<!-- task=m-iop-agent-cli-runtime/17+13_project_log_records plan=1 tag=API -->

# Code Review Reference - API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is mandatory.**
> Fill implementation evidence and actual outputs, then stop with active files in place. Review finalization is not an implementation action.

## Overview

date=2026-07-29
task=m-iop-agent-cli-runtime/17+13_project_log_records, plan=1, tag=API

## For the Review Agent

> **[REVIEW AGENT ONLY]** Implementing agents must not execute finalization.

Compare source and actual evidence. Append verdict/signals; archive `CODE_REVIEW-cloud-G08.md` → `code_review_cloud_G08_1.log` and `PLAN-local-G08.md` → `plan_local_G08_1.log`; on PASS write `complete.log` and archive the task; on WARN/FAIL materialize the next state.

## Implementation Item Completion

| Item | Status |
|------|--------|
| API-1 Records | [x] |

## Implementation Checklist

- [x] Define a versioned, bounded ProjectLogRecord and stable project/work/attempt/locator identity schema.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementing agents must not modify this checklist.

- [x] Append one verdict and verified routing signals.
- [x] Verify verdict, dimensions, and finding classifications.
- [x] Archive this review as `code_review_cloud_G08_1.log`.
- [x] Archive the plan as `plan_local_G08_1.log`.
- [x] Verify the Agent-Ops managed `.gitignore` block.
- [ ] If PASS, write canonical `complete.log` and leave no active Markdown files.
- [ ] If PASS, move this task directory to the dated archive and update this checklist there.
- [ ] If PASS, remove an empty split parent or prove siblings/files remain.
- [x] If WARN/FAIL, materialize the required next state without `complete.log`.

## Deviations from Plan

None

## Key Design Decisions

- Defined immutable `ProjectLogRecord` and `ArchiveManifest` schemas with explicit versioning (`RecordSchemaVersion = 1`, `ArchiveManifestSchemaVersion = 1`) in `apps/agent/internal/projectlog/record.go`.
- Preserved exact normalized identity types (`ProjectID`, `WorkspaceID`, `WorkUnitID`, `AttemptID`, `CommandID`, `LocatorRecord`) from `iop/packages/go/agenttask`.
- Implemented strict `Validate()` method enforcing bounded limits (`MaxMessageLength`, `MaxIDLength`, `MaxMetadataKeys`, `MaxMetadataValLen`, `MaxLocatorsCount`) and non-zero timestamp verification.
- Implemented rejection of secret tokens (bearer headers, `sk-`, `ghp_`, JWTs, private keys, password/secret/api_key patterns) and raw environment variable dumps (`PATH=`, `HOME=`, etc.) across message, metadata keys/values, route/quota reasons, and locator opaque strings.
- Implemented deterministic `NewArchiveManifest` creation and validation with SHA-256 record payload checksum calculation.

## Reviewer Checkpoints

- Record fields preserve exact project/work/attempt/locator identities.
- Validation is versioned, bounded, and rejects secrets, raw environment, and raw provider output.
- Archive manifest types remain immutable and deterministic.

## Verification Results

### Formatting

```bash
gofmt -w apps/agent/internal/projectlog/record.go apps/agent/internal/projectlog/record_test.go
```

Output:
```
(clean exit, code 0, no output)
```

### Focused tests

```bash
go test -count=1 ./apps/agent/internal/projectlog -run 'TestRecord'
```

Output:
```
ok  	iop/apps/agent/internal/projectlog	0.004s
```

### Static checks

```bash
go vet ./apps/agent/internal/projectlog
git diff --check
```

Output:
```
(clean exit, code 0, no output)
```

---

> **[IMPLEMENTING AGENT — BEFORE SAVING]** Fill every implementation-owned section and leave review-only content unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header, Overview, Review Instructions | Fixed | Implementer must not modify |
| Implementation Item Completion, Implementation Checklist | Implementing agent | Check status only |
| Review-Only Checklist | Review agent | Implementer must not modify |
| Deviations, Decisions, Verification Results | Implementing agent | Record actual evidence |
| Reviewer Checkpoints | Fixed | Reviewer verifies them |
| Code Review Result and finalization | Review agent | Append/execute only after review |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail
  - Completeness: Fail
  - Test coverage: Fail
  - API contract: Fail
  - Code quality: Pass
  - Implementation deviation: Fail
  - Verification trust: Pass
  - Spec conformance: Fail
- Findings:
  - Required — `apps/agent/internal/projectlog/record.go:155`: `ProjectLogRecord.Validate` checks only locator count plus `Opaque` length/content, so it accepts an unsupported locator kind and a locator whose project/workspace/work/attempt identity disagrees with the enclosing record. Validate every typed locator field, require the applicable revision and identities, enforce exact parent identity matches, and add negative matrix cases for kind and each identity drift.
  - Required — `apps/agent/internal/projectlog/record.go:133`: route and quota validation does not enforce bounded IDs, a closed safe status vocabulary, or a non-zero observation time; an oversized `ModelID` plus an arbitrary quota status with a zero timestamp is accepted. Replace arbitrary status/diagnostic inputs with bounded safe projections or strict enums, validate every route identity/reason field, and add boundary and malformed-status tests that cannot admit provider-native raw output.
  - Required — `apps/agent/internal/projectlog/record.go:231`: `NewArchiveManifest` validates records individually but never binds them to the manifest project/workspace or verifies ordered, non-duplicated sequences and terminal closure. It therefore creates a `proj-001` manifest containing an `other-project` record. Enforce exact archive membership and sequence/terminal invariants before hashing, and cover cross-project, cross-workspace, duplicate/out-of-order, and terminal-mismatch cases.
- Routing Signals:
  - `review_rework_count=1`
  - `evidence_integrity_failure=false`
- Next Step: Create a freshly routed WARN/FAIL follow-up plan from these raw findings and verification results; do not write `complete.log`.
