<!-- task=m-iop-agent-chronos-extraction-decoupling/05+03,04_handoff_gate plan=0 tag=TEST -->

# Transfer receipt와 downstream lock handoff gate 확정

## For the Implementing Agent

`CODE_REVIEW-cloud-G09.md`의 implementation-owned 섹션 작성은 필수다. predecessor evidence와 실제 private bundle을 read-only로 감사하고 receipt를 작성한 뒤 임시 migration tooling을 제거한다. 검증의 실제 출력만 기록하고 active pair를 유지해 review 준비 완료를 보고한다. Chronos repository/lock/roadmap을 수정하거나 finalization하지 않는다. 외부 artifact가 없으면 정확한 preflight blocker와 재개 조건만 implementation-owned evidence에 남긴다.

## Background

마지막 task는 source/state bundle, IOP 제거, neutral Node 회귀를 하나의 추적 가능한 receipt로 묶고 downstream lock identity를 검증한다. 이 task의 PASS는 Chronos 구현을 직접 시작하거나 lock을 해제하는 행위가 아니라, 이후 Milestone 완료 검토가 인용할 수 있는 immutable evidence를 만드는 gate다. 현재 작업 checkout 이름은 `iop-s1`이지만 workspace lock의 선행 target은 정식 프로젝트 identity `iop:`이므로, 정식 checkout 반영 전에는 둘을 같은 identity로 간주하지 않는다.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md)
- Task ids:
  - `handoff-gate`: 전체 state 이전, 양쪽 검증, rollback, downstream lock identity를 포함한 receipt 확정
- Completion mode: check-on-pass

## Analysis

### Files Read

- `agent-roadmap/ROADMAP.md`
- `agent-roadmap/priority-queue.md`
- `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`
- `/config/workspace/.agent-roadmap-sync/locks.yaml`
- `HANDOFF.md`
- `README.md`
- `/config/workspace/chronos/agent-roadmap/current.md`
- `/config/workspace/chronos/agent-roadmap/phase/runtime-ownership-transition/milestones/chronos-architecture-ownership-boundary.md`
- `/config/workspace/chronos/agent-roadmap/sdd/runtime-ownership-transition/chronos-architecture-ownership-boundary/SDD.md`
- `/config/workspace/chronos/go.mod`

### SDD Criteria

- SDD 상태 `[승인됨]`, 잠금 `해제`; target S05 / Task `handoff-gate`.
- Evidence Map: full state fixture, final cross-repo matrix, lock check, Roadmap Completion에서 인용 가능한 receipt.
- State machine의 `decoupled -> handoff-ready`는 IOP no-workflow 상태, neutral Node regression, final validation을 모두 요구한다.
- receipt는 source revision, bundle/item digest, state category counts/quarantine, predecessor completion, IOP removal/Node tests, rollback revision, downstream lock identity를 연결해야 한다.

### Verification Context

- Handoff 없음. predecessors `03+02_decouple`, `04+02,03_retain_node` exact completion은 현재 missing이다.
- Local rules state usable; receipt/schema/reference scans와 fresh Go/Flutter results는 predecessor evidence를 재검증한다.
- External Verification Preflight:
  - IOP repo: current workspace, expected branch/HEAD and clean source result after predecessors.
  - canonical IOP repo: `/config/workspace/iop`, current milestone/HEAD read-only capture, current task commit의 merge/reachability 여부와 `iop:` lock target 일치 여부.
  - Chronos repo: `/config/workspace/chronos`, expected locked milestone, no source import, branch/HEAD/dirty state read-only capture.
  - private bundle: transfer task가 기록한 owner-only durable path와 digest; state payload 원문·device path·credential은 읽어 receipt에 복사하지 않는다.
  - blocker: artifact path unavailable, digest mismatch, predecessor evidence ambiguity, 정식 `iop` checkout으로의 반영 경로 불명확, 또는 lock identity 오인이 있으면 PASS를 금지한다.
- Actual Chronos import/build is not run because workspace lock is intentionally active. The accepted bundle’s isolated staging test is the “other side” verification for this IOP milestone.
- Known downstream drift: the locked Chronos sketch/SDD still describes a selective transfer and IOP-retained finite provider runtime. The receipt must flag that wording for correction after unlock so it does not override approved IOP decisions D01/D02.
- Confidence: high for repository/lock audit, medium until predecessor and private artifact evidence exists.

### Test Coverage Gaps

- Receipt is evidence aggregation, not product behavior; no new unit test.
- Tampered/missing bundle is checked by digest and item count; sensitive leakage by deterministic scan.
- Chronos final import/build remains downstream and must not be misreported as completed here.

### Symbol References

- Remove temporary command `cmd/iop-chronos-transfer` and three migration fixture/input files only after receipt audit.
- Remove unindexed legacy `agent-contract/inner/iop-agent-cli-runtime.md` after its digest and bundle presence are in the receipt.
- No runtime symbol changes.

### Split Judgment

- Stable contract: one redacted receipt proves S01-S04 evidence closure and identifies the still-locked downstream acceptance owner.
- Predecessors `03`, `04`: exact active/archived `complete.log` both missing; implementation cannot start.
- PASS evidence: receipt matrix complete, digest match, IOP residual scan clean, `iop-s1`과 lock target `iop:`의 차이 및 정식 반영 조건이 명시됨, no Chronos writes, temporary migration files removed.

### Scope Rationale

- Does not check/close the Milestone itself, run `complete-milestone`, unlock Chronos, or start Chronos implementation.
- Does not rewrite `iop:` to `iop-s1:` in the workspace lock or report lock synchronization before the reviewed commit is promoted to the canonical `/config/workspace/iop` milestone.
- Does not import/activate state in Chronos.
- Does not record private bundle path, device roots, credentials, raw state, or client process records in tracked receipt.

### Final Routing

- `evaluation_mode=first-pass`, finalizer=`finalize-task-policy.sh`, mode=`pair`.
- Build closures 모두 true. Scores=`2,1,2,2,2`, grade=`G09`, base/route=`grade-boundary`, lane=`cloud`.
- Review scores=`2,1,2,2,2`, route=`official-review`, lane=`cloud`, grade=`G09`.
- `large_indivisible_context=false`; loop risk=`boundary_contract` (1); `review_rework_count=0`; `evidence_integrity_failure=false`; capability gap 없음.
- Canonical files: `PLAN-cloud-G09.md`, `CODE_REVIEW-cloud-G09.md`.

## Dependencies and Execution Order

1. `03+02_decouple` and `04+02,03_retain_node` must each have exactly one matching PASS `complete.log`; both are currently missing.
2. Resolve and read only the exact predecessor completion/evidence paths.
3. Verify private bundle digest and isolated staging result, then write the receipt.
4. Prove the current checkout identity is `iop-s1`, the lock target remains `iop:`, and the exact reviewed commit has an explicit canonical-promotion condition; do not alias the repositories implicitly.
5. Remove temporary exporter/fixtures and legacy active contract surface.
6. Run final IOP/lock/read-only audit. Do not unlock or mutate Chronos.

## Implementation Checklist

- [ ] Refuse to start until predecessors `03+02_decouple` and `04+02,03_retain_node` each have an exact PASS `complete.log` and the transfer bundle is accessible with its recorded digest.
- [ ] Build a redacted S01-S05 evidence matrix covering source revision, manifest count/digest, full-state categories/quarantine, staging behavior, IOP removal, neutral Node regression, rollback, downstream lock identity, and the locked Chronos sketch/SDD wording drift that must be corrected after unlock.
- [ ] Verify the Chronos checkout and lock read-only; record that actual import/layout/activation remains blocked until the reviewed commit is promoted to canonical `/config/workspace/iop` and that `iop-s1:` must not be treated as the lock target `iop:`.
- [ ] Remove temporary transfer exporter/fixtures/manifest and the unindexed legacy standalone contract only after their bundle presence and digests are recorded; update current README/HANDOFF and reconcile SDD pointers through `roadmap-sdd` without exposing private paths.
- [ ] Run final residual, sensitive-data, digest, repository status, and lock audits; record exact output and leave lock mutation to Milestone completion routing.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [TEST-1] S01-S04 evidence matrix와 receipt

**Problem**

개별 `complete.log`와 task logs만으로는 source/state/bundle/removal/Node result를 하나의 rollback 및 downstream acceptance chain으로 감사하기 어렵다.

```text
# SDD.md:90
S05 expects a Roadmap Completion-citable transfer receipt.
```

**Solution**

receipt에 stable identifiers와 redacted values만 기록한다: IOP revision, task names/completion logs, manifest row count/digest, bundle/item digest, state category counts, quarantined broken record count with `resumable=false`, verification commands/results, rollback revision, lock id/path/status. Private paths와 raw state는 `withheld-owner-local`로 표기한다.

```text
# after: transfer-receipt.md
source_revision: 3155be0e...
bundle_sha256: <digest>
state_payload_location: withheld-owner-local
downstream_lock: chronos:chronos-architecture-ownership-boundary
downstream_drift: locked Chronos sketch must absorb approved D01/D02 after unlock
```

**Modified Files and Checklist**

- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03,04_handoff_gate/transfer-receipt.md` — S01-S05 matrix and stable evidence.

**Test Strategy**

- Unit test는 생략한다. receipt field completeness와 digest recheck를 shell audit로 검증한다.

**Verification**

- `rg -n '^source_revision: 3155be0e275437a8eedc1aa93497955a7d30465b$|^bundle_sha256: [0-9a-f]{64}$|^downstream_lock: chronos:chronos-architecture-ownership-boundary$|^state_payload_location: withheld-owner-local$' agent-task/m-iop-agent-chronos-extraction-decoupling/05+03,04_handoff_gate/transfer-receipt.md` — required stable fields present.
- Recompute the private archive SHA-256 without printing its path or contents and compare to receipt; exact non-secret output goes in `handoff-audit.log`.

### [TEST-2] Downstream lock/read-only cross-repo audit

**Problem**

Chronos workspace는 IOP completion 전 구현 잠금 상태여야 하고 handoff task가 직접 unlock/import하면 ownership 순서를 위반한다.

```text
# Chronos Milestone:18, implementation lock
IOP predecessor must be 검토중 or 완료 before Chronos work.
```

**Solution**

Chronos HEAD/branch/dirty state, current milestone, lock id/status를 read-only로 캡처한다. 동시에 현재 checkout과 `/config/workspace/iop`의 root/HEAD를 각각 기록하고, lock checker가 `iop-s1:`에는 `none`, `iop:`에는 해당 `rely-on`을 반환하는지 확인한다. receipt에는 canonical promotion이 완료되기 전 `rely-on.status`를 동기화하거나 Chronos를 해제할 수 없다는 release condition을 쓰고 Chronos file SHA before/after가 동일함을 확인한다.

```text
# after audit
chronos_lock=locked
chronos_source_mutation=0
source_checkout_identity=iop-s1
lock_predecessor_identity=iop
release_condition=reviewed commit promoted to canonical iop, then milestone review/complete
```

**Modified Files and Checklist**

- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03,04_handoff_gate/handoff-audit.log` — read-only preflight, lock, digest, residual output.

**Test Strategy**

- Chronos source tests/import는 잠금 때문에 생략하고 isolated bundle evidence를 인용한다. checkout mutation 0을 hash/status로 검증한다.

**Verification**

- `git -C /config/workspace/chronos status --short && git -C /config/workspace/chronos rev-parse --abbrev-ref HEAD && git -C /config/workspace/chronos rev-parse HEAD` — exact checkout evidence.
- `rg -n 'chronos:chronos-architecture-ownership-boundary|status: locked|잠금' /config/workspace/.agent-roadmap-sync/locks.yaml /config/workspace/chronos/agent-roadmap/current.md /config/workspace/chronos/agent-roadmap/phase/runtime-ownership-transition/milestones/chronos-architecture-ownership-boundary.md` — lock identity/status/release condition confirmed.
- `git rev-parse --show-toplevel HEAD && git -C /config/workspace/iop rev-parse --show-toplevel HEAD && agent-ops/bin/roadmap-dependency-checker.sh --find-milestone 'iop-s1:agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md' both /config/workspace/.agent-roadmap-sync/locks.yaml && agent-ops/bin/roadmap-dependency-checker.sh --find-milestone 'iop:agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md' both /config/workspace/.agent-roadmap-sync/locks.yaml` — distinct checkout/lock identities and canonical promotion gate captured; expected checker lines are `none` then `rely-on:chronos:chronos-architecture-ownership-boundary`.

### [TEST-3] Temporary migration surface 제거와 final pointers

**Problem**

exporter, input manifest, fixture, standalone contract를 남기면 IOP active tree에 Agent migration/runtime surface가 계속 존재한다.

```text
# Milestone goal
all related IOP source/runtime/config/contract surfaces are removed after handoff.
```

**Solution**

receipt가 bundle presence/digest를 확정한 뒤 temporary source/fixtures와 unindexed standalone contract를 삭제한다. `HANDOFF.md`, `README.md`, SDD Interface Contract pointer는 final receipt/bundle ownership과 downstream acceptance만 설명하게 갱신한다. SDD 변경은 `roadmap-sdd` 규칙을 거쳐 승인 결정 D01/D02를 바꾸지 않는다.

```text
# after
cmd/iop-chronos-transfer: absent
scripts/fixtures/iop-agent-chronos-*: absent
agent-contract/inner/iop-agent-cli-runtime.md: absent
```

**Modified Files and Checklist**

- [ ] `cmd/iop-chronos-transfer/main.go` — delete.
- [ ] `cmd/iop-chronos-transfer/main_test.go` — delete.
- [ ] `scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv` — delete after receipt digest.
- [ ] `scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json` — delete after bundle evidence.
- [ ] `scripts/fixtures/iop-agent-chronos-transfer-state-v1.json` — delete after bundle evidence.
- [ ] `agent-contract/inner/iop-agent-cli-runtime.md` — delete after bundle digest/reference capture.
- [ ] `README.md` — current IOP boundary only.
- [ ] `HANDOFF.md` — final receipt/downstream acceptance entrypoint only.
- [ ] `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md` — replace removed contract pointer with immutable receipt/bundle evidence description; preserve D01/D02.
- [ ] `scripts/readability_baseline.json` — remove temporary/legacy read entries.
- [ ] `scripts/readability_read_sets.json` — remove temporary/legacy read entries.

**Test Strategy**

- no new tests; exact path absence, active pointer validity, full Go/readability audit.

**Verification**

- `test ! -e cmd/iop-chronos-transfer && test ! -e scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv && test ! -e scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json && test ! -e scripts/fixtures/iop-agent-chronos-transfer-state-v1.json && test ! -e agent-contract/inner/iop-agent-cli-runtime.md`
- `go test -count=1 ./...`
- `make readability-audit`

### [TEST-4] Final residual/sensitive/closure audit

**Problem**

receipt가 완전해도 active source residual이나 sensitive value가 남으면 handoff-ready가 아니다.

```text
# State machine: decoupled -> handoff-ready
final receipt + lock synchronization evidence
```

**Solution**

active product/contract/spec/rule paths의 standalone workflow residual, Chronos application import, task artifact sensitive patterns, broken active links를 검사한다. governance Milestone/SDD/receipt의 historical names는 exact allowed references로 기록한다.

```text
# after: handoff-audit.log
active_runtime_residuals=0
sensitive_receipt_fields=0
chronos_mutations=0
lock_identity_match=1
canonical_promotion_pending_is_explicit=1
```

**Modified Files and Checklist**

- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03,04_handoff_gate/handoff-audit.log` — final exact outputs.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03,04_handoff_gate/CODE_REVIEW-cloud-G09.md` — actual evidence.

**Test Strategy**

- deterministic scans and fresh Go/readability checks; no cached result.

**Verification**

- `test -z "$(rg --sort path -n 'apps/agent|packages/go/agent(runtime|provider|task|state|config|guard|policy|workspace)|IopAgentPanel|iop-agent (serve|task-loop)|git\.toki-labs\.com/toki/chronos' apps packages cmd configs proto agent-contract agent-spec agent-ops/rules/project README.md)"`
- `test -z "$(rg --sort path -n '/home/|/Users/|state_root: /|overlay_root: /|token:|credential:|secret:|private_key:' agent-task/m-iop-agent-chronos-extraction-decoupling/05+03,04_handoff_gate)"`
- `git diff --check`

## Modified Files Summary

| File | Item |
|------|------|
| `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03,04_handoff_gate/transfer-receipt.md` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03,04_handoff_gate/handoff-audit.log` | TEST-2, TEST-4 |
| `cmd/iop-chronos-transfer/main.go` | TEST-3 |
| `cmd/iop-chronos-transfer/main_test.go` | TEST-3 |
| `scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv` | TEST-3 |
| `scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json` | TEST-3 |
| `scripts/fixtures/iop-agent-chronos-transfer-state-v1.json` | TEST-3 |
| `agent-contract/inner/iop-agent-cli-runtime.md` | TEST-3 |
| `README.md` | TEST-3 |
| `HANDOFF.md` | TEST-3 |
| `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md` | TEST-3 |
| `scripts/readability_baseline.json` | TEST-3 |
| `scripts/readability_read_sets.json` | TEST-3 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03,04_handoff_gate/CODE_REVIEW-cloud-G09.md` | TEST-4 |

## Final Verification

1. Confirm exact PASS `complete.log` for `03+02_decouple` and `04+02,03_retain_node`, and resolve exact transfer evidence through their predecessor chain.
2. Recompute the private bundle digest without exposing its path/content and compare it with `transfer-receipt.md`.
3. `rg -n '^source_revision: 3155be0e275437a8eedc1aa93497955a7d30465b$|^bundle_sha256: [0-9a-f]{64}$|^downstream_lock: chronos:chronos-architecture-ownership-boundary$|^state_payload_location: withheld-owner-local$' agent-task/m-iop-agent-chronos-extraction-decoupling/05+03,04_handoff_gate/transfer-receipt.md`
4. `git -C /config/workspace/chronos status --short && git -C /config/workspace/chronos rev-parse --abbrev-ref HEAD && git -C /config/workspace/chronos rev-parse HEAD`
5. `rg -n 'chronos:chronos-architecture-ownership-boundary|status: locked|잠금' /config/workspace/.agent-roadmap-sync/locks.yaml /config/workspace/chronos/agent-roadmap/current.md /config/workspace/chronos/agent-roadmap/phase/runtime-ownership-transition/milestones/chronos-architecture-ownership-boundary.md`
6. `test ! -e cmd/iop-chronos-transfer && test ! -e scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv && test ! -e scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json && test ! -e scripts/fixtures/iop-agent-chronos-transfer-state-v1.json && test ! -e agent-contract/inner/iop-agent-cli-runtime.md`
7. `go test -count=1 ./...`
8. `make readability-audit`
9. `test -z "$(rg --sort path -n 'apps/agent|packages/go/agent(runtime|provider|task|state|config|guard|policy|workspace)|IopAgentPanel|iop-agent (serve|task-loop)|git\.toki-labs\.com/toki/chronos' apps packages cmd configs proto agent-contract agent-spec agent-ops/rules/project README.md)"`
10. `test -z "$(rg --sort path -n '/home/|/Users/|state_root: /|overlay_root: /|token:|credential:|secret:|private_key:' agent-task/m-iop-agent-chronos-extraction-decoupling/05+03,04_handoff_gate)"`
11. `git diff --check`

All repository tests are fresh; cached output is not acceptable. Chronos mutation/import is prohibited in this task.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
