<!-- task=m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual plan=1 tag=TEST milestone-task=hot-smoke -->

# Claude/Pi Hot Path actual smoke closure

## For the Implementing Agent

구현 후 `CODE_REVIEW-cloud-G07.md`의 구현 담당 섹션에 실제 Make/preflight/external 출력과 manifest 경로를 채우고 active 파일을 유지한다. 외부 환경이 없으면 exit 69의 정확한 blocker와 재개 조건만 기록하며 PASS를 주장하거나 archive/`complete.log`를 작성하지 않는다.

## Background

Child 20 harness를 stable Make targets에 연결하고 matching source/runtime에서 Claude/Pi 10-case evidence를 생성해야 S16이 닫힌다. 현재 dev inventory는 Pi profile만 configured이고 Claude는 `not_configured`이므로, 현 상태의 actual PASS는 외부 Claude auth/profile과 matching Hot Path runtime evidence가 공급될 때까지 차단되어 있다.

## Archive Evidence Snapshot

- 이전 active plan/review pair는 구현 전에 source reanalysis로 대체됐다. 구현 evidence와 verdict는 없다.

## Analysis

### Files Read

- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`
- `Makefile`
- `agent-test/local/rules.md`
- `agent-test/local/edge-smoke.md`
- `agent-test/dev/edge-smoke.md`
- `agent-test/inventory-agent.yaml`

### SDD Criteria

- 승인 SDD S16: actual Claude/Pi streaming, five scenarios each, workspace/artifact before/after, correlated observation and cleanup/orphan evidence, matching runtime/source identity, zero secret matches.

### Verification Context

- `/config/.npm-global/bin/claude`와 `/config/.npm-global/bin/pi`는 존재한다. Dev inventory상 Claude status=`not_configured`; Pi provider `iop`은 configured다.
- Claude는 `--bare` actual mode에서 out-of-band `ANTHROPIC_API_KEY` 또는 equivalent approved auth가 필요하며 값은 출력/manifest에 포함하면 안 된다.
- matching active runtime, four aliases, runtime evidence, observation log, disposable workspace parent, output path가 모두 필요하다.

### Test Coverage Gaps

- stable Make entry points와 actual two-agent 10-row manifest가 없다.

### Symbol References

- none.

### Split Judgment

- stable contract: child 20 harness → Make integration + actual S16 evidence. Harness implementation은 predecessor에 유지한다.

### Scope Rationale

- CLI/config patching, credential 생성/저장, shared runtime 배포/종료, tracked smoke output은 제외한다. 실제 credentialed target은 `test-e2e`에 넣지 않는다.

### Final Routing

- evaluation_mode=isolated-reassessment, finalizer=`finalize-task-policy.sh pair`.
- build scores=1/1/1/2/2, risks=`boundary_contract,variant_product`(2), local-fit → `PLAN-local-G07.md`.
- review → `CODE_REVIEW-cloud-G07.md`; `large_indivisible_context=false`, recovery=0/false. 현재 외부 미구성은 exact resume condition을 가진 verification blocker다.

## Implementation Checklist

- [ ] [TEST-1] Add separate harness self-test, external preflight, and actual smoke Make targets without exposing secrets or joining credentialed execution to `test-e2e`.
- [ ] [TEST-2] Run local/common checks and the actual Claude/Pi 10-case smoke; if current external requirements remain missing, record exit 69 and exact safe resume inputs/command without claiming PASS.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [TEST-1] Make integration

**Problem:** no stable entry point separates credential-free harness validation from external preflight and actual execution.

**Solution:** Add `test-hot-path-agent-smoke-self-test`, `test-hot-path-agent-smoke-preflight`, and `test-hot-path-agent-smoke`. Forward caller-supplied variables without echoing values, preserve harness exit codes, and keep external targets out of aggregate local/e2e targets.

**Modified Files and Checklist:**

- [ ] Modify `Makefile` with the three child-20 harness targets and no credential literals/defaults.

**Test Strategy:** self-test exits 0; missing external inputs produce exit 69 before agent invocation.

**Verification:** `make test-hot-path-agent-smoke-self-test` exits 0.

### [TEST-2] Actual S16 evidence or exact blocker

**Problem:** fake fixtures cannot prove Claude/Pi consume the real Hot Path stream or that real workspace/observation/cleanup behavior matches S16.

**Solution:** Compute the scoped source fingerprint, verify it against runtime binary/config/fixture evidence, run preflight, then run the 10-row matrix against a disposable workspace. Validate schema, all expected verdicts, native visible events/terminal, observation correlation, workspace/artifact before/after, cleanup/orphan result, and zero secret matches. If Claude auth/profile or matching runtime inputs are still unavailable, record the exact non-secret missing names and exit 69 output plus a resume command; do not mark actual smoke complete.

**Modified Files and Checklist:**

- [ ] Record Make output, scoped fingerprint check, preflight, actual manifest summary/path, or exact blocker evidence in `agent-task/m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual/CODE_REVIEW-cloud-G07.md`.

**Test Strategy:** actual external run is mandatory for PASS; preflight blocker is valid BLOCKED evidence only.

**Verification:** run Final Verification and validate the output manifest with child 20 schema.

## Dependencies and Execution Order

1. Directory dependency `20` must produce `agent-task/m-iop-hot-path-one-shot-execution/20+17,19_smoke_harness/complete.log`.
2. Implement TEST-1, then TEST-2.

## Modified Files Summary

| File | Item |
|---|---|
| `Makefile` | TEST-1 |
| `agent-task/m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual/CODE_REVIEW-cloud-G07.md` | TEST-2 |

## Final Verification

Local:

```bash
make test-hot-path-agent-smoke-self-test
go test -race -count=1 ./packages/go/streamgate ./packages/go/config ./apps/edge/internal/openai ./apps/edge/internal/service
git diff --check
```

External after all required inputs are supplied out-of-band:

```bash
test -n "${IOP_HOT_SMOKE_BASE_URL:-}" && test -n "${IOP_HOT_SMOKE_DIRECT_MODEL:-}" && test -n "${IOP_HOT_SMOKE_PASS_MODEL:-}" && test -n "${IOP_HOT_SMOKE_REPAIR_MODEL:-}" && test -n "${IOP_HOT_SMOKE_SLOW_MODEL:-}" && test -n "${IOP_HOT_SMOKE_PI_PROVIDER:-}" && test -n "${PI_CODING_AGENT_DIR:-}" && test -n "${ANTHROPIC_API_KEY:-}" && test -n "${IOP_HOT_SMOKE_RUNTIME_EVIDENCE:-}" && test -n "${IOP_HOT_SMOKE_OBSERVATION_FILE:-}" && test -n "${IOP_HOT_SMOKE_WORKSPACE_PARENT:-}" && test -n "${IOP_HOT_SMOKE_OUTPUT:-}"
IOP_HOT_SMOKE_SOURCE_FINGERPRINT="$(git ls-files --cached --others --exclude-standard -- apps/edge packages/go/streamgate packages/go/config go.mod go.sum | LC_ALL=C sort | while IFS= read -r path; do printf '%s\0%s\n' "$path" "$(git hash-object --no-filters "$path")"; done | git hash-object --stdin)"
export IOP_HOT_SMOKE_SOURCE_FINGERPRINT
jq -e --arg fingerprint "$IOP_HOT_SMOKE_SOURCE_FINGERPRINT" '.source_fingerprint == $fingerprint and (.binary_sha256 | type == "string" and length > 0) and (.config_sha256 | type == "string" and length > 0) and (.fixture_revision | type == "string" and length > 0)' "$IOP_HOT_SMOKE_RUNTIME_EVIDENCE"
make test-hot-path-agent-smoke-preflight
make test-hot-path-agent-smoke
jq -e '.schema_version == 1 and (.cases | length == 10) and all(.cases[]; .verdict == "pass") and (.redaction.secret_matches == 0)' "$IOP_HOT_SMOKE_OUTPUT"
```

Expected: local commands exit 0. External PASS requires matching runtime identity and 10 valid rows with zero secret matches. Exit 69 or current Claude `not_configured` state is BLOCKED evidence, never PASS.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
