# Resolved User Review - m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence

## 요청 일시

2026-07-30

## 상태

USER_REVIEW

## 사유

- 유형: external-execution
- 연결 대상: non-interactive SSH runner `ssh toki@toki-labs.com`, workdir `/Users/toki/agent-work/iop-dev`, authenticated Edge `/v1/models` preflight and S07 live smoke
- 현재 리뷰 회차: 1
- 최종 판정: FAIL
- 요약: The required authenticated S07 verification cannot start because neither approved remote credential source is available to the declared runner. Repository changes cannot supply or reconstruct the raw principal credential.

## 루프 이력

| Plan | Review | Verdict | 메모 |
|------|--------|---------|------|
| `plan_cloud_G08_0.log` | `code_review_cloud_G08_0.log` | FAIL | The authenticated preflight stopped with a missing credential source before any live invocation. |

## 차단 근거

- 문제: The authenticated S07 invocation, sanitized summary, and cleanup evidence required by OFR-S07-REMOTE-AUTH-0-2 and SDD S07 are absent.
- 현재 archive plan: `plan_cloud_G08_0.log`
- 현재 archive review: `code_review_cloud_G08_0.log`
- 검증 명령: Exact OFR-S07-REMOTE-AUTH-0-1 read-only preflight from `plan_cloud_G08_0.log`, rerun by the official reviewer.
- 실제 출력: exit status `42`; `remote_preflight=BLOCKED auth_source=missing invocation_count=0`
- 차단 판단 근거: The declared runner, transport, workdir, and safe credential lookup were reached successfully, but neither `IOP_OPENAI_API_KEY` nor a readable approved file named by `IOP_OPENAI_SMOKE_API_KEY_FILE` was available. The raw credential is user/operator-controlled, cannot be derived from the stored SHA-256 mapping, and no authorized automatic credential source remains.

## 사용자 조치 또는 결정

- [x] Securely provision an active raw principal credential to the declared non-interactive runner through `IOP_OPENAI_API_KEY` or a protected host-local SOPS source. Do not place the credential in chat, tracked files, task artifacts, or command output.

## 해결 근거

- Resolved at: 2026-07-30.
- Approved credential source: `/Users/toki/.config/iop/secrets/dev-openai-toki.sops.yaml` on `toki-labs.com`, protected with mode `0600` and decrypted only through the host-local age key.
- Active principal mapping: `user:toki`, alias `toki`, token references `toki-dev-pi` and `toki-dev-cline`.
- Rotation verification: both newly issued tokens returned HTTP `200` from `/v1/models`; both superseded tokens returned HTTP `401`.
- Non-interactive runner preflight: `dev_openai_auth_preflight=PASS token_ref=toki-dev-pi status=200`.
- Secret handling: raw token values were omitted from command output and task artifacts, and no raw value was written to tracked repository files.
- Remaining execution condition: the credential blocker is resolved. S07 still requires the original Ornith capacity contract of OneXPlayer `3` plus RTX5090 `1`; the user directed this task not to recover or restart RTX5090 automatically. If that provider is unavailable, the next plan must stop before live invocation and report `invocation_count=0`.

## 재개 조건

- The approved SOPS credential source is now visible to the non-interactive SSH session without revealing its value. Resume this exact task through an external-verification replan; the full preflight must return `remote_preflight=PASS ... auth=PASS` and confirm all four contracted Ornith slots before exactly one fresh 5-concurrent by 3-run S07 invocation is authorized and started.
- Completion still requires the sanitized S07 summary and cleanup assertions from `plan_cloud_G08_0.log`. Provisioning access alone does not resolve this stop as PASS.

## 다음 실행 힌트

- After the required user action is complete, invoke the plan workflow for `m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence`. It must archive this stop as `user_review_0.log`, revalidate the current remote identities, and prepare the single authorized external verification without carrying forward a preferred lane or grade.

## 종료 규칙

- If recorded user action and supplied final evidence directly satisfy every archived acceptance criterion, update this file to a resolved state, write `complete.log` from `agent-ops/skills/common/code-review/templates/complete-log-template.md`, and archive the task directory.
- If new implementation or verification execution is required, the plan workflow archives `USER_REVIEW.md` to `user_review_N.log` before writing a new routed `PLAN-*-G??.md` / `CODE_REVIEW-*-G??.md` pair.
