<!-- task=m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence plan=3 tag=REVIEW_OFR-S07-CP-REDEPLOY-3 -->

# Refresh the dev Control Plane before one isolated S07 run

## For the Implementing Agent

Filling every implementation-owned section in `CODE_REVIEW-cloud-G10.md` is mandatory. Run the verification exactly once within its stated mutation boundaries, record actual sanitized output and exit status, keep the active PLAN/CODE_REVIEW pair in place, and report ready for official review.

If blocked, record only the exact blocker, attempted commands/output, invocation count, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, write `complete.log`, or modify roadmap state.

Starting the implementation loop authorizes one rebuild/recreate of the dev Control Plane compose service from the pinned clean source and at most one new S07 model invocation after every gate passes. It does not authorize an Edge restart/config apply, provider recovery, config edit, credential rotation, or reuse/deletion of prior artifacts. Keep the Go test in the caller-owned foreground session until terminal exit and never retry it after process start.

## Background

The previous packet performed its one allowed no-change Edge config apply, but the Control Plane status still returned four connected nodes and zero provider snapshots, so no model call was made. Fresh review probes show both Windows provider stacks ready and Edge-connected while the running Control Plane container lacks the current `provider_snapshots` binary contract that exists in the pinned source and build artifact. The smallest safe continuation is to rebuild and recreate only that stale compose service, prove the restored `3+1` status contract, and then permit one new isolated foreground S07 run.

## Archive Evidence Snapshot

- `plan_cloud_G08_0.log` / `code_review_cloud_G08_0.log`: authentication blocker; `invocation_count=0`.
- `plan_cloud_G08_1.log` / `code_review_cloud_G08_1.log`: one consumed incomplete invocation; four SSE files, no summary, incomplete cleanup.
- `user_review_1.log`: resolved authorization/replan boundary, cancelled replacement cleanup, and the first zero-provider-snapshot diagnosis.
- `plan_cloud_G09_2.log` / `code_review_cloud_G09_2.log`: one no-change Edge apply did not restore the status contract; `invocation_count=0`. Review found a stale Control Plane container and a blocked-reporting command defect.
- Preserve `/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-1` and `/tmp/iop-repeat-guard-live/repeat-guard-task-03-direct-2`. Neither is accepted S07 evidence. Keep the plan-2 artifact path absent and use only the fresh plan-3 paths declared below.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md`
- Milestone link: [Milestone document](agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md)
- Task ids:
  - `repeat-guard`: rolling content/history/action repetition detection and safe continuation
- Completion mode: check-on-pass

## Analysis

### Files Read

- `docker-compose.yml`
- `.env.dev.example`
- `apps/control-plane/Dockerfile`
- `apps/control-plane/cmd/control-plane/http_views.go`
- `apps/control-plane/cmd/control-plane/edge_registry_handler_test.go`
- `apps/edge/internal/bootstrap/runtime.go`
- `apps/edge/internal/service/status_provider.go`
- `apps/edge/internal/service/model_queue_snapshot.go`
- `agent-contract/inner/control-plane-edge-wire.md`
- `agent-contract/inner/edge-config-runtime-refresh.md`
- `agent-contract/outer/openai-compatible-api.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/openai-compatible-output-validation-filters/SDD.md`
- `agent-test/dev/rules.md`
- `agent-test/dev/edge-smoke.md`
- `agent-test/dev/node-smoke.md`
- `agent-test/dev/control-plane-smoke.md`
- `agent-test/local/rules.md`
- `agent-test/local/edge-smoke.md`
- `agent-test/local/control-plane-smoke.md`
- `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/PLAN-cloud-G09.md`
- `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/CODE_REVIEW-cloud-G09.md`
- `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/code_review_cloud_G08_1.log`
- `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/user_review_1.log`

### SDD Criteria

- SDD: `agent-roadmap/sdd/knowledge-tool-optimization-extension/openai-compatible-output-validation-filters/SDD.md`; status `[approved]`; lock `unlocked`.
- Targeted acceptance: S03/S04 define deterministic `repeat-guard` continuation and safe-stop behavior. S07 supplies the live `ornith:35b`, `stream=true`, capacity+1, three-run operational evidence and accepts either a sanitized fingerprint/offset or `not_reproduced`.
- Evidence Map: S03/S04 require `repeat-guard` fixture evidence; the remaining packet-local gap is the S07 live capacity smoke. The broader S07 `ops-evidence` logging row is not claimed by this packet.
- The checklist therefore keeps current-source tests, provider/status gating, one 5-concurrent by 3-run invocation, 15 response/correlation cardinalities, three capacity rows, result classification, idle cleanup, and raw-free evidence in one gate. PASS reports only `repeat-guard`.

### Verification Context

- Handoff: current FAIL review plus repository-native read-only probes.
- Runner/workdir: `ssh toki@toki-labs.com`, `/Users/toki/agent-work/iop-dev`, Darwin/arm64, `/bin/zsh`; Windows status probes run directly from the current host as required by the dev inventory.
- Source: branch `feature/openai-compatible-output-validation-filters`, HEAD `750cb1d1cb88066a10d3c703c99f1326306d8e15`, clean checkout, test file SHA-256 `46261bb3a3000e00c27c419682f741c64c31c849d0aa30cbc024ed4531e7bfa6`.
- Runtime: compose project `iop-dev-agent`; Control Plane HTTP/Edge wire `18001/19002`; native Edge OpenAI/Node/refresh `18083/18084/19093`; Edge binary matches `build/dev-runtime/bin/edge`.
- Credential: remote SOPS file `/Users/toki/.config/iop/secrets/dev-openai-toki.sops.yaml`, age key `/Users/toki/.config/sops/age/keys.txt`, token ref `toki-dev-pi`; decrypt only in a `set +x` remote shell and never print token material.
- Fresh external preflight: both OneXPlayer and RTX5090 `remote-llm-toggle.ps1 -Action Status` calls returned `success=true`, `ready=true`, `health=ok`, correct model/profile/listener state, and `edge_connected=true`. No recovery action ran.
- Stale deployment evidence: live status remains `node_count=4 connected_count=4 provider_snapshot_count=0`; the running Control Plane container has zero `provider_snapshots` string hits while the current Control Plane build artifact has five and the matching Edge artifact has four. The Control Plane compose service must be rebuilt and force-recreated from the clean pinned checkout before S07.
- Setup: run the exact compose build/recreate command in item 1 once, preserve its remote build log, require the new container to expose the current contract, then wait for the native Edge to reconnect and report both providers healthy/idle at capacities `3+1`.
- Constraints: no Edge config apply/restart, provider Up/Down action, source/config edit, credential change, prior artifact deletion, detached harness, or model retry. Fresh plan-3 artifact and build-log paths must be absent before use.
- Gap/confidence: the deployment diagnosis is high confidence; the final repeat outcome remains probabilistic and must be reported as `reproduced` with a fingerprint/offset or `not_reproduced`.

### Test Coverage Gaps

- `TestEdgeRegistryHTTPHandlersGetLiveStatus` already asserts that `provider_snapshots` is serialized with capacity, queue, health, and raw-config secrecy; the previous remote focused package tests passed.
- Unit tests cannot prove that the currently running compose container was built from the pinned source. Container string inspection, force recreation, health/readiness, Edge reconnection, and live status assertions close that deployment gap.
- Only `TestDevRepeatGuardOrnithSmoke` proves the required full-capacity runtime cardinalities and cleanup. No synthetic summary or degraded-capacity substitute is accepted.

### Symbol References

- None. No source symbol or API is renamed, removed, or added.

### Split Judgment

- Keep the Control Plane replacement and S07 invocation in one follow-up packet. The model call is safe only against the exact post-recreate status generation, and its single-use artifact/invocation boundary cannot be independently retried after a detached child result.

### Scope Rationale

- The only workspace write is implementation evidence in `CODE_REVIEW-cloud-G10.md`.
- Remote mutation is limited to one rebuild/recreate of the `iop-dev-agent` Control Plane compose service and the fresh plan-3 harness artifacts. Existing Postgres/Redis state, native Edge, Nodes, providers, config, credentials, prior artifacts, source, and roadmap are excluded.
- If rebuild, reconnect, provider snapshots, authentication, or idle capacity fails, stop with `invocation_count=0`. Do not recover a provider, repeat a compose mutation, apply Edge config, or invoke the model.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer `finalize-task-policy.sh`, mode `pair`.
- Build closures: scope/context/verification/evidence/ownership/decision all true. Scores `2/2/2/2/2` produce G10 with base and final route basis `grade-boundary`.
- Review closures: scope/context/verification/evidence/ownership/decision all true. Scores `2/2/2/2/2` produce cloud G10 with route basis `official-review`.
- `large_indivisible_context=false`; matched loop risks: `temporal_state`, `concurrent_consistency`, `boundary_contract`, `structured_interpretation`; count 4.
- Recovery signals: `review_rework_count=3`, `evidence_integrity_failure=false`.
- Canonical files: `PLAN-cloud-G10.md` and `CODE_REVIEW-cloud-G10.md`; review adapter `codex`, model `gpt-5.6-sol`, reasoning effort `xhigh`.

## Implementation Checklist

- [ ] [REVIEW_OFR-S07-CP-REDEPLOY-3-1] Revalidate the pinned source and both ready provider hosts, run fresh focused tests, rebuild and force-recreate the stale dev Control Plane service exactly once, and require the current provider snapshot contract plus four connected nodes and healthy/idle OneXPlayer/RTX5090 capacities `3+1`.
- [ ] [REVIEW_OFR-S07-CP-REDEPLOY-3-2] Only after the complete post-redeploy gate passes, start exactly one caller-owned foreground 5-concurrent x 3-run S07 invocation on the fresh plan-3 artifact path, validate the raw-free summary and idle cleanup, and preserve every prior artifact.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_OFR-S07-CP-REDEPLOY-3-1] Replace the stale Control Plane runtime

#### Problem

Current source serializes `provider_snapshots` in `apps/control-plane/cmd/control-plane/http_views.go:144` and maps the protobuf field at line 246; `apps/control-plane/cmd/control-plane/edge_registry_handler_test.go:377` requires that JSON array. The live container has no corresponding binary string and returns zero snapshots while both provider hosts are ready. `apps/control-plane/Dockerfile:14` is the compose build boundary that must be rebuilt from the pinned checkout.

#### Solution

- Confirm both Windows provider stacks are already ready using direct read-only `-Action Status`; never run `Up`, `Down`, or default toggle.
- Recheck branch/HEAD/cleanliness, required ports, artifact isolation, Docker Compose availability, and fresh focused tests.
- Build the `control-plane` compose service once with `--no-cache`, preserve the build output under the declared remote temporary log, and force-recreate only that service.
- Require a new container identity, current `provider_snapshots` binary string, HTTP health/readiness, native Edge reconnection, and four connected nodes with OneXPlayer/RTX5090 healthy and idle at capacities `3+1`.
- On failure, print only sanitized counts/state and stop with `invocation_count=0`. Do not repeat the build/recreate or escalate to any other runtime mutation.

Before:

```text
provider_hosts=ready control_plane_contract_hits=0 node_count=4 connected_count=4 provider_snapshot_count=0
```

After:

```text
control_plane_redeploy_gate=PASS contract=current nodes=4 providers=3+1_idle invocation_count=0
```

#### Modified Files and Checklist

- [ ] `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/CODE_REVIEW-cloud-G10.md` - record direct provider readiness, pinned source/tests, the single Control Plane rebuild/recreate, restored snapshot contract, and exact exit status.
- [ ] No production source, tracked config, Edge/Node/provider process, credential, prior artifact, or roadmap change.

#### Test Strategy

Do not add tests: current source already has a direct HTTP serialization regression test and the previous packet ran the relevant packages successfully. Run the focused packages fresh with `-count=1`, then prove the deployed container/runtime contract directly.

#### Verification

Direct provider readiness:

```bash
ssh -o BatchMode=yes -o ConnectTimeout=15 r0bin@192.168.0.59 \
  'powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:/Users/r0bin/iop-field/remote-llm-toggle.ps1 -Action Status' |
  jq -e '.success == true and .state.ready == true and .state.health == "ok" and .state.model_loaded == true and .state.profile_valid == true and .state.listener_public == true and .state.edge_connected == true'

ssh -o BatchMode=yes -o ConnectTimeout=15 iop-dev-rtx5090 \
  'powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:/Users/r0bin/iop-field/remote-llm-toggle.ps1 -Action Status' |
  jq -e '.success == true and .state.ready == true and .state.health == "ok" and .state.model_loaded == true and .state.profile_valid == true and .state.listener_public == true and .state.edge_connected == true'
```

Expected: both commands exit 0 without changing provider state.

Pinned rebuild/recreate and status gate:

```bash
ssh -o BatchMode=yes -o ConnectTimeout=15 toki@toki-labs.com '/bin/zsh -lc "exec /bin/zsh -s"' <<'REMOTE'
set -euo pipefail
set +x
cd /Users/toki/agent-work/iop-dev

expected_head=750cb1d1cb88066a10d3c703c99f1326306d8e15
expected_test_hash=46261bb3a3000e00c27c419682f741c64c31c849d0aa30cbc024ed4531e7bfa6
test_file=apps/edge/internal/openai/stream_gate_vertical_slice_test.go
build_log=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-3-control-plane-build.log
artifact_dir=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-3
status_file=$(/usr/bin/mktemp -t iop-repeat-cp-status.XXXXXX)
trap '/bin/rm -f "$status_file"' EXIT

test "$(git branch --show-current)" = feature/openai-compatible-output-validation-filters
test "$(git rev-parse HEAD)" = "$expected_head"
test -z "$(git status --porcelain)"
test "$(/usr/bin/shasum -a 256 "$test_file" | /usr/bin/awk '{print $1}')" = "$expected_test_hash"
git diff --check
test ! -e "$build_log"
test ! -e "$artifact_dir"
test -d /tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-1
test -d /tmp/iop-repeat-guard-live/repeat-guard-task-03-direct-2
test ! -e /tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-2
! /usr/bin/pgrep -fl '[T]estDevRepeatGuardOrnithSmoke' >/dev/null

docker_bin=$(command -v docker)
test -n "$docker_bin"
"$docker_bin" compose version
for port in 18001 18083 18084 19093; do /usr/bin/nc -z 127.0.0.1 "$port"; done
"$(command -v go)" test -count=1 ./apps/edge/internal/service ./apps/edge/internal/controlplane ./apps/control-plane/cmd/control-plane

before_container=$("$docker_bin" ps --filter publish=18001 --format '{{.ID}}' | /usr/bin/head -1)
test -n "$before_container"

if ! "$docker_bin" compose --env-file .env.dev.example build --no-cache control-plane >"$build_log" 2>&1; then
  /usr/bin/tail -80 "$build_log"
  print -r -- 'control_plane_redeploy_gate=BLOCKED stage=build invocation_count=0'
  exit 51
fi
if ! "$docker_bin" compose --env-file .env.dev.example up -d --no-deps --force-recreate control-plane >>"$build_log" 2>&1; then
  /usr/bin/tail -80 "$build_log"
  print -r -- 'control_plane_redeploy_gate=BLOCKED stage=recreate invocation_count=0'
  exit 52
fi

after_container=$("$docker_bin" ps --filter publish=18001 --format '{{.ID}}' | /usr/bin/head -1)
test -n "$after_container"
test "$after_container" != "$before_container"
contract_hits=$("$docker_bin" exec "$after_container" sh -c "strings /usr/local/bin/control-plane | grep -c provider_snapshots || true")
test "$contract_hits" -ge 1

ready=false
for _ in {1..30}; do
  if /usr/bin/curl -fsS http://127.0.0.1:18001/healthz >/dev/null &&
     /usr/bin/curl -fsS http://127.0.0.1:18001/readyz >/dev/null &&
     /usr/bin/curl -fsS http://127.0.0.1:18001/edges/edge-toki-labs-dev/status >"$status_file" &&
     /usr/bin/jq -e '
       def provider($id): first(.nodes[]?.provider_snapshots[]? | select(.id == $id));
       ((.error // "") == "") and
       ((.nodes // []) | length == 4) and
       (all(.nodes[]; .connected == true)) and
       (provider("onexplayer-lemonade").capacity == 3) and
       (provider("onexplayer-lemonade").health == "healthy") and
       (provider("onexplayer-lemonade").in_flight == 0) and
       (provider("onexplayer-lemonade").queued == 0) and
       (provider("rtx5090-lemonade").capacity == 1) and
       (provider("rtx5090-lemonade").health == "healthy") and
       (provider("rtx5090-lemonade").in_flight == 0) and
       (provider("rtx5090-lemonade").queued == 0)
     ' "$status_file" >/dev/null; then
    ready=true
    break
  fi
  sleep 2
done

if [[ "$ready" != true ]]; then
  /usr/bin/curl -fsS http://127.0.0.1:18001/edges/edge-toki-labs-dev/status >"$status_file" || true
  /usr/bin/jq -c '{
    error: (.error // null),
    node_count: ((.nodes // []) | length),
    connected_count: ([.nodes[]? | select(.connected == true)] | length),
    provider_snapshot_count: ([.nodes[]?.provider_snapshots[]?] | length)
  }' "$status_file" 2>/dev/null || print -r -- '{"status":"unavailable"}'
  print -r -- 'control_plane_redeploy_gate=BLOCKED stage=status invocation_count=0'
  exit 53
fi

print -r -- "control_plane_redeploy_gate=PASS contract_hits=$contract_hits nodes=4 providers=3+1_idle build_log=$build_log invocation_count=0"
REMOTE
```

Expected: one compose build/recreate, fresh package tests pass, and the terminal PASS line reports a current contract and idle `3+1` providers. Exit 51, 52, or 53 is a non-retryable packet blocker with `invocation_count=0`.

### [REVIEW_OFR-S07-CP-REDEPLOY-3-2] Run one attached S07 invocation and verify cleanup

#### Problem

The previous attempts produced no accepted S07 result. SDD S07 and the `repeat-guard` task still require 15 provider responses, 15 Edge correlations, three capacity rows, and a sanitized `reproduced` fingerprint/offset or `not_reproduced` result.

#### Solution

- Recheck the pinned source, fresh plan-3 artifact absence, harness absence, protected SOPS authentication, and restored live provider status immediately before launch.
- Start `TestDevRepeatGuardOrnithSmoke` once in the same foreground SSH shell. Do not detach, background, timeout-retry, or create another artifact path.
- Record the exact terminal Go output and exit status. Any exit after `remote_live_start` consumes the invocation.
- On exit 0, validate `summary.json` without printing it, require all cardinalities/capacity rows/result classification, prove both providers idle, prove the harness absent, and preserve source/prior artifacts.

#### Modified Files and Checklist

- [ ] `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/CODE_REVIEW-cloud-G10.md` - record the single foreground invocation and sanitized summary/cleanup evidence.
- [ ] No source/config/Control Plane/Edge/Node/provider/credential/roadmap mutation after the post-redeploy gate.

#### Test Strategy

Use only the existing `TestDevRepeatGuardOrnithSmoke` five-concurrent, three-run, two-provider contract. Synthetic summaries, degraded capacity, detached processes, and retries are forbidden.

#### Verification

Foreground invocation:

```bash
ssh -o BatchMode=yes -o ConnectTimeout=15 toki@toki-labs.com '/bin/zsh -lc "exec /bin/zsh -s"' <<'REMOTE'
set -euo pipefail
set +x
cd /Users/toki/agent-work/iop-dev

artifact_dir=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-3
secret=/Users/toki/.config/iop/secrets/dev-openai-toki.sops.yaml
age_key=/Users/toki/.config/sops/age/keys.txt
status_file=$(/usr/bin/mktemp -t iop-repeat-live-status.XXXXXX)
api_key=''
cleanup() {
  /bin/rm -f -- "$status_file"
  unset api_key
}
trap cleanup EXIT

test "$(git rev-parse HEAD)" = 750cb1d1cb88066a10d3c703c99f1326306d8e15
test -z "$(git status --porcelain)"
test "$(/usr/bin/shasum -a 256 apps/edge/internal/openai/stream_gate_vertical_slice_test.go | /usr/bin/awk '{print $1}')" = 46261bb3a3000e00c27c419682f741c64c31c849d0aa30cbc024ed4531e7bfa6
test ! -e "$artifact_dir"
test -d /tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-1
test -d /tmp/iop-repeat-guard-live/repeat-guard-task-03-direct-2
! /usr/bin/pgrep -fl '[T]estDevRepeatGuardOrnithSmoke' >/dev/null

test -x /opt/homebrew/bin/sops
test -r "$age_key"
test -r "$secret"
test "$(/usr/bin/stat -f %Lp "$secret")" = 600
api_key=$(SOPS_AGE_KEY_FILE="$age_key" /opt/homebrew/bin/sops decrypt --extract '["tokens"]["toki-dev-pi"]' "$secret")
test -n "$api_key"

/usr/bin/curl -fsS http://127.0.0.1:18001/edges/edge-toki-labs-dev/status >"$status_file"
/usr/bin/jq -e '
  def provider($id): first(.nodes[]?.provider_snapshots[]? | select(.id == $id));
  ((.nodes // []) | length == 4) and
  (all(.nodes[]; .connected == true)) and
  (provider("onexplayer-lemonade").capacity == 3) and
  (provider("onexplayer-lemonade").health == "healthy") and
  (provider("onexplayer-lemonade").in_flight == 0) and
  (provider("onexplayer-lemonade").queued == 0) and
  (provider("rtx5090-lemonade").capacity == 1) and
  (provider("rtx5090-lemonade").health == "healthy") and
  (provider("rtx5090-lemonade").in_flight == 0) and
  (provider("rtx5090-lemonade").queued == 0)
' "$status_file" >/dev/null

http_status=$(
  {
    print -r -- 'silent'
    print -r -- 'show-error'
    print -r -- 'output = "/dev/null"'
    print -r -- "header = \"Authorization: Bearer $api_key\""
  } | /usr/bin/curl --config - --write-out '%{http_code}' http://127.0.0.1:18083/v1/models
)
test "$http_status" = 200
/bin/rm -f -- "$status_file"

print -r -- 'remote_live_start invocation_count=1 ownership=foreground artifact=plan-3'
IOP_OPENAI_API_KEY="$api_key" \
IOP_OPENAI_BASE_URL=http://127.0.0.1:18083 \
IOP_OPENAI_MODEL=ornith:35b \
IOP_OPENAI_SMOKE_CONCURRENCY=5 \
IOP_OPENAI_SMOKE_RUNS=3 \
IOP_OPENAI_SMOKE_PROMPT_FILE=/tmp/iop-repeat-guard-live/repeat-prompt.txt \
IOP_OPENAI_SMOKE_ARTIFACT_DIR="$artifact_dir" \
IOP_OPENAI_SMOKE_OBSERVATION_FILE=/tmp/iop-repeat-guard-live/edge-observations.jsonl \
IOP_OPENAI_SMOKE_STATUS_URL=http://127.0.0.1:18001/edges/edge-toki-labs-dev/status \
IOP_OPENAI_SMOKE_PROVIDER_IDS=onexplayer-lemonade,rtx5090-lemonade \
"$(command -v go)" test -timeout 90m -count=1 -v ./apps/edge/internal/openai -run '^TestDevRepeatGuardOrnithSmoke$'
REMOTE
```

Expected: the SSH session stays attached until Go exits. The test starts once and exits 0. Any non-zero exit after `remote_live_start` is a consumed invocation and must not be retried.

Sanitized summary and cleanup:

```bash
ssh -o BatchMode=yes -o ConnectTimeout=15 toki@toki-labs.com '/bin/zsh -lc "exec /bin/zsh -s"' <<'REMOTE'
set -euo pipefail
set +x
cd /Users/toki/agent-work/iop-dev
summary=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-3/summary.json
status_file=$(/usr/bin/mktemp -t iop-repeat-cleanup.XXXXXX)
trap '/bin/rm -f "$status_file"' EXIT

test -f "$summary"
/usr/bin/jq -e '
  (.model == "ornith:35b") and (.concurrency == 5) and (.runs == 3) and
  ((.provider_responses | length) == 15) and
  (([.provider_responses[].provider_response_id] | unique | length) == 15) and
  ((.lifecycles | length) == 15) and
  (([.lifecycles[].correlation_id] | unique | length) == 15) and
  ((.capacity_runs | length) == 3) and
  (all(.capacity_runs[];
    (.configured_capacity == 4) and (.peak_in_flight == 4) and
    (.peak_queued >= 1) and (.final_in_flight == 0) and (.final_queued == 0))) and
  ((.result == "not_reproduced") or
    ((.result == "reproduced") and
     any(.lifecycles[];
       (.result == "reproduced") and
       ((.fingerprint // "") | length > 0) and
       (.offset >= 0))))
' "$summary" >/dev/null

/usr/bin/curl -fsS http://127.0.0.1:18001/edges/edge-toki-labs-dev/status >"$status_file"
/usr/bin/jq -e '
  def provider($id): first(.nodes[]?.provider_snapshots[]? | select(.id == $id));
  (provider("onexplayer-lemonade").in_flight == 0) and
  (provider("onexplayer-lemonade").queued == 0) and
  (provider("rtx5090-lemonade").in_flight == 0) and
  (provider("rtx5090-lemonade").queued == 0)
' "$status_file" >/dev/null
! /usr/bin/pgrep -fl '[T]estDevRepeatGuardOrnithSmoke' >/dev/null
test "$(git rev-parse HEAD)" = 750cb1d1cb88066a10d3c703c99f1326306d8e15
test -z "$(git status --porcelain)"
test -d /tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-1
test -d /tmp/iop-repeat-guard-live/repeat-guard-task-03-direct-2
print -r -- 'remote_cleanup=PASS invocation_count=1 provider_responses=15 edge_correlations=15 capacity_runs=3 configured_capacity=4 peak_in_flight=4 queued_pressure=present providers=idle harness=absent source=unchanged prior_artifacts=preserved'
REMOTE
```

Expected: exit 0 and the sanitized cleanup PASS line. Do not print `summary.json`, raw SSE, prompt, output, status payload, token, or token hash.

## Modified Files Summary

| File | Items |
|------|-------|
| `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/CODE_REVIEW-cloud-G10.md` | REVIEW_OFR-S07-CP-REDEPLOY-3-1, REVIEW_OFR-S07-CP-REDEPLOY-3-2 |

## Dependencies and Execution Order

1. Preserve all prior task-03 artifacts and require the fresh plan-3 artifact/build-log paths to be absent.
2. Confirm both Windows providers are already ready using direct `Status` only.
3. Revalidate the pinned clean source and fresh package tests, then rebuild and force-recreate the Control Plane compose service exactly once.
4. Require the current container contract, Control Plane health/readiness, Edge reconnection, four connected nodes, and healthy/idle provider snapshots at capacities `3+1`.
5. If any prior step fails, record `invocation_count=0` and stop without another mutation.
6. If every gate passes, run the S07 Go test once in the foreground, validate the raw-free summary/cleanup, fill the active review, and stop for official review.

## Final Verification

PASS requires both direct provider status checks; pinned clean source and test hash; fresh focused package tests; exactly one Control Plane compose rebuild/recreate; a new container with the current `provider_snapshots` contract; healthy Control Plane; native Edge reconnection; four connected nodes; OneXPlayer and RTX5090 healthy/idle at capacities `3+1`; protected SOPS authentication HTTP 200; exactly one attached foreground invocation exiting 0; 15 unique provider responses; 15 unique Edge correlations; three capacity rows with configured 4, peak in-flight 4, and queue pressure; an accepted sanitized `reproduced` fingerprint/offset or `not_reproduced` result; idle providers; absent harness; unchanged source; preserved old artifacts; and no raw secret/output in tracked files.

Run local workspace hygiene after recording the remote evidence:

```bash
git diff --check
git status --short
git grep -nE 'sk-[A-Za-z0-9_-]{16,}|Authorization: Bearer [^$]' -- . \
  ':(exclude)agent-task/archive/**' \
  ':(exclude)agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/*.log'
```

Expected: `git diff --check` exits 0; status preserves unrelated user changes; grep finds no new raw credential or live response material in the active plan/review pair.

**After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.**
