<!-- task=m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture plan=5 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REFACTOR milestone-task=transfer -->

# Close the top-level category and resumability schema leaves

## For the Implementing Agent

Filling the implementation-owned sections in `CODE_REVIEW-cloud-G04.md` is mandatory. Reconfirm the encoded predecessor PASS, implement only this oracle follow-up, run every verification command exactly, paste actual output, keep the active pair in place, and report ready for review. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`; finalization belongs to the code-review skill.

## Background

The oracle now rejects added constraints on the conditional category/resumability leaves and the quarantine-reason leaf, but it still ignores admission semantics added to the top-level category and resumability definitions. Both top-level leaves drive `check_record`, so their supported shapes and canonical values must be exact before the fixture can be trusted as S02 state-transfer evidence.

## Archive Evidence Snapshot

- The current failed pair will archive as `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/plan_cloud_G04_4.log` and `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/code_review_cloud_G04_4.log`; verdict: FAIL.
- Required finding: `scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq:12-38,61-73,79-91` does not validate the top-level `record.properties.category` and `record.properties.resumable` leaves that drive record evaluation.
- Fresh reviewer mutations setting `record.properties.category.const = "quarantine"` or `record.properties.resumable.const = false` both exited 0 with `STATE_SCHEMA_CONTRACT_PASS`, although the canonical fixture contains non-quarantine records with `resumable=true`. The predecessor check and all eight current verification commands passed.
- Roadmap carryover remains `milestone-task=transfer`, SDD scenario S02, with no roadmap mutation or completion claim in this follow-up.

## Analysis

### Files Read

- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq`
- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json`
- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.json`
- `scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv`
- `cmd/iop-chronos-transfer/main.go`
- `cmd/iop-chronos-transfer/main_test.go`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/PLAN-cloud-G04.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/CODE_REVIEW-cloud-G04.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/IMPLEMENTATION_SUMMARY.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/code_review_cloud_G04_3.log`
- `agent-task/archive/2026/08/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log`
- `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`
- `agent-spec/runtime/iop-agent-cli-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`

### SDD Criteria

- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md` is `[승인됨]`, its lock is released, and no active SDD `USER_REVIEW.md` remains. The unchanged first-line scope is `milestone-task=transfer`.
- Acceptance Scenario S02 and its Evidence Map require a trustworthy full-state transfer fixture before isolated bundle verification. This follow-up therefore keeps the canonical schema and fixture unchanged while making the oracle reject every known extra constraint on schema leaves used for category/resumability evaluation.

### Verification Context

- No external verification handoff was supplied or required. Repository-native evidence came from the tracked schema, fixture, jq oracle, Go exporter validation, focused schema mutations, exact predecessor completion, provenance checks, and the sensitive-text scan.
- Local preflight is Go `go1.26.2 linux/arm64`, module `/config/workspace/iop-s1/go.mod`, with `/bin/jq` available. No service, credential, provider, external host, or `iop-agent` execution is required.
- All eight current plan commands passed. A focused reviewer probe added `const="quarantine"` to the top-level category leaf or `const=false` to the top-level resumability leaf; both mutated schemas still exited 0 with `STATE_SCHEMA_CONTRACT_PASS`.
- Preconditions: index 03 resolves to the one archived PASS at `agent-task/archive/2026/08/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log`.
- Constraints: do not change the canonical schema, fixture, ownership manifest, exporter, roadmap, contract, or spec. Confidence is high because both false positives are deterministic and isolated to two missing top-level leaf checks.

### Test Coverage Gaps

- Existing tracked mutations cover conditional category/resumability leaves, the quarantine-reason leaf, required-array semantics, and `allOf` cardinality.
- They do not cover added constraints on the top-level category and resumability leaves. Add both observed variants to the same tracked jq regression and to the focused external mutation command.

### Symbol References

- None. No Go, JSON, or jq symbol is renamed or removed.

### Split Judgment

- Keep one compact follow-up. Exact validation of the two top-level leaves and their mutation regression form one fail-closed oracle invariant and cannot independently PASS.
- Encoded predecessor index `03` is satisfied by `agent-task/archive/2026/08/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log`.

### Scope Rationale

- Exclude `scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json`: its canonical category and resumability definitions are correct; only the oracle ignores unsupported additions.
- Exclude the canonical fixture, ownership manifest, and `cmd/iop-chronos-transfer/**`: current data and production validation pass, and changing them would expand beyond the Required finding.
- Exclude roadmap/spec/contract updates: this is a regression-oracle repair for existing S02 evidence. Spec update not needed.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer=`finalize-task-policy.sh`, mode=`pair`.
- Build closures are all true. Scores are `scope=1,state=0,blast=1,evidence=1,verification=1`, grade `G04`, base `local-fit`, final route `recovery-boundary`, lane `cloud`.
- Review closures are all true. Scores are `scope=1,state=0,blast=1,evidence=1,verification=1`, route `official-review`, lane `cloud`, grade `G04`.
- `large_indivisible_context=false`; positive loop risks are `boundary_contract` and `structured_interpretation` (2); `review_rework_count=5`; `evidence_integrity_failure=false`; no capability gap.
- Canonical files: `PLAN-cloud-G04.md`, `CODE_REVIEW-cloud-G04.md`.

## Dependencies and Execution Order

1. Reconfirm the exact PASS in `agent-task/archive/2026/08/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log`.
2. Make the two top-level leaf checks and their mutation regressions one change, then run canonical and mutation verification.

## Implementation Checklist

- [ ] Reconfirm that predecessor index 03 resolves to exactly one PASS `complete.log` before changing the oracle.
- [ ] Require the exact canonical key sets and values for the top-level category and resumability leaf schemas while retaining every existing exact leaf check.
- [ ] Retain the canonical case and all existing record/schema mutations, add both observed top-level semantic mutations, and make every invalid external schema exit nonzero.
- [ ] Re-run parsing, canonical oracle, clause-key access, exact manifest/addendum provenance, sensitive-text, focused six-case leaf mutation, and diff checks without changing the canonical schema, fixture, or manifest.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REFACTOR-1] Make top-level consumed leaves exact

**Problem**

`scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq:14-17,20-38` validates the mode and reason definitions plus the conditional category/resumability definitions, but it never validates `record.properties.category` or `record.properties.resumable`. Lines 61-73 consume those record fields, so extra top-level constraints can invalidate the fixture without changing the oracle result.

```jq
# before: scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq:14-17,25,31,35
(($rec.properties.mode | keys) == ["const", "description", "type"])
and (($rec.properties.quarantine_reason | keys) == ["description", "minLength", "type"])
and (($cond.if.properties.category | keys) == ["const"])
and (($cond.then.properties[$then_keys[0]] | keys) == ["const"])
and (($cond.else.properties[$else_keys[0]] | keys) == ["const"])
```

**Solution**

Require the top-level category leaf to have exactly `description`, `enum`, and `type` with the canonical category enum and string type. Require the top-level resumability leaf to have exactly `description` and `type` with boolean type. Keep all current checks and add both top-level `const` mutations to the internal and external mutation tables.

```jq
# after
and (($rec.properties.category | keys) == ["description", "enum", "type"])
and ($rec.properties.category.type == "string")
and ($rec.properties.category.enum == ["config", "state", "client", "log", "overlay", "cache", "temp", "quarantine"])
and (($rec.properties.resumable | keys) == ["description", "type"])
and ($rec.properties.resumable.type == "boolean")
```

**Modified Files and Checklist**

- [ ] `scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq` — validate both top-level consumed leaf definitions exactly and cover both observed semantic mutations.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/CODE_REVIEW-cloud-G04.md` — record implementation notes and actual command output.

**Test Strategy**

- Update the existing tracked jq regression rather than adding another harness. Preserve every canonical, record-mutation, and schema-mutation case, and add top-level category/resumability `const` mutations.
- The final shell probe independently applies the four prior leaf-keyword mutations and the two new top-level mutations, requiring a nonzero oracle result for every case.

**Verification**

- `jq -nr --slurpfile schema scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json --slurpfile fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json -f scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq` — prints exactly `STATE_SCHEMA_CONTRACT_PASS` and exits 0.
- `bash -lc 'set -euo pipefail; probe_dir=$(mktemp -d); trap '\''rm -rf -- "$probe_dir"'\'' EXIT; mutations=('\''."$defs".record.allOf[0].if.properties.category.pattern = "^never$"'\'' '\''."$defs".record.allOf[0].then.properties.resumable.not = {}'\'' '\''."$defs".record.allOf[0].else.properties.resumable.not = {}'\'' '\''."$defs".record.properties.quarantine_reason.maxLength = 0'\'' '\''."$defs".record.properties.category.const = "quarantine"'\'' '\''."$defs".record.properties.resumable.const = false'\''); for i in "${!mutations[@]}"; do jq "${mutations[$i]}" scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json >"$probe_dir/schema-$i.json"; set +e; output=$(jq -nr --slurpfile schema "$probe_dir/schema-$i.json" --slurpfile fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json -f scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq 2>&1); rc=$?; set -e; test "$rc" -ne 0; test "$output" != "STATE_SCHEMA_CONTRACT_PASS"; done; printf "SCHEMA_CONSUMED_LEAF_MUTATIONS_REJECTED\n"'` — all six known consumed-leaf mutations are rejected.

## Modified Files Summary

| File | Item |
|------|------|
| `scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq` | REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REFACTOR-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/CODE_REVIEW-cloud-G04.md` | REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REFACTOR-1 |

## Final Verification

1. `bash -lc 'set -euo pipefail; mapfile -t predecessor_logs < <({ test ! -f agent-task/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log || printf "%s\n" agent-task/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log; find agent-task/archive -path "*/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log" -type f -print 2>/dev/null; } | sort -u); test "${#predecessor_logs[@]}" -eq 1; awk "BEGIN {in_summary=0; found=0} /^## Summary$/ {in_summary=1; next} in_summary && /^## / {in_summary=0} in_summary && /final verdict: PASS/ {found++} END {exit found==1?0:1}" "${predecessor_logs[0]}"; printf "%s\n" "${predecessor_logs[0]}"'` — exactly one predecessor PASS.
2. `jq -e . scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json scripts/fixtures/iop-agent-chronos-transfer-state-v1.json >/dev/null && printf 'JSON_PARSE_PASS\n'` — both JSON documents parse.
3. `jq -nr --slurpfile schema scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json --slurpfile fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json -f scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq` — prints exactly `STATE_SCHEMA_CONTRACT_PASS` and exits 0.
4. `bash -lc 'set -euo pipefail; probe_dir=$(mktemp -d); trap '\''rm -rf -- "$probe_dir"'\'' EXIT; mutations=('\''."$defs".record.allOf[0].if.properties.category.pattern = "^never$"'\'' '\''."$defs".record.allOf[0].then.properties.resumable.not = {}'\'' '\''."$defs".record.allOf[0].else.properties.resumable.not = {}'\'' '\''."$defs".record.properties.quarantine_reason.maxLength = 0'\'' '\''."$defs".record.properties.category.const = "quarantine"'\'' '\''."$defs".record.properties.resumable.const = false'\''); for i in "${!mutations[@]}"; do jq "${mutations[$i]}" scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json >"$probe_dir/schema-$i.json"; set +e; output=$(jq -nr --slurpfile schema "$probe_dir/schema-$i.json" --slurpfile fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json -f scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq 2>&1); rc=$?; set -e; test "$rc" -ne 0; test "$output" != "STATE_SCHEMA_CONTRACT_PASS"; done; printf "SCHEMA_CONSUMED_LEAF_MUTATIONS_REJECTED\n"'` — all six known consumed-leaf mutations are rejected.
5. `bash -lc 'set -euo pipefail; rg -q --fixed-strings "resumable_key:" scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq; ! rg -q --fixed-strings '\''$record.resumable'\'' scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq; printf "CLAUSE_KEY_ACCESS_PASS\n"'` — clause-driven resumability access remains present and direct field access remains absent.
6. `bash -lc 'set -euo pipefail; manifest_ids=$(mktemp); fixture_ids=$(mktemp); trap '\''rm -f -- "$manifest_ids" "$fixture_ids"'\'' EXIT; awk -F "\t" '\''NR>1 && $2=="state" {print $1}'\'' scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv | LC_ALL=C sort >"$manifest_ids"; jq -r '\''.records[] | select(.source_manifest=="original") | .logical_id'\'' scripts/fixtures/iop-agent-chronos-transfer-state-v1.json | LC_ALL=C sort >"$fixture_ids"; test "$(wc -l <"$manifest_ids")" -eq 10; cmp "$manifest_ids" "$fixture_ids"; test "$(jq -r '\''[.records[] | select(.source_manifest=="d04-addendum") | .logical_id] | sort | join(",")'\'' scripts/fixtures/iop-agent-chronos-transfer-state-v1.json)" = "state:cache-root,state:temp-root"; printf "STATE_ID_PROVENANCE_PASS\n"'` — original and addendum IDs remain exact.
7. `bash -lc 'set -euo pipefail; set +e; rg -n '\''/home/|/Users/|token|credential|secret|private_key'\'' scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json scripts/fixtures/iop-agent-chronos-transfer-state-v1.json scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq; scan_rc=$?; set -e; case "$scan_rc" in 0) exit 1;; 1) :;; *) exit "$scan_rc";; esac; printf "SENSITIVE_SCAN_PASS\n"'` — no host path or sensitive pattern appears and scanner errors fail closed.
8. `git diff --check` — exits 0 with no output.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
