<!-- task=m-iop-agent-cli-runtime/14+13_cli_config_fixtures plan=1 tag=API -->

# Code Review Reference - API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> Complete the checklist and evidence, leave active files in place, and report ready for review. Blockers belong only in implementation evidence. Do not classify next state or perform review-agent finalization.

## Overview

date=2026-07-29
task=m-iop-agent-cli-runtime/14+13_cli_config_fixtures, plan=1, tag=API

## For the Review Agent

> **[REVIEW AGENT ONLY]** Implementing agents must not execute finalization.

Compare every item and actual output to source. Append verdict/signals; archive `CODE_REVIEW-cloud-G06.md` → `code_review_cloud_G06_1.log` and `PLAN-local-G06.md` → `plan_local_G06_1.log`; on PASS write `complete.log` and archive the task; on WARN/FAIL materialize the next code-review state.

## Implementation Item Completion

| Item | Status |
|------|--------|
| API-1 Split configs | [x] |

## Implementation Checklist

- [x] Add secret-free repo-global and user-local example configurations with strict validation tests.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementing agents must not modify this checklist.

- [x] Append one verdict and verified `review_rework_count` / `evidence_integrity_failure`.
- [x] Verify verdict, dimensions, and finding classifications match.
- [x] Archive `CODE_REVIEW-cloud-G06.md` as `code_review_cloud_G06_1.log`.
- [x] Archive `PLAN-local-G06.md` as `plan_local_G06_1.log`.
- [x] Verify the Agent-Ops managed `.gitignore` block.
- [ ] If PASS, write canonical `complete.log` and leave no active Markdown files.
- [ ] If PASS, move this task directory to the dated archive and update this checklist there.
- [ ] If PASS, remove an empty split parent or prove remaining siblings/files require it.
- [x] If WARN/FAIL, write the exact next state and do not write `complete.log`.

## Deviations from Plan

None.

## Key Design Decisions

- Tracked fixtures live at `configs/iop-agent.runtime.yaml` (repo-global) and `configs/iop-agent.local.example.yaml` (user-local), matching the `RuntimeSnapshot` schema in `packages/go/agentconfig/runtime_config.go`.
- The local example uses placeholder absolute paths under `/home/user/.local/share/iop-agent/` and `/home/user/repos/iop-s0` so it is clearly replaceable without leaking real device paths.
- Provider catalog data stays in the repo-global file so the selector can validate profile references against a known catalog; the local example only owns device roots, project registrations, and alias overrides.
- Tests reference fixtures by walking the filesystem from the test file's package directory via `runtime.Caller(0)`, so the test path is stable regardless of CWD.

## Reviewer Checkpoints

- Repo-global and user-local examples remain separate.
- Tracked examples contain no secrets or device-specific real paths.
- Strict loading succeeds and validation does not mutate repo-global input.

## Verification Results

### Formatting

```text
gofmt: no files specified
```

### Focused tests

```bash
go test -count=1 ./apps/agent/internal/command -run 'TestTrackedRuntimeExamplesLoad|TestValidateDoesNotMutateRepoConfig'
```

```text
=== RUN   TestTrackedRuntimeExamplesLoad
--- PASS: TestTrackedRuntimeExamplesLoad (0.00s)
=== RUN   TestValidateDoesNotMutateRepoConfig
--- PASS: TestValidateDoesNotMutateRepoConfig (0.00s)
PASS
ok  	iop/apps/agent/internal/command	0.009s
```

### Static checks

```bash
git diff --check -- apps/agent/internal/command/config_test.go
```

```text
(exit code 0, no errors)
```

---

> **[IMPLEMENTING AGENT — BEFORE SAVING]** Fill every implementation-owned section and leave review-only content unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header, Overview, Review Instructions | Fixed | Implementer must not modify |
| Implementation Item Completion, Implementation Checklist | Implementing agent | Check status only |
| Review-Only Checklist | Review agent | Implementer must not modify |
| Deviations, Decisions, Verification Results | Implementing agent | Record actual evidence |
| Reviewer Checkpoints | Fixed | Reviewer verifies them |
| Code Review Result and finalization | Review agent | Append/execute only after review |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail — the runtime fixture embeds provider profiles that omit the executable arguments and modes present in the canonical provider catalog.
  - Completeness: Fail — the implementation does not preserve the plan's separate provider-catalog boundary.
  - Test coverage: Fail — the fixture test requires the duplicated catalog to be non-empty instead of proving that runtime references resolve against the separate canonical catalog.
  - API contract: Fail — downstream CLI plans and the Agent Runtime contract use `configs/iop-agent.providers.yaml` as the separate provider-catalog input.
  - Code quality: Pass
  - Implementation deviation: Fail — the recorded decision to keep catalog data in the runtime file contradicts the active plan and its archived source plan.
  - Verification trust: Pass — fresh focused tests, affected package tests, vet, formatting, and untracked-file whitespace checks passed in the review checkout.
- Findings:
  - Required — `configs/iop-agent.runtime.yaml:5` duplicates the canonical provider catalog but omits profile `args`, `resume_args`, `mode`, `output_format`, persistence, and concurrency settings that `agentprovider/catalog.NewProfileProvider` consumes. Remove the embedded `catalog` block, keep `configs/iop-agent.providers.yaml` as the single catalog input, and update `TestTrackedRuntimeExamplesLoad` to load that catalog separately and verify every runtime default/alias/selection profile reference resolves through it.
- Routing Signals:
  - review_rework_count=1
  - evidence_integrity_failure=false
- Next Step: Archive this pair and materialize the routed follow-up plan/review pair for the required catalog-boundary fix.
