<!-- task=m-iop-agent-chronos-extraction-decoupling/04+03_bundle_exporter plan=4 tag=REVIEW_REVIEW_REFACTOR milestone-task=transfer -->

# Code Review Reference - REVIEW_REVIEW_REFACTOR

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-02
task=m-iop-agent-chronos-extraction-decoupling/04+03_bundle_exporter, plan=4, tag=REVIEW_REVIEW_REFACTOR

## Archive Evidence Snapshot

- `agent-task/m-iop-agent-chronos-extraction-decoupling/04+03_bundle_exporter/plan_cloud_G10_3.log` and `code_review_cloud_G10_3.log` are the predicted archives for the failed plan-3 loop. The review has one Required finding: structurally invalid owner integration records with an accepted version are classified as resumable instead of quarantined.
- Fresh reviewer verification passed the predecessor PASS check, manifest SHA check, pinned commit check, focused owner/output tests, full package test, race test, vet, `git diff --check`, and `gofmt -d`. A focused reviewer reproducer failed because `client-process/flutter = {"schema_version":1}` was accepted as resumable. `evidence_integrity_failure=false`; the recorded implementation commands were accurate, but the behavioral oracle was incomplete.
- Exact/disjoint owner payload binding and arbitrary-name workspace confinement remain accepted. The `transfer` Milestone contribution remains S02 exporter evidence only; Task 06 still owns actual current-input reconciliation, private owner export, isolated staging build, and final bundle closure.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G10.md` → `code_review_cloud_G10_4.log` and `PLAN-cloud-G10.md` → `plan_cloud_G10_4.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-iop-agent-chronos-extraction-decoupling/04+03_bundle_exporter/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, preserve the first-line `milestone-task` metadata in `complete.log` and report it for the runtime aggregation event. Roadmap state evaluation belongs to `sync-milestone-workstate`.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_REVIEW_REFACTOR-1 Enforce strict owner integration-record admission | [x] |

## Implementation Checklist

- [x] Validate every supported owner integration-record family against its exact durable key identity and complete versioned payload structure/integrity before resumable routing; preserve every unknown or invalid record only in non-resumable quarantine.
- [x] Add table-driven valid/invalid family coverage, including malformed version-1 payloads and invalid durable identities, while preserving exact disjoint payload binding and the accepted workspace/output behavior.
- [x] Run the focused validation/quarantine tests and the fresh full package, race, vet, baseline, formatting, and whitespace verification.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G10_4.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G10_4.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory `agent-task/m-iop-agent-chronos-extraction-decoupling/04+03_bundle_exporter/` to `agent-task/archive/YYYY/MM/m-iop-agent-chronos-extraction-decoupling/04+03_bundle_exporter/` and update this checklist at the final archive path.
- [ ] If PASS and task group is `m-<milestone-slug>`, preserve and report `milestone-task` metadata for runtime aggregation, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove empty active parent `agent-task/m-iop-agent-chronos-extraction-decoupling/` or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

None.

## Key Design Decisions

- Kept resumable integration records in their existing raw-JSON payload field, but placed rejected records in a quarantine-only byte field. JSON therefore base64-encodes the opaque bytes and can recover them exactly without `MarshalIndent` rewriting their JSON representation.
- Mirrored each durable owner's exact key derivation and decoder invariants inside the self-contained exporter boundary. Client-process and local-control records validate lifecycle and retained protocol state; project-log journal/replay records validate scope, sequence, fingerprint, and enum invariants; workspace integration validates key and revision seals; task-loop selection validates the project-derived key; route decisions use the owning strict integrity decoder.
- Kept invalid and unknown records out of every resumable `integration_records` map and copied their original byte slices only into `state:broken-residual-records`.

## Reviewer Checkpoints

- Every resumable integration record has an exact owning key identity and passes a strict family-specific versioned payload validator; formats with integrity metadata have that integrity verified.
- Unknown keys, invalid suffixes, missing/unknown fields, identity mismatches, invalid enum/state values, trailing JSON, and integrity mismatches retain their exact bytes only in non-resumable quarantine.
- Valid records for client process, local-control ledger, project-log journal/replay, workspace integration, task-loop selection, and route decision still route to the intended unique logical payload.
- Exact/disjoint payload member binding, lease/recovery partitioning, redacted index/receipt, arbitrary-name workspace confinement, pinned Git input, and deterministic archive behavior remain passing.

## Verification Results

> Paste actual stdout/stderr for every command below. Do not summarize or reconstruct output. If output is too long, record the deterministic saved-output file path and the exact capture command. Any replacement command requires a `Deviations from Plan` entry.

### Verification 1

Command: `go test -count=1 ./cmd/iop-chronos-transfer -run 'TestOwnerIntegrationRecordValidationMatrix|TestInvalidOwnerResidualIsOnlyNonResumableQuarantine|TestOwnerStatePayloadsAreExactAndDisjoint'`

_Actual stdout/stderr and exit code (or exact saved-output path and capture command):_

```text
ok  	iop/cmd/iop-chronos-transfer	0.415s
exit code: 0
```

### Verification 2

Command: `bash -lc 'set -euo pipefail; mapfile -t predecessor_logs < <({ test ! -f agent-task/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log || printf "%s\n" agent-task/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log; find agent-task/archive -path "*/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log" -type f -print 2>/dev/null; } | sort -u); test "${#predecessor_logs[@]}" -eq 1; awk '\''BEGIN {in_summary=0; count=0} /^## Summary$/ {in_summary=1; next} in_summary && /^## / {in_summary=0} in_summary {line=$0; while (match(line, /final verdict: PASS/)) {count++; line=substr(line, RSTART+RLENGTH)}} END {exit count==1 ? 0 : 1}'\'' "${predecessor_logs[0]}"'`

_Actual stdout/stderr and exit code (or exact saved-output path and capture command):_

```text
(no stdout/stderr)
exit code: 0
```

### Verification 3

Command: `test "$(sha256sum scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv | awk '{print $1}')" = 7026fedc8b0eb24eab5c4124d3818400f66db5f1d116a71e7781f346fbd256a7`

_Actual stdout/stderr and exit code (or exact saved-output path and capture command):_

```text
(no stdout/stderr)
exit code: 0
```

### Verification 4

Command: `git cat-file -e 3155be0e275437a8eedc1aa93497955a7d30465b^{commit} && test "$(git rev-parse HEAD)" != 3155be0e275437a8eedc1aa93497955a7d30465b`

_Actual stdout/stderr and exit code (or exact saved-output path and capture command):_

```text
(no stdout/stderr)
exit code: 0
```

### Verification 5

Command: `go test -count=1 ./cmd/iop-chronos-transfer`

_Actual stdout/stderr and exit code (or exact saved-output path and capture command):_

```text
ok  	iop/cmd/iop-chronos-transfer	7.127s
exit code: 0
```

### Verification 6

Command: `go test -count=1 -race ./cmd/iop-chronos-transfer`

_Actual stdout/stderr and exit code (or exact saved-output path and capture command):_

```text
ok  	iop/cmd/iop-chronos-transfer	5.354s
exit code: 0
```

### Verification 7

Command: `go vet ./cmd/iop-chronos-transfer`

_Actual stdout/stderr and exit code (or exact saved-output path and capture command):_

```text
(no stdout/stderr)
exit code: 0
```

### Verification 8

Command: `gofmt -d cmd/iop-chronos-transfer/main.go cmd/iop-chronos-transfer/main_test.go`

_Actual stdout/stderr and exit code (or exact saved-output path and capture command):_

```text
(no stdout/stderr)
exit code: 0
```

### Verification 9

Command: `git diff --check`

_Actual stdout/stderr and exit code (or exact saved-output path and capture command):_

```text
(no stdout/stderr)
exit code: 0
```

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail
  - Completeness: Fail
  - Test coverage: Fail
  - API contract: Fail
  - Code quality: Pass
  - Implementation deviation: Fail
  - Verification trust: Pass
  - Spec conformance: Fail
- Findings:
  - Required — `cmd/iop-chronos-transfer/main.go:1826`: route-decision admission validates only that the `taskloop-route/` suffix is 64 hexadecimal characters, while the owning key is derived from `route + project + workspace + work-unit + attempt` at `apps/agent/internal/taskloop/module.go:777`. The decision envelope contains none of that preimage and the validator receives no decoded manager-state ownership context, so an integrity-valid decision under an orphaned or rebound 64-hex key is emitted as resumable `state:manager-checkpoint` instead of quarantine, contrary to SDD D01/S02 and this plan's exact durable-key requirement. `cmd/iop-chronos-transfer/main_test.go:435` currently blesses an arbitrary all-`f` suffix as the valid control and provides no end-to-end orphan/mismatch quarantine case or the promised invalid enum/state regression. Derive the admissible exact route keys from the strictly decoded manager checkpoint (or otherwise prove the full owning preimage), require membership before resumable routing, quarantine every unmatched route record byte-for-byte, and add valid-owned, orphan/rebound, and representative invalid enum/state coverage while preserving all other family checks.
- Routing Signals: `review_rework_count=3`, `evidence_integrity_failure=false`
- Next Step: Prepare and validate a freshly routed follow-up PLAN/CODE_REVIEW pair for exact route-decision ownership binding and the missing validation regressions, then archive this active pair and materialize the routed follow-up state.
