<!-- task=m-iop-agent-chronos-extraction-decoupling/06+04,05_bundle_verification plan=0 tag=REFACTOR -->

# Bundle 격리 staging과 실제 state export 검증

## For the Implementing Agent

`CODE_REVIEW-cloud-G10.md`의 implementation-owned 섹션 작성은 필수다. encoded predecessor의 exact PASS를 확인하고 이 child 범위만 구현·검증한다. active pair를 유지해 review 준비 완료를 보고하며 finalization은 code-review agent만 수행한다. 차단되면 질문하거나 상태를 분류하지 말고 blocker, 실제 명령/출력, 재개 조건만 evidence 필드에 기록한다.

## Background

exporter와 state fixture를 결합해 synthetic bundle의 isolated build와 owner-side real-state export evidence를 생성하고 S02를 닫는다.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md)
- Task ids:
  - `transfer`: 전체 source/contract/behavior/state의 versioned Chronos acceptance bundle 전달
- Completion mode: check-on-pass

## Analysis

### Files Read

- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/04+03_bundle_exporter/plan_cloud_G10_0.log`
- `configs/iop-agent.local.example.yaml`

### SDD Criteria

- SDD `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`는 `[승인됨]`, 잠금 `해제` 상태이고 사용자 결정 D01을 포함한다.
- Target은 Acceptance Scenario `S02`와 Milestone Task `transfer`; Evidence Map row는 isolated staging build, existing behavior test, forbidden-import scan, 전체 상태 fixture와 versioned digest/receipt를 요구한다.
- 이 closure child는 해당 row의 synthetic·real-state execution, detached staging build, digest/receipt evidence를 한 번에 검증해 `transfer` 완료 근거를 만든다.

### Verification Context

- Handoff는 없다. Milestone, 승인 SDD, 보존된 parent plan과 current state-root 설정을 읽었고 predecessors `04+03_bundle_exporter`, `05+03_state_fixture`의 exact PASS `complete.log`는 모두 missing이다.
- Synthetic export는 current checkout에서 실행한다. Real-state 검증은 owner가 제공한 `--local-config`, `--state-root`, `--output`을 사용하되 path/secret을 출력하지 않고 output mode `0600`과 digest만 기록해야 한다.
- External preflight에서 real state root 또는 실행 권한을 확인할 수 없으면 synthetic evidence로 대체하지 않고 blocker로 남긴다. Confidence는 medium이며 외부 실행이 유일한 미확정 요소다.

External Verification Preflight:

- Runner/repo/workdir: local shell, `/config/workspace/iop-s1`; branch `feature/iop-agent-chronos-extraction-decoupling`, HEAD `4e85b248381c97836b13aad10ed059c9dbf5961f`, planning checkout dirty with current roadmap/UI/task changes.
- Source sync/artifact: tasks 04 and 05 are incomplete, so `cmd/iop-chronos-transfer` and state-v1 artifacts do not exist yet; no binary/help/version output is available before those predecessors PASS. Planned runner is `go run ./cmd/iop-chronos-transfer export` with Go `go1.26.2 linux/arm64`.
- Config/runtime: `--local-config`, `--state-root`, `--output` must be supplied by the state owner at execution time without persisting or echoing secrets/absolute state paths. Runtime identity and filesystem read permission are not yet supplied.
- Ports/process/hosts/OS: no listening port, long-running process, or external network host is required; host is Linux `aarch64` (`6.10.14-linuxkit`).
- Exact blocker/setup: first obtain PASS `complete.log` for 04 and 05, then obtain owner-approved readable config/state roots and private output root, run command help plus the planned export, and verify `0600`. Missing owner paths/permission remains an external-execution blocker.

### Test Coverage Gaps

- real state runner가 없으면 external-execution blocker이며 synthetic evidence로 대체할 수 없다.

### Symbol References

- 새 runtime symbol 없음.

### Split Judgment

- 이 closure child만 transfer Roadmap Task를 닫는다.
- Predecessors `04`, `05`의 active/archived exact PASS `complete.log`는 모두 missing이다. PASS evidence는 synthetic·real export, detached staging behavior, forbidden-import scan과 digest receipt다.

### Scope Rationale

- Chronos repository import/write는 계속 금지한다.

### Final Routing

- `evaluation_mode=isolated-reassessment`, finalizer=`finalize-task-policy.sh`, mode=`pair`.
- Build closures 모두 true. Scores=`2,2,2,2,2`, grade=`G10`, base/route=`grade-boundary`, lane=`cloud`.
- Review closures 모두 true. Scores=`2,2,2,2,2`, route=`official-review`, lane=`cloud`, grade=`G10`.
- `large_indivisible_context=false`; positive loop risks=`temporal_state, concurrent_consistency, boundary_contract, structured_interpretation` (4); `review_rework_count=0`; `evidence_integrity_failure=false`; capability gap 없음.
- Canonical files: `PLAN-cloud-G10.md`, `CODE_REVIEW-cloud-G10.md`.

## Dependencies and Execution Order

1. `04+03_bundle_exporter` and `05+03_state_fixture` must each have exactly one matching PASS `complete.log`; all are currently missing.
2. Resolve only those exact predecessor completion artifacts, then implement this child scope.

## Implementation Checklist

- [ ] Refuse to start until 04+03_bundle_exporter and 05+03_state_fixture each have an exact PASS complete.log.
- [ ] Generate and extract the synthetic bundle in isolated staging and prove fresh bundled behavior tests and external-dependency scan pass.
- [ ] Run the owner-side real-state export and record only redacted category, mode, item, and bundle digest evidence; otherwise record the external-execution blocker.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REFACTOR-3] 격리 staging build와 실제 state export evidence

**Problem**

bundle이 source를 담았다는 사실만으로는 live IOP checkout 없이 build 가능하거나 실제 state가 완전하게 전달됐음을 증명하지 못한다.

```text
# SDD.md:127-130
격리 staging build + 전체 state 형식 + item/bundle digest
```

**Solution**

synthetic export를 `/tmp/iop-chronos-transfer-fixture`에 만들고 다른 `/tmp` staging root에 풀어 bundled verification snapshot의 fresh tests를 실행한다. 실제 runner에서는 동일 command를 owner-only external output에 실행하고 task log에는 source revision, category counts, redacted item digest, bundle digest, mode만 기록한다.

```text
# after: transfer-bundle-manifest.log
version=1 source_revision=<sha> item_count=<n> state_categories=<redacted counts> bundle_sha256=<digest>
```

**Modified Files and Checklist**

- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/06+04,05_bundle_verification/transfer-bundle-manifest.log` — path/secret 없는 receipt summary.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/06+04,05_bundle_verification/transfer-verification.log` — exact preflight, commands, stdout/stderr.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/06+04,05_bundle_verification/CODE_REVIEW-cloud-G10.md` — actual implementation/review evidence.

**Test Strategy**

- synthetic bundle은 local required verification이다.
- real state bundle은 external-execution required verification이며 미실행 시 blocker다. `iop-agent` binary는 실행하지 않는다.

**Verification**

- `rm -rf /tmp/iop-chronos-transfer-fixture /tmp/iop-chronos-transfer-staging && go run ./cmd/iop-chronos-transfer export --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --source-revision 3155be0e275437a8eedc1aa93497955a7d30465b --repo-root . --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --output /tmp/iop-chronos-transfer-fixture && mkdir -p /tmp/iop-chronos-transfer-staging && tar -xzf /tmp/iop-chronos-transfer-fixture/chronos-acceptance-v1.tar.gz -C /tmp/iop-chronos-transfer-staging` — synthetic export/extract PASS.
- `cd /tmp/iop-chronos-transfer-staging/acceptance-v1/behavior && go test -count=1 ./...` — bundled behavior tests PASS without current checkout.
- `test -z "$(rg --sort path -n '/config/workspace/iop|replace .*iop|\.\./.*iop' /tmp/iop-chronos-transfer-staging/acceptance-v1)"` — bundle-external IOP source dependency 0.
- External runner command with real `--local-config`, `--state-root`, `--output` must exit 0 and produce mode `0600`; exact non-secret command/output goes to `transfer-verification.log`.

## Modified Files Summary

| File | Item |
|------|------|
| `agent-task/m-iop-agent-chronos-extraction-decoupling/06+04,05_bundle_verification/transfer-bundle-manifest.log` | REFACTOR-3 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/06+04,05_bundle_verification/transfer-verification.log` | REFACTOR-3 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/06+04,05_bundle_verification/CODE_REVIEW-cloud-G10.md` | REFACTOR-3 |

## Final Verification

1. Confirm exact PASS `complete.log` for `04+03_bundle_exporter` and `05+03_state_fixture`.
2. `rm -rf /tmp/iop-chronos-transfer-fixture /tmp/iop-chronos-transfer-staging && go run ./cmd/iop-chronos-transfer export --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --source-revision 3155be0e275437a8eedc1aa93497955a7d30465b --repo-root . --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --output /tmp/iop-chronos-transfer-fixture && mkdir -p /tmp/iop-chronos-transfer-staging && tar -xzf /tmp/iop-chronos-transfer-fixture/chronos-acceptance-v1.tar.gz -C /tmp/iop-chronos-transfer-staging` — synthetic export/extract PASS.
3. `cd /tmp/iop-chronos-transfer-staging/acceptance-v1/behavior && go test -count=1 ./...` — bundled behavior tests PASS without current checkout.
4. `test -z "$(rg --sort path -n '/config/workspace/iop|replace .*iop|\.\./.*iop' /tmp/iop-chronos-transfer-staging/acceptance-v1)"` — bundle-external IOP source dependency 0.
5. External runner command with real `--local-config`, `--state-root`, `--output` must exit 0 and produce mode `0600`; exact non-secret command/output goes to `transfer-verification.log`.

Commands containing `go test -count=1` require fresh output; all other checks are rerun against the current checkout.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
