<!-- task=m-iop-agent-chronos-extraction-decoupling/17+15,16_canonical_promotion_closure plan=0 tag=REFACTOR milestone-task=handoff-gate -->

# Code Review Reference - REFACTOR

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-02
task=m-iop-agent-chronos-extraction-decoupling/17+15,16_canonical_promotion_closure, plan=0, tag=REFACTOR

## Archive Evidence Snapshot

- `agent-task/archive/2026/08/m-iop-agent-chronos-extraction-decoupling/15+14_handoff_closure/complete.log`: PASS; the tracked final composite receipt and exact `HANDOFF.md` digest were accepted after Task 14 removal evidence.
- `agent-task/archive/2026/08/m-iop-agent-chronos-extraction-decoupling/16_manifest_baseline_repair/complete.log`: PASS; corrected pinned-transfer manifest baseline is 300 rows (`file=290`, `state=10`, `retain-generic=135`) with SHA-256 `d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf`.
- No Required, Suggested, or Nit findings remain in those predecessor completion records. This plan does not reinterpret archived evidence; it promotes the already accepted result and records the canonical identity.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G10.md` → `code_review_cloud_G10_0.log` and `PLAN-cloud-G10.md` → `plan_cloud_G10_0.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-iop-agent-chronos-extraction-decoupling/17+15,16_canonical_promotion_closure/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-iop-agent-chronos-extraction-decoupling`, preserve the first-line `milestone-task` metadata in `complete.log` and report it for the runtime aggregation event. Roadmap state evaluation belongs to `sync-milestone-workstate`.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REFACTOR-1 Protect canonical state and apply the reviewed staging commit | [ ] |
| REFACTOR-2 Prove canonical closure readiness and reconcile Agent UI | [ ] |
| REFACTOR-3 Record exact promotion evidence without opening the lock | [ ] |
| REFACTOR-4 Run final guarded verification and retain rollback evidence | [ ] |

## Implementation Checklist

- [ ] Freeze and promote the reviewed staging change set into canonical IOP without losing the canonical roadmap patch.
- [ ] Verify canonical code, contracts, UI, and provider-only boundaries, then reconcile milestone-scoped Agent UI state while keeping the Chronos lock disabled.
- [ ] Record exact staging/canonical promotion evidence in HANDOFF.md and mirror reconciled UI evidence in this workspace.
- [ ] Run the complete final verification matrix and preserve recovery evidence.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G10_0.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G10_0.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory `agent-task/m-iop-agent-chronos-extraction-decoupling/17+15,16_canonical_promotion_closure/` to `agent-task/archive/YYYY/MM/m-iop-agent-chronos-extraction-decoupling/17+15,16_canonical_promotion_closure/` and update this checklist at the final archive path.
- [ ] If PASS and task group is `m-iop-agent-chronos-extraction-decoupling`, preserve and report `milestone-task` metadata for runtime aggregation, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove empty active parent `agent-task/m-iop-agent-chronos-extraction-decoupling/` or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

- The active `17+15,16_canonical_promotion_closure` PLAN/review pair was excluded from the staging promotion commit because it is the unreviewed control artifact for this implementation run. The reviewed predecessor change set and evidence were committed; the active pair remains in place as required.
- `git diff --cached --check` reported trailing spaces in immutable archived terminal-output logs. Those archive bytes were preserved because they are accepted evidence snapshots. The non-archive staged diff passed `git diff --cached --check -- . ':(exclude)agent-task/archive/**'`.
- The guarded cherry-pick produced 34 conflicts rather than the three roadmap conflicts authorized by the plan. The staging parent `1debc7ada01d98442560bbc4ac52dcef9cae25cc` is an ancestor of current `origin/dev` `c3a24ec5febab9fc978fd62392efcb6c96e12ec9`, but 324 paths changed between them. The cherry-pick was aborted instead of applying an unplanned source/contract/proto conflict policy.
- The REFACTOR-3 and final cross-workspace diagnostics allowed the expected missing `canonical_promotion: applied` match to return nonzero so the lock and recovery state could still be captured after the blocker. They are blocker diagnostics, not passing substitutes for the fixed gates.

## Key Design Decisions

- Created local staging promotion commit `7b90b7e5af9035fae2b5349c65eb322096d21b1b` with 608 staged paths (620 paths reported with rename expansion) and did not push because push was not authorized.
- Stopped at the first out-of-plan conflict boundary. No conflict was resolved by choosing `ours` or `theirs`, and no canonical source, contract, proto, Agent UI, HANDOFF promotion field, or workspace lock was changed by the failed cherry-pick.
- Retained two byte-identical recovery copies of the original canonical roadmap patch: `/tmp/iop-canonical-promotion.QOCOar/canonical-roadmap.patch` and named stash `stash@{0}` (`iop-canonical-promotion-roadmap-20260802T102956Z`), both SHA-256 `1f1afe533e910b6311390071e07799bf6cc24ca742853bb45a3eceb3da1d4575`.
- After aborting the cherry-pick, canonical remains at fast-forwarded `origin/dev` commit `c3a24ec5febab9fc978fd62392efcb6c96e12ec9`, and the protected three-file roadmap patch was reapplied from the retained stash. The Chronos dependency remains `disable`.
- Resume condition: re-plan the promotion against `origin/dev` `c3a24ec5febab9fc978fd62392efcb6c96e12ec9` by first producing a reviewed staging commit based on that upstream state, or provide an explicit reviewed resolution policy for all 34 conflicts. Then retry canonical promotion before running closure, Agent UI reconciliation, HANDOFF promotion recording, or final regressions.

## Reviewer Checkpoints

- Confirm the staging promotion commit is backed by the previously accepted Task 15/16 evidence and contains the intended milestone change set.
- Confirm canonical user-owned `[separation-01]` and priority-queue edits were preserved through fetch/cherry-pick/reconciliation.
- Compare promoted non-roadmap source and contract trees; reject unexplained divergence or unmerged paths.
- Verify fresh canonical Go, Flutter, Control Plane/Edge wire, reconnect, readability, and forbidden-surface results.
- Verify Agent UI reconciliation occurred only after check-only closure readiness and both status/index/sync-state agree.
- Verify both handoff copies record actual commit identities and preserve every prior receipt/digest.
- Verify the parent Chronos lock remains disabled and the milestone remains active for a subsequent `complete-milestone` archive transaction.
- Verify the saved canonical patch and named stash remain recoverable and their locators/digest are recorded.

## Verification Results

Paste actual stdout/stderr below each command. If output is too long, record the exact saved-output path and the command that created it. Any replacement command requires a matching entry in `Deviations from Plan`.

### REFACTOR-1 Canonical state and merge checks

```bash
git -C /config/workspace/iop status -sb
git -C /config/workspace/iop diff --name-only | LC_ALL=C sort
git -C /config/workspace/iop diff --check
git -C /config/workspace/iop diff --name-only --diff-filter=U
```

_Actual output:_

```text
BLOCKED before promotion completion.

Guarded cherry-pick:
  staging promotion commit: 7b90b7e5af9035fae2b5349c65eb322096d21b1b
  canonical fast-forward HEAD: c3a24ec5febab9fc978fd62392efcb6c96e12ec9
  cherry-pick result: conflict (34 paths; plan authorized only three roadmap conflicts)
  exact conflict list: /tmp/iop-canonical-promotion.QOCOar/unexpected-conflicts.txt
  conflict-list SHA-256: 15e564744e83accd74981a5976432d14d8638815cab0fefc1d1eaabe97a4aca4
  recovery action: git cherry-pick --abort; git stash apply stash@{0}

Current canonical state after recovery:
## dev...origin/dev
 M agent-roadmap/phase/automation-runtime-bridge/PHASE.md
 M agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md
 M agent-roadmap/priority-queue.md
agent-roadmap/phase/automation-runtime-bridge/PHASE.md
agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md
agent-roadmap/priority-queue.md

`git diff --check`: exit 0, no output.
`git diff --name-only --diff-filter=U`: exit 0, no output.
Canonical promotion commit does not exist because the guarded cherry-pick was aborted.
```

### REFACTOR-2 Canonical runtime and UI checks

Run from `/config/workspace/iop`:

```bash
mkdir -p /config/workspace/iop/.tmp
TMPDIR=/config/workspace/iop/.tmp GOTMPDIR=/config/workspace/iop/.tmp go test -count=1 ./...
make client-test
make client-build-web
make test-control-plane-edge-wire
make readability-audit
IOP_DEV_RECONNECT_BIND_TIMEOUT=60 scripts/dev/edge-node-reconnect-diagnostic.sh
```

_Actual output:_

```text
BLOCKED — not run. Canonical runtime verification is not valid until a reviewed promotion commit is applied without unresolved upstream conflicts.
Resume after the 34-conflict upstream integration policy is reviewed and canonical promotion succeeds.
```

### REFACTOR-3 Promotion identity and lock checks

Run from `/config/workspace/iop-s1`:

```bash
git -C /config/workspace/iop rev-parse --verify HEAD^{commit}
git -C /config/workspace/iop-s1 rev-parse --verify HEAD^{commit}
rg -n '^canonical_promotion: applied$|^staging_promotion_commit: [0-9a-f]{40}$|^canonical_promotion_commit: [0-9a-f]{40}$|^canonical_promotion_verified_at: ' /config/workspace/iop/HANDOFF.md HANDOFF.md
agent-ops/bin/roadmap-dependency-checker.sh --find-milestone 'iop:agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md' both /config/workspace/.agent-roadmap-sync/locks.yaml
```

_Actual output:_

```text
c3a24ec5febab9fc978fd62392efcb6c96e12ec9
7b90b7e5af9035fae2b5349c65eb322096d21b1b

No `canonical_promotion: applied`, staging/canonical promotion commit, or verification timestamp fields matched because promotion was aborted.

rely-on:chronos:chronos-architecture-ownership-boundary

Lock excerpt:
7:- id: chronos:chronos-architecture-ownership-boundary
8-  locked: chronos:agent-roadmap/phase/runtime-ownership-transition/milestones/chronos-architecture-ownership-boundary.md
9-  rely-on:
10-    - target: iop:agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md
11-      status: disable
```

### Final canonical regression

Run from `/config/workspace/iop`:

```bash
mkdir -p /config/workspace/iop/.tmp
TMPDIR=/config/workspace/iop/.tmp GOTMPDIR=/config/workspace/iop/.tmp go test -count=1 ./...
make client-test
make client-build-web
make test-control-plane-edge-wire
make readability-audit
IOP_DEV_RECONNECT_BIND_TIMEOUT=60 scripts/dev/edge-node-reconnect-diagnostic.sh
git diff --check
```

_Actual output:_

```text
BLOCKED — not run. The canonical checkout contains the upstream baseline plus the restored user-owned roadmap patch, not the reviewed staging promotion tree.
```

### Final canonical boundary and state checks

Run from `/config/workspace/iop`:

```bash
if rg --sort path -n -i 'chronos|agent_bridge|iop-agent|iop_agent|IopAgent|agentruntime|agentprovider|agenttask|agentworkspace' apps packages/go cmd proto configs; then exit 1; fi
test ! -d apps/agent
test -z "$(find packages/go -maxdepth 1 -type d -name 'agent*' -print -quit)"
test -z "$(git diff --name-only --diff-filter=U)"
rg -n '^status: 구현됨$|^Status: `구현됨`$' agent-ui/definition/components/console-shell/index.md
jq -e '.pending_milestone_work | length == 0' agent-ui/.sync-state.json
jq -e '.reconciled_milestone_work | any(.milestone_path == "agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md" and .state == "reconciled")' agent-ui/.sync-state.json
rg -n '^canonical_promotion: applied$|^staging_promotion_commit: [0-9a-f]{40}$|^canonical_promotion_commit: [0-9a-f]{40}$' HANDOFF.md
git diff --check
```

_Actual output:_

```text
BLOCKED — not run as a passing gate. The forbidden-surface and applied-promotion assertions are expected to fail before canonical promotion.
No unmerged paths remain after `git cherry-pick --abort`.
```

### Final cross-workspace preservation checks

Run from `/config/workspace/iop-s1`:

```bash
git diff --check
rg -n '^canonical_promotion: applied$|^staging_promotion_commit: [0-9a-f]{40}$|^canonical_promotion_commit: [0-9a-f]{40}$' HANDOFF.md
agent-ops/bin/roadmap-dependency-checker.sh --find-milestone 'iop:agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md' both /config/workspace/.agent-roadmap-sync/locks.yaml
rg -n -A4 'id: chronos:chronos-architecture-ownership-boundary' /config/workspace/.agent-roadmap-sync/locks.yaml
```

_Actual output, including retained patch path, SHA-256, and named stash locator:_

```text
Staging `git diff --check`: exit 0, no output.
No applied-promotion fields matched in `HANDOFF.md` because promotion was aborted.
rely-on:chronos:chronos-architecture-ownership-boundary
7:- id: chronos:chronos-architecture-ownership-boundary
8-  locked: chronos:agent-roadmap/phase/runtime-ownership-transition/milestones/chronos-architecture-ownership-boundary.md
9-  rely-on:
10-    - target: iop:agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md
11-      status: disable

Retained recovery patch: /tmp/iop-canonical-promotion.QOCOar/canonical-roadmap.patch
Patch SHA-256: 1f1afe533e910b6311390071e07799bf6cc24ca742853bb45a3eceb3da1d4575
Named stash: stash@{0} (iop-canonical-promotion-roadmap-20260802T102956Z)
Stash patch copy: /tmp/iop-canonical-promotion.QOCOar/stash-roadmap.patch
Stash patch SHA-256: 1f1afe533e910b6311390071e07799bf6cc24ca742853bb45a3eceb3da1d4575
Patch/stash byte comparison: equal
Unexpected conflict list: /tmp/iop-canonical-promotion.QOCOar/unexpected-conflicts.txt
Conflict-list SHA-256: 15e564744e83accd74981a5976432d14d8638815cab0fefc1d1eaabe97a4aca4
```

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail — the reviewed staging tree was not applied to the canonical checkout.
  - Completeness: Fail — REFACTOR-1 through REFACTOR-4 remain incomplete.
  - Test Coverage: Fail — the required fresh canonical Go, Flutter, wire, reconnect, readability, and boundary verification matrix was not run.
  - API Contract: Fail — the canonical source, contract, proto, and UI trees remain on the upstream pre-promotion baseline.
  - Code Quality: Pass — the unexpected cherry-pick was aborted without resolving unreviewed conflicts, and the protected roadmap patch remains recoverable.
  - Implementation Deviation: Fail — the planned three-roadmap-conflict promotion expanded to 34 conflicts and could not produce the required canonical commit.
  - Verification Trust: Pass — fresh review reproduced the reported commit identities, 34-path conflict list and digest, retained patch/stash digest, clean abort state, three restored roadmap edits, and disabled downstream lock.
  - Spec Conformance: Fail — SDD S05 requires canonical traceability through the final composite receipt, but canonical promotion and closure evidence are absent.
- Findings:
  - Required — `HANDOFF.md:83`, `/config/workspace/iop/apps/agent/cmd/agent/main.go:1`, and `CODE_REVIEW-cloud-G10.md:156`: canonical promotion is still pending, the canonical checkout still tracks the legacy Agent runtime surface, and the mandatory canonical verification matrix was not run. Rebuild or rebase the reviewed promotion change set onto canonical `c3a24ec5febab9fc978fd62392efcb6c96e12ec9`, review and resolve the full 34-path upstream overlap, apply the resulting commit to `/config/workspace/iop`, then complete the canonical regression, Agent UI reconciliation, mirrored handoff evidence, and lock-preservation checks before requesting another review.
- Routing Signals: `review_rework_count=1`, `evidence_integrity_failure=false`
- Next Step: Create a freshly routed follow-up PLAN/CODE_REVIEW pair for the required canonical integration and closure verification work; do not write `complete.log` or update the roadmap.
