<!-- task=m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability plan=7 tag=REVIEW_TEST milestone-task=ops-evidence -->

# Complete Tunnel Sentinel Traversal and Preserve Raw Verification Evidence

## For the Implementing Agent

Implement this follow-up exactly within the declared write set, run every verification command, and fill all implementation-owned sections of `CODE_REVIEW-cloud-G06.md` with actual notes and raw output or the exact saved transcript reference required below. Keep active files in place and report ready for review; finalization belongs to the code-review skill. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The Node observer, panic boundary, numeric duration field, and no-additional-terminal assertions pass fresh verification. Two evidence defects remain: tunnel response sentinels are asserted without entering the request, and long-command review blocks still contain synthesized `Result:` lines. This follow-up changes only the observability test oracle and its implementation evidence.

## Archive Evidence Snapshot

- Review loop 6 will be archived as `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/plan_cloud_G06_6.log` and `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/code_review_cloud_G06_6.log`; verdict `FAIL` with Required R2 and R5.
- R2 remains because `responseVal` in both tunnel fixtures appears only in the rejection list. R5 remains because the focused and reconnect evidence blocks reconstruct `Result:` summaries instead of containing only raw output or an exact transcript reference.
- R3 is resolved: both logger-panic fixtures validate one terminal after handler completion and reject an additional buffered terminal.
- Fresh reviewer execution passed formatting, the focused 20-iteration suite, Node package tests, race, vet, the complete two-process reconnect diagnostic, transcript integrity, and `git diff --check`. The fresh transcript hashes were `0d373d60a612d3da836222e98b6612974cfdb8da43637a5b21f70eb0f3093de8` and `0750c6dc6f355ff8dae782e9dddf5714ed0814b7b591b85344e0d146cef0cfa0`.
- First-line scope remains `milestone-task=ops-evidence`, mapped to SDD Acceptance Scenario S06 and Evidence Map S06. This child remains the Node-only evidence contribution.

## Finding Resolution Map

| Finding | Mode | Exact fix / evidence | Changed precondition |
|---------|------|----------------------|----------------------|
| Required R2 | direct-fix | Update both tunnel fixtures in `apps/node/internal/node/liveness_observability_test.go` to carry `responseVal` in `ProviderTunnelRequest.Metadata` and assert the captured adapter request contains every hostile run/tunnel/session/adapter/target/request/header/body/response/credential value before running the leakage oracle. | Every rejected sentinel will have traversed the real protobuf-to-runtime tunnel request seam. |
| Required R5 | direct-fix | Fill `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/CODE_REVIEW-cloud-G06.md` with raw short-command stdout/stderr; for long commands, record only the exact transcript path created by the displayed command, and place unmodified `wc -l`/`sha256sum` output under transcript integrity with no `Result:` summary. | Review evidence will no longer imitate tool output or reconstruct command results. |

## Analysis

### Files Read

- `apps/node/internal/node/liveness_observability_test.go`
- `apps/node/internal/node/liveness_observability.go`
- `apps/node/internal/node/runtime_bridge.go`
- `apps/node/internal/node/run_handler.go`
- `apps/node/internal/node/tunnel_handler.go`
- `scripts/dev/edge-node-reconnect-diagnostic.sh`
- `agent-contract/inner/execution-runtime.md`
- `agent-contract/inner/edge-node-runtime-wire.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-roadmap/phase/operational-observability-provider-management/PHASE.md`
- `agent-roadmap/phase/operational-observability-provider-management/milestones/node-provider-execution-liveness-recovery.md`
- `agent-roadmap/sdd/operational-observability-provider-management/node-provider-execution-liveness-recovery/SDD.md`
- `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/PLAN-cloud-G06.md`
- `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/CODE_REVIEW-cloud-G06.md`
- `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/plan_cloud_G05_5.log`
- `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/code_review_cloud_G05_5.log`
- `agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/06+05_failure_wire_mapping/complete.log`

### SDD Criteria

- SDD: `agent-roadmap/sdd/operational-observability-provider-management/node-provider-execution-liveness-recovery/SDD.md`; status `[승인됨]`; lock released; no `USER_REVIEW.md`.
- First-line scope is `milestone-task=ops-evidence`; the id exists in the active Milestone and maps to Acceptance Scenario S06 and Evidence Map S06.
- S06 requires Node metric label guards and structured-log capture proving bounded labels and raw-free evidence. R2 closes the final untraversed hostile value; R5 makes the resulting evidence reviewable without reconstruction.

### Verification Context

- No external handoff was supplied. Repository-native evidence is the current checkout at `/config/workspace/iop-s1`, Go `1.26.2`, and module `/config/workspace/iop-s1/go.mod`.
- The local verification sources are `agent-test/local/rules.md`, `agent-test/local/node-smoke.md`, `agent-test/local/platform-common-smoke.md`, `agent-test/local/testing-smoke.md`, and `scripts/dev/edge-node-reconnect-diagnostic.sh`.
- Fresh reviewer commands passed formatting, the focused 20-iteration test, `go test -count=1 ./packages/go/execution ./apps/node/...`, the three-iteration race suite, vet, the complete reconnect diagnostic, transcript integrity, and `git diff --check`.
- The diagnostic runs current-checkout `scripts/dev/edge.sh` and `scripts/dev/node.sh` with temporary configs and random local ports. It requires no external provider, credential, remote host, or user authorization.
- Long output must remain outside the repository at the exact `/tmp` paths in Final Verification. The review artifact may cite those paths but must not invent a result line. Confidence is high.

### Test Coverage Gaps

- Both normalized fixtures inject and forward their hostile response values through metadata.
- Both tunnel fixtures declare `responseVal` but never place it in headers, body, or metadata, so the current rejection scan can pass without exercising that value.
- The no-additional-terminal helper, exact metric/log schema, numeric duration, unknown normalization, and repeated construction are covered and pass.
- Transcript files and raw integrity output exist, but the review formatting still violates the verbatim-evidence rule.

### Symbol References

None. No symbol is renamed or removed.

### Split Judgment

Keep one compact test/evidence follow-up. Tunnel request traversal and transcript fidelity close the same S06 evidence row and have one deterministic verification profile; neither is independently useful as a separate runtime completion.

The `11+06` predecessor is satisfied by `agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/06+05_failure_wire_mapping/complete.log`; it records PASS and fresh integrated Node verification also passes.

### Scope Rationale

Do not change `liveness_observability.go`, watchdog behavior, Node construction, metric names/labels, terminal metadata, wire mapping, Edge ingestion, contracts, specs, roadmap files, or diagnostic scripts. Production behavior is already verified; only `liveness_observability_test.go` and the active review evidence artifact are writable.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer=`finalize-task-policy.sh pair`; status=`routed`.
- Build closures are true for scope, context, verification, evidence, ownership, and decisions. Scores `(1,1,0,2,2)` produce G06 with base `local-fit`; `review_rework_count=3` and `evidence_integrity_failure=true` select `recovery-boundary`, yielding `PLAN-cloud-G06.md`.
- Review closures are true. Scores `(1,1,0,2,2)` produce G06 and `official-review`, yielding `CODE_REVIEW-cloud-G06.md` with Codex `gpt-5.6-sol` xhigh.
- `large_indivisible_context=false`; positive loop risks are `concurrent_consistency` and `variant_product` (2). There is no capability gap.

## Implementation Checklist

- [ ] REVIEW_TEST-1 injects and verifies every hostile tunnel request value, including `responseVal`, through the captured runtime request before the full metric-label and dedicated-log rejection scan.
- [ ] REVIEW_TEST-2 runs every fresh formatting, focused, package, race, vet, complete two-process diagnostic, transcript-integrity, and diff command and records only raw output or the exact long-command transcript reference, with no synthesized result line.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_TEST-1] Prove every tunnel sentinel traverses the request seam

**Problem:** `apps/node/internal/node/liveness_observability_test.go:346` and `apps/node/internal/node/liveness_observability_test.go:406` define tunnel `responseVal` values and add them to `sentinels`, but the requests at lines 357 and 417 never carry those values. The oracle therefore rejects values that did not traverse production code.

**Solution:** Add `Metadata: map[string]string{"response": responseVal}` to both tunnel requests. After receiving `call := <-adapter.tunnelCalls`, assert the captured runtime request contains every hostile identity, header, body, metadata, and session value before driving the stall.

Before:

```go
responseVal := "raw-response-tun-avail"
sentinels := []string{runID, tunnelID, adapterName, target, sessionID, requestID, headerVal, bodyVal, responseVal, credentialVal}
// responseVal is never assigned to the request.
```

After:

```go
Metadata: map[string]string{"response": responseVal},
// After the adapter receives the request:
if call.req.Metadata["response"] != responseVal {
    t.Fatalf("tunnel response sentinel did not traverse request metadata: %#v", call.req.Metadata)
}
```

**Modified Files and Checklist:**

- [ ] `apps/node/internal/node/liveness_observability_test.go`: inject both tunnel response sentinels and assert the complete captured hostile request surface.
- [ ] Preserve the existing four-fixture metric/log matrix, numeric duration, normalization, panic isolation, exactly-once terminal, and repeated-construction assertions.

**Test Strategy:** Modify `TestNodeLivenessObservability` only. Both tunnel health variants must fail if any sentinel is removed from the actual captured request while the shared evidence helper continues to reject all values from every metric label and the full encoded dedicated log.

**Verification:** `go test -count=20 -v ./apps/node/internal/node -run '^TestNodeLivenessObservability$'` passes all named subtests in every iteration.

### [REVIEW_TEST-2] Record raw verification without synthesized result lines

**Problem:** archived loop 6 lines 132 and 194 add `Result:` statements that the focused Go command and reconnect diagnostic did not emit in that form. This repeats Required R5 even though the referenced transcript files themselves were complete and matched their recorded hashes.

**Solution:** For short commands, paste exact stdout/stderr or state only that the command produced no output with its exit status. For the two long commands, record only the exact path created by the command shown in the fixed command field. Put the unmodified `wc -l` and `sha256sum` lines only under Verification 8. Do not add `Result:`, rewrite the diagnostic PASS line, or summarize iteration counts as command output.

Before:

```text
Result: PASS (20 iterations completed with 0 failures, exit status 0)
```

After:

```text
Exact transcript saved by the command above: /tmp/iop-node-liveness-observability-focused.log
```

**Modified Files and Checklist:**

- [ ] `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/CODE_REVIEW-cloud-G06.md`: record actual short output, exact transcript references, and raw integrity output without reconstructed result lines.

**Test Strategy:** No new test file is needed. Verification 8 is the deterministic integrity oracle, and the reviewer will compare the review block against the saved transcripts and reject any synthesized output.

**Verification:** both transcript files are non-empty; raw `wc -l` and `sha256sum` output is present only under the exact integrity command; no `Result:` summary exists in implementation-owned evidence.

## Dependencies and Execution Order

1. Predecessor index 06 is satisfied by `agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/06+05_failure_wire_mapping/complete.log`.
2. Apply REVIEW_TEST-1 before recording REVIEW_TEST-2 so fresh transcript evidence covers the changed oracle.

## Modified Files Summary

| File | Item |
|------|------|
| `apps/node/internal/node/liveness_observability_test.go` | REVIEW_TEST-1 |
| `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/CODE_REVIEW-cloud-G06.md` | REVIEW_TEST-2 |

## Final Verification

Fresh Go execution is required; cached-only output is not acceptable. Preserve actual stdout/stderr. For the long commands, record the exact transcript path created by the displayed command and put raw line-count/checksum output only under command 8.

1. `go version && go env GOMOD` — reports the current Go toolchain and `/config/workspace/iop-s1/go.mod`.
2. `gofmt -w apps/node/internal/node/liveness_observability_test.go && test -z "$(gofmt -d apps/node/internal/node/liveness_observability_test.go)"` — formatting is stable.
3. `go test -count=20 -v ./apps/node/internal/node -run '^TestNodeLivenessObservability$' 2>&1 | tee /tmp/iop-node-liveness-observability-focused.log; test "${PIPESTATUS[0]}" -eq 0` — every named subtest passes 20 times and the exact transcript is saved; record only the transcript path in Verification 3.
4. `go test -count=1 ./packages/go/execution ./apps/node/...` — Node local profile passes.
5. `go test -race -count=3 ./apps/node/internal/node -run 'LivenessObservability|Watchdog|HealthEvidence'` — passes with no race report.
6. `go vet ./packages/go/execution ./apps/node/...` — no diagnostics.
7. `IOP_DEV_RECONNECT_BIND_TIMEOUT=45 ./scripts/dev/edge-node-reconnect-diagnostic.sh 2>&1 | tee /tmp/iop-node-liveness-observability-reconnect.log; test "${PIPESTATUS[0]}" -eq 0` — complete separate Edge/Node registration, two messages, reconnect message, payload parity, commands, terminal ordering, logs, PASS line, and cleanup are saved; record only the transcript path in Verification 7.
8. `test -s /tmp/iop-node-liveness-observability-focused.log && test -s /tmp/iop-node-liveness-observability-reconnect.log && wc -l /tmp/iop-node-liveness-observability-focused.log /tmp/iop-node-liveness-observability-reconnect.log && sha256sum /tmp/iop-node-liveness-observability-focused.log /tmp/iop-node-liveness-observability-reconnect.log` — paste this command's raw stdout without prefixes or summaries.
9. `git diff --check` — run after all source and `CODE_REVIEW-cloud-G06.md` evidence edits; no whitespace errors.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
