<!-- task=m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure plan=3 tag=REVIEW_REVIEW_REVIEW_TEST -->

# Confined Runtime Semantics and Trustworthy Logged-Smoke Closure

## For the Implementing Agent

Implement every checklist item, run the exact verification commands, and fill the implementation-owned sections of `CODE_REVIEW-cloud-G10.md` with actual notes and stdout/stderr. Keep the active PLAN/CODE_REVIEW files in place and report ready for review; finalization belongs only to the code-review workflow. If blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The previous loop added a standalone runtime and an S14 harness, but review found that official review bypasses executable confinement, canonical verdicts are not parsed, shared selection and post-apply validation are not composed, and Pi repair is unavailable in production. The field harness also derives success from hard-coded booleans and status projections rather than bounded runtime evidence, and no authenticated macOS manifest exists. This follow-up closes those runtime and evidence defects before attempting the mandatory field run.

## Archive Evidence Snapshot

- Prior task: `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure`
- Prior plan: `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/plan_cloud_G10_2.log`
- Prior review: `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/code_review_cloud_G10_2.log`
- Verdict: FAIL
- Findings: five Required, zero Suggested, zero Nit. The implementation artifact was entirely unfilled, while canonical verdict parsing, official-review confinement, Pi same-context repair, shared selection/continuation, and mandatory validation remain incorrect or uncomposed. The S14 harness still fabricates lifecycle success and the real macOS manifest remains absent.
- Affected files: standalone taskloop provider/evidence/review/integration/module adapters, CLI and daemon composition, S14 harness/schema/Make targets, standalone contract, and field evidence.
- Verification evidence: a fresh focused taskloop test, shell syntax, smoke self-test/preflight, Make dry-run, and `git diff --check` passed on Linux arm64, but the passing tests do not exercise the Required defects. Read-only dev-runner preflight found Darwin arm64 on clean branch `feature/openai-compatible-output-validation-filters` at `750cb1d1cb88066a10d3c703c99f1326306d8e15`; provider and build tools are absent from the non-interactive PATH but exist under `/opt/homebrew/bin`. No field mutation ran and no manifest was produced.
- Routing signals: `review_rework_count=3`, `evidence_integrity_failure=true`.
- Roadmap carryover: this task remains the sole completion owner for `logged-smoke`; task 26 remains dependency-waiting.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone document](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `logged-smoke`: authenticated macOS discovery-through-completion multi-project field validation
- Completion mode: check-on-pass

## Analysis

### Files Read

- `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/PLAN-cloud-G10.md`
- `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/CODE_REVIEW-cloud-G10.md`
- `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/code_review_cloud_G10_1.log`
- `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- `agent-contract/inner/agent-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `apps/agent/internal/taskloop/provider.go`
- `apps/agent/internal/taskloop/provider_test.go`
- `apps/agent/internal/taskloop/evidence.go`
- `apps/agent/internal/taskloop/evidence_test.go`
- `apps/agent/internal/taskloop/review.go`
- `apps/agent/internal/taskloop/review_test.go`
- `apps/agent/internal/taskloop/integration.go`
- `apps/agent/internal/taskloop/integration_test.go`
- `apps/agent/internal/taskloop/module.go`
- `apps/agent/internal/taskloop/module_test.go`
- `apps/agent/cmd/agent/main.go`
- `apps/agent/cmd/agent/main_test.go`
- `apps/agent/internal/bootstrap/module.go`
- `apps/agent/internal/bootstrap/module_test.go`
- `packages/go/agenttask/ports.go`
- `packages/go/agentpolicy/evaluator.go`
- `packages/go/agentpolicy/failure_policy.go`
- `packages/go/agentpolicy/quota.go`
- `scripts/e2e-iop-agent-logged-smoke.sh`
- `scripts/fixtures/iop-agent-smoke-manifest.schema.json`
- `Makefile`
- `agent-test/local/rules.md`
- `agent-test/local/platform-common-smoke.md`
- `agent-test/local/testing-smoke.md`
- `agent-test/dev/rules.md`
- `agent-test/dev/platform-common-smoke.md`
- `agent-test/dev/testing-smoke.md`

### SDD Criteria

- SDD: `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`, status approved and implementation-unlocked.
- Acceptance scenarios: S08 `workflow-evidence`, S10 `cli-surface`, S14 `logged-smoke`, and S19 `change-set-integration`.
- Milestone Task id: `logged-smoke`.
- Evidence Map: S08 requires Pi same-native-context repair followed by a fresh exact artifact match; S10 requires authoritative CLI/daemon runtime composition; S14 requires an exact-source authenticated macOS multi-project manifest; S19 requires real post-apply validation, rollback, retained blockers, queue continuation, and restart safety.
- These rows require runtime-path tests before field execution and require the final manifest to reference bounded discovery, quota, process/session, project-log, archive, cancellation, restart, and terminal evidence instead of self-asserted booleans.

### Verification Context

- Handoff: the prior review supplied exact findings, affected paths, Linux verification output, routing signals, and the missing-field-evidence blocker.
- Current checkout: branch `feature/iop-agent-cli-runtime`, HEAD `c2f91e2f1099ed93494832a268eb32f41d0c1530`, dirty with milestone-wide user changes. Preserve unrelated changes.
- Current host: `Linux 6.10.14-linuxkit aarch64`; Go `go1.26.2 linux/arm64`; `/bin/ssh`, `/config/.local/bin/go`, and `/bin/jq` exist.
- Fresh reviewer commands: focused taskloop tests, `bash -n`, `make test-iop-agent-logged-smoke-preflight`, `make -n test-iop-agent-logged-smoke`, `git diff --check`, and read-only dev-runner identity/tool probes.
- Constraints: no real provider CLI may run in Go tests; credentials and raw home paths must never enter tracked evidence; no current-host field result may substitute for S14.
- Gaps: the dev runner is clean but currently on the wrong branch/revision, and its non-interactive PATH omits required Homebrew tools. The exact remote field revision cannot be selected until implementation is stable and available on a clean source ref. Provider authentication, two clean selected-task clones, and a clean output root must be proven immediately before the field run.
- Confidence: high for the code and local harness defects; field completion remains conditional on a clean exact-revision authenticated macOS execution.

#### External Verification Preflight

- Runner: `ssh toki@toki-labs.com`; repo root `/Users/toki/agent-work/iop-dev`, from `agent-test/dev/rules.md`.
- Required preflight before mutation:

```bash
ssh toki@toki-labs.com '
  set -eu
  PATH=/opt/homebrew/bin:/usr/local/bin:$PATH
  export PATH
  cd /Users/toki/agent-work/iop-dev
  uname -srm
  git branch --show-current
  git rev-parse HEAD
  git status --short
  command -v go
  command -v jq
  command -v codex
  command -v claude
  go version
'
```

- Read-only result on 2026-07-30: Darwin `25.0.0 arm64`; clean checkout on `feature/openai-compatible-output-validation-filters` at `750cb1d1cb88066a10d3c703c99f1326306d8e15`. `go`, `jq`, `codex`, and `claude` were missing from the original non-interactive PATH, and executable copies were found under `/opt/homebrew/bin`.
- Source sync: after the reviewed implementation is available on the selected dev ref, clean-sync the declared dev checkout according to `agent-test/dev/rules.md`, rebuild `build/bin/iop-agent` from that exact HEAD, and require its SHA-256 plus both clone HEADs to match manifest source identity. Do not reuse an existing binary.
- Config/artifacts: tracked repo config and provider catalog from the exact checkout; user-local config, owned `0700` state root, two distinct clean registered clones, and absolute new output root remain runner-local. Do not print credential material.
- Runtime identity: Darwin arm64 or amd64, no existing matching daemon/socket, provider discovery and quota/status ready, authenticated catalog profiles, exact owned daemon PID/start token.
- If the runner checkout is dirty, the source ref is unavailable, a command is missing, provider auth is unavailable, or either clone/binary identity differs, stop before lifecycle mutation and record the exact setup/sync/rebuild blocker.

### Test Coverage Gaps

- Canonical `Overall Verdict:` parsing is untested; the current test uses `Verdict:`.
- Official review does not have a test proving exact retained confinement validation and zero launch on missing/stale/mismatched proof.
- Pi repair is tested only as an expected “not configured” error; no same-session production repair/rematch test exists.
- Static default selection is covered, but ordered project policy, persisted route evidence, quota-backed continuation, and unused-target failover are not exercised through `taskloop.Runtime`.
- Nil integration validation currently succeeds; no construction failure or production validation-failure/rollback/independent-queue test exists.
- CLI/daemon tests prove control surfaces but do not drive a fake provider through submission, canonical official review, change-set freeze, validation, integration, restart, and terminal project-log/archive evidence.
- Harness self-test validates schema and PID cleanup only; it does not reject fabricated lifecycle booleans, non-running cancellation, missing discovery/quota/session/log/archive evidence, duplicate restart invocation, or a binary not built from the declared HEAD.
- No real logged-in macOS manifest exists.

### Symbol References

- `CatalogReviewExecutor.ExecuteReview` is called only by `Reviewer.Review`; update its interface, constructor, fake, and tests together if the confinement-bearing request shape changes.
- `NewEvidence` is called by `taskloop.New` and focused evidence tests; add the production repairer at both call sites.
- `NewIntegration` is called by `taskloop.New` and integration tests; remove the nil-success fallback and update every call site.
- `configSelector.Select` is passed only to `agenttask.NewManager`; preserve the `agenttask.Selector` contract and add `FailureContinuationPolicySource` only through the existing common policy types.
- `taskloop.Config.Validator` is constructed by CLI `adapter.runtime`, daemon `NewDaemonModule`, and tests; update all callers.

### Split Judgment

Keep one plan. The field manifest is valid only if it is produced by the corrected selector, confined provider/review/repair paths, real validator, and hardened evidence harness at one exact revision. Splitting field execution from its runtime prerequisites would allow a manifest from behavior that the review has already found non-authoritative.

### Scope Rationale

- Do not change shared `agenttask.Manager`, `agentguard`, `agentpolicy`, or `agentworkspace` algorithms; the defect is in standalone host adaptation and composition.
- Do not change local-control or client-process protocols, UI clients, Python cutover task 26, roadmap state, or unrelated dirty files.
- Do not add provider secrets, raw user paths, or unbounded logs to the schema or tracked evidence.
- Do not relax Darwin, clean-source, exact-HEAD, authentication, containment, or exact-PID gates to make the field run pass.

### Final Routing

- Evaluation mode: `isolated-reassessment`.
- Status: `routed`; finalizer `finalize-task-policy.sh`, mode `pair`.
- Build closures: scope/context/verification/evidence/ownership/decision all true from the reviewed code, approved SDD, deterministic local commands, and declared dev preflight. Capability gap: not observed.
- Build grade scores: scope coupling 2, state concurrency 2, blast/irreversibility 2, evidence diagnosis 2, verification complexity 2; grade G10.
- Build base route basis and route basis: `grade-boundary`; lane `cloud`; filename `PLAN-cloud-G10.md`.
- Review closures: scope/context/verification/evidence/ownership/decision all true. Review grade scores: 2/2/2/2/2; route basis `official-review`; lane `cloud`; grade G10; adapter `codex`; model `gpt-5.6-sol`; reasoning effort `xhigh`; filename `CODE_REVIEW-cloud-G10.md`.
- `large_indivisible_context=false`.
- Positive loop-risk signatures: `temporal_state`, `concurrent_consistency`, `boundary_contract`, `structured_interpretation`, `variant_product`; count 5.
- Recovery signals: `review_rework_count=3`, `evidence_integrity_failure=true`; risk and recovery boundaries both matched, without replacing the grade-boundary basis.

## Implementation Checklist

- [ ] Correct canonical official-review parsing, exact retained confinement, and Pi same-native-context repair with deterministic zero-real-provider regressions.
- [ ] Compose common ordered selection/continuation semantics and a mandatory post-apply validator into both CLI and daemon, with end-to-end persisted lifecycle/rollback tests.
- [ ] Harden the S14 harness, manifest schema, and Make preflight so every lifecycle claim is derived from bounded runtime evidence and fabricated success is rejected.
- [ ] Run fresh local verification, then exact-revision dev macOS preflight and field execution; attach the validated redacted manifest and update the standalone contract with only verified evidence.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_REVIEW_REVIEW_TEST-1] Confine Review and Restore Same-Context Evidence

#### Problem

`apps/agent/internal/taskloop/review.go:224` cannot parse the canonical `Overall Verdict:` field. `review.go:270-294` launches a catalog provider outside the retained executable confinement. `apps/agent/internal/taskloop/module.go:214` passes no Pi repairer, so S08 always fails at `evidence.go:111`.

#### Solution

Parse exactly one canonical verdict field below the last `## Code Review Result` heading, with an explicitly tested legacy alias only if compatibility is required. Rehydrate the exact retained isolation through the existing backend and validate its descriptor, profile, confinement revision, and binding before building or starting the official-review command. Share the catalog command/session adapter with Pi repair so repair resumes only the durable `LocatorSession` in the same retained view, then let `agenttask.Manager` perform the mandatory fresh evidence observation.

```go
// Before: apps/agent/internal/taskloop/review.go:224
upper := strings.ToUpper(strings.TrimSpace(strings.TrimPrefix(text, "Verdict:")))
```

```go
// After: apps/agent/internal/taskloop/review.go
field, value, ok := splitReviewResultField(text)
if ok && field == "Overall Verdict" {
    return parseCanonicalVerdict(value)
}
```

```go
// Before: apps/agent/internal/taskloop/review.go:285
return provider.Execute(ctx, runtime.ExecutionSpec{Workspace: workspace, ...}, discardRuntimeEvents{})
```

```go
// After: apps/agent/internal/taskloop/review.go
prepared, err := executor.backend.Prepare(ctx, exactIsolationRequest(request))
if err != nil { return err }
if err := validateReviewConfinement(request, prepared); err != nil { return err }
return executor.invokeConfined(ctx, prepared.Confinement, exactReviewCommand(request, prepared))
```

#### Modified Files and Checklist

- [ ] `apps/agent/internal/taskloop/provider.go` — expose one side-effect-free catalog command/session preparation path usable by worker, review, and Pi repair.
- [ ] `apps/agent/internal/taskloop/provider_test.go` — prove exact confinement binding, session resume identity, and zero raw provider launch.
- [ ] `apps/agent/internal/taskloop/evidence.go` — implement a production repairer that resumes only the persisted Pi native session in the retained view.
- [ ] `apps/agent/internal/taskloop/evidence_test.go` — add same-context repair/rematch, stale locator, wrong provider, and no-launch denial cases.
- [ ] `apps/agent/internal/taskloop/review.go` — parse canonical verdicts and invoke official review only through exact retained confinement.
- [ ] `apps/agent/internal/taskloop/review_test.go` — add canonical artifact and missing/stale/mismatched confinement regressions.

#### Test Strategy

Write `TestReadReviewVerdictAcceptsCanonicalOverallVerdict`, `TestCatalogReviewExecutorRequiresExactRetainedConfinement`, and `TestPiEvidenceRepairResumesExactNativeSession`. Use fake confinement handles and deterministic shell fixtures only; assert the declared provider executable is never run directly.

#### Verification

```bash
go test -count=1 ./apps/agent/internal/taskloop -run 'Test(ReadReviewVerdict|CatalogReviewExecutor|PiEvidenceRepair|Provider)'
```

Expected: canonical artifacts parse, exact proof launches once through the fake boundary, and every identity mismatch launches zero processes.

### [REVIEW_REVIEW_REVIEW_TEST-2] Compose Shared Policy and Real Validation

#### Problem

`apps/agent/internal/taskloop/module.go:505-531` ignores ordered project policy and common continuation semantics. `apps/agent/internal/taskloop/integration.go:25-28` turns an absent validator into success, and both production callers omit one. Existing CLI/daemon tests stop before provider submission, review, validation, and integration.

#### Solution

Adapt `agentpolicy.Evaluator` and the existing failure-continuation policy types into `agenttask.Selector`/`FailureContinuationPolicySource`; convert the durable route decision to an exact catalog-backed execution target without reimplementing selection. Remove nil validation fallback. Require the standalone composition to provide a deterministic validator that runs against `ValidationRequest.ValidationRoot`, returns an error on command failure, and never validates by mutating the canonical root. Inject the same construction through CLI and daemon. Drive a fake-provider lifecycle through canonical review, freeze, validation failure/rollback, sibling queue continuation, restart, and terminal evidence.

```go
// Before: apps/agent/internal/taskloop/module.go:505
target := registration.Selection.Default
```

```go
// After: apps/agent/internal/taskloop/module.go
decision, err := selector.evaluator.SelectPolicy(ctx, selector.snapshot, selectionContext(request))
if err != nil { return agenttask.ExecutionTarget{}, err }
return selector.executionTarget(decision)
```

```go
// Before: apps/agent/internal/taskloop/integration.go:25
if validator == nil {
    validator = func(ctx context.Context, _ agentworkspace.ValidationRequest) error {
        return ctx.Err()
    }
}
```

```go
// After: apps/agent/internal/taskloop/integration.go
if validator == nil {
    return nil, errors.New("taskloop: post-apply validator is required")
}
```

#### Modified Files and Checklist

- [ ] `apps/agent/internal/taskloop/integration.go` — reject missing validation and preserve exact validation-root errors as retained blockers.
- [ ] `apps/agent/internal/taskloop/integration_test.go` — cover construction denial, validation failure, rollback, restart, and independent queue continuation.
- [ ] `apps/agent/internal/taskloop/module.go` — delegate ordered selection and continuation to common policy and compose repair/review/validation dependencies.
- [ ] `apps/agent/internal/taskloop/module_test.go` — execute a two-project fake-provider lifecycle through persisted selection, review, integration, cancellation, restart, and terminal evidence.
- [ ] `apps/agent/cmd/agent/main.go` — supply the same explicit validator and runtime dependencies for bounded CLI mutations.
- [ ] `apps/agent/cmd/agent/main_test.go` — extend the headless transcript through validation failure and a fresh invocation reading persisted terminal evidence.
- [ ] `apps/agent/internal/bootstrap/module.go` — supply the daemon-owned validator and preserve one manager/state owner.
- [ ] `apps/agent/internal/bootstrap/module_test.go` — prove daemon reconciliation, local-control projection, rollback, sibling continuation, and restart use the same task runtime.

#### Test Strategy

Write focused adapter tests plus one deterministic application-level lifecycle fixture. The validator fixture records `ValidationRoot`, fails one change set, proves canonical content is unchanged, and allows an independent sibling ordinal to complete. Run the same state through a reconstructed runtime to prove restart convergence.

#### Verification

```bash
go test -count=1 ./apps/agent/internal/taskloop ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap
go test -count=1 -race ./apps/agent/internal/taskloop ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./packages/go/agenttask ./packages/go/agentstate
```

Expected: shared policy evidence is preserved, missing validation fails construction, failed validation leaves no partial canonical mutation, and independent work completes across restart.

### [REVIEW_REVIEW_REVIEW_TEST-3] Bind S14 Claims to Runtime Evidence

#### Problem

`scripts/e2e-iop-agent-logged-smoke.sh:427-445` substitutes catalog listing and ad hoc auth checks for runtime discovery/quota readiness. It accepts `completed` while waiting for `running` at lines 285-286, hashes status projections as terminal evidence at lines 494-495, and hard-codes lifecycle success at lines 536-544. The schema therefore permits a valid-looking manifest without the S14 behavior.

#### Solution

Make each manifest lifecycle field a derived assertion over bounded artifacts captured during the run. Require runtime discovery plus safe quota/status evidence, distinct invocation/session locators, ordered project-log evidence, exact stop/cancel identity, retained restart identity with no duplicate invocation, and terminal archive evidence. Require both projects to reach `running` before cancellation; never accept terminal completion as a substitute. Bind source HEAD to a freshly built binary and both clean clone HEADs. Keep the allow-list/redaction/size rules, but make validation reject a true claim whose referenced evidence is missing or inconsistent.

```bash
# Before: scripts/e2e-iop-agent-logged-smoke.sh:536
lifecycle:{
  discovery:true,
  cancellation:true,
  restart_recovery:true,
  terminal_completion:true
}
```

```bash
# After: scripts/e2e-iop-agent-logged-smoke.sh
jq -n \
  --argjson discovery "$(assert_discovery_evidence)" \
  --argjson cancellation "$(assert_cancellation_evidence)" \
  --argjson restart_recovery "$(assert_restart_evidence)" \
  --argjson terminal_completion "$(assert_terminal_archives)" \
  '{lifecycle:{discovery:$discovery,cancellation:$cancellation,
               restart_recovery:$restart_recovery,
               terminal_completion:$terminal_completion}}'
```

#### Modified Files and Checklist

- [ ] `scripts/e2e-iop-agent-logged-smoke.sh` — capture and cross-check discovery/quota, process/session, project-log, cancellation, restart, duplicate-invocation, and terminal archive evidence.
- [ ] `scripts/fixtures/iop-agent-smoke-manifest.schema.json` — require bounded evidence locators/digests and cross-field lifecycle prerequisites without allowing raw paths or credentials.
- [ ] `Makefile` — keep stable preflight/field targets and make self-test exercise safe success plus each fabricated/missing-evidence rejection.

#### Test Strategy

Extend `--self-test` with deterministic fixtures that fail one invariant at a time: completed-before-running, static catalog-only discovery, missing quota, reused invocation identity, missing session/log/archive locator, mismatched HEAD/binary digest, fabricated lifecycle boolean, oversized output, secret, raw home path, and PID replacement. Keep all fixtures outside the repository or remove them on exit.

#### Verification

```bash
bash -n scripts/e2e-iop-agent-logged-smoke.sh
make test-iop-agent-logged-smoke-preflight
make -n test-iop-agent-logged-smoke
```

Expected: safe synthetic evidence passes; every fabricated, incomplete, unbounded, sensitive, or identity-drifted manifest fails before field execution.

### [REVIEW_REVIEW_REVIEW_TEST-4] Produce Exact-Revision Field Evidence

#### Problem

The current checkout is Linux and the prior loop produced no actual authenticated macOS manifest. S14 cannot pass from local preflight or a synthetic manifest.

#### Solution

After all code and local checks are stable, run the external preflight above. Clean-sync the declared dev runner to the exact reviewed source ref, rebuild the binary there, create two distinct clean selected-task clones at the same HEAD, prove authenticated discovery and quota/status without printing secrets, and run the exact Make field target. Validate the output again, copy only the redacted manifest to the deterministic task path below, and update the contract and review evidence with exact commands and stdout/stderr.

```bash
make test-iop-agent-logged-smoke \
  IOP_AGENT_SMOKE_LOCAL_CONFIG="$IOP_AGENT_SMOKE_LOCAL_CONFIG" \
  IOP_AGENT_SMOKE_PROJECT_A="$IOP_AGENT_SMOKE_PROJECT_A" \
  IOP_AGENT_SMOKE_PROJECT_B="$IOP_AGENT_SMOKE_PROJECT_B" \
  IOP_AGENT_SMOKE_OUTPUT="$IOP_AGENT_SMOKE_OUTPUT"
scripts/e2e-iop-agent-logged-smoke.sh \
  --validate-manifest "$IOP_AGENT_SMOKE_OUTPUT/manifest.json"
```

#### Modified Files and Checklist

- [ ] `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/logged-smoke-manifest.json` — store only the schema-valid redacted exact-revision manifest.
- [ ] `agent-contract/inner/iop-agent-cli-runtime.md` — replace provisional S08/S10/S14/S19 claims with exact corrected source, tests, and field evidence.
- [ ] `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/CODE_REVIEW-cloud-G10.md` — record actual local and field commands/output, manifest validation, redaction scan, and any exact blocker.

#### Test Strategy

This is required external verification, not a mocked test. PASS requires Darwin, exact source/build/clone identity, authenticated providers, two projects, cancellation isolation, new invocation, restart recovery, terminal archives, schema validation, and redaction. If preflight cannot prove any prerequisite, do not run and record the exact blocker.

#### Verification

```bash
jq -e . agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/logged-smoke-manifest.json >/dev/null
scripts/e2e-iop-agent-logged-smoke.sh \
  --validate-manifest agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/logged-smoke-manifest.json
if rg -n -i 'authorization|bearer|api[_-]?key|token|/Users/|/home/' \
  agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/logged-smoke-manifest.json; then
  exit 1
fi
```

Expected: the copied manifest validates, contains no credential or raw home path, and its evidence digests match the exact field output retained on the runner.

## Dependencies and Execution Order

Implement REVIEW_REVIEW_REVIEW_TEST-1 and REVIEW_REVIEW_REVIEW_TEST-2 before REVIEW_REVIEW_REVIEW_TEST-3. Run all local verification before REVIEW_REVIEW_REVIEW_TEST-4. Do not field-test an unreviewable dirty source snapshot or reuse an old runner binary.

## Modified Files Summary

| File | Item |
|------|------|
| `apps/agent/internal/taskloop/provider.go` | REVIEW_REVIEW_REVIEW_TEST-1 |
| `apps/agent/internal/taskloop/provider_test.go` | REVIEW_REVIEW_REVIEW_TEST-1 |
| `apps/agent/internal/taskloop/evidence.go` | REVIEW_REVIEW_REVIEW_TEST-1 |
| `apps/agent/internal/taskloop/evidence_test.go` | REVIEW_REVIEW_REVIEW_TEST-1 |
| `apps/agent/internal/taskloop/review.go` | REVIEW_REVIEW_REVIEW_TEST-1 |
| `apps/agent/internal/taskloop/review_test.go` | REVIEW_REVIEW_REVIEW_TEST-1 |
| `apps/agent/internal/taskloop/integration.go` | REVIEW_REVIEW_REVIEW_TEST-2 |
| `apps/agent/internal/taskloop/integration_test.go` | REVIEW_REVIEW_REVIEW_TEST-2 |
| `apps/agent/internal/taskloop/module.go` | REVIEW_REVIEW_REVIEW_TEST-2 |
| `apps/agent/internal/taskloop/module_test.go` | REVIEW_REVIEW_REVIEW_TEST-2 |
| `apps/agent/cmd/agent/main.go` | REVIEW_REVIEW_REVIEW_TEST-2 |
| `apps/agent/cmd/agent/main_test.go` | REVIEW_REVIEW_REVIEW_TEST-2 |
| `apps/agent/internal/bootstrap/module.go` | REVIEW_REVIEW_REVIEW_TEST-2 |
| `apps/agent/internal/bootstrap/module_test.go` | REVIEW_REVIEW_REVIEW_TEST-2 |
| `scripts/e2e-iop-agent-logged-smoke.sh` | REVIEW_REVIEW_REVIEW_TEST-3 |
| `scripts/fixtures/iop-agent-smoke-manifest.schema.json` | REVIEW_REVIEW_REVIEW_TEST-3 |
| `Makefile` | REVIEW_REVIEW_REVIEW_TEST-3 |
| `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/logged-smoke-manifest.json` | REVIEW_REVIEW_REVIEW_TEST-4 |
| `agent-contract/inner/iop-agent-cli-runtime.md` | REVIEW_REVIEW_REVIEW_TEST-4 |
| `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/CODE_REVIEW-cloud-G10.md` | REVIEW_REVIEW_REVIEW_TEST-4 |

## Final Verification

Run with fresh Go execution; cached success is not acceptable.

```bash
gofmt -w \
  apps/agent/internal/taskloop/provider.go \
  apps/agent/internal/taskloop/provider_test.go \
  apps/agent/internal/taskloop/evidence.go \
  apps/agent/internal/taskloop/evidence_test.go \
  apps/agent/internal/taskloop/review.go \
  apps/agent/internal/taskloop/review_test.go \
  apps/agent/internal/taskloop/integration.go \
  apps/agent/internal/taskloop/integration_test.go \
  apps/agent/internal/taskloop/module.go \
  apps/agent/internal/taskloop/module_test.go \
  apps/agent/cmd/agent/main.go \
  apps/agent/cmd/agent/main_test.go \
  apps/agent/internal/bootstrap/module.go \
  apps/agent/internal/bootstrap/module_test.go
go test -count=1 ./apps/agent/internal/taskloop ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./apps/agent/internal/command
go test -count=1 -race ./apps/agent/internal/taskloop ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./packages/go/agenttask ./packages/go/agentstate
go vet ./apps/agent/internal/taskloop ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./packages/go/...
bash -n scripts/e2e-iop-agent-logged-smoke.sh
make build-agent
GOOS=darwin GOARCH=arm64 go build -trimpath -o /tmp/iop-agent-review-darwin-arm64 ./apps/agent/cmd/agent
make test-iop-agent-logged-smoke-preflight
go test -count=1 ./...
git diff --check
```

Expected: all commands exit 0; no real provider CLI runs in Go tests; local self-test rejects fabricated lifecycle evidence; full regression has no repeatable failure.

Then execute the external preflight and exact-revision field commands in REVIEW_REVIEW_REVIEW_TEST-4. Validate and redact the deterministic manifest path. PASS requires that real field manifest; a Linux gate, synthetic fixture, skipped provider/quota check, or summarized output is insufficient.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
