<!-- task=m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit plan=2 tag=TEST -->

# Effective disposition matrix와 transfer receipt 감사

## For the Implementing Agent

`CODE_REVIEW-cloud-G09.md`의 implementation-owned 섹션 작성은 필수다. encoded predecessors의 exact PASS를 확인한 뒤 original manifest와 D04 delta를 불변 입력으로 합성하고, 실제 명령 출력까지 기록한 active pair를 유지한 채 review 준비 완료만 보고한다. finalization은 code-review agent만 수행한다. 차단되면 사용자에게 묻거나 상태를 분류하지 말고 exact blocker, 시도한 명령/출력, 재개 조건만 implementation-owned evidence에 기록하며 archive, `complete.log`, control-plane stop file을 만들지 않는다.

## Background

03 ownership manifest는 이미 receipt digest로 고정된 historical snapshot이므로 D04에 맞춰 다시 쓰면 안 된다. 10이 만드는 versioned boundary delta를 exact-path override로 합성해 provider-only IOP와 Chronos-owned agent/terminal 경계를 나타내는 effective final matrix를 만들고, bundle/state/rollback/lock evidence와 함께 redacted transfer receipt로 고정한다.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md)
- Task ids:
  - `inventory`: original manifest digest, D04 boundary delta digest와 effective final matrix
- Completion mode: check-on-pass

## Archive Evidence Snapshot

- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/plan_cloud_G09_0.log`와 `code_review_cloud_G09_0.log`는 split 전 receipt 구상을 보존하지만 implementation evidence나 verdict가 없다.
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/plan_cloud_G09_1.log`와 `code_review_cloud_G09_1.log`는 D02의 generic Node control 가정을 사용한 미착수 pair이며 implementation checklist, verification output, verdict가 없다. D04가 이를 대체했으므로 이 plan은 historical manifest를 수정하지 않는 delta/effective-matrix 방식만 승계한다.
- 이전 두 loop의 Required/Suggested/Nit finding과 Roadmap completion은 없다.

## Analysis

### Files Read

- `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`
- `agent-contract/index.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `agent-spec/index.md`
- `agent-spec/runtime/iop-agent-cli-runtime.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-ops/rules/project/domain/node/rules.md`
- `agent-ops/rules/project/domain/platform-common/rules.md`
- `agent-ops/rules/project/domain/testing/rules.md`
- `agent-test/local/rules.md`
- `agent-test/local/testing-smoke.md`
- `scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv`
- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json`
- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.json`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/09+08_remove_agent_ui_close/PLAN-local-G08.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/PLAN-cloud-G10.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/plan_cloud_G09_0.log`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/code_review_cloud_G09_0.log`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/plan_cloud_G09_1.log`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/code_review_cloud_G09_1.log`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/WORK_LOG.md`
- `/config/workspace/.agent-roadmap-sync/locks.yaml`

### SDD Criteria

- SDD는 `[승인됨]`, 잠금 `해제`이며 target은 S01 / Milestone Task `inventory`다.
- S01과 Evidence Map은 03 receipt의 original manifest digest, D04 boundary delta digest, effective disposition/import-graph audit를 요구한다. historical manifest는 불변이고 모든 `retain-generic` row는 delta가 빠짐없이 재판정해야 한다.
- Encoded predecessor 09는 UI/removal evidence에 기여하지만 Roadmap Task를 닫지 않는다. Task 10 PASS가 S03 `decouple`과 S04 `retain-node`를 함께 닫으며, 이 task는 그 결과와 delta를 전제로 S01을 최종 감사한다.
- S05 evidence도 receipt에 source revision, bundle/state 결과, rollback, external lock identity를 추적 가능하게 요구한다. 따라서 TEST-1은 세 digest와 row-level matrix를, TEST-2는 redacted receipt와 read-only lock/canonical-promotion evidence를 고정한다.

### Verification Context

- Handoff는 없다. active predecessor `09+08_remove_agent_ui_close`, `10+09_neutral_execution`과 같은 task group의 archive candidate에서 exact `complete.log`를 좁게 확인했으나 둘 다 현재 missing이다.
- 10의 고정 산출물 계약은 `boundary-disposition-delta-v1.tsv`와 `boundary-disposition-delta-v1.sha256`이다. TSV header는 `path\tprior_disposition\tfinal_action\tfinal_owner\tfinal_path\treason_code`; original manifest의 `retain-generic` path 전부와 오직 그것만 bytewise sort/unique로 포함한다.
- allowed delta는 `retain-rewrite+iop+nonempty final_path` 또는 `transfer-remove+chronos+-`다. reason은 `iop-provider-boundary | iop-neutral-surface | chronos-agent-cli | chronos-session-terminal-workspace | chronos-agent-status` 중 하나다.
- historical manifest의 current SHA-256은 `7026fedc8b0eb24eab5c4124d3818400f66db5f1d116a71e7781f346fbd256a7`, data rows는 303이고 `retain-generic` rows는 137이다. 구현은 이를 03 receipt에 기록된 digest와도 비교하며 mismatch 시 hard fail한다.
- External preflight는 local read-only shell이다. `/config/workspace/iop-s1`은 branch `feature/iop-agent-chronos-extraction-decoupling`, HEAD `4e85b248381c97836b13aad10ed059c9dbf5961f`, current roadmap/UI/task changes로 dirty다. canonical `/config/workspace/iop`은 clean `dev` at `7ae4be6ceba80c3298d7c2e0968db7d9e8767223`, `/config/workspace/chronos`는 clean `main` at `ed45e2e9c55a9e4e214198517175abf5ce8c7d92`였다.
- Bundle digest 재확인은 owner가 제공하는 task-specific `IOP_CHRONOS_BUNDLE_FILE`만 사용하고 path/content는 출력하지 않는다. canonical promotion은 pending으로 기록할 뿐 수행하지 않으며 Chronos, lock registry, canonical IOP를 수정하지 않는다.
- Linux aarch64, Go `go1.26.2`, `/bin/sha256sum`, `/bin/python3`를 확인했다. 외부 credential, host, port, process는 필요 없다. Confidence는 high이며 predecessor PASS와 owner bundle 파일 접근만 실행 전 precondition이다.

### Test Coverage Gaps

- source behavior를 바꾸지 않아 unit test는 추가하지 않는다. exact-path merge, digest, uniqueness, full-coverage와 redaction은 deterministic shell audit가 담당한다.
- private bundle path/content는 tracked evidence에 넣지 않는다. digest 불일치나 접근 부재는 PASS가 아니라 blocker다.

### Symbol References

- runtime symbol 변경 없음.
- Product ownership names `Chronos bridge/API/proto/config`, CLI agent/session/terminal/workspace는 matrix 최종 처분과 receipt의 zero-count assertion으로만 감사한다.

### Split Judgment

- Predecessor 09와 10의 active/archive exact PASS `complete.log`는 모두 missing이다. directory encoding 밖의 추가 실행 dependency는 없다.
- Stable invariant는 immutable original manifest, mandatory D04 delta와 effective matrix가 exact path로 1:1 대응하고 세 digest가 receipt에서 함께 검증되는 것이다.
- original transfer row는 `transfer-remove/chronos/-`, reference row는 `reference/none/-`로 보존하며 모든 original `retain-generic` row는 mandatory delta로 override한다. unmatched retain row, unknown delta path, duplicate path, unsupported 조합은 hard fail한다.
- matrix merge와 lock audit는 같은 receipt provenance를 공유하므로 분리하지 않는다. PASS evidence는 세 digest match, 303-row effective matrix, unclassified/duplicate 0, bundle/state provenance, external mutation 0이다.

### Scope Rationale

- IOP source 제거, provider-only Node 구현, temporary artifact 삭제와 README/HANDOFF 최종 pointer는 predecessors 및 tasks 14–15가 소유한다.
- Chronos Server/Node/loop/agent/terminal 구현, Chronos import, canonical IOP promotion과 lock mutation은 범위 밖이다.

### Final Routing

- `evaluation_mode=isolated-reassessment`, finalizer=`finalize-task-policy.sh`, mode=`pair`.
- Build closures 모두 true. Scores=`2,1,2,2,2`, grade=`G09`, base/route=`grade-boundary`, lane=`cloud`.
- Review closures 모두 true. Scores=`2,1,2,2,2`, route=`official-review`, lane=`cloud`, grade=`G09`.
- `large_indivisible_context=false`; positive loop risks=`boundary_contract, structured_interpretation` (2); `review_rework_count=0`; `evidence_integrity_failure=false`; capability gap 없음.
- Canonical files: `PLAN-cloud-G09.md`, `CODE_REVIEW-cloud-G09.md`.

## Dependencies and Execution Order

1. `09+08_remove_agent_ui_close`와 `10+09_neutral_execution`은 각각 exactly one matching PASS `complete.log`를 가져야 하며 현재 모두 missing이다.
2. 10 completion directory에서 exact delta TSV와 canonical SHA-256 sidecar를 resolve한다.
3. historical manifest를 수정하지 않고 effective matrix와 receipt를 만든 뒤 read-only cross-repo/lock audit를 실행한다.

## Implementation Checklist

- [ ] Refuse to start until predecessors 09+08_remove_agent_ui_close and 10+09_neutral_execution each have an exact PASS complete.log and owner-local bundle digest input is accessible.
- [ ] Verify the immutable 03 manifest digest and 10 delta v1 digest/shape, then build the exact-path effective final matrix with no unmatched, unknown, duplicate, or unclassified row.
- [ ] Write the redacted transfer receipt with original/delta/effective digests, bundle/state provenance, rollback revision, provider-only IOP boundary, and zero Chronos connection/mutation assertions.
- [ ] Audit iop-s1, canonical iop, Chronos, and the downstream lock read-only; record canonical promotion as pending without mutating external repositories or lock state.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [TEST-1] Immutable manifest와 D04 delta의 effective final matrix

**Problem**

03 manifest를 D04에 맞춰 직접 수정하면 이미 고정된 transfer provenance가 사라지고, 반대로 old `retain-generic` 값을 그대로 사용하면 CLI agent/session/status/quota와 terminal/workspace 책임이 IOP에 남는다.

```text
# SDD Interface Contract / Evidence Map S01
original manifest digest + boundary delta digest -> effective disposition matrix
```

**Solution**

10 completion directory의 six-column delta와 SHA sidecar를 검증한다. original manifest를 path key로 left join하여 모든 `retain-generic` row를 delta로 override하고, original `transfer`와 `reference`는 정해진 fallback으로 보존한다. output은 original fields와 `final_action`, `final_owner`, `final_path`, `reason_code`, `decision_source`를 포함해 original path byte order로 303 rows를 기록한다.

```text
# after: effective-disposition-matrix.tsv
path ... final_action final_owner final_path reason_code decision_source
packages/go/... ... transfer-remove chronos - chronos-session-terminal-workspace boundary-delta-v1
```

**Modified Files and Checklist**

- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/effective-disposition-matrix.tsv` — immutable original + mandatory delta effective audit table.

**Test Strategy**

- SHA sidecar, exact header, bytewise order, unique path, 137/137 retain override, allowed tuple, 303-row coverage와 hard-fail cases를 shell audit로 검증한다.

**Verification**

- `sha256sum scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv` — digest가 `7026fedc8b0eb24eab5c4124d3818400f66db5f1d116a71e7781f346fbd256a7`와 일치한다.
- Resolve exactly one PASS task-10 completion directory, run `sha256sum -c boundary-disposition-delta-v1.sha256`, and verify the six-column/all-and-only-retain-generic delta contract.
- Verify `effective-disposition-matrix.tsv` has the canonical header, 303 unique sorted data paths, 137 delta decisions, no `retain-generic` final decision, and no unmatched/unknown/duplicate path.

### [TEST-2] Redacted receipt와 downstream lock audit

**Problem**

matrix, private bundle/state evidence, rollback과 formal `iop:` lock identity가 흩어져 있으면 최종 handoff가 `iop-s1` 결과를 정식 promotion으로 오인하거나 Chronos를 조기에 변경할 수 있다.

```text
# locks.yaml
chronos:chronos-architecture-ownership-boundary relies on canonical iop:, not iop-s1:
```

**Solution**

receipt에 source revision, 세 matrix digest, bundle/state digests와 counts, rollback, ownership zero assertions, canonical promotion condition을 stable fields로 기록한다. 별도 audit log에는 exact digest comparison, checkout identity, lock-checker output, Chronos before/after status를 남기되 owner path와 raw state를 redacted한다.

```text
# after: transfer-receipt.md
original_manifest_sha256: 7026fedc...
boundary_delta_sha256: <sha256>
effective_matrix_sha256: <sha256>
iop_node_owner: model-provider-device
chronos_connection_surfaces: 0
chronos_repository_mutations: 0
```

**Modified Files and Checklist**

- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/transfer-receipt.md` — S01-S05 provenance, state, rollback and lock receipt.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/handoff-audit.log` — non-secret exact verification output.

**Test Strategy**

- receipt fields를 source artifacts에서 재계산하고 owner-local bundle digest를 path 출력 없이 비교한다. lock/repository는 status/HEAD before-after만 읽는다.

**Verification**

- `rg -n '^source_revision: 3155be0e275437a8eedc1aa93497955a7d30465b$|^original_manifest_sha256: 7026fedc8b0eb24eab5c4124d3818400f66db5f1d116a71e7781f346fbd256a7$|^boundary_delta_sha256: [0-9a-f]{64}$|^effective_matrix_sha256: [0-9a-f]{64}$|^bundle_sha256: [0-9a-f]{64}$|^state_record_count: 8$|^state_quarantine_count: 1$|^iop_node_owner: model-provider-device$|^chronos_connection_surfaces: 0$|^chronos_repository_mutations: 0$|^downstream_lock: chronos:chronos-architecture-ownership-boundary$' agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/transfer-receipt.md`
- Compare receipt digests to the original manifest, task-10 delta, effective matrix, state schema/fixture and owner-local bundle; emit only `*_digest_match=1` lines to `handoff-audit.log`.
- Run both exact lock-checker identities; expected results are `none` for `iop-s1:` and `rely-on:chronos:chronos-architecture-ownership-boundary` for canonical `iop:`.

## Modified Files Summary

| File | Item |
|------|------|
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/effective-disposition-matrix.tsv` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/transfer-receipt.md` | TEST-2 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/handoff-audit.log` | TEST-2 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/CODE_REVIEW-cloud-G09.md` | TEST-1, TEST-2 |

## Final Verification

1. Confirm exactly one PASS `complete.log` for each encoded predecessor `09+08_remove_agent_ui_close` and `10+09_neutral_execution`; resolve the task-10 completion directory from that exact log.
2. `test "$(sha256sum scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv | cut -d' ' -f1)" = 7026fedc8b0eb24eab5c4124d3818400f66db5f1d116a71e7781f346fbd256a7` — immutable 03 digest match.
3. In the exact task-10 completion directory, run `sha256sum -c boundary-disposition-delta-v1.sha256` and verify header, sorted unique paths, allowed tuples, allowed reason codes, and all-and-only 137 original `retain-generic` paths.
4. Verify `effective-disposition-matrix.tsv` has 303 unique bytewise-sorted data rows, exactly one decision for every original path, all 137 delta overrides, only historical transfer/reference fallbacks, and zero unmatched/unknown/duplicate/unclassified rows.
5. Recompute original manifest, delta, effective matrix, state schema/fixture and owner-local bundle SHA-256 values; compare all to `transfer-receipt.md` without printing the owner path/content and record exact non-secret results in `handoff-audit.log`.
6. `rg -n '^source_revision: 3155be0e275437a8eedc1aa93497955a7d30465b$|^original_manifest_sha256: 7026fedc8b0eb24eab5c4124d3818400f66db5f1d116a71e7781f346fbd256a7$|^boundary_delta_sha256: [0-9a-f]{64}$|^effective_matrix_sha256: [0-9a-f]{64}$|^bundle_sha256: [0-9a-f]{64}$|^state_record_count: 8$|^state_quarantine_count: 1$|^iop_node_owner: model-provider-device$|^chronos_connection_surfaces: 0$|^chronos_repository_mutations: 0$|^downstream_lock: chronos:chronos-architecture-ownership-boundary$' agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/transfer-receipt.md`
7. `git -C /config/workspace/chronos status --short && git -C /config/workspace/chronos rev-parse --abbrev-ref HEAD && git -C /config/workspace/chronos rev-parse HEAD && git -C /config/workspace/iop status --short && git -C /config/workspace/iop rev-parse --abbrev-ref HEAD && git -C /config/workspace/iop rev-parse HEAD` — exact read-only checkout evidence; before/after identities unchanged.
8. `agent-ops/bin/roadmap-dependency-checker.sh --find-milestone 'iop-s1:agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md' both /config/workspace/.agent-roadmap-sync/locks.yaml && agent-ops/bin/roadmap-dependency-checker.sh --find-milestone 'iop:agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md' both /config/workspace/.agent-roadmap-sync/locks.yaml` — expected `none`, then `rely-on:chronos:chronos-architecture-ownership-boundary`; do not mutate the lock.
9. `git diff --check`

Commands containing `go test -count=1` require fresh output; all other checks are rerun against the current checkout.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
