<!-- task=m-iop-agent-cli-runtime/14+13_cli_config_fixtures plan=1 tag=API -->

# Split CLI Configuration Fixtures

## For the Implementing Agent

Filling implementation-owned sections in `CODE_REVIEW-cloud-G06.md` is mandatory. Run verification, paste actual output, leave active files in place, and report ready for review. Finalization is code-review-only. If blocked, record exact blocker evidence and resume conditions without asking the user, creating stop files, archiving, or writing `complete.log`.

## Background

The headless CLI needs tracked repo-global and user-local examples before command and binary packets can consume deterministic configuration inputs. This packet owns only the secret-free fixtures and their strict, read-only validation.

## Analysis

### Files Read

- `packages/go/agentconfig/runtime_config.go`
- `packages/go/agentconfig/runtime_config_test.go`
- `configs/iop-agent.providers.yaml`
- `agent-task/m-iop-agent-cli-runtime/14+13_cli_config_fixtures/plan_local_G06_0.log`
- `agent-task/m-iop-agent-cli-runtime/14+13_cli_config_fixtures/code_review_cloud_G06_0.log`

### SDD Criteria

S10 requires split configuration and validation evidence. This strict subset supplies only the configuration-fixture portion and does not claim `cli-surface` completion.

### Verification Context

Use the original plan's fresh Go test and `git diff --check` requirements. No external service, secret, build, or field runner is needed.

### Test Coverage Gaps

- No tracked standalone runtime configuration examples exist.
- No test proves tracked examples load strictly and validation leaves repo-global input unchanged.

### Symbol References

None. This packet adds fixtures and tests without renaming shared symbols.

### Split Judgment

API-1 is independently implementable and verifiable. It depends on `13_agent_domain`; command parsing, binary construction, and contract evidence remain in later CLI children.

### Scope Rationale

Do not add Cobra commands, the executable entry point, Makefile targets, transcript evidence, secrets, or device-specific paths.

### Final Routing

- evaluation_mode: `first-pass`
- finalizer: `finalize-task-policy.sh pair`
- build: closure complete, `local-G06`, basis `local-fit`, filename `PLAN-local-G06.md`
- review: closure complete, `cloud-G06`, basis `official-review`, filename `CODE_REVIEW-cloud-G06.md`
- large_indivisible_context: `false`
- positive loop risks: `broad command matrix` (count `1`)
- recovery signals: rework `0`, evidence-integrity failure `false`
- capability-gap evidence: none

## Implementation Checklist

- [ ] Add secret-free repo-global and user-local example configurations with strict validation tests.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [API-1] Add Split Configuration Fixtures

#### Problem

`packages/go/agentconfig/runtime_config.go` defines separate repo-global and user-local schemas, but `configs/` contains only the provider catalog and no runnable runtime examples.

#### Solution

Add `configs/iop-agent.runtime.yaml` with defaults, selection, isolation, and retention. Add `configs/iop-agent.local.example.yaml` with placeholder absolute roots and project registration. Keep provider catalog data separate and validate both examples through the existing strict loader.

#### Modified Files and Checklist

- [ ] `configs/iop-agent.runtime.yaml` — add repo-global runtime defaults.
- [ ] `configs/iop-agent.local.example.yaml` — add a secret-free device/project example.
- [ ] `apps/agent/internal/command/config_test.go` — validate examples and read-only behavior.

#### Test Strategy

Write `TestTrackedRuntimeExamplesLoad` and `TestValidateDoesNotMutateRepoConfig`; copy the local example into a temp root after substituting absolute paths.

#### Verification

```bash
go test -count=1 ./apps/agent/internal/command -run 'TestTrackedRuntimeExamplesLoad|TestValidateDoesNotMutateRepoConfig'
```

Expected: both tests pass.

## Dependencies and Execution Order

Predecessor `13_agent_domain` must produce a same-group active or archived `complete.log`. This packet must complete before `18+14,15_cli_command_tree` and before the client-process packet extends the user-local example.

## Modified Files Summary

| File | Item |
|------|------|
| `configs/iop-agent.runtime.yaml` | API-1 |
| `configs/iop-agent.local.example.yaml` | API-1 |
| `apps/agent/internal/command/config_test.go` | API-1 |

## Final Verification

```bash
gofmt -w apps/agent/internal/command/config_test.go
go test -count=1 ./apps/agent/internal/command -run 'TestTrackedRuntimeExamplesLoad|TestValidateDoesNotMutateRepoConfig'
git diff --check
```

Expected: fresh fixture tests and diff validation pass. After completing all changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
