<!-- task=m-iop-owned-single-request-agent-execution/20+19_review_repair plan=3 tag=REVIEW_API milestone-task=review-stage -->

# Close Review-stage evidence gaps

## For the Implementing Agent

Filling the implementation-owned sections of `CODE_REVIEW-cloud-G05.md` is the mandatory final implementation step. Run every verification command, paste actual output, keep both active files in place, and report ready for review. Only the official code-review skill may append a verdict, archive files, write `complete.log`, or classify the next state. If blocked, record the exact blocker, attempted commands/output, and resume condition in the review evidence; do not ask the user, call a user-input tool, create a control-plane stop file, or change the owner or scope.

## Background

The Review stage implementation passes its focused race and package regressions, but the completed review artifact claimed tests that are absent. This follow-up closes Required R1 with deterministic Review-specific authority, continuation-correlation, and failure-path evidence without changing production behavior.

## Archive Evidence Snapshot

- The reviewed pair is archived as `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/plan_cloud_G07_2.log` and `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/code_review_cloud_G07_2.log`; the official verdict is FAIL with Required R1 and no Suggested or Nit findings.
- R1: the completed checklist claimed exact request-body, correlation, stale/duplicate-result, and provider/tool/envelope failure fixtures, but `single_request_review_stage_test.go` lacked that Review-specific matrix and left `envelopeErr` unused.
- Fresh reviewer evidence passed the dependency check, focused Review race test, service compatibility, OpenAI vet/regression, formatting, activation guard, and diff hygiene. The non-zero HEAD diff for `single_request.go` contains only predecessor-owned artifact interface methods; the lifecycle table is unchanged.
- The contribution remains `milestone-task=review-stage`. Production composite activation and external Claude/Mac S12 qualification remain outside this follow-up.

## Finding Resolution Map

| Finding | Mode | Exact fix | Changed precondition |
|---------|------|-----------|----------------------|
| Required R1 | `direct-fix` | Add the missing Review-specific exact-body, provider/envelope/tool failure, wrong/stale/duplicate continuation, and waiter-cleanup assertions in `apps/edge/internal/openai/single_request_review_stage_test.go`; replace the active review evidence with fresh output. | The previously absent tests exist and execute under the focused race command, so re-review evaluates new evidence rather than repeating the unchanged packet. |

## Analysis

### Files Read

- `apps/edge/internal/openai/single_request_review_stage.go`
- `apps/edge/internal/openai/single_request_review_stage_test.go`
- `apps/edge/internal/openai/single_request_provider_stage.go`
- `apps/edge/internal/openai/single_request_provider_stage_test.go`
- `apps/edge/internal/openai/single_request_work_stage.go`
- `apps/edge/internal/openai/single_request_work_stage_test.go`
- `apps/edge/internal/openai/single_request_plan_stage.go`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-owned-single-request-agent-execution.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-contract/outer/anthropic-compatible-api.md`
- `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/plan_cloud_G07_2.log`
- `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/code_review_cloud_G07_2.log`

### SDD Criteria

- SDD: `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md`, status `[승인됨]`, lock released.
- `milestone-task=review-stage` maps to Acceptance Scenario S10 and the S10 Evidence Map row requiring Review pass/defect/repair plus finalization evidence.
- The missing negative-path fixtures weaken that evidence row, so the checklist adds Review-specific frozen-authority, correlation, failure, and cleanup proof and reruns the focused race test. S12 remains separate.

### Verification Context

- No external verification handoff was supplied. Repository-native fallback used the local Edge rules, the active PLAN/review pair, approved SDD, current source/tests, and predecessor completion evidence.
- Precondition: exactly one task-19 completion exists at `agent-task/archive/2026/08/m-iop-owned-single-request-agent-execution/19+18_work_stage/complete.log`.
- Current checkout: branch `feature/iop-owned-single-request-agent-execution`, HEAD `22a8b81201e89d75c1e6c92342a8081472e8e436`, dirty shared worktree preserved. Local toolchain is `go1.26.2 linux/arm64` for a Go 1.24 module.
- Fresh reviewer commands passed: focused Review `-race`, service state/cleanup compatibility, OpenAI vet/regression, `gofmt -d`, activation guard, and `git diff --check`.
- The required fix is local and deterministic; no remote runner, credential, device, or external provider is needed. Confidence is high. Actual Claude/Mac full-cycle evidence stays with S12 `claude-smoke`.

### Test Coverage Gaps

- Covered: strict pass, REVIEW-before-finalizing order, inspection and repair lifecycle shape, malformed decision/envelope decoding, artifact write failure, iteration bound, cancellation, and basic waiter cleanup.
- Missing for R1: exact server-owned request body, Review-specific provider and envelope failures, real coordinator tool failure, and wrong/stale/duplicate continuation rejection with zero finalization/artifact leakage.
- Production source behavior is unchanged by this test-only follow-up.

### Symbol References

- No production symbol is renamed or removed.
- Test-only helper fields/functions may be added or replaced inside `single_request_review_stage_test.go`; no non-test call site changes are allowed.

### Split Judgment

- `20+19_review_repair` depends on task index 19, satisfied by `agent-task/archive/2026/08/m-iop-owned-single-request-agent-execution/19+18_work_stage/complete.log`.
- The exact-body and failure/correlation assertions close one compact R1 evidence boundary in one test file. Splitting would duplicate the same stage harness and race oracle.

### Scope Rationale

- Include only `single_request_review_stage_test.go` and the active review evidence file.
- Exclude production Review source, composite executor, production installation, service lifecycle changes, contract/spec updates, generic error/cancel work, and S12 external qualification. A discovered production defect must be recorded as a deviation/blocker rather than silently widening the write boundary.

### Final Routing

- `evaluation_mode=isolated-reassessment`; all build/review closures are true; no capability gap.
- Build scores `1/2/0/1/1` => G05, base `local-fit`. Positive loop risks are `temporal_state`, `concurrent_consistency`, `boundary_contract`, and `structured_interpretation` (4); `large_indivisible_context=false`.
- `review_rework_count=1` and `evidence_integrity_failure=true` select `recovery-boundary`, `worker/cloud/G05`, `PLAN-cloud-G05.md`.
- Review scores `1/2/0/1/1` => G05, `official-review`, `review/cloud/G05`, `CODE_REVIEW-cloud-G05.md`.
- Finalizer: `finalize-task-policy.sh`, mode `pair`.

## Dependencies and Execution Order

1. Resolve exactly one task-19 completion with the Final Verification dependency command.
2. Add all R1 tests before rerunning the focused race command; do not alter production source to make a test pass.
3. Fill `CODE_REVIEW-cloud-G05.md` with actual outputs only after every command completes.

## Implementation Checklist

- [ ] Add exact Review dispatch/body authority assertions for initial and resumed requests, including frozen Gemini route, high reasoning, closed tools, single-call serialization, and forbidden credential/override absence.
- [ ] Add Review-specific provider, envelope, coordinator tool, and wrong/stale/duplicate continuation failure fixtures that prove no REVIEW/finalizing state or leaked waiter on failure under `-race`.
- [ ] Run dependency, focused race, service compatibility, OpenAI vet/regression, deterministic coverage, source-boundary, activation, lifecycle-diff, and diff-hygiene checks.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_API-1] Add the missing Review evidence matrix

**Problem**

At `apps/edge/internal/openai/single_request_review_stage_test.go:124`, the request check uses substring membership only. At lines 188-258, the failure suite covers decoder, artifact, iteration, and cancellation cases but never uses the declared `envelopeErr`, returns a provider error, drives a failed Node tool through the service coordinator, or injects wrong/stale/duplicate Review continuation results. The archived checklist nevertheless marked those fixtures complete.

**Solution**

Decode each captured initial/resumed request and assert the complete server-owned authority shape, including exact fixed fields and absence of forbidden overrides. Extend the Review test harness with deterministic stage-targeted envelope failure and explicit continuation control. Add a small service-backed Review executor fixture, reusing the existing Work Node harness primitives, so a typed Node tool failure proves coordinator fail-closed behavior and cleanup.

Before (`single_request_review_stage_test.go:124`):

```go
if len(bodies) != 1 || !containsAll(string(bodies[0]), singleRequestReviewPrompt, "reasoning_effort", "high", "workspace_read", "Updated result.txt.") {
    t.Fatalf("body=%q", bodies)
}
```

After:

```go
func TestSingleRequestReviewStageExactBodyAuthority(t *testing.T) { /* deep assertions for initial and resumed bodies */ }
func TestSingleRequestReviewStageFailureMatrix(t *testing.T) { /* provider and stage-targeted envelope failures */ }
func TestSingleRequestReviewStageContinuationCorrelation(t *testing.T) { /* wrong, stale, duplicate, then exact result */ }
func TestSingleRequestReviewStageCoordinatorToolFailure(t *testing.T) { /* real service/Node typed failure and cleanup */ }
```

**Modified Files and Checklist**

- [ ] Update `apps/edge/internal/openai/single_request_review_stage_test.go` with the four named deterministic fixtures and any test-local helpers.
- [ ] Update `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/CODE_REVIEW-cloud-G05.md` with actual decisions and command output.

**Test Strategy**

Write the four named tests. Assert exact request authority on both initial Review and re-review; provider and envelope errors return only `errSingleRequestReviewStage`; wrong results do not consume the valid waiter; stale and concurrent duplicate delivery are rejected; real Node tool failure produces no continuation, REVIEW artifact, or finalizing state; every path leaves `pendingCount()==0`. Use existing deterministic provider and Node fixtures; no external provider is called.

**Verification**

Run the focused Review race command and the OpenAI package regression from Final Verification. Both must pass freshly, and the deterministic test-name search must find all four fixtures.

## Modified Files Summary

| File | Items |
|------|-------|
| `apps/edge/internal/openai/single_request_review_stage_test.go` | REVIEW_API-1 |
| `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/CODE_REVIEW-cloud-G05.md` | REVIEW_API-1 |

## Final Verification

Fresh output is required; Go tests use `-count=1` and cached output is not acceptable.

1. `bash -c 'set -euo pipefail; shopt -s nullglob; candidates=(agent-task/m-iop-owned-single-request-agent-execution/19_*/complete.log agent-task/m-iop-owned-single-request-agent-execution/19+*/complete.log agent-task/archive/*/*/m-iop-owned-single-request-agent-execution/19_*/complete.log agent-task/archive/*/*/m-iop-owned-single-request-agent-execution/19+*/complete.log); printf "%s\n" "${candidates[@]}"; ((${#candidates[@]} == 1))'` — prints exactly one predecessor completion path and exits zero.
2. `go test -race ./apps/edge/internal/openai -run 'TestSingleRequestReviewStage' -count=1` — all Review authority, pass, inspection, repair, correlation, provider/envelope/tool failure, cancellation, and cleanup fixtures pass without races.
3. `go test ./apps/edge/internal/service -run 'TestSingleRequest(InternalToolLoop|Cleanup|EnvelopeOrdering)' -count=1` — shared coordinator lifecycle remains compatible.
4. `go vet ./apps/edge/internal/openai && go test ./apps/edge/internal/openai -count=1` — the changed test package vets and regresses cleanly.
5. `rg --sort path -n '^func TestSingleRequestReviewStage(ExactBodyAuthority|FailureMatrix|ContinuationCorrelation|CoordinatorToolFailure)' apps/edge/internal/openai/single_request_review_stage_test.go` — finds all four required fixtures in stable order.
6. `test "$(git hash-object apps/edge/internal/openai/single_request_review_stage.go)" = '1fa8c84bdd5af917dbb091d2843bb1c6e0bb3ac2'` — production Review source remains unchanged by this test-only follow-up.
7. `test ! -e apps/edge/internal/openai/single_request_executor.go && bash -c 'set -euo pipefail; if rg --sort path -n "NewSingleRequestExecutor|SetSingleRequestExecutor" apps/edge/internal/input/manager.go; then exit 1; else test $? -eq 1; fi'` — composite construction and activation remain deferred.
8. `bash -c 'set -euo pipefail; if git diff --unified=0 HEAD -- apps/edge/internal/service/single_request.go | rg -n "isValidTransition|SingleRequestState(Reviewing|Repairing)"; then exit 1; else test $? -eq 1; fi'` — exits zero with no output because no lifecycle-table delta exists.
9. `git diff --check` — exits zero with no whitespace errors.

External Claude/Mac qualification remains S12 `claude-smoke`.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
