<!-- task=m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence plan=8 tag=REVIEW_OFR-S07-IDENTITY-DEADLINE-8 -->

# Accept bounded continuation identities and close S07 evidence

## For the Implementing Agent

Filling implementation-owned sections in `CODE_REVIEW-cloud-G09.md` is mandatory. Implement the scoped changes, run every applicable verification command, record actual notes and output in the review file, keep the active pair in place, and report ready for official review.

If blocked, record the exact blocker, attempted commands/output, mutation and invocation counts, and resume condition only in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, write `complete.log`, or modify roadmap state. Review finalization belongs to the code-review skill.

The remote portion authorizes one fresh isolated source overlay and at most one foreground S07 model invocation on the fresh plan-8 artifact path after every gate passes. It does not authorize another Edge build, replacement, restart, rollback, config change, or retry after `remote_live_start`.

## Background

Plan 7 fixed the post-open Chat tunnel error terminal and deployed the reviewed candidate, but its only live run exposed two evidence-harness defects. A recovered caller stream can contain a bounded ordered sequence of provider-native response IDs, while the validator currently requires one scalar ID; one request also exceeded the hard-coded 20-minute client timeout. This follow-up changes only the live evidence harness, preserves the deployed candidate, and permits one fresh capacity+1 run.

## Archive Evidence Snapshot

- `plan_cloud_G10_7.log` / `code_review_cloud_G10_7.log`: FAIL with three Required findings and trusted evidence.
- The deployed production candidate correctly emits the Chat post-open error event plus one final `[DONE]`; focused and full local/isolated-remote profiles passed before deployment.
- The sole plan-7 invocation observed provider response ID transitions inside two recovered caller streams and one client-side 20-minute timeout. No accepted `summary.json` exists.
- Required rework is limited to `apps/edge/internal/openai/stream_gate_vertical_slice_test.go`: preserve a bounded ordered ID sequence per logical caller response, reject non-contiguous reuse and cross-request overlap, make the live request deadline command-configurable within the enclosing test budget, and rerun S07 once on a fresh path.
- The plan-7 partial artifact, source overlay, binary backup, and all earlier artifacts must remain preserved.
- Fresh reviewer evidence: local focused tests pass; remote checkout `750cb1d1cb88066a10d3c703c99f1326306d8e15` is clean; Edge PID `20646` serves the deployed plan-7 candidate hash `e0eff854e5c6841e6dd5cafcd7242254c91ece26b4ad328a2b937acca42122e5`; four listeners, four connected nodes, and idle healthy capacity `3+1` are present; plan-8 source/result paths are absent and no live harness is running.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md`
- Milestone link: [Milestone document](agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md)
- Task ids:
  - `repeat-guard`: rolling content/history/action repetition detection and safe continuation
- Completion mode: check-on-pass

## Analysis

### Files Read

- `apps/edge/internal/openai/stream_gate_vertical_slice_test.go`
- `apps/edge/internal/openai/stream_gate_release_sink.go`
- `apps/edge/internal/openai/stream_gate_tunnel_codec.go`
- `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/plan_cloud_G10_7.log`
- `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/code_review_cloud_G10_7.log`
- `agent-ops/rules/project/domain/edge/rules.md`
- `agent-ops/rules/project/domain/testing/rules.md`
- `agent-test/local/rules.md`
- `agent-test/local/edge-smoke.md`
- `agent-test/local/testing-smoke.md`
- `agent-spec/runtime/stream-evidence-gate.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-contract/outer/openai-compatible-api.md`
- `agent-contract/inner/edge-node-runtime-wire.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/PHASE.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/openai-compatible-output-validation-filters/SDD.md`

### SDD Criteria

- SDD: `agent-roadmap/sdd/knowledge-tool-optimization-extension/openai-compatible-output-validation-filters/SDD.md`; status approved, lock released.
- S03 maps to `repeat-guard` and requires safe stream-open continuation with one final `[DONE]`; the deterministic terminal regression remains the local oracle.
- S07 requires a capacity+1 `ornith:35b` stream smoke for three runs with sanitized `reproduced` fingerprint/offset or `not_reproduced` evidence.
- Evidence Map S03 requires duplicate opening/prefix suppression and a single terminal. Evidence Map S07 requires the dev smoke and raw-free operational evidence.
- The checklist therefore treats ordered provider IDs as attempt evidence inside one logical response, keeps the caller terminal grammar unchanged, and requires the complete fresh S07 summary before reporting only `repeat-guard`.

### Verification Context

- Environment rules are usable. Local setup is `go version && go env GOMOD`; the required fresh unit profile is `go test -count=1 ./packages/go/streamgate ./apps/edge/internal/openai`; lint is `git diff --check`.
- Current local runner is `/config/workspace/iop-s1`, Go `go1.26.2 linux/arm64`, module `/config/workspace/iop-s1/go.mod`. The focused plan-7 terminal and validator tests passed uncached during review.
- The current checkout has unrelated user/task changes. Modify only the two exact workspace files in `Modified Files Summary`.
- Raw tokens, Authorization headers, prompts, model output, raw SSE, and status payloads must not enter tracked evidence or chat output.

#### External Verification Preflight

- Runner/workdir: `ssh toki@toki-labs.com`; immutable base checkout `/Users/toki/agent-work/iop-dev`; Darwin/arm64; `/opt/homebrew/bin/go` `go1.26.3`.
- Base checkout is clean at `750cb1d1cb88066a10d3c703c99f1326306d8e15`. The sibling dependency is `/Users/toki/agent-work/proto-socket/go`.
- Runtime identity: native Edge PID `20646`, executable/config `build/dev-runtime/bin/edge` / `build/dev-runtime/edge.yaml`, listeners `18001/18083/18084/19093`.
- Runtime hash is `e0eff854e5c6841e6dd5cafcd7242254c91ece26b4ad328a2b937acca42122e5` and matches the preserved plan-7 candidate. Four nodes are connected; `onexplayer-lemonade` capacity 3 and `rtx5090-lemonade` capacity 1 are healthy and idle.
- Plan-7 source/result artifacts are preserved and the result has no accepted summary. Fresh paths are `/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-8-source` and `/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-8`; both were absent at review preflight.
- No S07 harness is running. Host-local SOPS token ref `toki-dev-pi` remains the only authorized credential path; it must be used without printing the token/header/hash.
- Source sync mismatch is expected: create a fresh isolated remote tree from remote HEAD and overlay exactly the two unchanged production files plus the modified vertical-slice test. Do not edit the remote checkout.
- Do not rebuild or replace the Edge. Before `remote_live_start`, require the runtime hash to remain equal to the preserved plan-7 candidate, require two consecutive idle capacity samples, and require authenticated `/v1/models` HTTP 200.
- Confidence is high for the harness diagnosis and runtime identity. The live repeat result is probabilistic; both accepted S07 classifications remain valid.

### Test Coverage Gaps

- Existing SSE fixtures reject every response-ID transition. Add valid two-ID success/error continuations plus missing, invalid-prefix, over-bound, non-contiguous reuse, logical-terminal, and cross-request overlap cases.
- Existing evidence structs and final uniqueness checks store one provider ID per logical response. Change them to bounded ordered lists and validate flattened global disjointness.
- No deterministic test covers duration parsing or whether `runs × request timeout` leaves cleanup reserve under `t.Deadline`. Add `TestDevRepeatGuardRequestDeadline`.
- Local fixtures cannot produce the final capacity and live-provider evidence. The fresh plan-8 isolated overlay and single S07 invocation close that gap.

### Symbol References

- `devRepeatGuardSSEEvidence.providerResponseID` is consumed by `runDevRepeatGuardSmokeAttempt`, `TestStreamGateChatTunnelRepeatRecoveryExhaustionTerminatesSSE`, and `TestDevRepeatGuardSmokeEvidence`.
- `devRepeatGuardSmokeEvidence.ProviderResponseID` is consumed by summary encoding, `validateDevRepeatGuardUniqueEvidence`, `correlateDevRepeatGuardBatch`, and `TestDevRepeatGuardObservationCorrelation`.
- `validateDevRepeatGuardSSE` is used only by the live smoke attempt and focused evidence tests.
- No public or production symbol changes.

### Split Judgment

Keep one packet. The compact invariant is that the same harness must parse one logical caller response containing bounded attempt-native IDs, enforce uniqueness across 15 concurrent logical responses, apply a deadline that fits the enclosing run budget, and then validate the resulting summary. A test-only split would not independently close S07.

### Scope Rationale

- Modify no production Stream Gate, tunnel codec/sink, handler, service, config, contract, spec, roadmap, or runtime file.
- Do not normalize or rewrite provider-native success frames and do not require one provider ID across a recovered caller stream.
- Do not weaken the one-error-or-success-plus-final-`[DONE]` grammar.
- Do not infer a positional pairing between provider-native IDs and Edge lifecycle correlations; require disjoint complete sets and terminal cardinality instead.
- Remote writes are limited to the two fresh plan-8 temporary paths and ignored raw run artifacts. Preserve the deployed binary, process, config, checkout, credentials, and all prior artifacts.

### Final Routing

- `evaluation_mode=isolated-reassessment`
- `finalizer=finalize-task-policy.sh`, `finalizer_mode=pair`
- Build closures: scope/context/verification/evidence/ownership/decision are all closed; no capability gap.
- Build scores: scope coupling 2, state/concurrency 2, blast/irreversibility 1, evidence/diagnosis 2, verification complexity 2; grade `G09`; base/final basis `grade-boundary`; lane `cloud`; filename `PLAN-cloud-G09.md`.
- Review scores: `2/2/1/2/2`; grade `G09`; basis `official-review`; lane `cloud`; filename `CODE_REVIEW-cloud-G09.md`; adapter `codex`, model `gpt-5.6-sol`, reasoning effort `xhigh`.
- `large_indivisible_context=false`
- Positive loop-risk signatures: `temporal_state`, `concurrent_consistency`, `boundary_contract`, `structured_interpretation`; `loop_risk_count=4`.
- `review_rework_count=8`
- `evidence_integrity_failure=false`

## Implementation Checklist

- [ ] [REVIEW_OFR-S07-IDENTITY-DEADLINE-8-1] Represent each logical caller response with a bounded ordered provider-native ID sequence, accept contiguous continuation transitions, reject non-contiguous reuse and cross-request overlap, and expand deterministic success/error/invalid fixtures.
- [ ] [REVIEW_OFR-S07-IDENTITY-DEADLINE-8-2] Replace the fixed 20-minute client timeout with a command-configurable per-request duration that is bounded against the enclosing test deadline with explicit cleanup reserve; add parsing and budget boundary tests and run fresh local profiles.
- [ ] [REVIEW_OFR-S07-IDENTITY-DEADLINE-8-3] Build and test a fresh isolated plan-8 source overlay, prove the deployed plan-7 candidate and idle `3+1` runtime remain unchanged, run at most one foreground 5-concurrent x 3-run S07 invocation, and validate the sanitized summary and cleanup evidence.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_OFR-S07-IDENTITY-DEADLINE-8-1] Model continuation-native response identities

#### Problem

`apps/edge/internal/openai/stream_gate_vertical_slice_test.go:3056` stores one scalar `responseID` and fails on any change at line 3104. Production continuation preserves each provider attempt's native SSE frames, so a caller stream may legally contain a bounded contiguous ID sequence. The scalar evidence at lines 2458, 2738, and 3444 also cannot prove non-contiguous reuse or cross-request overlap.

#### Solution

Change SSE and logical-response evidence to an ordered `[]string` with a maximum of four distinct IDs: initial attempt plus the three bounded repeat-recovery dispatches. Accept repeated adjacent events for the current ID and append a new non-empty `chatcmpl-*` ID when it first appears. Reject a previously closed ID, more than four IDs, provider data without a valid native ID, and data after the logical terminal; the host-authored error event may still omit `id`.

Before:

```go
if responseID == "" {
    responseID = eventResponseID
} else if responseID != eventResponseID {
    return fmt.Errorf("data event %d changed provider response identity", eventCount)
}
```

After:

```go
if eventResponseID != currentID {
    if _, reused := closedIDs[eventResponseID]; reused {
        return fmt.Errorf("data event %d reused a non-contiguous provider response identity", eventCount)
    }
    // Bound and append the new attempt-native identity.
}
```

Encode the summary row as `provider_response_ids`. Update per-batch/final checks to require one to four IDs per logical response and global disjointness of every flattened ID across requests. Keep 15 logical provider-response rows and 15 unique Edge correlation rows; do not invent a one-to-one provider-ID/Edge-correlation pairing.

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/stream_gate_vertical_slice_test.go` - ordered bounded identity parsing, summary shape, batch/final uniqueness, and deterministic continuation fixtures.
- [ ] `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/CODE_REVIEW-cloud-G09.md` - record exact cases and results.

#### Test Strategy

Extend `TestDevRepeatGuardSmokeEvidence` with one- and two-ID success, two-ID error, invalid prefix/empty ID, non-contiguous reuse, more than four IDs, duplicate/mixed/missing terminal, and post-terminal cases. Extend observation-correlation tests with overlapping IDs across logical requests. Preserve the production-path Chat cap-exhaustion regression.

#### Verification

```bash
go test -count=1 ./apps/edge/internal/openai -run '^(TestStreamGateChatTunnelRepeatRecoveryExhaustionTerminatesSSE|TestDevRepeatGuardSmokeEvidence|TestDevRepeatGuardObservationCorrelation)$'
```

Expected: exit `0`; valid continuation ID sequences pass and every invalid/overlapping sequence is rejected.

### [REVIEW_OFR-S07-IDENTITY-DEADLINE-8-2] Bound the configurable live request deadline

#### Problem

`apps/edge/internal/openai/stream_gate_vertical_slice_test.go:2593` hard-codes `http.Client{Timeout: 20 * time.Minute}` while the live test runs three sequential concurrent batches under `go test -timeout 90m`. One plan-7 request reached that client timeout before the Edge lifecycle completed.

#### Solution

Read `IOP_OPENAI_SMOKE_REQUEST_TIMEOUT` as a Go duration with a default and command value of `25m`. Reject malformed, non-positive, or above-policy values. Before creating the client, compare the requested duration, run count, fixed per-run settlement allowance, and final cleanup reserve against `t.Deadline`; fail before any provider request if the budget cannot fit.

Before:

```go
client := &http.Client{Timeout: 20 * time.Minute}
```

After:

```go
requestTimeout := devRepeatGuardRequestTimeout(t, runs)
client := &http.Client{Timeout: requestTimeout}
```

Use the same bounded duration when deriving the capacity observer deadline so it cannot expire before the request client. Do not remove the enclosing `go test -timeout 90m`.

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/stream_gate_vertical_slice_test.go` - duration parsing, enclosing-deadline budget check, client/observer timeout wiring, and unit tests.
- [ ] `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/CODE_REVIEW-cloud-G09.md` - record parser/budget boundaries and local profile output.

#### Test Strategy

Add `TestDevRepeatGuardRequestDeadline` with default/explicit valid duration, malformed/zero/over-limit duration, exact-fit budget, insufficient cleanup reserve, missing test deadline fallback, and three-run 25-minute acceptance under a 90-minute envelope. Use pure helper inputs or `t.Setenv`; do not call an external provider.

#### Verification

```bash
go test -count=1 ./apps/edge/internal/openai -run '^(TestDevRepeatGuardRequestDeadline|TestDevRepeatGuardSmokeEvidence|TestDevRepeatGuardCapacityEvidence)$'
go test -count=1 ./packages/go/streamgate ./apps/edge/internal/openai
git diff --check
```

Expected: all commands exit `0`; Go tests are uncached.

### [REVIEW_OFR-S07-IDENTITY-DEADLINE-8-3] Run one fresh plan-8 S07 smoke

#### Problem

The plan-7 candidate is deployed and healthy, but the only authorized invocation failed in the evidence harness. Local fixtures cannot prove the required capacity+1 three-run result.

#### Solution

Create a fresh isolated source tree from the clean remote HEAD, copy the sibling module, and overlay exactly the three local files needed to represent the deployed candidate plus the corrected test. Verify their SHA-256 manifest and run the complete profile remotely. Do not build or deploy an Edge binary.

From the local workspace:

```bash
set -euo pipefail
remote=toki@toki-labs.com
remote_repo=/Users/toki/agent-work/iop-dev
stage_root=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-8-source
source_root="$stage_root/iop"
manifest=$(/usr/bin/mktemp -t iop-plan-8-overlay.XXXXXX)
files=(
  apps/edge/internal/openai/stream_gate_release_sink.go
  apps/edge/internal/openai/stream_gate_tunnel_codec.go
  apps/edge/internal/openai/stream_gate_vertical_slice_test.go
)
sha256sum "${files[@]}" >"$manifest"

ssh -o BatchMode=yes -o ConnectTimeout=15 "$remote" '/bin/zsh -lc "exec /bin/zsh -s"' <<'REMOTE'
set -euo pipefail
remote_repo=/Users/toki/agent-work/iop-dev
stage_root=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-8-source
source_root="$stage_root/iop"
test ! -e "$stage_root"
test "$(cd "$remote_repo" && git rev-parse HEAD)" = 750cb1d1cb88066a10d3c703c99f1326306d8e15
test -z "$(cd "$remote_repo" && git status --porcelain)"
/bin/mkdir -p "$source_root" "$stage_root/proto-socket"
(cd "$remote_repo" && git archive HEAD) | /usr/bin/tar -xf - -C "$source_root"
/usr/bin/ditto /Users/toki/agent-work/proto-socket/go "$stage_root/proto-socket/go"
print -r -- 750cb1d1cb88066a10d3c703c99f1326306d8e15 >"$stage_root/base-head"
REMOTE

/usr/bin/tar -cf - "${files[@]}" |
  ssh -o BatchMode=yes -o ConnectTimeout=15 "$remote" \
    "/usr/bin/tar -xf - -C '$source_root'"
scp -q -o BatchMode=yes -o ConnectTimeout=15 "$manifest" "$remote:$stage_root/overlay.sha256"
ssh -o BatchMode=yes -o ConnectTimeout=15 "$remote" \
  "cd '$source_root' && /usr/bin/shasum -a 256 -c '$stage_root/overlay.sha256'"
```

Run the isolated profile and prove the unchanged deployed candidate:

```bash
ssh -o BatchMode=yes -o ConnectTimeout=15 toki@toki-labs.com '/bin/zsh -lc "exec /bin/zsh -s"' <<'REMOTE'
set -euo pipefail
stage_root=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-8-source
source_root="$stage_root/iop"
runtime_root=/Users/toki/agent-work/iop-dev
plan7_source=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-7-source
cd "$source_root"
/usr/bin/shasum -a 256 -c "$stage_root/overlay.sha256"
/opt/homebrew/bin/go version
/opt/homebrew/bin/go test -count=1 ./packages/go/streamgate ./apps/edge/internal/openai
runtime_hash=$(/usr/bin/shasum -a 256 "$runtime_root/build/dev-runtime/bin/edge" | /usr/bin/awk '{print $1}')
candidate_hash=$(/usr/bin/shasum -a 256 "$plan7_source/edge.candidate" | /usr/bin/awk '{print $1}')
test "$runtime_hash" = "$candidate_hash"
test -z "$(cd "$runtime_root" && git status --porcelain)"
print -r -- "remote_plan8_gate=PASS base_head=$(<"$stage_root/base-head") runtime_hash=$runtime_hash edge_restart_count=0 invocation_count=0"
REMOTE
```

After all gates pass, use one caller-owned foreground SSH session. Wait for two consecutive idle capacity samples before the sole invocation; any exit after `remote_live_start` consumes it and must not be retried.

```bash
ssh -o BatchMode=yes -o ConnectTimeout=15 toki@toki-labs.com '/bin/zsh -lc "exec /bin/zsh -s"' <<'REMOTE'
set -euo pipefail
set +x
source_root=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-8-source/iop
stage_root=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-8-source
artifact_dir=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-8
runtime_root=/Users/toki/agent-work/iop-dev
plan7_source=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-7-source
secret=/Users/toki/.config/iop/secrets/dev-openai-toki.sops.yaml
age_key=/Users/toki/.config/sops/age/keys.txt
api_key=''
cleanup() { unset api_key; }
trap cleanup EXIT

test ! -e "$artifact_dir"
! /usr/bin/pgrep -fl '[T]estDevRepeatGuardOrnithSmoke|[r]epeat-guard-task-03-plan-8' >/dev/null
cd "$source_root"
/usr/bin/shasum -a 256 -c "$stage_root/overlay.sha256"
test "$(/usr/bin/shasum -a 256 "$runtime_root/build/dev-runtime/bin/edge" | /usr/bin/awk '{print $1}')" = \
  "$(/usr/bin/shasum -a 256 "$plan7_source/edge.candidate" | /usr/bin/awk '{print $1}')"
test -z "$(cd "$runtime_root" && git status --porcelain)"

test -x /opt/homebrew/bin/sops
test -r "$age_key"
test -r "$secret"
test "$(/usr/bin/stat -f %Lp "$secret")" = 600
api_key=$(SOPS_AGE_KEY_FILE="$age_key" /opt/homebrew/bin/sops decrypt --extract '["tokens"]["toki-dev-pi"]' "$secret")
test -n "$api_key"

for sample in 1 2; do
  /usr/bin/curl -fsS http://127.0.0.1:18001/edges/edge-toki-labs-dev/status |
    /opt/homebrew/bin/jq -e '
      def provider($id): first(.nodes[]?.provider_snapshots[]? | select(.id == $id));
      ((.nodes // []) | length == 4) and (all(.nodes[]; .connected == true)) and
      (provider("onexplayer-lemonade").capacity == 3) and
      (provider("onexplayer-lemonade").health == "healthy") and
      (provider("onexplayer-lemonade").in_flight == 0) and
      (provider("onexplayer-lemonade").queued == 0) and
      (provider("rtx5090-lemonade").capacity == 1) and
      (provider("rtx5090-lemonade").health == "healthy") and
      (provider("rtx5090-lemonade").in_flight == 0) and
      (provider("rtx5090-lemonade").queued == 0)
    ' >/dev/null
  /bin/sleep 2
done

http_status=$(
  {
    print -r -- 'silent'
    print -r -- 'show-error'
    print -r -- 'output = "/dev/null"'
    print -r -- "header = \"Authorization: Bearer $api_key\""
  } | /usr/bin/curl --config - --write-out '%{http_code}' http://127.0.0.1:18083/v1/models
)
test "$http_status" = 200

print -r -- 'remote_live_start invocation_count=1 ownership=foreground artifact=plan-8 edge_restart_count=0'
IOP_OPENAI_API_KEY="$api_key" \
IOP_OPENAI_BASE_URL=http://127.0.0.1:18083 \
IOP_OPENAI_MODEL=ornith:35b \
IOP_OPENAI_SMOKE_CONCURRENCY=5 \
IOP_OPENAI_SMOKE_RUNS=3 \
IOP_OPENAI_SMOKE_REQUEST_TIMEOUT=25m \
IOP_OPENAI_SMOKE_PROMPT_FILE=/tmp/iop-repeat-guard-live/repeat-prompt.txt \
IOP_OPENAI_SMOKE_ARTIFACT_DIR="$artifact_dir" \
IOP_OPENAI_SMOKE_OBSERVATION_FILE=/tmp/iop-repeat-guard-live/edge-observations.jsonl \
IOP_OPENAI_SMOKE_STATUS_URL=http://127.0.0.1:18001/edges/edge-toki-labs-dev/status \
IOP_OPENAI_SMOKE_PROVIDER_IDS=onexplayer-lemonade,rtx5090-lemonade \
/opt/homebrew/bin/go test -timeout 90m -count=1 -v ./apps/edge/internal/openai -run '^TestDevRepeatGuardOrnithSmoke$'
REMOTE
```

Validate the successful summary without printing it:

```bash
ssh -o BatchMode=yes -o ConnectTimeout=15 toki@toki-labs.com '/bin/zsh -lc "exec /bin/zsh -s"' <<'REMOTE'
set -euo pipefail
summary=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-8/summary.json
runtime_root=/Users/toki/agent-work/iop-dev
plan7_source=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-7-source
test -f "$summary"
/opt/homebrew/bin/jq -e '
  (.model == "ornith:35b") and (.concurrency == 5) and (.runs == 3) and
  ((.provider_responses | length) == 15) and
  (all(.provider_responses[];
    ((.provider_response_ids | type) == "array") and
    ((.provider_response_ids | length) >= 1) and
    ((.provider_response_ids | length) <= 4))) and
  (([.provider_responses[].provider_response_ids[]] | length) >= 15) and
  (([.provider_responses[].provider_response_ids[]] | unique | length) ==
   ([.provider_responses[].provider_response_ids[]] | length)) and
  ((.lifecycles | length) == 15) and
  (([.lifecycles[].correlation_id] | unique | length) == 15) and
  ((.capacity_runs | length) == 3) and
  (all(.capacity_runs[];
    (.configured_capacity == 4) and (.peak_in_flight == 4) and
    (.peak_queued >= 1) and (.final_in_flight == 0) and (.final_queued == 0))) and
  ((.result == "not_reproduced") or
    ((.result == "reproduced") and
     any(.lifecycles[];
       (.result == "reproduced") and
       ((.fingerprint // "") | length > 0) and (.offset >= 0))))
' "$summary" >/dev/null
result_evidence=$(/opt/homebrew/bin/jq -r '
  if .result == "reproduced" then
    first(.lifecycles[] | select(.result == "reproduced") |
      "result=reproduced fingerprint=\(.fingerprint) offset=\(.offset)")
  else "result=not_reproduced" end
' "$summary")

/usr/bin/curl -fsS http://127.0.0.1:18001/edges/edge-toki-labs-dev/status |
  /opt/homebrew/bin/jq -e '
    def provider($id): first(.nodes[]?.provider_snapshots[]? | select(.id == $id));
    (provider("onexplayer-lemonade").in_flight == 0) and
    (provider("onexplayer-lemonade").queued == 0) and
    (provider("rtx5090-lemonade").in_flight == 0) and
    (provider("rtx5090-lemonade").queued == 0)
  ' >/dev/null
! /usr/bin/pgrep -fl '[T]estDevRepeatGuardOrnithSmoke|[r]epeat-guard-task-03-plan-8' >/dev/null
test "$(/usr/bin/shasum -a 256 "$runtime_root/build/dev-runtime/bin/edge" | /usr/bin/awk '{print $1}')" = \
  "$(/usr/bin/shasum -a 256 "$plan7_source/edge.candidate" | /usr/bin/awk '{print $1}')"
test -z "$(cd "$runtime_root" && git status --porcelain)"
test -d /tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-7

print -r -- "remote_cleanup=PASS $result_evidence invocation_count=1 logical_provider_responses=15 edge_correlations=15 capacity_runs=3 configured_capacity=4 peak_in_flight=4 queued_pressure=present providers=idle harness=absent candidate=unchanged checkout=clean prior_artifacts=preserved edge_restart_count=0"
REMOTE
```

Any failure after `remote_live_start` is final for this packet. Preserve the partial plan-8 artifact, run only a raw-free cleanup probe, record the exact failure and `invocation_count=1`, and stop for official review.

#### Modified Files and Checklist

- [ ] `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/CODE_REVIEW-cloud-G09.md` - record overlay hashes, remote test, unchanged runtime identity, the sole invocation, summary or failure, and cleanup counts.
- [ ] No production, tracked remote source/config, runtime binary/process, Control Plane, Node, provider, credential, roadmap, or prior artifact change.

#### Test Strategy

Use only the fresh isolated source overlay, unchanged deployed-candidate gate, protected authentication, and one foreground S07 process. Do not accept the stale checkout, a changed runtime hash, degraded capacity, detached/background execution, a second invocation, raw SSE in review evidence, or a synthesized summary.

#### Verification

The three exact remote command blocks above must exit `0`. The sole live invocation must produce 15 logical provider-response rows with globally disjoint bounded ID lists, 15 unique Edge correlations, three valid capacity rows, an accepted result classification, idle cleanup, no harness, unchanged candidate, clean checkout, and preserved prior artifacts.

## Modified Files Summary

| File | Items |
|------|-------|
| `apps/edge/internal/openai/stream_gate_vertical_slice_test.go` | REVIEW_OFR-S07-IDENTITY-DEADLINE-8-1, REVIEW_OFR-S07-IDENTITY-DEADLINE-8-2 |
| `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/CODE_REVIEW-cloud-G09.md` | REVIEW_OFR-S07-IDENTITY-DEADLINE-8-1, REVIEW_OFR-S07-IDENTITY-DEADLINE-8-2, REVIEW_OFR-S07-IDENTITY-DEADLINE-8-3 |

## Dependencies and Execution Order

1. Implement ordered provider identity evidence and deterministic invalid cases.
2. Implement deadline parsing/budget enforcement and unit boundaries.
3. Run focused and complete local profiles; stop before remote writes on failure.
4. Require fresh plan-8 paths, unchanged candidate hash, clean checkout, absent harness, and idle capacity.
5. Create/verify the isolated source overlay and run the uncached remote profile.
6. Authenticate without exposing credentials, take two idle samples, and start the S07 test once in the foreground.
7. Validate the raw-free summary and cleanup or preserve one failed partial artifact; fill the active review and stop.

## Final Verification

PASS requires: ordered one-to-four provider-native IDs per logical response; contiguous transitions only; no invalid ID, non-contiguous reuse, cross-request overlap, mixed/duplicate/missing terminal, or post-`[DONE]` data; a command-configurable request timeout whose three-run budget leaves bounded settlement and cleanup time under the enclosing 90-minute test; uncached local and isolated-remote profiles; a verified three-file overlay; unchanged deployed plan-7 candidate and zero Edge restarts; four listeners; four connected nodes; idle healthy `3+1` capacity; protected `/v1/models` HTTP 200; exactly one foreground 5-concurrent x 3-run invocation; 15 logical provider-response rows with globally disjoint bounded ID lists; 15 unique Edge correlations; three capacity rows at configured capacity 4 with peak in-flight 4 and queue pressure; accepted `reproduced` fingerprint/offset or `not_reproduced`; idle cleanup; absent harness; clean checkout; preserved prior artifacts; `git diff --check`; and no raw secret/model output in tracked evidence.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
