<!-- task=m-iop-agent-chronos-extraction-decoupling/04+03_bundle_exporter plan=1 tag=REFACTOR -->

# Versioned acceptance bundle exporter 구현

## For the Implementing Agent

`CODE_REVIEW-cloud-G09.md`의 implementation-owned 섹션 작성은 필수다. encoded predecessor의 exact PASS를 확인하고 이 child 범위만 구현·검증한다. active pair를 유지해 review 준비 완료를 보고하며 finalization은 code-review agent만 수행한다. 차단되면 질문하거나 상태를 분류하지 말고 blocker, 실제 명령/출력, 재개 조건만 evidence 필드에 기록한다.

## Background

확정 manifest를 repository-neutral acceptance-v1 layout으로 내보내는 stdlib Go exporter와 output/state 안전 경계를 구현한다.

## Analysis

### Files Read

- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/04+03_bundle_exporter/plan_cloud_G10_0.log`
- `configs/iop-agent.local.example.yaml`

### SDD Criteria

- SDD `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`는 `[승인됨]`, 잠금 `해제` 상태다.
- Target은 Acceptance Scenario `S02`와 Milestone Task `transfer`; Evidence Map row는 isolated staging build, existing behavior test, forbidden-import scan, 전체 상태 fixture와 versioned digest/receipt를 요구한다.
- 이 child는 그 row의 재현 가능한 exporter와 synthetic safety tests를 checklist/Final Verification으로 구현하고, 실제 state execution과 staging closure는 child 06에 남긴다.

### Verification Context

- Handoff는 없다. Milestone, 승인 SDD, 보존된 parent plan과 현재 state-root 설정 예시를 읽었고 predecessor `03+02_inventory_closure`의 exact PASS `complete.log`는 missing이다.
- gap은 exporter source/tests가 아직 없다는 점이다. 이 child는 synthetic inputs만 사용하며 외부 state root나 credential에 접근하지 않는다.
- Confidence는 medium-high다. archive traversal/symlink, determinism, quarantine를 unit test로 닫되 실제 owner state는 child 06의 외부 검증이 필요하다.

### Test Coverage Gaps

- 정상, traversal, symlink, live state, deterministic digest, quarantine tests를 같은 child에 둔다.

### Symbol References

- 새 임시 command iop-chronos-transfer export만 추가한다.

### Split Judgment

- 안정 계약은 synthetic inputs에서 안전하고 결정적인 archive/digest를 생성하는 exporter다.
- Predecessor `03`의 active/archived exact PASS `complete.log`는 missing이다. PASS evidence는 exporter unit/fuzz-like safety cases와 deterministic digest 재현이다.

### Scope Rationale

- tracked state fixture와 실제 staging/export evidence는 후속 children이 소유한다.

### Final Routing

- `evaluation_mode=isolated-reassessment`, finalizer=`finalize-task-policy.sh`, mode=`pair`.
- Build closures 모두 true. Scores=`2,2,2,1,2`, grade=`G09`, base/route=`grade-boundary`, lane=`cloud`.
- Review closures 모두 true. Scores=`2,2,2,1,2`, route=`official-review`, lane=`cloud`, grade=`G09`.
- `large_indivisible_context=false`; positive loop risks=`temporal_state, concurrent_consistency, boundary_contract, structured_interpretation` (4); `review_rework_count=0`; `evidence_integrity_failure=false`; capability gap 없음.
- Canonical files: `PLAN-cloud-G09.md`, `CODE_REVIEW-cloud-G09.md`.

## Dependencies and Execution Order

1. `03+02_inventory_closure` must each have exactly one matching PASS `complete.log`; all are currently missing.
2. Resolve only those exact predecessor completion artifacts, then implement this child scope.

## Implementation Checklist

- [ ] Refuse to start until predecessor 03+02_inventory_closure has an exact PASS complete.log.
- [ ] Implement the Go exporter, repository-neutral v1 layout, deterministic digests, external-output confinement, quiesced state guard, and broken-record quarantine.
- [ ] Add and run all exporter safety and reproducibility tests from the original plan.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REFACTOR-1] Versioned bundle exporter와 안전 경계

**Problem**

`SDD.md:59-70`은 bundle과 전체 legacy state export를 요구하지만 현재 deterministic exporter, output confinement, redaction contract가 없다.

```text
# agent-roadmap/sdd/.../SDD.md:59-60
chronos_transfer_bundle
legacy_state_export
```

**Solution**

stdlib-only Go command를 추가한다. manifest의 transfer/retain/reference payload를 immutable source snapshot으로 복사하고 `acceptance-v1/{source,state,contracts,behavior,provenance}`를 만든다. output은 workspace와 Chronos checkout 밖의 absolute owner-only root만 허용한다. real state mode는 quiesced socket/process evidence, root ownership, symlink/path traversal를 검증하고 broken records를 `state/quarantine`에 원문 보존하되 `resumable=false`로 표시한다.

```text
# after: cmd/iop-chronos-transfer/main.go
iop-chronos-transfer export --manifest <tsv> --source-revision <sha> \
  --repo-root <iop> --local-config <owner-file> --state-root <owner-root> \
  --output <outside-repo-owner-only-dir>
```

**Modified Files and Checklist**

- [ ] `cmd/iop-chronos-transfer/main.go` — CLI parsing, validation, deterministic archive/digest, redacted receipt.
- [ ] `cmd/iop-chronos-transfer/main_test.go` — safe output, path/symlink rejection, deterministic digest, state quarantine tests.

**Test Strategy**

- `TestExportSyntheticBundle`, `TestRejectsOutputInsideWorkspace`, `TestRejectsTraversalAndSymlink`, `TestDigestStableAcrossRuns`, `TestBrokenStateIsQuarantinedNotResumable`, `TestRefusesLiveStateSocket`를 작성한다.

**Verification**

- `go test -count=1 ./cmd/iop-chronos-transfer` — all tests PASS; cache 불허.
- `go vet ./cmd/iop-chronos-transfer` — findings 0.

## Modified Files Summary

| File | Item |
|------|------|
| `cmd/iop-chronos-transfer/main.go` | REFACTOR-1 |
| `cmd/iop-chronos-transfer/main_test.go` | REFACTOR-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/04+03_bundle_exporter/CODE_REVIEW-cloud-G09.md` | REFACTOR-1 |

## Final Verification

1. Confirm exact PASS `complete.log` for `03+02_inventory_closure`.
2. `go test -count=1 ./cmd/iop-chronos-transfer` — all tests PASS; cache 불허.
3. `go vet ./cmd/iop-chronos-transfer` — findings 0.

Commands containing `go test -count=1` require fresh output; all other checks are rerun against the current checkout.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
