<!-- task=m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution plan=7 tag=REVIEW_REFACTOR milestone-task=inventory,decouple,retain-node -->

# Plan - Reject Residual Agent Config and Prove the Neutral Full Cycle

## For the Implementing Agent

Implement every checklist item, run the verification commands with fresh output, and fill every implementation-owned section in `CODE_REVIEW-cloud-G08.md`. Keep the active PLAN/CODE_REVIEW files in place and report ready for review; finalization is review-agent-only. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The preceding D04 follow-up fixed provider-command validation and produced an all-zero audit, but review found that Edge configuration still accepts the removed `console.agent` alias and that the audit does not search that compatibility surface. The same review also found that auxiliary `make test-e2e` output was used in place of the project-required direct Edge/Node diagnostic. This follow-up removes the residual config API, makes the existing repo diagnostic provider-neutral, and records that real path in the fail-closed S03/S04 audit.

## Archive Evidence Snapshot

- The pair being closed is `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/plan_cloud_G08_6.log` and `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/code_review_cloud_G08_6.log`; its verdict is FAIL with two Required findings, zero Suggested findings, and zero Nit findings.
- Required finding 1 affects `packages/go/config/edge_types.go`, `packages/go/config/load.go`, `packages/go/config/legacy_provider_rejection_test.go`, `scripts/verify-iop-agent-chronos-boundary.py`, `scripts/verify_iop_agent_chronos_boundary_test.py`, and `node-boundary-audit.log`: remove and reject `console.agent`, then make the audit prove the removed symbol and serialized key stay absent.
- Required finding 2 affects `scripts/dev/edge-node-reconnect-diagnostic.sh` and the audit evidence: replace its removed CLI/process fixture with the explicit mock provider, prove register, `/nodes`, two ordered Node-to-Edge message relays, `/capabilities`, and `/transport`, and record that session/status ownership commands remain absent.
- Fresh review passed Client tests, focused and race Edge service tests, the Control Plane-Edge wire smoke, `go test -count=1 ./...`, the auxiliary local E2E smoke, verifier tests, fixture digests, and the boundary verifier. Those passes do not overcome the live config contradiction or the missing direct diagnostic.
- Roadmap and approved SDD scope remain `inventory,decouple,retain-node`, driven by S01, S03, and S04. Recovery signals are `review_rework_count=3` and `evidence_integrity_failure=true`.

## Analysis

### Files Read

- `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/PLAN-cloud-G08.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/CODE_REVIEW-cloud-G08.md`
- `apps/client/lib/widgets/runtime_panel.dart`
- `apps/client/lib/control_plane_status_repository.dart`
- `apps/client/lib/control_plane_status_controller.dart`
- `apps/client/test/runtime_panel_test.dart`
- `apps/client/test/support/client_test_harness.dart`
- `apps/edge/internal/controlplane/connector.go`
- `apps/edge/internal/opsconsole/console.go`
- `apps/edge/internal/opsconsole/status.go`
- `apps/edge/internal/opsconsole/console_test.go`
- `apps/edge/internal/service/control_command.go`
- `apps/edge/internal/service/node_command.go`
- `apps/edge/internal/service/run_command_test.go`
- `apps/node/internal/adapters/mock/mock.go`
- `packages/go/config/adapter_types.go`
- `packages/go/config/edge_types.go`
- `packages/go/config/load.go`
- `packages/go/config/legacy_provider_rejection_test.go`
- `packages/go/config/provider_catalog_validation_config_test.go`
- `scripts/dev/edge.sh`
- `scripts/dev/node.sh`
- `scripts/dev/edge-node-reconnect-diagnostic.sh`
- `scripts/verify-iop-agent-chronos-boundary.py`
- `scripts/verify_iop_agent_chronos_boundary_test.py`
- `scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log`
- `agent-contract/inner/client-control-plane-wire.md`
- `agent-contract/inner/control-plane-edge-wire.md`
- `agent-contract/inner/execution-runtime.md`
- `agent-contract/inner/edge-node-runtime-wire.md`
- `agent-contract/inner/edge-config-runtime-refresh.md`
- `agent-spec/control/control-plane-operations.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`

### SDD Criteria

- SDD: `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`, status `[승인됨]`, lock released.
- First-line milestone contribution ids remain exactly `inventory,decouple,retain-node`.
- Targeted Acceptance Scenarios are S01, S03, and S04. S01 requires the immutable manifest, 137-row delta, and D04 surface addendum to combine into a trustworthy effective matrix. S03 requires removed-path/reference audit plus a clean IOP build. S04 requires focused provider execution, contract regression, and forbidden-reference coverage across config, CLI-agent, terminal, workspace, and bridge surfaces.
- Evidence Map rows S01/S03/S04 make the config rejection, literal forbidden scan, provider-neutral direct diagnostic, and regenerated all-zero audit one closure unit. The checklist therefore does not reopen already-passing Client or Edge command behavior and does not alter the immutable manifest, delta, or addendum bytes.

### Verification Context

- No external handoff was supplied. Review evidence and current source were inspected in this checkout.
- Repository verification sources are `agent-test/local/rules.md`, `agent-ops/rules/project/domain/testing/rules.md`, and `agent-ops/skills/project/e2e-smoke/SKILL.md`. They require fresh Go tests and a direct `scripts/dev/edge.sh` plus `scripts/dev/node.sh` diagnostic for this config/runtime path; `make test-e2e` is auxiliary only.
- The existing diagnostic already owns temporary configs, FIFO-driven Edge console input, child cleanup, transcript capture, per-run ordering checks, and reconnect coverage. Its current `adapters.cli` fixture is rejected by the D04 loader and its `/sessions`/`/terminate-session` assertions restore removed ownership semantics, so it must be neutralized rather than treated as evidence in its present form.
- Preconditions are the repository root, Bash, Go, Python, Flutter, free loopback ports, and permission to start local child processes. The diagnostic must use temporary files and the explicit in-process mock adapter; it must not require a real provider CLI, account, secret, external host, or network endpoint.
- Confidence is high because the config surface has only the loader field/fallback/accessor references found by the symbol scan, and the diagnostic has a deterministic mock oracle plus exact Node-local versus Edge-rendered payload comparison. Unit/full-suite evidence remains fallback evidence but cannot substitute for the direct diagnostic.

### Test Coverage Gaps

- `console.agent` is currently accepted before decode and has no rejection regression. Add an exact `LoadEdge` negative test while preserving `console.target` and the provider-neutral `console.model` fallback.
- The audit command inventory does not assert absence of `ResolveAgent`, `InConfig("console.agent")`, or serialized `agent` tags. Add an inventory unit assertion so later edits cannot silently weaken this check.
- The direct diagnostic is not executable under the D04 loader because it configures `adapters.cli`; its payload and command checks also encode removed session/process behavior. Convert it to the explicit mock adapter and validate actual register/message/provider-command behavior.
- Already-passing provider-command UI/service tests cover the three-command allowlist and terminal lifecycle. No new Client or Edge service behavior test is required in this follow-up.

### Symbol References

- Remove `EdgeConsoleConf.Agent`. Its only production read is `cfg.Console.Agent` in `LoadEdge`.
- Remove `EdgeConsoleConf.ResolveAgent`; no call sites exist.
- Retain `EdgeConsoleConf.ResolveTarget` and its production call in `apps/edge/internal/opsconsole/console.go`, but reduce its fallback order to `Target` then the provider-neutral legacy `Model` alias.
- Remove the `v.InConfig("console.agent")` acceptance branch. Add a pre-decode rejection for the nested key without reintroducing a decoded field.

### Split Judgment

Keep one plan. The indivisible invariant is that removed agent configuration must be rejected by the loader, absent from the compiled config API, exercised through the real provider-neutral Edge/Node startup path, and proven by the same fail-closed S03/S04 audit. Splitting code removal from diagnostic/audit regeneration would permit another false-positive closure.

### Scope Rationale

- Do not modify Client provider-command UI, Edge provider-command service logic, protobuf contracts, or their tests; fresh review already confirmed those preceding fixes.
- Do not modify the immutable ownership manifest, 137-row disposition delta, D04 addendum, or their digest sidecars; the finding concerns live config and verification coverage, not matrix membership.
- Do not restore `/sessions`, `/status`, `/terminate-session`, CLI profiles, process execution, or durable session ownership. `/session` remains correlation-only as already specified.
- Do not change roadmap, SDD, contract, spec, or public docs because their current text already prohibits the residual surface and defines the required provider-only behavior.
- Do not introduce a new diagnostic file; update the existing repo diagnostic and preserve its temporary-file and cleanup structure.

### Final Routing

- `evaluation_mode=isolated-reassessment`; `finalizer=finalize-task-policy.sh`, mode `pair`.
- Build closures: `scope_closed=true`, `context_closed=true`, `verification_closed=true`, `evidence_trusted=true`, `ownership_closed=true`, `decision_closed=true`; no capability gap.
- Build scores are scope 2, state 1, blast 1, evidence 2, verification 2, yielding G08. Base basis is `local-fit`; positive loop risks are `temporal_state`, `boundary_contract`, and `structured_interpretation` (count 3); `large_indivisible_context=false`; `review_rework_count=3`; `evidence_integrity_failure=true`; final basis is `recovery-boundary`, lane cloud, filename `PLAN-cloud-G08.md`.
- Review closures are all true with no capability gap. Review scores are scope 2, state 1, blast 1, evidence 2, verification 2, yielding G08; basis `official-review`, lane cloud, Codex `gpt-5.6-sol` xhigh, filename `CODE_REVIEW-cloud-G08.md`.

## Implementation Checklist

- [ ] Remove the `console.agent` field, fallback, and accessor; reject that nested key before weak decode and add focused config regression coverage.
- [ ] Convert the existing reconnect diagnostic to an explicit mock-provider full cycle that proves startup/register, `/nodes`, at least two ordered relays, `/capabilities`, `/transport`, and the absence of removed session/status ownership surfaces.
- [ ] Extend the fixed audit inventory and its unit tests to cover the removed config API and direct diagnostic, then atomically regenerate an all-zero `node-boundary-audit.log`.
- [ ] Run fresh focused, diagnostic, audit, build, full-suite, race, Client, wire, auxiliary smoke, and diff verification with the auxiliary smoke clearly labeled.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_REFACTOR-1] Remove and reject the residual agent config alias

**Problem:** `packages/go/config/edge_types.go:451-475` still declares the serialized `Agent` field, includes it in `ResolveTarget`, and exports `ResolveAgent`. `packages/go/config/load.go:60-68` explicitly promotes `console.agent` into `console.target`, contradicting approved SDD S03/S04 and `agent-contract/inner/edge-config-runtime-refresh.md:27`.

**Solution:** Delete `EdgeConsoleConf.Agent` and `ResolveAgent`. Keep `ResolveTarget` with only `Target` then `Model`. Remove the `LoadEdge` promotion branch for `console.agent`, and make `rejectLegacyProviderConfig` fail on `path == "console" && key == "agent"` before mapstructure decoding can discard the removed key.

Before:

```go
if !v.InConfig("console.target") {
    if v.InConfig("console.agent") {
        cfg.Console.Target = cfg.Console.Agent
    } else if v.InConfig("console.model") {
        cfg.Console.Target = cfg.Console.Model
    }
}
```

After:

```go
if !v.InConfig("console.target") && v.InConfig("console.model") {
    cfg.Console.Target = cfg.Console.Model
}
```

**Modified Files and Checklist:**

- [ ] `packages/go/config/edge_types.go` — remove the field/accessor and retain only neutral target/model resolution.
- [ ] `packages/go/config/load.go` — reject `console.agent` during raw settings traversal and remove its normalization branch.
- [ ] `packages/go/config/legacy_provider_rejection_test.go` — add `TestLegacyConsoleAgentRejected` with an exact path-bearing error assertion.

**Test Strategy:** Write `TestLegacyConsoleAgentRejected` in `packages/go/config/legacy_provider_rejection_test.go`. Load a minimal Edge YAML containing `console.agent`, require a non-nil error containing both `legacy provider configuration` and `console.agent`, and keep the existing CLI/process rejection table passing. The compile plus forbidden scan proves removed symbols/tags are absent.

**Verification:**

```bash
gofmt -d packages/go/config/edge_types.go packages/go/config/load.go packages/go/config/legacy_provider_rejection_test.go
go test -count=1 ./packages/go/config -run 'Test(LegacyProviderCLIRejected|LegacyConsoleAgentRejected)'
bash -c 'rg --sort path -n --glob "!**/*_test.go" "$1" packages/go/config apps/edge configs; status=$?; test "$status" -eq 1' _ 'ResolveAgent|InConfig\("console\.agent"\)|mapstructure:"agent"|yaml:"agent"'
```

Expected: formatting is clean, both rejection groups pass, and no production config symbol, acceptance branch, or serialized agent tag remains.

### [REVIEW_REFACTOR-2] Make the repo diagnostic provider-neutral and exact

**Problem:** `scripts/dev/edge-node-reconnect-diagnostic.sh:54-103` generates an `adapters.cli` process profile that `LoadEdge` now rejects. Lines 180-183 and 329-333 require `/sessions` and `/terminate-session`, even though SDD S04 and `agent-spec/runtime/edge-node-execution.md:44` intentionally removed process/session ownership. Consequently it cannot serve as the mandatory direct diagnostic.

**Solution:** Preserve the existing temporary config/FIFO/process cleanup structure, but configure `nodes[].adapters.mock.enabled: true` and `console.adapter: mock`, `console.target: mock-stream`. Remove fake process creation and removed command dispatch. For each run, derive the exact run id from Edge start events, compare the Node-local `[node-message]` payload list byte-for-byte and in order with the Edge `[node0-msg]` list between start and the sole terminal event, require the fixed token to appear, and reject messages after completion. Require registration, `/nodes`, `/capabilities`, `/transport`, reconnect, and an exact console command banner that excludes removed `/sessions`, `/status`, and `/terminate-session` ownership surfaces. Print one stable PASS line describing all proved cycles and the intentional absence.

Before:

```yaml
adapters:
  cli:
    enabled: true
    profiles:
      fake-cli:
        command: "..."
console:
  adapter: cli
  target: fake-cli
```

After:

```yaml
adapters:
  mock:
    enabled: true
console:
  adapter: mock
  target: mock-stream
  session_id: diagnostic-correlation
```

**Modified Files and Checklist:**

- [ ] `scripts/dev/edge-node-reconnect-diagnostic.sh` — use the explicit mock provider, validate exact relay ordering, keep reconnect coverage, and record removed surface absence.

**Test Strategy:** Do not add a simulated unit test for the diagnostic; its purpose is the real two-process path. Run `bash -n`, then execute it with a bounded registration timeout. It must launch `scripts/dev/edge.sh` and `scripts/dev/node.sh`, use only temporary configs/ports, compare at least two run transcripts, prove provider commands, clean children, and exit nonzero on any missing/misordered/mismatched evidence.

**Verification:**

```bash
bash -n scripts/dev/edge-node-reconnect-diagnostic.sh
IOP_DEV_RECONNECT_BIND_TIMEOUT=60 scripts/dev/edge-node-reconnect-diagnostic.sh
```

Expected: the script reports registration, three ordered mock runs including one after reconnect, matching Node/Edge payloads, `/nodes`, `/capabilities`, `/transport`, removed session/status surface absence, and a final PASS with exit 0.

### [REVIEW_REFACTOR-3] Bind config absence and the full cycle into the audit

**Problem:** `scripts/verify-iop-agent-chronos-boundary.py:408-455` scans many removed runtime symbols but not the live `console.agent` compatibility API, and its fixed matrix includes only auxiliary `make test-e2e`. The current all-zero `node-boundary-audit.log` therefore contradicts production config and lacks the direct runtime proof required by project testing rules.

**Solution:** Strengthen the production config forbidden scan with the `ResolveAgent`, `InConfig("console.agent")`, `mapstructure:"agent"`, and `yaml:"agent"` patterns while excluding test fixtures. Replace the duplicate second boundary-verifier command in the fixed 30-command inventory with the bounded provider-neutral reconnect diagnostic; keep `make test-e2e` as separately identifiable auxiliary smoke. Add a unit test that inspects `audit_commands` and requires both the config patterns and diagnostic command. Preserve atomic fail-closed recording and the exact 01..30 parser contract, then regenerate the task audit and verify it with the same parser.

**Modified Files and Checklist:**

- [ ] `scripts/verify-iop-agent-chronos-boundary.py` — extend the forbidden scan and include the direct diagnostic in the immutable ordered inventory.
- [ ] `scripts/verify_iop_agent_chronos_boundary_test.py` — assert the inventory cannot omit the config patterns or full-cycle command.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log` — atomically regenerate all 30 exact command blocks with zero exits and direct-diagnostic stdout.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/CODE_REVIEW-cloud-G08.md` — fill actual implementation decisions, deviations, and command output.

**Test Strategy:** Add `test_audit_inventory_rejects_console_agent_and_runs_full_cycle`. Assert the ordered inventory length remains 30, one command includes every removed config token, one command invokes `scripts/dev/edge-node-reconnect-diagnostic.sh` with its timeout, and `make test-e2e` remains present only as auxiliary evidence. Existing recorder PASS/FAIL tests continue proving atomic markers and exit preservation.

**Verification:**

```bash
python3 scripts/verify_iop_agent_chronos_boundary_test.py
python3 scripts/verify-iop-agent-chronos-boundary.py --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --expected-manifest-sha256 d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf --delta scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.tsv --delta-sha256 scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 --addendum scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv --addendum-sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256 --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --expected-state-logical-id-sha256 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9 --surface-plan agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/plan_cloud_G10_5.log --iop-root . --record-audit agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log
python3 scripts/verify-iop-agent-chronos-boundary.py --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --expected-manifest-sha256 d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf --delta scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.tsv --delta-sha256 scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 --addendum scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv --addendum-sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256 --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --expected-state-logical-id-sha256 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9 --surface-plan agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/plan_cloud_G10_5.log --iop-root . --audit-log agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log --check-only
```

Expected: unit tests pass, recorder exits 0, all 30 blocks have `exit_code=0`, direct diagnostic stdout is retained in the audit, and check-only reports `boundary_verification=PASS`.

## Modified Files Summary

| File | Item |
|------|------|
| `packages/go/config/edge_types.go` | REVIEW_REFACTOR-1 |
| `packages/go/config/load.go` | REVIEW_REFACTOR-1 |
| `packages/go/config/legacy_provider_rejection_test.go` | REVIEW_REFACTOR-1 |
| `scripts/dev/edge-node-reconnect-diagnostic.sh` | REVIEW_REFACTOR-2 |
| `scripts/verify-iop-agent-chronos-boundary.py` | REVIEW_REFACTOR-3 |
| `scripts/verify_iop_agent_chronos_boundary_test.py` | REVIEW_REFACTOR-3 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log` | REVIEW_REFACTOR-3 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/CODE_REVIEW-cloud-G08.md` | REVIEW_REFACTOR-3 |

## Final Verification

Run from `/config/workspace/iop-s1`. Go output must be fresh (`-count=1`); cached output is not acceptable. The direct diagnostic and the auxiliary smoke are separate evidence.

```bash
gofmt -d packages/go/config/edge_types.go packages/go/config/load.go packages/go/config/legacy_provider_rejection_test.go
bash -n scripts/dev/edge-node-reconnect-diagnostic.sh
go test -count=1 ./packages/go/config -run 'Test(LegacyProviderCLIRejected|LegacyConsoleAgentRejected)'
go test -count=1 ./packages/go/config ./apps/edge/cmd/edge
python3 scripts/verify_iop_agent_chronos_boundary_test.py
IOP_DEV_RECONNECT_BIND_TIMEOUT=60 scripts/dev/edge-node-reconnect-diagnostic.sh
bash -c 'rg --sort path -n --glob "!**/*_test.go" "$1" packages/go/config apps/edge configs; status=$?; test "$status" -eq 1' _ 'ResolveAgent|InConfig\("console\.agent"\)|mapstructure:"agent"|yaml:"agent"'
make build-local
go test -race -count=1 ./packages/go/config ./apps/edge/internal/service ./apps/node/internal/node
make client-test
make test-control-plane-edge-wire
make test-e2e
go test -count=1 ./...
python3 scripts/verify-iop-agent-chronos-boundary.py --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --expected-manifest-sha256 d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf --delta scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.tsv --delta-sha256 scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 --addendum scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv --addendum-sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256 --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --expected-state-logical-id-sha256 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9 --surface-plan agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/plan_cloud_G10_5.log --iop-root . --record-audit agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log
python3 scripts/verify-iop-agent-chronos-boundary.py --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --expected-manifest-sha256 d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf --delta scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.tsv --delta-sha256 scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 --addendum scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv --addendum-sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256 --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --expected-state-logical-id-sha256 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9 --surface-plan agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/plan_cloud_G10_5.log --iop-root . --audit-log agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log --check-only
git diff --check
```

Expected: every command exits 0. The config loader rejects `console.agent`; no removed field, accessor, acceptance branch, or serialized tag remains; the direct mock-provider diagnostic proves register, ordered message relay, provider commands, reconnect, and absent session/status ownership; the auxiliary smoke is reported only as auxiliary; the all-zero audit contains and passes those checks.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
