<!-- task=m-iop-hot-path-one-shot-execution/20+17,19_smoke_harness plan=1 tag=TEST milestone-task=hot-smoke -->

# Claude/Pi Hot Path smoke harness

## For the Implementing Agent

구현 후 `CODE_REVIEW-cloud-G08.md`의 구현 담당 섹션에 syntax/self-test 원문 출력을 채우고 active 파일을 유지한다. 차단 시 정확한 blocker와 재개 조건만 기록하며 사용자 질문, 상태 판정, archive, `complete.log` 작성은 하지 않는다.

## Background

실제 Claude/Pi smoke를 secret-safe하고 deterministic하게 실행할 공통 harness와 parser/preflight self-test가 없다. 이 child는 외부 credential/runtime 없이 구현·검증 가능한 harness core를 만든다. Make integration과 actual external evidence는 child 21에서 닫는다.

## Analysis

### Files Read

- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`
- `scripts/e2e-openai-cli-workspace.sh`
- `agent-test/local/rules.md`
- `agent-test/local/edge-smoke.md`
- `agent-test/dev/edge-smoke.md`
- `agent-test/inventory-agent.yaml`

### SDD Criteria

- 승인 SDD, `milestone-task=hot-smoke`, S16.
- 이 child는 secret-safe invocation, deterministic scenario manifest, isolated workspace before/after, child-only cancel, cleanup/orphan parsing의 harness evidence를 제공한다.
- S16 PASS는 child 21의 actual Claude/Pi 10-case run까지 필요하다.

### Verification Context

- current checkout/CLI facts and external preflight requirements are inherited from the parent plan.
- credential-free fake-agent/fake-runtime self-test is the deterministic oracle for this child.

### Test Coverage Gaps

- Claude/Pi invocation, raw-free manifest, workspace/artifact lifecycle, cancel, and malformed input paths을 한 script로 검증하는 self-test가 없다.

### Symbol References

- none.

### Split Judgment

- stable contract: external agent/runtime inputs → secret-safe manifest and workspace oracle.
- Make targets and actual external evidence are closure child 21.
- terminal/observation semantics are supplied by predecessors 17 and 19.

### Scope Rationale

- Makefile changes, actual provider calls, secret provisioning, shared process/config mutation, deployment, tracked smoke output are excluded.

### Final Routing

- evaluation_mode=isolated-reassessment, finalizer=`finalize-task-policy.sh pair`.
- build closures 모두 true, scores=2/1/1/2/2, G08, local-fit → `PLAN-local-G08.md`.
- review closures 모두 true, scores=2/1/1/2/2, G08, official-review → `CODE_REVIEW-cloud-G08.md`.
- risks=`boundary_contract,structured_interpretation,variant_product`(3), `large_indivisible_context=false`, recovery=0/false, capability gap 없음.

## Implementation Checklist

- [ ] [TEST-1] Add a secret-safe Claude/Pi Hot Path harness with deterministic input validation, scenario matrix, raw-free manifest, workspace/artifact before/after, and child-only cancellation.
- [ ] [TEST-2] Add credential-free fake-agent/fake-runtime self-tests for success, expected failure, cancel, redaction, malformed evidence, and cleanup, then run the child verification commands.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [TEST-1] Agent smoke harness core

**Problem:** existing synthetic CLI workspace smoke neither invokes Claude/Pi nor validates preset stage/cleanup evidence.

**Solution:** Add `scripts/e2e-hot-path-agents.sh` with `--preflight-only`, `--self-test`, and actual run modes. Validate required non-secret runtime/model/workspace/evidence inputs without echoing secrets; require fingerprinted runtime evidence and four deterministic model aliases. Create isolated per-agent/scenario workspaces, collect visible stream/terminal/observation/artifact evidence, run the two-agent five-scenario matrix, redact sensitive names/values, and signal cancellation only to the child.

**Modified Files and Checklist:**

- [ ] Add executable `scripts/e2e-hot-path-agents.sh` with strict validation, isolated cleanup trap, fixed manifest schema, and fake fixtures.

**Test Strategy:** TEST-2 exercises every parser/preflight/cleanup branch without credentials.

**Verification:** `bash -n scripts/e2e-hot-path-agents.sh && ./scripts/e2e-hot-path-agents.sh --self-test` exits 0.

### [TEST-2] Credential-free harness evidence

**Problem:** harness correctness must be reviewable before external runtime/credentials exist.

**Solution:** Fake `claude`, `pi`, HTTP/runtime evidence, observation logs, and disposable workspaces. Exercise success, expected write failure, timeout/cancel, redaction sentinel, malformed runtime evidence, source mismatch, and cleanup/orphan rows. Assert no network credential or shared process is required.

**Modified Files and Checklist:**

- [ ] Implement the self-test mode inside `scripts/e2e-hot-path-agents.sh`.
- [ ] Fill `agent-task/m-iop-hot-path-one-shot-execution/20+17,19_smoke_harness/CODE_REVIEW-cloud-G08.md` with syntax and self-test output.

**Test Strategy:** the self-test creates and removes all temporary fixtures itself.

**Verification:** run Final Verification; syntax/self-test and common Go regressions exit 0.

## Dependencies and Execution Order

1. `17+14,15,16_endpoint_error_matrix` must produce its active `complete.log`.
2. `19+17,18_observation_lifecycle` must produce its active `complete.log`.
3. Implement TEST-1, then TEST-2.

## Modified Files Summary

| File | Item |
|---|---|
| `scripts/e2e-hot-path-agents.sh` | TEST-1, TEST-2 |
| `agent-task/m-iop-hot-path-one-shot-execution/20+17,19_smoke_harness/CODE_REVIEW-cloud-G08.md` | TEST-2 |

## Final Verification

```bash
bash -n scripts/e2e-hot-path-agents.sh
./scripts/e2e-hot-path-agents.sh --self-test
go test -race -count=1 ./packages/go/streamgate ./packages/go/config ./apps/edge/internal/openai ./apps/edge/internal/service
git diff --check
```

Expected: exit 0, credential-free fixtures cover success/failure/cancel/redaction/malformed evidence/cleanup, no shared process mutation, empty diff check. Cached Go output is not acceptable.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
