<!-- task=m-iop-hot-path-one-shot-execution/09+06,08_artifact_pair plan=0 tag=API milestone-task=artifact-pair -->

# Code Review Reference - API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> Fill item statuses, deviations, decisions, and actual output, then stop with active files and report ready. Record blockers only in implementation evidence. Do not ask the user, create control state, classify, archive, or write `complete.log`; review owns finalization.

## Overview

date=2026-08-02
task=m-iop-hot-path-one-shot-execution/09+06,08_artifact_pair, plan=0, tag=API

## For the Review Agent

> **[REVIEW AGENT ONLY]** Implementers must not execute this section.

Compare source/evidence, append verdict/signals, archive the pair, and on PASS write `complete.log`, preserve metadata, archive the directory, and update the final `.log` checklist. WARN/FAIL must create the exact next state.

## Implementation Item Completion

| Item | Status |
|------|---------|
| API-2 Validate directory prepare and exact pair continuation frontier | [ ] |

## Implementation Checklist

- [ ] Issue only the reserved request directory prepare and exact Plan/Review write pair through the pinned binding.
- [ ] Enforce public/provider ids, paths, receipts, and one-frontier exactly-once result consumption before local eligibility.
- [ ] Run dependency, focused frontier, race, vet, and diff verification exactly as written.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual notes and output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementers must not modify or check this section.

- [x] Append one PASS/WARN/FAIL verdict with verified `review_rework_count` and `evidence_integrity_failure`.
- [x] Verify verdict, Dimension Assessment, and Required/Suggested/Nit classifications match.
- [x] Archive the active review to `code_review_cloud_G09_0.log`.
- [x] Archive the active plan to `plan_cloud_G08_0.log`.
- [x] Verify the Agent-Ops `.gitignore` block.
- [ ] On PASS write `complete.log` from `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md`.
- [ ] On PASS archive to `agent-task/archive/YYYY/MM/m-iop-hot-path-one-shot-execution/09+06,08_artifact_pair/` and update this checklist there.
- [ ] On PASS preserve/report `milestone-task=artifact-pair` without direct roadmap mutation.
- [ ] On PASS remove the active parent only if no siblings/files remain.
- [x] On WARN/FAIL create the mandatory next state without `complete.log`.

## Deviations from Plan

_Implementer: replace with actual deviations or “None”._

## Key Design Decisions

_Implementer: replace with actual decisions._

## Reviewer Checkpoints

- Reserved paths are derived only from the server request id.
- Only exact prepare or exact pair success advances once and order-independently.
- Missing, extra, duplicate, opaque, failed, mixed, and replayed results fail closed.

## Verification Results

### API-2 item verification

```bash
go test -race -count=1 ./apps/edge/internal/openai -run 'Test(Workspace|ArtifactPair)'
```

_Actual stdout/stderr:_

### Dependencies and common race

```bash
test -f agent-task/m-iop-hot-path-one-shot-execution/06+04,05_request_identity_ingress/complete.log
test -f agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/complete.log
go test -race -count=1 ./packages/go/streamgate ./apps/edge/internal/openai ./apps/edge/internal/service
```

_Actual stdout/stderr:_

### Vet and diff

```bash
go vet ./apps/edge/internal/openai
git diff --check
```

_Actual stdout/stderr:_

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?** Leave review-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Fixed structure, item/checklist/checkpoints/commands | Fixed | Do not rewrite |
| Item status, deviations, decisions, actual output | Implementer | Must complete |
| Review checklist and verdict/finalization | Review agent | Implementer must not modify |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail — the classified `light` path still terminates the logical request and returns `501` instead of issuing or consuming the reserved artifact frontier.
  - Completeness: Fail — neither planned production/test file exists, and every implementation-owned checklist/evidence field remains incomplete.
  - Test Coverage: Fail — the focused test pattern lists only existing workspace-binding tests and no `TestArtifactPair...` coverage for S06.
  - API Contract: Fail — the approved SDD S06 exact prepare/pair and successful-receipt-before-local contract is not implemented.
  - Code Quality: Pass — no new artifact-pair implementation exists to assess, and the adjacent reviewed code introduced no task-local quality finding.
  - Implementation Deviation: Fail — the implementation omitted the complete planned API-2 production and test scope without recording a deviation.
  - Verification Trust: Fail — required production/test paths and implementation-owned command output are absent; fresh verification cannot establish the claimed artifact-pair behavior.
  - Spec Conformance: Fail — the `artifact-pair` Evidence Map row has no mapping, prepare, receipt, reversed-order, or rejection evidence.
- Findings:
  - Required — `apps/edge/internal/openai/hot_path_dispatch.go:810`: exact prepare and Plan/Review outputs are classified as `light`, but this branch immediately terminates the request and returns `not implemented`. Replace the terminal branch with a pinned-binding artifact frontier that emits only the exact prepare or pair calls, resumes the same selector stage after prepare, and advances toward local eligibility only after the exact pair succeeds.
  - Required — `apps/edge/internal/openai/request_identity_ingress.go:34` and `apps/edge/internal/openai/request_identity_ingress.go:110`: Chat and Anthropic continuations consume a frontier by tool-result IDs and immediately activate the next stage without validating artifact result status/body against the issued workspace payload and configured result matcher. Parse and correlate endpoint-native results, reject failed/opaque/mixed/replayed receipts, and consume the artifact frontier exactly once only after every expected receipt matches.
  - Required — `agent-task/m-iop-hot-path-one-shot-execution/09+06,08_artifact_pair/PLAN-cloud-G08.md:51`: the required `apps/edge/internal/openai/artifact_pair.go`, `apps/edge/internal/openai/artifact_pair_test.go`, `TestArtifactPairFrontierMatrix`, and implementation evidence are absent. Add the deterministic Chat/Messages S06 matrix, including reversed success and missing/extra/duplicate/opaque/failed/path/replay rejection, and record fresh command output in the next review stub.
- Routing Signals:
  - `review_rework_count=1`
  - `evidence_integrity_failure=true`
- Next Step: Invoke the plan skill with these raw findings and create the freshly routed follow-up pair; no user-review gate applies.
