<!-- task=m-iop-agent-chronos-extraction-decoupling/16_manifest_baseline_repair plan=0 tag=TEST milestone-task=transfer -->

# Correct the Pinned-Tree Ownership Manifest Baseline

## For the Implementing Agent

Filling implementation-owned sections in `CODE_REVIEW-*-G??.md` is mandatory. Run every verification command, paste actual output into the review file, keep both active files in place, and report ready for official review. If blocked, record only the exact blocker, attempted commands/output, and resume condition in the implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`; finalization belongs to the code-review skill.

## Background

The transfer manifest currently contains three non-state rows that do not exist in pinned revision `3155be0e275437a8eedc1aa93497955a7d30465b`, so the exporter correctly refuses the bundle. This selected correction preserves that revision and the exporter fail-closed contract, derives the active manifest from the pinned tree, records the SDD decision log as separate evidence, and excludes the two post-revision protocol-profile tests from this historical bundle. This task provides correction evidence only; the stopped bundle-verification task must be replanned after this task passes.

## Archive Evidence Snapshot

- Prior task: `agent-task/m-iop-agent-chronos-extraction-decoupling/06+04,05_bundle_verification/`; the exact stop record is `USER_REVIEW.md`, and its last archived pair is `plan_cloud_G10_1.log` / `code_review_cloud_G10_1.log` with verdict `FAIL`.
- Required findings: the prior predecessor parser was prose-sensitive, full synthetic/owner closure evidence was absent, and the exporter could not proceed because the manifest named three paths absent from the pinned revision. Suggested/Nit findings: none relevant to this correction.
- Affected input: `scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv`; the old manifest has 303 rows (`file=293`, `state=10`), `retain-generic=137`, and SHA-256 `7026fedc8b0eb24eab5c4124d3818400f66db5f1d116a71e7781f346fbd256a7`.
- Verified correction candidate: remove exactly the SDD decision-log row and the two protocol-profile test rows, producing 300 rows (`file=290`, `state=10`), `retain-generic=135`, and SHA-256 `d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf`. A real fixture-mode exporter run against the pinned revision succeeded with `source_mode=pinned-git-tree`.
- Roadmap carryover: this packet contributes only to Milestone task `transfer` and SDD scenario S02. It does not claim full owner-state export, S02 completion, or Roadmap task completion.

## Analysis

### Files Read

- `agent-roadmap/current.md`
- `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/user_review_0.log`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/user_review_1.log`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/06+04,05_bundle_verification/USER_REVIEW.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/06+04,05_bundle_verification/code_review_cloud_G10_1.log`
- `scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv`
- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.json`
- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json`
- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq`
- `cmd/iop-chronos-transfer/main.go`
- `cmd/iop-chronos-transfer/main_test.go`
- `go.mod`
- `agent-ops/rules/project/domain/testing/rules.md`
- `agent-test/local/rules.md`
- `agent-test/local/testing-smoke.md`

### SDD Criteria

- SDD: `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`; status approved, lock released, no active SDD `USER_REVIEW.md`.
- First-line scope: `milestone-task=transfer`.
- Target scenario: S02. Its Evidence Map requires a versioned bundle digest, isolated staging baseline, behavior fixture, forbidden-import check, and itemized receipt without missing IOP source dependencies.
- This packet repairs the manifest prerequisite and supplies a pinned fixture-mode export plus behavior evidence. It deliberately does not provide the owner-state export or claim S02 closure; the later `06+04,05_bundle_verification` replan owns that closure.

### Verification Context

- Supplied handoff: none. The selected `06+04,05_bundle_verification/USER_REVIEW.md` is control evidence, not a neutral verification-context handoff.
- Sources: `agent-test/local/rules.md`, `agent-test/local/testing-smoke.md`, the testing domain rule, `go.mod`, exporter source/tests, the manifest, and the state fixture/schema/oracle.
- Repository-native commands and criteria: `go version && go env GOMOD`, fresh `go test -count=1 ./cmd/iop-chronos-transfer`, a sorted `git ls-tree` manifest audit, exact row/digest assertions, an actual fixture-mode exporter run against the pinned revision, bundled behavior tests, evidence-log comparison, and `git diff --check`.
- Preconditions: workdir `/config/workspace/iop-s1`; pinned object resolves as a commit; Git, Go, jq, and sha256sum are available; exporter output is a fresh absolute directory under `/tmp` and outside every checkout.
- Read-only preflight: `go1.26.2 linux/arm64`, `GOMOD=/config/workspace/iop-s1/go.mod`, required commands present, focused tests PASS, corrected candidate export PASS, and `git diff --check` PASS.
- Constraints: `go.mod` and local rules declare Go 1.24 while this host provides compatible newer Go 1.26.2. No external service, secret, owner-state path, Git-history write, archive mutation, or `iop-agent` execution is permitted.
- Gaps: exact Go 1.24 parity was not run; the focused package and actual exporter path pass on the dispatcher host. Full owner-state verification remains in task 06.
- Confidence: medium; the full correction path was preflighted locally, with only the declared toolchain-version parity gap and deferred owner-state closure remaining.

### Test Coverage Gaps

- Missing pinned blobs are covered by `TestRejectsMissingRevisionBlob`.
- Pinned bytes remaining independent of newer HEAD/worktree content are covered by `TestExportIgnoresNewerHeadAndDirtyWorktree`.
- Deterministic archive/receipt output is covered by `TestDigestStableAcrossRuns`; the focused suite passes fresh.
- The repository-specific three-row fixture defect is not encoded in a Go unit fixture. The exact sorted-tree audit, fixed digest/count assertions, and actual pinned exporter run are the regression oracle; no exporter test change is needed.

### Symbol References

- None. No symbol is renamed or removed, and exporter source/tests remain unchanged.

### Split Judgment

- Archive sibling names occupy indices `01` through `05`: `01_asset_universe`, `02+01_disposition`, `03+02_inventory_closure`, `04+03_bundle_exporter`, and `05+03_state_fixture`.
- Active sibling names occupy indices `06` through `15`: `06+04,05_bundle_verification` through `15+14_handoff_closure`. Therefore `16` is the lowest unused collision-free split index.
- `16_manifest_baseline_repair` is independent (`depends_on=[]`). Making it depend on stopped task 06 would create a repair deadlock; task 06 must instead consume this task's PASS evidence when it is replanned.
- The manifest, active baseline wording, pinned exporter run, and correction evidence form one compact invariant. Splitting them would permit a digest or documentation update without proof that the exact exporter contract accepts the corrected bytes.

### Scope Rationale

- Modify only the active manifest, the two active Milestone/SDD baseline documents, this task's deterministic evidence log, and this task's review evidence file.
- Preserve revision `3155be0e275437a8eedc1aa93497955a7d30465b`, Git history, all existing archive directories and `complete.log` files, `WORK_LOG.md`, task 06's `USER_REVIEW.md`, and every other active PLAN/CODE_REVIEW pair.
- Do not modify `cmd/iop-chronos-transfer`; its pinned-tree rejection is correct and must remain fail-closed.
- Do not delete or edit the two protocol-profile tests in the current checkout. Exclude them only from the revision-3155 historical bundle because they did not exist in that revision.
- Do not place `user_review_0.log` in the bundle. Preserve it unchanged as active SDD decision evidence, bound in the correction log by path and SHA-256.
- Do not run owner-state export or create the stable owner receipt; those belong to the later task-06 replan.

### Final Routing

- `evaluation_mode=first-pass`; `finalizer=finalize-task-policy.sh`; `finalizer_mode=pair`.
- Build closures: scope/context/verification/evidence/ownership/decision are all true; capability gap: none.
- Build scores: scope coupling 1, state/concurrency 0, blast/irreversibility 1, evidence diagnosis 1, verification complexity 1; grade G04; base/route basis `local-fit`; lane `local`; filename `PLAN-local-G04.md`.
- Build signals: `large_indivisible_context=false`; matched loop risks `boundary_contract`, `structured_interpretation`; count 2; `review_rework_count=0`; `evidence_integrity_failure=false`; risk and recovery boundaries false.
- Review closures are all true. Scores: 1/0/1/1/1; route `official-review`; lane `cloud`; grade G04; adapter `codex`; model `gpt-5.6-sol`; reasoning `xhigh`; filename `CODE_REVIEW-cloud-G04.md`.

## Implementation Checklist

- [ ] Derive the manifest from revision `3155be0e275437a8eedc1aa93497955a7d30465b`, remove exactly the three non-pinned rows, and preserve every other row and the exporter fail-closed contract.
- [ ] Update only the active Milestone and SDD baseline wording to distinguish the Task-03 historical 303-row evidence from the corrected 300-row pinned-transfer input, classify `user_review_0.log` as separate evidence, and exclude the two post-revision tests from this historical snapshot.
- [ ] Run the fresh focused tests, deterministic pinned-tree audit, actual fixture-mode exporter and bundled behavior test, then write the exact English correction evidence to `manifest-baseline-verification.log`.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [TEST-1] Repair and prove the pinned manifest baseline

#### Problem

`scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv:21`, `:104`, and `:126` name paths absent from the pinned tree. `cmd/iop-chronos-transfer/main.go:639-667` correctly requires every non-state row to resolve to a regular blob and fails with `manifest source is missing from the pinned revision`. The active Milestone and SDD still describe the defective current baseline as 303 rows, `retain-generic=137`, and SHA `7026...56a7`, so changing only the TSV would leave active evidence inconsistent.

#### Solution

Verify the old manifest SHA before editing, then delete exactly the three rows through an explicit patch. Recompute the manifest from the sorted pinned tree and require the final bytes to have 300 rows, `file=290`, `state=10`, `retain-generic=135`, and SHA `d8598134...d2ccf`. Update all active “current manifest” clauses in the Milestone/SDD to the corrected baseline while retaining the Task-03 303-row result as historical evidence only. Add concise English correction text stating that the SDD log is separate decision evidence and the two protocol-profile tests are outside this historical revision.

Before (`scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv:21,104,126`):

```text
agent-roadmap/.../user_review_0.log  evidence  reference  source/.../user_review_0.log  none  -  S01,S05
apps/node/internal/adapters/openai_compat/protocol_profile_test.go  test  retain-generic  source/...  rewrite  ...  S01,S04
apps/node/internal/node/protocol_profile_tunnel_test.go  test  retain-generic  source/...  rewrite  ...  S01,S04
```

After:

```text
# All three rows are absent. user_review_0.log is separate SDD evidence.
# The two tests remain in the current checkout but are excluded from the revision-3155 historical bundle.
```

Active baseline after correction:

```text
historical Task-03 inventory evidence: rows=303 file=293 state=10
corrected pinned-transfer manifest: rows=300 file=290 state=10 retain-generic=135
corrected manifest sha256: d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf
```

#### Modified Files and Checklist

- [ ] `scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv` — remove exactly the three rows and no other content.
- [ ] `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md` — make current baseline/count/delta references use the corrected manifest while retaining Task-03 counts as historical only.
- [ ] `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md` — align Source of Truth, state transition, interface input, S01 evidence wording, and work context with the corrected baseline and separate-evidence classification.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/16_manifest_baseline_repair/manifest-baseline-verification.log` — record only the exact English key/value evidence specified below.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/16_manifest_baseline_repair/CODE_REVIEW-cloud-G04.md` — fill actual implementation and verification evidence; do not finalize the review.

#### Test Strategy

Do not modify exporter tests. Existing `TestRejectsMissingRevisionBlob`, `TestExportIgnoresNewerHeadAndDirtyWorktree`, and `TestDigestStableAcrossRuns` cover the pinned-source contract. Run the fresh focused suite, then use the real repository manifest with a fixture-mode export and bundled behavior test as the regression for the corrected data. The exact old/new digest, exact three exclusions, all retained non-state rows, SDD evidence hash, receipt, and bundle digest are asserted.

#### Verification

- Run `go test -count=1 ./cmd/iop-chronos-transfer`; expect exit 0.
- Run Final Verification commands 3-5; expect exact manifest/digest/evidence equality and `source_mode=pinned-git-tree` without modifying exporter source.

## Modified Files Summary

| File | Item |
|------|------|
| `scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv` | TEST-1 |
| `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md` | TEST-1 |
| `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/16_manifest_baseline_repair/manifest-baseline-verification.log` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/16_manifest_baseline_repair/CODE_REVIEW-cloud-G04.md` | TEST-1 |

## Final Verification

1. `go version && test "$(go env GOMOD)" = /config/workspace/iop-s1/go.mod`
   - Expected: Go reports its version and the module-root assertion exits 0. Go 1.26.2 is the preflighted dispatcher-host version for this Go 1.24 module.
2. `go test -count=1 ./cmd/iop-chronos-transfer`
   - Expected: fresh focused suite exits 0; cached output is not accepted.
3. `bash -euo pipefail -c 'revision=3155be0e275437a8eedc1aa93497955a7d30465b; manifest=scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv; test "$(sha256sum "$manifest" | awk "{print \\$1}")" = d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf; test "$(awk -F "\t" "NR>1 {if (\\$2==\"state\") s++; else f++} END {printf \"%d:%d:%d\", f,s,f+s}" "$manifest")" = 290:10:300; test "$(awk -F "\t" "NR>1 && \\$3==\"retain-generic\" {n++} END {print n+0}" "$manifest")" = 135; tree=$(mktemp); git ls-tree -r --name-only "$revision" | LC_ALL=C sort -u > "$tree"; awk -F "\t" "NR==FNR {p[\\$0]=1; next} FNR==1 || \\$2==\"state\" || p[\\$1]" "$tree" "$manifest" | cmp -s - "$manifest"; for path in agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/user_review_0.log apps/node/internal/adapters/openai_compat/protocol_profile_test.go apps/node/internal/node/protocol_profile_tunnel_test.go; do ! rg -F -q "$path" "$manifest"; ! git cat-file -e "$revision:$path" 2>/dev/null; done; test "$(sha256sum agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/user_review_0.log | awk "{print \\$1}")" = e48d18ee51913707ef4aa4e1bf1b235794d43913927af54340d08255f546e5a3'`
   - Expected: exit 0; all 290 non-state rows come from the pinned tree, all 10 state rows remain, the three selected rows are absent, and the separate SDD evidence bytes are unchanged.
4. `bash -euo pipefail -c 'temp_root=$(mktemp -d /tmp/iop-chronos-manifest-repair.XXXXXX); output="$temp_root/export"; staging="$temp_root/staging"; go run ./cmd/iop-chronos-transfer export --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --source-revision 3155be0e275437a8eedc1aa93497955a7d30465b --repo-root . --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --output "$output"; test "$(sha256sum "$output/receipt.json" | awk "{print \\$1}")" = f0af396a439e8bb513ced2d7b36a6e96b94c0b74bdaf69adeb61077c4d38d6ee; test "$(sha256sum "$output/chronos-acceptance-v1.tar.gz" | awk "{print \\$1}")" = 63e43471a70f0c6be188354c934474bd0f371a1dff20af5429af7e8f0f29c4c2; jq -e '\'' .source_revision=="3155be0e275437a8eedc1aa93497955a7d30465b" and .manifest_sha=="d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf" and .source_mode=="pinned-git-tree" and .archive_mode=="0600" and .state_logical_id_count==12 '\'' "$output/receipt.json" >/dev/null; tar -xOzf "$output/chronos-acceptance-v1.tar.gz" acceptance-v1/provenance/ownership-manifest.tsv | cmp -s - scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv; install -d -m 0700 "$staging"; tar -xzf "$output/chronos-acceptance-v1.tar.gz" -C "$staging"; cd "$staging/acceptance-v1/behavior"; go test -count=1 ./...'`
   - Expected: actual exporter and bundled behavior tests exit 0 with the exact deterministic receipt/bundle digests and unchanged `pinned-git-tree` source mode. The unique `/tmp` output may remain for inspection and is not a repository artifact.
5. `diff -u <(printf '%s\n' 'artifact_version=1' 'artifact_status=PASS' 'artifact_language=English' 'source_revision=3155be0e275437a8eedc1aa93497955a7d30465b' 'historical_manifest_sha256=7026fedc8b0eb24eab5c4124d3818400f66db5f1d116a71e7781f346fbd256a7' 'historical_manifest_rows=303' 'corrected_manifest_sha256=d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf' 'corrected_manifest_rows=300' 'corrected_file_rows=290' 'corrected_state_rows=10' 'corrected_retain_generic_rows=135' 'removed_pinned_source_rows=3' 'separate_sdd_evidence_path=agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/user_review_0.log' 'separate_sdd_evidence_sha256=e48d18ee51913707ef4aa4e1bf1b235794d43913927af54340d08255f546e5a3' 'excluded_protocol_profile_tests=2' 'source_mode=pinned-git-tree' 'export_receipt_sha256=f0af396a439e8bb513ced2d7b36a6e96b94c0b74bdaf69adeb61077c4d38d6ee' 'export_bundle_sha256=63e43471a70f0c6be188354c934474bd0f371a1dff20af5429af7e8f0f29c4c2' 'export_behavior=PASS' 'exporter_contract=unchanged') agent-task/m-iop-agent-chronos-extraction-decoupling/16_manifest_baseline_repair/manifest-baseline-verification.log`
   - Expected: no diff; the only new correction evidence artifact is exact, deterministic, and English.
6. `bash -euo pipefail -c 'for doc in agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md; do rg -F -q "d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf" "$doc"; rg -F -q "corrected pinned-transfer manifest" "$doc"; rg -F -q "separate evidence" "$doc"; rg -F -q "excluded from the revision-3155 historical bundle" "$doc"; ! rg -F -q "7026fedc8b0eb24eab5c4124d3818400f66db5f1d116a71e7781f346fbd256a7" "$doc"; done; test ! -e agent-task/m-iop-agent-chronos-extraction-decoupling/16_manifest_baseline_repair/complete.log; git diff --check'`
   - Expected: both active documents use the corrected current baseline and explicit English classification text, the superseded SHA exists only in task-local correction evidence, no premature completion log exists, and diff checks pass.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
