<!-- task=m-iop-agent-cli-runtime/08+06,07_quota_failure plan=0 tag=API -->

# Code Review Reference - API

> **[IMPLEMENTING AGENT — READ FIRST]** Both encoded predecessors must pass. Fill actual evidence and leave archive/finalization to review.

## Overview

date=2026-07-28
task=m-iop-agent-cli-runtime/08+06,07_quota_failure, plan=0, tag=API

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `quota-failure`: typed quota/failure와 policy-only retry/failover
- Completion mode: check-on-pass

## Implementation Item Completion

| Item | Status |
|---|---|
| API-1 failure-aware route continuation을 구현한다 | [ ] |

## Implementation Checklist

- [ ] quota evidence와 Failure를 work-attempt snapshot으로 normalize하고 secret-bearing diagnostics를 exclude한다.
- [ ] retry/failover eligibility를 ordered policy, unused candidate, failure budget으로 제한한다.
- [ ] unknown/stale/corrupt observation을 silent selection 없이 typed blocker로 만든다.
- [ ] exhaustion, unknown, retry budget, failover and isolation tests를 추가한다.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]**

- [x] Append PASS/WARN/FAIL and verified routing signals.
- [x] Archive as `code_review_cloud_G09_0.log` and `plan_cloud_G09_0.log`.
- [ ] On PASS create `complete.log`, report `quota-failure`, then archive this subtask.

## Deviations from Plan

_Record actual deviations and rationale here._

## Key Design Decisions

_Record actual decisions here._

## Reviewer Checkpoints

- Unknown evidence blocks one work unit; retry/failover must match policy and persist history.

## Verification Results

### `go test -count=1 ./packages/go/agentruntime ./packages/go/agentprovider/cli/status ./packages/go/agentpolicy ./packages/go/agenttask`

_Paste actual stdout/stderr._

### `rg --sort path -n 'RawOutput' packages/go/agentpolicy packages/go/agenttask`

_Paste actual stdout/stderr._

### `git diff --check`

_Paste actual stdout/stderr._

## Section Ownership

| Section | Owner |
|---|---|
| Implementation checklist/results/deviations/decisions | Implementing agent |
| Review checklist, verdict, archive and completion log | Review agent |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail
  - Completeness: Fail
  - Test coverage: Fail
  - API contract: Fail
  - Code quality: Pass
  - Implementation deviation: Fail
  - Verification trust: Fail
  - Spec conformance: Fail
- Findings:
  - Required — `packages/go/agentpolicy/quota.go:85`: quota normalization trusts the caller-supplied `snapshot_id` without recomputing or validating it against `checked_at`, target status, caps, and reasons, and it copies any syntactically safe reason string into durable evidence. A snapshot can therefore retain its old ID while `exhausted` is changed to `available`, or persist a secret-like reason, and still become `ObservationValid`. Also, malformed identity is returned as `ObservationCorrupt` with the malformed value retained, but `ValidateAttemptObservation` rejects that value before `agenttask` can persist the promised typed work-unit blocker. Add content-integrity validation and a sanitized corrupt projection, whitelist durable reason codes, and cover field tampering plus the manager blocker path.
  - Required — `packages/go/agentpolicy/quota.go:17`: SDD S07 explicitly includes `not-applicable`, but the durable quota enum and decision matrix support only `available`, `exhausted`, and `unknown`. Add an explicit not-applicable normalization/continuation case and tests so absence of a provider quota surface is not conflated with unknown evidence.
  - Required — `packages/go/agenttask/ports.go:153`: the runtime path never invokes `agentpolicy.DecideContinuation`; the optional selector port can fabricate any non-current target and `dispatch.go` validates only target shape. The integration test does exactly that with a stub decision, so ordered policy, unused-candidate history, and policy-declared retry/failover are not proven or enforced by a concrete common selector path. Connect the immutable persisted route/policy evidence to `DecideContinuation`, persist the resulting history, and exercise the manager with that concrete policy implementation.
  - Required — `agent-contract/inner/agent-runtime.md:94`: the shared runtime contract stops at the typed failure codec and does not define the new quota observation, continuation policy, failure budget, history, or blocker behavior, even though `iop-agent-cli-runtime.md` assigns selection/failover ownership to `iop.agent-runtime`. Update the authoritative shared contract with the public port and state semantics.
  - Required — `agent-task/m-iop-agent-cli-runtime/08+06,07_quota_failure/CODE_REVIEW-cloud-G09.md:20`: every implementation-owned completion/evidence field remains unchecked or placeholder text. This prevents the S07 Evidence Map from being satisfied even though fresh reviewer commands passed. After fixing the behavior, record actual implementation notes, deviations/decisions, and command output and mark the matching checklist items.
- Routing Signals:
  - review_rework_count=1
  - evidence_integrity_failure=true
- Next Step: Archive this reviewed pair and create the freshly routed WARN/FAIL follow-up PLAN/CODE_REVIEW pair through the plan skill.
