<!-- task=m-iop-agent-cli-runtime/06+05_config_registry plan=0 tag=API -->

# Code Review Reference - API

> **[IMPLEMENTING AGENT — READ FIRST]** Verify predecessor completion, fill evidence, and leave finalization to the review agent.

## Overview

date=2026-07-28
task=m-iop-agent-cli-runtime/06+05_config_registry, plan=0, tag=API

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `config-registry`: repo-global/local registry와 immutable revision
- Completion mode: check-on-pass

## Implementation Item Completion

| Item | Status |
|---|---|
| API-1 immutable runtime config snapshot을 제공한다 | [x] |

## Implementation Checklist

- [x] RuntimeConfig와 global/local schema, strict decode 및 revision hash를 새 runtime config file에 구현한다.
- [x] local overlay precedence와 ordered rule 전체 교체를 deterministic merge로 구현하고 repo write를 금지한다.
- [x] watcher가 valid change만 다음 invocation revision으로 publish하도록 구현한다.
- [x] merge, invalid config, array replacement, watcher A/B와 read-only repo tests를 추가한다.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]**

- [x] Append PASS/WARN/FAIL and verified routing signals.
- [x] Archive as `code_review_cloud_G09_0.log` and `plan_cloud_G09_0.log`.
- [ ] On PASS create `complete.log`, report `config-registry`, then archive this subtask.

## Deviations from Plan

No material scope deviations. The contract index row was synchronized in addition to the listed contract document because S05 now has concrete implementation source paths.

## Key Design Decisions

- Raw local overlays use pointer scalars so omitted values remain distinct from explicit `false`, zero, or empty values. Alias maps merge by key with local precedence; ordered selection rules and isolation fallback arrays replace the complete preceding array.
- Exact repo-global and user-local bytes receive separate SHA-256 revisions. A length-prefixed derived runtime revision pins the merged config, effective project registrations, and derived selection-policy revisions.
- `RuntimeSnapshot` keeps the merged config private and returns defensive deep copies. Mutating one accessor result cannot affect a running invocation or a later accessor.
- `RuntimeConfigWatcher` polls both inputs, retains the last valid snapshot on strict decode or validation failure, and coalesces unread valid changes to the latest revision. The implementation exposes no repository write path.
- The user-local schema has no credential or raw environment value fields. Unknown fields, invalid catalog bindings, non-absolute required roots, duplicate rule IDs, unsupported isolation modes, and negative retention values fail closed.

## Reviewer Checkpoints

- Global config is never written; local overrides are deterministic and watcher updates are snapshot-safe.

## Verification Results

### `go test -count=1 ./packages/go/agentconfig`

```text
ok  	iop/packages/go/agentconfig	0.030s
```

### `go test -count=1 ./packages/go/agenttask`

```text
ok  	iop/packages/go/agenttask	0.131s
```

### `git diff --check`

PASS (no output).

### Additional focused verification

```text
go test -count=1 -race ./packages/go/agentconfig
ok  	iop/packages/go/agentconfig	1.062s

go test -count=20 ./packages/go/agentconfig
ok  	iop/packages/go/agentconfig	0.618s

go vet ./packages/go/agentconfig
PASS (no output).

git diff --no-index --check /dev/null <each untracked implementation artifact>
PASS (no whitespace diagnostics).
```

## Section Ownership

| Section | Owner |
|---|---|
| Implementation checklist/results/deviations/decisions | Implementing agent |
| Review checklist, verdict, archive and completion log | Review agent |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail
  - Completeness: Fail
  - Test Coverage: Fail
  - API Contract: Fail
  - Code Quality: Pass
  - Implementation Deviation: Pass
  - Verification Trust: Pass
  - Spec Conformance: Fail
- Findings:
  - Required — `packages/go/agentconfig/runtime_config.go:569`: validate every non-empty catalog identity in a `TargetRef` even when `profile` is absent, or reject such partial targets. `validateTargetCatalogBinding` currently returns immediately when `target.Profile == ""`, so a configured catalog accepts unknown `selection.default.provider` and `selection.default.model` references. A focused reviewer reproducer using `selection.default.provider: missing-provider` loaded successfully, contrary to the contract requirement that invalid catalog references fail the load. Add table-driven regression coverage for the provider-only and model-only variants.
- Routing Signals:
  - `review_rework_count=1`
  - `evidence_integrity_failure=false`
- Next Step: Create a narrowly scoped WARN/FAIL follow-up through the plan skill and rerun isolated routing.
