<!-- task=m-openai-compatible-output-validation-filters/02+01_repeat_guard plan=8 tag=REVIEW_OFR-REPEAT-7 -->

# Code Review Reference - REVIEW_OFR-REPEAT-7

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-07-29
task=m-openai-compatible-output-validation-filters/02+01_repeat_guard, plan=8, tag=REVIEW_OFR-REPEAT-7

## Roadmap Targets

- Milestone: `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md`
- Milestone link: [Milestone document](agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md)
- Task ids:
  - `repeat-guard`: rolling content/history/action repetition detection and safe continuation
- Completion mode: check-on-pass

## Archive Evidence Snapshot

- Predecessor dependency: `agent-task/archive/2026/07/m-openai-compatible-output-validation-filters/01_resume_notice_builder/complete.log` records PASS and satisfies subtask `+01`.
- Earlier failed loops: `plan_cloud_G10_0.log` / `code_review_cloud_G10_0.log`, `plan_cloud_G10_1.log` / `code_review_cloud_G10_1.log`, `plan_cloud_G10_2.log` / `code_review_cloud_G10_2.log`, `plan_cloud_G10_3.log` / `code_review_cloud_G10_3.log`, and `plan_cloud_G10_5.log` / `code_review_cloud_G10_5.log`.
- Plan-contract correction: `plan_cloud_G10_4.log` and `code_review_cloud_G10_4.log`.
- Earlier review pair: `plan_cloud_G10_6.log` and `code_review_cloud_G10_6.log`; verdict FAIL.
- Immediate prior pair: `plan_cloud_G10_7.log` and `code_review_cloud_G10_7.log`; verdict FAIL.
- Fresh reviewer evidence: local focused race checks pass, while the reviewed tree and dev runner still use different refs, selected capacity is 3 rather than 4, and the fixed prompt/observation inputs are absent.
- Required follow-up: publish the exact reviewed work through an authorized clean-ref workflow, rebuild/redeploy/restart every participating runtime from that ref, restore both selected providers, provision worker-owned inputs, and record 15 unique SSE-derived correlations plus three accepted `4/4/>=1/0/0` capacity rows.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G10.md` → `code_review_cloud_G10_8.log` and `PLAN-cloud-G10.md` → `plan_cloud_G10_8.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-openai-compatible-output-validation-filters/02+01_repeat_guard/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, report completion event metadata. Roadmap state check and `update-roadmap` calls are runtime responsibilities.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_OFR-REPEAT-7-1 — Clean same-ref live lifecycle and capacity evidence with worker-owned external raw artifacts | [ ] |

## Implementation Checklist

- [ ] [REVIEW_OFR-REPEAT-7-1] Produce the clean same-ref `ornith:35b` 5-concurrent × 3 lifecycle and capacity evidence with matching runtime identities, worker-owned external raw artifacts, and sanitized results.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G10_8.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G10_8.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory `agent-task/m-openai-compatible-output-validation-filters/02+01_repeat_guard/` to `agent-task/archive/YYYY/MM/m-openai-compatible-output-validation-filters/02+01_repeat_guard/` and update this checklist at the final archive path.
- [ ] If PASS and task group is `m-<milestone-slug>`, report completion event metadata for runtime, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove empty active parent `agent-task/m-openai-compatible-output-validation-filters/` or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

- The normal authorized commit/push workflow was used to publish the reviewed tree as
  `d1e32b6e06f7153a4db5a5a08b7026d6dd49fcfb`, because a clean remotely
  addressable ref was a mandatory precondition. No force push was used.
- The runner's first default-parallel `go test -count=1 ./...` attempt exposed two
  pre-existing macOS runner constraints: the agent-task fake workspace compared
  `/var` with its canonical `/private/var` path, and the catalog package's two-second
  probe timed out under parallel package load. A checkout-local ignored `TMPDIR`
  removed the path mismatch, and `go test -p 1 -count=1 ./...` passed before and
  after the same-ref artifact build. No test or production source was changed for
  these runner-only constraints.
- The first Edge/macOS Node restart shell exited 1 after losing its nested-shell PID
  variables. Both processes had already started successfully; their actual
  PPID-1 processes were rediscovered, their PID files were corrected, and their
  start times/listeners were verified.
- The live command was intentionally not run. The required preflight failed because
  the RTX5090 host remained unreachable over its authorized SSH alias, leaving
  selected aggregate capacity at 3 instead of 4. The deployed Edge configuration
  also has no `openai.stream_evidence_gate` block, so it cannot emit the required
  repeat-guard lifecycle observations. Changing that shared runtime configuration
  is outside this verification-only plan.

## Key Design Decisions

- The clean source and runtime identity was pinned to
  `d1e32b6e06f7153a4db5a5a08b7026d6dd49fcfb`; the runner was clean-synced
  to that ref before rebuilding all platform artifacts.
- Edge, macOS Node, GX10 Node, and OneXPlayer Node were gracefully restarted from
  the rebuilt artifacts. The unavailable RTX5090 Node was not represented as
  deployed or restarted.
- The non-empty prompt, raw smoke artifact directory, and observation input were
  provisioned only below worker-owned `/tmp/iop-repeat-guard-live/`. The fixed
  observation path points to the Edge JSON log, whose sampled tail was valid JSON.
  No raw prompt, SSE, output, credential, or token was copied into tracked evidence
  or command output.
- The once-only live test invocation was preserved for a valid preflight. Running it
  with an offline selected provider or a disabled stream gate would create invalid,
  mixed-readiness evidence rather than the required acceptance proof.

## Reviewer Checkpoints

- Confirm one clean reviewed ref identifies the source, Edge binary, every participating Node binary, deployment/restart, process start time, listener ports, and selected provider status.
- Reject stale or mixed source/build/process identities and any live summary produced before the clean same-ref preflight passes.
- Confirm the exact live command exits 0 with 15 unique SSE-derived correlations and exactly three capacity rows satisfying `4/4/>=1/0/0`.
- Confirm raw prompt, SSE, output, credentials, and tokens remain only in the worker-owned `/tmp/iop-repeat-guard-live/` directory; tracked artifacts and stdout remain sanitized.
- Confirm no production, test, contract, spec, or config change was introduced by this verification-only follow-up.

## Verification Results

### Clean Same-Ref Identity Preflight

Record the authorized clean ref, clean runner status, Edge and every participating Node checksum/version, deployment/restart record, process start times, listener ports, provider identities, configured capacity, and readiness of the fixed worker-owned prompt/observation inputs. If any identity is stale, mixed, or unavailable, record the exact attempted preflight output, blocker, and resume condition and do not run the live command.

Implementation evidence:

Status: **BLOCKED; live preflight did not pass.**

Clean source ref:

```text
local HEAD=d1e32b6e06f7153a4db5a5a08b7026d6dd49fcfb
local branch=feature/openai-compatible-output-validation-filters
local status=clean
remote feature ref=d1e32b6e06f7153a4db5a5a08b7026d6dd49fcfb
runner HEAD=d1e32b6e06f7153a4db5a5a08b7026d6dd49fcfb
runner status=clean
```

The clean runner completed `TMPDIR=/Users/toki/agent-work/iop-dev/build/go-test-tmp
go test -p 1 -count=1 ./...` with exit 0 before and after the artifact build.

Built and deployed identities:

```text
Edge:
  sha256=c1dc3b13780ce2421867c2a56575b489136418b24acbae67d86dae6eba48d3cd
  version=0.1.0
  pid=7140 ppid=1 start="Wed Jul 29 18:56:30 2026"
  listeners=*:18083,*:18084,127.0.0.1:19093
mac-codex Node:
  sha256=efa6be20376c21bdf074cae90c9a22120ad95f6eb11d60c3b0b808c8d3ea8125
  version=0.1.0
  pid=7145 ppid=1 start="Wed Jul 29 18:56:31 2026"
gx10-vllm Node:
  sha256=5a2d4dcaa16ee0b44a6600a1b91d6a022d46ee7dd3b6ecb2c0f93553c6b846f3
  version=0.1.0
  pid=159799 ppid=1 start="Wed Jul 29 18:57:49 2026"
  node listener=*:19103
onexplayer-lemonade Node:
  sha256=fc269bf238880845c8b0f419b0857b36d34e5953a69514b59f3fbeffbef10f5a
  version=0.1.0
  pid=15172 start="07/29/2026 18:58:46" (host-reported local time)
  provider listener=0.0.0.0:13305
rtx5090-lemonade Node:
  runner artifact sha256=fc269bf238880845c8b0f419b0857b36d34e5953a69514b59f3fbeffbef10f5a
  deployment/restart/runtime identity=UNAVAILABLE
```

The final authorized RTX5090 status attempt failed:

```text
$ ssh -o BatchMode=yes -o ConnectTimeout=8 iop-dev-rtx5090 \
    'powershell ... remote-llm-toggle.ps1 -Action Status'
ssh: connect to host 192.168.0.111 port 22: Connection timed out
exit=255
```

The Edge control-plane status after the other restarts reported:

```text
onexplayer-lemonade: connected=true health=healthy status=available capacity=3
rtx5090-lemonade:    connected=false health=offline status=unavailable capacity=0
configured selected capacity=4
available selected capacity=3
all selected counters at preflight: in_flight=0 queued=0
```

Worker-owned input readiness:

```text
prompt=/tmp/iop-repeat-guard-live/repeat-prompt.txt bytes=217
artifact_dir=/tmp/iop-repeat-guard-live/repeat-guard mode=700
observation=/tmp/iop-repeat-guard-live/edge-observations.jsonl
observation_target=/Users/toki/agent-work/iop-dev/build/dev-runtime/bin/logs/edge.log
observation_bytes=117724196
sampled Edge log tail JSON validation=valid
```

An additional read-only runtime-config preflight reported:

```text
openai keys do not include stream_evidence_gate
stream_gate_enabled=nil
stream_gate_filters=
streamgate_filter_observation events=0
```

Resume condition: make the RTX5090 SSH service reachable through
`iop-dev-rtx5090`; deploy and restart the exact Windows artifact above; use the
existing explicit `remote-llm-toggle.ps1 -Action Up` workflow; verify its exact
Ornith profile, `0.0.0.0:13305` listener, connected Node, and capacity 1 without
creating boot autostart. The authorized runtime workflow must also provision and
restart the same-ref Edge with the intended active repeat-guard stream-gate policy.
Only after the status endpoint reports both selected providers healthy with aggregate
capacity 4 and the observation sink is active may the once-only live command run.

### Fresh Local Guard Verification

```bash
go version && go env GOMOD
git diff --check
go test -race -count=1 ./packages/go/streamgate -run '^TestRequestRuntimeTerminalFailureFidelity/fatal_filter_overrides_success_terminal$'
go test -race -count=1 ./apps/edge/internal/openai -run 'Test(DevRepeatGuardObservationCorrelation|DevRepeatGuardCapacityEvidence)'
```

Expected: all commands exit 0; focused evidence is fresh and uncached.

Implementation evidence:

All required commands were rerun from the clean local ref and exited 0:

```text
$ go version && go env GOMOD
go version go1.26.2 linux/arm64
/config/workspace/iop-s1/go.mod

$ git diff --check
[no output]

$ go test -race -count=1 ./packages/go/streamgate \
    -run '^TestRequestRuntimeTerminalFailureFidelity/fatal_filter_overrides_success_terminal$'
ok  	iop/packages/go/streamgate	1.015s

$ go test -race -count=1 ./apps/edge/internal/openai \
    -run 'Test(DevRepeatGuardObservationCorrelation|DevRepeatGuardCapacityEvidence)'
ok  	iop/apps/edge/internal/openai	1.336s
```

### Clean Same-Ref Live Lifecycle and Capacity Evidence

After the authorized clean sync/rebuild/redeploy/restart and identity proof:

```bash
IOP_OPENAI_BASE_URL=http://127.0.0.1:18083 \
IOP_OPENAI_MODEL=ornith:35b \
IOP_OPENAI_SMOKE_CONCURRENCY=5 \
IOP_OPENAI_SMOKE_RUNS=3 \
IOP_OPENAI_SMOKE_PROMPT_FILE=/tmp/iop-repeat-guard-live/repeat-prompt.txt \
IOP_OPENAI_SMOKE_ARTIFACT_DIR=/tmp/iop-repeat-guard-live/repeat-guard \
IOP_OPENAI_SMOKE_OBSERVATION_FILE=/tmp/iop-repeat-guard-live/edge-observations.jsonl \
IOP_OPENAI_SMOKE_STATUS_URL=http://127.0.0.1:18001/edges/edge-toki-labs-dev/status \
IOP_OPENAI_SMOKE_PROVIDER_IDS=onexplayer-lemonade,rtx5090-lemonade \
go test -count=1 -v ./apps/edge/internal/openai -run '^TestDevRepeatGuardOrnithSmoke$'
```

Expected: exit 0; exactly 15 unique sanitized request correlations and three capacity rows satisfying `4/4/>=1/0/0`, with no raw prompt/output/token in tracked files or stdout.

Implementation evidence:

Status: **NOT RUN.**

The exact live command was not invoked, so there is no live PASS claim, no generated
summary, no correlation count, and no capacity row. The mandatory same-ref
preflight failed before invocation:

```text
rtx5090-lemonade connected=false health=offline capacity=0
selected aggregate capacity=3 (required 4)
RTX5090 authorized SSH status exit=255 (port 22 timed out)
Edge stream_evidence_gate absent
streamgate_filter_observation events=0
```

The fixed worker-owned input paths are ready, but the command must remain unrun
until every resume condition in `Clean Same-Ref Identity Preflight` is satisfied.
At that point, run the command shown in this section exactly once and require 15
unique SSE-derived correlations plus three accepted capacity rows with
`configured=4`, `peak_in_flight=4`, `peak_queued>=1`, `final_in_flight=0`, and
`final_queued=0`.

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Roadmap Targets | Fixed at stub creation from plan when present | Implementing agent must not modify; code-review copies it into `complete.log` as `Roadmap Completion` only on PASS |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Pass
  - Completeness: Fail
  - Test coverage: Fail
  - API contract: Pass
  - Code quality: Pass
  - Implementation deviation: Pass
  - Verification trust: Pass
  - Spec conformance: Fail
- Findings:
  - Required — `agent-task/m-openai-compatible-output-validation-filters/02+01_repeat_guard/CODE_REVIEW-cloud-G10.md:56`, `agent-task/m-openai-compatible-output-validation-filters/02+01_repeat_guard/CODE_REVIEW-cloud-G10.md:279`, and `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md:78`: `REVIEW_OFR-REPEAT-7-1` remains unchecked and the required clean same-ref `ornith:35b` capacity+1 live verification is explicitly `NOT RUN`. Fresh reviewer checks confirm that the focused race-enabled fixtures pass and the source and available deployed artifacts identify commit `d1e32b6e06f7153a4db5a5a08b7026d6dd49fcfb`, but selected healthy capacity is only 3 because `rtx5090-lemonade` is offline and the deployed Edge configuration has no enabled `openai.stream_evidence_gate`, so no filter observations can prove the SDD S07 lifecycle. Restore RTX5090 connectivity and the exact same-ref Windows runtime, provision and restart Edge with the intended repeat-guard gate and observation sink, confirm both selected providers are healthy with aggregate capacity 4, run the fixed 5-concurrent × 3 command exactly once, and record only sanitized identities, 15 unique SSE-derived correlations, and three accepted capacity rows with `configured=4`, `peak_in_flight=4`, `peak_queued>=1`, `final_in_flight=0`, and `final_queued=0`.
- Routing Signals: `review_rework_count=8`, `evidence_integrity_failure=false`
- Next Step: Archive this failed pair and create the routed follow-up PLAN/CODE_REVIEW pair for the same task path.
