<!-- task=m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding plan=3 tag=REVIEW_REVIEW_API milestone-task=artifact-pair -->

# Finish Native Tool Normalization and Exact Workspace Receipts

## For the Implementing Agent

Implement every checklist item, run every verification command, and fill the implementation-owned sections of `CODE_REVIEW-cloud-G07.md` with actual notes and verbatim output. Keep the active PLAN and CODE_REVIEW files in place and report ready for review; finalization is code-review-skill-only. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The configured compiler now handles OpenAI maps but still rejects the native Anthropic decoder type, and the receipt matcher accepts explicit error data when a positive subset is also present. The permanent tests model neither defect and the required race and Edge-wide gates remain red. This follow-up closes those exact S06 gaps without integrating the binding into the later artifact-pair coordinator.

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/plan_cloud_G07_2.log`.
- Prior review: `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/code_review_cloud_G07_2.log`.
- Verdict: FAIL with 4 Required, 0 Suggested, and 0 Nit findings; `review_rework_count=2`, `evidence_integrity_failure=true`.
- Required scope: accept the actual native Anthropic decoded tool representation; reject explicit error-shaped receipt bodies; correlate exact receipts with immutable issued operation/path/payload/guard evidence; add the missing S06 operation and negative variants; and produce clean, verbatim integrated verification.
- Affected files: `apps/edge/internal/openai/workspace_tool_binding.go`, `apps/edge/internal/openai/workspace_tool_codec.go`, and `apps/edge/internal/openai/workspace_tool_binding_test.go`.
- Fresh evidence: focused tests and static checks pass; reviewer-only typed-Anthropic and error-shaped-success cases fail; race and all-Edge commands fail in the active shared Hot Path work, with the current Chat failure reporting `unhealthy_route` instead of the submitted creation-time evidence.
- Roadmap carryover: Milestone task `artifact-pair`, approved SDD scenario S06, and its native mapping, exact receipt, operation matrix, and integrated verification Evidence Map rows remain unsatisfied.

## Dependencies and Execution Order

- Predecessor 02 remains satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log`.
- Predecessor 04 remains satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log`.
- Predecessor 06 remains satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/06+04,05_request_identity_ingress/complete.log`.
- Complete REVIEW_REVIEW_API-1 before REVIEW_REVIEW_API-2. Shared sibling Hot Path changes are outside this child; rerun the required integration gates on the final shared checkout and record any remaining exact blocker.

## Analysis

### Files Read

- `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/PLAN-cloud-G07.md`
- `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/CODE_REVIEW-cloud-G07.md`
- `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/plan_local_G06_1.log`
- `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/code_review_cloud_G06_1.log`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-hot-path-one-shot-execution.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-contract/inner/edge-config-runtime-refresh.md`
- `agent-contract/outer/openai-compatible-api.md`
- `agent-contract/outer/anthropic-compatible-api.md`
- `packages/go/config/execution_preset_types.go`
- `apps/edge/internal/openai/anthropic_types.go`
- `apps/edge/internal/openai/workspace_tool_binding.go`
- `apps/edge/internal/openai/workspace_tool_codec.go`
- `apps/edge/internal/openai/workspace_tool_binding_test.go`

### SDD Criteria

- SDD: `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`; status approved and implementation lock released.
- Milestone task id: `artifact-pair`.
- Target acceptance scenario: S06.
- The S06 Evidence Map requires canonical-to-actual mapping for both endpoint tool representations, parent-capable write or prepare, exact versus opaque/error receipts, missing/extra tools, reversed variants, and traversal rejection before local-stage admission.
- The checklist therefore keeps native typed normalization, exact error-aware receipt correlation, the complete operation/variant matrix, and clean race/all-Edge evidence in the same atomic child.

### Verification Context

- No separate external handoff was supplied. Repository-native fallback came from the active pair, prior exact logs, approved SDD, contracts, current compiler/codec/tests, and `agent-test/local/edge-smoke.md`.
- Current host: `/config/workspace/iop-s0`, Go `go1.26.2 linux/arm64`; no credential, remote runner, provider, or workspace tool execution is required.
- Fresh passing evidence: exact predecessor probes, focused workspace tests, Edge vet, formatting, and diff checks.
- Fresh failing evidence: the actual `anthropicTool` reproducer, explicit error-shaped-success receipt reproducer, race suite, and executable-`TMPDIR` all-Edge suite.
- Constraints: tests must remain hermetic and must not inspect a workspace or execute a caller tool. Default `/tmp` is noexec, so the all-Edge command retains an executable temporary directory under `/config`.
- Gap: active shared Hot Path handler tests are currently red outside the three owned source files. This does not expand this child's ownership; it remains an explicit final verification precondition/blocker until the shared checkout is clean.
- Confidence: high; both owned defects have deterministic unit reproducers and the integration failures are fresh command output.

### Test Coverage Gaps

- Actual native Anthropic `[]anthropicTool` plus `json.RawMessage InputSchema`: missing and currently fails.
- Explicit error data coexisting with positive receipt fields: missing and currently matches incorrectly.
- Issued operation/path/arguments/containment-guard mutation correlation: missing.
- Read and delete encoding/result cases: missing.
- Two complete configured alternatives in reversed order and complete missing/extra tool variants: incomplete.
- Integrated race and all-Edge gates: present but failing on the active shared checkout.

### Symbol References

- No public symbol is renamed or removed.
- `compileWorkspaceBinding`, `encodeWorkspaceCall`, and `matchResultReceipt` remain private to `workspace_tool_binding_test.go` in this child; later artifact-pair integration owns production consumption.

### Split Judgment

The decoded tool representation, immutable issued payload, result normalization, and regression matrix form one receipt-safety invariant. Splitting source and tests would prevent either child from producing independent S06 PASS evidence, so this remains one compact dependent subtask. Predecessor indices 02, 04, and 06 are satisfied by the exact archived completions above.

### Scope Rationale

Exclude Hot Path handler/model-identity regressions, artifact-pair coordinator integration, endpoint dispatch, cross-call state, filesystem execution, and roadmap changes. This child changes only the isolated binding compiler, payload/receipt codec, and their deterministic tests; shared integration failures are reported rather than repaired through unrelated files.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer `finalize-task-policy.sh` in pair mode.
- Build closures: scope/context/verification/evidence/ownership/decision are true. Scores `(2,0,2,2,1)` produce G07 with base `local-fit`; `review_rework_count=2` and `evidence_integrity_failure=true` select `recovery-boundary`, yielding `PLAN-cloud-G07.md`.
- Review closures: scope/context/verification/evidence/ownership/decision are true. Scores `(2,0,2,2,1)` produce official cloud G07 `CODE_REVIEW-cloud-G07.md` with adapter `codex`, model `gpt-5.6-sol`, and reasoning effort `xhigh`.
- `large_indivisible_context=false`; positive loop-risk signatures are `boundary_contract`, `structured_interpretation`, and `variant_product` (3); risk boundary is not matched and recovery boundary is matched.
- Capability gap: none. The repository and local Go toolchain can implement and verify the owned fixes.

## Implementation Checklist

- [ ] Accept actual OpenAI map and native Anthropic decoded tool definitions, and make issued workspace receipts deterministic, immutable, and explicit-error-aware.
- [ ] Add the full S06 compiler/operation/receipt regression matrix and obtain clean predecessor, focused, race, all-Edge, vet, formatting, and diff evidence on one checkout.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_REVIEW_API-1] Normalize Native Tools and Exact Receipts

#### Problem

`apps/edge/internal/openai/workspace_tool_binding.go:145-149` drops every non-map definition even though native Messages decodes tools as `anthropicTool`. `apps/edge/internal/openai/workspace_tool_codec.go:371-381` treats the configured matcher as a positive subset and accepts a body that also contains an explicit error; the issued payload has no immutable correlation digest for operation, path, arguments, and guard.

#### Solution

Normalize both endpoint-owned decoded forms without reflection-based role inference, decode and deep-copy typed Anthropic `InputSchema`, and preserve identical canonical fingerprints. Add an immutable issued-payload correlation digest over the binding fingerprint, operation, tool identities, safe path, mapped arguments/command, and containment guard. Reject invalid/trailing JSON and explicit error signals before evaluating the configured success matcher, then verify the payload digest before producing a matched receipt.

Before (`workspace_tool_binding.go:145-149`, `workspace_tool_codec.go:371-381`):

```go
m, ok := rawTool.(map[string]any)
if !ok {
	return nil
}
// ...
if !deepSubsetMatch(map[string]any(ob.resultMatcher), normalized) {
	return receipt
}
receipt.matched = true
```

After:

```go
switch tool := rawTool.(type) {
case map[string]any:
	return normalizeMappedTool(tool)
case anthropicTool:
	return normalizeDecodedAnthropicTool(tool)
}
// Validate the immutable issued-payload digest and reject normalized error
// signals before applying the configured result matcher.
```

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/workspace_tool_binding.go` — normalize actual endpoint decoder forms and copy typed Anthropic schemas into the selected contract.
- [ ] `apps/edge/internal/openai/workspace_tool_codec.go` — canonical issued-payload digest, strict JSON normalization, explicit error rejection, and exact receipt correlation.
- [ ] `apps/edge/internal/openai/workspace_tool_binding_test.go` — native typed normalization, payload mutation, and error-shaped receipt regressions.

#### Test Strategy

Add `TestWorkspaceToolBindingContract/native_decoded_Anthropic_tool` using `[]anthropicTool`, and receipt cases for embedded error, trailing JSON, and mutation of operation/path/arguments/guard after issuance. Assert equivalent OpenAI/Anthropic fingerprints and unmatched receipts for every mutation. Do not execute the guard or a workspace tool.

#### Verification

Run `go test -count=1 ./apps/edge/internal/openai -run 'TestWorkspace(Tool|Command|Binding)'`; expect all compiler/codec cases to pass with no workspace access.

### [REVIEW_REVIEW_API-2] Complete the S06 Matrix and Integrated Evidence

#### Problem

`apps/edge/internal/openai/workspace_tool_binding_test.go:11-199` uses a synthetic Anthropic map and primarily exercises prepare/write. It omits actual native decoding, read/delete, a reversed pair of complete alternatives, issued payload/guard mutation, and embedded error-shaped success. The required race and all-Edge commands also fail on the current shared checkout, and the submitted Chat failure text does not match fresh output.

#### Solution

Expand the permanent table-driven matrix across OpenAI/native Anthropic definitions, structured/command modes, prepare/read/write/delete, parent-capable and separate-prepare alternatives, reversed complete alternatives, missing/extra tools, unsafe paths, identities, payload/guard mutation, and exact/opaque/error results. Keep fixes limited to owned files, then rerun every required command on one final checkout and paste verbatim output; if a shared sibling regression remains, record its exact current failure and resume condition without marking the checklist complete.

Before (`workspace_tool_binding_test.go:14-15`, `workspace_tool_binding_test.go:167-199`):

```go
anthropicTools := []any{anthropicWorkspaceTool("write_file", structuredSchema()), unrelatedTool()}
// Receipt negatives cover opaque/status-error/wrong-id/wrong-body/arbitrary JSON only.
```

After:

```go
nativeTools := []anthropicTool{{Name: "write_file", InputSchema: actualSchema}}
// Table rows cover every canonical operation, ordered alternative, issued
// correlation mutation, and exact/error receipt variant required by S06.
```

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/workspace_tool_binding_test.go` — full S06 endpoint, operation, ordering, containment, identity, and receipt matrix.
- [ ] `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/CODE_REVIEW-cloud-G07.md` — actual implementation notes and verbatim verification output only.

#### Test Strategy

Use table-driven in-package tests with decoded JSON fixtures and typed native tools. Cover both successful mapping and every named negative without touching a real workspace. Retain fresh `-count=1` focused/race/all-Edge execution; cached output is not acceptable.

#### Verification

Run every command in Final Verification. All commands must exit zero on one checkout; otherwise leave REVIEW_REVIEW_API-2 incomplete with the exact blocker evidence.

## Modified Files Summary

| File | Items |
|------|-------|
| `apps/edge/internal/openai/workspace_tool_binding.go` | REVIEW_REVIEW_API-1 |
| `apps/edge/internal/openai/workspace_tool_codec.go` | REVIEW_REVIEW_API-1 |
| `apps/edge/internal/openai/workspace_tool_binding_test.go` | REVIEW_REVIEW_API-1, REVIEW_REVIEW_API-2 |
| `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/CODE_REVIEW-cloud-G07.md` | REVIEW_REVIEW_API-2 |

## Final Verification

```bash
test -f agent-task/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log || test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log
test -f agent-task/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log || test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log
test -f agent-task/m-iop-hot-path-one-shot-execution/06+04,05_request_identity_ingress/complete.log || test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/06+04,05_request_identity_ingress/complete.log
go test -count=1 ./apps/edge/internal/openai -run 'TestWorkspace(Tool|Command|Binding)'
go test -race -count=1 ./apps/edge/internal/openai ./apps/edge/internal/service
review_tmp_dir=$(mktemp -d /config/.tmp-iop-workspace-binding.XXXXXX)
TMPDIR="$review_tmp_dir" go test -count=1 ./apps/edge/...
review_status=$?
rmdir "$review_tmp_dir"
test "$review_status" -eq 0
go vet ./apps/edge/...
gofmt -d apps/edge/internal/openai/workspace_tool_binding.go apps/edge/internal/openai/workspace_tool_codec.go apps/edge/internal/openai/workspace_tool_binding_test.go
git diff --check
```

Expected: every command exits 0; actual OpenAI and native Anthropic decoded tools select only complete configured alternatives; all four canonical operations encode deterministically; explicit or embedded errors, opaque data, identity/payload/guard mutations, traversal, and symlink escape remain unmatched or rejected; no test executes a workspace tool or inspects a real workspace.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
