<!-- task=m-iop-agent-cli-runtime/09+05_workflow_evidence plan=0 tag=REFACTOR -->

# Provider-neutral Workflow Evidence Gate

## For the Implementing Agent

`05_contract_boundary/complete.log`가 선행한다. 변경·검증 결과를 `CODE_REVIEW-cloud-G09.md`에 채우고 finalization은 하지 않는다.

## Background

`agenttask`는 generic `Submission`과 `Reviewer` port를 사용하지만, project artifact completeness/identity matcher와 Pi same-context evidence repair는 구현되어 있지 않다.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `workflow-evidence`: common artifact matcher, review gate, Pi evidence repair
- Completion mode: check-on-pass

## Analysis

### Files Read

- `packages/go/agenttask/workflow.go`
- `packages/go/agenttask/dispatch.go`
- `packages/go/agenttask/review.go`
- `packages/go/agenttask/review_test.go`
- `packages/go/agenttask/manager_integration_test.go`
- `agent-contract/inner/agent-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`

### SDD Criteria

S08/Evidence Map S08 requires provider-neutral completed/placeholder/identity-mismatch matching. Pi alone may repair worker-owned fields in the same valid native context, then must be matched again before official review.

### Test Environment Rules

local rules were read; `go test -count=1 ./packages/go/agenttask` baseline is PASS. New adapter/matcher tests must run without a live provider.

### Test Coverage Gaps

Existing review tests cover verdict transitions, not artifact parsing, placeholder detection, provider variance or repair locator identity.

### Split Judgment

This is an independent workflow-artifact boundary after contract `05`; it can PASS without config registry or isolation backend.

### Scope Rationale

Project filesystem parsing remains in a workflow adapter. The common package must not absorb agent-task archive finalization or write `USER_REVIEW.md`.

### Final Routing

`first-pass`; cloud G09 (artifact interpretation, review state and provider-specific recovery). risk: temporal-state, boundary-contract. official cloud G09 review.

## Implementation Checklist

- [ ] Define normalized artifact identity, completeness and repair intent port types.
- [ ] Implement provider-neutral matcher for active pair, placeholders and exact work/attempt identity.
- [ ] Permit Pi-only same-context repair with durable locator/ordinal and a mandatory rematch.
- [ ] Gate reviewer invocation on a matched submission and retain typed blocker evidence otherwise.
- [ ] Add matcher, repair and manager integration matrices.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REFACTOR-1] artifact gate와 Pi repair를 strict port로 추가한다

**Problem:** `dispatch.go` trusts `Submission.Ready`; it cannot prove project artifact state or constrain provider-specific repair.

**Solution:** add a workflow evidence port and normalized matcher result. `Manager` receives completed evidence only after identity/completeness validation; Pi repair carries original native locator and emits a fresh matcher result. Other providers never repair automatically.

**Test Strategy:** table-driven matcher fixtures cover complete, placeholder, wrong identity, stale locator and repair-after-rematch; manager test proves review invocation remains zero until valid evidence.

**Verification:** matcher and agenttask tests PASS with no provider executable.

## Modified Files Summary

| File | Item |
|---|---|
| `packages/go/agenttask/ports.go` | REFACTOR-1 |
| `packages/go/agenttask/dispatch.go` | REFACTOR-1 |
| `packages/go/agenttask/workflow_evidence.go` | REFACTOR-1 |
| `packages/go/agenttask/workflow_evidence_test.go` | REFACTOR-1 |
| `packages/go/agenttask/manager_integration_test.go` | REFACTOR-1 |

## Dependencies and Execution Order

`05_contract_boundary` PASS 후 시작한다.

## Final Verification

```bash
go test -count=1 ./packages/go/agenttask
rg --sort path -n 'USER_REVIEW|complete\.log' packages/go/agenttask
git diff --check
```

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
