<!-- task=m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture plan=4 tag=REVIEW_REVIEW_REVIEW_REVIEW_REFACTOR milestone-task=transfer -->

# Make every consumed schema leaf exact and key-driven

## For the Implementing Agent

Filling the implementation-owned sections in `CODE_REVIEW-cloud-G04.md` is mandatory. Reconfirm the encoded predecessor PASS, implement only this oracle follow-up, run every verification command exactly, paste actual output, keep the active pair in place, and report ready for review. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`; finalization belongs to the code-review skill.

## Background

The oracle now rejects the four previously observed array/cardinality mutations, but it still accepts added JSON Schema keywords below the checked property maps. Those ignored leaf constraints can make the canonical fixture invalid while the oracle reports `STATE_SCHEMA_CONTRACT_PASS`. The supported schema leaves must be exact, and resumability evaluation must use the key extracted from the validated conditional.

## Archive Evidence Snapshot

- The current failed pair will archive as `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/plan_cloud_G04_3.log` and `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/code_review_cloud_G04_3.log`; verdict: FAIL.
- Required finding: `scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq:18-31,37-46,52-64,75-78` does not enforce exact consumed leaf-schema keys and still reads `$record.resumable` directly instead of using an extracted conditional key.
- Fresh reviewer mutations added `if.properties.category.pattern`, `then.properties.resumable.not`, `else.properties.resumable.not`, or `record.properties.quarantine_reason.maxLength`; all four exited 0 with `STATE_SCHEMA_CONTRACT_PASS`. The predecessor check, JSON parsing, canonical oracle, four prior semantic mutations, provenance, sensitive-text scan, and `git diff --check` passed.
- Roadmap carryover remains `milestone-task=transfer`, SDD scenario S02, with no roadmap mutation or completion claim in this follow-up.

## Analysis

### Files Read

- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq`
- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json`
- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.json`
- `scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv`
- `cmd/iop-chronos-transfer/main.go`
- `cmd/iop-chronos-transfer/main_test.go`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/PLAN-cloud-G04.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/CODE_REVIEW-cloud-G04.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/IMPLEMENTATION_SUMMARY.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/plan_cloud_G04_2.log`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/code_review_cloud_G04_2.log`
- `agent-task/archive/2026/08/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log`
- `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`
- `agent-spec/runtime/iop-agent-cli-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`

### SDD Criteria

- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md` is `[approved]`, its lock is released, and no active SDD `USER_REVIEW.md` remains. The unchanged first-line scope is `milestone-task=transfer`.
- Acceptance Scenario S02 and its Evidence Map require a trustworthy full-state transfer fixture before isolated bundle verification. The checklist therefore preserves the canonical schema/fixture while making every accepted leaf shape explicit and making record evaluation consume the validated clause key.

### Verification Context

- No external verification handoff was supplied or required. Repository-native evidence came from the tracked schema, fixture, jq oracle, exporter validation, focused quarantine regression, exact predecessor completion, and fresh reviewer mutations.
- Local preflight is Go `go1.26.2 linux/arm64`, module `/config/workspace/iop-s1/go.mod`, with `/bin/jq` available. No service, credential, provider, external host, or `iop-agent` execution is required.
- All seven current plan commands passed. A focused leaf-keyword table then added `pattern`, `not`, or `maxLength` constraints below already checked parent maps; all four mutated schemas exited 0 and printed `STATE_SCHEMA_CONTRACT_PASS`.
- Preconditions: index 03 resolves to the one archived PASS at `agent-task/archive/2026/08/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log`.
- Constraints: do not change the canonical schema, fixture, ownership manifest, exporter, roadmap, contract, or spec. Confidence is high because the false positives are deterministic and isolated to leaf-shape validation and record-key access in the jq oracle.

### Test Coverage Gaps

- Existing tracked mutations cover removed/inverted headline clauses, extra required-array members, and additional `allOf` entries.
- They do not cover extra keywords on the conditional category/resumability leaves or on the required reason leaf. Add the complete four-case reviewer reproduction to the same tracked jq regression.
- The canonical oracle exercises resumability values but cannot prove clause-driven key access by itself; retain exact leaf validation and add a deterministic source assertion that the extracted `resumable_key` is present and direct `$record.resumable` access is absent.

### Symbol References

- None. No Go or JSON symbol is renamed or removed.

### Split Judgment

- Keep one compact follow-up. Exact consumed-leaf validation, dynamic resumability-key access, and the matching mutation regression form one fail-closed verifier invariant and cannot independently PASS.
- Encoded predecessor index `03` is satisfied by `agent-task/archive/2026/08/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log`.

### Scope Rationale

- Exclude `scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json`: its canonical leaf shapes are correct; only the oracle accepts unsupported additions.
- Exclude the canonical fixture, ownership manifest, and `cmd/iop-chronos-transfer/**`: current data and production validation pass, and changing them would expand beyond the Required finding.
- Exclude roadmap/spec/contract updates: this is a regression-oracle repair for existing S02 evidence. Spec update not needed.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer=`finalize-task-policy.sh`, mode=`pair`.
- Build closures are all true. Scores are `scope=1,state=0,blast=1,evidence=1,verification=1`, grade `G04`, base `local-fit`, final route `recovery-boundary`, lane `cloud`.
- Review closures are all true. Scores are `scope=1,state=0,blast=1,evidence=1,verification=1`, route `official-review`, lane `cloud`, grade `G04`.
- `large_indivisible_context=false`; positive loop risks are `boundary_contract` and `structured_interpretation` (2); `review_rework_count=4`; `evidence_integrity_failure=false`; no capability gap.
- Canonical files: `PLAN-cloud-G04.md`, `CODE_REVIEW-cloud-G04.md`.

## Dependencies and Execution Order

1. Reconfirm the exact PASS in `agent-task/archive/2026/08/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log`.
2. Make exact leaf validation, key extraction, and leaf-mutation rejection one change, then run canonical and mutation verification.

## Implementation Checklist

- [ ] Reconfirm that predecessor index 03 resolves to exactly one PASS `complete.log` before changing the oracle.
- [ ] Require exact supported key sets for the consumed mode, reason, conditional category, and conditional resumability leaf schemas.
- [ ] Extract one validated resumability key from the matching `then`/`else` property clauses and use it for dynamic record access instead of `$record.resumable`.
- [ ] Retain the canonical case and all existing record/schema mutations, add the four observed leaf-keyword mutations, and make every invalid external schema exit nonzero.
- [ ] Re-run parsing, canonical oracle, clause-key access, exact manifest/addendum provenance, sensitive-text, focused leaf-mutation, and diff checks without changing the canonical schema, fixture, or manifest.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_REVIEW_REVIEW_REVIEW_REFACTOR-1] Make consumed schema leaves exact and key-driven

**Problem**

`scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq:18-31` checks the keys of parent conditional objects and property maps but not the keys of the consumed leaf schemas. Lines 37-46 omit a resumability key, and lines 57-63 access `.resumable` directly. Added leaf constraints can therefore change JSON Schema admission without changing the oracle result.

```jq
# before: scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq:18-31,43-44,57-63
and ($cond.if.properties | keys) == ["category"]
and ($cond.if.properties.category.const == "quarantine")
and ($cond.then.properties | keys) == ["resumable"]
and ($cond.else.properties | keys) == ["resumable"]

quarantine_resumable: $cond.then.properties.resumable.const,
non_quarantine_resumable: $cond.else.properties.resumable.const,

($record.resumable == $contract.quarantine_resumable)
```

**Solution**

Require the exact canonical keys on every consumed leaf schema, bind the single common resumability property key from the validated `then` and `else` maps, and use dynamic record access. Keep the known array/cardinality mutations and add all four leaf-keyword regressions so unsupported additions fail closed.

```jq
# after
($cond.then.properties | keys) as $then_keys
| ($cond.else.properties | keys) as $else_keys
| ($then_keys == ["resumable"])
and ($else_keys == $then_keys)
and (($cond.if.properties.category | keys) == ["const"])
and (($cond.then.properties[$then_keys[0]] | keys) == ["const"])
and (($cond.else.properties[$else_keys[0]] | keys) == ["const"])

resumable_key: $then_keys[0]

($record[$contract.resumable_key] == $contract.quarantine_resumable)
```

**Modified Files and Checklist**

- [ ] `scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq` — enforce exact consumed leaf shapes, extract the resumability key, and cover all observed leaf-keyword mutations.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/CODE_REVIEW-cloud-G04.md` — record implementation notes and actual command output.

**Test Strategy**

- Update the existing tracked jq regression rather than adding a second harness. Preserve every canonical, record-mutation, and schema-mutation case, and add four cases for a category `pattern`, `then` resumability `not`, `else` resumability `not`, and reason `maxLength`.
- The final shell probe independently applies the same four schema mutations and requires a nonzero oracle result for each. A deterministic source assertion verifies clause-driven resumability access without relying on reviewer interpretation.

**Verification**

- `jq -nr --slurpfile schema scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json --slurpfile fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json -f scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq` — prints exactly `STATE_SCHEMA_CONTRACT_PASS` and exits 0.
- `bash -lc 'set -euo pipefail; probe_dir=$(mktemp -d); trap '\''rm -rf -- "$probe_dir"'\'' EXIT; mutations=('\''."$defs".record.allOf[0].if.properties.category.pattern = "^never$"'\'' '\''."$defs".record.allOf[0].then.properties.resumable.not = {}'\'' '\''."$defs".record.allOf[0].else.properties.resumable.not = {}'\'' '\''."$defs".record.properties.quarantine_reason.maxLength = 0'\''); for i in "${!mutations[@]}"; do jq "${mutations[$i]}" scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json >"$probe_dir/schema-$i.json"; set +e; output=$(jq -nr --slurpfile schema "$probe_dir/schema-$i.json" --slurpfile fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json -f scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq 2>&1); rc=$?; set -e; test "$rc" -ne 0; test "$output" != "STATE_SCHEMA_CONTRACT_PASS"; done; printf "SCHEMA_LEAF_MUTATIONS_REJECTED\n"'` — prints exactly `SCHEMA_LEAF_MUTATIONS_REJECTED` and exits 0.
- `bash -lc 'set -euo pipefail; rg -q --fixed-strings "resumable_key:" scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq; ! rg -q --fixed-strings '\''$record.resumable'\'' scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq; printf "CLAUSE_KEY_ACCESS_PASS\n"'` — prints exactly `CLAUSE_KEY_ACCESS_PASS` and exits 0.

## Modified Files Summary

| File | Item |
|------|------|
| `scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq` | REVIEW_REVIEW_REVIEW_REVIEW_REFACTOR-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/05+03_state_fixture/CODE_REVIEW-cloud-G04.md` | REVIEW_REVIEW_REVIEW_REVIEW_REFACTOR-1 |

## Final Verification

1. `bash -lc 'set -euo pipefail; mapfile -t predecessor_logs < <({ test ! -f agent-task/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log || printf "%s\n" agent-task/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log; find agent-task/archive -path "*/m-iop-agent-chronos-extraction-decoupling/03+02_inventory_closure/complete.log" -type f -print 2>/dev/null; } | sort -u); test "${#predecessor_logs[@]}" -eq 1; awk "BEGIN {in_summary=0; found=0} /^## Summary$/ {in_summary=1; next} in_summary && /^## / {in_summary=0} in_summary && /final verdict: PASS/ {found++} END {exit found==1?0:1}" "${predecessor_logs[0]}"; printf "%s\n" "${predecessor_logs[0]}"'` — exactly one predecessor PASS.
2. `jq -e . scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json scripts/fixtures/iop-agent-chronos-transfer-state-v1.json >/dev/null && printf 'JSON_PARSE_PASS\n'` — both JSON documents parse.
3. `jq -nr --slurpfile schema scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json --slurpfile fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json -f scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq` — prints exactly `STATE_SCHEMA_CONTRACT_PASS` and exits 0.
4. `bash -lc 'set -euo pipefail; probe_dir=$(mktemp -d); trap '\''rm -rf -- "$probe_dir"'\'' EXIT; mutations=('\''."$defs".record.allOf[0].if.properties.category.pattern = "^never$"'\'' '\''."$defs".record.allOf[0].then.properties.resumable.not = {}'\'' '\''."$defs".record.allOf[0].else.properties.resumable.not = {}'\'' '\''."$defs".record.properties.quarantine_reason.maxLength = 0'\''); for i in "${!mutations[@]}"; do jq "${mutations[$i]}" scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json >"$probe_dir/schema-$i.json"; set +e; output=$(jq -nr --slurpfile schema "$probe_dir/schema-$i.json" --slurpfile fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json -f scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq 2>&1); rc=$?; set -e; test "$rc" -ne 0; test "$output" != "STATE_SCHEMA_CONTRACT_PASS"; done; printf "SCHEMA_LEAF_MUTATIONS_REJECTED\n"'` — all four leaf-keyword mutations are rejected.
5. `bash -lc 'set -euo pipefail; rg -q --fixed-strings "resumable_key:" scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq; ! rg -q --fixed-strings '\''$record.resumable'\'' scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq; printf "CLAUSE_KEY_ACCESS_PASS\n"'` — clause-driven resumability access is present and direct field access is absent.
6. `bash -lc 'set -euo pipefail; manifest_ids=$(mktemp); fixture_ids=$(mktemp); trap '\''rm -f -- "$manifest_ids" "$fixture_ids"'\'' EXIT; awk -F "\t" '\''NR>1 && $2=="state" {print $1}'\'' scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv | LC_ALL=C sort >"$manifest_ids"; jq -r '\''.records[] | select(.source_manifest=="original") | .logical_id'\'' scripts/fixtures/iop-agent-chronos-transfer-state-v1.json | LC_ALL=C sort >"$fixture_ids"; test "$(wc -l <"$manifest_ids")" -eq 10; cmp "$manifest_ids" "$fixture_ids"; test "$(jq -r '\''[.records[] | select(.source_manifest=="d04-addendum") | .logical_id] | sort | join(",")'\'' scripts/fixtures/iop-agent-chronos-transfer-state-v1.json)" = "state:cache-root,state:temp-root"; printf "STATE_ID_PROVENANCE_PASS\n"'` — original and addendum IDs remain exact.
7. `bash -lc 'set -euo pipefail; set +e; rg -n '\''/home/|/Users/|token|credential|secret|private_key'\'' scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json scripts/fixtures/iop-agent-chronos-transfer-state-v1.json scripts/fixtures/iop-agent-chronos-transfer-state-v1.contract-test.jq; scan_rc=$?; set -e; case "$scan_rc" in 0) exit 1;; 1) :;; *) exit "$scan_rc";; esac; printf "SENSITIVE_SCAN_PASS\n"'` — no host path or sensitive pattern appears and scanner errors fail closed.
8. `git diff --check` — exits 0 with no output.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
