<!-- task=m-iop-hot-path-one-shot-execution/05+02,04_request_coordinator plan=3 tag=REVIEW_API milestone-task=request-identity -->

# Make Logical Request Lineage Frontier-Aware

## For the Implementing Agent

Implement the two review fixes, run every command, and fill the implementation-owned sections in `CODE_REVIEW-cloud-G05.md` with actual notes and output. Keep the active files in place and report ready for review; finalization is code-review-skill only. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The lossless raw JSON change preserves large numbers and structured values, but both lineage builders still hash the entire current `messages` array. A normal Chat or Anthropic continuation appends the issued assistant tool call and its result frontier, so its history digest differs from the admission digest and the coordinator rejects the first valid continuation. The lineage boundary must distinguish the committed prefix, repeated issued-call evidence, and current result frontier, then advance committed state only after successful consumption.

## Archive Evidence Snapshot

- Closing pair: `agent-task/m-iop-hot-path-one-shot-execution/05+02,04_request_coordinator/plan_cloud_G08_2.log` and `agent-task/m-iop-hot-path-one-shot-execution/05+02,04_request_coordinator/code_review_cloud_G08_2.log`; verdict `FAIL`.
- Required finding: preserve lossless canonical values while splitting endpoint-native Chat and Anthropic continuations into committed history, repeated issued-call evidence, and the current result frontier; advance the committed lineage only after successful exactly-once consumption.
- Fresh evidence: all planned focused/race/vet/format/diff commands passed, but a reviewer-only Chat/Anthropic table test showed that appending a normal assistant tool call and result changed `HistoryDigest` for both endpoints. The temporary reproducer was removed after capture.
- Dependencies: `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log` and `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log` are the exact completed predecessors.
- Roadmap carryover: `milestone-task=request-identity`; SDD scenario S05 and its Evidence Map remain the acceptance source.

## Dependencies and Execution Order

- `02+01_preset_generation` is satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log`.
- `04+02,03_preset_model_authorization` is satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log`.

## Analysis

### Files Read

- `apps/edge/internal/openai/request_lineage.go`
- `apps/edge/internal/openai/request_coordinator.go`
- `apps/edge/internal/openai/request_coordinator_test.go`
- `apps/edge/internal/openai/server.go`
- `apps/edge/internal/openai/chat_types.go`
- `apps/edge/internal/openai/anthropic_types.go`
- `agent-task/m-iop-hot-path-one-shot-execution/05+02,04_request_coordinator/PLAN-cloud-G08.md`
- `agent-task/m-iop-hot-path-one-shot-execution/05+02,04_request_coordinator/CODE_REVIEW-cloud-G08.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/PHASE.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-hot-path-one-shot-execution.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-contract/outer/openai-compatible-api.md`
- `agent-contract/outer/anthropic-compatible-api.md`
- `agent-test/local/rules.md`
- `agent-test/local/edge-smoke.md`

### SDD Criteria

- SDD: `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`; status `[승인됨]`, lock released.
- Milestone metadata: `milestone-task=request-identity`; Acceptance Scenario S05.
- Evidence Map S05 requires full-history/frontier evidence, lineage and tool-schema mutation rejection, bijective public/provider tool-ID mapping, cross-principal/missing-state rejection, and concurrency race safety.
- The implementation checklist therefore requires endpoint-native initial-to-continuation fixtures, explicit current-frontier separation, repeated issued-call validation, atomic committed-lineage advancement, and focused plus race verification.

### Verification Context

- No external environment handoff was supplied. Repository-native sources were `agent-test/local/rules.md`, `agent-test/local/edge-smoke.md`, the active plan/review pair, SDD S05, the coordinator source/tests, and fresh reviewer commands.
- Local preflight: `/config/.local/bin/go` resolves through the configured PATH; `go version go1.26.2 linux/arm64`; `GOROOT=/config/opt/go`; module directive is Go 1.24.
- Fresh planned verification passed: focused lineage tests, focused coordinator race tests, common race packages, vet, formatting, and `git diff --check`.
- Fresh reviewer evidence failed for both endpoint variants: the initial request and a full endpoint-native first continuation produced different history digests solely because the current issued-call/result frontier was included. The temporary test file was removed and `git diff --check` passed afterward.
- Required execution stays in the current checkout. Endpoint handler integration, a live provider, credentials, smoke helpers, and full-cycle execution are excluded because this task owns the unintegrated coordinator/lineage boundary only.
- The worktree contains intentional sibling execution-preset changes. Verification must preserve them and use fresh `-count=1` tests; cached success is not accepted.
- Confidence: high. The defect has a deterministic two-endpoint reproducer and the required behavior has direct unit and race oracles.

### Test Coverage Gaps

- `TestLogicalRequestLineageMutationMatrix` proves lossless numeric/structured mutation and canonical equivalence, but it treats each complete `messages` value as one history and never constructs an initial request followed by a full endpoint-native continuation.
- `TestLogicalRequestContinuationMatrix` supplies the admission lineage unchanged by hand, so it does not prove that a real Chat or Anthropic continuation can derive the matching committed prefix while separating the new result frontier.
- Existing tests do not prove that a rejected repeated issued-call/result frontier leaves the stored committed lineage unchanged or that a successful consume advances it for the next frontier.

### Symbol References

- `newChatRequestLineage` and `newAnthropicRequestLineage` are referenced only in `request_coordinator_test.go`; no production handler calls them yet.
- `consumeContinuation`, `awaitToolResults`, and the lineage fields are internal to `request_coordinator.go` and `request_coordinator_test.go`.
- `Server.logicalRequests()` remains the only production ownership accessor; handler integration remains deferred. Any internal signature changes are confined to these source/tests.

### Split Judgment

Keep one plan. Endpoint-native frontier parsing and atomic coordinator lineage advancement are one continuation-fence invariant: either half can pass locally while valid continuations still fail or mutated repeated history is admitted.

### Scope Rationale

Change only the lineage helper, coordinator state transition, and their tests. Do not integrate Chat/Anthropic handlers, add stage execution or artifact semantics, change external API/config contracts, alter `Server` ownership, or touch sibling execution-preset work.

### Final Routing

- `evaluation_mode=isolated-reassessment`; `finalizer=finalize-task-policy.sh`, pair mode.
- Build closures are all true. Scores `(1,2,0,1,1)` produce G05 with local-fit base. `large_indivisible_context=false`; matched risks are `temporal_state`, `concurrent_consistency`, `boundary_contract`, `structured_interpretation`, and `variant_product` (5). `review_rework_count=2` and `evidence_integrity_failure=true` select `recovery-boundary`; build route is cloud `PLAN-cloud-G05.md`.
- Review closures are all true. Scores `(1,2,0,1,1)` produce official cloud G05 in `CODE_REVIEW-cloud-G05.md` using Codex `gpt-5.6-sol` xhigh.
- Capability gap: none. No external decision or authorization remains.

## Implementation Checklist

- [ ] Split Chat and Anthropic endpoint-native histories into committed prefix, repeated issued-call evidence, and current result frontier without losing canonical JSON fidelity, and add full initial-to-continuation and mutation regression coverage.
- [ ] Validate expected issued-call/frontier evidence and atomically advance committed lineage only after successful exactly-once consumption, with no state mutation on rejection and race coverage.
- [ ] Run archived dependency, focused, race, vet, formatting, and diff verification exactly as written.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_API-1] Split Endpoint-Native Continuation Lineage

#### Problem

`request_lineage.go:30-55` canonicalizes raw JSON losslessly but hashes the full Chat or Anthropic `messages` field. The builder has no representation for the committed prefix, repeated issued assistant call, or current tool-result frontier, so a normal first continuation cannot reproduce the admission lineage and the mutation test cannot distinguish committed history from the newly arriving frontier.

#### Solution

Add endpoint-aware raw continuation parsing that keeps `UseNumber` canonicalization while identifying the trailing endpoint-native tool-result frontier and its immediately preceding issued assistant tool call. Return separate canonical evidence for the committed prefix, repeated issued call, current result IDs, and post-consume committed lineage; reject malformed, partial, duplicate, unknown-role, or non-trailing frontier shapes before coordinator mutation.

```go
// Before: request_lineage.go:30
func newChatRequestLineage(raw json.RawMessage) (logicalRequestLineage, error) {
    return newLogicalRequestLineageFromRaw(raw, logicalRequestEndpointChat, []string{"model", "messages"})
}

// After: expose the immutable comparison and the candidate committed advance.
type logicalRequestContinuationLineage struct {
    Prefix         logicalRequestLineage
    IssuedCallHash string
    ResultIDs      []string
    Committed      logicalRequestLineage
}

func newChatContinuationLineage(raw json.RawMessage) (logicalRequestContinuationLineage, error) {
    // Canonically split the trailing assistant tool-call/result frontier.
}
```

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/request_lineage.go` — add lossless Chat/Anthropic continuation-frontier extraction and canonical evidence.
- [ ] `apps/edge/internal/openai/request_coordinator_test.go` — add table-driven initial/full-continuation equivalence, issued-call mutation, result mutation, partial/duplicate frontier, and large-number fixtures.

#### Test Strategy

Add `TestLogicalRequestEndpointContinuationLineage` with Chat and Anthropic fixtures. Assert that the same initial committed prefix survives a full first continuation, the current result frontier is returned separately, the post-consume committed digest includes the accepted transcript, and mutations to prior committed history, issued tool call, tool schema, IDs, or endpoint are rejected. Preserve the adjacent-large-integer regression.

#### Verification

Run `go test -count=1 ./apps/edge/internal/openai -run 'TestLogicalRequest(Lineage|EndpointContinuation)'`; expect PASS.

### [REVIEW_API-2] Advance Committed Lineage Atomically

#### Problem

`request_coordinator.go:291-303` compares continuation lineage to one fixed admission value, consumes only public result IDs, and never advances `record.lineage`. Even with a frontier-aware parser, the coordinator cannot validate repeated issued-call evidence or make the next frontier relative to the transcript accepted by the previous consume.

#### Solution

Store the expected canonical issued-call evidence with the active frontier. On consume, validate owner, principal, committed prefix, toolset, issued-call evidence, and exact public result set under the same lock; only then clear the frontier and replace the record lineage with the candidate committed lineage. Every rejection must leave the expected frontier, active stage, mappings, and committed lineage unchanged.

```go
// Before: request_coordinator.go:291
if record.lineage != continuation.Lineage {
    return logicalRequestSnapshot{}, errLogicalRequestLineage
}
// ...
record.expected = nil

// After: validate the frontier fence, then advance in one locked commit.
if record.lineage != continuation.Lineage.Prefix ||
    record.expectedIssuedCallHash != continuation.Lineage.IssuedCallHash {
    return logicalRequestSnapshot{}, errLogicalRequestLineage
}
if !sameLogicalRequestResultSet(record.expected, continuation.Results) {
    return logicalRequestSnapshot{}, errLogicalRequestFrontier
}
record.lineage = continuation.Lineage.Committed
record.expected = nil
```

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/request_coordinator.go` — retain the expected issued-call fence and atomically advance committed lineage on successful consumption.
- [ ] `apps/edge/internal/openai/request_coordinator_test.go` — cover first and second frontier advancement, rejected mutation/no-state-change, duplicate consumption, and concurrent exactly-once behavior for the new lineage contract.

#### Test Strategy

Extend `TestLogicalRequestContinuationMatrix` and add `TestLogicalRequestCommittedLineageAdvance`. Exercise two sequential endpoint-native frontiers, mutate each known variant before the valid consume, assert the snapshot and committed lineage remain unchanged on every rejection, then race the valid continuation and require exactly one advance.

#### Verification

Run `go test -race -count=1 ./apps/edge/internal/openai -run 'TestLogicalRequest(Continuation|CommittedLineage|ConcurrentFrontier)'`; expect PASS with exactly one concurrent lineage advance.

## Modified Files Summary

| File | Items |
|------|-------|
| `apps/edge/internal/openai/request_lineage.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/request_coordinator.go` | REVIEW_API-2 |
| `apps/edge/internal/openai/request_coordinator_test.go` | REVIEW_API-1, REVIEW_API-2 |
| `agent-task/m-iop-hot-path-one-shot-execution/05+02,04_request_coordinator/CODE_REVIEW-cloud-G05.md` | REVIEW_API-1, REVIEW_API-2 |

## Final Verification

```bash
test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log
test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log
go test -count=1 ./apps/edge/internal/openai -run 'TestLogicalRequest(Lineage|EndpointContinuation)'
go test -race -count=1 ./apps/edge/internal/openai -run 'TestLogicalRequest(Continuation|CommittedLineage|ConcurrentFrontier)'
go test -race -count=1 ./packages/go/streamgate ./apps/edge/internal/openai ./apps/edge/internal/service
go vet ./apps/edge/internal/openai
gofmt -d apps/edge/internal/openai/request_coordinator.go apps/edge/internal/openai/request_lineage.go apps/edge/internal/openai/request_coordinator_test.go
git diff --check
```

Expected: every command exits 0; both endpoints split the current frontier from the committed transcript without losing canonical fidelity, mutations and malformed frontiers fail without state change, successful consumption advances committed lineage, and exactly one concurrent continuation advances each frontier. Fresh `-count=1` output is required; live provider, repository smoke, and full-cycle execution remain out of scope until handler integration.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
