<!-- task=m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding plan=4 tag=REVIEW_REVIEW_REVIEW_API milestone-task=artifact-pair -->

# Finish Native Decoder Admission and Parent-Capable Workspace Safety

## For the Implementing Agent

Implement every checklist item, run every verification command, and fill the implementation-owned sections of `CODE_REVIEW-cloud-G07.md` with actual notes and verbatim output. Keep the active PLAN and CODE_REVIEW files in place and report ready for review; finalization is code-review-skill-only. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The receipt and integrated-test repairs pass, but the compiler still cannot accept the native Messages decoder slice directly. The caller-executed guard also defeats a configured parent-capable write by requiring the fresh request directory to exist, while command write templates may omit the mapped content. This follow-up closes those remaining S06 admission and payload-safety gaps without integrating the binding into the later artifact-pair coordinator.

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/plan_cloud_G07_3.log`.
- Prior review: `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/code_review_cloud_G07_3.log`.
- Verdict: FAIL with 3 Required, 0 Suggested, and 0 Nit findings; `review_rework_count=3`, `evidence_integrity_failure=false`.
- Required scope: accept the actual `[]anthropicTool` decoder slice without manual `[]any` wrapping; reject command write templates that omit canonical content; and make containment guards honor parent-capable prepare/write operations while still rejecting existing symlink escapes.
- Affected files: `apps/edge/internal/openai/workspace_tool_binding.go`, `apps/edge/internal/openai/workspace_tool_codec.go`, and `apps/edge/internal/openai/workspace_tool_binding_test.go`.
- Fresh evidence: every planned dependency, focused, race, Edge-wide, vet, formatting, and diff command passes; a reviewer probe against an empty temporary workspace fails the generated parent-capable guard at the absent immediate parent, and static typing proves `[]anthropicTool` cannot be passed to the current `[]any` compiler parameter.
- Roadmap carryover: Milestone task `artifact-pair` and approved SDD scenario S06 remain unsatisfied for native endpoint admission, parent-capable write behavior, and complete command payload mapping.

## Dependencies and Execution Order

- Predecessor 02 remains satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log`.
- Predecessor 04 remains satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log`.
- Predecessor 06 remains satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/06+04,05_request_identity_ingress/complete.log`.
- Complete REVIEW_REVIEW_REVIEW_API-1 before REVIEW_REVIEW_REVIEW_API-2 so guard payloads are sealed only after the selected operation contract is complete.

## Analysis

### Files Read

- `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/PLAN-cloud-G07.md`
- `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/CODE_REVIEW-cloud-G07.md`
- `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/plan_cloud_G07_2.log`
- `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/code_review_cloud_G07_2.log`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-hot-path-one-shot-execution.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-contract/outer/openai-compatible-api.md`
- `agent-contract/outer/anthropic-compatible-api.md`
- `agent-test/local/rules.md`
- `agent-test/local/edge-smoke.md`
- `apps/edge/internal/openai/anthropic_types.go`
- `apps/edge/internal/openai/hot_path_selector.go`
- `packages/go/config/execution_preset_types.go`
- `apps/edge/internal/openai/workspace_tool_binding.go`
- `apps/edge/internal/openai/workspace_tool_codec.go`
- `apps/edge/internal/openai/workspace_tool_binding_test.go`

### SDD Criteria

- SDD: `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`; status approved and implementation lock released.
- Milestone task id: `artifact-pair`.
- Target acceptance scenario: S06.
- S06 requires the actual endpoint tool representation, either parent-capable write or separate prepare behavior, exact canonical payload mapping, containment, and deterministic result correlation before local-stage admission.
- The checklist therefore pairs native slice admission and complete command content mapping with capability-aware containment plus hermetic regressions and fresh integrated verification.

### Verification Context

- No external handoff was supplied. Repository-native evidence came from the active pair, exact prior logs, approved SDD, endpoint contracts, decoder/config types, the compiler/codec/tests, and `agent-test/local/edge-smoke.md`.
- Current host: `/config/workspace/iop-s0`, Go `go1.26.2 linux/arm64`; no credential, provider, remote runner, or caller workspace tool execution is required.
- Passing evidence: exact predecessor probes, focused workspace tests, race, executable-`TMPDIR` all-Edge, vet, formatting, and diff checks all exit zero on the current shared checkout.
- Failing evidence: the exact generated guard exits 1 for `.iop/job/request-1/plan.md` in an empty temporary workspace because the immediate parent is absent; the actual decoder owns `Tools []anthropicTool`, which is not assignable to the compiler's `[]any` parameter.
- Constraints: tests must remain hermetic, may evaluate the guard only against `t.TempDir()` fixtures, and must not execute a caller workspace tool. Cached output is not acceptable for planned Go verification.
- Confidence: high; the two runtime-boundary defects and the command payload omission are directly visible and have deterministic regression shapes.

### Test Coverage Gaps

- Native Messages admission: the existing test wraps one `anthropicTool` in `[]any`; no test passes the actual `[]anthropicTool` field shape.
- Command write completeness: no case rejects an argv template lacking `{content}`.
- Parent-capable guard: existing tests check substrings only; no case proves a fresh nested parent is admitted or an existing escaping symlink is rejected.
- Receipt error normalization, issued digest mutation, all four operations, ordered alternatives, and integrated Edge gates are already covered and passing.

### Symbol References

- No public symbol is renamed or removed.
- `compileWorkspaceBinding`, `encodeWorkspaceCall`, and `matchResultReceipt` remain private to the workspace binding source/tests in this child; later artifact-pair integration owns their production call sites.

### Split Judgment

Native tool admission, canonical command content, containment guard generation, and the sealed payload digest are one workspace-operation admission invariant. Splitting them would allow a compiler or codec child to pass while issuing an unusable or incomplete payload, so the compact repair remains one dependent subtask.

### Scope Rationale

Exclude artifact-pair coordinator integration, endpoint dispatch/state transitions, real caller tool execution, arbitrary workspace inspection, contracts/config schema changes, sibling Hot Path handlers, and roadmap edits. This child changes only the isolated compiler, codec, and their hermetic regression suite.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer `finalize-task-policy.sh` in pair mode.
- Build closures for scope, context, verification, evidence, ownership, and decision are true. Scores `(2,0,2,2,1)` produce G07 with base `local-fit`; `review_rework_count=3` and `evidence_integrity_failure=false` select `recovery-boundary`, yielding `PLAN-cloud-G07.md`.
- Review closures are true. Scores `(2,0,2,2,1)` produce official cloud G07 `CODE_REVIEW-cloud-G07.md` with adapter `codex`, model `gpt-5.6-sol`, and reasoning effort `xhigh`.
- `large_indivisible_context=false`; positive loop-risk signatures are `boundary_contract`, `structured_interpretation`, and `variant_product` (3); risk boundary is not matched and recovery boundary is matched.
- Capability gap: none. The local Go and POSIX shell toolchain can implement and verify the owned fixes without external authority.

## Implementation Checklist

- [ ] Accept actual endpoint-owned tool slices and reject command mappings that omit or ambiguously encode the canonical write content.
- [ ] Make containment guards capability-aware, add fresh-parent and symlink-escape regressions, and obtain clean dependency, focused, race, all-Edge, vet, formatting, and diff evidence.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_REVIEW_REVIEW_API-1] Accept Native Tool Slices and Complete Command Payloads

#### Problem

`apps/edge/internal/openai/workspace_tool_binding.go:101` accepts only `[]any`, so the actual `anthropicRequest.Tools []anthropicTool` decoder field cannot be passed without a manual copy. `apps/edge/internal/openai/workspace_tool_binding.go:348-351` requires only `{path}` in command templates, allowing a write mapping to read canonical content and then omit it from the emitted command.

#### Solution

Accept the endpoint-owned slice as an explicit closed type set and normalize `[]any` plus `[]anthropicTool` without reflection-based role inference. Validate command placeholders at compilation: every placeholder token must be supported, every command requires `{path}`, and write commands require exactly usable `{content}` encoding.

Before (`workspace_tool_binding.go:101`, `workspace_tool_binding.go:348-351`):

```go
func compileWorkspaceBinding(alternatives []config.ExecutionWorkspaceToolAlternative, tools []any) (*workspaceBinding, error) {
// ...
if !argvContainsPlaceholder(argv, "{path}") {
	return fmt.Errorf("command argv template must reference the {path} placeholder")
}
```

After:

```go
func compileWorkspaceBinding(alternatives []config.ExecutionWorkspaceToolAlternative, tools any) (*workspaceBinding, error) {
	// Normalize only []any and []anthropicTool through explicit type cases.
}
// Reject unknown/embedded placeholder forms and require {content} for write.
```

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/workspace_tool_binding.go` — explicit endpoint slice normalization and complete command placeholder validation.
- [ ] `apps/edge/internal/openai/workspace_tool_binding_test.go` — direct `[]anthropicTool` equivalence/operation cases and missing-content/unsupported-placeholder rejection.

#### Test Strategy

Extend `TestWorkspaceToolBindingContract` and `TestWorkspaceOperationMatrix` with an actual `[]anthropicTool` value passed directly to the compiler. Add command alternatives whose write argv omits `{content}` or embeds an unsupported placeholder and assert compile rejection; retain a valid path/content command round trip.

#### Verification

Run `go test -count=1 ./apps/edge/internal/openai -run 'TestWorkspace(Tool|Command|Binding|Operation)'`; expect all endpoint slice, operation, command, and receipt cases to pass without caller tool execution.

### [REVIEW_REVIEW_REVIEW_API-2] Honor Parent-Capable Containment and Close Evidence

#### Problem

`apps/edge/internal/openai/workspace_tool_codec.go:313-326` uses the same guard for every operation and calls `realpath -e` on an absent target's immediate parent. A creates-parent write or prepare for a fresh `.iop/job/<request_id>/` hierarchy therefore fails before execution, contradicting the selected capability and S06.

#### Solution

Pass the compiled operation's `createsParents` capability into guard synthesis. Resolve an existing target directly; for parent-capable absent targets, walk to the nearest existing ancestor, canonicalize and fence that ancestor, and preserve the validated lexical suffix; for non-parent-capable operations, continue requiring the immediate parent. Reject an existing final or ancestor symlink that canonicalizes outside the workspace, and keep every guard-affecting value inside the issued correlation digest.

Before (`workspace_tool_codec.go:139`, `workspace_tool_codec.go:321-326`):

```go
payload.containmentGuard = synthesizeContainmentGuard(safePath)
// ...
IOP_WS_PARENT=$(realpath -e -- "$(dirname -- "$IOP_WS_CANDIDATE")") || exit 1
```

After:

```go
payload.containmentGuard = synthesizeContainmentGuard(safePath, ob.createsParents)
// Existing targets resolve directly; parent-capable targets fence the nearest
// existing ancestor before retaining the validated nonexistent suffix.
```

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/workspace_tool_codec.go` — capability-aware nearest-existing-ancestor guard with existing symlink fencing and sealed output.
- [ ] `apps/edge/internal/openai/workspace_tool_binding_test.go` — hermetic guard evaluation in `t.TempDir()` for fresh nested parents, immediate-parent requirements, and final/ancestor symlink escape; no caller tool execution.
- [ ] `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/CODE_REVIEW-cloud-G07.md` — actual implementation decisions and verbatim final command output only.

#### Test Strategy

Add `TestWorkspaceContainmentGuard` using temporary directories only. Evaluate the generated guard without invoking the mapped caller command: a parent-capable fresh nested target must pass, a non-parent-capable target with a missing immediate parent must fail, and an existing final or ancestor symlink outside the temporary workspace must fail. Keep payload-digest mutation coverage to prove a changed capability-derived guard cannot match a receipt.

#### Verification

Run the focused suite and every Final Verification command on the same checkout. All commands must exit zero and formatting output must remain empty.

## Modified Files Summary

| File | Items |
|------|-------|
| `apps/edge/internal/openai/workspace_tool_binding.go` | REVIEW_REVIEW_REVIEW_API-1 |
| `apps/edge/internal/openai/workspace_tool_codec.go` | REVIEW_REVIEW_REVIEW_API-2 |
| `apps/edge/internal/openai/workspace_tool_binding_test.go` | REVIEW_REVIEW_REVIEW_API-1, REVIEW_REVIEW_REVIEW_API-2 |
| `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/CODE_REVIEW-cloud-G07.md` | REVIEW_REVIEW_REVIEW_API-2 |

## Final Verification

```bash
test -f agent-task/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log || test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log
test -f agent-task/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log || test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log
test -f agent-task/m-iop-hot-path-one-shot-execution/06+04,05_request_identity_ingress/complete.log || test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/06+04,05_request_identity_ingress/complete.log
go test -count=1 ./apps/edge/internal/openai -run 'TestWorkspace(Tool|Command|Binding|Operation|Containment)'
go test -race -count=1 ./apps/edge/internal/openai ./apps/edge/internal/service
review_tmp_dir=$(mktemp -d /config/.tmp-iop-workspace-binding.XXXXXX)
TMPDIR="$review_tmp_dir" go test -count=1 ./apps/edge/...
review_status=$?
rmdir "$review_tmp_dir"
test "$review_status" -eq 0
go vet ./apps/edge/...
gofmt -d apps/edge/internal/openai/workspace_tool_binding.go apps/edge/internal/openai/workspace_tool_codec.go apps/edge/internal/openai/workspace_tool_binding_test.go
git diff --check
```

Expected: every command exits 0; the compiler directly accepts actual OpenAI `[]any` and native Anthropic `[]anthropicTool` slices; command writes cannot drop content; parent-capable fresh nested paths pass their guard while non-parent-capable missing parents and existing symlink escapes fail; no test executes a caller workspace tool.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
