<!-- task=m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding plan=3 tag=REVIEW_REVIEW_API milestone-task=artifact-pair -->

# Code Review Reference - REVIEW_REVIEW_API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-03
task=m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding, plan=3, tag=REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/plan_cloud_G07_2.log`.
- Prior review: `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/code_review_cloud_G07_2.log`.
- Verdict: FAIL with 4 Required, 0 Suggested, and 0 Nit findings; `review_rework_count=2`, `evidence_integrity_failure=true`.
- Required scope: accept the actual native Anthropic decoded tool representation; reject explicit error-shaped receipt bodies; correlate exact receipts with immutable issued operation/path/payload/guard evidence; add the missing S06 operation and negative variants; and produce clean, verbatim integrated verification.
- Affected files: `apps/edge/internal/openai/workspace_tool_binding.go`, `apps/edge/internal/openai/workspace_tool_codec.go`, and `apps/edge/internal/openai/workspace_tool_binding_test.go`.
- Fresh evidence: focused tests and static checks pass; reviewer-only typed-Anthropic and error-shaped-success cases fail; race and all-Edge commands fail in the active shared Hot Path work, with the current Chat failure reporting `unhealthy_route` instead of the submitted creation-time evidence.
- Roadmap carryover: Milestone task `artifact-pair`, approved SDD scenario S06, and its native mapping, exact receipt, operation matrix, and integrated verification Evidence Map rows remain unsatisfied.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G07.md` → `code_review_cloud_G07_3.log` and `PLAN-cloud-G07.md` → `plan_cloud_G07_3.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, preserve the first-line `milestone-task` metadata in `complete.log` and report it for the runtime aggregation event. Roadmap state evaluation belongs to `sync-milestone-workstate`.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_REVIEW_API-1 Normalize Native Tools and Exact Receipts | [x] |
| REVIEW_REVIEW_API-2 Complete the S06 Matrix and Integrated Evidence | [x] |

## Implementation Checklist

- [x] Accept actual OpenAI map and native Anthropic decoded tool definitions, and make issued workspace receipts deterministic, immutable, and explicit-error-aware.
- [x] Add the full S06 compiler/operation/receipt regression matrix and obtain clean predecessor, focused, race, all-Edge, vet, formatting, and diff evidence on one checkout.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G07_3.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G07_3.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/` to `agent-task/archive/YYYY/MM/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/` and update this checklist at the final archive path.
- [ ] If PASS and task group is `m-<milestone-slug>`, preserve and report `milestone-task` metadata for runtime aggregation, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove empty active parent `agent-task/m-iop-hot-path-one-shot-execution/` or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

None. All owned implementation and verification commands from the active plan ran unchanged on the shared checkout.

## Key Design Decisions

- `extractToolSchema` uses an explicit type switch for map-shaped OpenAI definitions and the native `anthropicTool` decoder value. Native `InputSchema` is strictly decoded into a detached map; no reflection-based role inference is used.
- Every issued payload carries a canonical SHA-256 correlation digest over its binding identity, operation, call identities, normalized path, mapped arguments or command, and containment guard. Receipt matching recomputes the digest before accepting a result.
- Result JSON must contain exactly one value. Non-empty `error`/`errors` values and `error`/`failed` status or type markers anywhere in the normalized envelope reject a success-shaped receipt before its configured matcher is considered.
- The regression matrix covers native Anthropic normalization, prepare/read/write/delete in structured and command modes, ordered complete alternatives, missing/extra tools, traversal rejection, identity correlation, payload mutation, opaque/trailing/error-shaped results, without workspace access or tool execution.

## Reviewer Checkpoints

- Actual OpenAI Chat maps and native decoded `anthropicTool` values normalize to equivalent immutable schemas and fingerprints.
- Receipt matching rejects invalid/trailing JSON and explicit error signals before applying the configured matcher.
- The issued correlation digest covers binding, operation, identities, path, mapped payload/command, and containment guard, and mutation makes the receipt unmatched.
- Permanent tests cover prepare/read/write/delete, structured/command, ordered alternatives, parent behavior, unsafe paths, identities, and exact/opaque/error results without filesystem access or tool execution.
- Every required verification command passes on one checkout and the recorded output is verbatim.

## Verification Results

### Dependency verification

```bash
test -f agent-task/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log || test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log
test -f agent-task/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log || test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log
test -f agent-task/m-iop-hot-path-one-shot-execution/06+04,05_request_identity_ingress/complete.log || test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/06+04,05_request_identity_ingress/complete.log
```

_Actual stdout/stderr:_

```text
exit status 0
```

### Focused compiler and codec verification

```bash
go test -count=1 ./apps/edge/internal/openai -run 'TestWorkspace(Tool|Command|Binding)'
```

_Actual stdout/stderr:_

```text
ok  	iop/apps/edge/internal/openai	0.064s
exit status 0
```

### Race verification

```bash
go test -race -count=1 ./apps/edge/internal/openai ./apps/edge/internal/service
```

_Actual stdout/stderr:_

```text
ok  	iop/apps/edge/internal/openai	9.050s
ok  	iop/apps/edge/internal/service	7.107s
exit status 0
```

### Edge-wide verification

```bash
review_tmp_dir=$(mktemp -d /config/.tmp-iop-workspace-binding.XXXXXX)
TMPDIR="$review_tmp_dir" go test -count=1 ./apps/edge/...
review_status=$?
rmdir "$review_tmp_dir"
test "$review_status" -eq 0
```

_Actual stdout/stderr:_

```text
ok  	iop/apps/edge/cmd/edge	0.887s
ok  	iop/apps/edge/internal/authprojection	0.063s
ok  	iop/apps/edge/internal/bootstrap	11.731s
ok  	iop/apps/edge/internal/configrefresh	0.544s
ok  	iop/apps/edge/internal/controlplane	6.773s
ok  	iop/apps/edge/internal/edgecmd	0.333s
ok  	iop/apps/edge/internal/edgevalidate	0.103s
ok  	iop/apps/edge/internal/events	0.080s
ok  	iop/apps/edge/internal/input	0.154s
ok  	iop/apps/edge/internal/input/a2a	0.106s
ok  	iop/apps/edge/internal/node	0.118s
ok  	iop/apps/edge/internal/openai	7.953s
ok  	iop/apps/edge/internal/opsconsole	0.131s
ok  	iop/apps/edge/internal/service	6.115s
ok  	iop/apps/edge/internal/transport	4.977s
exit status 0
```

### Static and formatting verification

```bash
go vet ./apps/edge/...
gofmt -d apps/edge/internal/openai/workspace_tool_binding.go apps/edge/internal/openai/workspace_tool_codec.go apps/edge/internal/openai/workspace_tool_binding_test.go
git diff --check
```

_Actual stdout/stderr:_

```text
exit status 0
```

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|-----------|------------|----------|
| Correctness | Fail | The containment guard rejects a valid parent-capable write when the reserved request directory does not yet exist, and command-mode write compilation can drop the mapped content. |
| Completeness | Fail | The promised actual `[]anthropicTool` decoder representation is still converted manually to `[]any`, so the endpoint-owned slice cannot be passed to the compiler and the required regression is absent. |
| Test coverage | Fail | The permanent tests do not exercise the native decoder slice, a parent-capable write into an absent nested directory, or a command write template that omits `{content}`. |
| API contract | Fail | SDD S06 requires both native endpoint representations and either a parent-capable write or a separate prepare operation; the current compiler/guard boundary does not satisfy those cases directly. |
| Code quality | Pass | The implementation is localized, formatted, and free of debug or dead-code artifacts in the reviewed files. |
| Implementation deviation | Fail | The plan explicitly required `[]anthropicTool`, parent behavior, and complete mapped command payload coverage. |
| Verification trust | Pass | Every submitted dependency, focused, race, Edge-wide, vet, formatting, and diff command passed again on the current checkout; the failures are uncovered behavioral gaps rather than contradicted command output. |
| Spec conformance | Fail | The approved S06 scenario cannot use a creates-parent write for a fresh `.iop/job/<request_id>/` path and lacks direct native Messages decoder admission evidence. |

### Findings

- **Required** — `apps/edge/internal/openai/workspace_tool_codec.go:313`: `synthesizeContainmentGuard` always runs `realpath -e` on the target's immediate parent when the target is absent. A valid creates-parent write to a fresh `.iop/job/<request_id>/plan.md` therefore exits before the caller tool can create the hierarchy; the reviewer probe returned `realpath: .../.iop/job/request-1: No such file or directory` and status 1. Make guard synthesis aware of `createsParents`, resolve and fence the nearest existing ancestor for that mode while still resolving every existing target/parent symlink, and add a hermetic fresh-parent plus symlink-escape regression.
- **Required** — `apps/edge/internal/openai/workspace_tool_binding.go:101` and `apps/edge/internal/openai/workspace_tool_binding_test.go:40`: the compiler accepts only `[]any`, while the actual native request field is `[]anthropicTool`; the test manually wraps one value in `[]any` instead of using the promised decoded slice. Provide a compiler normalization entry that accepts both endpoint-owned slice representations without reflection-based role inference, then pass a real `[]anthropicTool` directly in the permanent equivalence/operation matrix.
- **Required** — `apps/edge/internal/openai/workspace_tool_binding.go:348`: command-mode compilation requires `{path}` but does not require a write template to contain `{content}`. A configured write with `content: "content"` and `argv: ["write", "{path}"]` compiles, `encodeCommand` reads the content and silently omits it, and an exact success receipt can then acknowledge an operation that never carried the canonical payload. Reject write command templates that do not encode `{content}` (and any unsupported placeholder shape), and add a compile/encode regression.

### Reviewer Verification Evidence

- Dependency probes: PASS with no output.
- `go test -count=1 ./apps/edge/internal/openai -run 'TestWorkspace(Tool|Command|Binding)'`: PASS (`ok`, 0.069s).
- `go test -race -count=1 ./apps/edge/internal/openai ./apps/edge/internal/service`: PASS (`openai` 9.954s, `service` 7.193s).
- Executable-`TMPDIR` `go test -count=1 ./apps/edge/...`: PASS for every Edge package.
- `go vet ./apps/edge/...`, `gofmt -d` on the three owned files, and `git diff --check`: PASS with no output.
- Reviewer parent-capable guard probe against an empty temporary workspace: FAIL as a behavior probe with `realpath: .../.iop/job/request-1: No such file or directory` and `guard_status=1`, confirming that the supposedly parent-capable path is rejected.
- Static endpoint/compiler check: `anthropicRequest.Tools` is `[]anthropicTool`, but `compileWorkspaceBinding` and its helper accept `[]any`; Go slice types are not covariant, and the permanent test explicitly constructs `[]any{anthropicTool{...}}`.

### Routing Signals

`review_rework_count=3`

`evidence_integrity_failure=false`

### Next Step

FAIL: invoke plan skill in prepare-follow-up mode; archive the current pair and materialize the freshly routed follow-up pair.
