<!-- task=m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure plan=0 tag=TEST -->

# Logged-in macOS Smoke Harness and Field Closure

## For the Implementing Agent

Fill implementation-owned sections in `CODE_REVIEW-cloud-G09.md` with actual local and field outputs. Keep the active pair in place and report ready for review. If the required macOS/login runner is unavailable, implement and locally verify the harness, then record the exact failed preflight and setup/resume command; do not fabricate evidence, ask the user directly, create stop files, or finalize the task.

## Background

Production wiring alone cannot prove actual CLI authentication, multi-project isolation, cancellation, restart recovery, and terminal archives. This closure packet implements the fail-fast harness and evidence schema, then runs the complete S14 sequence on an exact logged-in macOS build.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone document](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `logged-smoke`: authenticated macOS discovery-through-completion multi-project field validation
- Completion mode: check-on-pass

## Analysis

### Files Read

- `agent-task/m-iop-agent-cli-runtime/24+19,21,22,23_daemon_wiring/plan_cloud_G07_0.log`
- `agent-task/m-iop-agent-cli-runtime/24+19,21,22,23_daemon_wiring/code_review_cloud_G07_0.log`
- `configs/iop-agent.providers.yaml`
- `agent-test/local/rules.md`
- `agent-test/local/profiles/platform-common-smoke.md`
- `agent-test/local/profiles/testing-smoke.md`

### SDD Criteria

Approved SDD scenario S14 maps to `logged-smoke`. PASS requires an actual logged-in macOS multi-project field manifest covering discovery, run/stream, quota/status, cancel, a new invocation, daemon restart/recovery, completion, per-project logs, and proof that one project failure does not stop the other.

### Verification Context

The analyzed runner is Linux arm64 and cannot satisfy S14. A logged-in macOS runner must sync the reviewed commit, build `iop-agent`, prepare a user-local config with two clean clones, verify catalog-declared CLI logins, and run the exact field command below. The harness must fail before authentication on an OS mismatch, install cleanup traps before starting processes, and leave raw logs only in the operator-owned output root.

### Test Coverage Gaps

- No authenticated standalone smoke harness exists.
- No bounded manifest schema prevents credential, home-path, or provider-output leakage.
- No field run proves two project loops survive cancellation and daemon restart independently.

### Symbol References

None.

### Split Judgment

Harness implementation and field PASS remain together because redaction, cleanup, and lifecycle correctness require the actual manifest contract. The child depends on product closures plus `24_daemon_wiring` and exclusively owns `Roadmap Targets`.

### Scope Rationale

Do not change provider authentication, download CLIs, use the working checkout as a provider workspace, add synthetic S14 completion evidence, or store raw paths/provider output in tracked files.

### Final Routing

- evaluation_mode: `isolated-reassessment`
- finalizer: `finalize-task-policy.sh pair`
- build closures: external closure resolved by logged-in macOS cloud execution; grade scores `2/2/1/2/2`; route `capability-gap`, `cloud-G09`, filename `PLAN-cloud-G09.md`
- review closures: all reviewable from the manifest and exact output; grade scores `2/2/1/2/2`; route `official-review`, `cloud-G09`, filename `CODE_REVIEW-cloud-G09.md`
- large_indivisible_context: `false`
- positive loop risks: `temporal_state`, `concurrent_consistency`, `structured_interpretation`, `variant_product` (count `4`)
- recovery signals: rework `0`, evidence-integrity failure `false`
- capability-gap evidence: current Linux runner cannot execute required logged-in macOS lifecycle; the cloud target must provide the exact macOS/login environment

## Implementation Checklist

- [ ] Add a fail-fast, cleanup-safe macOS field harness with exact source, binary, config, login, workspace, socket, and process preflight.
- [ ] Cover discovery, preview/start, stream/log, quota/status, cancel, new invocation, daemon restart/recovery, independent project failure, and completion.
- [ ] Emit and validate a bounded redacted manifest containing commit/binary/config revisions, provider readiness states, project pseudonyms, step results, and evidence locators.
- [ ] Add Makefile entry points and locally verify help, preflight, redaction, and cleanup behavior without claiming S14 completion.
- [ ] Execute the harness on an actual logged-in macOS runner and paste the redacted manifest plus exact command output.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [TEST-2] Add the Field Harness and Preflight

#### Problem

No standalone script proves runner, source, binary, config, login, workspace, socket, and process assumptions before authenticated work.

#### Solution

Add `scripts/e2e-iop-agent-logged-smoke.sh` with explicit required flags. Require Darwin, a supported architecture, clean synced commit, exact binary SHA, executable/version output, catalog-declared auth status, two distinct clean clones, valid config, owner-only state root/socket, and no pre-existing daemon. Install exact-PID cleanup traps before process start.

#### Modified Files and Checklist

- [ ] `scripts/e2e-iop-agent-logged-smoke.sh` — implement preflight, steps, cleanup, and manifest handling.
- [ ] `scripts/fixtures/iop-agent-smoke-manifest.schema.json` — define bounded redacted output.

#### Test Strategy

Expose `--preflight-only` and `--validate-manifest`. On Linux, require a deterministic OS mismatch before login/process calls. Exercise safe and forbidden manifest fixtures under `/tmp`.

#### Verification

```bash
bash -n scripts/e2e-iop-agent-logged-smoke.sh
scripts/e2e-iop-agent-logged-smoke.sh --help
preflight_output=$(mktemp)
if scripts/e2e-iop-agent-logged-smoke.sh --preflight-only >"$preflight_output" 2>&1; then exit 1; fi
test "$(rg -c 'requires Darwin' "$preflight_output")" = 1
```

Expected: syntax/help pass and Linux fails exactly at the OS gate.

### [TEST-3] Exercise the S14 Lifecycle

#### Problem

No field sequence orchestrates discovery through completion across two authenticated projects.

#### Solution

Validate configs, record provider readiness, list projects, preview and start two selected work units, observe stream/log sequences, capture quota/status, cancel one, verify the sibling continues, start a new invocation, restart only the daemon, prove locator/state recovery, wait for terminal completion, and check per-project log/archive identity. Every wait has a deadline and focused diagnostics.

#### Modified Files and Checklist

- [ ] `scripts/e2e-iop-agent-logged-smoke.sh` — add the exact S14 sequence and assertions.

#### Test Strategy

The real logged-in macOS field run is mandatory; synthetic preflight cannot replace it.

#### Verification

```bash
scripts/e2e-iop-agent-logged-smoke.sh \
  --binary "$PWD/build/bin/iop-agent" \
  --repo-config "$PWD/configs/iop-agent.runtime.yaml" \
  --local-config "$IOP_AGENT_SMOKE_LOCAL_CONFIG" \
  --provider-catalog "$PWD/configs/iop-agent.providers.yaml" \
  --project-a "$IOP_AGENT_SMOKE_PROJECT_A" \
  --project-b "$IOP_AGENT_SMOKE_PROJECT_B" \
  --expected-head "$(git rev-parse HEAD)" \
  --output "$IOP_AGENT_SMOKE_OUTPUT"
```

Expected: exit 0 on logged-in macOS and a schema-valid redacted manifest.

### [TEST-4] Validate Evidence Redaction

#### Problem

No S14 evidence schema prevents provider output or device paths from leaking into task evidence.

#### Solution

Record only provider IDs/readiness enums, hashed project aliases, revisions, command step/status/duration, safe blocker codes, and relative evidence locators. Reject token-like keys, authorization text, home paths, raw environment, prompts, and unbounded output.

#### Modified Files and Checklist

- [ ] `scripts/e2e-iop-agent-logged-smoke.sh` — enforce redaction and size bounds.
- [ ] `scripts/fixtures/iop-agent-smoke-manifest.schema.json` — constrain allowed fields.

#### Test Strategy

Require unsafe synthetic manifests to fail and validate the field manifest before evidence is accepted.

#### Verification

```bash
scripts/e2e-iop-agent-logged-smoke.sh --validate-manifest "$IOP_AGENT_SMOKE_OUTPUT/manifest.json"
rg -n -i 'authorization|bearer|api[_-]?key|token|/Users/|/home/' "$IOP_AGENT_SMOKE_OUTPUT/manifest.json" && exit 1 || true
```

Expected: schema validation passes and forbidden search has zero matches.

### [TEST-5] Add Stable Make Targets

#### Problem

The Makefile has no standalone logged-in validation entry point.

#### Solution

Add `test-iop-agent-logged-smoke-preflight` and `test-iop-agent-logged-smoke`. The field target must require explicit environment paths and never fall back to synthetic workspaces.

#### Modified Files and Checklist

- [ ] `Makefile` — add preflight and field targets.

#### Test Strategy

Run help/preflight locally and the field target only on the matching macOS environment.

#### Verification

```bash
make test-iop-agent-logged-smoke-preflight
```

Expected: the current Linux runner returns the documented Darwin mismatch; the field runner passes every preflight gate.

## Dependencies and Execution Order

Predecessors `19+14,16,18_cli_binary_contract`, `21+13,17,20_project_log_sink`, `22+16_local_control`, `23+14,16,22_client_process_manager`, and `24+19,21,22,23_daemon_wiring` must each produce a same-group active or archived `complete.log`.

## Modified Files Summary

| File | Item |
|------|------|
| `scripts/e2e-iop-agent-logged-smoke.sh` | TEST-2, TEST-3, TEST-4 |
| `scripts/fixtures/iop-agent-smoke-manifest.schema.json` | TEST-2, TEST-4 |
| `Makefile` | TEST-5 |

## Final Verification

```bash
bash -n scripts/e2e-iop-agent-logged-smoke.sh
scripts/e2e-iop-agent-logged-smoke.sh --help
make build-agent
scripts/e2e-iop-agent-logged-smoke.sh \
  --binary "$PWD/build/bin/iop-agent" \
  --repo-config "$PWD/configs/iop-agent.runtime.yaml" \
  --local-config "$IOP_AGENT_SMOKE_LOCAL_CONFIG" \
  --provider-catalog "$PWD/configs/iop-agent.providers.yaml" \
  --project-a "$IOP_AGENT_SMOKE_PROJECT_A" \
  --project-b "$IOP_AGENT_SMOKE_PROJECT_B" \
  --expected-head "$(git rev-parse HEAD)" \
  --output "$IOP_AGENT_SMOKE_OUTPUT"
scripts/e2e-iop-agent-logged-smoke.sh --validate-manifest "$IOP_AGENT_SMOKE_OUTPUT/manifest.json"
rg -n -i 'authorization|bearer|api[_-]?key|token|/Users/|/home/' "$IOP_AGENT_SMOKE_OUTPUT/manifest.json" && exit 1 || true
git diff --check
```

Expected: local syntax/help/build pass, the exact macOS field run exits 0, the manifest validates, and forbidden evidence is absent. After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
