<!-- task=m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability plan=6 tag=REVIEW_TEST milestone-task=ops-evidence -->

# Close Node Liveness Evidence Gaps and Preserve Verbatim Verification

## For the Implementing Agent

Implement this follow-up exactly within the declared write set, run every verification command, and fill all implementation-owned sections of `CODE_REVIEW-cloud-G06.md` with actual notes and raw output or the exact saved transcript evidence required below. Keep active files in place and report ready for review; finalization belongs to the code-review skill. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The observer panic boundary, numeric duration field, exhaustive four-fixture metric/log helper, and production seams are correct and pass fresh reviewer verification. The remaining failures are evidence gaps: several hostile values are asserted without being injected, panic fixtures do not reject a second terminal, and the review artifact reconstructs long command output instead of preserving actual transcripts. This follow-up changes only the observability test oracle and its implementation evidence.

## Archive Evidence Snapshot

- Review loop 5 will be archived as `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/plan_cloud_G05_5.log` and `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/code_review_cloud_G05_5.log`; verdict `FAIL` with Required R2, R3, and R5.
- R2 remains because adapter/target are ordinary values and listed request/response sentinels are never injected. R3 remains because panic-core fixtures consume one terminal but do not reject a duplicate. R5 records reconstructed focused-test output and a truncated reconnect transcript.
- The reviewer removed the no-op buffer and dummy dependency sentinels, resolving prior Suggested S1 without behavior change.
- Fresh reviewer execution passed formatting, the focused 20-iteration suite, Node package tests, race, vet, the complete two-process reconnect diagnostic, and `git diff --check`. These passes confirm the production implementation while leaving the missing oracle and transcript requirements unresolved.
- First-line scope remains `milestone-task=ops-evidence`, mapped to SDD Acceptance Scenario S06 and Evidence Map S06. This child remains the Node-only contribution; shared Edge observability and contract/spec consolidation stay outside its write set.

## Finding Resolution Map

| Finding | Mode | Exact fix / evidence | Changed precondition |
|---------|------|----------------------|----------------------|
| Required R2 | direct-fix | Update `apps/node/internal/node/liveness_observability_test.go` so each relevant normalized/tunnel fixture injects distinct hostile run, session, adapter, target, request, prompt/body, response, and credential values through actual request fields or metadata, then passes every exact value to the shared full-label/full-JSON rejection scan. | The leakage oracle will inspect values that actually traversed the production request seams. |
| Required R3 | direct-fix | Update `apps/node/internal/node/liveness_observability_test.go` with a deterministic no-additional-terminal helper and call it after both panicking-logger handlers return and the first terminal is validated. | Normalized and tunnel panic isolation will prove exactly one terminal rather than merely at least one. |
| Required R5 | direct-fix | Fill `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/CODE_REVIEW-cloud-G06.md` with verbatim command output; for the focused and reconnect commands, retain the exact `/tmp` transcript paths, line counts, and SHA-256 output and do not invent summary lines. | Verification trust will be based on saved command output with preserved exit status instead of reconstructed text. |

## Analysis

### Files Read

- `apps/node/internal/node/liveness_observability.go`
- `apps/node/internal/node/liveness_observability_test.go`
- `apps/node/internal/node/node.go`
- `apps/node/internal/node/liveness_watchdog.go`
- `apps/node/internal/node/liveness_health_evidence.go`
- `apps/node/internal/node/liveness_watchdog_test.go`
- `apps/node/internal/node/liveness_watchdog_lifecycle_test.go`
- `apps/node/internal/node/liveness_health_evidence_test.go`
- `apps/node/internal/node/provider_tunnel_liveness_test.go`
- `packages/go/observability/observability.go`
- `scripts/dev/edge-node-reconnect-diagnostic.sh`
- `agent-contract/inner/execution-runtime.md`
- `agent-contract/inner/edge-node-runtime-wire.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-roadmap/phase/operational-observability-provider-management/PHASE.md`
- `agent-roadmap/phase/operational-observability-provider-management/milestones/node-provider-execution-liveness-recovery.md`
- `agent-roadmap/sdd/operational-observability-provider-management/node-provider-execution-liveness-recovery/SDD.md`
- `agent-test/local/rules.md`
- `agent-test/local/node-smoke.md`
- `agent-test/local/platform-common-smoke.md`
- `agent-test/local/testing-smoke.md`
- `agent-ops/rules/project/domain/node/rules.md`
- `agent-ops/rules/project/domain/platform-common/rules.md`
- `agent-ops/rules/project/domain/testing/rules.md`
- `agent-ops/skills/project/e2e-smoke/SKILL.md`

### SDD Criteria

- SDD: `agent-roadmap/sdd/operational-observability-provider-management/node-provider-execution-liveness-recovery/SDD.md`; status `[승인됨]`; lock released; no `USER_REVIEW.md`.
- First-line scope is `milestone-task=ops-evidence` and the id exists in the active Milestone.
- S06 requires Node/Edge bounded liveness evidence with high-cardinality and raw content absent. Evidence Map S06 specifically requires metric label guards and structured-log capture.
- R2 drives actual hostile-value injection and complete label/log rejection. R3 preserves S02/S06 exactly-once terminal trust under observability failure. R5 makes the final evidence reviewable and non-reconstructed.

### Verification Context

- No external handoff was supplied. Repository-native evidence is the current checkout at `/config/workspace/iop-s1`, Go `1.26.2`, and module `/config/workspace/iop-s1/go.mod`.
- Fresh reviewer commands passed: formatting stability, focused Node observability 20 times with all named subtests, `go test -count=1 ./packages/go/execution ./apps/node/...`, three-iteration race, vet, the repository two-process reconnect diagnostic, and `git diff --check`.
- The reconnect diagnostic runs current-checkout `scripts/dev/edge.sh` and `scripts/dev/node.sh` with temporary config and ports; it requires no external provider, credential, remote host, or user authorization.
- Focused and diagnostic output is long. Save it outside the repository at the exact `/tmp` paths in Final Verification, preserve pipeline exit status, and record the path, `wc -l`, and `sha256sum` output in the review artifact. Do not reconstruct or trim the transcript.
- Preconditions are satisfied: local Go/module preflight passed, predecessor 06 has an archived `complete.log`, SDD is approved/unlocked, and all changes are repository-fixable. Confidence is high.

### Test Coverage Gaps

- The four-fixture helper covers exact metric family count/value/labels, histogram count/duration, exact log count/field set, numeric duration, and encoded-log scanning.
- Gap R2: the helper receives values that never entered the request, and it does not receive hostile adapter/target values.
- Gap R3: panic-core fixtures prove one terminal arrives but do not prove no second event/frame remains after handler completion.
- R5 is an evidence-capture gap, not a production behavior gap.

### Symbol References

None. No symbol is renamed or removed.

### Split Judgment

Keep one compact test/evidence follow-up. Hostile request-surface coverage, panic exactly-once proof, and transcript fidelity close one S06 evidence oracle and share the same test file and review artifact. Splitting would not produce an independently useful intermediate completion.

The `11+06` predecessor remains satisfied by `agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/06+05_failure_wire_mapping/complete.log` plus fresh integrated Node verification.

### Scope Rationale

Do not change `liveness_observability.go`, `node.go`, `liveness_watchdog.go`, health classification, terminal metadata, wire mapping, Edge ingestion, recovery behavior, metric names/labels, contracts, specs, roadmap files, or diagnostic scripts. Production behavior already passes; only `liveness_observability_test.go` and the active review evidence artifact are writable.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer=`finalize-task-policy.sh pair`.
- Build closures are true for scope, context, verification, evidence, ownership, and decisions. Scores `(1,1,0,2,2)` produce G06 with base `local-fit`; `review_rework_count=2` and `evidence_integrity_failure=true` select `recovery-boundary`, yielding `PLAN-cloud-G06.md`.
- Review closures are true. Scores `(1,1,0,2,2)` produce G06 and `official-review`, yielding `CODE_REVIEW-cloud-G06.md` with Codex `gpt-5.6-sol` xhigh.
- `large_indivisible_context=false`. Positive loop risks are `concurrent_consistency` and `variant_product` (2). There is no capability gap.

## Implementation Checklist

- [ ] REVIEW_TEST-1 injects every hostile run/session/adapter/target/request/prompt-or-body/response/credential value through actual normalized/tunnel request surfaces, rejects every value from all metric labels and the full encoded log, and proves no duplicate terminal after normalized/tunnel logger panics.
- [ ] REVIEW_TEST-2 runs every fresh formatting, focused, package, race, vet, complete two-process diagnostic, transcript-integrity, and diff command in Final Verification and records only actual stdout/stderr or exact saved transcript evidence.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_TEST-1] Close the adversarial and exactly-once oracle

**Problem:** `apps/node/internal/node/liveness_observability_test.go:216` lists request and response sentinels that never enter the request, uses ordinary adapter/target values, and `apps/node/internal/node/liveness_observability_test.go:457` validates the first panic-path terminal without rejecting a second terminal.

Before (`apps/node/internal/node/liveness_observability_test.go:216`):

```go
sentinels := []string{
    "raw-response-secret",
    "spoof-request-id",
}
req := &iop.RunRequest{
    Adapter: adapter.Name(),
    Target:  "target",
}
terminal := waitRunEvent(t, pipe.events)
// No post-handler duplicate assertion.
```

**Solution:** Define distinct hostile values per fixture, use the hostile adapter as the controlled adapter identity, use the hostile target consistently in the request and probe result, and place request/response/credential sentinels in request metadata while prompt/body/header sentinels use their native surfaces. Pass every injected exact value to `hostileSentinels`. Add one deterministic helper that checks the already-buffered event/frame channel after the handler returned.

After:

```go
adapterName := "hostile-adapter-norm-available"
target := "hostile-target-norm-available"
sentinels := []string{runID, sessionID, adapterName, target, requestID, prompt, response, credential}
adapter := newProbingWatchdogAdapter(adapterName)
req := &iop.RunRequest{
    RunId: runID, Adapter: adapterName, Target: target, SessionId: sessionID,
    Input: inputWithPrompt(prompt),
    Metadata: map[string]string{"request_id": requestID, "response": response, "credential": credential},
}
assertNoAdditionalTerminal(t, pipe.events)
```

**Modified Files and Checklist:**

- [ ] `apps/node/internal/node/liveness_observability_test.go`: inject the complete hostile matrix and add normalized/tunnel no-second-terminal assertions without changing production code.
- [ ] Preserve all current exact metric/log/numeric/normalization/repeated-construction assertions.

**Test Strategy:** Extend `TestNodeLivenessObservability` only. Keep its four manual-clock matrix cases, unknown-normalization, failure-isolation, and repeated-construction subtests. Assert every injected exact sentinel is absent from all gathered label names/values and the full encoded JSON log, and assert both panic paths have zero additional terminal messages after handler return.

**Verification:** `go test -count=20 -v ./apps/node/internal/node -run '^TestNodeLivenessObservability$'` passes and displays all matrix/failure-isolation subtests in each iteration.

### [REVIEW_TEST-2] Preserve actual verification transcripts

**Problem:** `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/CODE_REVIEW-cloud-G05.md:109` contains a line that `go test` does not emit, and its reconnect output omits the command's startup, Edge, and Node transcript despite the plan's explicit fidelity requirement.

Before:

```text
PASS (20 iterations completed with 0 failures)
[diagnostic] Verifying payload sequence...
```

**Solution:** Run the exact commands below. Preserve the focused and diagnostic streams with `tee` at deterministic outside-repository paths, immediately check `PIPESTATUS[0]`, and record the exact path plus `wc -l` and `sha256sum` output in `CODE_REVIEW-cloud-G06.md`. Paste short command stdout/stderr verbatim and do not add tool-like summary lines.

After:

```text
Transcript: /tmp/iop-node-liveness-observability-focused.log
Line count: <actual wc -l output>
SHA-256: <actual sha256sum output>
Command output: <verbatim or exact transcript reference; no reconstruction>
```

**Modified Files and Checklist:**

- [ ] `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/CODE_REVIEW-cloud-G06.md`: record actual notes, outputs, exact transcript paths, line counts, checksums, and any real warnings.

**Test Strategy:** No additional test file is needed for evidence formatting. The exact commands and transcript-integrity checks below are the deterministic oracle.

**Verification:** `test -s /tmp/iop-node-liveness-observability-focused.log && test -s /tmp/iop-node-liveness-observability-reconnect.log` passes; `wc -l` and `sha256sum` report both exact files.

## Modified Files Summary

| File | Item |
|------|------|
| `apps/node/internal/node/liveness_observability_test.go` | REVIEW_TEST-1 |
| `agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/CODE_REVIEW-cloud-G06.md` | REVIEW_TEST-2 |

## Final Verification

Fresh Go execution is required; cached-only output is not acceptable. Preserve actual stdout/stderr without reconstructed summaries.

1. `go version && go env GOMOD` — reports the current Go toolchain and `/config/workspace/iop-s1/go.mod`.
2. `gofmt -w apps/node/internal/node/liveness_observability_test.go && test -z "$(gofmt -d apps/node/internal/node/liveness_observability_test.go)"` — formatting is stable.
3. `go test -count=20 -v ./apps/node/internal/node -run '^TestNodeLivenessObservability$' 2>&1 | tee /tmp/iop-node-liveness-observability-focused.log; test "${PIPESTATUS[0]}" -eq 0` — all named subtests pass 20 times and the exact transcript is saved.
4. `go test -count=1 ./packages/go/execution ./apps/node/...` — Node local profile passes.
5. `go test -race -count=3 ./apps/node/internal/node -run 'LivenessObservability|Watchdog|HealthEvidence'` — passes with no race report.
6. `go vet ./packages/go/execution ./apps/node/...` — no diagnostics.
7. `IOP_DEV_RECONNECT_BIND_TIMEOUT=45 ./scripts/dev/edge-node-reconnect-diagnostic.sh 2>&1 | tee /tmp/iop-node-liveness-observability-reconnect.log; test "${PIPESTATUS[0]}" -eq 0` — complete separate Edge/Node registration, message x2, reconnect message, payload parity, commands, terminal ordering, warnings, Edge log, and Node log are saved.
8. `test -s /tmp/iop-node-liveness-observability-focused.log && test -s /tmp/iop-node-liveness-observability-reconnect.log && wc -l /tmp/iop-node-liveness-observability-focused.log /tmp/iop-node-liveness-observability-reconnect.log && sha256sum /tmp/iop-node-liveness-observability-focused.log /tmp/iop-node-liveness-observability-reconnect.log` — both transcripts are non-empty and have exact line-count/checksum evidence.
9. `git diff --check` — run after all source and `CODE_REVIEW-cloud-G06.md` evidence edits; no whitespace errors.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
