<!-- task=m-iop-agent-cli-runtime/08+06,07_quota_failure plan=3 tag=REVIEW_TEST -->

# Code Review Reference - REVIEW_TEST

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-07-29
task=m-iop-agent-cli-runtime/08+06,07_quota_failure, plan=3, tag=REVIEW_TEST

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone document](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `quota-failure`: typed quota/failure and policy-only retry/failover
- Completion mode: check-on-pass

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-iop-agent-cli-runtime/08+06,07_quota_failure/plan_cloud_G08_2.log`
- Prior review: `agent-task/m-iop-agent-cli-runtime/08+06,07_quota_failure/code_review_cloud_G08_2.log`
- Verdict: `FAIL`
- Findings: 1 Required, 0 Suggested, 0 Nit.
- Required summary:
  - Complete the projection-integrity regression matrix with snapshot-ID and adapter mutation in policy, JSON, and manager paths, add the required `not_applicable` JSON round trip, and assert full canonical corrupt persistence.
- Affected files: `packages/go/agentpolicy/failure_policy_test.go`, `packages/go/agenttask/failure_continuation_test.go`, and the active review evidence.
- Reviewer verification:
  - Focused sanitizer/JSON, manager/store, and raw-snapshot suites passed.
  - Affected package suites, race suites, `go vet ./packages/go/...`, `go test -count=1 ./packages/go/...`, formatting, deterministic searches, and `git diff --check` passed.
  - Production code and both runtime contracts already cover the omitted fields; no production or contract change is justified unless a new regression fails.
- Routing signals: `review_rework_count=3`, `evidence_integrity_failure=false`.
- Roadmap carryover: S07 / `quota-failure` remains incomplete; the Milestone was not modified.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G04.md` → `code_review_cloud_G04_3.log` and `PLAN-cloud-G04.md` → `plan_cloud_G04_3.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-iop-agent-cli-runtime/08+06,07_quota_failure/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, report completion event metadata. Roadmap state check and `update-roadmap` calls are runtime responsibilities.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_TEST-1 Complete policy and JSON projection cases | [x] |
| REVIEW_TEST-2 Complete manager fail-closed identity cases | [x] |

## Implementation Checklist

- [x] Complete the policy sanitizer and strict JSON matrices with snapshot-ID and adapter drift plus valid, stale, not-applicable, and corrupt round trips.
- [x] Complete the manager mutation matrix with snapshot-ID and adapter drift, full canonical corrupt persistence, and exactly one invocation per case.
- [x] Run focused, affected, race, vet, full shared-package, formatting, deterministic search, and diff verification without production or contract changes.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G04_3.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G04_3.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [x] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [x] If PASS, move active task directory `agent-task/m-iop-agent-cli-runtime/08+06,07_quota_failure/` to `agent-task/archive/YYYY/MM/m-iop-agent-cli-runtime/08+06,07_quota_failure/` and update this checklist at the final archive path.
- [x] If PASS and task group is `m-<milestone-slug>`, report completion event metadata for runtime, without modifying roadmap or directly calling `update-roadmap`.
- [x] If PASS for split work, remove empty active parent `agent-task/m-iop-agent-cli-runtime/` or verify it was kept due to remaining siblings/files.
- [ ] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

- The plan's Before/After snippet for REVIEW_TEST-1 shows the "snapshot ID"/"adapter identity" cases replacing the existing "state" case in the sanitizer table. That was illustrative placement, not a removal instruction (the plan text says "Extend the existing tables"), so the "state" case was kept and the two new cases were inserted immediately after it. All previously existing cases in both tables remain unchanged.
- `go test -count=1 -race ./packages/go/agentpolicy ./packages/go/agenttask ./packages/go/agentstate` intermittently failed (2 of 5 runs) on `TestManualStartStopCancelsInvocationAndReleasesCapacity` (`manager_test.go:175`) and `TestSchedulerProviderCapacityAndParallelRelease` (`scheduler_test.go:26`). Both tests live in files this plan does not touch (scope is limited to `failure_policy_test.go` and `failure_continuation_test.go`), assert capacity-release/scheduler-concurrency timing unrelated to quota-observation projection integrity, and passed in 3/3 isolated re-runs of `go test -count=1 -race ./packages/go/agenttask` alone. This is pre-existing timing-sensitive flakiness under `-race` when the three packages run concurrently in this sandbox, not a regression from the REVIEW_TEST-1/2 changes. The `Verification Results` section below records one full clean pass of the exact plan command as primary evidence and preserves a flaked run for transparency.

## Key Design Decisions

- Snapshot-ID drift cases use `"quota-" + strings.Repeat("0", 64)`: syntactically valid per `validQuotaSnapshotIdentity` (prefix + 64 hex chars) but distinct from the digest-derived ID that `status.NormalizeQuotaSnapshot` actually produces, so the case proves seal/integrity drift rather than shape rejection, per the plan's instruction.
- Added `notApplicable := policyQuotaObservation("ignored", QuotaStateNotApplicable)` to the JSON round-trip set (`valid, stale, unknown, notApplicable, CorruptQuotaObservation()`), reusing the same `QuotaStateNotApplicable` construction path already proven in `TestDecideContinuationNotApplicable`.
- The manager-side durable-persistence assertion in `TestFailureContinuationProjectionTamperBecomesTypedBlocker` was tightened from a single-field `Validity` check to `reflect.DeepEqual(work.AttemptObservations[0].Observation.Quota, agentpolicy.CorruptQuotaObservation())`, matching the plan's requirement to assert the complete canonical corrupt value rather than one field.

## Reviewer Checkpoints

- The sanitizer and strict JSON matrices independently mutate snapshot ID and adapter as well as the already covered fields.
- The JSON round-trip set includes valid, stale, not-applicable, and corrupt projections; unknown may remain as additional coverage.
- Every manager mutation case invokes the provider exactly once, blocks with `BlockerFailureObservationCorrupt`, and persists the full `CorruptQuotaObservation()` value.
- Production and contract files remain unchanged unless a newly added required regression exposes a defect.
- Every verification section contains complete actual stdout/stderr and an exit status.

## Verification Results

For every command below, paste actual stdout/stderr and record its exit status. Do not replace output with a summary.

### `go test -count=1 -run 'Test(SanitizeQuotaObservationRejectsProjectionTampering|QuotaObservationJSONRoundTripRejectsTampering)$' ./packages/go/agentpolicy`

```text
ok  	iop/packages/go/agentpolicy	0.012s
```

With `-v`, every subtest passed:
```text
--- PASS: TestSanitizeQuotaObservationRejectsProjectionTampering (0.00s)
    --- PASS: TestSanitizeQuotaObservationRejectsProjectionTampering/state (0.00s)
    --- PASS: TestSanitizeQuotaObservationRejectsProjectionTampering/snapshot_ID (0.00s)
    --- PASS: TestSanitizeQuotaObservationRejectsProjectionTampering/adapter_identity (0.00s)
    --- PASS: TestSanitizeQuotaObservationRejectsProjectionTampering/target_identity (0.00s)
    --- PASS: TestSanitizeQuotaObservationRejectsProjectionTampering/checked_time (0.00s)
    --- PASS: TestSanitizeQuotaObservationRejectsProjectionTampering/validity (0.00s)
    --- PASS: TestSanitizeQuotaObservationRejectsProjectionTampering/ordered_reason (0.00s)
--- PASS: TestQuotaObservationJSONRoundTripRejectsTampering (0.00s)
    --- PASS: TestQuotaObservationJSONRoundTripRejectsTampering/state (0.00s)
    --- PASS: TestQuotaObservationJSONRoundTripRejectsTampering/target (0.00s)
    --- PASS: TestQuotaObservationJSONRoundTripRejectsTampering/snapshot_id (0.00s)
    --- PASS: TestQuotaObservationJSONRoundTripRejectsTampering/adapter (0.00s)
    --- PASS: TestQuotaObservationJSONRoundTripRejectsTampering/checked_time (0.00s)
    --- PASS: TestQuotaObservationJSONRoundTripRejectsTampering/validity (0.00s)
    --- PASS: TestQuotaObservationJSONRoundTripRejectsTampering/reason (0.00s)
    --- PASS: TestQuotaObservationJSONRoundTripRejectsTampering/integrity (0.00s)
    --- PASS: TestQuotaObservationJSONRoundTripRejectsTampering/unknown_field (0.00s)
PASS
```

Exit status: 0

### `go test -count=1 -run '^TestFailureContinuationProjectionTamperBecomesTypedBlocker$' ./packages/go/agenttask`

```text
ok  	iop/packages/go/agenttask	0.208s
```

With `-v`, every subtest passed:
```text
--- PASS: TestFailureContinuationProjectionTamperBecomesTypedBlocker (0.47s)
    --- PASS: TestFailureContinuationProjectionTamperBecomesTypedBlocker/state (0.03s)
    --- PASS: TestFailureContinuationProjectionTamperBecomesTypedBlocker/target (0.03s)
    --- PASS: TestFailureContinuationProjectionTamperBecomesTypedBlocker/snapshot_id (0.17s)
    --- PASS: TestFailureContinuationProjectionTamperBecomesTypedBlocker/adapter (0.07s)
    --- PASS: TestFailureContinuationProjectionTamperBecomesTypedBlocker/checked_time (0.04s)
    --- PASS: TestFailureContinuationProjectionTamperBecomesTypedBlocker/validity (0.09s)
    --- PASS: TestFailureContinuationProjectionTamperBecomesTypedBlocker/reason (0.04s)
PASS
```

Exit status: 0

### `command -v go && go version && go env GOROOT`

```text
/config/.local/bin/go
go version go1.26.2 linux/arm64
/config/opt/go
```

Exit status: 0

### `gofmt -d packages/go/agentpolicy/failure_policy_test.go packages/go/agenttask/failure_continuation_test.go`

```text
(no output — both files are already gofmt-clean)
```

Exit status: 0

### `go test -count=1 ./packages/go/agentpolicy ./packages/go/agenttask ./packages/go/agentstate`

```text
ok  	iop/packages/go/agentpolicy	0.014s
ok  	iop/packages/go/agenttask	5.751s
ok  	iop/packages/go/agentstate	0.102s
```

Exit status: 0

### `go test -count=1 -race ./packages/go/agentpolicy ./packages/go/agenttask ./packages/go/agentstate`

Primary evidence (clean pass, most recent run):
```text
ok  	iop/packages/go/agentpolicy	1.133s
ok  	iop/packages/go/agenttask	6.223s
ok  	iop/packages/go/agentstate	1.130s
```

Exit status: 0

Observed intermittent flake (2 of 5 total runs of this exact command), preserved for transparency — see `Deviations from Plan`:
```text
ok  	iop/packages/go/agentpolicy	1.127s
--- FAIL: TestManualStartStopCancelsInvocationAndReleasesCapacity (0.04s)
    manager_test.go:175: cancel lost the durable process locator
FAIL
FAIL	iop/packages/go/agenttask	5.127s
ok  	iop/packages/go/agentstate	1.242s
FAIL
```
A second flaked run additionally showed:
```text
--- FAIL: TestSchedulerProviderCapacityAndParallelRelease (0.18s)
    scheduler_test.go:26: max provider concurrency = 1, want 2
```
Both failing tests are in `manager_test.go` and `scheduler_test.go`, files outside this plan's scope, and `go test -count=1 -race ./packages/go/agenttask` run in isolation (without the sibling packages) passed 3/3 times.

### `go vet ./packages/go/...`

```text
(no output)
```

Exit status: 0

### `go test -count=1 ./packages/go/...`

```text
ok  	iop/packages/go/agentconfig	0.048s
ok  	iop/packages/go/agentguard	0.060s
ok  	iop/packages/go/agentpolicy	0.077s
ok  	iop/packages/go/agentprovider/catalog	0.081s
ok  	iop/packages/go/agentprovider/cli	39.608s
?   	iop/packages/go/agentprovider/cli/internal/testutil	[no test files]
ok  	iop/packages/go/agentprovider/cli/status	44.320s
ok  	iop/packages/go/agentruntime	1.065s
ok  	iop/packages/go/agentstate	0.167s
ok  	iop/packages/go/agenttask	4.513s
ok  	iop/packages/go/agentworkspace	8.827s
ok  	iop/packages/go/audit	0.003s
?   	iop/packages/go/auth	[no test files]
ok  	iop/packages/go/config	0.166s
?   	iop/packages/go/events	[no test files]
ok  	iop/packages/go/hostsetup	0.011s
?   	iop/packages/go/jobs	[no test files]
?   	iop/packages/go/metadata	[no test files]
ok  	iop/packages/go/observability	0.040s
?   	iop/packages/go/policy	[no test files]
ok  	iop/packages/go/streamgate	1.068s
?   	iop/packages/go/version	[no test files]
```

Exit status: 0

### `rg --sort path -n 'snapshot ID|adapter identity|QuotaStateNotApplicable|CorruptQuotaObservation' packages/go/agentpolicy/failure_policy_test.go packages/go/agenttask/failure_continuation_test.go`

```text
packages/go/agentpolicy/failure_policy_test.go:135:			name:        "snapshot ID",
packages/go/agentpolicy/failure_policy_test.go:142:			name:        "adapter identity",
packages/go/agentpolicy/failure_policy_test.go:183:			if got := SanitizeQuotaObservation(observation); !reflect.DeepEqual(got, CorruptQuotaObservation()) {
packages/go/agentpolicy/failure_policy_test.go:198:	notApplicable := policyQuotaObservation("ignored", QuotaStateNotApplicable)
packages/go/agentpolicy/failure_policy_test.go:199:	for _, observation := range []QuotaObservation{valid, stale, unknown, notApplicable, CorruptQuotaObservation()} {
packages/go/agentpolicy/failure_policy_test.go:444:			Target: alternate, Eligible: true, Quota: CorruptQuotaObservation(),
packages/go/agentpolicy/failure_policy_test.go:467:			QuotaStateNotApplicable,
packages/go/agentpolicy/failure_policy_test.go:494:			Quota:    policyQuotaObservation("ignored", QuotaStateNotApplicable),
packages/go/agentpolicy/failure_policy_test.go:546:	case QuotaStateNotApplicable:
packages/go/agenttask/failure_continuation_test.go:31:			continuationCandidate(secondAlternate, agentpolicy.QuotaStateNotApplicable),
packages/go/agenttask/failure_continuation_test.go:236:					agentpolicy.CorruptQuotaObservation(),
packages/go/agenttask/failure_continuation_test.go:269:				agentpolicy.QuotaStateNotApplicable,
packages/go/agenttask/failure_continuation_test.go:553:	case agentpolicy.QuotaStateNotApplicable:
```

Exit status: 0

### `if rg --sort path -n 'RawOutput' packages/go/agentpolicy packages/go/agenttask; then exit 1; else test $? -eq 1; fi`

```text
(no output — rg found no match, exited 1, so the if/else took the else branch)
```

Exit status: 0

### `git diff --check`

```text
(no output)
```

Exit status: 0

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Roadmap Targets | Fixed at stub creation from plan when present | Implementing agent must not modify; code-review copies it into `complete.log` as `Roadmap Completion` only on PASS |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Agent UI Completion | Mixed | Present only for plan-required agent-ui code work; implementing agent fills actual evidence, review agent applies `구현됨` status/evidence update on PASS and copies the section into `complete.log` |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: PASS
- Dimension Assessment:
  - Correctness: Pass
  - Completeness: Pass
  - Test coverage: Pass
  - API contract: Pass
  - Code quality: Pass
  - Implementation deviation: Pass
  - Verification trust: Pass
  - Spec conformance: Pass
- Findings: None
- Routing Signals:
  - review_rework_count=3
  - evidence_integrity_failure=false
- Next Step: Write `complete.log`, archive this reviewed pair, and emit the milestone task completion metadata for the runtime.
