<!-- task=m-multi-provider-protocol-profile-native-messages/03+02_responses_profile plan=2 tag=API -->

# Optional Responses profile operation regression

## For the Implementing Agent

CODE_REVIEW-cloud-G04.md의 구현 담당 섹션을 채우는 것이 구현의 필수 마지막 단계다. 선행 02+01_messages_ingress/complete.log를 확인한 뒤 Responses profile 경계와 focused regression만 구현한다. 실제 검증 stdout/stderr를 review에 기록하고 active 파일을 유지한 채 review 준비 완료를 보고한다. 최종 판정, log rename, complete.log, archive 이동은 code-review skill만 수행한다.

## Background

Protocol profile과 Messages 구현 뒤 기존 Responses tunnel은 explicit profile의 optional responses operation/capability을 사용해야 한다. 동시에 legacy no-profile, normalized execution, stream, provider-auth, body/status 의미는 그대로 보존해야 한다. 이 child는 해당 production 경계와 S08 focused evidence만 닫는다.

## Analysis

### Files Read

- agent-roadmap/phase/operational-observability-provider-management/milestones/multi-provider-protocol-profile-native-messages.md
- agent-roadmap/sdd/operational-observability-provider-management/multi-provider-protocol-profile-native-messages/SDD.md
- packages/go/config/provider_types.go
- proto/iop/runtime.proto
- apps/edge/internal/openai/provider_tunnel.go
- apps/edge/internal/openai/responses_handler.go
- apps/edge/internal/openai/responses_handler_test.go
- apps/edge/internal/openai/openai_auth_routes_models_test.go
- apps/node/internal/adapters/openai_compat/provider_tunnel.go
- apps/node/internal/adapters/openai_compat/provider_tunnel_test.go
- apps/node/internal/adapters/openai_compat/capabilities_test.go

### SDD Criteria

- S08 / responses-regression 중 explicit openai_responses profile/runtime과 normalized/passthrough/provider-auth fixture가 기존 status/body/stream 의미를 보존해야 한다.
- 공통 provider 완료에 Responses live smoke는 요구하지 않는다.

### Verification Context

- Go 검증은 -count=1로 fresh evidence를 만든다.
- 외부 network, credential, live provider는 사용하지 않는다.
- 선행 Messages task의 complete.log가 직접 dependency source of truth다.

### Test Coverage Gaps

- Existing Responses tests do not prove explicit profile operation/capability admission.
- Unsupported explicit profiles are not proven to reject before dispatch.
- Legacy no-profile fallback and normalized/provider-auth behavior need regression coverage beside the new operation.

### Symbol References

- Public route /v1/responses and existing DTO/handler names remain unchanged.
- The new Operation takes precedence only for explicit profiles; Path remains the mixed-version fallback.

### Split Judgment

- The original 03+02_contract_responses_sync pair is split once into Responses production regression, Pi regression, and a dependent contract/spec closure.
- This child owns only the Responses production path and its focused tests.
- Pi installer files and contract/spec documents are excluded.

### Scope Rationale

- Profile schema and Messages behavior belong to predecessors and are not redesigned here.
- A source defect outside this Responses boundary is recorded as a blocker rather than hidden in docs.
- Full package/Edge/Node verification and roadmap completion evidence belong to 05+03,04_contract_spec_sync.

### Final Routing

- status: routed; evaluation_mode: isolated-reassessment; finalizer: finalize-task-policy.sh (pair).
- build closures: scope/context/verification/evidence/ownership/decision all true; capability gap none.
- build grade scores: scope_coupling=1, state_concurrency=0, blast_irreversibility=1, evidence_diagnosis=1, verification_complexity=1 -> G04.
- build route: base=local-fit, large_indivisible_context=false, matched loop risk=boundary_contract (1), review_rework_count=0, evidence_integrity_failure=false, route=local-fit.
- review closures: all true; grade scores 1/0/1/1/1 -> G04; route=official-review, cloud, Codex gpt-5.6-sol, xhigh.
- canonical files: PLAN-local-G04.md, CODE_REVIEW-cloud-G04.md.

## Dependencies and Execution Order

1. 02+01_messages_ingress — agent-task/m-multi-provider-protocol-profile-native-messages/02+01_messages_ingress/complete.log must exist.
2. Implement operation/capability admission before running the focused compatibility suite.

## Implementation Checklist

- [ ] Migrate provider-pool Responses passthrough to the optional profile operation/capability boundary while preserving legacy no-profile, normalized, stream, provider-auth, and body/status semantics.
- [ ] Add S08 focused tests for explicit supported/unsupported profiles and legacy fallback.
- [ ] Run the focused Responses/provider-auth verification with fresh Go results.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [API-1] Optional Responses profile operation without behavior drift

#### Problem

Provider-pool Responses constructs a tunnel with literal Path=/v1/responses. Explicit profiles must admit the responses operation/capability, while legacy no-profile routes retain the old path fallback. Responses must remain optional rather than becoming a universal provider baseline.

#### Solution

Set the profile operation id for explicit profiles and filter candidates by optional Responses support. Preserve Path=/v1/responses for mixed-version fallback. Leave normalized execution validation, passthrough bytes/SSE, provider auth, and stream-gate behavior unchanged. Reject explicit profiles without Responses support before dispatch.

#### Modified Files and Checklist

- [ ] apps/edge/internal/openai/responses_handler.go: set Responses operation and candidate capability predicate without changing normalized semantics.
- [ ] apps/edge/internal/openai/provider_tunnel.go: propagate operation through direct/pool/recovery templates while preserving path fallback and auth.
- [ ] apps/edge/internal/openai/responses_protocol_profile_test.go: add explicit-supported, explicit-unsupported, legacy fallback, body/status/stream/provider-auth cases.

#### Test Strategy

Add TestResponsesProtocolProfileOperationPassthrough, TestResponsesProtocolProfileUnsupportedRejectsBeforeDispatch, TestResponsesLegacyProfileFallback, and table subtests for non-stream, stream, and provider auth. Assert operation/path, exact output bytes/status, zero unsupported dispatch, and unchanged normalized SubmitRun behavior.

#### Verification

~~~bash
go test -count=1 ./apps/edge/internal/openai -run 'TestResponses(ProtocolProfile|LegacyProfileFallback)'
go test -count=1 ./apps/edge/internal/openai -run 'TestResponses|Test.*ProviderAuth'
~~~

Expected: explicit capability controls only profile-aware passthrough, and all existing Responses/provider-auth behavior remains unchanged.

## Modified Files Summary

| File | Items |
|------|-------|
| `apps/edge/internal/openai/responses_handler.go` | API-1 |
| `apps/edge/internal/openai/provider_tunnel.go` | API-1 |
| `apps/edge/internal/openai/responses_protocol_profile_test.go` | API-1 |
| `agent-task/m-multi-provider-protocol-profile-native-messages/03+02_responses_profile/CODE_REVIEW-cloud-G04.md` | evidence |

## Final Verification

Run after predecessor PASS:

~~~bash
test -f agent-task/m-multi-provider-protocol-profile-native-messages/02+01_messages_ingress/complete.log
command -v go && go version && go env GOROOT
go test -count=1 ./apps/edge/internal/openai -run 'TestResponses(ProtocolProfile|LegacyProfileFallback)'
go test -count=1 ./apps/edge/internal/openai -run 'TestResponses|Test.*ProviderAuth'
git diff --check
~~~

Expected: dependency exists, S08 Responses regressions pass, unsupported profiles dispatch nothing, and diff check is clean.

After completing all code changes, fill implementation-owned sections in CODE_REVIEW-*-G??.md.
