<!-- task=m-node-provider-execution-liveness-recovery/12+08_health_overlay_observability plan=5 tag=REVIEW_REVIEW_REVIEW_REFACTOR milestone-task=ops-evidence -->

# Close Every Remaining Direct Provider-Health Leakage Input

## For the Implementing Agent

Implement only the test-oracle repair selected below, run every verification command, and fill all implementation-owned sections of `CODE_REVIEW-cloud-G03.md` with actual notes and raw output. Keep the active files in place and report ready for review; finalization belongs to the code-review skill. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The prior follow-up populated the direct protobuf fields named in its immediate finding, but the plan's broader all-input leakage invariant remains incomplete. The normalized terminal still omits one raw response field and one identity field, and the tunnel terminal still omits two identity fields, so SDD S06 can still receive false-positive raw-free evidence. This packet closes that remaining test-only gap without changing production behavior.

## Archive Evidence Snapshot

- Prior pair: `agent-task/m-node-provider-execution-liveness-recovery/12+08_health_overlay_observability/plan_cloud_G03_4.log` and `agent-task/m-node-provider-execution-liveness-recovery/12+08_health_overlay_observability/code_review_cloud_G03_4.log`; verdict `FAIL` with Required R1.
- R1 evidence: `RunEvent.Delta`, `RunEvent.NodeAlias`, `ProviderTunnelFrame.TunnelId`, and `ProviderTunnelFrame.NodeAlias` remain empty, so the leakage oracle does not cover every direct high-cardinality/raw protobuf input required by the PLAN and SDD S06.
- Reviewer verification: focused verbose, count-20 sentinel, count-20 observability, race, vet, and diff checks passed. The full service package did not terminate within more than two minutes while the independently owned active sibling `09+08_retry_candidate_policy` was changing the same package; it was stopped without modifying sibling files.
- Carryover: preserve the normalized/tunnel unavailable-stale-recovery matrix, public snapshots, production `Capabilities` recovery, existing direct-field sentinels, complete metric/log scans, production observer/overlay, contracts, specs, roadmap, and prior smoke evidence unchanged.

## Finding Resolution Map

| Finding | Mode | Exact resolution | Changed precondition |
|---------|------|------------------|----------------------|
| Required R1 | `direct-fix` | Populate direct `RunEvent.Delta`, `RunEvent.NodeAlias`, `ProviderTunnelFrame.TunnelId`, and `ProviderTunnelFrame.NodeAlias` with distinct sentinels and include every new value in the forbidden set scanned across all metric labels and dedicated structured-log messages, keys, and values. | The oracle will fail if any remaining direct normalized raw output or normalized/tunnel identity reaches provider-health observability. |

## Analysis

### Files Read

- `apps/edge/internal/service/provider_health_observability_test.go`
- `apps/edge/internal/service/provider_health_observability.go`
- `apps/edge/internal/service/provider_health_overlay_test.go`
- `apps/edge/internal/service/service.go`
- `apps/edge/internal/service/provider_tunnel.go`
- `apps/edge/internal/service/model_queue_release.go`
- `apps/edge/internal/service/model_queue_snapshot.go`
- `apps/edge/internal/service/node_command.go`
- `proto/gen/iop/runtime.pb.go`
- `agent-contract/inner/edge-node-runtime-wire.md`
- `agent-contract/inner/edge-config-runtime-refresh.md`
- `agent-spec/runtime/provider-pool-config-refresh.md`
- `agent-roadmap/phase/operational-observability-provider-management/PHASE.md`
- `agent-roadmap/phase/operational-observability-provider-management/milestones/node-provider-execution-liveness-recovery.md`
- `agent-roadmap/sdd/operational-observability-provider-management/node-provider-execution-liveness-recovery/SDD.md`
- `agent-test/local/rules.md`
- `agent-test/local/edge-smoke.md`
- `agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/08+07_health_overlay/complete.log`
- `agent-task/m-node-provider-execution-liveness-recovery/12+08_health_overlay_observability/plan_cloud_G03_4.log`
- `agent-task/m-node-provider-execution-liveness-recovery/12+08_health_overlay_observability/code_review_cloud_G03_4.log`

### SDD Criteria

- SDD: `agent-roadmap/sdd/operational-observability-provider-management/node-provider-execution-liveness-recovery/SDD.md`; status `[승인됨]`; `milestone-task=ops-evidence`.
- Acceptance Scenario S06 requires provider-health metrics/logs and snapshots that expose no high-cardinality identity or raw content.
- Evidence Map S06 requires metric-label guards and structured-log capture. The direct raw `RunEvent.Delta` and high-cardinality normalized/tunnel identity fields therefore belong in the same input-derived forbidden-value oracle as the fields already covered.

### Verification Context

- No external handoff was supplied. Repository-native review used Go `1.26.2`, module `/config/workspace/iop-s1/go.mod`, the approved SDD, current generated protobuf field definitions, the production reception/observation paths, and private Prometheus/zap fixtures.
- Fresh reviewer commands passed for focused verbose, count-20 sentinel, count-20 observability, race, vet, and diff checks. The full service package remained active for more than two minutes during concurrent sibling work and was stopped; this packet does not own `apps/edge/internal/service/provider_recovery_selection_test.go`.
- No external runner, credential, smoke environment, or full-cycle runtime is required because the repair changes only a deterministic test oracle and preserves production behavior.
- Confidence is high: the four empty direct fields are explicit in the generated protobuf types and the fix is confined to one test.

### Test Coverage Gaps

- `RunEvent.Delta` does not carry a raw response sentinel.
- `RunEvent.NodeAlias`, `ProviderTunnelFrame.TunnelId`, and `ProviderTunnelFrame.NodeAlias` do not carry high-cardinality identity sentinels.
- Existing normalized/tunnel matrix, public snapshots, recovery, duplicate-terminal, collector reuse, post-lock, and all previously added leakage assertions already cover their intended behavior and remain unchanged.

### Symbol References

- None. No production symbol is renamed or removed.

### Split Judgment

- Keep one compact test-only packet. The four fields close one all-direct-input leakage invariant and share one deterministic oracle.
- Predecessor index `08` is satisfied by `agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/08+07_health_overlay/complete.log`.
- Active sibling `09+08_retry_candidate_policy` is unordered and owns a different test file.

### Scope Rationale

- Modify only `apps/edge/internal/service/provider_health_observability_test.go` and implementation-owned evidence in the active review stub.
- Do not modify production Go files, protobuf sources/generated output, contracts, specs, roadmap files, smoke scripts, or sibling task artifacts.
- In particular, do not modify `apps/edge/internal/service/provider_recovery_selection_test.go` or reinterpret its package-wide test state as this packet's ownership.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer=`finalize-task-policy.sh pair`.
- Build closures are all true; scores `(0,0,0,2,1)`, grade G03, base `local-fit`, escalated by `recovery-boundary` because `review_rework_count=3` and `evidence_integrity_failure=true`; canonical file `PLAN-cloud-G03.md`.
- Review closures are all true; scores `(0,0,0,2,1)`, grade G03, route `official-review`; canonical file `CODE_REVIEW-cloud-G03.md` (`codex`, `gpt-5.6-sol`, `xhigh`).
- `large_indivisible_context=false`; positive loop risks are `boundary_contract` and `variant_product` (2). `risk_boundary=false`; `recovery_boundary=true`; capability gap none.

## Implementation Checklist

- [ ] REVIEW_REVIEW_REVIEW_REFACTOR-1 populates direct `RunEvent.Delta`, `RunEvent.NodeAlias`, `ProviderTunnelFrame.TunnelId`, and `ProviderTunnelFrame.NodeAlias` with distinct sentinels, adds every new value to the complete forbidden set, retains every existing leakage scan, and passes the count-20 focused oracle.
- [ ] Run the focused, package, race, vet, and diff commands in Final Verification with fresh output; if the independently owned active sibling still prevents the package command from passing or terminating, record its exact test/path and output without modifying it.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_REVIEW_REVIEW_REFACTOR-1] Exercise the remaining direct protobuf inputs

**Problem:** `apps/edge/internal/service/provider_health_observability_test.go:307` populates several normalized identities and error fields but leaves `Delta` and `NodeAlias` empty. The tunnel fixture at `apps/edge/internal/service/provider_health_observability_test.go:346` populates its run/node/header/body/error inputs but leaves `TunnelId` and `NodeAlias` empty. These omissions preserve a false-negative path in the S06 leakage guard.

**Solution:** Give each remaining direct raw/identity field a distinct sentinel and include those exact sentinels in the shared forbidden set before gathering metrics and logs.

Before (`apps/edge/internal/service/provider_health_observability_test.go:307`):

```go
event := &iop.RunEvent{
    RunId: forbiddenValues[2], Type: "error",
    NodeId: "SECRET_EVENT_NODE_ID_11111", SessionId: "SECRET_EVENT_SESSION_ID_22222",
    Message: "SECRET_EVENT_MESSAGE_33333", Error: "SECRET_EVENT_ERROR_44444",
    Failure: failure, Metadata: failure.Metadata,
}
```

After:

```go
event := &iop.RunEvent{
    RunId: forbiddenRunID, Type: "error", Delta: forbiddenDelta,
    NodeId: forbiddenEventNodeID, NodeAlias: forbiddenEventNodeAlias,
    SessionId: forbiddenSessionID, Message: forbiddenMessage, Error: forbiddenError,
    Failure: failure, Metadata: failure.Metadata,
}
frame := &iop.ProviderTunnelFrame{
    RunId: forbiddenFrameRunID, TunnelId: forbiddenTunnelID,
    NodeId: forbiddenFrameNodeID, NodeAlias: forbiddenFrameNodeAlias,
    Headers: map[string]string{forbiddenHeaderName: forbiddenCredential},
    Body: []byte(forbiddenBody), Error: forbiddenFrameError,
    Kind: iop.ProviderTunnelFrameKind_PROVIDER_TUNNEL_FRAME_KIND_ERROR,
    Failure: frameFailure, Metadata: frameFailure.Metadata,
}
```

**Modified Files and Checklist:**

- [ ] `apps/edge/internal/service/provider_health_observability_test.go`: populate the four remaining direct fields and extend the forbidden set.
- [ ] `agent-task/m-node-provider-execution-liveness-recovery/12+08_health_overlay_observability/CODE_REVIEW-cloud-G03.md`: record decisions and fresh command output.

**Test Strategy:** Strengthen `TestProviderHealthObservabilityDoesNotExposeSentinels` in the existing file. The test must fail if any of the four new input sentinels appears in any gathered metric label or dedicated log message/key/value; no new production test file is needed.

**Verification:** `go test -count=20 ./apps/edge/internal/service -run '^TestProviderHealthObservabilityDoesNotExposeSentinels$'` must pass every iteration after source inspection confirms all four direct fields carry distinct forbidden values.

## Modified Files Summary

| File | Item |
|------|------|
| `apps/edge/internal/service/provider_health_observability_test.go` | REVIEW_REVIEW_REVIEW_REFACTOR-1 |
| `agent-task/m-node-provider-execution-liveness-recovery/12+08_health_overlay_observability/CODE_REVIEW-cloud-G03.md` | REVIEW_REVIEW_REVIEW_REFACTOR-1 |

## Final Verification

Fresh Go output is required; cached output is not acceptable.

1. `go test -v -count=1 ./apps/edge/internal/service -run '^TestProviderHealthObservability'` — PASS and display normalized, tunnel, duplicate, default-collector, lock-safety, and forbidden-input rows.
2. `go test -count=20 ./apps/edge/internal/service -run '^TestProviderHealthObservabilityDoesNotExposeSentinels$'` — PASS every iteration for the complete direct-input leakage oracle.
3. `go test -count=20 ./apps/edge/internal/service -run '^TestProviderHealthObservability'` — PASS every iteration for the full observability set.
4. `go test -timeout=90s -count=1 ./apps/edge/internal/service` — PASS when independently owned active sibling tests are valid; if an out-of-scope sibling still fails or times out, record its exact test/path and raw output without modifying it.
5. `go test -race -count=3 ./apps/edge/internal/service -run '^TestProviderHealthObservability'` — PASS with no race report.
6. `go vet ./apps/edge/internal/service` — no diagnostics.
7. `git diff --check` — no whitespace errors.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
