<!-- task=m-iop-owned-single-request-agent-execution/04+02_preset_refresh plan=1 tag=API milestone-task=preset-binding -->

# Fixed Single-request Preset Refresh and Schema

## For the Implementing Agent

Do not start until packet 02 has `complete.log`. Implement this plan exactly within the listed write boundary, run every verification command, fill all implementation-owned sections of `CODE_REVIEW-cloud-G06.md` with actual notes and stdout/stderr, keep both active files in place, and report ready for review. Finalization belongs only to the code-review skill. If blocked, record exact blocker evidence, attempted commands/output, and the resume condition; do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Archive Evidence Snapshot

- Superseded refined pair: `plan_local_G05_0.log`, `code_review_cloud_G06_0.log`.
- The superseded pair and its split parent contained no implementation evidence or review verdict; implementation has not started.
- Fresh-review correction: retain live-refresh/schema ownership, use the exact predecessor archive candidate pattern, and restore the required Edge vet baseline.

## Background

Packet 01 introduces the operator-owned fixed single-request policy. SDD S02 also requires live-refresh generation isolation and an operator-visible schema without leaking endpoint, credential, Node, or raw workspace values.

## Analysis

### Files Read

- `apps/edge/internal/configrefresh/classify.go`
- `apps/edge/internal/configrefresh/execution_preset_classify_test.go`
- `configs/edge.yaml`
- `agent-contract/inner/edge-config-runtime-refresh.md`
- `agent-spec/runtime/provider-pool-config-refresh.md`
- `agent-ops/rules/project/domain/edge/rules.md`
- `agent-test/local/edge-smoke.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-owned-single-request-agent-execution.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md`

### SDD Criteria

- SDD status is approved and its implementation lock is released.
- First-line Milestone task: `preset-binding`; targeted Acceptance Scenario: S02.
- This child supplies refresh-path and published-schema evidence. Packet 01 owns decode/validation/cloning, while packet 02 owns authorization/model echo and request-start binding isolation.

### Verification Context

- The parent packet selected focused config-refresh tests, Edge regression, and `git diff --check`; the Edge profile also requires `go vet ./apps/edge/...`, restored here.
- Precondition: packet 02 completion. This sequencing avoids concurrent writes to `agent-spec/runtime/provider-pool-config-refresh.md` while retaining packet 01 transitively.

### Test Coverage Gaps

- Existing refresh tests do not report the fixed single-request policy as its own live-applied path or prove deterministic previous/next value capture.

### Symbol References

- No symbol is renamed or removed. `appendExecutionPresetChanges` is the existing classifier extended by this child.

### Split Judgment

- Stable result: the typed policy is classified as a live-applied request-generation change and published without claiming runtime execution.
- The production classifier and its executable test remain together; the config example, contract, and spec describe that same behavior.

### Scope Rationale

- Exclude config type/validation, route authorization, handlers, provider execution, Node/workspace execution, protobuf, and SSE.
- Document exact absolute caps and new-request snapshot semantics only. Do not claim coordinator or real-provider execution.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer `finalize-task-policy.sh` in `pair` mode.
- Build closures scope/context/verification/evidence/ownership/decision are true; scores 1/1/1/1/1 = G05; base/final route `local-fit`; lane `local`; canonical filename `PLAN-local-G05.md`.
- Build signals: `large_indivisible_context=false`; positive loop risks `boundary_contract`, `concurrent_consistency`, `variant_product` (3); `review_rework_count=0`; `evidence_integrity_failure=false`; no capability gap.
- Review closures are true; scores 2/1/1/1/1 = G06; route `official-review`; lane `cloud`; canonical filename `CODE_REVIEW-cloud-G06.md`.

## Dependencies and Execution Order

1. Verify packet 02 completion evidence; it transitively includes packet 01's typed policy and serializes the shared refresh spec write.
2. Add the classifier path and focused test.
3. Publish the secret-free example, contract, and current spec, then run Edge regression.

## Implementation Checklist

- [ ] Classify fixed single-request policy changes as live-applied, add a secret-free commented config example, and synchronize the config contract and current implementation spec.
- [ ] Run dependency, targeted config-refresh, Edge vet, full Edge regression, and `git diff --check` verification.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Implementation Plan

### [API-2] Preserve refresh semantics and publish the schema

**Problem**

- `apps/edge/internal/configrefresh/classify.go:371` compares selector, modes, routes, and workspace tools but cannot report the fixed single-request policy independently.
- `configs/edge.yaml:340`, `agent-contract/inner/edge-config-runtime-refresh.md:62`, and `agent-spec/runtime/provider-pool-config-refresh.md:93` publish generic model/preset refresh only and do not describe a secret-free fixed single-request generation.

**Solution**

Before (`apps/edge/internal/configrefresh/classify.go:383`):

```go
appendDeepIfChanged(changes, fmt.Sprintf("execution_presets[%q].routes", id), StatusApplied, cur.Routes, next.Routes)
appendDeepIfChanged(changes, fmt.Sprintf("execution_presets[%q].workspace_tools", id), StatusApplied, cur.WorkspaceTools, next.WorkspaceTools)
```

After:

```go
appendDeepIfChanged(changes, fmt.Sprintf("execution_presets[%q].routes", id), StatusApplied, cur.Routes, next.Routes)
appendDeepIfChanged(changes, fmt.Sprintf("execution_presets[%q].single_request", id), StatusApplied, cur.SingleRequest, next.SingleRequest)
appendDeepIfChanged(changes, fmt.Sprintf("execution_presets[%q].workspace_tools", id), StatusApplied, cur.WorkspaceTools, next.WorkspaceTools)
```

Classify the policy as live-applied and document the exact absolute caps plus the rule that refresh affects only new request snapshots. Add only a commented, secret-free YAML example; synchronize contract/spec without claiming runtime execution.

**Modified Files and Checklist**

- [ ] `apps/edge/internal/configrefresh/classify.go` — emit the precise single-request change path.
- [ ] `apps/edge/internal/configrefresh/execution_preset_classify_test.go` — prove value capture and deterministic ordering.
- [ ] `configs/edge.yaml` — add a commented fixed-light example only.
- [ ] `agent-contract/inner/edge-config-runtime-refresh.md` — define validation, compatibility, refresh generation, and secret rules.
- [ ] `agent-spec/runtime/provider-pool-config-refresh.md` — synchronize current schema and executable evidence.

**Test Strategy**

- Extend `TestClassifyExecutionPresetLiveApply` with differing policy snapshots and assert the exact sorted change path plus previous/next values.
- Use packet 01's config loader tests as the decoder/validator oracle; no external config smoke is needed.

**Verification**

- `go test ./apps/edge/internal/configrefresh -run 'TestClassifyExecutionPresetLiveApply$' -count=1`
- Expected: the classifier reports the policy path as applied with deterministic ordering.

## Modified Files Summary

| File | Item |
|------|------|
| `apps/edge/internal/configrefresh/classify.go` | API-2 |
| `apps/edge/internal/configrefresh/execution_preset_classify_test.go` | API-2 |
| `configs/edge.yaml` | API-2 |
| `agent-contract/inner/edge-config-runtime-refresh.md` | API-2 |
| `agent-spec/runtime/provider-pool-config-refresh.md` | API-2 |
| `agent-task/m-iop-owned-single-request-agent-execution/04+02_preset_refresh/CODE_REVIEW-cloud-G06.md` | API-2 |

## Final Verification

1. `test -f agent-task/m-iop-owned-single-request-agent-execution/02+01_preset_binding/complete.log || test "$(compgen -G 'agent-task/archive/*/*/m-iop-owned-single-request-agent-execution/02+01_preset_binding/complete.log' | wc -l)" -eq 1`
2. `go test ./apps/edge/internal/configrefresh -run 'TestClassifyExecutionPresetLiveApply$' -count=1`
3. `go test ./apps/edge/internal/configrefresh -count=1`
4. `go vet ./apps/edge/...`
5. `go test ./apps/edge/... -count=1`
6. `git diff --check`

Expected: all commands exit 0; predecessor evidence exists; refresh reports the fixed policy path with deterministic values; the example and documents remain secret-free. Runtime authorization and coordinator execution remain outside this child.

**After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.**
