<!-- task=m-iop-agent-chronos-extraction-decoupling/17+15,16_canonical_promotion_closure plan=1 tag=REVIEW_REFACTOR milestone-task=handoff-gate -->

# Canonical Promotion Integration Rework

## For the Implementing Agent

Execute only the implementation, verification, and evidence steps in this plan. Do not classify user-review state, create control-plane stop files, archive this task pair, write `complete.log`, change roadmap completion state, or enable the Chronos dependency lock. If a guarded precondition fails, record the exact blocker and recovery state in the active code-review artifact and stop safely.

## Background

The first canonical promotion attempt safely aborted after `git cherry-pick 7b90b7e5af9035fae2b5349c65eb322096d21b1b` exposed 34 conflicts against canonical commit `c3a24ec5febab9fc978fd62392efcb6c96e12ec9`. The attempt preserved the canonical three-file roadmap patch and left no unmerged state, but no extraction code reached canonical IOP and none of the required canonical regression commands ran. This follow-up rebuilds the reviewed extraction change on the exact canonical base in an isolated worktree, explicitly preserves the newer managed credential/TLS/projection work, then performs the guarded canonical promotion and closure evidence steps.

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-iop-agent-chronos-extraction-decoupling/17+15,16_canonical_promotion_closure/plan_cloud_G10_0.log`
- Prior review: `agent-task/m-iop-agent-chronos-extraction-decoupling/17+15,16_canonical_promotion_closure/code_review_cloud_G10_0.log`
- Prior verdict: `FAIL`
- Required finding count: `1`
- Suggested finding count: `0`
- Nit count: `0`
- Review routing signals: `review_rework_count=1`, `evidence_integrity_failure=false`
- Recovery evidence retained by the failed attempt:
  - roadmap patch: `/tmp/iop-canonical-promotion.QOCOar/canonical-roadmap.patch`
  - conflict inventory: `/tmp/iop-canonical-promotion.QOCOar/unexpected-conflicts.txt`
  - retained stash at review time: `stash@{0}` named `iop-canonical-promotion-roadmap-20260802T102956Z`
  - roadmap patch SHA-256: `1f1afe533e910b6311390071e07799bf6cc24ca742853bb45a3eceb3da1d4575`
  - conflict inventory SHA-256: `15e564744e83accd74981a5976432d14d8638815cab0fefc1d1eaabe97a4aca4`

## Analysis

### Files Read

- Active task artifacts: the current `PLAN-cloud-G10.md`, `CODE_REVIEW-cloud-G10.md`, and the exact Task 15/16 predecessor `complete.log` evidence named by the plan.
- Project workflow: project rules, roadmap rules/current pointer, code-review skill, plan skill, final routing skill, review stub template, local testing rules, and applicable Node, Edge, Control Plane, Client, platform-common, and testing domain rules.
- Roadmap/SDD: the active automation-runtime-bridge Phase, `iop-agent-chronos-extraction-decoupling` Milestone, and its approved/unlocked SDD.
- Current canonical/staging evidence: both worktree statuses and identities, canonical dirty roadmap diff, retained recovery patch/stash/conflict inventory, lock checker output, HANDOFF promotion fields, and Agent UI sync/component state.
- Conflict documents: `Makefile`, `go.mod`, `agent-contract/index.md`, the four affected inner contracts, `agent-contract/outer/openai-compatible-api.md`, the selected roadmap/phase/milestone/queue documents, related active roadmap/SDD documents, `agent-spec/index.md`, and the four affected implementation specs in both staging and canonical forms.
- Conflict source and tests: `apps/edge/internal/node/registry.go`, `apps/edge/internal/openai/dispatch_context.go`, `apps/edge/internal/transport/connection_handlers.go`, `apps/node/internal/node/node.go`, `apps/node/internal/node/tunnel_handler.go`, `apps/node/internal/node/provider_tunnel_test.go`, `packages/go/config/edge_types.go`, `proto/iop/control.proto`, and `proto/iop/runtime.proto` in both staging and canonical forms, plus adjacent managed-route, registration, config, credential-lease, workspace-removal, and cancellation test references.
- Generated/document surfaces: generated Go binding headers and change shape, `docs/edge-local-dev-guide.md`, canonical/staging HANDOFF files, and canonical/staging Agent UI sync and console-shell component documents.

### SDD Criteria

The approved SDD requires S05 `handoff-gate` evidence to prove traceable disposition, state transfer, deletion, regression, rollback, and the still-disabled downstream lock in one composite receipt. The checklist therefore requires: an exact reviewed source commit; an explicit 34-path three-way merge disposition; preservation of current canonical credential/TLS/projection behavior; deletion of IOP Agent/workspace/terminal ownership; deterministic wire regeneration; fresh canonical runtime, Flutter, wire, reconnect, readability, credential, and boundary verification; mirrored HANDOFF/UI evidence; preserved rollback artifacts; and a disabled Chronos lock. Final milestone archive and lock enable remain excluded.

### Verification Context

- Supplied and freshly reproduced facts:
  - staging promotion commit `7b90b7e5af9035fae2b5349c65eb322096d21b1b` has parent `1debc7ada01d98442560bbc4ac52dcef9cae25cc`;
  - canonical `dev` and `origin/dev` were both `c3a24ec5febab9fc978fd62392efcb6c96e12ec9` at review time;
  - the staging promotion is not a canonical ancestor;
  - canonical still tracks 83 files under the forbidden legacy Agent surfaces sampled by the review;
  - canonical has exactly three intentional dirty roadmap files and no unmerged entry;
  - the saved patch and retained stash patch reproduce the reported digest and semantic user edits;
  - the conflict inventory has exactly 34 paths and reproduces its reported digest;
  - the Chronos dependency lock is still `disable`.
- External precondition: implementation must re-prove that canonical `HEAD`, `dev`, and `origin/dev` are exactly the reviewed `c3a24ec5febab9fc978fd62392efcb6c96e12ec9`. Any advance requires a new overlap review and is a blocker for this fixed-base plan.
- Confidence: high for the failure cause and recovery state; medium-high for the merge recipe because the exact conflicts are known, but the combined result must be established only by compilation, focused dual-boundary tests, and the complete canonical matrix.

#### External Verification Preflight

Run from `/config/workspace/iop-s1` before creating or modifying any integration state:

```bash
test "$(git -C /config/workspace/iop symbolic-ref --short HEAD)" = dev
test "$(git -C /config/workspace/iop rev-parse HEAD)" = c3a24ec5febab9fc978fd62392efcb6c96e12ec9
test "$(git -C /config/workspace/iop rev-parse origin/dev)" = c3a24ec5febab9fc978fd62392efcb6c96e12ec9
test "$(git rev-parse HEAD)" = 7b90b7e5af9035fae2b5349c65eb322096d21b1b
test "$(git rev-parse 7b90b7e5af9035fae2b5349c65eb322096d21b1b^1)" = 1debc7ada01d98442560bbc4ac52dcef9cae25cc
test "$(git -C /config/workspace/iop diff --name-only | LC_ALL=C sort)" = $'agent-roadmap/phase/automation-runtime-bridge/PHASE.md\nagent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md\nagent-roadmap/priority-queue.md'
test -z "$(git -C /config/workspace/iop diff --name-only --diff-filter=U)"
test "$(sha256sum /tmp/iop-canonical-promotion.QOCOar/canonical-roadmap.patch | awk '{print $1}')" = 1f1afe533e910b6311390071e07799bf6cc24ca742853bb45a3eceb3da1d4575
test "$(sha256sum /tmp/iop-canonical-promotion.QOCOar/unexpected-conflicts.txt | awk '{print $1}')" = 15e564744e83accd74981a5976432d14d8638815cab0fefc1d1eaabe97a4aca4
test "$(wc -l < /tmp/iop-canonical-promotion.QOCOar/unexpected-conflicts.txt)" -eq 34
git -C /config/workspace/iop diff --check
```

Expected: every guard exits 0. Preserve the recovery patch and existing named stash. On any mismatch, do not stash, cherry-pick, resolve, or commit; record the mismatch in the review artifact.

### Test Coverage Gaps

No new product capability is introduced. The risk is a bad three-way merge that independently valid extraction and credential-plane tests do not catch together. Preserve the upstream credential lease test in `provider_tunnel_test.go`, preserve the extraction cancellation test using the provider-only `CancelRequest{run_id}`, and add or adjust focused regression assertions only where the integrated source has no existing test for a merged boundary. Full fresh Go execution and the credential-slot smoke are mandatory; cached `go test` output is not accepted.

### Symbol References

- Extraction symbols to remove or reserve: `AgentKind`, `WorkspaceRequired`, `RunSessionMode`, `CancelAction`, `AgentUsageStatus`, CLI adapter config, `metadata.workspace`, and the `packages/go/agentruntime` package name.
- Upstream symbols to preserve: `EdgeCredentialPlaneConf`, nested TLS config, `PrincipalProjection`, `ProjectedPrincipalToken`, `ProjectedPrincipalRoute`, `SignedCredentialLease`, `CredentialLeaseBinding`, recipient key fields on node registration/registry entries, trusted managed route metadata, and `credentiallease.Consumer`.
- Provider-neutral successor: `packages/go/execution` owns runtime request/event/provider types after extraction and must receive auto-merged upstream credential additions formerly made under `packages/go/agentruntime`.

### Split Judgment

Do not split. The merge commit, canonical promotion, UI/HANDOFF reconciliation, and final composite receipt form one guarded transaction. Splitting would allow a code merge or evidence update to be reviewed without the canonical regression and rollback proof required by S05.

### Scope Rationale

The only required fix is canonical integration of the already reviewed extraction commit on the newer canonical base. The plan does not add features, push branches, archive the milestone, enable the Chronos lock, delete recovery stashes, or rewrite unrelated user work. Unrelated canonical roadmap content is retained; extraction-related wording is merged only where required to remove stale IOP Agent ownership.

### Final Routing

- Evaluation mode: isolated reassessment
- Build route basis: `grade-boundary`
- Build large indivisible context: `false`
- Positive risk categories: `temporal_state`, `boundary_contract`, `structured_interpretation`
- Review feedback: `review_rework_count=1`, `evidence_integrity_failure=false`
- Build lane/grade: `cloud/G10`
- Review lane/grade: `cloud/G10`
- Routed files: `PLAN-cloud-G10.md`, `CODE_REVIEW-cloud-G10.md`

## Implementation Checklist

- [ ] Rebuild the reviewed extraction change on exact canonical base `c3a24ec5febab9fc978fd62392efcb6c96e12ec9` in an isolated integration worktree and resolve all 34 overlaps with recorded dispositions.
- [ ] Prove the integrated result preserves managed credential/TLS behavior and removes IOP Agent ownership, then promote it to canonical while restoring the three-file user roadmap patch.
- [ ] Reconcile canonical Agent UI and mirrored HANDOFF evidence with exact promotion identities while keeping the Chronos lock disabled.
- [ ] Run the complete final verification matrix, retain rollback evidence, and fill implementation-owned sections in `CODE_REVIEW-*-G??.md` with actual output.

### [REVIEW_REFACTOR-1] Build an explicit canonical-base integration commit

**Problem**

The reviewed extraction commit is based on `1debc7a`, while canonical `c3a24ec` adds managed principal projection, mTLS peer identity, credential recipient registration, sealed credential leases, config fields, generated wire bindings, tests, and extensive contract/docs content. The failed direct cherry-pick found 34 conflicts. Choosing staging or canonical wholesale would respectively drop security work or retain removed Agent/workspace ownership.

**Solution**

Create a task-specific detached worktree under `/tmp` from exact canonical `c3a24ec`. Apply `7b90b7e5` with `git cherry-pick --no-commit`, confirm the unmerged path set exactly matches the retained 34-line inventory, and resolve every path using the matrix below. Do not resolve generated bindings manually. After source proto resolution, run the repository generators, `go mod tidy`, format changed Go, and create one integration commit whose parent is exactly `c3a24ec`.

Resolution matrix:

| Paths | Required disposition |
|------|----------------------|
| `Makefile`, `go.mod` | Remove Agent build/parity/smoke targets and Agent-only dependencies; preserve credential-slot smoke, secure-delivery wire coverage, managed credential dependencies, and provider-only targets. Run `go mod tidy` rather than hand-pruning shared dependencies. |
| `agent-contract/index.md`, affected inner contracts, `agent-contract/outer/openai-compatible-api.md` | Preserve managed projection, exact route/slot/revision binding, mTLS, recipient-sealed lease, stream-gate, provider passthrough, metrics, and reconnect semantics. Remove workspace authoring, CLI Agent/session/terminal ownership, Agent-specific status/commands, and stale `agentruntime` references. Point provider-neutral runtime semantics to `execution-runtime.md`. |
| `agent-spec/index.md` and four affected specs | Synthesize current managed credential/TLS/route evidence with the extraction boundary. Keep Control Plane credential ownership and Edge/Node provider execution; remove IOP task loop, workspace, terminal, CLI Agent, session termination, and Agent command ownership. Preserve current source-of-truth paths after the `agentruntime` to `execution` move. |
| selected automation roadmap/milestone and `priority-queue.md` | Apply the extraction completion/evidence state while preserving the canonical user-owned `[separation-01]` edits and queue placement. Do not mark the milestone complete or archive it. |
| other conflicting active roadmap/SDD files | Preserve all unrelated `c3a24ec` content and incorporate only extraction boundary substitutions needed to replace IOP Agent/CLI/session/terminal ownership with Chronos ownership. Do not reorder unrelated milestones or regress newer roadmap work. |
| `apps/edge/internal/node/registry.go` | Remove `AgentKind` defaulting and storage; preserve immutable credential recipient key id/public key and connection-generation/dispatch-ready fencing, including clone safety. |
| `apps/edge/internal/openai/dispatch_context.go` | Remove workspace parsing/validation/storage; preserve route-aware trusted managed metadata overwrite for route id/revision and credential slot/revision. |
| `apps/edge/internal/transport/connection_handlers.go` | Remove AgentKind registration/event metadata; preserve authenticated mTLS node identity validation and credential recipient fields from `RegisterRequest`. |
| `apps/node/internal/node/node.go`, `tunnel_handler.go`, `provider_tunnel_test.go` | Use `packages/go/execution`; preserve `credentiallease.Consumer`, admission-before-consumption, exact binding validation, secret zeroing, and replay rejection. Preserve provider-only run-id cancellation and remove action/session termination requirements. |
| `packages/go/config/edge_types.go` | Preserve credential-plane and nested TLS configuration. Remove AgentKind, workspace-required routing, and console Agent aliases while retaining provider route/session correlation fields that remain in the reviewed extraction contract. |
| `proto/iop/control.proto`, `proto/iop/runtime.proto` and generated Go/Dart outputs | Preserve projection/lease/recipient wire messages and fields. Reserve the removed workspace/session-mode/cancel-action/usage-status/CLI config/control-plane domain-agent field numbers and names exactly as staged. Regenerate all bindings; never take ours/theirs for generated files. |
| `docs/edge-local-dev-guide.md` | Preserve current provider quickstart, managed credential/TLS startup, safe slot lifecycle, and redaction guidance. Remove `agent_kind`, CLI/workspace-agent instructions, and stale Agent ownership without replacing the full guide with the short staging version. |

Before committing, record a deterministic table in the active review artifact with each of the 34 paths, its disposition category, and the evidence command used. Verify no conflict marker or unmerged entry remains and inspect the integrated diff against both parents for unexpected deletions of credential/TLS work or retention of Agent surfaces.

**Modified Files and Checklist**

- [ ] Create an isolated detached integration worktree from exact `c3a24ec` without mutating either existing worktree.
- [ ] Apply `7b90b7e5` without committing and prove the unmerged set exactly matches the retained 34-path inventory.
- [ ] Resolve every conflict using the matrix and preserve auto-merged upstream credential additions moved into `packages/go/execution`.
- [ ] Regenerate Go and Dart protobuf bindings from resolved source proto files; do not edit generated bindings manually.
- [ ] Run formatting/tidy and create an integration commit with parent exactly `c3a24ec`.
- [ ] Save exact integration worktree path, commit id, parent id, resolved-path inventory digest, and diff summaries in the active review artifact.

**Test Strategy**

This is an internal integration repair. Preserve and update existing tests; add a focused assertion only if the merged boundary is otherwise untested. The minimum focused set must exercise managed route metadata, mTLS/recipient registration, registry clone fencing, credential lease consume/replay behavior, provider-only cancel, config rejection, and wire round-trip/reservation behavior.

**Intermediate Verification**

Run from the isolated integration worktree after resolution and before promotion:

```bash
test "$(git rev-parse HEAD)" = c3a24ec5febab9fc978fd62392efcb6c96e12ec9
test -z "$(git diff --name-only --diff-filter=U)"
if rg --sort path -n '^(<<<<<<<|=======|>>>>>>>)' --glob '!agent-task/**'; then exit 1; fi
git diff --name-only --diff-filter=ACM -z -- '*.go' | xargs -0 -r gofmt -w
go mod tidy
make proto
make proto-dart
go test -count=1 ./packages/go/config ./packages/go/credentiallease ./apps/edge/internal/node ./apps/edge/internal/transport ./apps/edge/internal/openai ./apps/node/internal/node
git diff --check
```

After committing the integrated source, require `test "$(git rev-parse HEAD^)" = c3a24ec5febab9fc978fd62392efcb6c96e12ec9`, rerun `go mod tidy`, `make proto`, and `make proto-dart`, then require `git diff --exit-code`. Expected: all commands exit 0; generated output is reproducible; the integration commit parent is exact canonical base; no unmerged path or marker exists.

### [REVIEW_REFACTOR-2] Qualify and promote the integrated commit without losing user state

**Problem**

Canonical contains an intentional uncommitted three-file roadmap patch. Promotion must neither commit nor discard it. The failed attempt retained both a patch and named stash, but canonical has not received the integrated code and its full test matrix remains unexecuted.

**Solution**

First run the complete source/regression and boundary qualification in the isolated integration worktree. Only after it passes, write a fresh copy of the canonical three-file diff to the same task-specific recovery directory, hash it, create a newly named safety stash limited to those exact files, and confirm canonical is clean. Fetch the integration commit into a task-specific canonical ref and fast-forward `dev` from exact `c3a24ec` to that commit. Apply, but do not drop, the new safety stash. If patch application conflicts, resolve only the three roadmap files by retaining both the reviewed extraction state and the user `[separation-01]`/queue edits, then verify the restored semantic diff. Leave both old and new recovery stashes intact.

Do not push. Do not use reset, force checkout, or destructive cleanup. If integration qualification, stash creation, fast-forward, or restoration fails, preserve the exact state and record a blocker rather than improvising a broader history rewrite.

**Modified Files and Checklist**

- [ ] Run all qualification commands in the isolated integration worktree and require zero failures.
- [ ] Save and hash a fresh exact three-file canonical roadmap patch and create a new named safety stash limited to those paths.
- [ ] Prove canonical is clean, still based on exact `c3a24ec`, and fast-forward only to the qualified integration commit.
- [ ] Restore the three-file user roadmap patch without committing it and prove the same user decisions remain present alongside extraction state.
- [ ] Retain the original and new recovery patch/stash locators and record their digests.
- [ ] Confirm canonical has no unmerged entry and only the intentional roadmap patch plus later evidence edits are dirty.

**Test Strategy**

Run the full fresh suite in the isolated result before promotion, then repeat the canonical suite after promotion. This dual execution prevents a valid temp result from masking canonical state or environment drift.

**Intermediate Verification**

Run from the isolated integration worktree:

```bash
mkdir -p .tmp
TMPDIR="$PWD/.tmp" GOTMPDIR="$PWD/.tmp" go test -count=1 ./...
make client-test
make client-build-web
make test-control-plane-edge-wire
make test-credential-slot-smoke
make readability-audit
IOP_DEV_RECONNECT_BIND_TIMEOUT=60 scripts/dev/edge-node-reconnect-diagnostic.sh
git diff --exit-code
```

Expected: all commands exit 0 and the committed integration worktree stays clean. After canonical fast-forward and user-patch restoration, require `git merge-base --is-ancestor <integration-commit> /config/workspace/iop/HEAD`, `git diff --check`, no unmerged path, and an exact sorted dirty-path set of the three roadmap files before evidence reconciliation.

### [REVIEW_REFACTOR-3] Reconcile UI and promotion evidence while the lock stays closed

**Problem**

Canonical Agent UI still describes the removed Agent shell and has no reconciled milestone record. Both HANDOFF files still report `canonical_promotion: pending`. SDD S05 requires actual commit identities, verification evidence, rollback locators, state-transfer receipts, and downstream lock state; placeholder or staging-only evidence is insufficient.

**Solution**

After canonical runtime and Flutter verification passes, execute the repository's `complete-milestone` check-only workflow. If closure-ready, execute the routed `sync-agent-ui mode=reconcile-milestone-completion` workflow for this exact milestone, validate Agent UI, and repeat check-only. Update canonical console-shell/component index and sync state to the provider-only, reconciled milestone state, then mirror those exact bytes into this workspace.

Update canonical and local `HANDOFF.md` with `canonical_promotion: applied`, the reviewed staging commit `7b90b7e5...`, actual qualified integration/canonical promotion commit, UTC verification timestamp, canonical base, exact recovery patch/stash locators and hashes, 34-conflict disposition evidence, full test results, and the still-disabled lock result. Preserve all Task 13-16 receipt/digest pointers. Do not archive the milestone or enable the lock.

**Modified Files and Checklist**

- [ ] Run milestone check-only before and after Agent UI reconciliation; do not run completion/archive mode.
- [ ] Reconcile `/config/workspace/iop/agent-ui/.sync-state.json`, console-shell component definition, and components index only after canonical Flutter verification passes.
- [ ] Mirror those exact three Agent UI files into this workspace.
- [ ] Update canonical and local `HANDOFF.md` with exact applied promotion, conflict-resolution, verification, recovery, and lock evidence.
- [ ] Preserve all existing Task 13-16 receipt and digest pointers.
- [ ] Prove the dependency checker still returns the Chronos boundary and its lock entry remains `disable`.

**Test Strategy**

No new UI test source is required. Existing Flutter tests/build plus Agent UI validation and byte equality are the gates. HANDOFF checks validate actual commit objects/ancestry, exact 40-hex fields, retained digests, and disabled lock output.

**Intermediate Verification**

```bash
cmp /config/workspace/iop/agent-ui/.sync-state.json agent-ui/.sync-state.json
cmp /config/workspace/iop/agent-ui/definition/components/console-shell/index.md agent-ui/definition/components/console-shell/index.md
cmp /config/workspace/iop/agent-ui/definition/components/index.md agent-ui/definition/components/index.md
cmp /config/workspace/iop/HANDOFF.md HANDOFF.md
jq -e '.pending_milestone_work | length == 0' agent-ui/.sync-state.json
jq -e '.reconciled_milestone_work | any(.milestone_path == "agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md" and .state == "reconciled")' agent-ui/.sync-state.json
rg -n '^canonical_promotion: applied$|^staging_promotion_commit: [0-9a-f]{40}$|^canonical_promotion_commit: [0-9a-f]{40}$|^canonical_promotion_verified_at: ' HANDOFF.md
agent-ops/bin/roadmap-dependency-checker.sh --find-milestone 'iop:agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md' both /config/workspace/.agent-roadmap-sync/locks.yaml
rg -n -A4 'id: chronos:chronos-architecture-ownership-boundary' /config/workspace/.agent-roadmap-sync/locks.yaml
```

Expected: mirrored files are byte-identical; pending milestone work is empty; the exact milestone appears as reconciled; promotion fields contain actual ids; dependency checker prints `rely-on:chronos:chronos-architecture-ownership-boundary`; lock status remains `disable`.

### [REVIEW_REFACTOR-4] Run final canonical and cross-workspace closure verification

**Problem**

The failed attempt did not run canonical Go, Flutter, wire, reconnect, readability, credential, generated-wire, or final boundary checks. A promotion claim without fresh canonical results and recoverable user state cannot close the Required finding.

**Solution**

Run the full canonical matrix again after UI/HANDOFF evidence edits, save long stdout/stderr under a task-specific ignored `/tmp` evidence directory, and paste concise actual output or the exact saved paths and commands into the active review artifact. Re-run deterministic boundary searches, generated-file reproducibility, commit ancestry, dirty-state, mirrored-evidence, lock, and rollback checks. Keep the integration worktree and recovery artifacts until review finalization. Do not write `complete.log`, archive the milestone, or enable the lock.

**Modified Files and Checklist**

- [ ] Execute every final verification command with fresh Go test execution and record actual outputs or exact saved output paths.
- [ ] Prove generated Go/Dart bindings remain reproducible and canonical contains no unmerged or conflict-marker state.
- [ ] Prove forbidden Agent/workspace/terminal ownership surfaces and old package roots are absent from active runtime/config/wire paths.
- [ ] Prove the canonical promotion commit is an ancestor of canonical `HEAD` and the user roadmap diff remains recoverable.
- [ ] Fill all implementation-owned sections in `agent-task/m-iop-agent-chronos-extraction-decoupling/17+15,16_canonical_promotion_closure/CODE_REVIEW-cloud-G10.md` and leave review-only sections unchanged.

**Test Strategy**

This is the final regression and evidence gate. Fresh canonical execution is required; no test cache substitution is accepted. Any failed command, missing output, unexpected forbidden surface, lost user patch, unmerged entry, or enabled lock leaves the item incomplete.

**Verification**

Run from `/config/workspace/iop`:

```bash
mkdir -p .tmp
TMPDIR="$PWD/.tmp" GOTMPDIR="$PWD/.tmp" go test -count=1 ./...
make client-test
make client-build-web
make test-control-plane-edge-wire
make test-credential-slot-smoke
make readability-audit
IOP_DEV_RECONNECT_BIND_TIMEOUT=60 scripts/dev/edge-node-reconnect-diagnostic.sh
go mod tidy
make proto
make proto-dart
git diff --check
test -z "$(git diff --name-only --diff-filter=U)"
```

After generation, require no source/generated drift outside the intentional evidence/user-roadmap edits. Then run:

```bash
if rg --sort path -n -i 'chronos|agent_bridge|iop-agent|iop_agent|IopAgent|agentruntime|agentprovider|agenttask|agentworkspace' apps packages/go cmd proto configs; then exit 1; fi
test ! -d apps/agent
test -z "$(find packages/go -maxdepth 1 -type d -name 'agent*' -print -quit)"
test ! -e proto/iop/agent.proto
test ! -e proto/gen/iop/agent.pb.go
test -z "$(git diff --name-only --diff-filter=U)"
rg -n '^status: 구현됨$|^Status: `구현됨`$' agent-ui/definition/components/console-shell/index.md
jq -e '.pending_milestone_work | length == 0' agent-ui/.sync-state.json
jq -e '.reconciled_milestone_work | any(.milestone_path == "agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md" and .state == "reconciled")' agent-ui/.sync-state.json
rg -n '^canonical_promotion: applied$|^staging_promotion_commit: [0-9a-f]{40}$|^canonical_promotion_commit: [0-9a-f]{40}$' HANDOFF.md
git merge-base --is-ancestor "$(sed -n 's/^canonical_promotion_commit: //p' HANDOFF.md)" HEAD
```

Run from `/config/workspace/iop-s1`:

```bash
git diff --check
cmp /config/workspace/iop/HANDOFF.md HANDOFF.md
cmp /config/workspace/iop/agent-ui/.sync-state.json agent-ui/.sync-state.json
cmp /config/workspace/iop/agent-ui/definition/components/console-shell/index.md agent-ui/definition/components/console-shell/index.md
cmp /config/workspace/iop/agent-ui/definition/components/index.md agent-ui/definition/components/index.md
agent-ops/bin/roadmap-dependency-checker.sh --find-milestone 'iop:agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md' both /config/workspace/.agent-roadmap-sync/locks.yaml
rg -n -A4 'id: chronos:chronos-architecture-ownership-boundary' /config/workspace/.agent-roadmap-sync/locks.yaml
```

Expected: all runtime, UI, credential, wire, readability, reconnect, generator, boundary, ancestry, mirroring, rollback, and lock checks pass. Canonical may remain dirty only for the intentional three-file user roadmap patch and post-promotion evidence/UI files. The active review artifact contains exact recovery locators and actual command evidence.

## Modified Files Summary

| File | Items |
|------|-------|
| `HANDOFF.md` | REVIEW_REFACTOR-3, REVIEW_REFACTOR-4 |
| `agent-ui/.sync-state.json` | REVIEW_REFACTOR-3, REVIEW_REFACTOR-4 |
| `agent-ui/definition/components/console-shell/index.md` | REVIEW_REFACTOR-3, REVIEW_REFACTOR-4 |
| `agent-ui/definition/components/index.md` | REVIEW_REFACTOR-3, REVIEW_REFACTOR-4 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/17+15,16_canonical_promotion_closure/CODE_REVIEW-cloud-G10.md` | REVIEW_REFACTOR-1, REVIEW_REFACTOR-2, REVIEW_REFACTOR-3, REVIEW_REFACTOR-4 |

## Final Verification

The final verification contract is the union of every command in REVIEW_REFACTOR-1 through REVIEW_REFACTOR-4. Run commands in their stated worktree and order. Record actual stdout/stderr; when output is long, save it under the exact task-specific `/tmp` evidence directory and record both the path and command. Require all exit codes to be zero, no unexplained dirty or unmerged path, no forbidden runtime surface, exact mirrored evidence, recoverable user state, and a still-disabled Chronos lock.

After completing all implementation and verification work, fill every implementation-owned section in `CODE_REVIEW-*-G??.md` and stop for review.
