<!-- task=m-iop-agent-cli-runtime/14+13_cli_config_fixtures plan=2 tag=REVIEW_API -->

# Restore the Separate Provider Catalog Boundary

## For the Implementing Agent

Filling implementation-owned sections in `CODE_REVIEW-cloud-G04.md` is mandatory. Run every verification command, record actual notes and output, leave the active files in place, and report ready for review. Finalization is code-review-only. If blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence; do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The split runtime fixture currently embeds an incomplete copy of the canonical provider catalog. Restore the planned three-input boundary so the runtime fixture owns defaults and policy, while `configs/iop-agent.providers.yaml` remains the single source for executable provider profiles.

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-iop-agent-cli-runtime/14+13_cli_config_fixtures/plan_local_G06_1.log`
- Prior review: `agent-task/m-iop-agent-cli-runtime/14+13_cli_config_fixtures/code_review_cloud_G06_1.log`
- Verdict: FAIL
- Findings: Required=1, Suggested=0, Nit=0. The runtime fixture duplicates the provider catalog and omits executable profile arguments and modes.
- Affected files: `configs/iop-agent.runtime.yaml`, `apps/agent/internal/command/config_test.go`
- Verification evidence: fresh `go test -count=1 ./apps/agent/internal/command ./packages/go/agentconfig`, `go vet ./apps/agent/internal/command ./packages/go/agentconfig`, `gofmt -d`, secret/path scans, and untracked-file whitespace checks passed.
- Roadmap carryover: none. This strict subset remains Milestone-adjacent and must not mark `cli-surface` complete on PASS.

## Analysis

### Files Read

- `configs/iop-agent.runtime.yaml`
- `configs/iop-agent.local.example.yaml`
- `configs/iop-agent.providers.yaml`
- `apps/agent/internal/command/config_test.go`
- `packages/go/agentconfig/runtime_config.go`
- `packages/go/agentconfig/runtime_config_test.go`
- `packages/go/agentconfig/catalog.go`
- `packages/go/agentconfig/validate.go`
- `packages/go/agentconfig/catalog_test.go`
- `packages/go/agentconfig/default_catalog_test.go`
- `packages/go/agentprovider/catalog/factory.go`
- `agent-contract/inner/agent-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- `agent-task/archive/2026/07/m-iop-agent-cli-runtime/13_agent_domain/complete.log`
- `agent-task/m-iop-agent-cli-runtime/18+14,15_cli_command_tree/PLAN-local-G06.md`
- `agent-task/m-iop-agent-cli-runtime/14+13_cli_config_fixtures/plan_local_G06_1.log`
- `agent-task/m-iop-agent-cli-runtime/14+13_cli_config_fixtures/code_review_cloud_G06_1.log`

### SDD Criteria

`agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md` is approved and unlocked. S10 maps to `cli-surface`; its Evidence Map requires split configuration plus later binary/command integration and a headless transcript. This follow-up repairs only the split configuration input boundary and regression evidence, so it does not carry `Roadmap Targets`; command, binary, and transcript evidence remain downstream closure work.

### Verification Context

No external handoff was supplied. Repository-native sources were `agent-test/local/rules.md`, `agent-test/local/platform-common-smoke.md`, `agent-test/local/testing-smoke.md`, the active plan, contracts, loader tests, and safe local probes. The checkout uses `/config/.local/bin/go`, Go 1.26.2 on Linux arm64, with intentional unrelated uncommitted work; the three fixture-task files are untracked, so final whitespace verification must use an untracked-aware `git diff --no-index --check` loop. No external service, credential, port, binary, or field runner is required. Full-cycle CLI execution is not available in this strict fixture child and remains explicitly deferred to the command/binary/transcript dependents; confidence in the local regression oracle is high.

### Test Coverage Gaps

- Current coverage proves that the two runtime documents load, but it incorrectly requires an embedded catalog.
- No regression assertion proves the runtime document omits catalog ownership while every configured profile reference resolves through `configs/iop-agent.providers.yaml`.
- Existing `TestRepositoryDefaultCatalog` validates the canonical catalog itself; the follow-up test must validate the cross-file fixture references without changing production loader ownership.

### Symbol References

None. No symbol is renamed or removed.

### Split Judgment

This is one compact fixture/test invariant: removing the duplicate source and proving external reference resolution must pass together. Runtime predecessor 13 is satisfied by `agent-task/archive/2026/07/m-iop-agent-cli-runtime/13_agent_domain/complete.log`.

### Scope Rationale

Do not change `packages/go/agentconfig` loader APIs, canonical provider catalog content, the user-local example, Cobra commands, the binary, Makefile targets, contracts, or roadmap state. The downstream command layer already owns explicit `--repo-config`, `--local-config`, and `--provider-catalog` composition.

### Final Routing

- evaluation_mode: `isolated-reassessment`
- finalizer: `finalize-task-policy.sh pair`
- build: closure complete, `local-G04`, basis `local-fit`, filename `PLAN-local-G04.md`
- review: closure complete, `cloud-G04`, basis `official-review`, filename `CODE_REVIEW-cloud-G04.md`
- large_indivisible_context: `false`
- positive loop risks: `boundary_contract`, `structured_interpretation` (count `2`)
- recovery signals: review rework `1`, evidence-integrity failure `false`
- capability-gap evidence: none

## Implementation Checklist

- [x] Remove the embedded provider catalog and add regression assertions that runtime references resolve through the separate canonical catalog.
- [x] Run fresh focused and affected-package tests, vet, formatting, secret-key, and untracked-file whitespace checks.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_API-1] Restore the Separate Catalog Fixture Boundary

#### Problem

`configs/iop-agent.runtime.yaml:5-69` duplicates `configs/iop-agent.providers.yaml` but omits profile execution arguments, resume arguments, mode, output format, persistence, and concurrency. `apps/agent/internal/command/config_test.go:79-81` then locks in that invalid duplication by requiring the merged runtime catalog to be non-empty.

#### Solution

Remove the `catalog` block from the runtime fixture. Load `configs/iop-agent.providers.yaml` independently in `TestTrackedRuntimeExamplesLoad`, assert that the runtime snapshot has no embedded catalog, and verify the default profile, aliases, selection default, and every selection-rule profile resolve through the canonical catalog.

Before (`configs/iop-agent.runtime.yaml:5-8`):

```yaml
catalog:
  version: "1"
  providers:
    - id: codex
```

After:

```yaml
defaults:
  default_profile: claude-headless
```

#### Modified Files and Checklist

- [x] `configs/iop-agent.runtime.yaml` — remove the duplicate provider catalog.
- [x] `apps/agent/internal/command/config_test.go` — load the canonical catalog separately and assert all runtime profile references resolve.

#### Test Strategy

Update `TestTrackedRuntimeExamplesLoad` as the regression test. It must fail if the runtime document embeds catalog entries, if the canonical catalog does not load strictly, or if any default, alias, selection default, or selection-rule profile is absent from the canonical catalog. Keep `TestValidateDoesNotMutateRepoConfig` unchanged.

#### Verification

```bash
gofmt -w apps/agent/internal/command/config_test.go
go test -count=1 ./apps/agent/internal/command -run 'TestTrackedRuntimeExamplesLoad|TestValidateDoesNotMutateRepoConfig'
```

Expected: both fresh fixture tests pass with the catalog loaded only from `configs/iop-agent.providers.yaml`.

## Dependencies and Execution Order

Predecessor 13 is complete at `agent-task/archive/2026/07/m-iop-agent-cli-runtime/13_agent_domain/complete.log`. This follow-up must PASS before `18+14,15_cli_command_tree` consumes the fixtures.

## Modified Files Summary

| File | Item |
|------|------|
| `configs/iop-agent.runtime.yaml` | REVIEW_API-1 |
| `apps/agent/internal/command/config_test.go` | REVIEW_API-1 |

## Final Verification

```bash
gofmt -w apps/agent/internal/command/config_test.go
go test -count=1 ./apps/agent/internal/command -run 'TestTrackedRuntimeExamplesLoad|TestValidateDoesNotMutateRepoConfig'
go test -count=1 ./packages/go/agentconfig
go vet ./apps/agent/internal/command ./packages/go/agentconfig
! rg --sort path -n '^[[:space:]]*(token|password|secret|api_key|authorization)[[:space:]]*:' configs/iop-agent.runtime.yaml configs/iop-agent.local.example.yaml configs/iop-agent.providers.yaml
for file in configs/iop-agent.runtime.yaml configs/iop-agent.local.example.yaml apps/agent/internal/command/config_test.go; do
  output=$(git diff --no-index --check /dev/null "$file" 2>&1 || true)
  if [ -n "$output" ]; then
    printf '%s\n' "$output"
    exit 1
  fi
done
```

Expected: fresh tests and vet pass, no forbidden secret-bearing YAML key is found, formatting is stable, and every planned file is free of whitespace errors even while untracked. Cached test output is not accepted.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
