<!-- task=m-iop-owned-single-request-agent-execution/16+14,15_observation_evidence plan=1 tag=REVIEW_API milestone-task=cleanup-observation -->

# Repair Linked Single-request Observation Evidence

## For the Implementing Agent

Resolve Required findings R1 and R2 exactly as mapped below. Extend the existing real-POST test through the production service observation adapter, correct only the two inconsistent living-spec statements, run every verification command, and fill `CODE_REVIEW-cloud-G05.md`. Do not change production lifecycle behavior, metric/log schemas, public API behavior, or external Claude/Mac qualification scope.

## Background

The first implementation added a real Anthropic POST test and spec claims, but review found that the test observes only the ingress counter and fake workspace call counts. It never installs the production lifecycle observer or proves request, stage, tool, cleanup, terminal, label, log-correlation, and privacy evidence. The spec edits also leave raw-free cleanup observation both deferred and claimed complete, while elevating the whole input-surface document beyond its index status.

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-iop-owned-single-request-agent-execution/16+14,15_observation_evidence/plan_local_G03_0.log`
- Prior review: `agent-task/m-iop-owned-single-request-agent-execution/16+14,15_observation_evidence/code_review_cloud_G03_0.log`
- Verdict: `FAIL` with Required findings R1 and R2.
- R1: the real-POST test does not install the production service observation logger, snapshot lifecycle metric families, assert closed lifecycle deltas, or correlate raw-free logs.
- R2: the runtime spec still defers raw-free cleanup observation while claiming it is tested, and the input-surface spec status conflicts with `agent-spec/index.md`.
- Verification evidence: fresh focused/package tests, vet, dependency checks, and `git diff --check` passed, but the claimed lifecycle/log assertions are absent and the recorded spec-search output is not the command's actual stdout.
- Roadmap carryover: keep `milestone-task=cleanup-observation`; deterministic S07 evidence remains in scope and actual Claude/Mac timing qualification remains deferred to S12 `claude-smoke`.

## Analysis

### Files Read

- `agent-task/m-iop-owned-single-request-agent-execution/16+14,15_observation_evidence/plan_local_G03_0.log`
- `agent-task/m-iop-owned-single-request-agent-execution/16+14,15_observation_evidence/code_review_cloud_G03_0.log`
- `apps/edge/internal/openai/single_request_handler_test.go`
- `apps/edge/internal/service/single_request_metrics.go`
- `apps/edge/internal/service/single_request_metrics_test.go`
- `apps/edge/internal/service/single_request_observation.go`
- `apps/edge/internal/service/single_request_observation_test.go`
- `apps/edge/internal/service/service.go`
- `apps/edge/internal/bootstrap/runtime.go`
- `apps/edge/internal/bootstrap/single_request_observation_test.go`
- `apps/node/internal/workspace/observation.go`
- `apps/node/internal/workspace/observation_test.go`
- `agent-spec/index.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-contract/outer/anthropic-compatible-api.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-owned-single-request-agent-execution.md`
- `agent-task/archive/2026/08/m-iop-owned-single-request-agent-execution/14+05,12,13_observation_timing/complete.log`
- `agent-task/archive/2026/08/m-iop-owned-single-request-agent-execution/15+14_observation_adapters/complete.log`

### Finding Resolution Map

| Finding | Disposition | Direct-fix Targets | Verified Current Evidence | Required Change |
|---------|-------------|--------------------|---------------------------|-----------------|
| R1 | direct-fix | `apps/edge/internal/openai/single_request_handler_test.go` | `TestAnthropicSingleRequestObservation` creates the service and checks ingress plus fake open/tool/cleanup counts, but never installs `SetSingleRequestObservationLogger` or asserts the production lifecycle metric/log projections. | Install the production service observation adapter with a captured logger, take before/after lifecycle metric snapshots, assert exact request/stage/tool/cleanup/terminal deltas and closed labels, then prove every lifecycle log shares one bounded non-empty correlation and excludes all private sentinels. |
| R2 | direct-fix | `agent-spec/input/openai-compatible-surface.md`; `agent-spec/runtime/edge-node-execution.md` | The runtime limitations defer raw-free cleanup observation immediately before claiming it is tested; input-surface frontmatter says `구현됨` while its index entry remains `부분`. | Remove only the stale cleanup-observation deferral, preserve the separate provider-driver and Claude qualification deferrals, and restore the input-surface document status to `부분` without broadening any implementation claim. |

### Revalidated Outcome, Acceptance, and Exclusions

- Outcome: one deterministic marked Anthropic POST proves the production Edge observation projections that S07 requires and the living specs state exactly that proven boundary.
- Acceptance: ingress delta is one; lifecycle metrics prove exactly one request total and terminal plus the expected stage, tool, and cleanup deltas; every label uses the closed allowlist; captured lifecycle logs share one bounded generated correlation; public output and logs exclude private tool protocol, arguments, results, workspace references, and configured sentinels.
- Acceptance: `agent-spec/input/openai-compatible-surface.md` returns to `status: 부분`, and the runtime limitation no longer says raw-free cleanup observation is deferred while still keeping provider-specific drivers and actual Claude/Mac qualification deferred.
- Exclusions: no production Go file, metric/log field, API or wire contract, Node behavior, dashboard/ledger, prompt policy, or external Claude/Mac execution changes.

### SDD Criteria

- S07 requires raw-free stage/tool/cleanup/total timing and outcome evidence across the single-request path.
- The S07 Evidence Map requires cleanup-race, user-result-preservation, and raw-free timing/log/metric allowlist coverage; this child closes only the linked deterministic observation evidence assigned by its split contract.
- S12 separately owns actual Claude/Mac timing qualification and remains deferred to `claude-smoke`.
- D10 keeps internal tools, arguments, results, and workspace references absent from caller output and operational observation.

### Verification Context

- Packets 14 and 15 are uniquely archived with PASS `complete.log` evidence and provide the timing semantics and production observation adapters consumed here.
- Fresh review reruns passed the focused endpoint test, the full OpenAI package, vet, both dependency checks, and whitespace verification; these results establish a stable baseline but not the missing semantic assertions.
- The production service metric observer uses the default Prometheus registry, so the endpoint test must snapshot and compare only its request-local closed series rather than assume process-global zero values.
- No handoff or external runner is required. Actual Claude/Mac smoke is explicitly excluded.

### State and Concurrency Findings

- The test exercises one request with ordered stage/tool/cleanup transitions and an exactly-once terminal; before/after metric deltas must isolate that request from process-global collectors.
- The generated correlation is allowed in captured application logs but prohibited from metric labels and caller output.
- Observer installation is service-local. The test must not mutate production defaults or register new collectors.

### Test Coverage Gaps

- The existing endpoint test does not consume the production service observer and therefore cannot prove request-total, terminal, semantic stage/tool/cleanup lifecycle deltas, duration series, or closed labels.
- It does not capture `edge_single_request_observation`, compare correlation across lifecycle events, or run the privacy sentinel allowlist against those logs.
- The spec verification was a broad search whose recorded output was manually summarized; the follow-up uses semantic test assertions and deterministic status/deferral checks.

### Symbol References

- Extend only `TestAnthropicSingleRequestObservation` in `apps/edge/internal/openai/single_request_handler_test.go`.
- Use the production service observation setter and existing metric/log projections; do not recreate lifecycle semantics in an OpenAI-local fake.
- Reuse the captured zap observer pattern already exercised by bootstrap/service observation tests.
- Preserve `iop_anthropic_single_request_ingress_total` as an unlabeled OpenAI ingress counter and compare it separately from the service lifecycle collectors.

### Split Judgment

- This remains the integration/closure-only child downstream of packets 14 and 15.
- The three-file direct-fix set is atomic because the endpoint evidence and the two living-spec claims must describe the same verified boundary.
- No new sibling split is needed: the write set is compact and all dependencies are complete.

### Scope Rationale

- Include one production-adapter endpoint assertion repair and two exact living-spec corrections.
- Exclude production changes because the review found missing evidence and contradictory documentation, not a runtime defect.
- Keep milestone ownership on `cleanup-observation`; do not claim completion for `claude-smoke`.

### Final Routing

- `evaluation_mode=isolated-reassessment`; build closures are all true and scores `scope=1`, `state=1`, `blast=0`, `evidence=2`, `verification=1` produce G05.
- Finalizer `finalize-task-policy.sh` in `pair` mode selected build `route_basis=recovery-boundary`, lane `cloud`, filename `PLAN-cloud-G05.md`.
- Build signals: `large_indivisible_context=false`; matched loop-risk signatures are `concurrent_consistency` and `boundary_contract`; `loop_risk_count=2`; `risk_boundary_matched=false`; `review_rework_count=1`; `evidence_integrity_failure=true`; `recovery_boundary_matched=true`.
- Review closures are all true with the same G05 scores; official review filename is `CODE_REVIEW-cloud-G05.md`.

## Dependencies and Execution Order

1. Preserve the completed packet 14 timing semantics and packet 15 production adapters unchanged.
2. Repair R1 in the existing real-POST observation test using the production service observer and process-global metric deltas.
3. Repair R2 in the two living specs after the test proves the precise observation boundary.
4. Run all deterministic verification and record literal stdout/stderr in the review stub.

## Implementation Checklist

- [ ] Resolve R1 by proving exact ingress/request/stage/tool/cleanup/terminal deltas, closed labels, one shared bounded correlation, and raw-free public/log projections through the production observation adapter.
- [ ] Resolve R2 by restoring the input-surface status to `부분` and removing only the stale cleanup-observation deferral while preserving external Claude/Mac and provider-driver deferrals.
- [ ] Keep production lifecycle, metrics, log schemas, API/wire contracts, and Node behavior unchanged.
- [ ] Run every dependency, focused, package, vet, deterministic spec-consistency, and whitespace command with cache disabled where specified.
- [ ] Fill every implementation-owned section in `CODE_REVIEW-cloud-G05.md` with literal implementation notes and command output.

## Implementation Plan

### [REVIEW_API-1] Repair lifecycle evidence and living-spec consistency

**Problem**

- The current real-POST test calls the real coordinator but measures only ingress and fake workspace listener counts. Its comment and specs claim lifecycle metric/log evidence that no assertion observes.
- Runtime documentation simultaneously defers and claims raw-free cleanup observation, and input-surface frontmatter is inconsistent with its index entry.

**Current Evidence Before the Fix**

- `TestAnthropicSingleRequestObservation` creates `service, node := newAnthropicInternalToolService(...)`, snapshots only `singleRequestIngressTotal`, and gathers only `iop_anthropic_single_request_ingress_total`.
- The test has no `SetSingleRequestObservationLogger` call and no assertion over `iop_edge_single_request_lifecycle_total`, `iop_edge_single_request_duration_seconds`, or `edge_single_request_observation`.
- `agent-spec/runtime/edge-node-execution.md` says “raw-free cleanup observation ... remain separate work” immediately before its implemented evidence statement.
- `agent-spec/input/openai-compatible-surface.md` has `status: 구현됨`; `agent-spec/index.md` retains `부분` for that spec.

**Solution**

Install the existing production service observation adapter on the test service using an in-memory zap observer. Snapshot the production lifecycle metric families before the request, execute the same marked POST with its two private tools and cleanup, and compare after-state series by the closed lifecycle labels. Require the exact request-total/terminal, stage, tool, and cleanup deltas established by the production lifecycle semantics, and require the expected duration observations without request-derived labels. Inspect every captured `edge_single_request_observation` entry: require the closed event/phase/outcome fields, one common non-empty bounded generated correlation, and absence of internal tool names, raw arguments/results, workspace references, request payload text, and sentinel values. Retain the existing public-terminal privacy and unlabeled-ingress assertions.

Then restore the input-surface frontmatter to `부분` and remove `raw-free cleanup observation` from the runtime spec's deferred list. Keep provider-specific plan/work/review drivers and actual Claude/Mac qualification explicitly deferred, and do not alter the documented deterministic observation contract beyond what the repaired test proves.

**Modified Files and Checklist**

- [ ] `apps/edge/internal/openai/single_request_handler_test.go` — install the production service observer and assert exact lifecycle metrics, labels, log correlation, and privacy for the real POST.
- [ ] `agent-spec/input/openai-compatible-surface.md` — restore the indexed partial status while retaining the scoped deterministic observation statement and external-smoke deferral.
- [ ] `agent-spec/runtime/edge-node-execution.md` — remove the stale cleanup-observation deferral and retain the still-deferred provider-driver/Claude boundaries.

**Test Strategy**

- Extend the existing endpoint test instead of adding a fake-only test, so the real handler, coordinator, service observer, workspace loop, cleanup, and terminal path remain connected.
- Use before/after deltas for default-registry collectors and inspect only the closed label combinations owned by this request flow.
- Capture the production log adapter with the existing zap observer technique, then assert correlation consistency and sentinel exclusion over the emitted lifecycle entries.
- Retain the package regression and vet checks; use direct status/deferral assertions instead of treating a broad documentation search as semantic proof.

**Verification**

- `go test ./apps/edge/internal/openai -run 'TestAnthropicSingleRequestObservation' -count=1`
- `go test ./apps/edge/internal/openai -count=1`
- Expected: the endpoint test fails if any required lifecycle delta, closed label, shared correlation, or privacy assertion is removed, while the package remains clean without production changes.

## Modified Files Summary

| File | Item |
|------|------|
| `apps/edge/internal/openai/single_request_handler_test.go` | REVIEW_API-1 / R1 |
| `agent-spec/input/openai-compatible-surface.md` | REVIEW_API-1 / R2 |
| `agent-spec/runtime/edge-node-execution.md` | REVIEW_API-1 / R2 |
| `agent-task/m-iop-owned-single-request-agent-execution/16+14,15_observation_evidence/CODE_REVIEW-cloud-G05.md` | REVIEW_API-1 evidence |

## Final Verification

1. `test -f agent-task/m-iop-owned-single-request-agent-execution/14+05,12,13_observation_timing/complete.log || test "$(compgen -G 'agent-task/archive/*/*/m-iop-owned-single-request-agent-execution/14+05,12,13_observation_timing/complete.log' | wc -l)" -eq 1`
2. `test -f agent-task/m-iop-owned-single-request-agent-execution/15+14_observation_adapters/complete.log || test "$(compgen -G 'agent-task/archive/*/*/m-iop-owned-single-request-agent-execution/15+14_observation_adapters/complete.log' | wc -l)" -eq 1`
3. `go test ./apps/edge/internal/openai -run 'TestAnthropicSingleRequestObservation' -count=1`
4. `go test ./apps/edge/internal/openai -count=1`
5. `go vet ./apps/edge/internal/openai`
6. `test "$(sed -n 's/^status: //p' agent-spec/input/openai-compatible-surface.md | head -n 1)" = "부분"`
7. `! rg --fixed-strings 'Those drivers, raw-free cleanup observation, and actual Claude qualification remain separate work' agent-spec/runtime/edge-node-execution.md`
8. `rg --sort path -n 'single-request observation evidence|stage-pure|raw-free correlation|Claude/Mac timing evidence.*deferred.*claude-smoke' agent-spec/input/openai-compatible-surface.md agent-spec/runtime/edge-node-execution.md`
9. `git diff --check`

Expected: packets 14 and 15 remain uniquely complete; the focused test proves the linked production lifecycle evidence with closed labels and raw-free logs; the full affected package and vet pass; the two specs are internally consistent and still defer only external Claude/Mac qualification; whitespace is clean. Cached test results are not acceptable.

**After completing all code changes, fill every implementation-owned section in `CODE_REVIEW-cloud-G05.md`.**
