<!-- task=m-iop-owned-single-request-agent-execution/21+20_single_request_executor plan=0 tag=API milestone-task=review-stage -->

# Plan, Work, Review composite executor

## For the Implementing Agent

Filling the implementation-owned sections of `CODE_REVIEW-cloud-G08.md` is the mandatory last implementation step. Run every verification command, paste actual output, keep both active files in place, and report ready for review; only the official code-review skill may append a verdict, archive files, write `complete.log`, or classify the next state. If blocked, record the exact blocker, attempted commands/output, and resume condition only in the review evidence fields; do not ask the user, call a user-input tool, create a control-plane stop file, or change the owner or scope.

## Background

The predecessor children provide private Plan, Work, and Review stage runners plus a request-safe continuation bridge. This child composes them behind the existing service executor/continuation contracts so one controller owns the full lifecycle and only reviewer-approved output can become terminal. Production installation remains deferred to the next child.

## Archive Evidence Snapshot

- Pre-refine parent plan: checkpoint `f4dad6ba88ae442e08ab67f49a5b1a65dd4719e9`, `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_stage/PLAN-cloud-G09.md`.
- Pre-refine parent review: checkpoint `f4dad6ba88ae442e08ab67f49a5b1a65dd4719e9`, `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_stage/CODE_REVIEW-cloud-G09.md`.
- The checkpoint pair contains no implementation evidence or official verdict; refinement split it once into three scope-preserving children. No active-log path is required after predecessor archival.

## Analysis

### Files Read

- The original parent PLAN/CODE_REVIEW pair and its recorded source, test, contract, and SDD findings.
- No source, test, archived log body, or verification output was reread for this refinement.

### SDD Criteria

- This child contributes `review-stage` by ensuring the reviewer is the sole final-output authority in the complete Plan → Work → Review lifecycle.
- One immutable binding and controller must span all stages, and request-local continuation state must be removed on every terminal path.

### Verification Context

- Deterministic full-lifecycle fixtures can prove composition, concurrency isolation, cancellation, cleanup, and final-output provenance without external providers.
- Production reachability and current contract/spec claims remain deferred to `22+21_executor_activation`.

### Test Coverage Gaps

- No production composite currently proves that Plan, Work, and Review share one controller and lifecycle.
- No composite test proves concurrent request isolation, cancellation, stage failure cleanup, or reviewer-only terminal provenance.

### Symbol References

- `SingleRequestExecutor`, `SingleRequestToolContinuation`, the predecessor stage runners, and the predecessor request-safe bridge are the existing composition boundaries.
- The public Anthropic request/event types and Edge input construction remain unchanged in this child.

### Split Judgment

- This child owns only composite construction and deterministic lifecycle proof.
- It depends on completed Review/repair and produces the stable constructor consumed by the activation child.
- The child is not recursively split in this refinement pass.

### Scope Rationale

Include the executor implementation, production constructor, request-safe continuation delegation, full-lifecycle tests, and cleanup/provenance evidence. Exclude input-manager installation, contract/spec synchronization, public schema changes, generic error/cancel quality work, and external qualification.

### Final Routing

- `evaluation_mode=isolated-reassessment`; all build/review closures are true; no capability gap.
- Build scores `2/2/1/1/2` => G08, base/route `local-fit`, `worker/local/G08`, `PLAN-local-G08.md`.
- Review scores `2/2/1/1/2` => G08, `official-review`, `review/cloud/G08`, `CODE_REVIEW-cloud-G08.md`.
- `large_indivisible_context=false`; loop risks `temporal_state`, `concurrent_consistency`, `boundary_contract` (3); `review_rework_count=0`; `evidence_integrity_failure=false`; finalizer `finalize-task-policy.sh`, mode `pair`.

## Dependencies and Execution Order

1. Before implementation or review, run the exact dependency command in Final Verification. It must print exactly one task-20 completion path from active or archive storage and exit zero.
2. Read only that resolved `complete.log`, then consume the completed Plan, Work, Review, artifact, and continuation APIs without reopening their ownership.
3. Prove deterministic full-lifecycle behavior and cleanup before reporting this child ready for review; do not install it in the input manager.

## Implementation Checklist

- [ ] Add a concurrent request-safe composite executor that drives Plan → Work → Review through one controller, reuses the completed continuation bridge, and returns only reviewer-approved output.
- [ ] Add pass, inspection, repair, concurrent isolation, cancellation, stage failure, final-output provenance, and waiter-cleanup fixtures under `-race`.
- [ ] Run dependency, focused race, service compatibility, OpenAI vet/regression, constructor search, and diff checks without production activation.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [API-1] Compose the three private stages

**Problem**

Installing stage runners independently would split lifecycle ownership, let a Work candidate become terminal, and leave continuation without a stable concurrent executor instance.

**Solution**

Add `single_request_executor.go` implementing existing service executor and continuation interfaces. Per request, run Plan, Work, and Review against one controller and immutable binding. Delegate tool results to the request-safe bridge, preserve cancellation and generic errors, return only Review-approved output, and remove every keyed bridge entry on terminal paths.

**Modified Files and Checklist**

- [ ] Add the composite and exported production constructor in `apps/edge/internal/openai/single_request_executor.go`.
- [ ] Add pass, inspection, repair, concurrent isolation, cancellation, stage failure, final-output provenance, and waiter-cleanup tests in `apps/edge/internal/openai/single_request_executor_test.go`.

**Test Strategy**

Drive deterministic full lifecycles through the real service controller with Work tools and Review inspection/repair variants. Assert legal monotonic envelopes, artifact order, reviewer-only terminal output, concurrent identity isolation under `-race`, and cleanup after injected failures.

**Verification**

Run focused executor race tests and unchanged service cleanup/tool-loop tests.

## Modified Files Summary

| File | Items |
|------|-------|
| `apps/edge/internal/openai/single_request_executor.go` | API-1 |
| `apps/edge/internal/openai/single_request_executor_test.go` | API-1 |
| `agent-task/m-iop-owned-single-request-agent-execution/21+20_single_request_executor/CODE_REVIEW-cloud-G08.md` | API-1 |

## Final Verification

Fresh output is required; Go tests use `-count=1` and cached output is not acceptable.

1. `bash -c 'set -euo pipefail; shopt -s nullglob; candidates=(agent-task/m-iop-owned-single-request-agent-execution/20_*/complete.log agent-task/m-iop-owned-single-request-agent-execution/20+*/complete.log agent-task/archive/*/*/m-iop-owned-single-request-agent-execution/20_*/complete.log agent-task/archive/*/*/m-iop-owned-single-request-agent-execution/20+*/complete.log); printf "%s\n" "${candidates[@]}"; ((${#candidates[@]} == 1))'` — prints exactly one predecessor completion path and exits zero.
2. `go test -race ./apps/edge/internal/openai -run 'TestSingleRequestExecutor' -count=1` — pass, inspection, repair, concurrency, cancellation, failure, and cleanup fixtures pass without races.
3. `go test ./apps/edge/internal/service -run 'TestSingleRequest(InternalToolLoop|Cleanup|EnvelopeOrdering)' -count=1` — unchanged coordinator tool-loop, cleanup, and envelope-ordering invariants pass freshly.
4. `go vet ./apps/edge/internal/openai && go test ./apps/edge/internal/service ./apps/edge/internal/openai -count=1` — changed-path packages vet/regress cleanly.
5. `rg --sort path -n 'NewSingleRequestExecutor|SingleRequestExecutor|SingleRequestToolContinuation' apps/edge/internal/openai/single_request_executor.go apps/edge/internal/openai/single_request_executor_test.go` — constructor, executor ownership, and continuation delegation are explicit and test-covered.
6. `bash -c 'set -euo pipefail; if rg --sort path -n "NewSingleRequestExecutor|SetSingleRequestExecutor" apps/edge/internal/input/manager.go; then exit 1; else test $? -eq 1; fi'` — exits zero with no output only when production installation remains deferred to task 22.
7. `git diff --check` — no whitespace errors.

Actual provider/Claude full-cycle evidence remains owned by S12 `claude-smoke`.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
