<!-- task=m-iop-owned-single-request-agent-execution/19+18_work_stage plan=2 tag=REVIEW_API milestone-task=work-stage -->

# Code Review Reference - REVIEW_API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> Execute the plan's selected root cause, scope, files, and dependency decisions as written. Do not choose another owner, narrow/expand the write boundary, or replace a fix with another verification attempt.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-07
task=m-iop-owned-single-request-agent-execution/19+18_work_stage, plan=2, tag=REVIEW_API

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-iop-owned-single-request-agent-execution/19+18_work_stage/plan_cloud_G08_1.log`.
- Prior review: `agent-task/m-iop-owned-single-request-agent-execution/19+18_work_stage/code_review_cloud_G08_1.log`; verdict `FAIL`, with Required R1-R5, no Suggested or Nit findings.
- R1-R5 affect `apps/edge/internal/openai/single_request_work_stage.go` and `apps/edge/internal/openai/single_request_work_stage_test.go`: coordinator identity/argument decoding, reserved options, environment schema, duplicate continuation delivery, and missing provider/tool/limit/cancel evidence.
- Fresh focused race, service compatibility, vet, and broad Edge commands passed, but the focused fake bypassed coordinator validation and did not contain the scenarios claimed by its evidence; `evidence_integrity_failure=true`.
- The predecessor remains satisfied by `agent-task/archive/2026/08/m-iop-owned-single-request-agent-execution/18+17_plan_stage/complete.log` (`PASS`). The Milestone carryover remains `milestone-task=work-stage`, SDD S09; S12 external Claude/Mac qualification remains deferred.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G09.md` -> `code_review_cloud_G09_2.log` and `PLAN-cloud-G09.md` -> `plan_cloud_G09_2.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-iop-owned-single-request-agent-execution/19+18_work_stage/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS, preserve first-line `milestone-task=work-stage` metadata in `complete.log` and report it for runtime aggregation. Roadmap state evaluation belongs to `sync-milestone-workstate`.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_API-1 Restore the standard Work call/coordinator contract | [x] |
| REVIEW_API-2 Close Work request and schema authority | [x] |
| REVIEW_API-3 Make continuation ownership and failure evidence trustworthy | [x] |

## Implementation Checklist

- [x] Make standard OpenAI Work tool calls consumable by the real coordinator and prove an actual write-plus-verification flow.
- [x] Close reserved-option aliases and command environment schemas to the frozen Work binding.
- [x] Make continuation delivery single-claim and add the missing provider, tool, budget, deadline, and cancellation regressions under `-race`.
- [x] Run every dependency, focused, compatibility, vet, broad Edge, formatting, activation, spec, and diff verification command freshly.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G09_2.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G09_2.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [x] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [x] If PASS, move active task directory `agent-task/m-iop-owned-single-request-agent-execution/19+18_work_stage/` to `agent-task/archive/YYYY/MM/m-iop-owned-single-request-agent-execution/19+18_work_stage/` and update this checklist at the final archive path.
- [x] If PASS, preserve and report `milestone-task=work-stage` metadata for runtime aggregation, without modifying roadmap or directly calling `update-roadmap`.
- [x] If PASS for split work, remove empty active parent `agent-task/m-iop-owned-single-request-agent-execution/` or verify it was kept due to remaining siblings/files.
- [ ] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

None.

## Key Design Decisions

- Decode the provider's standard string-valued `function.arguments` into one duplicate-free JSON object before creating the service-owned call, while preserving the original string in the assistant continuation message.
- Use canonical semantic stage ID `work` for bridge and coordinator identities; keep the public/service lifecycle state `working` only in state envelopes.
- Treat reserved option aliases as invalid, keep exact server-owned and credential fields non-serializable, reject Work reasoning explicitly, and project a closed environment schema from the frozen allowlist.
- Claim and remove a continuation waiter atomically before delivery so duplicate callers cannot both succeed.
- Exercise the real service coordinator with typed workspace open, PLAN artifact write/read, workspace write, verification command, cleanup, denial, failure, budget, deadline, and cancellation paths while leaving production activation absent.

## Reviewer Checkpoints

- Verify a standard OpenAI string-valued `function.arguments` becomes exactly one strict inner JSON object and reaches the actual service coordinator with canonical `stage_id=work`.
- Verify the actual coordinator fixture performs an admitted write plus verification command, preserves saved-stage/budget/cancel behavior, returns completion/verification evidence, and leaves no bridge waiter.
- Verify case-folded reserved keys cannot serialize reasoning, credentials, or server-owned structural fields in initial or resumed bodies.
- Verify the command environment schema exposes only frozen `EnvironmentNames` with `additionalProperties=false`.
- Verify two synchronized deliveries for one bridge key produce exactly one success, one generic rejection, and zero retained entries under `-race`.
- Verify provider submit/frame, real tool denial/failure, output/iteration/deadline, and provider/tool cancellation cases have exact count, redaction, error-class, and cleanup assertions.
- Verify no production executor or activation is added and S12 external qualification remains deferred.

## Verification Results

Paste actual stdout/stderr for every command below. Any replacement command requires a matching `Deviations from Plan` entry with the reason.

### 1. Dependency evidence

`bash -c 'set -euo pipefail; shopt -s nullglob; candidates=(agent-task/m-iop-owned-single-request-agent-execution/18_*/complete.log agent-task/m-iop-owned-single-request-agent-execution/18+*/complete.log agent-task/archive/*/*/m-iop-owned-single-request-agent-execution/18_*/complete.log agent-task/archive/*/*/m-iop-owned-single-request-agent-execution/18+*/complete.log); printf "%s\n" "${candidates[@]}"; ((${#candidates[@]} == 1))'`

Expected: prints exactly `agent-task/archive/2026/08/m-iop-owned-single-request-agent-execution/18+17_plan_stage/complete.log` and exits zero before implementation.

```text
agent-task/archive/2026/08/m-iop-owned-single-request-agent-execution/18+17_plan_stage/complete.log
```

### 2. Focused Work race tests

`go test -race ./apps/edge/internal/openai -run 'TestSingleRequestWork(Stage|ToolBridge)' -count=1`

Expected: real coordinator, codec, authority, failure, limit, cancellation, and duplicate-delivery cases pass without races.

```text
ok  	iop/apps/edge/internal/openai	1.200s
```

### 3. Service compatibility

`go test ./apps/edge/internal/service -run 'TestSingleRequest(InternalToolLoop|Cleanup)' -count=1`

Expected: unchanged coordinator, tool-loop, cancellation, deadline, and cleanup oracles pass freshly.

```text
ok  	iop/apps/edge/internal/service	0.093s
```

### 4. Vet and broad Edge regression

`go vet ./apps/edge/internal/openai ./apps/edge/internal/service && go test ./apps/edge/... -count=1`

Expected: both touched boundaries vet cleanly and the broad Edge regression passes freshly.

```text
ok  	iop/apps/edge/cmd/edge	0.148s
ok  	iop/apps/edge/internal/authprojection	0.049s
ok  	iop/apps/edge/internal/bootstrap	0.445s
ok  	iop/apps/edge/internal/configrefresh	0.106s
ok  	iop/apps/edge/internal/controlplane	6.616s
ok  	iop/apps/edge/internal/edgecmd	0.097s
ok  	iop/apps/edge/internal/edgevalidate	0.063s
ok  	iop/apps/edge/internal/events	0.044s
ok  	iop/apps/edge/internal/input	0.094s
ok  	iop/apps/edge/internal/input/a2a	0.082s
ok  	iop/apps/edge/internal/node	0.065s
ok  	iop/apps/edge/internal/openai	8.159s
ok  	iop/apps/edge/internal/opsconsole	0.065s
ok  	iop/apps/edge/internal/service	6.499s
ok  	iop/apps/edge/internal/transport	4.792s
```

### 5. Required regression inventory

`rg --sort path -n 'func TestSingleRequestWork(StageRunsThroughServiceCoordinator|StageRejectsReservedOptionAliases|StageProjectsClosedEnvironmentSchema|StageFailuresAndLimits|StageCancellation|ToolBridgeRejectsConcurrentDuplicate)' apps/edge/internal/openai/single_request_work_stage_test.go`

Expected: finds all six named regressions.

```text
395:func TestSingleRequestWorkStageRunsThroughServiceCoordinator(t *testing.T) {
469:func TestSingleRequestWorkStageFailuresAndLimits(t *testing.T) {
620:func TestSingleRequestWorkStageCancellation(t *testing.T) {
796:func TestSingleRequestWorkStageRejectsReservedOptionAliases(t *testing.T) {
846:func TestSingleRequestWorkStageProjectsClosedEnvironmentSchema(t *testing.T) {
951:func TestSingleRequestWorkToolBridgeRejectsConcurrentDuplicate(t *testing.T) {
```

### 6. No incomplete production activation

`test ! -e apps/edge/internal/openai/single_request_executor.go && bash -c 'set -euo pipefail; if rg --sort path -n "NewSingleRequestExecutor|SetSingleRequestExecutor" apps/edge/internal/input/manager.go; then exit 1; else test $? -eq 1; fi'`

Expected: exits zero with no output; Work remains uninstalled.

```text
(no output; exit 0)
```

### 7. Spec conformance

`rg --sort path -n 'ornith-fast|Work stage|Review|not installed|deferred' agent-spec/runtime/edge-node-execution.md`

Expected: existing spec statements are supported by the repaired S09 evidence and later stages remain deferred.

```text
89:    notes: Private ornith-fast Work provider/tool loop, request-safe continuation bridge, admitted tool projection, and strict completion evidence
191:| single-request observation evidence | Stage-pure timing, tool/cleanup/total counts, cardinality-bounded labels, Node logs, and raw-free correlation are documented for the single-request path. `iop_anthropic_single_request_ingress_total` is strictly unlabeled. Internal tool names, raw arguments, and private results are absent from public output and log projections. Actual Claude/Mac timing evidence is explicitly deferred to `claude-smoke` (SDD S12); deterministic coordinator/tool-loop tests do not imply external qualification. |
197:| Plan stage | A private, not installed Plan runner emits the `planning` envelope, sends the immutable task through the frozen Gemini Chat binding with `reasoning_effort=high`, requires one strict small `plan`/`verification` JSON result, and writes deterministic bounded Markdown through `SingleRequestArtifactPlan`. |
198:| Work stage | A private, not installed `ornith-fast` Work runner reads the closed PLAN artifact, projects only the admitted workspace tools, and resumes the same frozen provider route after exactly correlated Node results. It rejects any Work `reasoning_effort`, malformed or multiple tool calls, and empty completion or verification evidence. |
220:- Request-owned plan and review artifact access is implemented between the controller and the same dedicated workspace wire. Only `SingleRequestArtifactPlan` and `SingleRequestArtifactReview` are accepted. Artifact and model-tool callers share one serialized open attempt and the same opened cleanup gate; terminal and cancellation paths wait for in-flight artifact work before issuing exactly one cleanup. Edge bounds writes before dispatch and reads before acceptance, validates the echoed kind/operation and canonical terminal, and never reselects after a generation mismatch. Node maps the closed selectors to `plan.md` and `review.md`, validates the inventoried parent/file identity with descriptor-relative no-follow reads, and never grants the public workspace tool surface access to `.iop`.
221:- The private Plan stage is implemented but not installed in an outer executor. Its provider codec accepts only frozen Plan options and selected dispatch facts, uses the admitted stage deadline and exact output limit, accepts only `RESPONSE_START`, zero or more `BODY`, then `END`, and projects all provider failures to a generic internal failure. The fixed Plan prompt requests a small plan plus verification criteria and writes only the closed PLAN artifact.
222:- The private Work stage is implemented but not installed in an outer executor. It reads only `SingleRequestArtifactPlan`, retains only request/stage/tool identifiers while waiting for the coordinator-owned continuation, and sends no `reasoning_effort` field in an initial or resumed provider request. Its provider messages contain the immutable task, PLAN, admitted tool schemas, and bounded typed tool results; Review/repair and final user-result composition remain deferred.
231:Single-request lifecycle observation evidence links ingress=1, request-total=1, terminal=1, stage/tool/cleanup counts, and raw-free correlation for one real POST. `iop_anthropic_single_request_ingress_total` is strictly unlabeled (no request_id, stage_id, provider identity, content, or workspace reference). Internal tool names, raw arguments, and private results are absent from public output and log projections. Stage-pure timing, cardinality-bounded labels, and privacy semantics are documented here. Actual Claude/Mac timing evidence is explicitly deferred to `claude-smoke` (SDD S12); deterministic coordinator/tool-loop tests do not imply external qualification.
310:- `go test -race -count=1 ./apps/edge/internal/openai -run 'TestSingleRequestWork(Stage|ToolBridge)'` — deterministic ornith-fast Work tool loop, correlation isolation, cancellation cleanup, strict completion evidence, and Work reasoning-option absence.
322:- The private Plan and Work stages are implemented but not installed as a composite executor. Review/repair, generic error/cancel integration, outer activation, and actual Claude/Mac qualification remain deferred; deterministic S08/S09 components do not establish S12 evidence.
323:- Single-request observation evidence (ingress=1, request-total=1, terminal=1, stage/tool/cleanup counts, raw-free correlation) is documented and tested. `iop_anthropic_single_request_ingress_total` is strictly unlabeled. Internal tool names, raw arguments, and private results are absent from public output and log projections. Actual Claude/Mac timing evidence is explicitly deferred to `claude-smoke` (SDD S12); deterministic coordinator/tool-loop tests do not imply external qualification.
335:- 2026-08-06: Added implemented Edge workspace admission for single-request execution: an opaque `workspace_ref` binds to one configured ready Node generation and a closed capability projection before executor startup. Admission rejects unavailable, foreign, pending, malformed, and stale candidates without fallback or reselection; Node-private wire, executor, filesystem path, and symlink enforcement remain deferred.
336:- 2026-08-06: Added the dedicated Edge-Node workspace wire. `NodeConfigPayload` now delivers the approved catalog; `WorkspaceOpen`/`Tool`/`Cancel`/`Cleanup` messages have closed typed outcomes, immutable coordinator identities, parser registration, and an optional Node handler. Edge dispatch is generation-fenced and context cancellation sends one typed cancel. Node filesystem and process execution are intentionally deferred.
337:- 2026-08-06: Completed the reviewed workspace file boundary repair. Edge now sends only frozen request authority, Node admits immutable catalog subsets/lower limits, and structured write reaches the file executor while legacy incomplete input remains rejected. The Go 1.24-compatible descriptor-relative no-follow write path validates before effects, bounded list processing retains fixed state, startup errors are path-free, and composition proves handler-before-ready plus workspace-before-session/store teardown. Command execution/cancellation and cleanup remain deferred.
338:- 2026-08-07: Implemented exact-template workspace COMMAND and typed cancellation. The Node uses an inherited-root `fchdir`/`exec` shim, minimal allowlisted environment, a shared draining stdout/stderr cap, and one process-group result owner across exit, timeout, context cancel, and exact request/tool cancel. Focused race tests cover non-zero exit, output overflow, descendant termination, cross-request isolation, and configured-root rename/replacement. Artifact cleanup remains deferred.
341:- 2026-08-07: Added the closed request-owned PLAN/REVIEW artifact wire and controller lifecycle. Artifact calls share the model-tool lazy open and terminal cleanup gate, use the frozen Node generation and immutable bounds, and map only inside Node to inventoried `plan.md`/`review.md` files. Provider-specific stage drivers and actual Claude qualification remain deferred.
342:- 2026-08-08: Synchronized single-request lifecycle observation evidence: stage-pure timing (planning/working/reviewing/repairing/finalizing/completed/failed/cancelled), tool/cleanup/total counts, cardinality-bounded labels, Node logs, and raw-free correlation. External Claude/Mac timing evidence is explicitly deferred to `claude-smoke` (SDD S12). Deterministic coordinator/tool-loop tests cover the full single-request path without implying external qualification.
343:- 2026-08-07: Added the private Plan stage and its fail-closed provider codec. The component uses only frozen Gemini dispatch/options, ordered bounded tunnel decoding, strict small plan/verification JSON, and the closed `SingleRequestArtifactPlan` write. It is not installed; Work, Review/repair, activation, and S12 qualification remain deferred.
344:- 2026-08-07: Added the private ornith-fast Work stage. It reads PLAN through the closed artifact controller, emits only admitted workspace schemas, bridges exact request/stage/tool results without retaining payloads, and resumes the frozen route with bounded tool evidence. Work rejects `reasoning_effort`; Review/repair, composite installation, and S12 external qualification remain deferred.
```

### 8. Formatting

`gofmt -d apps/edge/internal/openai/single_request_work_stage.go apps/edge/internal/openai/single_request_work_stage_test.go`

Expected: exits zero with no output.

```text
(no output; exit 0)
```

### 9. Diff hygiene

`git diff --check`

Expected: exits zero with no whitespace errors.

```text
(no output; exit 0)
```

External provider/Claude full-cycle evidence remains owned by S12 `claude-smoke`.

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Archive Evidence Snapshot | Fixed at stub creation | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` -> `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation | Implementing agent checks `[ ]` -> `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

### Overall Verdict

PASS

### Dimension Assessment

| Dimension | Assessment | Evidence |
|-----------|------------|----------|
| Correctness | Pass | Standard string-valued OpenAI tool arguments are decoded into one duplicate-free object, canonical `stage_id=work` reaches the service coordinator, and continuation delivery is atomically single-claim. |
| Completeness | Pass | REVIEW_API-1 through REVIEW_API-3 and inherited Required R1-R5 are implemented within the planned production/test boundary. |
| Test coverage | Pass | Fresh focused race tests exercise the real coordinator, typed workspace write/command path, reserved aliases, closed environment schema, duplicate delivery, provider/tool failures, budgets, deadlines, and cancellation. |
| API contract | Pass | Frozen Work options, admitted tool schemas, canonical coordinator identity, typed continuation results, and inactive production ownership conform to the selected contracts and SDD S09. |
| Code quality | Pass | The implementation is formatted, vet-clean, contains no debug/TODO residue, and keeps correlation state bounded and payload-free. |
| Implementation deviation | Pass | No plan deviation or unrelated write was introduced in the Work-stage production/test boundary. |
| Verification trust | Pass | Every recorded command was rerun successfully; source, test inventory, activation guard, formatting, spec search, and broad Edge results agree with the implementation evidence. |
| Spec conformance | Pass | The private, uninstalled ornith-fast Work stage now supplies S09 workspace-change and verification evidence while S12 external Claude/Mac qualification remains deferred. |

### Findings

None.

### Routing Signals

- `review_rework_count=1`
- `evidence_integrity_failure=false`

### Next Step

PASS: archive the reviewed pair, write `complete.log`, and move the completed task directory to the dated archive without modifying the roadmap.
