<!-- task=m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding plan=2 tag=REVIEW_API milestone-task=artifact-pair -->

# Repair the Configured Workspace Tool Binding Contract

## For the Implementing Agent

Start only after the three predecessor completions listed below are present at their exact active or archived paths. Implement every item, run every verification command, and fill the implementation-owned sections of `CODE_REVIEW-cloud-G07.md` with actual notes and output. Keep the active PLAN and CODE_REVIEW files in place and report ready for review; finalization is code-review-skill-only. If blocked, record only the exact blocker, attempted commands/output, and resume conditions in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The first implementation replaced the preset-declared workspace binding contract with tool-name heuristics and permissive codecs. Fresh review evidence showed that it misses actual OpenAI function wrappers, misclassifies unrelated tools, mutates structured content, and accepts arbitrary JSON as an exact result. This follow-up keeps the compiler/codec boundary isolated while making it consume the already-validated preset contract and proving SDD S06 behavior without executing a workspace tool.

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/plan_local_G06_1.log`.
- Prior review: `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/code_review_cloud_G06_1.log`.
- Verdict: FAIL with 5 Required, 0 Suggested, and 0 Nit findings; `review_rework_count=1`, `evidence_integrity_failure=true`.
- Required scope: consume ordered `ExecutionPreset.WorkspaceTools` alternatives; normalize actual OpenAI Chat and Anthropic tool definitions; preserve typed structured values; make command mapping deterministic; carry public/provider identities; emit executable canonical-workdir and realpath containment guards; evaluate configured result matchers for exact receipts; and accept exact active-or-archived predecessor evidence.
- Affected files: `apps/edge/internal/openai/workspace_tool_binding.go`, `apps/edge/internal/openai/workspace_tool_codec.go`, and `apps/edge/internal/openai/workspace_tool_binding_test.go`.
- Fresh evidence: the existing focused suite, race suites, executable-`TMPDIR` Edge suite, vet, formatting, and diff checks pass, but a transient reviewer matrix failed actual nested OpenAI shape, unrelated `get_weather`, raw structured content preservation, and arbitrary successful JSON rejection.
- Roadmap carryover: Milestone task `artifact-pair`, approved SDD scenario S06, and its canonical mapping, parent preparation, no-escape, exact receipt, reversed-order, missing-tool, and extra-tool Evidence Map rows remain unsatisfied until this repair passes.

## Dependencies and Execution Order

- Predecessor 02 is satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log`.
- Predecessor 04 is satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log`.
- Predecessor 06 is satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/06+04,05_request_identity_ingress/complete.log`.
- Complete REVIEW_API-1 before REVIEW_API-2 because the codec must consume the immutable selected contract. REVIEW_API-3 closes both with regression evidence.

## Analysis

### Files Read

- `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/PLAN-local-G06.md`
- `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/CODE_REVIEW-cloud-G06.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/PHASE.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-hot-path-one-shot-execution.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-contract/inner/edge-config-runtime-refresh.md`
- `agent-contract/outer/openai-compatible-api.md`
- `agent-contract/outer/anthropic-compatible-api.md`
- `packages/go/config/execution_preset_types.go`
- `apps/edge/internal/openai/workspace_tool_binding.go`
- `apps/edge/internal/openai/workspace_tool_codec.go`
- `apps/edge/internal/openai/workspace_tool_binding_test.go`

### SDD Criteria

- SDD: `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`; status approved and implementation lock released.
- Milestone task id: `artifact-pair`.
- Target acceptance scenario: S06.
- Governing Evidence Map rows require canonical-to-actual tool mapping, parent-capable write or a separate prepare operation, exact versus opaque result receipts, reversed alternative order, missing/extra tools, and traversal rejection.
- Those rows require the checklist to compile configured alternatives rather than infer names, keep structured and command mappings separate, preserve identity through receipt matching, and add a negative/variant regression matrix to final verification.

### Verification Context

- Handoff source: the prior active PLAN/CODE_REVIEW pair and its recorded commands; no separate external verification handoff was supplied.
- Repository-native fallback evidence: config types, binding compiler/codec/test sources, endpoint contracts, approved SDD, and exact archived predecessor `complete.log` files.
- Fresh commands applied: focused workspace binding tests, race tests for OpenAI/service, all Edge tests with an executable workspace-local `TMPDIR`, Edge vet, `gofmt -d`, and `git diff --check`.
- Preconditions: all three split predecessors are PASS in their exact August 2026 archive paths; no external runner or workspace tool execution is required.
- Constraints: Edge may compile and encode only; it must not inspect the workspace, resolve a real workspace path itself, or execute a caller tool. The local environment mounts default `/tmp` noexec, so the Edge-wide test must set `TMPDIR` to an executable temporary directory outside the repository.
- Gaps: existing tests use simplified OpenAI maps and accept current permissive receipt behavior. The transient reviewer-only matrix exposed four missing negative/actual-shape cases and was removed after diagnosis.
- Confidence: high; each Required finding has a direct source location and a deterministic unit-level reproduction.

### Test Coverage Gaps

- Actual OpenAI Chat `{type,function:{name,description,parameters}}` normalization: missing.
- Typed Anthropic `name`/`input_schema` normalization against the same preset matcher: simplified map coverage only.
- Ordered configured alternative selection, reversed alternatives, missing roles, and unrelated extra tools: missing or based on name heuristics.
- Recursive schema matcher and full-contract fingerprint stability: missing.
- Raw typed structured content and rejection of unmapped fields: missing.
- Deterministic command argument mapping plus an executable canonical-workdir/realpath and symlink-escape guard: missing.
- Public/provider tool call identity and configured result matcher correlation: missing.
- Opaque, error-shaped, wrong-id, wrong-path, wrong-payload, and failed-guard receipts: incomplete.

### Symbol References

- `compileWorkspaceBindings`, `compileWorkspaceBindingForTool`, `encodeWorkspaceCall`, and `matchResultReceipt` currently have references only in `apps/edge/internal/openai/workspace_tool_binding_test.go`; there is no production consumer to migrate in this child.
- No public symbol is renamed or removed. Keep changes private to this compiler/codec boundary so the later artifact-pair frontier child can consume the corrected API.

### Split Judgment

The immutable selected binding and its encoder/result codec form one compact safety invariant: a codec cannot be correct without the exact configured matcher and argument/result contract selected by the compiler. Splitting them again would prevent independent PASS evidence, so this follow-up remains one subtask with three ordered items. Predecessor indices 02, 04, and 06 are each satisfied by the exact archived PASS path listed above; there are no missing or ambiguous predecessor matches.

### Scope Rationale

Exclude endpoint dispatch integration, cross-call artifact pair state, model execution, local/review frontiers, filesystem inspection/execution, cleanup, manifests/revisions, server-side artifact fallback, and generic shell evaluation. Do not change the already-defined config wire contract. This child only corrects the request-local binding compiler, payload/receipt codec, and their tests; a later child owns consumption by the artifact-pair state machine.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer `finalize-task-policy.sh` in pair mode.
- Build closures: goal=true, acceptance=true, ownership=true, dependency=true, verification=true. Scores `(2,0,2,2,1)` produce grade G07 and base `local-fit`; `evidence_integrity_failure=true` activates `recovery-boundary`, selecting cloud build `PLAN-cloud-G07.md`.
- Review closures: goal=true, acceptance=true, ownership=true, dependency=true, verification=true. Official review scores `(2,0,2,2,1)` select cloud G07 `CODE_REVIEW-cloud-G07.md` with adapter `codex`, model `gpt-5.6-sol`, and reasoning effort `xhigh`.
- `large_indivisible_context=false`; positive loop-risk signatures are `boundary_contract`, `structured_interpretation`, and `variant_product` (3); no grade risk boundary is matched.
- Recovery signals: `review_rework_count=1`, `evidence_integrity_failure=true`; recovery boundary matched.
- Capability gap: none. The repository and local toolchain provide all required implementation and verification capabilities.

## Implementation Checklist

- [ ] Compile only preset-configured ordered workspace alternatives against normalized actual OpenAI Chat and Anthropic tool definitions, preserving the full immutable binding contract.
- [ ] Encode structured and command calls without content corruption, map public/provider identities, enforce executable no-escape guards, and match configured exact receipts.
- [ ] Add the reviewer regression/variant matrix and run archived-dependency, focused, race, Edge-wide, vet, formatting, and diff verification exactly as written.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_API-1] Compile the preset-declared ordered binding

#### Problem

`packages/go/config/execution_preset_types.go:44` already defines ordered alternatives and per-operation `ToolName`, `SchemaMatcher`, `ArgumentMap`, `ResultMatcher`, and `CreatesParents`, but `apps/edge/internal/openai/workspace_tool_binding.go:88` accepts only tools and discards that contract. `extractToolSchema` also misses the actual nested OpenAI function wrapper, while broad substring matchers classify unrelated tools such as `get_weather`.

#### Solution

Accept the preset's ordered workspace alternatives and normalize actual decoded OpenAI Chat and Anthropic tool definitions into one internal schema view. Select only a complete configured alternative by exact tool name and recursive schema matcher, preserve every operation mapping and parent capability in an immutable binding, enforce write-with-parents or separate-prepare completeness, and fingerprint the canonical selected configuration plus normalized actual schema. Do not infer workspace roles from tool-name substrings.

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/workspace_tool_binding.go` — config-driven normalization, ordered selection, recursive matcher, completeness validation, immutable contract, and full fingerprint.
- [ ] `apps/edge/internal/openai/workspace_tool_binding_test.go` — actual OpenAI/Anthropic shapes, reversed order, missing/extra tools, incomplete alternatives, and fingerprint cases.

#### Test Strategy

Use actual decoded endpoint shapes and table-driven preset alternatives. Assert exact configured selection, equivalent OpenAI/Anthropic behavior, deterministic order/fingerprint, rejection of unrelated or schema-mismatched tools, and required prepare behavior when write cannot create parents.

#### Verification

Run `go test -count=1 ./apps/edge/internal/openai -run 'TestWorkspace(Tool|Command|Binding)'`; expect the compiler matrix and all negative cases to PASS.

### [REVIEW_API-2] Encode deterministic calls and exact receipts

#### Problem

`apps/edge/internal/openai/workspace_tool_codec.go:134` shell-quotes structured content, `apps/edge/internal/openai/workspace_tool_codec.go:164` selects command fields by map iteration, `apps/edge/internal/openai/workspace_tool_codec.go:307` emits a placeholder guard, and `apps/edge/internal/openai/workspace_tool_codec.go:344` treats any non-empty successful JSON as exact. Tool-call ids and names are not carried into receipt correlation.

#### Solution

Drive structured and command payloads only from the compiled argument map. Preserve structured values exactly, use deterministic fixed command argument positions and shell-safe encoding only in command mode, carry public/provider tool identities, and emit a concrete caller-executable containment guard based on canonical workspace cwd and realpath comparison that rejects traversal and symlink escape before the operation. Evaluate the configured result matcher over normalized result/status fields and correlate the exact issued call identity, operation, path, payload, and guard state before producing a matched receipt.

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/workspace_tool_codec.go` — mapped payloads, identity correlation, deterministic command encoding, executable guard, and configured exact result matching.
- [ ] `apps/edge/internal/openai/workspace_tool_binding_test.go` — raw structured values, command determinism, traversal/symlink guards, identity mismatch, opaque/error/mismatched receipts.

#### Test Strategy

Assert byte-for-byte raw structured content, stable command output across repeated/map-order variants, executable guard structure without running it, rejection of traversal and symlink-escape candidates, public/provider id preservation, and exact-versus-opaque/error/wrong-field receipts under configured result matchers.

#### Verification

Run the focused and race commands in Final Verification; expect no real tool execution and no data-dependent flakes.

### [REVIEW_API-3] Close the regression and integration evidence gaps

#### Problem

`apps/edge/internal/openai/workspace_tool_binding_test.go` currently passes simplified fixtures while missing all four reviewer reproductions. The prior dependency probes also fail after normal predecessor archival, so the recorded command sequence cannot establish readiness.

#### Solution

Add named regressions for the actual OpenAI wrapper, unrelated `get_weather`, raw structured content, and arbitrary successful JSON. Expand the variant matrix across both endpoint shapes, structured/command alternatives, parent-capable/separate-prepare writes, reversed/missing/extra tools, unsafe paths, ids, and receipt mismatches. Use exact active-or-archive predecessor probes and run the complete package/race/Edge-wide/static sequence with executable `TMPDIR` handling.

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/workspace_tool_binding_test.go` — reviewer reproductions and full S06 variant/negative matrix.
- [ ] `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/CODE_REVIEW-cloud-G07.md` — actual implementation notes and command outputs only.

#### Test Strategy

Every prior reviewer failure must have a stable named test that fails against the archived implementation and passes only after the contract repair. Keep all tests hermetic: compile, encode, and match values without executing a tool or inspecting a workspace.

#### Verification

Run every command below exactly. All commands must exit zero, formatting output must be empty, and no test may invoke an actual workspace operation.

## Modified Files Summary

| File | Items |
|------|-------|
| `apps/edge/internal/openai/workspace_tool_binding.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/workspace_tool_codec.go` | REVIEW_API-2 |
| `apps/edge/internal/openai/workspace_tool_binding_test.go` | REVIEW_API-1, REVIEW_API-2, REVIEW_API-3 |
| `agent-task/m-iop-hot-path-one-shot-execution/08+02,04,06_workspace_binding/CODE_REVIEW-cloud-G07.md` | REVIEW_API-3 |

## Final Verification

```bash
test -f agent-task/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log || test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log
test -f agent-task/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log || test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log
test -f agent-task/m-iop-hot-path-one-shot-execution/06+04,05_request_identity_ingress/complete.log || test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/06+04,05_request_identity_ingress/complete.log
go test -count=1 ./apps/edge/internal/openai -run 'TestWorkspace(Tool|Command|Binding)'
go test -race -count=1 ./apps/edge/internal/openai ./apps/edge/internal/service
review_tmp_dir=$(mktemp -d /config/.tmp-iop-workspace-binding.XXXXXX)
TMPDIR="$review_tmp_dir" go test -count=1 ./apps/edge/...
review_status=$?
rmdir "$review_tmp_dir"
test "$review_status" -eq 0
go vet ./apps/edge/...
gofmt -d apps/edge/internal/openai/workspace_tool_binding.go apps/edge/internal/openai/workspace_tool_codec.go apps/edge/internal/openai/workspace_tool_binding_test.go
git diff --check
```

Expected: every command exits 0; both actual endpoint shapes select only configured alternatives; structured content remains raw; command output and guards are deterministic; traversal, symlink escape, unrelated tools, and opaque/error/mismatched receipts are rejected; no test executes a workspace tool or inspects a real workspace.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
