<!-- task=m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure plan=4 tag=REVIEW_REVIEW_REVIEW_REVIEW_TEST -->

# Code Review Reference - REVIEW_REVIEW_REVIEW_REVIEW_TEST

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-07-31
task=m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure, plan=4, tag=REVIEW_REVIEW_REVIEW_REVIEW_TEST

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone document](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `logged-smoke`: authenticated macOS discovery-through-completion multi-project field validation
- Completion mode: check-on-pass

## Archive Evidence Snapshot

- Prior task: `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure`
- Prior plan: `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/plan_cloud_G10_3.log`
- Prior review: `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/code_review_cloud_G10_3.log`
- Verdict: FAIL
- Findings: four Required, zero Suggested, zero Nit. Continuation merges unrelated rules and targets; no CLI/daemon composition drives a fake provider through review, validation rollback, sibling continuation, and restart; manifest validation ignores its 13 absent evidence files; and restart/duplicate-invocation claims are not derived from a live invocation.
- Affected files: the common continuation request boundary, standalone selector, application composition tests, logged-smoke harness/schema/evidence artifacts, and the two runtime contracts.
- Verification evidence: fresh focused, package, race, vet, shell, smoke-preflight, full-repository, and diff checks passed. A focused manifest reproducer then removed all 13 referenced evidence files while `--validate-manifest` still exited 0. Read-only dev preflight found clean Darwin arm64 at `750cb1d1cb88066a10d3c703c99f1326306d8e15`; the manifest field commit `ee632daf7b57f5e3a9bba8a3e647b9797ac060b3` was not present in that checkout.
- Routing signals: `review_rework_count=4`, `evidence_integrity_failure=true`.
- Roadmap carryover: this task remains the completion owner for `logged-smoke`; no roadmap state changes until PASS.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G10.md` → `code_review_cloud_G10_4.log` and `PLAN-cloud-G10.md` → `plan_cloud_G10_4.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, report completion event metadata. Roadmap state check and `update-roadmap` calls are runtime responsibilities.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_REVIEW_REVIEW_REVIEW_TEST-1 Preserve failure-specific ordered continuation | [x] |
| REVIEW_REVIEW_REVIEW_REVIEW_TEST-2 Prove the application-level persisted lifecycle | [x] |
| REVIEW_REVIEW_REVIEW_REVIEW_TEST-3 Validate evidence bytes and live restart identity | [x] |
| REVIEW_REVIEW_REVIEW_REVIEW_TEST-4 Produce a self-contained exact-source field evidence set | [x] |

## Implementation Checklist

- [x] Bind continuation policy and candidate eligibility to the exact sanitized failure observation and full ordered rule context, with cross-code and nonmatching-predicate manager regressions.
- [x] Drive one persisted manager through a deterministic fake-provider lifecycle in both CLI and daemon compositions, including canonical review, mandatory validation rollback, sibling continuation, and restart.
- [x] Make manifest, schema, and self-test validate the actual bounded evidence files and derive live restart/no-duplicate/terminal-monotonic claims from exact process and state evidence.
- [x] Run fresh local verification and a new exact-source authenticated Darwin field execution; promote the redacted manifest plus all allowlisted evidence files and update both runtime contracts.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G10_4.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G10_4.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [x] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [x] If PASS, move active task directory `agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/` to `agent-task/archive/YYYY/MM/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/` and update this checklist at the final archive path.
- [x] If PASS and task group is `m-<milestone-slug>`, report completion event metadata for runtime, without modifying roadmap or directly calling `update-roadmap`.
- [x] If PASS for split work, remove empty active parent `agent-task/m-iop-agent-cli-runtime/` or verify it was kept due to remaining siblings/files.
- [ ] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

- Go commands used a fresh `GOCACHE` under `/tmp` and `GOTMPDIR=/tmp/g`. The inherited cache path was not writable; command scope and test semantics were unchanged.
- Final formatting and focused verification also include `apps/agent/internal/taskloop/recovery.go` and `recovery_test.go`. The authenticated live-restart run exposed that recovered submissions copied the host-owned overlay locator into the provider boundary. Recovery now retains only process and optional session locators, with a focused regression.
- The live restart uses an exact-identity daemon crash rather than graceful shutdown. Graceful shutdown correctly cancels owned children and therefore cannot prove crash recovery. The fixture waits for a non-placeholder durable review and exact marker while the provider process remains live, holds that state for a bounded 20-second checkpoint, kills only the verified daemon identity, and removes only its owned stale socket.
- Three fresh isolated field attempts failed closed before promotion: graceful shutdown removed the child; an early crash had no durable submission artifact; and the first durable recovery retained an unsupported overlay locator. Each attempt used a new commit, source, clones, state root, and output root. Only the fourth PASS bundle was promoted.

## Key Design Decisions

- Pass the already sanitized `AttemptObservation` through `FailureContinuationPolicyRequest`, evaluate the immutable ordered policy once with the concrete failure/quota context, and expose only the selected explicit failure rule's target. The common manager remains the sole final retry/failover owner.
- Keep provider/reviewer/validator injection optional and internal to application composition. Production defaults remain unchanged; tests use the real manager, state store, workspace backend, integration backend, event logs, and archive flow with proof-owned no-op children.
- Treat the evidence set as one exact same-directory bundle: one manifest, exactly 13 allowlisted JSON files, the tracked schema digest, recomputed content digests, strict per-kind shapes, bounded sizes, regular-file/no-symlink gates, and a shared sensitive-content rejection policy.
- Derive restart safety from pre/post persisted state revision, attempt digest, process-locator revision, and PID/start identity. The no-duplicate field is accepted only when those observed identities agree and both checkpoints are live; completed project traces are absorbing.
- Materialize the reviewed worktree as a locally verifiable orphan commit and tree, transfer that exact Git bundle, rebuild on Darwin, and use two new clean sparse clones at the same identity. No unavailable prior field object or prior run state was reused.

## Reviewer Checkpoints

- The continuation request carries only the manager-sanitized immutable observation, and the common manager remains the sole final action/target owner.
- Cross-code and nonmatching stage, grade, lane, capability, quota, and default cases cannot select a target from another rule.
- CLI and daemon tests drive one persisted manager through fake provider submission, canonical review, validation failure/rollback, sibling continuation, restart, project logs, and terminal evidence.
- No Go test invokes a real provider CLI or replaces the common scheduler with a test scheduler.
- Manifest validation resolves same-directory regular evidence files, recomputes every SHA-256 and schema digest, and rejects missing, symlinked, escaped, tampered, duplicated, or sensitive content.
- Restart occurs while an exact invocation is live; pre/post state revision, attempt, process locator revision, PID, and start token derive the no-duplicate claim.
- Status traces never leave a terminal state.
- The final Darwin manifest and all 13 allowlisted evidence files share one exact, locally and remotely verifiable source/build/clone identity and pass in-place validation/redaction.

## Verification Results

### Failure-Specific Continuation

```bash
go test -count=1 ./packages/go/agenttask ./apps/agent/internal/taskloop -run 'Test.*(Continuation|FailureRule|ConfigSelector)'
go test -count=1 -race ./packages/go/agenttask ./apps/agent/internal/taskloop
```

Actual stdout/stderr:

```text
ok  	iop/packages/go/agenttask	0.126s
ok  	iop/apps/agent/internal/taskloop	1.146s

ok  	iop/packages/go/agenttask	2.798s
ok  	iop/apps/agent/internal/taskloop	9.011s
```

### Application-Level Fake-Provider Lifecycle

```bash
go test -count=1 ./apps/agent/internal/taskloop ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap -run 'Test.*(FakeProvider|PersistedLifecycle|Rollback|Restart)'
go test -count=1 -race ./apps/agent/internal/taskloop ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./packages/go/agenttask ./packages/go/agentstate
```

Actual stdout/stderr:

```text
ok  	iop/apps/agent/internal/taskloop	2.868s
ok  	iop/apps/agent/cmd/agent	1.210s
ok  	iop/apps/agent/internal/bootstrap	1.409s

ok  	iop/packages/go/agenttask	2.798s
ok  	iop/apps/agent/internal/taskloop	9.011s
ok  	iop/apps/agent/cmd/agent	8.159s
ok  	iop/apps/agent/internal/bootstrap	7.780s
ok  	iop/packages/go/agentstate	1.122s
```

### Evidence-File and Restart Self-Test

```bash
bash -n scripts/e2e-iop-agent-logged-smoke.sh
make test-iop-agent-logged-smoke-preflight
make -n test-iop-agent-logged-smoke
```

Actual stdout/stderr:

```text
bash -n: exit 0

bash -n scripts/e2e-iop-agent-logged-smoke.sh
jq -e . scripts/fixtures/iop-agent-smoke-manifest.schema.json >/dev/null
jq -e '.properties.evidence.properties.records | .minItems == 13 and .maxItems == 13' scripts/fixtures/iop-agent-smoke-manifest.schema.json >/dev/null
./scripts/e2e-iop-agent-logged-smoke.sh --help >/dev/null
./scripts/e2e-iop-agent-logged-smoke.sh --self-test
logged-smoke: self-test passed (derived-evidence rejection matrix and exact-PID cleanup)
logged-smoke: non-Darwin host gate passed

make -n expanded all eight required variable gates and the exact
scripts/e2e-iop-agent-logged-smoke.sh invocation; exit 0.
```

### Exact-Source Darwin Field Evidence

Run the external preflight recorded in the plan, then the exact-source field target.

```bash
jq -e . agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/logged-smoke-manifest.json >/dev/null
scripts/e2e-iop-agent-logged-smoke.sh \
  --validate-manifest agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/logged-smoke-manifest.json
if rg -n -i 'authorization|bearer|api[_-]?key|credential|secret|token|/Users/|/home/' \
  agent-task/m-iop-agent-cli-runtime/25+19,21,22,23,24_logged_smoke_closure/*.json; then
  exit 1
fi
```

Actual stdout/stderr:

```text
External preflight:
Darwin 25.0.0 arm64
feature/openai-compatible-output-validation-filters
750cb1d1cb88066a10d3c703c99f1326306d8e15
/opt/homebrew/bin/go
/opt/homebrew/bin/jq
/opt/homebrew/bin/codex
/opt/homebrew/bin/claude
go version go1.26.3 darwin/arm64
base-object-missing

Final exact source identity, repeated for source and both clean clones:
8e55719a928a01f88f7f5e3d2574e3ea810035e8
ed741ffa781c6b52eea59175b1cb5a4891e1b0e8
exact-field-r4-ready

Local source-object verification:
git cat-file -e 8e55719a928a01f88f7f5e3d2574e3ea810035e8^{commit}: exit 0
git rev-parse 8e55719a928a01f88f7f5e3d2574e3ea810035e8^{tree}:
ed741ffa781c6b52eea59175b1cb5a4891e1b0e8
Exact field runtime/harness source-file comparison: all files match

Fail-closed attempts before the successful fresh run:
logged-smoke: daemon shutdown changed the retained live invocation
logged-smoke: project b blocked while waiting for completed
  ambiguous_checkpoint: provider exited without a durable submission result
logged-smoke: project b blocked while waiting for completed
  stale_checkpoint: agenttask: provider returned unsupported "overlay" submission locator

Final authenticated Darwin run:
logged-smoke: manifest valid (6757 bytes)
logged-smoke: PASS manifest=<runner-output>/manifest.json

Remote in-place validation and redaction:
logged-smoke: manifest valid (6757 bytes)
field-evidence-redaction-pass

Promoted local in-place validation and redaction:
logged-smoke: manifest valid (6757 bytes)
rg sensitive-content scan: no matches
jq: exit 0
```

### Final Verification

```bash
gofmt -w \
  packages/go/agenttask/ports.go \
  packages/go/agenttask/dispatch.go \
  packages/go/agenttask/failure_continuation_test.go \
  apps/agent/internal/taskloop/module.go \
  apps/agent/internal/taskloop/module_test.go \
  apps/agent/cmd/agent/main.go \
  apps/agent/cmd/agent/main_test.go \
  apps/agent/internal/bootstrap/module.go \
  apps/agent/internal/bootstrap/module_test.go
GOTMPDIR=/tmp/g go test -count=1 ./packages/go/agenttask ./apps/agent/internal/taskloop ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./apps/agent/internal/command
GOTMPDIR=/tmp/g go test -count=1 -race ./packages/go/agenttask ./apps/agent/internal/taskloop ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./packages/go/agentstate
go vet ./packages/go/agenttask ./apps/agent/internal/taskloop ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap
bash -n scripts/e2e-iop-agent-logged-smoke.sh
make test-iop-agent-logged-smoke-preflight
make -n test-iop-agent-logged-smoke
make build-agent
GOOS=darwin GOARCH=arm64 go build -trimpath -o /tmp/iop-agent-review-darwin-arm64 ./apps/agent/cmd/agent
GOTMPDIR=/tmp/g go test -count=1 ./...
git diff --check
```

Actual stdout/stderr:

```text
gofmt: exit 0 (the two recovery files listed in Deviations were also formatted)

ok  	iop/packages/go/agenttask	1.475s
ok  	iop/apps/agent/internal/taskloop	3.860s
ok  	iop/apps/agent/cmd/agent	3.583s
ok  	iop/apps/agent/internal/bootstrap	2.048s
ok  	iop/apps/agent/internal/command	0.013s

ok  	iop/packages/go/agenttask	2.798s
ok  	iop/apps/agent/internal/taskloop	9.011s
ok  	iop/apps/agent/cmd/agent	8.159s
ok  	iop/apps/agent/internal/bootstrap	7.780s
ok  	iop/packages/go/agentstate	1.122s

go vet: exit 0
bash -n: exit 0

bash -n scripts/e2e-iop-agent-logged-smoke.sh
jq -e . scripts/fixtures/iop-agent-smoke-manifest.schema.json >/dev/null
jq -e '.properties.evidence.properties.records | .minItems == 13 and .maxItems == 13' scripts/fixtures/iop-agent-smoke-manifest.schema.json >/dev/null
./scripts/e2e-iop-agent-logged-smoke.sh --help >/dev/null
./scripts/e2e-iop-agent-logged-smoke.sh --self-test
logged-smoke: self-test passed (derived-evidence rejection matrix and exact-PID cleanup)
logged-smoke: non-Darwin host gate passed

make -n test-iop-agent-logged-smoke: exit 0; all eight required variable
gates and the exact harness invocation were expanded.

mkdir -p build/bin
go build -trimpath -o build/bin/iop-agent ./apps/agent/cmd/agent
GOOS=darwin GOARCH=arm64 go build: exit 0

ok  	iop/apps/agent/cmd/agent	17.313s
ok  	iop/apps/agent/internal/bootstrap	6.660s
ok  	iop/apps/agent/internal/clientprocess	2.032s
ok  	iop/apps/agent/internal/command	0.022s
ok  	iop/apps/agent/internal/host	0.012s
ok  	iop/apps/agent/internal/localcontrol	0.444s
ok  	iop/apps/agent/internal/projectlog	6.998s
ok  	iop/apps/agent/internal/taskloop	19.687s
ok  	iop/apps/control-plane/cmd/control-plane	0.141s
ok  	iop/apps/control-plane/internal/wire	1.490s
ok  	iop/apps/edge/cmd/edge	0.052s
ok  	iop/apps/edge/internal/bootstrap	17.924s
ok  	iop/apps/edge/internal/configrefresh	0.030s
ok  	iop/apps/edge/internal/controlplane	4.461s
ok  	iop/apps/edge/internal/edgecmd	0.015s
ok  	iop/apps/edge/internal/edgevalidate	0.005s
ok  	iop/apps/edge/internal/events	0.003s
ok  	iop/apps/edge/internal/input	0.010s
ok  	iop/apps/edge/internal/input/a2a	0.006s
ok  	iop/apps/edge/internal/node	0.006s
ok  	iop/apps/edge/internal/openai	7.439s
ok  	iop/apps/edge/internal/opsconsole	0.008s
ok  	iop/apps/edge/internal/service	5.931s
ok  	iop/apps/edge/internal/transport	4.745s
ok  	iop/apps/node/cmd/node	0.024s
ok  	iop/apps/node/internal/adapters	0.016s
ok  	iop/apps/node/internal/adapters/ollama	0.017s
ok  	iop/apps/node/internal/adapters/openai_compat	0.132s
ok  	iop/apps/node/internal/adapters/vllm	0.126s
ok  	iop/apps/node/internal/bootstrap	1.369s
ok  	iop/apps/node/internal/node	0.817s
ok  	iop/apps/node/internal/router	0.507s
ok  	iop/apps/node/internal/store	0.045s
ok  	iop/apps/node/internal/transport	5.542s
ok  	iop/cmd/iop-provider-smoke	0.012s
ok  	iop/packages/go/agentconfig	0.036s
ok  	iop/packages/go/agentguard	0.014s
ok  	iop/packages/go/agentpolicy	0.009s
ok  	iop/packages/go/agentprovider/catalog	0.054s
ok  	iop/packages/go/agentprovider/cli	29.682s
ok  	iop/packages/go/agentprovider/cli/status	39.816s
ok  	iop/packages/go/agentruntime	0.605s
ok  	iop/packages/go/agentstate	0.088s
ok  	iop/packages/go/agenttask	1.119s
ok  	iop/packages/go/agentworkspace	6.372s
ok  	iop/packages/go/audit	0.002s
ok  	iop/packages/go/config	0.054s
ok  	iop/packages/go/hostsetup	0.005s
ok  	iop/packages/go/observability	0.010s
ok  	iop/packages/go/streamgate	0.880s
ok  	iop/scripts/inventory-query	0.006s

logged-smoke: manifest valid (6757 bytes)
promoted JSON redaction scan: no matches
git diff --check: exit 0
```

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Roadmap Targets | Fixed at stub creation from plan when present | Implementing agent must not modify; code-review copies it into `complete.log` as `Roadmap Completion` only on PASS |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: PASS
- Dimension Assessment:
  - Correctness: Pass
  - Completeness: Pass
  - Test Coverage: Pass
  - API Contract: Pass
  - Code Quality: Pass
  - Implementation Deviation: Pass
  - Verification Trust: Pass
  - Spec Conformance: Pass
- Findings: None
- Routing Signals:
  - `review_rework_count=4`
  - `evidence_integrity_failure=false`
- Next Step: Write `complete.log`, archive the active plan/review pair, move the completed split task to the monthly task archive, and report milestone completion metadata for runtime processing.
