<!-- task=m-iop-agent-cli-runtime/10+06_state_recovery plan=3 tag=REVIEW_REVIEW_REVIEW_API -->

# Code Review Reference - REVIEW_REVIEW_REVIEW_API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-07-29
task=m-iop-agent-cli-runtime/10+06_state_recovery, plan=3, tag=REVIEW_REVIEW_REVIEW_API

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone document](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `state-recovery`: singleton/workspace lease, checkpoint, restart reconciliation
- Completion mode: check-on-pass

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-iop-agent-cli-runtime/10+06_state_recovery/plan_cloud_G07_2.log`
- Prior review: `agent-task/m-iop-agent-cli-runtime/10+06_state_recovery/code_review_cloud_G08_2.log`
- Verdict: `FAIL`
- Findings: Required=1, Suggested=0, Nit=0.
- Required finding: an early project claim is released durably after a foreign workspace conflict but remains in `leaseSet`, so the next independent project is fenced by the intentionally released token.
- Affected files: `packages/go/agenttask/reconcile.go` and `packages/go/agenttask/manager_test.go`.
- Fresh reviewer evidence: the focused lease matrix, twenty-repeat matrix, race suite, shared-package suite, vet, formatting, proto generation, contract search, and `git diff --check` all passed.
- Focused failure evidence: a two-project reviewer reproducer returned `agenttask lease ownership lost during operation: project lease a-blocked no longer matches`; the independent project never ran.
- Roadmap carryover: SDD S09 and Milestone task `state-recovery` remain incomplete until a project-local ownership conflict cannot abort another project.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G06.md` → `code_review_cloud_G06_3.log` and `PLAN-cloud-G06.md` → `plan_cloud_G06_3.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-iop-agent-cli-runtime/10+06_state_recovery/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, report completion event metadata. Roadmap state check and `update-roadmap` calls are runtime responsibilities.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.
## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_REVIEW_REVIEW_API-1 — Retire early project claims before exact release | [x] |

## Implementation Checklist

- [x] Remove each early project claim from `leaseSet` before exact-token release so foreign workspace conflicts remain project-local.
- [x] Add a deterministic multi-project regression proving a blocked workspace owner does not fence an independent project and preserves the foreign lease.
- [x] Run the focused, repeated, race, shared-package, vet, formatting, contract, proto, and diff verification commands.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G06_3.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G06_3.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [x] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [x] If PASS, move active task directory `agent-task/m-iop-agent-cli-runtime/10+06_state_recovery/` to `agent-task/archive/YYYY/MM/m-iop-agent-cli-runtime/10+06_state_recovery/` and update this checklist at the final archive path.
- [x] If PASS and task group is `m-<milestone-slug>`, report completion event metadata for runtime, without modifying roadmap or directly calling `update-roadmap`.
- [x] If PASS for split work, remove empty active parent `agent-task/m-iop-agent-cli-runtime/` or verify it was kept due to remaining siblings/files.
- [ ] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

None.

## Key Design Decisions

- Updated early project claim release paths in `packages/go/agenttask/reconcile.go` to invoke `leases.Remove(projectClaim)` before `m.releaseExact(ownedCtx, projectClaim)` using a local `releaseProjectClaim` helper. This ensures the released claim handle is removed from the live supervisor set prior to durable exact-token release, preventing stale lease tracking from causing `ErrLeaseLost` on subsequent independent projects during reconciliation loop.
- Added `TestWorkspaceLeaseConflictDoesNotFenceIndependentProject` in `packages/go/agenttask/manager_test.go` to prove that a project blocked by a foreign workspace lease does not fence an independent project in the same reconciliation pass, while preserving foreign leases and preventing claim leaks.

## Reviewer Checkpoints

- Confirm every branch that releases `projectClaim` before final reconciliation cleanup removes the exact handle from `leaseSet` first.
- Confirm early cleanup uses the unfenced exact-token release helper and cannot delete a foreign or successor workspace/project token.
- Confirm a foreign workspace lease blocks only its project while another project in a distinct workspace completes in the same reconciliation.
- Confirm the regression asserts the foreign token is retained, exactly one independent provider call occurs, and no manager-owned claim leaks.
- Confirm the existing renewal, immediate-loss, CAS-retry, integration, cleanup, and successor-retention matrix still passes.

## Verification Results

Paste actual stdout/stderr and exit status for every command. Do not replace output with a summary.

### Environment identity

```bash
command -v go && readlink -f "$(command -v go)" && go version && go env GOROOT
```

```text
/config/.local/bin/go
/config/opt/go/bin/go
go version go1.26.2 linux/arm64
/config/opt/go
exit status: 0
```

### Proto generation

```bash
make proto
```

```text
protoc \
	--go_out=. \
	--go_opt=module=iop \
	--proto_path=. \
	proto/iop/runtime.proto \
	proto/iop/node.proto \
	proto/iop/control.proto \
	proto/iop/job.proto
exit status: 0
```

### Focused project-local lease regression

```bash
go test -count=1 -run '^TestWorkspaceLeaseConflictDoesNotFenceIndependentProject$' -v ./packages/go/agenttask
```

```text
=== RUN   TestWorkspaceLeaseConflictDoesNotFenceIndependentProject
--- PASS: TestWorkspaceLeaseConflictDoesNotFenceIndependentProject (0.00s)
PASS
ok  	iop/packages/go/agenttask	0.004s
exit status: 0
```

### Focused lease lifecycle matrix

```bash
go test -count=1 -run '^(TestWorkspaceLeaseConflictDoesNotFenceIndependentProject|TestLeaseSupervisorRenewsAllTrackedScopesAndDeniesTakeover|TestLeaseLossImmediatelyFencesProviderAndReviewResults|TestLeaseLossImmediatelyFencesIntegrationResult|TestLeaseCleanupReleasesOwnedClaimsAndPreservesSuccessors)$' -v ./packages/go/agenttask
```

```text
=== RUN   TestWorkspaceLeaseConflictDoesNotFenceIndependentProject
--- PASS: TestWorkspaceLeaseConflictDoesNotFenceIndependentProject (0.00s)
=== RUN   TestLeaseSupervisorRenewsAllTrackedScopesAndDeniesTakeover
--- PASS: TestLeaseSupervisorRenewsAllTrackedScopesAndDeniesTakeover (0.00s)
=== RUN   TestLeaseLossImmediatelyFencesProviderAndReviewResults
=== RUN   TestLeaseLossImmediatelyFencesProviderAndReviewResults/provider
=== RUN   TestLeaseLossImmediatelyFencesProviderAndReviewResults/review
--- PASS: TestLeaseLossImmediatelyFencesProviderAndReviewResults (0.01s)
    --- PASS: TestLeaseLossImmediatelyFencesProviderAndReviewResults/provider (0.00s)
    --- PASS: TestLeaseLossImmediatelyFencesProviderAndReviewResults/review (0.00s)
=== RUN   TestLeaseLossImmediatelyFencesIntegrationResult
--- PASS: TestLeaseLossImmediatelyFencesIntegrationResult (0.00s)
=== RUN   TestLeaseCleanupReleasesOwnedClaimsAndPreservesSuccessors
=== RUN   TestLeaseCleanupReleasesOwnedClaimsAndPreservesSuccessors/normal
=== RUN   TestLeaseCleanupReleasesOwnedClaimsAndPreservesSuccessors/successors
--- PASS: TestLeaseCleanupReleasesOwnedClaimsAndPreservesSuccessors (0.00s)
    --- PASS: TestLeaseCleanupReleasesOwnedClaimsAndPreservesSuccessors/normal (0.00s)
    --- PASS: TestLeaseCleanupReleasesOwnedClaimsAndPreservesSuccessors/successors (0.00s)
PASS
ok  	iop/packages/go/agenttask	0.021s
exit status: 0
```

### Repeated deterministic lease matrix

```bash
go test -count=20 -run '^(TestWorkspaceLeaseConflictDoesNotFenceIndependentProject|TestLeaseSupervisorRenewsAllTrackedScopesAndDeniesTakeover|TestLeaseLossImmediatelyFencesProviderAndReviewResults|TestLeaseLossImmediatelyFencesIntegrationResult|TestLeaseCleanupReleasesOwnedClaimsAndPreservesSuccessors)$' ./packages/go/agenttask
```

```text
ok  	iop/packages/go/agenttask	0.408s
exit status: 0
```

### Race verification

```bash
go test -count=1 -race ./packages/go/agentstate ./packages/go/agenttask
```

```text
ok  	iop/packages/go/agentstate	1.095s
ok  	iop/packages/go/agenttask	1.294s
exit status: 0
```

### Shared package regression

```bash
go test -count=1 ./packages/go/...
```

```text
ok  	iop/packages/go/agentconfig	0.047s
ok  	iop/packages/go/agentguard	0.014s
ok  	iop/packages/go/agentpolicy	0.013s
ok  	iop/packages/go/agentprovider/catalog	0.091s
ok  	iop/packages/go/agentprovider/cli	30.725s
?   	iop/packages/go/agentprovider/cli/internal/testutil	[no test files]
ok  	iop/packages/go/agentprovider/cli/status	40.135s
ok  	iop/packages/go/agentruntime	0.758s
ok  	iop/packages/go/agentstate	0.109s
ok  	iop/packages/go/agenttask	0.276s
ok  	iop/packages/go/agentworkspace	1.765s
ok  	iop/packages/go/audit	0.010s
?   	iop/packages/go/auth	[no test files]
ok  	iop/packages/go/config	0.113s
?   	iop/packages/go/events	[no test files]
ok  	iop/packages/go/hostsetup	0.011s
?   	iop/packages/go/jobs	[no test files]
?   	iop/packages/go/metadata	[no test files]
ok  	iop/packages/go/observability	0.033s
?   	iop/packages/go/policy	[no test files]
ok  	iop/packages/go/streamgate	0.913s
?   	iop/packages/go/version	[no test files]
exit status: 0
```

### Vet

```bash
go vet ./packages/go/agentstate ./packages/go/agenttask
```

```text
exit status: 0
```

### Formatting

```bash
gofmt -d packages/go/agenttask/reconcile.go packages/go/agenttask/manager_test.go
```

```text
exit status: 0
```

### Contract conformance

```bash
rg --sort path -n 'Every external result|only exact tokens|atomic fence|project-local' agent-contract/inner/agent-runtime.md agent-contract/inner/iop-agent-cli-runtime.md
```

```text
agent-contract/inner/agent-runtime.md:57:- Lease renewal and fencing: manager starts a bounded-background supervisor after the device claim that renews every tracked lease by CAS at a fraction of `LeaseDuration`. The guarded reconciliation context is cancelled the moment any renewal cannot prove its token still matches current state. Every external result (provider submission, review outcome, integration result) is followed by an atomic fence validation against all live tokens before the result enters durable state. On fence failure the guarded context is cancelled, the external call is cancelled, and only exact tokens are released; a successor lease is never overwritten or deleted.
agent-contract/inner/agent-runtime.md:70:- project-local workflow, admission, invocation, review와 integration blocker는 다른 project나 independent sibling 진행을 중단하지 않는다.
agent-contract/inner/agent-runtime.md:80:- `AdmissionResult`는 `permitted | blocked`, typed `Blocker`, raw path를 포함하지 않는 actionable `Notification`을 반환한다. 차단은 task/project-local result이며 다른 project provider를 stop하지 않는다. interactive approval fallback은 없다.
exit status: 0
```

### Diff check

```bash
git diff --check
```

```text
exit status: 0
```

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Roadmap Targets | Fixed at stub creation from plan when present | Implementing agent must not modify; code-review copies it into `complete.log` as `Roadmap Completion` only on PASS |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Agent UI Completion | Mixed | Present only for plan-required agent-ui code work; implementing agent fills actual evidence, review agent applies the `implemented` status/evidence update on PASS and copies the section into `complete.log` |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: PASS

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Pass | Every early project-claim release removes the exact handle from `leaseSet` before exact-token release, so a foreign workspace conflict no longer fences the next independent project. |
| Completeness | Pass | The shared helper covers the post-claim load error, workspace-claim error, and foreign-workspace branches, and all implementation and verification checklist items are complete. |
| Test coverage | Pass | The deterministic two-project regression, focused lease matrix, twenty-repeat matrix, race suite, and shared-package suite all pass with meaningful assertions for independent progress, foreign-token retention, and claim cleanup. |
| API contract | Pass | The implementation preserves exact-token cleanup and the `iop.agent-runtime` requirement that a project-local blocker must not stop another project. |
| Code quality | Pass | The local release helper keeps the required remove-before-release ordering explicit without changing public APIs or persisted lease records. |
| Implementation deviation | Pass | The implementation stays within the planned two-file correction and adds no behavioral deviation. |
| Verification trust | Pass | Fresh reviewer execution reproduced the claimed environment, proto generation, focused/repeated/race/shared-package tests, vet, formatting, contract search, and diff-check results. |
| Spec conformance | Pass | The regression supplies SDD S09 evidence for singular ownership and exact retained state while allowing independent project progress. |

### Findings

None.

### Routing Signals

- `review_rework_count=3`
- `evidence_integrity_failure=false`

### Next Step

- Archive the active pair, write `complete.log`, move the completed split task under `agent-task/archive/2026/07/`, and report the `m-iop-agent-cli-runtime` completion event metadata.
