<!-- task=m-iop-hot-path-one-shot-execution/05+02,04_request_coordinator plan=4 tag=REVIEW_API milestone-task=request-identity -->

# Enforce the Logical Request Lineage Fence

## For the Implementing Agent

Implement the two review fixes, run every command, and fill the implementation-owned sections in `CODE_REVIEW-cloud-G06.md` with actual notes and output. Keep the active files in place and report ready for review; finalization is code-review-skill only. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The endpoint-native builders now separate a committed prefix from the arriving result frontier, but the coordinator still permits the issued-call fence to be omitted and accepts an incomplete committed lineage. The builders also accept malformed committed prefixes and duplicate issued IDs that the plan and SDD require them to reject before coordinator mutation.

## Archive Evidence Snapshot

- Closing pair: `agent-task/m-iop-hot-path-one-shot-execution/05+02,04_request_coordinator/plan_cloud_G05_3.log` and `agent-task/m-iop-hot-path-one-shot-execution/05+02,04_request_coordinator/code_review_cloud_G05_3.log`; verdict `FAIL`.
- Required findings: make issued-call evidence and a complete, consistent committed lineage mandatory before consume; reject duplicate issued IDs and unknown/malformed committed-prefix roles for both endpoints.
- Fresh evidence: every planned focused/race/vet/format/diff command passed, but a reviewer-only test failed for unpinned issued-call hash, empty committed lineage, duplicate Chat issued ID, and an `alien` Chat prefix role. The temporary test was removed after capture.
- Dependencies: `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log` and `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log` are the exact completed predecessors.
- Roadmap carryover: `milestone-task=request-identity`; approved SDD scenario S05 and its Evidence Map remain the acceptance source.

## Dependencies and Execution Order

- `02+01_preset_generation` is satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log`.
- `04+02,03_preset_model_authorization` is satisfied by `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log`.

## Analysis

### Files Read

- `apps/edge/internal/openai/request_lineage.go`
- `apps/edge/internal/openai/request_coordinator.go`
- `apps/edge/internal/openai/request_coordinator_test.go`
- `apps/edge/internal/openai/chat_types.go`
- `apps/edge/internal/openai/chat_decode.go`
- `apps/edge/internal/openai/anthropic_types.go`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/PHASE.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-hot-path-one-shot-execution.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-contract/outer/openai-compatible-api.md`
- `agent-contract/outer/anthropic-compatible-api.md`
- `agent-test/local/rules.md`
- `agent-test/local/edge-smoke.md`
- `agent-task/m-iop-hot-path-one-shot-execution/05+02,04_request_coordinator/PLAN-cloud-G05.md`
- `agent-task/m-iop-hot-path-one-shot-execution/05+02,04_request_coordinator/CODE_REVIEW-cloud-G05.md`
- `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log`
- `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log`

### SDD Criteria

- SDD: `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`; status `[승인됨]`, lock released.
- Milestone metadata: `milestone-task=request-identity`; target Acceptance Scenario S05.
- S05 requires immutable committed history and tool binding, an active result frontier consumed exactly once, past issued-call/tool-schema mutation rejection, public/provider ID affinity, cross-principal/missing-state rejection, and race safety.
- The checklist therefore makes every lineage fence field mandatory, validates both endpoint-native histories before mutation, and requires negative no-mutation plus race evidence.

### Verification Context

- No external handoff is required. Repository-native sources are the active pair, SDD S05, Edge/local test rules, coordinator source/tests, and the two exact predecessor completion logs.
- Preflight: `/config/.local/bin/go`; `go version go1.26.2 linux/arm64`; `GOROOT=/config/opt/go`; current dirty worktree is the intentional execution-preset task state.
- Fresh planned focused tests, common race tests, `go vet`, `gofmt -d`, and `git diff --check` all passed. Fresh reviewer `go test -race -count=1 ./packages/go/config` also passed.
- A temporary reviewer-only package test deterministically failed four lineage-fence cases and was removed; no tool, credential, provider, remote runner, or live smoke is needed because handler integration remains excluded.
- Fresh `-count=1` and race output is required; cached success is not accepted. Confidence: high.

### Test Coverage Gaps

- Existing coordinator tests often omit the issued-call hash and pass zero-value `Committed` lineages, so they normalize the bypass instead of rejecting it.
- `TestLogicalRequestEndpointContinuationLineage` covers valid Chat/Anthropic continuations and a small malformed set but omits duplicate issued IDs, unknown committed-prefix roles, and endpoint-complete malformed/non-trailing tables.
- Rejection tests inspect public snapshot state but do not prove the stored committed lineage remains unchanged across every new validation failure.

### Symbol References

- No symbol is removed. `awaitToolResults`, `consumeContinuation`, `newChatContinuationLineage`, and `newAnthropicContinuationLineage` are currently referenced only by `request_coordinator_test.go`; `Server.logicalRequests()` owns the unintegrated coordinator instance.

### Split Judgment

Keep one plan. Raw endpoint parsing and the locked coordinator commit form one lineage-fence transaction: either half can pass independently while a malformed continuation still advances state.

### Scope Rationale

Change only `request_lineage.go`, `request_coordinator.go`, and their tests. Do not integrate Chat/Anthropic handlers, change external API/config contracts, add stage/artifact behavior, alter Server ownership, or touch sibling execution-preset work.

### Final Routing

- `evaluation_mode=isolated-reassessment`; `finalizer=finalize-task-policy.sh`, pair mode.
- Build closures are all true. Scores `(1,2,0,2,1)` produce G06 with `local-fit` base. `large_indivisible_context=false`; matched risks are `temporal_state`, `concurrent_consistency`, `boundary_contract`, `structured_interpretation`, and `variant_product` (5). `review_rework_count=3` and `evidence_integrity_failure=true` select `recovery-boundary`; build route is cloud `PLAN-cloud-G06.md`.
- Review closures are all true. Scores `(1,2,0,2,1)` produce official cloud G06 in `CODE_REVIEW-cloud-G06.md` using Codex `gpt-5.6-sol` xhigh.
- Capability gap: none. All required evidence is deterministic in the current checkout.

## Implementation Checklist

- [ ] Make issued-call evidence, result IDs, and a complete endpoint/toolset-consistent committed lineage mandatory; validate them before mutation, update every coordinator caller/fixture, and add no-mutation plus race regressions.
- [ ] Validate full Chat and Anthropic continuation sequences, reject duplicate issued IDs and unknown/malformed committed-prefix roles, and add endpoint-complete malformed/partial/duplicate/non-trailing table coverage.
- [ ] Run archived dependency, focused, common race including config, vet, formatting, and diff verification exactly as written.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_API-1] Make the Coordinator Lineage Fence Mandatory

#### Problem

`request_coordinator.go:229` accepts the issued-call hash as an optional variadic argument. Lines 298-309 skip hash validation when it was omitted, allow empty result-ID evidence, and store `continuation.Lineage.Committed` without checking that it is complete and consistent with the accepted endpoint/toolset. The reviewer reproduced successful consumption with an arbitrary unpinned issued-call hash and with a zero-value committed lineage.

#### Solution

Replace the optional hash with one required non-empty argument. Add a continuation-lineage validator that requires a complete prefix and committed lineage, matching endpoint/toolset, a changed committed history digest, a non-empty issued-call hash, and non-empty unique result IDs. Execute this validation and exact result-set comparison under the lock before clearing the frontier or updating lineage.

```go
// Before: request_coordinator.go:229
func (c *logicalRequestCoordinator) awaitToolResults(requestID, ownerEdgeID, stageID string, expected []logicalRequestExpectedTool, expectedIssuedCallHash ...string) (logicalRequestSnapshot, error)

// After: every frontier pins repeated issued-call evidence.
func (c *logicalRequestCoordinator) awaitToolResults(requestID, ownerEdgeID, stageID string, expected []logicalRequestExpectedTool, expectedIssuedCallHash string) (logicalRequestSnapshot, error)
```

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/request_coordinator.go` — require and validate every lineage-fence field before state mutation.
- [ ] `apps/edge/internal/openai/request_coordinator_test.go` — update all callers and add missing-hash, empty/inconsistent committed-lineage, result-ID, no-mutation, sequential advance, and race cases.

#### Test Strategy

Add `TestLogicalRequestMandatoryLineageFence` with table cases for empty/mismatched hash, missing/duplicate result IDs, zero/mismatched endpoint/toolset committed lineage, and unchanged committed history. Assert every rejection preserves stored lineage, expected frontier, active stage, mappings, and state; keep exactly-one race coverage with valid evidence.

#### Verification

Run `go test -race -count=1 ./apps/edge/internal/openai -run 'TestLogicalRequest(MandatoryLineageFence|Continuation|CommittedLineage|ConcurrentFrontier)'`; expect PASS.

### [REVIEW_API-2] Reject Malformed Endpoint-Native Histories

#### Problem

`request_lineage.go:117-123` and `request_lineage.go:267-278` collapse issued IDs into maps without rejecting duplicates. Both builders hash the committed prefix without validating its endpoint-allowed roles, so the reviewer reproduced acceptance of a duplicate Chat issued ID and an `alien` committed-prefix role despite the plan's explicit malformed/duplicate/unknown-role rejection requirement.

#### Solution

Validate every message role while retaining `json.RawMessage` and `UseNumber` canonical fidelity. Enforce Chat role/frontier placement and Anthropic user/assistant alternation/content-block legality needed by the lineage boundary, reject duplicate issued IDs before set comparison, and keep current result blocks strictly trailing with no mixed new instruction.

```go
// Before: request_lineage.go:117
expectedToolCallIDs[tc.ID] = struct{}{}

// After: duplicates fail before any lineage is returned.
if _, duplicate := expectedToolCallIDs[tc.ID]; duplicate {
    return logicalRequestContinuationLineage{}, fmt.Errorf("duplicate issued assistant tool call id %q", tc.ID)
}
expectedToolCallIDs[tc.ID] = struct{}{}
```

#### Modified Files and Checklist

- [ ] `apps/edge/internal/openai/request_lineage.go` — validate lossless Chat/Anthropic prefix roles, issued ID uniqueness, and frontier placement.
- [ ] `apps/edge/internal/openai/request_coordinator_test.go` — add parallel Chat/Anthropic rejection tables without weakening large-number and canonicalization coverage.

#### Test Strategy

Add `TestLogicalRequestEndpointContinuationRejectionMatrix`. Cover duplicate issued IDs, unknown/malformed prefix roles, partial result sets, duplicate results, non-trailing results, mixed Anthropic user instruction/result blocks, malformed assistant blocks, large adjacent integers, and canonical key reordering for both endpoints.

#### Verification

Run `go test -count=1 ./apps/edge/internal/openai -run 'TestLogicalRequest(Lineage|EndpointContinuation)'`; expect PASS.

## Modified Files Summary

| File | Items |
|------|-------|
| `apps/edge/internal/openai/request_coordinator.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/request_lineage.go` | REVIEW_API-2 |
| `apps/edge/internal/openai/request_coordinator_test.go` | REVIEW_API-1, REVIEW_API-2 |
| `agent-task/m-iop-hot-path-one-shot-execution/05+02,04_request_coordinator/CODE_REVIEW-cloud-G06.md` | REVIEW_API-1, REVIEW_API-2 |

## Final Verification

```bash
test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/02+01_preset_generation/complete.log
test -f agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/04+02,03_preset_model_authorization/complete.log
go test -count=1 ./apps/edge/internal/openai -run 'TestLogicalRequest(Lineage|EndpointContinuation)'
go test -race -count=1 ./apps/edge/internal/openai -run 'TestLogicalRequest(MandatoryLineageFence|Continuation|CommittedLineage|ConcurrentFrontier)'
go test -race -count=1 ./packages/go/streamgate ./packages/go/config ./apps/edge/internal/openai ./apps/edge/internal/service
go vet ./apps/edge/internal/openai
gofmt -d apps/edge/internal/openai/request_coordinator.go apps/edge/internal/openai/request_lineage.go apps/edge/internal/openai/request_coordinator_test.go
git diff --check
```

Expected: every command exits 0; both endpoint parsers reject the full malformed matrix without losing canonical JSON fidelity, every frontier pins a non-empty issued-call hash and complete committed lineage, all rejection paths preserve coordinator state, and exactly one valid concurrent continuation advances lineage. Live provider, smoke, and full-cycle execution remain out of scope until handler integration.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
