<!-- task=m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery plan=1 tag=API milestone-task=secure-transport,credential-lease,adapter-injection,revocation -->

# Code Review Reference - API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-01
task=m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery, plan=1, tag=API

## Roadmap Targets

- Milestone: `agent-roadmap/phase/operational-observability-provider-management/milestones/principal-provider-credential-slot-routing.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/operational-observability-provider-management/milestones/principal-provider-credential-slot-routing.md)
- Task ids:
  - `secure-transport`: Client-Control Plane, Control Plane-Edge, Edge-Node credential path 인증·기밀성
  - `credential-lease`: bounded, scoped, tamper-evident dedicated lease delivery
  - `adapter-injection`: Node adapter 직전 profile auth injection과 cleanup
  - `revocation`: rotation/revoke generation/revision fence
- Completion mode: check-on-pass

## Archive Evidence Snapshot

- `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/03+01,02_projection_auth/complete.log`: secret-free projection/cache와 managed ingress auth PASS.
- `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/04+03_principal_routes/complete.log`: principal route/discovery/no-fallback PASS.
- `agent-task/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log`: 현재 missing; 구현 전 exact path가 필요하다.
- prior unimplemented pair: `plan_cloud_G10_0.log`, `code_review_cloud_G10_0.log`.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare each item against source and verify the recorded output.

1. Append verdict and routing signals.
2. Archive review to `code_review_cloud_G10_1.log` and plan to `plan_cloud_G10_1.log`.
3. On PASS write `complete.log`, archive the task directory, and report milestone event metadata; on WARN/FAIL write the required next state.
4. Complete the review-only checklist at the final log path.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| API-1 Credential-bearing HTTPS operation and boundary TLS auth | [ ] |
| API-2 Issuer-signed, Node-sealed bounded lease | [ ] |
| API-3 Candidate-bound delivery and last-moment injection | [ ] |
| API-4 Secure activation and revoke/rotate ordering fence | [ ] |

## Implementation Checklist

- [ ] Enforce TLS/auth on every credential-bearing Client-CP, CP-Edge, and Edge-Node operation without plaintext fallback.
- [ ] Add a signed, scope-bound lease whose credential is sealed to the selected Node and never plaintext at Edge/protobuf debug boundaries.
- [ ] Bind lease acquisition/delivery to exact projection generation, candidate node, route/profile/target and revisions.
- [ ] Decrypt and inject only inside the Node adapter immediately before upstream send, then zero request-local plaintext.
- [ ] Activate managed mode only when the complete secure composition is valid and fence revoke/rotate/queue/retry ordering.
- [ ] Regenerate Go/Dart protobufs and add fresh peer, tamper, full-cycle, race, redaction and generation-determinism tests.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementing agents must not modify or check this section.

- [x] Append one verdict and verified `review_rework_count`, `evidence_integrity_failure`.
- [x] Verify verdict, dimensions and finding classifications match.
- [x] Archive active review to `code_review_cloud_G10_1.log`.
- [x] Archive active plan to `plan_cloud_G10_1.log`.
- [x] Verify `.gitignore` Agent-Ops managed block.
- [ ] If PASS, write `complete.log` and leave no active `.md` files.
- [ ] If PASS, archive this task directory and update the checklist at final location.
- [ ] If PASS, report milestone completion metadata without roadmap mutation.
- [ ] If PASS for split work, preserve active parent because siblings remain.
- [x] If WARN/FAIL, write matching next state and no `complete.log`.

## Deviations from Plan

_Record any deviations from the plan and rationale here._

## Key Design Decisions

_Record actual TLS identity model, canonical lease encoding, key distribution and cleanup decisions here._

## Reviewer Checkpoints

- Confirm the thin slot/route lifecycle adapter is HTTPS + principal-authenticated, secret create/rotate uses a bounded zeroed octet-stream body, Client proto stays hello-only, and remote bootstrap remains impossible.
- Confirm credential-enabled CP-Edge/Edge-Node use mTLS 1.3 and no reconnect/downgrade path selects plaintext.
- Confirm the lease is signed, sealed to the exact selected Node, and raw provider secret is absent from Edge memory-owned DTOs and protobuf debug output.
- Confirm issuer/recipient key formats and key IDs are deterministic, TTL stays within 5..300 seconds, cache/replay sets stay within 1..4096 entries, and overflow cannot evict a live replay fence.
- Confirm all scope dimensions, projection generation and revisions are checked both before send and at Node.
- Confirm adapter injection happens after validation and immediately before the single upstream call, with cleanup on every terminal path.
- Confirm enabled mode is a deployable secure path rather than a dormant composition and disabled mode preserves legacy behavior.
- Confirm revoke/rotate ordering matches S13 and no stale retry/fallback occurs.

## Verification Results

### Environment and generation determinism

Command:

```bash
command -v go && go version && go env GOROOT
command -v protoc && command -v protoc-gen-dart && command -v flutter
git status --short --branch
make proto
make proto-dart
sha256sum proto/gen/iop/control.pb.go proto/gen/iop/runtime.pb.go apps/client/lib/gen/proto/iop/control.pb.dart apps/client/lib/gen/proto/iop/control.pbenum.dart apps/client/lib/gen/proto/iop/control.pbjson.dart apps/client/lib/gen/proto/iop/control.pbserver.dart apps/client/lib/gen/proto/iop/runtime.pb.dart apps/client/lib/gen/proto/iop/runtime.pbenum.dart apps/client/lib/gen/proto/iop/runtime.pbjson.dart apps/client/lib/gen/proto/iop/runtime.pbserver.dart > /tmp/iop-credential-proto-first.sha256
make proto
make proto-dart
sha256sum proto/gen/iop/control.pb.go proto/gen/iop/runtime.pb.go apps/client/lib/gen/proto/iop/control.pb.dart apps/client/lib/gen/proto/iop/control.pbenum.dart apps/client/lib/gen/proto/iop/control.pbjson.dart apps/client/lib/gen/proto/iop/control.pbserver.dart apps/client/lib/gen/proto/iop/runtime.pb.dart apps/client/lib/gen/proto/iop/runtime.pbenum.dart apps/client/lib/gen/proto/iop/runtime.pbjson.dart apps/client/lib/gen/proto/iop/runtime.pbserver.dart > /tmp/iop-credential-proto-second.sha256
diff -u /tmp/iop-credential-proto-first.sha256 /tmp/iop-credential-proto-second.sha256
make client-test
(cd apps/client && flutter analyze)
```

Output and exit status:

_Fill actual stdout/stderr and exit status._

### Tests, race and full-cycle wire smoke

Command:

```bash
go test -count=1 ./packages/go/auth ./packages/go/config ./packages/go/credentiallease
go test -count=1 ./apps/control-plane/... ./apps/edge/... ./apps/node/...
go test -count=1 -race ./packages/go/credentiallease ./apps/control-plane/internal/credentiallease ./apps/edge/internal/authprojection ./apps/edge/internal/service ./apps/node/internal/node
make test-control-plane-edge-wire
```

Output and exit status:

_Fill actual stdout/stderr, exit status and sanitized full-cycle observations._

### Vet, diff and structural secret guard

Command:

```bash
go vet ./apps/control-plane/... ./apps/edge/... ./apps/node/... ./packages/go/...
git diff --check
if rg --sort path -n 'bytes[[:space:]]+(secret|provider_secret)|map<string, string>[[:space:]]+(credential|provider_auth)' proto/iop/runtime.proto; then exit 1; fi
```

Output and exit status:

_Fill actual stdout/stderr and exit status. Also list the HTTPS sensitive-input boundary, intentional sealed-payload/injection references and sentinel-absence evidence._

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, fill it before saving. Leave review-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header, Overview, Review Agent Instructions | Fixed | Implementer must not modify/execute |
| Roadmap Targets | Fixed | Implementer must not modify |
| Archive Evidence Snapshot | Fixed | Read only cited evidence when needed |
| Implementation Item Completion | Fixed names | Implementer checks status only |
| Implementation Checklist | Fixed text/order | Implementer checks status only |
| Review-Only Checklist | Review agent only | Implementer must not modify |
| Deviations, Key Design Decisions | Implementing agent | Replace placeholders |
| Reviewer Checkpoints | Fixed | Pre-filled from plan |
| Verification Results | Fixed commands | Implementer fills actual output only |
| Code Review Result | Review agent appends | Not in stub |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail — none of the S10-S13 secure-delivery runtime paths is implemented.
  - Completeness: Fail — all four implementation items and every implementation checklist item remain incomplete.
  - Test coverage: Fail — the required TLS, lease, delivery, injection, revocation, and full-cycle tests do not exist.
  - API contract: Fail — the active contracts still describe plaintext transport, dormant projection activation, and caller-supplied provider authorization forwarding.
  - Code quality: Pass — no separate code-quality defect was identified in the existing prerequisite implementation.
  - Implementation deviation: Fail — implementation started neither the planned secure transport nor the signed/sealed credential lease path, and the declared predecessor remains incomplete.
  - Verification trust: Fail — required production paths and test packages are absent, and the review contains no executed command output or exit status.
  - Spec conformance: Fail — SDD scenarios S10, S11, S12, and S13 have no implementation or Evidence Map closure.
- Findings:
  - Required — `apps/control-plane/cmd/control-plane/server.go:75`, `apps/control-plane/cmd/control-plane/server.go:80`, `apps/control-plane/cmd/control-plane/server.go:164`, `apps/control-plane/internal/wire/edge_server.go:61`, `apps/edge/internal/controlplane/connector.go:202`, `apps/edge/internal/transport/server.go:105`, and `apps/node/internal/transport/client.go:130`: credential management is not mounted, HTTP still uses `ListenAndServe`, and both internal hops still use plaintext TCP. Implement API-1 with TLS 1.3 identity validation, authenticated HTTPS credential operations, mTLS on CP-Edge and Edge-Node, fail-closed configuration, and the planned peer matrix tests.
  - Required — `proto/iop/runtime.proto:65`, `apps/edge/internal/openai/provider_tunnel.go:158`, `apps/edge/internal/service/provider_tunnel.go:384`, `apps/node/internal/node/tunnel_handler.go:24`, and `apps/node/internal/adapters/openai_compat/provider_tunnel.go:25`: no signed, Node-sealed credential lease exists; the current production path still copies caller-supplied provider authorization through the generic `headers` map and sends it upstream unchanged. Implement API-2/API-3 with canonical signed scope, Node recipient sealing, a dedicated runtime field, complete scope/revision validation, atomic consumption, last-moment profile auth injection, and terminal-path zeroization.
  - Required — `agent-task/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/PLAN-cloud-G10.md:341`: the required predecessor `agent-task/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log` is still absent, while the planned `packages/go/credentiallease`, Control Plane lease issuer, Edge lease cache/delivery, Node validation/injection, and revocation fence files do not exist. Complete predecessor 07 first, then implement API-2 through API-4 and the deterministic expiry, replay, rotation, revoke, queue, retry, and race tests before this dependent task runs again.
  - Required — `agent-task/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/CODE_REVIEW-cloud-G10.md:51`: every implementation status/checklist entry is unchecked and every verification result remains a placeholder; fresh reviewer commands also fail because `./packages/go/credentiallease` and `./apps/control-plane/internal/credentiallease` do not exist. After implementation, execute every plan command, paste actual stdout/stderr and exit status, record the secure full-cycle observations and redaction scan, and check the implementation-owned evidence items.
- Routing Signals: `review_rework_count=1`, `evidence_integrity_failure=true`
- Next Step: Create and execute a freshly routed follow-up PLAN/CODE_REVIEW pair for the Required findings after predecessor 07 is complete.
