<!-- task=m-iop-agent-cli-runtime plan=3 tag=REVIEW_REVIEW_REVIEW_API -->

# Plan - Exact compiled lifecycle evidence and bounded dispatcher cutover ownership

## For the Implementing Agent

Filling the implementation-owned sections in `CODE_REVIEW-*-G??.md` is mandatory. Implement the checklist, run every verification command, paste actual notes and output into the active review file, leave the active Plan/Review files in place, and report ready for review. Final verdicts, log renames, `complete.log`, and archive moves belong only to the code-review skill. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields; do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The third review confirmed the canonical `m-foo` round-trip and exact two-work status projection, but the compiled-binary test replaced its lifecycle subprocess coverage instead of extending it. The same implementation also changed the S13 cutover oracle outside the PLAN write-set and left the standalone contract describing a different validation owner. This follow-up restores additive compiled evidence and makes the transitional dispatcher exception explicit, narrow, and contract-aligned without changing production runtime behavior.

## Archive Evidence Snapshot

- `agent-task/m-iop-agent-cli-runtime/plan_local_G07_0.log` and `agent-task/m-iop-agent-cli-runtime/code_review_cloud_G07_0.log`: first loop, FAIL with 2 Required findings.
- `agent-task/m-iop-agent-cli-runtime/plan_cloud_G06_1.log` and `agent-task/m-iop-agent-cli-runtime/code_review_cloud_G07_1.log`: second loop, FAIL with 2 Required findings.
- `agent-task/m-iop-agent-cli-runtime/plan_cloud_G07_2.log` and `agent-task/m-iop-agent-cli-runtime/code_review_cloud_G07_2.log`: third loop, FAIL with 2 Required, 0 Suggested, and 0 Nit findings.
- Required evidence finding: `TestBuiltBinaryHeadlessS10Transcript` asserts exact seeded two-work status but dropped the exact compiled `preview`, lifecycle mutation, and selection-persistence steps that the follow-up was supposed to strengthen additively.
- Required ownership/contract finding: `apps/agent/internal/taskloop/cutover_test.go` changed outside the prior PLAN write-set and accepts the dispatcher-owned validation path while `agent-contract/inner/iop-agent-cli-runtime.md` still says active plan/review workflows use only the Go validator.
- Fresh reviewer evidence: the canonical slug suite, exact adapter/in-process transcript suite, cutover guard tests, focused vet, and `git diff --check` passed. The reviewer did not invoke the product `iop-agent` binary or a real provider CLI.
- Roadmap carryover: `cli-surface` remains the only unchecked Milestone Task and still requires exact SDD S10 headless evidence plus `Roadmap Completion`.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone document](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `cli-surface`: headless binary, split config, Milestone discovery/selection/preview, lifecycle, and per-work overlay/integration/blocker observation
- Completion mode: check-on-pass

## Analysis

### Files Read

- Production and adapter boundaries: `apps/agent/internal/taskloop/workflow.go`, `apps/agent/internal/taskloop/module.go`, `apps/agent/internal/command/service.go`, `apps/agent/cmd/agent/main.go`.
- Tests: `apps/agent/cmd/agent/main_test.go`, `apps/agent/internal/taskloop/workflow_test.go`, `apps/agent/internal/taskloop/cutover_test.go`.
- Contract and design: `agent-contract/index.md`, `agent-contract/inner/iop-agent-cli-runtime.md`, `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`, `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`, `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`.
- Rules and workflow: `agent-ops/rules/project/rules.md`, `agent-ops/rules/project/domain/agent/rules.md`, `agent-ops/rules/project/domain/platform-common/rules.md`, `agent-ops/rules/project/domain/testing/rules.md`, `agent-test/local/rules.md`, `agent-test/local/testing-smoke.md`, `agent-test/local/platform-common-smoke.md`, `agent-ops/skills/common/code-review/SKILL.md`, `agent-ops/skills/common/plan/SKILL.md`, and `agent-ops/skills/common/finalize-task-routing/SKILL.md`.
- Active loop evidence: `agent-task/m-iop-agent-cli-runtime/PLAN-cloud-G07.md` and `agent-task/m-iop-agent-cli-runtime/CODE_REVIEW-cloud-G07.md`.

### SDD Criteria

- SDD: `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`; status `[approved]`, lock released, no unresolved user review.
- Primary target: Acceptance Scenario `S10`, Milestone Task `cli-surface`.
- S10 Evidence Map: binary plus split-config command integration must produce exact headless operation evidence and `cli-surface` Roadmap Completion.
- Supporting boundary: S13 keeps Python fixtures and the dispatcher transition bounded until Milestone completion while product runtime ownership remains Go. The contract and cutover guard must describe the same transitional exception before the S10 full-suite result is trustworthy.
- These rows require additive compiled-binary lifecycle/status assertions, a bounded no-provider dispatcher-validation exception, and a fresh deterministic matrix before PASS.

### Verification Context

- Supplied handoff: the third review findings, active pair, implementation output, current diff, and prior archive summary.
- Local environment: `/config/workspace/iop-s0`, branch `dev`, Go `/config/.local/bin/go`, `go version go1.26.2 linux/arm64`, `GOROOT=/config/opt/go`.
- Fresh reviewer commands passed with an isolated `/var/tmp` Go cache: the canonical slug/cutover test selection; command and CLI tests through `TestRunFullHeadlessS10Transcript` excluding product-binary execution; focused vet; `git diff --check`.
- Preconditions: preserve the already-correct canonical slug production fix and exact adapter DTO. Use deterministic temporary fixtures and proof-owned fake/no-op provider ports only.
- Constraints: do not start a real provider CLI; do not change shared manager state, command DTOs, config schema, roadmap state, SDD state, or Agent-Ops common/project files. Do not use `iop-agent` as an active `agent-task` execution or validation path.
- External Verification Preflight: not applicable. Darwin remains a local cross-build; logged-in macOS/provider behavior is prior S14 scope.
- Gap and confidence: the two failures are directly visible in the diff and contract. Confidence is high.
- Agent spec: `agent-spec/index.md` has no matching standalone `iop-agent` CLI spec; code, contract, SDD, and tests remain authoritative.

### Test Coverage Gaps

- Compiled CLI lifecycle: current compiled evidence covers exact validate/list/seeded status but no longer covers preview, start, stop, resume, selection, or cross-process persistence.
- Dispatcher exception: the current injected-caller regression rejects another skill, but the allowed-document exception is broader than the exact documented validation command and the contract still names only the Go validator.
- Canonical slug and adapter projection: covered and passing; retain without further production changes.

### Symbol References

- No production symbol is renamed or removed.
- Test-only ownership helpers are local to `cutover_test.go`; grep all references before replacing or renaming them.

### Split Judgment

Keep one plan. The compiled S10 transcript is accepted only after the full `./apps/agent/...` suite has a contract-consistent S13 ownership oracle, so splitting would leave neither child with independent PASS evidence for `cli-surface`.

### Scope Rationale

- Change test and contract evidence only; do not change CLI/runtime production behavior.
- Retain prior task-owned S10 files in the write claim until final PASS, but do not edit them unless a focused regression proves it necessary.
- Do not modify roadmap, SDD, agent-spec, or Agent-Ops rules/skills. The contract clarification describes the existing transitional boundary rather than changing product design.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer `finalize-task-policy.sh`, mode `pair`.
- Build closures: scope/context/verification/evidence/ownership/decision all `true`; grade scores scope `2`, state `1`, blast `1`, evidence `2`, verification `2` = `G08`; base `local-fit`, final `recovery-boundary`, lane `cloud`.
- Review closures: scope/context/verification/evidence/ownership/decision all `true`; grade scores `2/1/1/2/2` = `G08`; route `official-review`, lane `cloud`, adapter `codex`, model `gpt-5.6-sol`, reasoning `xhigh`.
- `large_indivisible_context=false`; positive loop risks: `boundary_contract`, `structured_interpretation` (`loop_risk_count=2`).
- Recovery signals: `review_rework_count=3`, `evidence_integrity_failure=false`; recovery boundary matched.
- Capability gap: none.
- Canonical files: `PLAN-cloud-G08.md`, `CODE_REVIEW-cloud-G08.md`.

## Implementation Checklist

- [ ] [REVIEW_REVIEW_REVIEW_API-1] Restore the full exact compiled-binary lifecycle transcript while retaining exact validation and seeded ordered two-work status evidence.
- [ ] [REVIEW_REVIEW_REVIEW_API-2] Bound the transitional dispatcher validation exception in the cutover guard and align the standalone runtime contract.
- [ ] [REVIEW_REVIEW_REVIEW_API-3] Run the complete fresh S10/S13 verification matrix without real provider execution and record exact output.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_REVIEW_REVIEW_API-1] Additive compiled-binary lifecycle and status evidence

**Problem**

`apps/agent/cmd/agent/main_test.go:630-654` now defines only three subprocess steps. The prior exact compiled `preview`, start/stop/resume, and selection-persistence steps were removed even though the previous plan required adding seeded two-work status to the compiled transcript.

**Solution**

- Build the binary once and use two deterministic fixture phases: an unstarted `createRuntimeFixture` phase for the full exact lifecycle/selection transcript and a separate seeded `createCommandLifecycleFixture` phase for exact two-work status.
- Compare complete stdout and stderr for validate, list, preview, observed status, start, persisted started status, stop, resume, milestone select, persisted selected status, and seeded blocked status.
- Keep validation output exact by deriving only its content-addressed revision and catalog counts from the fixture loaders.
- Keep the seeded phase read-only after `seedCommandLifecycleState` proves exactly two dispatch/review/validation calls; the compiled binary must not receive a command that can launch a provider.

Before (`apps/agent/cmd/agent/main_test.go:630`):

```go
steps := []struct {
    name       string
    args       []string
    wantStdout string
    wantStderr string
}{
    {name: "validate", /* ... */},
    {name: "milestone list", /* ... */},
    {name: "seeded status", /* ... */},
}
```

After:

```go
runBuiltBinaryTranscript(t, binPath, lifecycleSteps)
runBuiltBinaryTranscript(t, binPath, seededStatusSteps)
```

**Modified Files and Checklist**

- [ ] `apps/agent/cmd/agent/main_test.go`: restore every exact compiled lifecycle/selection step and keep the exact seeded two-work status phase.

**Test Strategy**

- Update `TestBuiltBinaryHeadlessS10Transcript`; do not add a second production path.
- Assert every subprocess exit, stdout, and stderr exactly.
- Keep `TestAdapterStatusPreservesAllWork` and `TestRunFullHeadlessS10Transcript` exact.
- Use only temporary configs/state and deterministic fake/no-op provider boundaries.

**Verification**

```bash
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache go test -count=1 ./apps/agent/cmd/agent -run '^(TestAdapterStatusPreservesAllWork|TestRunFullHeadlessS10Transcript|TestBuiltBinaryHeadlessS10Transcript)$'
```

Expected: PASS; the compiled transcript includes the full lifecycle/selection sequence and exact seeded two-work status with no real provider CLI.

### [REVIEW_REVIEW_REVIEW_API-2] Contract-aligned bounded dispatcher exception

**Problem**

`apps/agent/internal/taskloop/cutover_test.go:14-20,177-183` changed outside the prior PLAN write-set, excludes broad ownership documents from caller scanning, and expects the dispatcher validator command. `agent-contract/inner/iop-agent-cli-runtime.md:14,50` still states that active plan/review workflows use only the Go validator, so passing cutover tests and the written contract disagree.

**Solution**

- Keep the dispatcher-owning project skill as the declared transitional Agent-Ops orchestration owner, not a product runtime caller.
- Allow the exact `dispatch.py --workspace ... --validate-plan ...` finalization command only in the declared plan/code-review documents. Scan all remaining content in those documents and reject additional Python dispatcher caller forms.
- Retain the injected executable/other-skill caller regression and add a regression proving that an extra caller inside an allowed document is rejected.
- Update the S13 contract summary and Evidence Map to distinguish the Go-owned product validator from the transitional Agent-Ops dispatcher validation preflight. Preserve zero Python fallback/caller claims for the product runtime and retain disposal at Milestone completion.

Before (`apps/agent/internal/taskloop/cutover_test.go:181`):

```go
if isCutoverStaticOwnershipDocument(relative) ||
    relative == "agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md" {
    return nil
}
```

After:

```go
if isDeclaredDispatcherOwner(relative) {
    return nil
}
documents = append(documents, relative)
```

The allowed plan/review documents must be scanned with only their exact declared validation command removed from consideration.

**Modified Files and Checklist**

- [ ] `apps/agent/internal/taskloop/cutover_test.go`: narrow the exact command exception and add an allowed-document escape regression.
- [ ] `agent-contract/inner/iop-agent-cli-runtime.md`: align the S13 transitional validation ownership wording with the bounded guard.

**Test Strategy**

- Extend the cutover table/fixtures to prove the exact validation command passes in declared documents.
- Prove a second dispatcher caller in a declared document and an injected caller in any other skill/executable document both fail with a path and line.
- Retain static route-table rejection for documents where the product contract requires it.

**Verification**

```bash
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache go test -count=1 ./apps/agent/internal/taskloop -run '^(TestCutoverProductionOwnershipHasNoReferenceCallerOrStaticRouteTable|TestCutoverProductionOwnershipRejectsInjectedPythonCaller|TestCutoverProductionOwnershipRejectsUnexpectedCallerInAllowedDocument)$'
```

Expected: PASS; only the exact declared validation preflight and the dispatcher owner are exempt, and contract wording matches the guard.

### [REVIEW_REVIEW_REVIEW_API-3] Fresh S10/S13 closure

**Problem**

Focused tests pass while the compiled transcript and cutover contract are incomplete. `cli-surface` cannot emit trustworthy Roadmap Completion until both evidence boundaries pass together on the current checkout.

**Solution**

- Run every command below with fresh caches outside the repository.
- Preserve deterministic fake/no-op provider boundaries and record raw stdout/stderr.
- Do not invoke a real provider CLI or use `iop-agent` as the active task dispatcher.

**Modified Files and Checklist**

- [ ] `agent-task/m-iop-agent-cli-runtime/CODE_REVIEW-cloud-G08.md`: fill implementation notes, deviations, decisions, and exact command output.
- [ ] Retain the already-modified canonical slug source/tests and prior S10 ownership files until final PASS; no further production edit is expected.

**Test Strategy**

- REVIEW_REVIEW_REVIEW_API-1/2 own the test changes.
- Run focused, race, all-agent, vet, build, Darwin cross-build, logged-smoke preflight, symbol/contract, and diff checks fresh.

**Verification**

```bash
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache go test -count=1 ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/cmd/agent
```

Expected: PASS with no real provider CLI.

## Modified Files Summary

| File | Item |
|------|------|
| `apps/agent/cmd/agent/main_test.go` | REVIEW_REVIEW_REVIEW_API-1 |
| `apps/agent/internal/taskloop/cutover_test.go` | REVIEW_REVIEW_REVIEW_API-2 |
| `agent-contract/inner/iop-agent-cli-runtime.md` | REVIEW_REVIEW_REVIEW_API-2 |
| `apps/agent/internal/taskloop/workflow.go` | REVIEW_REVIEW_REVIEW_API-3 ownership carryover; no planned edit |
| `apps/agent/internal/taskloop/workflow_test.go` | REVIEW_REVIEW_REVIEW_API-3 ownership carryover; no planned edit |
| `apps/agent/internal/taskloop/module.go` | REVIEW_REVIEW_REVIEW_API-3 ownership carryover; no planned edit |
| `apps/agent/internal/command/service.go` | REVIEW_REVIEW_REVIEW_API-3 ownership carryover; no planned behavior edit |
| `apps/agent/internal/command/root.go` | REVIEW_REVIEW_REVIEW_API-3 ownership carryover; no planned behavior edit |
| `apps/agent/internal/command/root_test.go` | REVIEW_REVIEW_REVIEW_API-3 ownership carryover; no planned edit |
| `apps/agent/cmd/agent/main.go` | REVIEW_REVIEW_REVIEW_API-3 ownership carryover; no planned edit |
| `agent-task/m-iop-agent-cli-runtime/CODE_REVIEW-cloud-G08.md` | REVIEW_REVIEW_REVIEW_API-3 |

## Final Verification

Fresh execution is required; cached Go test output is not acceptable. Unit/integration/compiled-binary tests must use deterministic temporary state and must not start a real provider CLI.

```bash
gofmt -w apps/agent/cmd/agent/main_test.go apps/agent/internal/taskloop/cutover_test.go apps/agent/internal/taskloop/workflow.go apps/agent/internal/taskloop/workflow_test.go
```

Expected: formatting completes without error.

```bash
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache go test -count=1 ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/cmd/agent
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/race-cache go test -count=1 -race ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./packages/go/agenttask ./packages/go/agentstate
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache go test -count=1 ./apps/agent/...
```

Expected: focused, race, and all-agent suites PASS without a real provider.

```bash
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache go vet ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./packages/go/...
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache make build-agent
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/darwin-cache GOOS=darwin GOARCH=arm64 go build -trimpath -o /var/tmp/iop-agent-cli-final-darwin-arm64 ./apps/agent/cmd/agent
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache make test-iop-agent-logged-smoke-preflight
```

Expected: vet, build, Darwin arm64 cross-build, and non-provider logged-smoke preflight PASS.

```bash
rg --sort path -n '\b(TestBuiltBinaryHeadlessS10Transcript|TestCutoverProductionOwnership|dispatcherPlanValidatorCommand|task-loop validate-plan|dispatch\.py)\b' apps/agent agent-contract/inner/iop-agent-cli-runtime.md agent-ops/skills/common/plan/SKILL.md agent-ops/skills/common/code-review/SKILL.md agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md
git diff --check
git status --short
```

Expected: compiled transcript and bounded ownership references are intentional, no whitespace errors exist, and only declared task-owned files plus explicitly unrelated pre-existing changes are modified.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
