<!-- task=m-multi-provider-protocol-profile-native-messages/01_protocol_core plan=2 tag=REVIEW_API -->

# Code Review Reference - REVIEW_API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-01
task=m-multi-provider-protocol-profile-native-messages/01_protocol_core, plan=2, tag=REVIEW_API

## Roadmap Targets

- Milestone: `agent-roadmap/phase/operational-observability-provider-management/milestones/multi-provider-protocol-profile-native-messages.md`
- Milestone link: [Milestone document](agent-roadmap/phase/operational-observability-provider-management/milestones/multi-provider-protocol-profile-native-messages.md)
- Task ids:
  - `profile-contract`: common provider profile and immutable overlay/runtime contract
  - `path-resolution`: profile-operation URL resolver
  - `profile-catalog`: built-in/custom profile catalog and admission
- Completion mode: check-on-pass

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-multi-provider-protocol-profile-native-messages/01_protocol_core/plan_cloud_G09_01.log`
- Prior review: `agent-task/m-multi-provider-protocol-profile-native-messages/01_protocol_core/code_review_cloud_G09_01.log`
- Verdict: `FAIL`; Required=5, Suggested=0, Nit=0; `review_rework_count=2`; `evidence_integrity_failure=true`.
- Required carryover: filter operation-incompatible candidates before queue admission and re-resolution; classify profile-affecting and token-counter refresh changes; compile adapter-backed concrete profiles into provider-specific Node adapters; preserve all non-model JSON during model mapping; validate RFC-compatible header names and correct the built-in auth matrix.
- Affected areas: config normalization/catalog/refresh classification, Edge provider-pool admission and Node payload mapping, Node OpenAI-compatible request preparation, and the provider-first fake-upstream smoke.
- Verification evidence: fresh focused config/Edge/Node/OpenAI-compatible commands, protobuf generation, Dart generated-proto test, fake Lemonade full-cycle, full Edge/Node suites, the documented packages replacement suite, and `git diff --check` passed. None of those commands exercised the five Required boundary cases.
- Roadmap carryover: `profile-contract`, `path-resolution`, and `profile-catalog` remain unchecked until this follow-up passes.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G09.md` → `code_review_cloud_G09_02.log` and `PLAN-cloud-G09.md` → `plan_cloud_G09_02.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-multi-provider-protocol-profile-native-messages/01_protocol_core/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, report completion event metadata. Roadmap state check and `update-roadmap` calls are runtime responsibilities.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_API-1 | [x] |
| REVIEW_API-2 | [x] |
| REVIEW_API-3 | [x] |
| REVIEW_API-4 | [x] |
| REVIEW_API-5 | [x] |

## Implementation Checklist

- [x] Filter concrete profiles that do not support the requested operation before initial provider-pool admission and every queued re-resolution, while preserving deliberate nil-profile compatibility.
- [x] Classify top-level profile catalogs and provider selectors as restart-required, classify model token counters as applied, and prove a profile-changing apply cannot silently commit a divergent runtime snapshot.
- [x] Compile each adapter-backed profile provider into a provider-id-keyed OpenAI-compatible Node adapter derived from its exact backing instance while retaining the legacy adapter and rejecting missing, disabled, or ambiguous references.
- [x] Rewrite only the top-level JSON `model` string so all non-model bytes and provider-native values, including large integers, remain unchanged.
- [x] Enforce HTTP token syntax for auth header names and lock the built-in MiniMax/MiMo auth declarations to independently expected currently documented values.
- [x] Run fresh focused, refresh, full regression, generated-consumer, and adapter-backed Edge→Node→fake-upstream verification and preserve unrelated user changes.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G09_02.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G09_02.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [x] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [x] If PASS, move active task directory `agent-task/m-multi-provider-protocol-profile-native-messages/01_protocol_core/` to `agent-task/archive/YYYY/MM/m-multi-provider-protocol-profile-native-messages/01_protocol_core/` and update this checklist at the final archive path.
- [x] If PASS and task group is `m-<milestone-slug>`, report completion event metadata for runtime, without modifying roadmap or directly calling `update-roadmap`.
- [x] If PASS for split work, remove empty active parent `agent-task/m-multi-provider-protocol-profile-native-messages/` or verify it was kept due to remaining siblings/files.
- [ ] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

- No implementation scope or required verification command changed.
- The exact unfiltered `go test -count=1 ./packages/go/...` run reproduced only the documented `TestCLIWorkspacePreflightFailures/Helper` permission fixture in this runner; the fixed named-skip replacement from the plan passed. `TestSerialIntegratorRestartRecoversInterruptedApplyByRollback` did not fail in the unfiltered run.
- The first full Edge run exposed an old `nodes list` test fixture whose profiled vLLM provider referenced no configured backing instance. The fixture was corrected to declare the enabled, capacity-matching vLLM backing required by the new contract, and both the focused package and the exact full Edge command passed on rerun.
- Additional local-profile vet runs passed for `packages/go/...` and `apps/node/...`; `go vet ./apps/edge/...` reported the pre-existing, out-of-scope diagnostic `input_estimator.go:109:26: method WriteByte(b byte) should have signature WriteByte(byte) error` in an unchanged file.

## Key Design Decisions

- Composed the operation predicate once with the caller predicate and reused it for both initial admission and the queue resolver. Concrete profiles require an exact operation key; nil profiles intentionally remain eligible for legacy path fallback.
- Kept source profile inputs as refresh ownership boundaries: top-level catalogs and provider selectors are restart-required, model token counters are live-applied, and derived `RuntimeProfile` pointers are not compared independently.
- Treated `provider.adapter` as a backing reference only for profile-backed providers. Config normalization overlays the exact backing endpoint into the immutable profile, Edge compiles a provider-id-keyed `openai_compat` Node adapter from the enabled vLLM/OpenAI-compatible backing, and the original legacy adapter remains in the payload.
- Preserved dispatch compatibility by using the provider ID only when `RuntimeProfile` is non-nil; unprofiled legacy providers continue to dispatch their configured adapter key.
- Validated the complete JSON object but scanned its original bytes to splice only the last top-level string-valued `model`, preserving all unrelated lexical forms and bytes.
- Implemented the RFC 9110 ASCII token grammar locally for header names and locked all built-in auth expectations in a literal test matrix. MiniMax Messages uses `Authorization: Bearer`; MiMo Messages uses raw `api-key`.

## Reviewer Checkpoints

- Confirm a requested operation is composed with any existing admission predicate before both initial queue admission and re-resolution; concrete unsupported profiles are excluded and nil profiles retain legacy fallback.
- Confirm top-level `protocol_profiles` and provider `profile` changes are restart-required, model `token_counter` changes are applied, and a real profile-changing apply preserves the running runtime snapshot.
- Confirm an adapter-backed profile provider resolves exactly one enabled vLLM/OpenAI-compatible backing instance, receives a provider-id-keyed Node adapter, and retains the original legacy adapter payload.
- Confirm Edge selection dispatches the provider id for every concrete profile while unprofiled legacy providers keep current adapter-key behavior.
- Confirm the Node-built provider adapter receives the backing endpoint/header/capacity/timeouts plus an isolated concrete profile and that its fingerprint changes with profile changes.
- Confirm model mapping changes only the top-level JSON string value and preserves every other byte, including large integers, exponent spelling, nested unknown values, and whitespace.
- Confirm header validation implements the complete ASCII HTTP token set and rejects whitespace, controls, colon, separators, and non-ASCII names.
- Confirm the MiniMax/MiMo expected auth matrix is independent of production data and actual HTTP requests use the declared supported header/scheme.
- Confirm fake Lemonade uses an adapter-backed profile through real Edge and Node entrypoints and still asserts Models/Chat/Responses path, auth, model, and counts.
- Confirm no protobuf/schema, public Messages ingress, contract/spec, roadmap, central rule/skill, or unrelated user-owned change entered scope.

## Verification Results

> **Implementation owner:** Run every command below exactly as written and paste actual stdout/stderr. If a command changes, record the replacement and reason in `Deviations from Plan` first. Long output may be saved to a deterministic file only when the exact save command and path are recorded.

### Verification 1 — Operation admission

```bash
go test -count=1 ./apps/edge/internal/service -run 'TestProtocolProfileOperationAdmission|Test.*TunnelOperation'
go test -count=1 ./apps/edge/internal/openai -run 'Test.*(ProtocolProfile|ProviderDispatch|Responses)'
```

```text
ok  	iop/apps/edge/internal/service	0.040s
ok  	iop/apps/edge/internal/openai	0.062s
```

### Verification 2 — Refresh classification and apply

```bash
go test -count=1 ./apps/edge/internal/configrefresh -run 'TestClassify(ProtocolProfile|ProviderProfile|ModelTokenCounter)'
go test -count=1 ./apps/edge/internal/bootstrap -run 'TestRefreshApplyDoesNotMutateOnProtocolProfileRestartRequired'
```

```text
ok  	iop/apps/edge/internal/configrefresh	0.027s
ok  	iop/apps/edge/internal/bootstrap	0.105s
```

### Verification 3 — Adapter-backed concrete profile

```bash
go test -count=1 ./packages/go/config/... -run 'TestProtocolProfile.*(Adapter|Backing|Endpoint)'
go test -count=1 ./apps/edge/internal/node ./apps/edge/internal/service -run 'TestProtocolProfile.*(Adapter|Backing|Dispatch)'
go test -count=1 ./apps/node/internal/adapters -run 'TestProtocolProfile.*(Config|Adapter|Fingerprint)'
IOP_LEMONADE_MODE=fake ./scripts/e2e-openai-lemonade.sh
```

```text
ok  	iop/packages/go/config	0.040s
ok  	iop/apps/edge/internal/node	0.040s
ok  	iop/apps/edge/internal/service	0.039s
ok  	iop/apps/node/internal/adapters	0.030s
[openai-lemonade] OpenAI-compatible Lemonade serving test PASSED (mode=fake).
```

### Verification 4 — Raw-body model mapping

```bash
go test -count=1 ./apps/node/internal/adapters/openai_compat -run 'TestProtocolProfile.*(ModelMapping|RawBody|ActualRequest)'
```

```text
ok  	iop/apps/node/internal/adapters/openai_compat	0.022s
```

### Verification 5 — Header syntax and auth matrix

```bash
go test -count=1 ./packages/go/config/... -run 'TestProtocolProfile.*(Header|Auth)|TestBuiltInProtocolProfileCatalog'
go test -count=1 ./apps/node/internal/adapters/openai_compat -run 'TestProtocolProfile.*Auth'
```

```text
ok  	iop/packages/go/config	0.027s
ok  	iop/apps/node/internal/adapters/openai_compat	0.013s
```

### Verification 6 — Fresh final regression

```bash
cd /config/workspace/iop-s0
mkdir -p .gocache .local/gotmp-g09-followup
export GOCACHE=/config/workspace/iop-s0/.gocache
export GOTMPDIR=/config/workspace/iop-s0/.local/gotmp-g09-followup
go version
protoc --version
flutter --version
command -v protoc-gen-dart
go test -count=1 ./packages/go/config/... -run 'Test(ProtocolProfile|LegacyProviderAlias|BuiltInProtocolProfile)'
go test -count=1 ./apps/edge/internal/configrefresh -run 'TestClassify(ProtocolProfile|ProviderProfile|ModelTokenCounter)'
go test -count=1 ./apps/edge/internal/bootstrap -run 'TestRefreshApplyDoesNotMutateOnProtocolProfileRestartRequired'
go test -count=1 ./apps/edge/internal/node ./apps/edge/internal/service -run 'Test.*ProtocolProfile|Test.*TunnelOperation'
go test -count=1 ./apps/node/internal/adapters ./apps/node/internal/adapters/openai_compat -run 'Test.*ProtocolProfile|Test.*LegacyEndpointPathFallback|Test.*OpenAICompat.*Models'
go test -count=1 ./apps/edge/internal/openai -run 'Test.*(ProtocolProfile|ProviderDispatch|Responses)'
make proto
make proto-dart
go test -count=1 ./packages/go/...
go test -count=1 ./packages/go/... -skip 'TestCLIWorkspacePreflightFailures|TestSerialIntegratorRestartRecoversInterruptedApplyByRollback'
go test -count=1 ./apps/edge/...
go test -count=1 ./apps/node/...
cd apps/client && flutter test test/iop_wire/generated_proto_import_test.dart
cd /config/workspace/iop-s0 && IOP_LEMONADE_MODE=fake ./scripts/e2e-openai-lemonade.sh
cd /config/workspace/iop-s0 && rg -n --sort path 'CanonicalMIMEHeaderKey|var payload map\[string\]any|Auth:.*X-Api-Key' packages/go/config/protocol_profile.go apps/node/internal/adapters/openai_compat/request.go
git diff --check
git status --short
```

```text
go version go1.26.2 linux/arm64
libprotoc 29.3
Flutter 3.41.5 • channel stable • https://github.com/flutter/flutter.git
Framework • revision 2c9eb20739 (5 months ago) • 2026-03-17 16:14:01 -0700
Engine • hash c1db59d880ca73dd86cec08a6663f287522d9f39 (revision 052f31d115) (4 months ago) • 2026-03-17 20:29:11.000Z
Tools • Dart 3.11.3 • DevTools 2.54.2
/config/.local/bin/protoc-gen-dart
ok  	iop/packages/go/config	0.063s
ok  	iop/apps/edge/internal/configrefresh	0.020s
ok  	iop/apps/edge/internal/bootstrap	0.099s
ok  	iop/apps/edge/internal/node	0.027s
ok  	iop/apps/edge/internal/service	0.048s
ok  	iop/apps/node/internal/adapters	0.036s
ok  	iop/apps/node/internal/adapters/openai_compat	0.021s
ok  	iop/apps/edge/internal/openai	0.067s
protoc \
	--go_out=. \
	--go_opt=module=iop \
	--proto_path=. \
	proto/iop/agent.proto \
	proto/iop/runtime.proto \
	proto/iop/node.proto \
	proto/iop/control.proto \
	proto/iop/job.proto
mkdir -p apps/client/lib/gen
protoc \
	--plugin=protoc-gen-dart=/config/.local/bin/protoc-gen-dart \
	--dart_out=apps/client/lib/gen \
	--proto_path=. \
	--proto_path=/config/.local/include \
	proto/iop/runtime.proto \
	proto/iop/node.proto \
	proto/iop/control.proto \
	proto/iop/job.proto
ok  	iop/packages/go/agentconfig	0.196s
ok  	iop/packages/go/agentguard	1.400s
ok  	iop/packages/go/agentpolicy	0.036s
ok  	iop/packages/go/agentprovider/catalog	0.377s
--- FAIL: TestCLIWorkspacePreflightFailures (0.01s)
    --- FAIL: TestCLIWorkspacePreflightFailures/Helper (0.00s)
        cli_workspace_test.go:189: failed to create inaccessible dir: mkdir /config/workspace/iop-s0/.local/gotmp-g09-followup/TestCLIWorkspacePreflightFailuresHelper164023765/001/inaccessible: permission denied
        testing.go:1464: TempDir RemoveAll cleanup: unlinkat /config/workspace/iop-s0/.local/gotmp-g09-followup/TestCLIWorkspacePreflightFailuresHelper164023765/001: directory not empty
FAIL
FAIL	iop/packages/go/agentprovider/cli	30.333s
?   	iop/packages/go/agentprovider/cli/internal/testutil	[no test files]
ok  	iop/packages/go/agentprovider/cli/status	39.981s
ok  	iop/packages/go/agentruntime	0.759s
ok  	iop/packages/go/agentstate	0.668s
ok  	iop/packages/go/agenttask	4.136s
ok  	iop/packages/go/agentworkspace	16.248s
ok  	iop/packages/go/audit	0.019s
?   	iop/packages/go/auth	[no test files]
ok  	iop/packages/go/config	1.920s
?   	iop/packages/go/events	[no test files]
ok  	iop/packages/go/hostsetup	0.271s
?   	iop/packages/go/jobs	[no test files]
?   	iop/packages/go/metadata	[no test files]
ok  	iop/packages/go/observability	0.091s
?   	iop/packages/go/policy	[no test files]
ok  	iop/packages/go/streamgate	0.904s
?   	iop/packages/go/version	[no test files]
FAIL

The fixed replacement packages command passed:
ok  	iop/packages/go/agentconfig	0.327s
ok  	iop/packages/go/agentguard	1.768s
ok  	iop/packages/go/agentpolicy	0.046s
ok  	iop/packages/go/agentprovider/catalog	0.461s
ok  	iop/packages/go/agentprovider/cli	30.272s
?   	iop/packages/go/agentprovider/cli/internal/testutil	[no test files]
ok  	iop/packages/go/agentprovider/cli/status	40.006s
ok  	iop/packages/go/agentruntime	0.808s
ok  	iop/packages/go/agentstate	0.809s
ok  	iop/packages/go/agenttask	4.141s
ok  	iop/packages/go/agentworkspace	15.988s
ok  	iop/packages/go/audit	0.016s
?   	iop/packages/go/auth	[no test files]
ok  	iop/packages/go/config	2.183s
?   	iop/packages/go/events	[no test files]
ok  	iop/packages/go/hostsetup	0.370s
?   	iop/packages/go/jobs	[no test files]
?   	iop/packages/go/metadata	[no test files]
ok  	iop/packages/go/observability	0.086s
?   	iop/packages/go/policy	[no test files]
ok  	iop/packages/go/streamgate	0.912s
?   	iop/packages/go/version	[no test files]

ok  	iop/apps/edge/cmd/edge	0.620s
ok  	iop/apps/edge/internal/bootstrap	4.533s
ok  	iop/apps/edge/internal/configrefresh	0.557s
ok  	iop/apps/edge/internal/controlplane	4.535s
ok  	iop/apps/edge/internal/edgecmd	0.268s
ok  	iop/apps/edge/internal/edgevalidate	0.068s
ok  	iop/apps/edge/internal/events	0.045s
ok  	iop/apps/edge/internal/input	0.110s
ok  	iop/apps/edge/internal/input/a2a	0.099s
ok  	iop/apps/edge/internal/node	0.093s
ok  	iop/apps/edge/internal/openai	7.518s
ok  	iop/apps/edge/internal/opsconsole	0.093s
ok  	iop/apps/edge/internal/service	5.960s
ok  	iop/apps/edge/internal/transport	4.815s
ok  	iop/apps/node/cmd/node	0.135s
ok  	iop/apps/node/internal/adapters	0.081s
?   	iop/apps/node/internal/adapters/mock	[no test files]
ok  	iop/apps/node/internal/adapters/ollama	0.052s
ok  	iop/apps/node/internal/adapters/openai_compat	0.166s
ok  	iop/apps/node/internal/adapters/vllm	0.159s
ok  	iop/apps/node/internal/bootstrap	1.497s
ok  	iop/apps/node/internal/node	0.907s
ok  	iop/apps/node/internal/router	0.533s
ok  	iop/apps/node/internal/store	0.157s
ok  	iop/apps/node/internal/transport	5.606s
00:00 +0: loading /config/workspace/iop-s0/apps/client/test/iop_wire/generated_proto_import_test.dart
00:00 +0: Generated proto compile guard and field verification
00:00 +1: All tests passed!
[openai-lemonade] OpenAI-compatible Lemonade serving test PASSED (mode=fake).

The forbidden-pattern `rg` command returned no matches. `git diff --check` returned no output. `git status --short` retained the task worktree plus the four pre-existing user-owned roadmap edits and the expected `.gocache/`, `.local/`, and active task artifacts; no cleanup or unrelated overwrite was performed.
```

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Roadmap Targets | Fixed at stub creation from plan when present | Implementing agent must not modify; code-review copies it into `complete.log` as `Roadmap Completion` only on PASS |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: PASS

### Dimension Assessment

- Correctness: Pass
- Completeness: Pass
- Test coverage: Pass
- API contract: Pass
- Code quality: Pass
- Implementation deviation: Pass
- Verification trust: Pass
- Spec conformance: Pass

### Findings

- None.

### Fresh Reviewer Verification

- Passed the focused operation-admission, refresh-classification/apply, adapter-backed profile, raw-body preservation, header-token, and actual auth-request Go test commands from the active review.
- Passed `IOP_LEMONADE_MODE=fake ./scripts/e2e-openai-lemonade.sh`; the real Edge and Node entrypoints reached the adapter-backed fake upstream and satisfied the path, auth, model, and request-count assertions.
- Passed `make proto`, `make proto-dart`, the documented full `packages/go/...` replacement suite, full `apps/edge/...` and `apps/node/...` suites, and `flutter test test/iop_wire/generated_proto_import_test.dart`.
- Passed `git diff --check`; no stale forbidden symbols, debug prints, or unrelated task-scope changes were found in the implementation diff. The four pre-existing roadmap edits remained untouched.
- Rechecked the current official MiniMax and Xiaomi MiMo documentation: MiniMax Anthropic-compatible requests use `Authorization: Bearer`, and MiMo Anthropic-compatible requests use raw `api-key`, matching the independent production and HTTP-request fixtures.

### Routing Signals

- `review_rework_count=2`
- `evidence_integrity_failure=false`

### Next Step

- Archive the passing plan/review pair, write `complete.log`, move the completed split subtask to its dated task archive, and report Milestone completion metadata to the runtime.
