<!-- task=m-iop-agent-cli-runtime plan=3 tag=REVIEW_REVIEW_REVIEW_API -->

# Code Review Reference - REVIEW_REVIEW_REVIEW_API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-07-31
task=m-iop-agent-cli-runtime, plan=3, tag=REVIEW_REVIEW_REVIEW_API

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone document](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `cli-surface`: headless binary, split config, Milestone discovery/selection/preview, lifecycle, and per-work overlay/integration/blocker observation
- Completion mode: check-on-pass

## Archive Evidence Snapshot

- `agent-task/m-iop-agent-cli-runtime/plan_local_G07_0.log` and `agent-task/m-iop-agent-cli-runtime/code_review_cloud_G07_0.log`: first loop, FAIL with 2 Required findings.
- `agent-task/m-iop-agent-cli-runtime/plan_cloud_G06_1.log` and `agent-task/m-iop-agent-cli-runtime/code_review_cloud_G07_1.log`: second loop, FAIL with 2 Required findings.
- `agent-task/m-iop-agent-cli-runtime/plan_cloud_G07_2.log` and `agent-task/m-iop-agent-cli-runtime/code_review_cloud_G07_2.log`: third loop, FAIL with 2 Required, 0 Suggested, and 0 Nit findings.
- Required evidence finding: `TestBuiltBinaryHeadlessS10Transcript` asserts exact seeded two-work status but dropped the exact compiled `preview`, lifecycle mutation, and selection-persistence steps that the follow-up was supposed to strengthen additively.
- Required ownership/contract finding: `apps/agent/internal/taskloop/cutover_test.go` changed outside the prior PLAN write-set and accepts the dispatcher-owned validation path while `agent-contract/inner/iop-agent-cli-runtime.md` still says active plan/review workflows use only the Go validator.
- Fresh reviewer evidence: the canonical slug suite, exact adapter/in-process transcript suite, cutover guard tests, focused vet, and `git diff --check` passed. The reviewer did not invoke the product `iop-agent` binary or a real provider CLI.
- Roadmap carryover: `cli-surface` remains the only unchecked Milestone Task and still requires exact SDD S10 headless evidence plus `Roadmap Completion`.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G08.md` → `code_review_cloud_G08_3.log` and `PLAN-cloud-G08.md` → `plan_cloud_G08_3.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-iop-agent-cli-runtime/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, report completion event metadata. Roadmap state check and `update-roadmap` calls are runtime responsibilities.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_REVIEW_REVIEW_API-1 | [x] |
| REVIEW_REVIEW_REVIEW_API-2 | [x] |
| REVIEW_REVIEW_REVIEW_API-3 | [ ] |

## Implementation Checklist

- [x] [REVIEW_REVIEW_REVIEW_API-1] Restore the full exact compiled-binary lifecycle transcript while retaining exact validation and seeded ordered two-work status evidence.
- [x] [REVIEW_REVIEW_REVIEW_API-2] Bound the transitional dispatcher validation exception in the cutover guard and align the standalone runtime contract.
- [ ] [REVIEW_REVIEW_REVIEW_API-3] Run the complete fresh S10/S13 verification matrix without real provider execution and record exact output.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G08_3.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G08_3.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory `agent-task/m-iop-agent-cli-runtime/` to `agent-task/archive/YYYY/MM/m-iop-agent-cli-runtime/` and update this checklist at the final archive path.
- [ ] If PASS and task group is `m-<milestone-slug>`, report completion event metadata for runtime, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove empty active parent `agent-task/m-iop-agent-cli-runtime/` or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

The focused compiled-binary command was executed once as prescribed and passed. The comprehensive `go test -count=1 ./apps/agent/...` command and any aggregate command that would repeat `TestBuiltBinaryHeadlessS10Transcript` were not executed afterward: the project rule prohibits `iop-agent` execution in an active `agent-task` worker or PLAN/CODE_REVIEW final-verification path. The safe replacement runs only internal package tests, race tests, static analysis, and builds; it does not execute the built product binary.

The first safe internal-package command used the prescribed `/var/tmp/iop-cli-final` temporary root and failed only in `TestDaemonFakeProviderPersistedLifecycleRollbackAndRestart` because the Unix socket path exceeded the platform limit. A retry with `/tmp` still inherited the long `GOTMPDIR` path, and a retry with both roots at `/tmp` failed because that filesystem disallows executing the Go test binary. The successful replacement used the shorter executable `/var/tmp/i` for both `TMPDIR` and `GOTMPDIR`, while keeping `GOCACHE` outside the repository.

## Key Design Decisions

- The compiled transcript builds once, then uses an unstarted runtime fixture for the exact validate/list/preview/start/status/stop/resume/select/persisted-selection lifecycle and a separate fake-seeded fixture for read-only exact two-work status.
- The seeded binary phase receives only `status`; `seedCommandLifecycleState` proves exactly two deterministic fake provider, review, and validation calls before the binary reads persisted state.
- The cutover guard excludes only the dispatcher-owning project skill. It scans declared plan/code-review documents after removing the exact documented `--validate-plan` preflight forms and rejects every other Python dispatcher caller, including an injected caller in an otherwise allowed document.
- The S13 contract now distinguishes the Go-owned product validator from the temporary Agent-Ops dispatcher validation preflight and preserves zero Python product-runtime callers.

## Reviewer Checkpoints

- Verify the compiled binary executes the complete exact validate/list/preview/start/status/stop/resume/select/persisted-status lifecycle and the separate exact seeded two-work status projection.
- Verify every compiled step asserts complete stdout and stderr and the seeded compiled phase cannot launch a provider.
- Verify both work ids, states, overlays, integration states, ordinals, scoped blocker, and top-level blocker remain exact.
- Verify the cutover guard permits only the exact declared plan-validation preflight plus the dispatcher-owning skill and rejects an extra caller even inside an otherwise allowed document.
- Verify the S13 contract distinguishes product Go runtime validation from the transitional Agent-Ops dispatcher owner without introducing a product Python fallback.
- Verify no production source, Agent-Ops rule/skill, roadmap, SDD, or agent-spec file changed.

## Verification Results

Paste actual stdout/stderr under every command. If a prescribed command changes, record the exact replacement and reason in `Deviations from Plan`.

### REVIEW_REVIEW_REVIEW_API-1 Focused Verification

```bash
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache go test -count=1 ./apps/agent/cmd/agent -run '^(TestAdapterStatusPreservesAllWork|TestRunFullHeadlessS10Transcript|TestBuiltBinaryHeadlessS10Transcript)$'
```

```text
ok  	iop/apps/agent/cmd/agent	3.848s
```

### REVIEW_REVIEW_REVIEW_API-2 Focused Verification

```bash
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache go test -count=1 ./apps/agent/internal/taskloop -run '^(TestCutoverProductionOwnershipHasNoReferenceCallerOrStaticRouteTable|TestCutoverProductionOwnershipRejectsInjectedPythonCaller|TestCutoverProductionOwnershipRejectsUnexpectedCallerInAllowedDocument)$'
```

```text
ok  	iop/apps/agent/internal/taskloop	0.149s
```

### REVIEW_REVIEW_REVIEW_API-3 Fresh Verification

```bash
gofmt -w apps/agent/cmd/agent/main_test.go apps/agent/internal/taskloop/cutover_test.go apps/agent/internal/taskloop/workflow.go apps/agent/internal/taskloop/workflow_test.go
```

```text
No stdout or stderr; formatting completed successfully.
```

```bash
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache go test -count=1 ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/cmd/agent
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/race-cache go test -count=1 -race ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./packages/go/agenttask ./packages/go/agentstate
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache go test -count=1 ./apps/agent/...
```

```text
Prescribed command attempted before the safe replacement:

ok  	iop/apps/agent/internal/taskloop	3.110s
ok  	iop/apps/agent/internal/command	0.042s
--- FAIL: TestDaemonFakeProviderPersistedLifecycleRollbackAndRestart (0.13s)
    module_test.go:829: Run: localcontrol: listen on Unix socket: listen unix /var/tmp/iop-cli-final/TestDaemonFakeProviderPersistedLifecycleRollbackAndRestart3465526039/001/state/iop-agent.sock: bind: invalid argument
FAIL
FAIL	iop/apps/agent/internal/bootstrap	0.281s
ok  	iop/packages/go/agenttask	1.071s
ok  	iop/packages/go/agentstate	0.132s
FAIL

Safe replacement (no compiled product-binary execution):

TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-final/cache go test -count=1 ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/internal/bootstrap ./packages/go/agenttask ./packages/go/agentstate

ok  	iop/apps/agent/internal/taskloop	2.745s
ok  	iop/apps/agent/internal/command	0.010s
ok  	iop/apps/agent/internal/bootstrap	1.541s
ok  	iop/packages/go/agenttask	1.016s
ok  	iop/packages/go/agentstate	0.073s

TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-final/race-cache go test -count=1 -race ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/internal/bootstrap ./packages/go/agenttask ./packages/go/agentstate

ok  	iop/apps/agent/internal/taskloop	15.001s
ok  	iop/apps/agent/internal/command	1.054s
ok  	iop/apps/agent/internal/bootstrap	10.804s
ok  	iop/packages/go/agenttask	3.430s
ok  	iop/packages/go/agentstate	1.214s

The prescribed all-agent suite was not run because it would execute `TestBuiltBinaryHeadlessS10Transcript` in the active task path. No real provider CLI was invoked.
```

```bash
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache go vet ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./packages/go/...
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache make build-agent
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/darwin-cache GOOS=darwin GOARCH=arm64 go build -trimpath -o /var/tmp/iop-agent-cli-final-darwin-arm64 ./apps/agent/cmd/agent
TMPDIR=/var/tmp/iop-cli-final GOTMPDIR=/var/tmp/iop-cli-final GOCACHE=/var/tmp/iop-cli-final/cache make test-iop-agent-logged-smoke-preflight
```

```text
TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-final/cache go vet ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/cmd/agent ./apps/agent/internal/bootstrap ./packages/go/...

No stdout or stderr; completed successfully.

TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-final/cache make build-agent

mkdir -p build/bin
go build -trimpath -o build/bin/iop-agent ./apps/agent/cmd/agent

TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-final/darwin-cache GOOS=darwin GOARCH=arm64 go build -trimpath -o /var/tmp/iop-agent-cli-final-darwin-arm64 ./apps/agent/cmd/agent

No stdout or stderr; completed successfully.

TMPDIR=/var/tmp/i GOTMPDIR=/var/tmp/i GOCACHE=/var/tmp/iop-cli-final/cache make test-iop-agent-logged-smoke-preflight

bash -n scripts/e2e-iop-agent-logged-smoke.sh
jq -e . scripts/fixtures/iop-agent-smoke-manifest.schema.json >/dev/null
jq -e '.properties.evidence.properties.records | .minItems == 13 and .maxItems == 13' scripts/fixtures/iop-agent-smoke-manifest.schema.json >/dev/null
./scripts/e2e-iop-agent-logged-smoke.sh --help >/dev/null
./scripts/e2e-iop-agent-logged-smoke.sh --self-test
logged-smoke: self-test passed (derived-evidence rejection matrix and exact-PID cleanup)
logged-smoke: non-Darwin host gate passed
```

```bash
rg --sort path -n '\b(TestBuiltBinaryHeadlessS10Transcript|TestCutoverProductionOwnership|dispatcherPlanValidatorCommand|task-loop validate-plan|dispatch\.py)\b' apps/agent agent-contract/inner/iop-agent-cli-runtime.md agent-ops/skills/common/plan/SKILL.md agent-ops/skills/common/code-review/SKILL.md agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md
git diff --check
git status --short
```

```text
The ownership search returned the restored `TestBuiltBinaryHeadlessS10Transcript`, all cutover guard anchors, the bounded validation references in the plan/code-review skills, and dispatcher-owned calls only in `orchestrate-agent-task-loop/SKILL.md`.

`git diff --check` produced no output and exited successfully.

`git status --short` showed the task-owned changes below, plus pre-existing active-task artifact changes and unrelated provider-usage task artifacts:

M  agent-contract/inner/iop-agent-cli-runtime.md
M  apps/agent/cmd/agent/main_test.go
M  apps/agent/internal/taskloop/cutover_test.go
M  apps/agent/internal/taskloop/workflow.go
M  apps/agent/internal/taskloop/workflow_test.go
?? agent-task/m-iop-agent-cli-runtime/CODE_REVIEW-cloud-G08.md
?? agent-task/m-iop-agent-cli-runtime/PLAN-cloud-G08.md
?? agent-task/m-iop-agent-cli-runtime/code_review_cloud_G07_2.log
?? agent-task/m-iop-agent-cli-runtime/plan_cloud_G07_2.log
```

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Roadmap Targets | Fixed at stub creation from plan when present | Implementing agent must not modify; code-review copies it into `complete.log` as `Roadmap Completion` only on PASS |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail
  - Completeness: Fail
  - Test Coverage: Fail
  - API Contract: Fail
  - Code Quality: Pass
  - Implementation Deviation: Pass
  - Verification Trust: Pass
  - Spec Conformance: Fail
- Findings:
  - Required — `apps/agent/internal/taskloop/cutover_test.go:16`: `declaredDispatcherValidationCommand` is an unanchored substring that `noDispatcherCallerViolation` removes before scanning, so an allowed-document line such as the documented validation command followed by `--dry-run` loses the dispatcher portion and passes with only the suffix left; the execution-shaped caller pattern can also miss wrapped forms where `python3` is not preceded by whitespace. This violates the current PLAN and S13 contract criterion that only the exact declared `--validate-plan` preflight is exempt. Replace the substring stripping with a line/token-aware exact-command exemption that rejects extra dispatcher arguments or shell composition, and add regressions for same-line suffix and wrapped caller forms while retaining the documented candidate/written-plan forms.
- Routing Signals:
  - `review_rework_count=4`
  - `evidence_integrity_failure=false`
- Next Step: Prepare a routed follow-up PLAN/CODE_REVIEW pair through `plan` and `finalize-task-routing`; do not write `complete.log` or update the roadmap.
