<!-- task=m-iop-owned-single-request-agent-execution/20+19_review_repair plan=4 tag=REVIEW_API milestone-task=review-stage -->

# Prove Review evidence through the real coordinator path

## For the Implementing Agent

Filling the implementation-owned sections of `CODE_REVIEW-cloud-G06.md` is the mandatory final implementation step. Run every verification command, paste actual output, keep both active files in place, and report ready for review. Only the official code-review skill may append a verdict, archive files, write `complete.log`, or classify the next state. If blocked, record the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields; do not ask the user, call user-input tools, create control-plane stop files, change ownership or scope, archive logs, or write `complete.log`.

## Background

The four named Review fixtures and their recorded commands pass, but the inherited Required R1 remains open because the tool-failure fixture bypasses the service coordinator and Node wire. The same evidence packet also stops short of exact frozen-body/tool-schema comparison and a Review-specific concurrent/stale continuation race. This follow-up replaces simulated evidence with path-faithful deterministic tests; production Review behavior remains unchanged.

## Archive Evidence Snapshot

- The reviewed pair is archived as `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/plan_cloud_G05_3.log` and `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/code_review_cloud_G05_3.log`; the official verdict is FAIL with Required R1 and no Suggested or Nit findings.
- R1: `TestSingleRequestReviewStageCoordinatorToolFailure` injects an error-shaped result directly into the bridge and fails later on malformed provider content, while the real coordinator rejects a non-success Node response before continuation. The exact-body fixture compares selected fields/tool count, and the Review duplicate delivery is sequential rather than concurrent or stale-after-cancel.
- Fresh reviewer execution passed the dependency check, focused Review race test, service compatibility, OpenAI vet/regression, fixture discovery, production Review hash, activation guard, lifecycle-table guard, and diff hygiene. Passing commands do not substitute for the missing path-faithful assertions.
- The sole predecessor remains `agent-task/archive/2026/08/m-iop-owned-single-request-agent-execution/19+18_work_stage/complete.log`. The contribution remains `milestone-task=review-stage`; production composite activation and S12 external Claude/Mac qualification remain outside this follow-up.

## Finding Resolution Map

| Finding | Mode | Exact fix | Changed precondition |
|---------|------|-----------|----------------------|
| Required R1 | `direct-fix` | Replace the direct bridge error injection with a Review executor driven through `Service.StartSingleRequest` and the existing Node workspace harness; deep-compare frozen dispatch/body/tool authority; add concurrent duplicate and post-cancel stale Review correlation assertions in `apps/edge/internal/openai/single_request_review_stage_test.go`; replace active review evidence with fresh output. | The prior simulated and partial assertions are replaced by real service/Node execution plus exact and race-sensitive oracles, so re-review evaluates a newly exercised production path. |

## Analysis

### Files Read

- `apps/edge/internal/openai/single_request_review_stage.go`
- `apps/edge/internal/openai/single_request_review_stage_test.go`
- `apps/edge/internal/openai/single_request_work_stage.go`
- `apps/edge/internal/openai/single_request_work_stage_test.go`
- `apps/edge/internal/openai/single_request_provider_stage_test.go`
- `apps/edge/internal/service/single_request_tool_loop.go`
- `apps/edge/internal/service/single_request_tool_loop_test.go`
- `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/plan_cloud_G05_3.log`
- `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/code_review_cloud_G05_3.log`
- `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/plan_cloud_G07_2.log`
- `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/code_review_cloud_G07_2.log`

### SDD Criteria

- SDD: `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md`, status `[승인됨]`, lock released.
- First-line contribution: `milestone-task=review-stage`.
- Acceptance Scenario S10 requires Gemini high-reasoning Review to pass or repair/reverify and produce the final result. Its Evidence Map requires Review pass/defect/repair plus finalization evidence.
- The implementation checklist therefore requires exact frozen Review authority, real coordinator/Node tool-failure behavior with no continuation or finalization, and race-safe Review correlation before the focused `-race` and package regressions may satisfy S10. S12 remains separate.

### Verification Context

- A neutral local context was resolved from `agent-test/local/rules.md` and `agent-test/local/edge-smoke.md`; both are usable for deterministic Edge tests. Repository-native evidence came from the active pair, approved SDD, current Review/Work/service source and tests, and the single predecessor completion log.
- Workdir is the repository root on branch `feature/iop-owned-single-request-agent-execution`, HEAD `22a8b81201e89d75c1e6c92342a8081472e8e436`, with unrelated shared dirty changes preserved. Toolchain is `go1.26.2 linux/arm64` for a Go 1.24 module.
- Fresh reviewer commands passed: predecessor resolution, focused Review race, service compatibility, OpenAI vet/regression, fixture discovery, production source boundary, activation guard, lifecycle-table guard, and `git diff --check`.
- No external runner, credential, provider, port, or device is needed for this test-only private Review component. Actual Claude/Mac full-cycle qualification remains S12 `claude-smoke`, not a substitute for or blocker to this deterministic fix.
- Confidence is high: the service source explicitly rejects a non-success Node response before `ContinueInternalTool`, and the existing Work service-backed fixture demonstrates the required harness and observable counters.

### Test Coverage Gaps

- Missing: a Review executor actually driven through `Service.StartSingleRequest`, the Node workspace wire, a non-success `WorkspaceToolResponse`, coordinator failure/cleanup, and zero continuation/REVIEW/finalizing evidence.
- Partial: initial/resumed bodies verify selected values but not the exact top-level object, exact user/tool continuation content, exact closed tool schemas, or frozen dispatch/credential binding.
- Partial: wrong identities and a sequential duplicate are rejected, but the focused Review race suite does not prove one-winner concurrent duplicate delivery or stale delivery after cancellation.
- Covered and retained: pass persistence ordering, inspection/repair state legality, provider/envelope errors, iteration bound, cancellation waiter cleanup, production source boundary, and package regressions.

### Symbol References

- None. This is test-only evidence work; no production symbol is renamed or removed.

### Split Judgment

- Keep one plan. The service-backed failure, exact authority, and correlation races close one compact R1 evidence boundary in the same Review test file and share the same provider/bridge/coordinator harness. Splitting would duplicate setup without an independent PASS contract.
- The `20+19_review_repair` predecessor index 19 is satisfied by `agent-task/archive/2026/08/m-iop-owned-single-request-agent-execution/19+18_work_stage/complete.log`.

### Scope Rationale

- Include only `apps/edge/internal/openai/single_request_review_stage_test.go` and the active review evidence file.
- Exclude production Review source, Work/service behavior, composite executor, production installation, lifecycle-table changes, spec/contract updates, generic error/cancel work, and S12 external qualification. The existing production path already exposes the required test seam; a production defect must be recorded as a deviation/blocker rather than silently widening the write boundary.

### Final Routing

- `evaluation_mode=isolated-reassessment`; build and review scope/context/verification/evidence/ownership/decision closures are true; no capability gap.
- Build scores `1/2/0/2/1` => G06 with base `local-fit`. Positive loop risks are `temporal_state`, `concurrent_consistency`, `boundary_contract`, and `structured_interpretation`; `loop_risk_count=4`, `large_indivisible_context=false`.
- `review_rework_count=2` and `evidence_integrity_failure=true` select `recovery-boundary`: `worker/cloud/G06`, `PLAN-cloud-G06.md`.
- Review scores `1/2/0/2/1` => G06, `official-review`, `review/cloud/G06`, `CODE_REVIEW-cloud-G06.md`.
- Finalizer: `finalize-task-policy.sh`, mode `pair`.

## Dependencies and Execution Order

1. Resolve exactly one task-19 completion with Final Verification command 1.
2. Replace the simulated failure and partial authority/correlation assertions before rerunning the focused race command.
3. Fill `CODE_REVIEW-cloud-G06.md` only after all commands complete.

## Implementation Checklist

- [ ] Replace the simulated Review tool-failure fixture with a service-backed Node response failure that proves no continuation, REVIEW/finalizing leak, waiter leak, or cleanup omission.
- [ ] Deep-compare initial/resumed Review dispatch bodies and frozen provider authority, then add concurrent duplicate and post-cancel stale correlation assertions under the focused race test.
- [ ] Run dependency, focused race, service compatibility, OpenAI vet/regression, deterministic fixture/source-boundary, activation, lifecycle-diff, formatting, and diff-hygiene checks.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_API-1] Replace simulated evidence with path-faithful Review fixtures

**Problem**

At `apps/edge/internal/openai/single_request_review_stage_test.go:502`, the purported coordinator failure test manually calls `bridge.ContinueInternalTool` with `Status: "error"`, even though `apps/edge/internal/service/single_request_tool_loop.go:184` fails a non-success Node response before continuation. The test then depends on a malformed second provider response, so it does not prove coordinator terminal, cleanup, or zero continuation. At lines 292-357 the authority test checks selected fields and tool count rather than the complete frozen request/dispatch, and lines 479-485 exercise only a sequential duplicate.

**Solution**

Reuse the existing Work coordinator/Node harness primitives from `single_request_work_stage_test.go`, install a Review-specific executor/continuation adapter, and start it through the real service. Return a typed error `WorkspaceToolResponse` from the Node harness and assert the service terminal error, one provider call, one Node call, zero continuation, one cleanup, no REVIEW write/finalizing progress, and zero bridge waiters. Deep-compare the initial/resumed request maps, closed tool schemas, frozen run/tunnel/credential authority, and add one-winner concurrent duplicate plus post-cancel stale Review deliveries.

Before (`single_request_review_stage_test.go:530`):

```go
toolErrResult := edgeservice.InternalWorkspaceToolResult{
    RequestID: "request-review", StageID: singleRequestReviewStageID,
    ToolCallID: "repair-fail-1", Status: "error",
}
if err := bridge.ContinueInternalTool(ctx, toolErrResult); err != nil { /* ... */ }
```

After:

```go
harness.node.toolResponder = func(req *iop.WorkspaceToolRequest) *iop.WorkspaceToolResponse {
    return &iop.WorkspaceToolResponse{
        RequestId: req.GetRequestId(), StageId: req.GetStageId(), ToolCallId: req.GetToolCallId(),
        Status: iop.WorkspaceStatus_WORKSPACE_STATUS_ERROR,
        ErrorCode: iop.WorkspaceErrorCode_WORKSPACE_ERROR_CODE_INTERNAL,
    }
}
execution, err := harness.service.StartSingleRequest(ctx, reviewServiceRequest(harness.binding))
```

**Modified Files and Checklist**

- [ ] Update `apps/edge/internal/openai/single_request_review_stage_test.go` with the Review service executor/harness, real Node failure assertions, exact authority comparison, and race-sensitive correlation cases.
- [ ] Update `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/CODE_REVIEW-cloud-G06.md` with actual implementation decisions and command output.

**Test Strategy**

Extend the four existing named Review fixtures rather than creating production code. `TestSingleRequestReviewStageCoordinatorToolFailure` must use the service/Node harness and assert typed terminal, raw-error exclusion, no continuation, no REVIEW/finalizing, cleanup, and waiter count. `TestSingleRequestReviewStageExactBodyAuthority` must deep-compare both complete bodies and captured dispatch authority. `TestSingleRequestReviewStageContinuationCorrelation` must race two identical valid deliveries, observe exactly one success and one rejection, and reject a stale result after cancellation.

**Verification**

Run Final Verification commands 2, 4, 5, and 6. The focused test must pass under `-race`, and the static fixture guard must prove the coordinator fixture starts the service and no longer calls the bridge directly.

## Modified Files Summary

| File | Items |
|------|-------|
| `apps/edge/internal/openai/single_request_review_stage_test.go` | REVIEW_API-1 |
| `agent-task/m-iop-owned-single-request-agent-execution/20+19_review_repair/CODE_REVIEW-cloud-G06.md` | REVIEW_API-1 |

## Final Verification

Fresh output is required; Go tests use `-count=1` and cached output is not acceptable.

1. `bash -c 'set -euo pipefail; shopt -s nullglob; candidates=(agent-task/m-iop-owned-single-request-agent-execution/19_*/complete.log agent-task/m-iop-owned-single-request-agent-execution/19+*/complete.log agent-task/archive/*/*/m-iop-owned-single-request-agent-execution/19_*/complete.log agent-task/archive/*/*/m-iop-owned-single-request-agent-execution/19+*/complete.log); printf "%s\n" "${candidates[@]}"; ((${#candidates[@]} == 1))'` — prints exactly one predecessor completion path and exits zero.
2. `go test -race ./apps/edge/internal/openai -run 'TestSingleRequestReviewStage' -count=1` — exact authority, real coordinator/Node failure, provider/envelope failure, continuation correlation, cancellation, and cleanup pass without races.
3. `go test ./apps/edge/internal/service -run 'TestSingleRequest(InternalToolLoop|Cleanup|EnvelopeOrdering)' -count=1` — shared coordinator lifecycle remains compatible.
4. `go vet ./apps/edge/internal/openai && go test ./apps/edge/internal/openai -count=1` — the changed package vets and regresses cleanly.
5. `rg --sort path -n '^func TestSingleRequestReviewStage(ExactBodyAuthority|FailureMatrix|ContinuationCorrelation|CoordinatorToolFailure)' apps/edge/internal/openai/single_request_review_stage_test.go` — finds all four Review evidence fixtures.
6. `bash -c 'set -euo pipefail; fixture=$(sed -n "/^func TestSingleRequestReviewStageCoordinatorToolFailure/,/^}/p" apps/edge/internal/openai/single_request_review_stage_test.go); rg -q "StartSingleRequest" <<<"$fixture"; rg -q "WORKSPACE_STATUS_ERROR" <<<"$fixture"; if rg -q "bridge\\.ContinueInternalTool" <<<"$fixture"; then exit 1; fi'` — proves the coordinator failure fixture enters the service/Node path and does not inject a bridge result directly.
7. `test -z "$(gofmt -d apps/edge/internal/openai/single_request_review_stage_test.go)"` — the changed test file is formatted.
8. `test "$(git hash-object apps/edge/internal/openai/single_request_review_stage.go)" = '1fa8c84bdd5af917dbb091d2843bb1c6e0bb3ac2'` — production Review source remains unchanged.
9. `test ! -e apps/edge/internal/openai/single_request_executor.go && bash -c 'set -euo pipefail; if rg --sort path -n "NewSingleRequestExecutor|SetSingleRequestExecutor" apps/edge/internal/input/manager.go; then exit 1; else test $? -eq 1; fi'` — composite construction and activation remain deferred.
10. `bash -c 'set -euo pipefail; if git diff --unified=0 HEAD -- apps/edge/internal/service/single_request.go | rg -n "isValidTransition|SingleRequestState(Reviewing|Repairing)"; then exit 1; else test $? -eq 1; fi'` — no lifecycle-table delta exists.
11. `git diff --check` — exits zero with no whitespace errors.

External Claude/Mac full-cycle qualification remains S12 `claude-smoke` and is not performed by this test-only private component.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
