<!-- task=m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit plan=3 tag=TEST milestone-task=inventory,handoff-gate -->

# 삭제 내성 effective matrix와 pre-deletion receipt 확정

## For the Implementing Agent

`CODE_REVIEW-cloud-G09.md`의 implementation-owned 섹션 작성은 필수다. encoded predecessors의 exact PASS를 확인한 뒤 Task 10의 stable delta/addendum와 immutable original manifest를 task-local 검증 복제본으로 고정하고, exact-schema effective matrix와 pre-deletion receipt를 만든다. active pair를 유지한 채 review 준비 완료만 보고하며 finalization은 code-review agent만 수행한다. 차단되면 exact blocker, 실행한 명령/출력, 재개 조건만 implementation-owned evidence에 기록하고 archive, `complete.log`, control-plane stop file을 만들지 않는다.

## Background

Task 14가 exporter, verifier, original manifest, state fixture와 stable delta/addendum를 삭제하므로 Task 13의 증거가 live source를 계속 참조하면 archive 이후 재검증할 수 없다. 이 task는 삭제 전 모든 provenance input을 자기 task directory에 복제하고 digest sidecar로 검증한 뒤, original 303 rows와 Task 10 addendum의 disjoint union을 exact-schema matrix로 물질화한다. 실제 state export는 owner bundle의 canonical member에서만 읽고 host path/content를 기록하지 않으며, member literal·digest와 실제 record/category/quarantine/logical-ID 결과만 receipt에 고정한다.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md)
- Task ids:
  - `inventory`: immutable original, boundary delta/addendum와 effective disposition의 삭제 내성 증거
- Completion mode: `milestone-task` evidence aggregation; this PASS alone does not check either Roadmap Task.

## Archive Evidence Snapshot

- `plan_cloud_G09_0.log` / `code_review_cloud_G09_0.log`는 split 전 receipt 구상, `plan_cloud_G09_1.log` / `code_review_cloud_G09_1.log`는 폐기된 D02 generic Node 가정, `plan_cloud_G09_2.log` / `code_review_cloud_G09_2.log`는 stable source가 삭제된 뒤 archive를 다시 찾게 되는 미착수 구상을 보존한다.
- 세 pair 모두 implementation checklist, verification evidence, verdict, Roadmap completion이 없다. 현재 plan은 D04와 stable artifact contract만 승계하고 archive 단절과 receipt schema 결함을 수정한다.

## Analysis

### Files Read

- `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`
- `agent-contract/index.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `agent-spec/index.md`
- `agent-spec/runtime/iop-agent-cli-runtime.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-ops/rules/project/domain/node/rules.md`
- `agent-ops/rules/project/domain/platform-common/rules.md`
- `agent-ops/rules/project/domain/testing/rules.md`
- `agent-test/local/rules.md`
- `agent-test/local/testing-smoke.md`
- `scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv`
- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json`
- `scripts/fixtures/iop-agent-chronos-transfer-state-v1.json`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/06+04,05_bundle_verification/PLAN-cloud-G10.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/09+08_remove_agent_ui_close/PLAN-local-G08.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/PLAN-cloud-G10.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/PLAN-cloud-G09.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/CODE_REVIEW-cloud-G09.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/plan_cloud_G09_0.log`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/code_review_cloud_G09_0.log`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/plan_cloud_G09_1.log`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/code_review_cloud_G09_1.log`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/plan_cloud_G09_2.log`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/code_review_cloud_G09_2.log`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/WORK_LOG.md`
- `/config/workspace/.agent-roadmap-sync/locks.yaml`

### SDD Criteria

- SDD는 `[승인됨]`, 잠금 `해제`다. 첫 줄 `milestone-task=inventory,handoff-gate` 중 direct closure evidence는 S01/`inventory`이고, S05/`handoff-gate`에는 pre-deletion receipt evidence를 기여한다.
- S01 Evidence Map의 original manifest, D04 final disposition/import graph를 original/delta/addendum/effective 네 digest와 row-level merge로 연결한다.
- S05에 필요한 bundle/state/rollback/lock provenance는 이 task에서 pre-deletion receipt로 고정하지만, 최종 S05 composite receipt와 `handoff-gate` completion은 Task 15가 `HANDOFF.md`에서 닫는다.
- D04에 따라 IOP Node owner는 `model-provider-device`, Chronos connection surface는 0이다. Chronos Server/Node/loop/agent/terminal 구현 또는 IOP Node 연결은 이 task 범위가 아니다.

### Verification Context

- Encoded predecessors 09와 10은 immutable provenance path가 필요하므로 active candidate를 허용하지 않는다. 구현은 archive의 실제 존재하는 `complete.log`만 Bash `nullglob` 배열에 수집하고, 각 predecessor가 exactly one archived log이며 Summary의 final-PASS marker가 정확히 한 번인지 확인하기 전 시작하지 않는다.
- Task 10 stable inputs는 `scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.tsv(.sha256)`와 `scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv(.sha256)`다. source verifier는 `scripts/verify-iop-agent-chronos-boundary.py`이고 import-graph provenance는 archived Task 10 `node-boundary-audit.log`다.
- Task 06 stable non-secret source receipt는 `scripts/fixtures/iop-agent-chronos-transfer-bundle-receipt-v1.json`이다. Stable `real_bundle_sha`는 Task 13 `bundle_sha256`, exporter receipt `state_export_sha`에서 승계된 stable `real_state_export_sha`는 extracted canonical member의 `real_state_export_sha256`으로 연결한다. Record/category/quarantine counts, `state_logical_id_count=12`와 canonical `state_logical_ids_sha`도 required inputs이며 Task 13은 이 receipt를 복제하고 Task 14 삭제 전에 task-local digest sidecar를 만든다.
- Delta header는 `path\tprior_disposition\tfinal_action\tfinal_owner\tfinal_path\treason_code`; original의 all-and-only 137 `retain-generic` paths를 override한다. `retain-rewrite`에서 `final_path != path`이면 final path present와 old source path absent를 모두 강제한다. Addendum header는 `path\tsurface_kind\tfinal_action\tfinal_owner\tfinal_path\treason_code`; original/delta source path keys와 disjoint, bytewise sorted unique다.
- Addendum `surface_kind`는 `consumer|generated|contract|spec|rule|doc|neutral-successor|verification|state`; 일반 tuple은 `retain-rewrite+iop+same-path`, `create-neutral+iop+same-path`, `transfer-remove+chronos+-`다. Exactly two `surface_kind=state` rows는 `state:cache-root`, `state:temp-root`이며 둘 다 `transfer-remove/chronos/-/chronos-session-terminal-workspace`다. Addendum source `path` key는 original/delta source keys와 disjoint지만, `create-neutral.path`가 delta row의 `retain-rewrite.final_path`와 같은 것은 provenance/final-surface pair로 허용한다.
- Original manifest expected SHA-256은 `7026fedc8b0eb24eab5c4124d3818400f66db5f1d116a71e7781f346fbd256a7`, rows는 303, retain-generic rows는 137이다. Original의 `state:` logical ID exact set은 10개이고 addendum은 `state:cache-root`, `state:temp-root` 두 supplemental IDs를 포함한다. Task 05 sanitized fixture는 이 12-ID union과 exact set-equal인 12 records, 8 categories, 1 quarantine record이며 real export counts와 혼동하지 않는다.
- Owner-local input은 gzip tar `chronos-acceptance-v1.tar.gz`를 가리키는 `IOP_CHRONOS_BUNDLE_FILE` 하나뿐이다. verifier는 모든 archive path가 relative·normalized·unique이고 symlink/hardlink/device가 없음을 검사한 뒤 exact-one regular member `acceptance-v1/state/state-export-v1.json`만 mode `0700` owner-only temporary root에 `tar -xOzf`로 추출한다. 추출 파일은 mode `0600`으로 두고 종료 시 제거하며 bundle host path/content를 stdout, log, receipt에 쓰지 않는다.
- `/config/workspace/chronos`, canonical `/config/workspace/iop`, `/config/workspace/.agent-roadmap-sync/locks.yaml`은 before/after HEAD, status-byte digest, lock digest가 동일해야 한다. dirty/clean 여부를 추측하지 않고 동일성으로 외부 mutation 0을 판정한다.
- Local Bash, Python 3, `tar`, `sha256sum`, Git이 필요하며 external service/credential/port는 없다. Confidence는 high이고 predecessor PASS 및 owner bundle 접근이 실행 precondition이다.

### Test Coverage Gaps

- Product behavior는 변경하지 않으므로 새 unit test는 없다. task-local structured verifier가 source verifier 실행, merge schema, digest, row count, redaction, receipt field uniqueness와 external snapshot 동일성을 fail closed로 검사한다.
- 실제 export/bundle content는 tracked evidence에 복제하지 않는다. 접근 불가, schema 불일치, digest 재계산 불가는 blocker이며 fixture digest로 대체하지 않는다.

### Symbol References

- Runtime symbol 변경 없음.
- `verify-iop-agent-chronos-boundary.py`, ownership manifest, state schema/fixture, delta/addendum와 Task 10 audit가 provenance input이다.

### Split Judgment

- Immutable copies, merge, receipt와 external snapshot은 같은 digest graph와 deletion barrier를 공유한다. 어느 하나만 PASS하면 Task 14 삭제가 안전하지 않으므로 한 transaction으로 유지한다.
- Stable invariant는 receipt의 모든 literal path가 task-local copy 또는 exact predecessor archive file을 가리키고, 각 digest/row count가 verifier로 재현되며, real export와 sanitized fixture가 별도 필드인 것이다.

### Scope Rationale

- IOP source 삭제, README/HANDOFF pointer와 final regression은 Tasks 14–15 소유다.
- Chronos repository, canonical IOP, lock registry, roadmap/SDD와 owner-local content는 수정하지 않는다.

### Final Routing

- `evaluation_mode=isolated-reassessment`, finalizer=`finalize-task-policy.sh`, mode=`pair`.
- Build closures all true. Scores=`2,1,2,2,2`, grade=`G09`, base/route=`grade-boundary`, lane=`cloud`.
- Review closures all true. Scores=`2,1,2,2,2`, route=`official-review`, lane=`cloud`, grade=`G09`.
- `large_indivisible_context=false`; positive loop risks=`boundary_contract,structured_interpretation` (2); `review_rework_count=0`; `evidence_integrity_failure=false`; capability gap 없음.
- Canonical files: `PLAN-cloud-G09.md`, `CODE_REVIEW-cloud-G09.md`.

## Dependencies and Execution Order

1. Bash/repository-root preflight 후 09와 10 각각 exactly one archived PASS `complete.log`를 resolve한다. Task 10 archive directory의 `node-boundary-audit.log`도 exact named artifact로 확인한다.
2. owner-local bundle 하나의 접근을 확인하고 external repositories/lock before snapshot을 잡는다.
3. stable source verifier를 실행한 뒤 original/delta/addendum/state를 task-local artifact names로 copy하고 canonical digest sidecar를 만든다.
4. exact-schema effective matrix, receipt와 audit log를 물질화하고 task-local verifier의 full check와 external after comparison을 통과시킨다.

## Implementation Checklist

- [ ] Refuse to start unless Bash runs at repository root, predecessors 09 and 10 each resolve to exactly one archived `complete.log` with exactly one Summary final-PASS marker, Task 10's same-directory named import audit exists, and the single owner bundle input is readable.
- [ ] Validate immutable original, stable delta/addendum, state schema/fixture and Task 06 stable bundle receipt, including the exact original-10 plus supplemental-2 logical-state universe; create task-local byte-identical copies and canonical single-line SHA-256 sidecars.
- [ ] Materialize the exact-schema effective matrix and pure front-matter pre-deletion receipt with every required literal path, digest, row count, import provenance, rollback, promotion and lock field exactly once.
- [ ] Implement and run the task-local structured verifier; capture deterministic command/stdout/stderr/exit-code markers and equal external before/after identities in `pre-deletion-audit.log` without owner path/content leakage.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [TEST-1] 삭제 내성 input copies와 exact-schema effective matrix

**Problem**

Task 14가 stable source artifacts와 verifier를 삭제한 뒤 receipt가 live paths를 참조하면 Task 15가 original/delta/addendum/state provenance를 재검증할 수 없다. Addendum을 누락하면 Task 10에서 새로 생긴 consumer/generated/neutral surfaces도 disposition universe 밖에 남는다.

**Solution**

Original, delta, addendum, state schema/fixture data bytes를 이 task directory에 고정한다. Source sidecar는 repo-relative `scripts/fixtures/...tsv` name으로 먼저 검증하고, task-local sidecar는 copy basename을 가리키는 `sha256sum` canonical one-line format으로 재생성한다. Effective matrix exact header는 다음과 같다.

```text
path\tsurface_kind\toriginal_disposition\toriginal_bundle_path\toriginal_iop_action\toriginal_neutral_successor\toriginal_evidence_map\tfinal_action\tfinal_owner\tfinal_path\treason_code\tdecision_source
```

- Original `retain-generic` 137 rows는 delta로 all-and-only override하고 `decision_source=boundary-delta-v1`다.
- Original `transfer`는 `transfer-remove/chronos/-/original-transfer/original-manifest`, `reference`는 `reference/none/-/provenance-reference/original-manifest`로 보존한다.
- Addendum rows는 original fields를 `-`로 두고 `decision_source=boundary-surface-addendum-v1`로 source-key disjoint union한다. `create-neutral.path == delta retain-rewrite.final_path`는 허용하되 다른 source-key collision은 거부한다.
- 전체 path는 bytewise sorted unique이고 row count는 `303 + boundary_addendum_row_count`다.
- Original manifest의 10 `state:` keys와 addendum의 exact `state:cache-root`, `state:temp-root`는 logical surfaces다. 둘의 12-ID union은 state fixture `records[].logical_id`와 exact set-equal이어야 하고 filesystem presence/absence 판정에서는 제외한다.

**Modified Files and Checklist**

- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-ownership-manifest.tsv` — immutable original copy.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-ownership-manifest.sha256` — canonical original digest sidecar.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/boundary-disposition-delta-v1.tsv` — validated stable delta copy.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/boundary-disposition-delta-v1.sha256` — canonical delta digest sidecar.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/boundary-surface-addendum-v1.tsv` — validated stable addendum copy.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/boundary-surface-addendum-v1.sha256` — canonical addendum digest sidecar.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-transfer-state-v1.schema.json` — validated state schema copy.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-transfer-state-v1.schema.json.sha256` — canonical schema digest sidecar.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-transfer-state-v1.json` — sanitized exact 12-logical-ID fixture copy.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-transfer-state-v1.json.sha256` — canonical fixture digest sidecar.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-transfer-bundle-receipt-v1.json` — validated Task 06 stable receipt copy.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-transfer-bundle-receipt-v1.json.sha256` — canonical stable-receipt digest sidecar.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/effective-disposition-matrix-v1.tsv` — exact-schema merged matrix.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/effective-disposition-matrix-v1.sha256` — canonical matrix digest sidecar.

**Test Strategy**

- Run Task 10's stable verifier against live stable inputs first with original/delta/addendum, `--state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json`, `--expected-state-logical-id-sha256 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9`, `--iop-root .` and `--check-only`, then verify copy byte identity and sidecars. The task-local verifier rejects header/order/duplicate/disjoint/enum/tuple/coverage/count/state-ID or live-path disposition mismatches; it skips all `state:` logical keys for filesystem existence and accepts a renamed `retain-rewrite` only when its final path exists and old source path is absent. Task-local verifier는 이 고정 digest 옵션을 Task 10 stable verifier에 그대로 전달한다.

**Verification**

- `bash -euo pipefail -c 'test "$PWD" = /config/workspace/iop-s1; shopt -s nullglob; group=m-iop-agent-chronos-extraction-decoupling; for task in 09+08_remove_agent_ui_close 10+09_neutral_execution; do logs=(); for archived in agent-task/archive/*/*/"$group"/"$task"/complete.log; do test -f "$archived"; logs+=("$archived"); done; test "${#logs[@]}" -eq 1; awk '\''/^## (Summary|요약)$/ {s=1; next} /^## / && s {exit} s && (/final verdict: PASS/ || /최종 verdict: PASS/) {p++} END {exit p==1?0:1}'\'' "${logs[0]}"; done'`
- `bash -euo pipefail -c ': "${IOP_CHRONOS_BUNDLE_FILE:?set owner-approved readable gzip tar bundle}"; test -f "$IOP_CHRONOS_BUNDLE_FILE"; test -r "$IOP_CHRONOS_BUNDLE_FILE"; python3 agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/verify-pre-deletion-receipt-v1.py materialize --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --manifest-sha256 7026fedc8b0eb24eab5c4124d3818400f66db5f1d116a71e7781f346fbd256a7 --delta scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.tsv --delta-sha256 scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 --addendum scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv --addendum-sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256 --state-schema scripts/fixtures/iop-agent-chronos-transfer-state-v1.schema.json --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --expected-state-logical-id-sha256 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9 --bundle-receipt scripts/fixtures/iop-agent-chronos-transfer-bundle-receipt-v1.json --bundle-state-member acceptance-v1/state/state-export-v1.json --boundary-verifier scripts/verify-iop-agent-chronos-boundary.py --owner-bundle "$IOP_CHRONOS_BUNDLE_FILE" --artifact-dir agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit --audit agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/pre-deletion-audit.log'`

### [TEST-2] Exact receipt, import provenance와 read-only external audit

**Problem**

Digest만 흩어 놓으면 어떤 artifact bytes와 실제 export를 검증했는지, import graph가 어떤 Task 10 run에서 0이었는지, rollback/promotion/lock 상태가 무엇인지 결정적으로 복원할 수 없다. Sanitized fixture 12 records를 실제 export count로 오인해도 안 된다.

**Solution**

`pre-deletion-transfer-receipt-v1.md`는 YAML front matter에 아래 ordered key set을 각각 정확히 한 번 갖고, 나머지 key를 허용하지 않는다. `<sha256>`, `<count>`, `<exact-archive-path>`는 verifier가 actual value로 치환하며 angle-bracket placeholder 자체는 결과에 남을 수 없다.

```text
receipt_version: 1
source_revision: 3155be0e275437a8eedc1aa93497955a7d30465b
rollback_revision: 3155be0e275437a8eedc1aa93497955a7d30465b
artifact_root: .
original_manifest_path: iop-agent-chronos-ownership-manifest.tsv
original_manifest_sha256_path: iop-agent-chronos-ownership-manifest.sha256
original_manifest_sha256: <sha256>
original_manifest_row_count: 303
boundary_delta_path: boundary-disposition-delta-v1.tsv
boundary_delta_sha256_path: boundary-disposition-delta-v1.sha256
boundary_delta_sha256: <sha256>
boundary_delta_row_count: 137
boundary_addendum_path: boundary-surface-addendum-v1.tsv
boundary_addendum_sha256_path: boundary-surface-addendum-v1.sha256
boundary_addendum_sha256: <sha256>
boundary_addendum_row_count: <count>
effective_matrix_path: effective-disposition-matrix-v1.tsv
effective_matrix_sha256_path: effective-disposition-matrix-v1.sha256
effective_matrix_sha256: <sha256>
effective_matrix_row_count: <303-plus-addendum-count>
state_schema_path: iop-agent-chronos-transfer-state-v1.schema.json
state_schema_sha256_path: iop-agent-chronos-transfer-state-v1.schema.json.sha256
state_schema_sha256: <sha256>
state_fixture_path: iop-agent-chronos-transfer-state-v1.json
state_fixture_sha256_path: iop-agent-chronos-transfer-state-v1.json.sha256
state_fixture_sha256: <sha256>
state_original_manifest_logical_id_count: 10
state_addendum_logical_id_count: 2
state_logical_id_count: 12
state_logical_ids_sha: 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9
state_fixture_record_count: 12
state_fixture_category_count: 8
state_fixture_quarantine_count: 1
bundle_receipt_path: iop-agent-chronos-transfer-bundle-receipt-v1.json
bundle_receipt_sha256_path: iop-agent-chronos-transfer-bundle-receipt-v1.json.sha256
bundle_receipt_sha256: <sha256>
real_state_export_location: bundle-member:acceptance-v1/state/state-export-v1.json
real_state_export_sha256: <sha256>
real_state_export_record_count: <actual-count>
real_state_export_category_count: <actual-count>
real_state_export_quarantine_count: <actual-count>
bundle_location: withheld-owner-local
bundle_sha256: <sha256>
task09_complete_log_path: <exact-archive-path>
task09_complete_log_sha256: <sha256>
task10_complete_log_path: <exact-archive-path>
task10_complete_log_sha256: <sha256>
import_graph_audit_path: <exact-task10-archive-path>/node-boundary-audit.log
import_graph_audit_sha256: <sha256>
import_graph_residuals: 0
iop_node_owner: model-provider-device
chronos_connection_surfaces: 0
chronos_repository_mutations: 0
external_mutations: 0
canonical_promotion: pending
downstream_lock: chronos:chronos-architecture-ownership-boundary
staging_lock_identity: iop-s1:agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md
staging_lock_result: none
canonical_lock_identity: iop:agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md
canonical_lock_result: rely-on:chronos:chronos-architecture-ownership-boundary
```

Artifact basenames are literal receipt-relative paths without `/`, wildcard, absolute prefix or `..`; predecessor provenance paths are literal workspace-relative paths under the exactly resolved archive directories. Every digest is lowercase 64-hex and sidecars name only their receipt-relative artifact basename. `real_state_export_location` is the fixed non-host literal `bundle-member:acceptance-v1/state/state-export-v1.json`; its three actual counts and logical-ID facts are recomputed from extracted member bytes, must satisfy the state schema and Task 06 stable receipt, and are not copied from fixture counts. Audit log records command id, stdout/stderr digest and exit code, archive/member safety, row/state counters, digest matches, redaction check and before/after external identities.

**Modified Files and Checklist**

- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/pre-deletion-transfer-receipt-v1.md` — strict pre-deletion provenance receipt.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/verify-pre-deletion-receipt-v1.py` — deterministic materialize/check/check-archived/check-live verifier.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/pre-deletion-audit.log` — non-secret commands, counters and external before/after evidence.

**Test Strategy**

- `materialize`와 `check`는 owner bundle SHA를 stable Task 06 receipt `real_bundle_sha`와 대조하고, unsafe/duplicate/non-regular archive entries를 거부한 뒤 exact-one canonical member를 owner-only temporary root에 추출한다. Member SHA는 stable receipt `real_state_export_sha`와, schema-derived record/category/quarantine/logical-ID count 및 canonical sorted-ID digest는 stable receipt의 대응 필드와 각각 같아야 한다. `check`는 exact front-matter key set과 `real_state_export_location=bundle-member:acceptance-v1/state/state-export-v1.json`을 강제하고, original 10 IDs와 supplemental 2 IDs의 union이 12-record fixture 및 extracted member logical IDs와 일치하는지 재계산한다. Owner bundle/temp host path나 member content는 출력하지 않으며 Task 10 import provenance, `renamed_source_residuals=0`, external before/after 동일성도 확인한다.
- `check-archived`는 owner input을 요구하거나 archive를 검색하지 않고 task-local stable receipt copy, receipt, sidecars와 audit markers에서 fixed member location/digest/count/logical-ID binding을 재검증한다. `check-live`는 같은 archived matrix/receipt를 현재 IOP tree에 대조하며 `state:` logical keys는 filesystem 판정에서 제외한다.

**Verification**

- `bash -euo pipefail -c ': "${IOP_CHRONOS_BUNDLE_FILE:?set owner-approved readable gzip tar bundle}"; test -f "$IOP_CHRONOS_BUNDLE_FILE"; test -r "$IOP_CHRONOS_BUNDLE_FILE"; python3 agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/verify-pre-deletion-receipt-v1.py check --artifact-dir agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit --receipt agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/pre-deletion-transfer-receipt-v1.md --iop-root . --bundle-state-member acceptance-v1/state/state-export-v1.json --owner-bundle "$IOP_CHRONOS_BUNDLE_FILE" --audit agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/pre-deletion-audit.log'`
- `python3 -c 'from pathlib import Path; p=Path("agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/pre-deletion-audit.log"); t=p.read_text(); required=["original_manifest_digest_match=1","boundary_delta_digest_match=1","boundary_addendum_digest_match=1","effective_matrix_digest_match=1","state_schema_digest_match=1","state_fixture_digest_match=1","bundle_receipt_digest_match=1","upstream_receipt_state_fields_match=1","bundle_member_path=acceptance-v1/state/state-export-v1.json","bundle_member_exactly_once=1","bundle_archive_paths_safe=1","bundle_member_regular_file=1","owner_temp_mode=0700","owner_temp_cleanup=1","real_state_export_location=bundle-member:acceptance-v1/state/state-export-v1.json","real_state_export_digest_match=1","real_state_export_counts_match=1","real_state_export_logical_ids_match=1","bundle_digest_match=1","original_manifest_rows=303","boundary_delta_rows=137","state_manifest_records=10","state_supplemental_records=2","state_supplemental_ids=state:cache-root,state:temp-root","state_fixture_records=12","state_coverage_missing=0","state_coverage_unknown=0","state_logical_id_count=12","state_logical_id_sha256=9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9","state_logical_ids_sha_match=1","state_fixture_categories=8","state_fixture_quarantine=1","state_logical_id_mismatches=0","import_graph_residuals=0","renamed_source_residuals=0","receipt_path_leaks=0","external_mutations=0","canonical_promotion=pending"]; missing=[x for x in required if t.splitlines().count(x)!=1]; assert not missing, missing'`

## Modified Files Summary

| File | Item |
|------|------|
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-ownership-manifest.tsv` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-ownership-manifest.sha256` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/boundary-disposition-delta-v1.tsv` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/boundary-disposition-delta-v1.sha256` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/boundary-surface-addendum-v1.tsv` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/boundary-surface-addendum-v1.sha256` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-transfer-state-v1.schema.json` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-transfer-state-v1.schema.json.sha256` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-transfer-state-v1.json` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-transfer-state-v1.json.sha256` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-transfer-bundle-receipt-v1.json` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/iop-agent-chronos-transfer-bundle-receipt-v1.json.sha256` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/effective-disposition-matrix-v1.tsv` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/effective-disposition-matrix-v1.sha256` | TEST-1 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/pre-deletion-transfer-receipt-v1.md` | TEST-2 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/verify-pre-deletion-receipt-v1.py` | TEST-2 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/pre-deletion-audit.log` | TEST-2 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/CODE_REVIEW-cloud-G09.md` | TEST-1, TEST-2 |

## Final Verification

1. `bash -euo pipefail -c 'test "$PWD" = /config/workspace/iop-s1; shopt -s nullglob; group=m-iop-agent-chronos-extraction-decoupling; for task in 09+08_remove_agent_ui_close 10+09_neutral_execution; do logs=(); for archived in agent-task/archive/*/*/"$group"/"$task"/complete.log; do test -f "$archived"; logs+=("$archived"); done; test "${#logs[@]}" -eq 1; awk '\''/^## (Summary|요약)$/ {s=1; next} /^## / && s {exit} s && (/final verdict: PASS/ || /최종 verdict: PASS/) {p++} END {exit p==1?0:1}'\'' "${logs[0]}"; done'`
2. `bash -euo pipefail -c ': "${IOP_CHRONOS_BUNDLE_FILE:?set owner-approved readable gzip tar bundle}"; test -f "$IOP_CHRONOS_BUNDLE_FILE"; test -r "$IOP_CHRONOS_BUNDLE_FILE"; python3 agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/verify-pre-deletion-receipt-v1.py check --artifact-dir agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit --receipt agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/pre-deletion-transfer-receipt-v1.md --iop-root . --bundle-state-member acceptance-v1/state/state-export-v1.json --owner-bundle "$IOP_CHRONOS_BUNDLE_FILE" --audit agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/pre-deletion-audit.log'`
3. `python3 -c 'from pathlib import Path; p=Path("agent-task/m-iop-agent-chronos-extraction-decoupling/13+09,10_receipt_lock_audit/pre-deletion-audit.log"); t=p.read_text(); required=["original_manifest_digest_match=1","boundary_delta_digest_match=1","boundary_addendum_digest_match=1","effective_matrix_digest_match=1","state_schema_digest_match=1","state_fixture_digest_match=1","bundle_receipt_digest_match=1","upstream_receipt_state_fields_match=1","bundle_member_path=acceptance-v1/state/state-export-v1.json","bundle_member_exactly_once=1","bundle_archive_paths_safe=1","bundle_member_regular_file=1","owner_temp_mode=0700","owner_temp_cleanup=1","real_state_export_location=bundle-member:acceptance-v1/state/state-export-v1.json","real_state_export_digest_match=1","real_state_export_counts_match=1","real_state_export_logical_ids_match=1","bundle_digest_match=1","original_manifest_rows=303","boundary_delta_rows=137","state_manifest_records=10","state_supplemental_records=2","state_supplemental_ids=state:cache-root,state:temp-root","state_fixture_records=12","state_coverage_missing=0","state_coverage_unknown=0","state_logical_id_count=12","state_logical_id_sha256=9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9","state_logical_ids_sha_match=1","state_fixture_categories=8","state_fixture_quarantine=1","state_logical_id_mismatches=0","import_graph_residuals=0","renamed_source_residuals=0","receipt_path_leaks=0","external_mutations=0","canonical_promotion=pending"]; missing=[x for x in required if t.splitlines().count(x)!=1]; assert not missing, missing'`
4. `git diff --check`

Commands containing `go test -count=1` require fresh output; all other checks are rerun against the current checkout.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
