<!-- task=m-iop-hot-path-one-shot-execution/19+17,18_observation_lifecycle plan=1 tag=API milestone-task=route-observability -->

# Raw-free Hot Path observation lifecycle wiring

## For the Implementing Agent

구현 후 `CODE_REVIEW-cloud-G09.md`의 구현 담당 섹션에 실제 변경·검증 출력을 채우고 active 파일을 유지한다. 차단 시 정확한 blocker와 재개 조건만 기록하며 archive/`complete.log` 작성이나 상태 판정은 하지 않는다.

## Background

Child 18의 closed observation schema를 admission, dispatch attempts, transitions, outer terminal, cleanup, orphan responsibility에 연결한다. 모든 emit은 best effort이며 Hot Path의 response/cancellation/cleanup 의미를 바꾸지 않는다.

## Archive Evidence Snapshot

- 이전 active plan/review pair는 구현 전에 source reanalysis로 대체됐다. 구현 evidence와 verdict는 없다.

## Analysis

### Files Read

- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-hot-path-one-shot-execution/SDD.md`
- `apps/edge/internal/openai/hot_path_dispatch.go`
- `apps/edge/internal/openai/hot_path_light.go`
- `apps/edge/internal/openai/hot_path_cleanup.go`
- `apps/edge/internal/openai/hot_path_cleanup_test.go`
- `agent-test/local/rules.md`

### SDD Criteria

- 승인 SDD S15: one logical request를 route/stage/attempt/terminal/cleanup/orphan across time으로 join하고, actual path에서도 raw/secret absence와 bounded metric cardinality를 증명한다.

### Verification Context

- child 18 in-memory observer/collector와 deterministic fake stages를 사용한다. 외부 backend는 필요 없다.

### Test Coverage Gaps

- schema projection test만으로는 lifecycle callsite 누락, ordering, exactly-once counters, cleanup/orphan ownership, observer failure isolation을 증명할 수 없다.

### Symbol References

- public rename/remove 없음. Child 18 observer contract만 소비한다.

### Split Judgment

- stable contract: actual Hot Path lifecycle boundaries → closed observation schema. Schema construction은 child 18에 유지한다.

### Scope Rationale

- 새 sink contract, dashboard/backend, raw payload storage/hash, external smoke는 제외한다.

### Final Routing

- evaluation_mode=isolated-reassessment, finalizer=`finalize-task-policy.sh pair`.
- build scores=2/2/1/1/2, risks=`temporal_state,boundary_contract,variant_product`(3), local-fit → `PLAN-local-G08.md`.
- review → `CODE_REVIEW-cloud-G09.md`; `large_indivisible_context=false`, recovery=0/false.

## Implementation Checklist

- [ ] [API-1] Emit the predecessor observation contract across admission, dispatch, stage transition, terminal, cleanup, and orphan boundaries with exactly-once responsibility and failure isolation.
- [ ] [API-2] Add joined lifecycle, ordering/cardinality, raw/secret absence, and failure-isolation regressions on actual paths.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [API-1] Lifecycle emission

**Problem:** current logs do not join a Hot Path request across route, stage transitions, terminal choice, and deferred cleanup/orphan responsibility.

**Solution:** Emit typed observations at admission/route selection, every dispatch start/end, local/review/repair transition, one outer disposition, cleanup attempt/result, and orphan/TTL handoff. Reuse request correlation only in log projection; metric labels stay enum/bucket-only. Assign terminal and cleanup counters to their single winning callsites, normalize causes before projection, and wrap every observer call so failure/panic cannot affect response or cleanup.

**Modified Files and Checklist:**

- [ ] Modify `apps/edge/internal/openai/hot_path_dispatch.go` at admission, route, dispatch attempt/result, and outer terminal boundaries.
- [ ] Modify `apps/edge/internal/openai/hot_path_light.go` at local/review/repair transition and attempt boundaries.
- [ ] Modify `apps/edge/internal/openai/hot_path_cleanup.go` at cleanup result and orphan/TTL responsibility boundaries.

**Test Strategy:** direct, light-pass, light-repair, provider error, timeout/cancel, cleanup failure, and orphan rows produce exact lifecycle traces.

**Verification:** targeted API-2 command exits 0.

### [API-2] Actual-path evidence

**Problem:** callsite coverage and absence of raw values need positive and negative evidence from real lifecycle paths.

**Solution:** Capture ordered log/metric projections for all scenario rows. Assert join keys, monotonic attempt order, one terminal, one cleanup owner, bounded labels/buckets, observer failure isolation, and absence of seeded prompt/output/tool/header/credential/provider-error sentinels.

**Modified Files and Checklist:**

- [ ] Extend `apps/edge/internal/openai/hot_path_observation_test.go` with actual lifecycle, redaction/cardinality, and observer-failure rows.
- [ ] Record actual output in `agent-task/m-iop-hot-path-one-shot-execution/19+17,18_observation_lifecycle/CODE_REVIEW-cloud-G09.md`.

**Test Strategy:** exact ordered event classes and projected allowlists are the oracle.

**Verification:** run Final Verification; all commands exit 0.

## Dependencies and Execution Order

1. Directory dependency `17` must produce `agent-task/m-iop-hot-path-one-shot-execution/17+14,15,16_endpoint_error_matrix/complete.log`.
2. Directory dependency `18` must produce `agent-task/m-iop-hot-path-one-shot-execution/18+17_observation_schema/complete.log`.
3. Implement API-1, then API-2.

## Modified Files Summary

| File | Item |
|---|---|
| `apps/edge/internal/openai/hot_path_dispatch.go` | API-1 |
| `apps/edge/internal/openai/hot_path_light.go` | API-1 |
| `apps/edge/internal/openai/hot_path_cleanup.go` | API-1 |
| `apps/edge/internal/openai/hot_path_observation_test.go` | API-2 |
| `agent-task/m-iop-hot-path-one-shot-execution/19+17,18_observation_lifecycle/CODE_REVIEW-cloud-G09.md` | API-2 |

## Final Verification

```bash
go test -race -count=1 ./apps/edge/internal/openai -run 'TestHotPath(ObservationLifecycle|ObservationRejectsRawValues|MetricLabels|ObserverFailureIsolation|EndpointTerminalMatrix|Cleanup)'
go test -race -count=1 ./packages/go/streamgate ./packages/go/config ./apps/edge/internal/openai ./apps/edge/internal/service
git diff --check
```

Expected: exit 0, complete joined lifecycle, bounded raw-free projections, one terminal/cleanup owner, observation failure isolation, no race.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
