<!-- task=m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence plan=8 tag=REVIEW_OFR-S07-IDENTITY-DEADLINE-8 -->

# Code Review Reference - REVIEW_OFR-S07-IDENTITY-DEADLINE-8

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, mutation and invocation counts, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-07-30
task=m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence, plan=8, tag=REVIEW_OFR-S07-IDENTITY-DEADLINE-8

## Roadmap Targets

- Milestone: `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md`
- Milestone link: [Milestone document](agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md)
- Task ids:
  - `repeat-guard`: rolling content/history/action repetition detection and safe continuation
- Completion mode: check-on-pass

## Archive Evidence Snapshot

- `plan_cloud_G10_7.log` / `code_review_cloud_G10_7.log`: FAIL with three Required findings and trusted evidence.
- The deployed production candidate correctly emits the Chat post-open error event plus one final `[DONE]`; focused and full local/isolated-remote profiles passed before deployment.
- The sole plan-7 invocation observed provider response ID transitions inside two recovered caller streams and one client-side 20-minute timeout. No accepted `summary.json` exists.
- Required rework is limited to `apps/edge/internal/openai/stream_gate_vertical_slice_test.go`: preserve a bounded ordered ID sequence per logical caller response, reject non-contiguous reuse and cross-request overlap, make the live request deadline command-configurable within the enclosing test budget, and rerun S07 once on a fresh path.
- The plan-7 partial artifact, source overlay, binary backup, and all earlier artifacts must remain preserved.
- Fresh reviewer evidence: local focused tests pass; remote checkout `750cb1d1cb88066a10d3c703c99f1326306d8e15` is clean; Edge PID `20646` serves the deployed plan-7 candidate hash `e0eff854e5c6841e6dd5cafcd7242254c91ece26b4ad328a2b937acca42122e5`; four listeners, four connected nodes, and idle healthy capacity `3+1` are present; plan-8 source/result paths are absent and no live harness is running.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G09.md` → `code_review_cloud_G09_8.log` and `PLAN-cloud-G09.md` → `plan_cloud_G09_8.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, report completion event metadata. Roadmap state check and `update-roadmap` calls are runtime responsibilities.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_OFR-S07-IDENTITY-DEADLINE-8-1 | [x] |
| REVIEW_OFR-S07-IDENTITY-DEADLINE-8-2 | [x] |
| REVIEW_OFR-S07-IDENTITY-DEADLINE-8-3 | [ ] |

## Implementation Checklist

- [x] [REVIEW_OFR-S07-IDENTITY-DEADLINE-8-1] Represent each logical caller response with a bounded ordered provider-native ID sequence, accept contiguous continuation transitions, reject non-contiguous reuse and cross-request overlap, and expand deterministic success/error/invalid fixtures.
- [x] [REVIEW_OFR-S07-IDENTITY-DEADLINE-8-2] Replace the fixed 20-minute client timeout with a command-configurable per-request duration that is bounded against the enclosing test deadline with explicit cleanup reserve; add parsing and budget boundary tests and run fresh local profiles.
- [ ] [REVIEW_OFR-S07-IDENTITY-DEADLINE-8-3] Build and test a fresh isolated plan-8 source overlay, prove the deployed plan-7 candidate and idle `3+1` runtime remain unchanged, run at most one foreground 5-concurrent x 3-run S07 invocation, and validate the sanitized summary and cleanup evidence.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G09_8.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G09_8.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/` to `agent-task/archive/YYYY/MM/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/` and update this checklist at the final archive path.
- [ ] If PASS and task group is `m-<milestone-slug>`, report completion event metadata for runtime, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove empty active parent `agent-task/m-openai-compatible-output-validation-filters/` or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

- The sole authorized foreground S07 invocation reached `remote_live_start` and then failed during run 1 with the sanitized error `run=1 attempt=1 released repeated downstream content`. Per the plan, the invocation was consumed and was not retried.
- Because the live test failed, no accepted `summary.json` was created and the success-only summary validation command was not executed. A raw-free cleanup probe was executed instead, and the partial plan-8 artifact was preserved.
- No production Edge build, replacement, restart, rollback, config mutation, checkout mutation, or credential mutation was performed.
- Mutation counts: one tracked implementation file and this active review file; two fresh remote temporary roots (source overlay and partial result artifact); production runtime/config/checkout mutations `0`; Edge restart count `0`; live model invocation count `1`.
- Resume condition: official review must assess the downstream-repeat failure. Any later live execution requires a reviewer-authored follow-up with a fresh artifact path and explicit new invocation authorization.

## Key Design Decisions

- Each logical caller response now records `provider_response_ids`, an ordered list of one to four provider-native `chatcmpl-*` identities. Adjacent events may retain the current identity; a transition closes the prior identity, and a closed identity cannot reappear.
- Every non-error provider data event must carry a valid non-empty provider-native identity. The one host-authored terminal error event may omit `id`.
- Batch and final evidence validation flatten all identity lists and require global disjointness without pairing provider identities positionally to Edge lifecycle correlations. Provider and Edge terminal cardinality remains the only cross-domain terminal comparison.
- `IOP_OPENAI_SMOKE_REQUEST_TIMEOUT` defaults to and is capped at `25m`. Each run reserves an additional `2m` for capacity settlement, and the test reserves `5m` for final cleanup. Three default runs therefore require at least `86m` under the enclosing deadline. The capacity observer uses `request timeout + settlement allowance`, so it cannot expire before the request client.

## Reviewer Checkpoints

- Verify every provider data event carries a non-empty `chatcmpl-*` identity, while the single host-authored error event may omit it.
- Verify an identity may repeat contiguously, a new identity starts a bounded continuation segment, and a closed identity cannot reappear.
- Verify the maximum identity count is the initial attempt plus three recovery attempts.
- Verify summary/batch/final validation requires 15 logical response rows and globally disjoint flattened provider identities without inventing provider-to-Edge positional pairing.
- Verify success and error terminal grammar remains exactly one logical terminal followed by one final `[DONE]`.
- Verify `IOP_OPENAI_SMOKE_REQUEST_TIMEOUT=25m` is parsed as a duration and the three-run request/settlement/cleanup budget fits inside the enclosing test deadline before any provider request.
- Verify local and isolated-remote profiles run uncached against the three-file overlay.
- Verify the remote Edge hash remains the deployed plan-7 candidate, checkout stays clean, no restart occurs, and plan-8 paths were fresh before first use.
- Verify protected SOPS authentication exposes no token/header/hash and returns `/v1/models` HTTP 200.
- Verify the S07 process starts at most once in the foreground, is never retried, and leaves accepted summary/cleanup evidence.
- Verify PASS reports only `repeat-guard`, not `ops-evidence`.

## Verification Results

### Ordered continuation identity fixtures

Commands:

```bash
go test -count=1 ./apps/edge/internal/openai -run '^(TestStreamGateChatTunnelRepeatRecoveryExhaustionTerminatesSSE|TestDevRepeatGuardSmokeEvidence|TestDevRepeatGuardObservationCorrelation)$'
```

Implementation evidence:

Exit `0`:

```text
ok  	iop/apps/edge/internal/openai	0.028s
```

Coverage includes one- and two-ID success, two-ID host-error termination, missing/empty/invalid-prefix IDs, non-contiguous reuse, the four-ID bound, mixed/duplicate/missing logical terminals, post-terminal data, cross-request overlap, and final flattened overlap across runs.

### Configurable request deadline and local profile

Commands:

```bash
go version
go env GOMOD
go test -count=1 ./apps/edge/internal/openai -run '^(TestDevRepeatGuardRequestDeadline|TestDevRepeatGuardSmokeEvidence|TestDevRepeatGuardCapacityEvidence)$'
go test -count=1 ./packages/go/streamgate ./apps/edge/internal/openai
git diff --check
```

Implementation evidence:

All commands exited `0`:

```text
go version go1.26.2 linux/arm64
/config/workspace/iop-s1/go.mod
ok  	iop/apps/edge/internal/openai	0.324s
ok  	iop/packages/go/streamgate	0.884s
ok  	iop/apps/edge/internal/openai	7.319s
```

`git diff --check` produced no output. Deadline fixtures cover default and explicit durations, malformed/zero/negative/above-policy values, exact `86m` fit, insufficient cleanup reserve, missing-test-deadline fallback, and three `25m` runs under a `90m` envelope.

### Isolated remote plan-8 overlay

Commands:

- Execute the exact overlay and isolated profile commands in `PLAN-cloud-G09.md`.

Implementation evidence:

The fresh overlay was created from remote HEAD `750cb1d1cb88066a10d3c703c99f1326306d8e15`. Manifest:

```text
207698668e0c51994a2e286357d0f97ebb94b8e6cf7f221b611a02deb54c9175  apps/edge/internal/openai/stream_gate_release_sink.go
24fc8f20ffb8c23e5aef44d2ccfce48adef65a5aad2bef1eb2d01bb6b9e642a0  apps/edge/internal/openai/stream_gate_tunnel_codec.go
cee62c686df3f85dde73ca7addf29d740f7531b448637b767b8961340c764516  apps/edge/internal/openai/stream_gate_vertical_slice_test.go
```

Overlay verification and isolated profile exited `0`:

```text
apps/edge/internal/openai/stream_gate_release_sink.go: OK
apps/edge/internal/openai/stream_gate_tunnel_codec.go: OK
apps/edge/internal/openai/stream_gate_vertical_slice_test.go: OK
go version go1.26.3 darwin/arm64
ok  	iop/packages/go/streamgate	1.275s
ok  	iop/apps/edge/internal/openai	7.864s
remote_plan8_gate=PASS base_head=750cb1d1cb88066a10d3c703c99f1326306d8e15 runtime_hash=e0eff854e5c6841e6dd5cafcd7242254c91ece26b4ad328a2b937acca42122e5 edge_restart_count=0 invocation_count=0
```

The immutable checkout was clean, the deployed runtime matched the preserved plan-7 candidate, and the plan-8 source/result paths were fresh before use.

### One foreground S07 invocation

Commands:

- Execute the exact `remote_live_start` command in `PLAN-cloud-G09.md` at most once.

Implementation evidence:

The protected preflight completed before this sole foreground start:

```text
remote_live_start invocation_count=1 ownership=foreground artifact=plan-8 edge_restart_count=0
=== RUN   TestDevRepeatGuardOrnithSmoke
```

The invocation exited `1` and was not retried:

```text
stream_gate_vertical_slice_test.go:2697: correlate observation segment for run=1: run=1 attempt=1 released repeated downstream content
--- FAIL: TestDevRepeatGuardOrnithSmoke (327.95s)
FAIL
FAIL	iop/apps/edge/internal/openai	328.279s
FAIL
```

Sanitized result: failed downstream-repeat invariant at run `1`, logical request `1`; `invocation_count=1`; `edge_restart_count=0`.

### Sanitized summary and cleanup

Commands:

- Execute the exact summary/cleanup command in `PLAN-cloud-G09.md` only after a successful foreground run.

Implementation evidence:

The success-only summary command was not run. The raw-free failure cleanup probe exited `0`:

```text
remote_cleanup_probe=PASS result=failed_downstream_repeat run=1 attempt=1 invocation_count=1 summary_present=false providers=idle harness=absent candidate=unchanged checkout=clean prior_artifacts=preserved partial_plan8_artifact=preserved edge_restart_count=0
```

### Workspace hygiene

Commands:

```bash
git diff --check
git status --short
git grep -nE 'sk-[A-Za-z0-9_-]{16,}|Authorization: Bearer [^$]' -- . \
  ':(exclude)agent-task/archive/**' \
  ':(exclude)agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/*.log'
```

Implementation evidence:

`git diff --check` exited `0` with no output.

`git status --short` confirms the scoped implementation file is modified and the active task directory is untracked, alongside unrelated pre-existing user/task changes. No unrelated file was modified by this packet.

The prescribed secret-like pattern scan exited `0` because existing examples/tests match the broad pattern. Path-only findings were:

```text
agent-contract/outer/a2a-json-rpc-api.md
agent-contract/outer/openai-compatible-api.md
agent-ops/skills/project/orchestrate-agent-task-loop/scripts/dispatch.py
agent-roadmap/archive/phase/automation-runtime-bridge/milestones/agent-task-runtime-target-selector.md
agent-roadmap/archive/phase/operational-observability-provider-management/milestones/usage-token-log-ops-mvp.md
agent-roadmap/archive/sdd/automation-runtime-bridge/agent-task-runtime-target-selector/SDD.md
agent-roadmap/archive/sdd/operational-observability-provider-management/usage-token-log-ops-mvp/SDD.md
agent-roadmap/phase/automation-runtime-bridge/PHASE.md
agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md
agent-roadmap/phase/automation-runtime-bridge/milestones/shared-agent-task-runtime-desktop-agent.md
agent-roadmap/sdd/automation-runtime-bridge/cli-agent-group-grade-routing/user_review_0.log
agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md
agent-roadmap/sdd/automation-runtime-bridge/shared-agent-task-runtime-desktop-agent/SDD.md
agent-roadmap/sdd/automation-runtime-bridge/shared-agent-task-runtime-desktop-agent/user_review_0.log
apps/edge/internal/openai/log_safety_test.go
apps/edge/internal/openai/usage_metrics_test.go
docs/edge-local-dev-guide.md
packages/go/agentprovider/catalog/lifecycle_conformance_test.go
packages/go/agentprovider/catalog/redact_test.go
tmp/iop-review-followup.MreBOU/CODE_REVIEW-cloud-G08.md
tmp/iop-review-followup.MreBOU/PLAN-local-G08.md
```

Neither scoped implementation file nor this active review file appeared in the path-only findings.

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Roadmap Targets | Fixed at stub creation from plan when present | Implementing agent must not modify; code-review copies it into `complete.log` as `Roadmap Completion` only on PASS |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail — the live smoke collapses reasoning and content into one string before checking for a repeated suffix, so a repetition that exists only across the channel boundary is reported as released downstream repetition.
  - Completeness: Fail — `REVIEW_OFR-S07-IDENTITY-DEADLINE-8-3` is incomplete; the only authorized plan-8 invocation failed and no accepted `summary.json` exists.
  - Test Coverage: Fail — deterministic fixtures cover SSE identity and terminal grammar but do not cover channel-preserving downstream repetition classification or a cross-channel false positive.
  - API Contract: Fail — the evidence harness violates the approved content/reasoning channel provenance used by the Stream Evidence Gate contract.
  - Code Quality: Pass.
  - Implementation Deviation: Fail — the remote run stopped during run 1, so the required three-run summary and success cleanup validation were not executed.
  - Verification Trust: Pass — fresh uncached local tests matched the recorded results, and a read-only remote audit confirmed five preserved SSE files, no summary, idle providers, an absent harness, the unchanged candidate, and the channel-boundary false positive without exposing raw output.
  - Spec Conformance: Fail — SDD S03/S07 and the Evidence Map require channel-preserving repeat evidence plus a completed capacity+1 three-run smoke; neither is established by this packet.
- Findings:
  - Required — `apps/edge/internal/openai/stream_gate_vertical_slice_test.go:3143`: `devRepeatGuardSmokeText` appends `reasoning_content`, `reasoning`, and `content` into one string before calling `openAIRepeatedSuffix`. The preserved plan-8 artifact proves the defect: each of the five responses is non-repeating when content and reasoning are checked separately, while four become repeating only after concatenation. Parse the caller SSE into separate content and canonical reasoning accumulators using the production codec's `reasoning_content`-then-`reasoning` precedence, evaluate repetition within each channel only, and add deterministic content-repeat, reasoning-repeat, and cross-channel-nonrepeat fixtures.
  - Required — `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/CODE_REVIEW-cloud-G09.md:57`: the integrated remote item remains unchecked, the sole plan-8 invocation exited non-zero, and the success-only summary command was not run. After the channel-aware harness fix passes locally and in a fresh isolated overlay, authorize at most one new foreground invocation on a fresh artifact path and require all 15 provider-response rows, 15 Edge correlations, three capacity rows, accepted classification, and cleanup evidence before claiming `repeat-guard`.
- Routing Signals:
  - `review_rework_count=9`
  - `evidence_integrity_failure=false`
- Next Step: Prepare the smallest fresh follow-up plan that preserves content/reasoning channel boundaries in downstream-repeat evidence, adds deterministic regression coverage, and reruns the isolated remote profile plus at most one newly authorized S07 invocation on a fresh artifact path; do not write `complete.log`.
