<!-- task=m-iop-hot-path-one-shot-execution/20+17,19_smoke_harness plan=12 tag=RECONCILE milestone-task=hot-smoke -->

# Code Review Reference - RECONCILE

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> Execute the plan's selected root cause, scope, files, and dependency decisions as written. Do not choose another owner, narrow/expand the write boundary, restore whole backup files, or replace a fix with another verification attempt.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-05
task=m-iop-hot-path-one-shot-execution/20+17,19_smoke_harness, plan=12, tag=RECONCILE

## Archive Evidence Snapshot

- Plan 11 is preserved at `agent-task/m-iop-hot-path-one-shot-execution/20+17,19_smoke_harness/plan_cloud_G03_11.log`; its review stub is preserved at `agent-task/m-iop-hot-path-one-shot-execution/20+17,19_smoke_harness/code_review_cloud_G03_11.log`.
- Plan 10 review at `agent-task/m-iop-hot-path-one-shot-execution/20+17,19_smoke_harness/code_review_cloud_G03_10.log` ended `FAIL` with two unnumbered Required findings, zero Suggested findings, and zero Nits. They are assigned stable ids R1 and R2 below. Routing signals remain `review_rework_count=9` and `evidence_integrity_failure=true`.
- Backup commit `f7af4f4857055a80efd73c563422f530775a102b` records the tracked worktree immediately before the reset. It contains the missing Hot Path outer-turn, observer, lifecycle, normalized-delta, cleanup-stage, and RunEvent-observer integration. It is comparison evidence only, not a whole-file checkout source.
- Commit `c8e98d4e10b30114de7bafe426a4045abd6c1205` deliberately removed legacy CLI adapter configuration and added `packages/go/config/legacy_provider_rejection_test.go`. The untracked `packages/go/config/edge_cli_config_test.go` is the superseded pre-provider-only test and is recoverable from the backup commit.
- Split prerequisites remain complete at `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/17+14,15,16_endpoint_error_matrix/complete.log` and `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/19+17,18_observation_lifecycle/complete.log`, but those completion logs do not prove the current checkout compiles after the reset.

## Finding Resolution Map

| ID | Mode | Expected resolution |
|---|---|---|
| R1 | `direct-fix` | Superseded CLI/workspace tests are removed; current reserved wire/run-id-only cancellation stays intact; selectively reconciled Hot Path/outer-turn owners make the common race command pass. |
| R2 | `direct-fix` | This file contains exact fresh same-checkout output and no stale plan 11 blocker transcript. |

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare each implementation item against current source/contracts, the selected current-compatible backup hunks, and existing tests. Review completion means:

1. Append one verdict and verified `review_rework_count` / `evidence_integrity_failure` signals.
2. Archive `CODE_REVIEW-cloud-G09.md` to `code_review_cloud_G09_12.log` and `PLAN-cloud-G09.md` to `plan_cloud_G09_12.log`.
3. If PASS, write `complete.log` and move the active task directory to `agent-task/archive/YYYY/MM/m-iop-hot-path-one-shot-execution/20+17,19_smoke_harness/`. If WARN/FAIL, fully materialize the next state required by the code-review skill.
4. If PASS, preserve first-line `milestone-task=hot-smoke` metadata for runtime aggregation; roadmap evaluation belongs to `sync-milestone-workstate`.
5. Check applicable review-only items at the final `.log` location before reporting.

## Implementation Item Completion

| Item | Status |
|---|---|
| RECONCILE-1 Provider-only compatibility boundary | [x] |
| RECONCILE-2 Hot Path outer-turn and observer integration | [x] |
| RECONCILE-3 Lifecycle ownership and test support | [x] |
| RECONCILE-4 Trusted integrated evidence | [x] |
| Fill implementation-owned sections | [x] |

## Implementation Checklist

- [x] [RECONCILE-1] Remove superseded CLI/workspace tests and reconcile stale Hot Path references with the current provider-only, removed-workspace, and run-id-only cancellation contracts.
- [x] [RECONCILE-2] Restore normalized-stage, observer, outer-turn, cleanup-correlation, and RunEvent-observer integration by adapting only relevant backup hunks to current source.
- [x] [RECONCILE-3] Wire exact-once lifecycle ownership and synchronize existing Hot Path test helpers/assertions without weakening behavior.
- [x] [RECONCILE-4] Run the complete harness and race-enabled common regression from one checkout and record exact fresh evidence.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified routing signals to `Code Review Result`.
- [x] Verify verdict, dimension assessment, and stable R/S classifications agree.
- [x] Confirm R1 and R2 each have source/evidence proof and `ownership_closed=true` remains valid.
- [x] Archive active review to `code_review_cloud_G09_12.log` and active plan to `plan_cloud_G09_12.log`.
- [x] Verify the Agent-Ops managed `.gitignore` block unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [x] If PASS, write `complete.log`, preserve `milestone-task=hot-smoke`, and move this task directory to its dated archive path with no active `.md` pair left.
- [ ] If WARN/FAIL, prepare the exact next filesystem state through plan/review ownership; do not write `complete.log` and do not create an unchanged-precondition verification loop.
- [x] Do not modify roadmap state directly; report completion metadata for `sync-milestone-workstate`.

## Deviations from Plan

None.

## Key Design Decisions

- Used `f7af4f4857055a80efd73c563422f530775a102b` only as comparison evidence and applied function/block-level adaptations. No whole file was restored from the backup.
- Preserved the current provider-only boundary: removed the obsolete CLI/workspace tests, kept workspace/session proto reservations and service code untouched, removed stale workspace routing references, and sent cancellation with only `NodeRef` and `RunID`.
- Restored request-local Chat and Anthropic codecs over the normalized outer-turn accumulator, including provider response identity, ordered normalized deltas, accumulated usage, output-cap propagation, caller-visible tool identity projection, and terminal-disposition arbitration without reparsing selected provider wire.
- Kept cleanup as an internal caller-stage-only frontier: the intermediate response exposes the exact cleanup tool while the accumulated review output remains available for the post-cleanup terminal response. This preserves current continuation lineage and exact tool-result correlation.
- Installed the Hot Path observer/hook independently from Stream Gate observation state, with concurrency-safe replacement and failure isolation. Lifecycle call sites emit closed exact-once dispatch, stage, transition, cleanup, terminal, rejection, and TTL orphan projections; the existing redacted TTL diagnostic remains compatibility-only and does not own lifecycle metrics.
- Observed every non-nil normalized-path `RunEvent` before translation so provider identity failures propagate before caller-visible output. Test helpers were synchronized for output caps, request cancellation, usage-complete fixtures, public/provider tool ID mapping, and stage-aware budget assertions without changing gate or observation expectations.

## Reviewer Checkpoints

- Confirm `packages/go/config/edge_cli_config_test.go` and `workspace_metadata_test.go` are removed, `legacy_provider_rejection_test.go` remains unchanged, and no CLI/workspace config types were restored.
- Confirm `f7af4f48` was used only as comparison evidence; no whole OpenAI/config/service/proto file was replaced from it.
- Confirm `proto/iop/runtime.proto`, generated proto, and `apps/edge/internal/service/**` remain unchanged, including reserved workspace/session/action fields and run-id-only cancellation.
- Confirm normalized delta slices are deep-cloned and remain excluded from wire JSON.
- Confirm the Hot Path observer and hook are concurrency-safe, separate from Stream Gate `obsSink`, default to production zap/noop safely, and cannot alter request behavior on error or panic.
- Confirm RunEvent observation happens on each non-nil real event before normalized translation and propagates identity-validation errors; stage cancellation sends only NodeRef/RunID through the current service API.
- Confirm each request installs exactly one endpoint codec/outer turn and that Chat/Anthropic framing consumes the normalized accumulator without reparsing provider wire.
- Confirm that same outer turn owns selector/stage output budget, active transport, release ordering, public tool/response identity, rejected-dispatch disposal, accumulated usage, and terminal arbitration.
- Confirm direct tool turns are non-terminal; final direct/light, cleanup, write-failure, cancellation, timeout, rejection, and TTL paths emit exactly once with closed labels.
- Confirm existing lifecycle tests were not weakened and no raw prompt, provider output, credential, or error text enters observation labels/log projections.
- Confirm all six Final Verification commands ran from one checkout and child 21 was not started.

## Verification Results

Paste actual stdout/stderr and exit status for every command. Do not summarize, reconstruct, or reuse prior output. Run from `/config/workspace/iop-s0`.

### Superseded config artifact removed

Command: `test ! -e packages/go/config/edge_cli_config_test.go && test ! -e apps/edge/internal/openai/workspace_metadata_test.go`

~~~text
stdout/stderr: (empty)
exit status: 0
~~~

### Harness syntax

Command: `bash -n scripts/e2e-hot-path-agents.sh`

~~~text
stdout/stderr: (empty)
exit status: 0
~~~

### Fixed manifest schema

Command: `jq -e '(.properties.cases.prefixItems | length) == 10 and .properties.cases.items == false and ([.properties.cases.prefixItems[].properties.id.const] | length == 10) and ([.properties.cases.prefixItems[].properties.id.const] | unique | length == 10)' scripts/fixtures/hot-path-agent-smoke-manifest.schema.json`

~~~text
true
exit status: 0
~~~

### Credential-free behavioral oracle

Command: `./scripts/e2e-hot-path-agents.sh --self-test`

~~~text
[e2e-hot-path-agents] assertion PASS: positive do_run exits 0
[e2e-hot-path-agents] assertion PASS: produced manifest validates against supplied fixture
[e2e-hot-path-agents] assertion PASS: ten unique case ids
[e2e-hot-path-agents] assertion PASS: raw argv/stdout capture deleted
[e2e-hot-path-agents] assertion PASS: direct cases terminal=success
[e2e-hot-path-agents] assertion PASS: write-unavailable terminal=provider_error
[e2e-hot-path-agents] assertion PASS: timeout-cancel terminal=cancelled
[e2e-hot-path-agents] assertion PASS: process exit status is captured from wait
[e2e-hot-path-agents] assertion PASS: light-pass/repair cleanup=removed
[e2e-hot-path-agents] assertion PASS: timeout-cancel cleanup=orphan
[e2e-hot-path-agents] assertion PASS: timeout-cancel child_only target
[e2e-hot-path-agents] assertion PASS: redaction matches == 0 on manifest
[e2e-hot-path-agents] assertion PASS: redaction detects leaked sentinel
[e2e-hot-path-agents] assertion PASS: all surviving harness artifacts are redacted
[e2e-hot-path-agents] assertion PASS: workspace digest changes on content-only edit
[e2e-hot-path-agents] assertion PASS: 9-case manifest rejected
[e2e-hot-path-agents] assertion PASS: forbidden-field manifest rejected
[e2e-hot-path-agents] assertion PASS: bad-enum manifest rejected
[e2e-hot-path-agents] assertion PASS: 11-case duplicate manifest rejected
[e2e-hot-path-agents] assertion PASS: distinct-row duplicate id rejected
[e2e-hot-path-agents] assertion PASS: id-agent mismatch rejected
[e2e-hot-path-agents] assertion PASS: id-scenario mismatch rejected
[e2e-hot-path-agents] assertion PASS: terminal-event contradiction rejected
[e2e-hot-path-agents] assertion PASS: cancellation relation mismatch rejected
[e2e-hot-path-agents] assertion PASS: alternate fixture changes acceptance rejected
[e2e-hot-path-agents] assertion PASS: malformed nine-row fixture rejected
[e2e-hot-path-agents] validation failed: claude_binary_sha256: identity mismatch
[e2e-hot-path-agents] assertion PASS: runtime identity mismatch rejected before invocation
[e2e-hot-path-agents] assertion PASS: source identity mismatch rejected before invocation
[e2e-hot-path-agents] assertion PASS: missing observation evidence rejected before manifest output
[e2e-hot-path-agents] assertion PASS: mismatched observation request correlation rejected before manifest output
[e2e-hot-path-agents] assertion PASS: immediate exit with no native output rejected before manifest output
[e2e-hot-path-agents] assertion PASS: missing native terminal rejected before manifest output
[e2e-hot-path-agents] assertion PASS: terminal and scenario contradiction rejected before manifest output
[e2e-hot-path-agents] assertion PASS: content-insensitive cleanup contradiction rejected before manifest output
[e2e-hot-path-agents] assertion PASS: timeout without triggered child cancellation rejected before manifest output
[e2e-hot-path-agents] assertion PASS: preflight ok
[e2e-hot-path-agents] self-test PASSED: exact argv, fixed 2x5 matrix, schema rejection,
[e2e-hot-path-agents]   identity mismatch exit 69 before invocation, secret absence,
[e2e-hot-path-agents]   child-only cancellation, cleanup/orphan classification, and full
[e2e-hot-path-agents]   cleanup verified with fake agents/runtime only.
exit status: 0
~~~

### Race-enabled common regression

Command: `go test -race -count=1 ./packages/go/streamgate ./packages/go/config ./apps/edge/internal/openai ./apps/edge/internal/service`

~~~text
ok  	iop/packages/go/streamgate	2.063s
ok  	iop/packages/go/config	1.735s
ok  	iop/apps/edge/internal/openai	12.328s
ok  	iop/apps/edge/internal/service	6.997s
exit status: 0
~~~

### Diff integrity

Command: `git diff --check`

~~~text
stdout/stderr: (empty)
exit status: 0
~~~

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled every implementation-owned section?**
> If anything is blank, go back and fill it before saving. Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---|---|---|
| Header, Overview, Finding Resolution Map, Review Agent instructions | Fixed at stub creation | Implementer must not alter route/finalization state |
| Archive Evidence Snapshot | Fixed at stub creation | Read only cited exact evidence when more context is needed |
| Implementation Item Completion | Implementing agent | Check status only after the matching item is complete |
| Implementation Checklist | Implementing agent | Check text in place; do not reorder or reinterpret |
| Review-Only Checklist | Review agent only | Implementer must not modify or execute |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholders with actual facts |
| Reviewer Checkpoints | Fixed at stub creation | Reviewer validates against source/tests |
| Verification Results | Implementing agent | Fill exact output/status; command changes require a deviation entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: PASS
- Dimension Assessment:
  - Correctness: Pass — the provider-only boundary, request-local outer-turn ownership, cancellation, lifecycle observation, and terminal arbitration agree with the current source and contracts.
  - Completeness: Pass — R1 and R2 are both closed with source proof and fresh same-checkout evidence; `ownership_closed=true` remains valid.
  - Test Coverage: Pass — the unchanged Hot Path gate, terminal-control, lifecycle, cleanup, and observer tests pass under the required race-enabled package command, and the harness self-test covers its fixed matrix and rejection cases.
  - API Contract: Pass — obsolete CLI/workspace behavior was not restored, reserved wire fields remain untouched, and cancellation uses the current `NodeRef` plus `RunID` service contract.
  - Code Quality: Pass — the reconciliation keeps observer state separate, deep-clones normalized deltas, and preserves explicit outer-turn ownership without debug or dead-code residue in the reviewed scope.
  - Implementation Deviation: Pass — no deviation from the selected reconciliation plan was found.
  - Verification Trust: Pass — all six recorded commands were rerun from `/config/workspace/iop-s0`; their exit statuses and outputs agree with the implementation-owned evidence.
  - Spec Conformance: Pass — this child supplies the deterministic S16 smoke-harness prerequisite and does not claim the downstream credentialed Claude/Pi execution.
- Findings: None.
- Routing Signals:
  - `review_rework_count=9`
  - `evidence_integrity_failure=false`
- Next Step: Archive the passing plan/review pair, write `complete.log`, move the split subtask to its dated archive path, and report the `hot-smoke` completion metadata without modifying roadmap state.
