<!-- task=m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery plan=2 tag=REVIEW_API milestone-task=secure-transport,credential-lease,adapter-injection,revocation -->

# Code Review Reference - REVIEW_API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-01
task=m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery, plan=2, tag=REVIEW_API

## Archive Evidence Snapshot

- `plan_cloud_G10_1.log` and `code_review_cloud_G10_1.log`: current-pair predicted archives; verdict `FAIL` with 4 Required, 0 Suggested, and 0 Nit findings. Reviewer evidence shows plaintext transports, no credential-management listener, no lease packages/runtime field, generic-header provider auth forwarding, and no implementation verification output.
- `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/03+01,02_projection_auth/complete.log`: secret-free projection/cache and managed ingress auth passed.
- `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/04+03_principal_routes/complete.log`: principal-scoped route/discovery and no-fallback behavior passed.
- `agent-task/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log`: missing; implementation must not start until this exact predecessor evidence exists.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G10.md` -> `code_review_cloud_G10_2.log` and `PLAN-cloud-G10.md` -> `plan_cloud_G10_2.log`.
3. If PASS, write `complete.log` and move the task directory under `agent-task/archive/YYYY/MM/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS, preserve first-line `milestone-task` metadata in `complete.log` and report it for runtime aggregation. Roadmap state evaluation belongs to `sync-milestone-workstate`.
5. Check applicable `Review-Only Checklist` items at the final log location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_API-1 Authenticated credential operations and TLS transport | [ ] |
| REVIEW_API-2 Signed and Node-sealed bounded lease | [ ] |
| REVIEW_API-3 Candidate-bound delivery and last-moment injection | [ ] |
| REVIEW_API-4 Secure activation, revocation fence, and integrated evidence | [ ] |

## Implementation Checklist

- [ ] Enforce authenticated TLS 1.3 on every credential-bearing Client-Control Plane, Control Plane-Edge, and Edge-Node operation, with no plaintext fallback, and pass the complete peer matrix.
- [ ] Add a canonical issuer-signed, Node-sealed, bounded credential lease and pass scope, TTL, cache, replay, overflow, tamper, and redaction tests.
- [ ] Bind acquisition and delivery to the exact projection generation, candidate Node, principal/slot/route/profile/target and revisions; inject only at Node adapter admission and zero request-local plaintext on every terminal path.
- [ ] Activate managed mode only for a complete secure composition and pass deterministic revoke/rotate, queue, retry, in-flight, full-cycle, race, generated-contract, Flutter, vet, and secret-guard verification.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G10_2.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G10_2.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory to `agent-task/archive/YYYY/MM/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/` and update this checklist at the final archive path.
- [ ] If PASS, preserve and report `milestone-task` metadata for runtime aggregation, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove the empty active parent or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching the verdict and do not write `complete.log`.

## Deviations from Plan

Implementation did not start. The mandatory predecessor evidence file
`agent-task/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log`
does not exist, so the plan's execution gate is not satisfied. No implementation
deviation was taken.

## Key Design Decisions

No implementation or design decision was made because the predecessor gate failed
before implementation began. Resume only after the exact predecessor evidence file
exists at the active sibling path required by the plan.

## Reviewer Checkpoints

- Confirm predecessor `07+01,02,05_secret_material/complete.log` existed before implementation began.
- Confirm the thin slot/route lifecycle adapter is HTTPS plus principal authentication, secret create/rotate uses a bounded zeroed octet-stream body, Client protobuf remains hello-only, and remote bootstrap remains impossible.
- Confirm credential-enabled CP-Edge and Edge-Node use mTLS 1.3 with peer-role/name verification and no reconnect or error path downgrades to plaintext.
- Confirm the lease is canonical, issuer-signed, sealed to the exact selected Node, bounded by every scope/revision/generation/expiry dimension, and absent from generic maps and protobuf debug output.
- Confirm issuer/recipient key formats and key IDs are deterministic, TTL remains 5..300 seconds, cache/replay bounds remain 1..4096, and overflow never evicts a live replay fence.
- Confirm route/profile/candidate selection precedes lease acquisition and Node repeats all scope/revision/generation checks before atomic consumption.
- Confirm adapter injection occurs immediately before the single upstream call, rejects collision, and zeroes every owned plaintext buffer on success, error, validation failure, and cancellation.
- Confirm managed mode starts only with the complete secure composition, disabled mode preserves legacy behavior, and managed mode rejects caller-supplied provider auth rather than mixing sources.
- Confirm S13 ordering: an already-started attempt may terminate, while revoke/rotate prevents every new lease, queued send, recovery, and retry using the old revision.
- Confirm generated Go/Dart bindings are deterministic and fresh peer, tamper, full-cycle, race, redaction, and structural secret guards all pass.

## Verification Results

Paste actual stdout/stderr and exit status below each command. Do not summarize or reconstruct output. Replacement commands require a `Deviations from Plan` entry.

### REVIEW_API-1

```bash
go test -count=1 ./packages/go/auth ./packages/go/config ./apps/control-plane/cmd/control-plane ./apps/control-plane/internal/wire ./apps/edge/internal/controlplane ./apps/edge/internal/transport ./apps/node/internal/transport
```

_Actual stdout/stderr and exit status:_

Not run. The predecessor gate failed before implementation began.

### REVIEW_API-2

```bash
go test -count=1 -race ./packages/go/credentiallease ./apps/control-plane/internal/credentiallease ./apps/edge/internal/controlplane ./apps/edge/internal/service ./apps/node/internal/node
```

_Actual stdout/stderr and exit status:_

Not run. The predecessor gate failed before implementation began.

### REVIEW_API-3

```bash
go test -count=1 ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/node/internal/node ./apps/node/internal/adapters/openai_compat
```

_Actual stdout/stderr and exit status:_

Not run. The predecessor gate failed before implementation began.

### REVIEW_API-4 and Final Verification

```bash
command -v go && go version && go env GOROOT
command -v protoc && command -v protoc-gen-dart && command -v flutter
git status --short --branch
test -f agent-task/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log
make proto
make proto-dart
sha256sum proto/gen/iop/control.pb.go proto/gen/iop/runtime.pb.go apps/client/lib/gen/proto/iop/control.pb.dart apps/client/lib/gen/proto/iop/control.pbenum.dart apps/client/lib/gen/proto/iop/control.pbjson.dart apps/client/lib/gen/proto/iop/control.pbserver.dart apps/client/lib/gen/proto/iop/runtime.pb.dart apps/client/lib/gen/proto/iop/runtime.pbenum.dart apps/client/lib/gen/proto/iop/runtime.pbjson.dart apps/client/lib/gen/proto/iop/runtime.pbserver.dart > /tmp/iop-credential-proto-first.sha256
make proto
make proto-dart
sha256sum proto/gen/iop/control.pb.go proto/gen/iop/runtime.pb.go apps/client/lib/gen/proto/iop/control.pb.dart apps/client/lib/gen/proto/iop/control.pbenum.dart apps/client/lib/gen/proto/iop/control.pbjson.dart apps/client/lib/gen/proto/iop/control.pbserver.dart apps/client/lib/gen/proto/iop/runtime.pb.dart apps/client/lib/gen/proto/iop/runtime.pbenum.dart apps/client/lib/gen/proto/iop/runtime.pbjson.dart apps/client/lib/gen/proto/iop/runtime.pbserver.dart > /tmp/iop-credential-proto-second.sha256
diff -u /tmp/iop-credential-proto-first.sha256 /tmp/iop-credential-proto-second.sha256
make client-test
(cd apps/client && flutter analyze)
go test -count=1 ./packages/go/auth ./packages/go/config ./packages/go/credentiallease
go test -count=1 ./apps/control-plane/... ./apps/edge/... ./apps/node/...
go test -count=1 -race ./packages/go/credentiallease ./apps/control-plane/internal/credentiallease ./apps/edge/internal/authprojection ./apps/edge/internal/service ./apps/node/internal/node
make test-control-plane-edge-wire
go vet ./apps/control-plane/... ./apps/edge/... ./apps/node/... ./packages/go/...
git diff --check
if rg --sort path -n 'bytes[[:space:]]+(secret|provider_secret)|map<string, string>[[:space:]]+(credential|provider_auth)' proto/iop/runtime.proto; then exit 1; fi
```

_Actual stdout/stderr, exit status, sanitized full-cycle observations, authenticated HTTPS boundary, intentional sealed/injection references, and sentinel-absence evidence:_

Predecessor gate probe:

```text
$ test -f agent-task/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log
(no stdout/stderr)
exit status: 1
```

Directory inspection:

```text
$ ls -la agent-task/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material
ls: cannot access 'agent-task/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material': No such file or directory
exit status: 2
```

All remaining final-verification commands were not run because the plan explicitly
prohibits implementation before this exact predecessor evidence exists. Resume when
`agent-task/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log`
exists, then implement REVIEW_API-1 through REVIEW_API-4 in order and run every listed
verification command.

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these finalization steps |
| Archive Evidence Snapshot | Fixed at stub creation from plan | Implementing agent uses it as default prior-loop context |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks status only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks status only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholders with actual content |
| Reviewer Checkpoints | Fixed | Pre-filled from plan |
| Verification Results | Implementing agent | Fill actual output only; command changes require a deviation entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail — the production credential path still uses plaintext listeners/transports and generic provider-auth headers, so SDD scenarios S10-S13 remain unsatisfied.
  - Completeness: Fail — none of REVIEW_API-1 through REVIEW_API-4 or their integrated verification is implemented.
  - Test coverage: Fail — the planned TLS, lease, delivery, injection, revocation, and full-cycle test packages are absent.
  - API contract: Fail — no authenticated credential operation, signed/sealed lease field, or managed secure-delivery runtime contract exists in production.
  - Code quality: Pass — no separate code-quality defect was identified in the already completed prerequisite code.
  - Implementation deviation: Fail — execution stopped on an obsolete active-path dependency probe even though the dispatcher had already satisfied dependency 07 from its archived PASS evidence.
  - Verification trust: Fail — every required implementation verification was skipped and fresh reviewer probes fail because the planned lease packages do not exist.
  - Spec conformance: Fail — SDD S10, S11, S12, and S13 and their Evidence Map requirements have no implementation evidence.
- Findings:
  - Required — `agent-task/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/PLAN-cloud-G10.md:254` and `agent-task/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/CODE_REVIEW-cloud-G10.md:76`: the active-only predecessor probe is stale. Dependency 07 completed with PASS at `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log`, and the dispatcher started this task after that completion. Prepare the follow-up from the archived completion evidence and do not block implementation on a `complete.log` that was correctly moved out of the active sibling directory.
  - Required — `apps/control-plane/cmd/control-plane/server.go:164`, `apps/control-plane/internal/wire/edge_server.go:61`, `apps/edge/internal/controlplane/connector.go:202`, `apps/edge/internal/transport/server.go:105`, and `apps/node/internal/transport/client.go:130`: credential management remains unmounted, the public server still uses plain HTTP, and both internal credential-bearing hops remain plaintext TCP. Implement REVIEW_API-1 with authenticated HTTPS, TLS 1.3 peer validation, fail-closed managed activation, and the complete peer matrix.
  - Required — `proto/iop/runtime.proto:65`, `apps/edge/internal/service/provider_tunnel.go:400`, `apps/node/internal/node/tunnel_handler.go:32`, and `apps/node/internal/adapters/openai_compat/provider_tunnel.go:25`: there is no signed, Node-sealed credential lease or dedicated runtime field; provider authorization still crosses the Edge-Node boundary in the generic headers map and is passed directly upstream. Implement REVIEW_API-2 through REVIEW_API-4, including exact candidate/scope/revision binding, atomic replay fencing, last-moment adapter injection, terminal-path zeroization, and revoke/rotate queue/retry ordering.
  - Required — `agent-task/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/CODE_REVIEW-cloud-G10.md:39`: all four implementation statuses and the behavioral checklist remain unchecked, while fresh `go test -count=1 ./packages/go/credentiallease` and `go test -count=1 ./apps/control-plane/internal/credentiallease` probes exit 1 because both directories are absent. Implement the planned production and test paths, then run and record every focused and final verification command, including deterministic protobuf generation, Flutter, race, wire smoke, vet, full-cycle, and secret-leak evidence.
- Routing Signals: `review_rework_count=2`, `evidence_integrity_failure=false`
- Next Step: Create and execute a freshly routed follow-up PLAN/CODE_REVIEW pair for all Required findings, using dependency 07's archived PASS evidence.
