<!-- task=m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery plan=2 tag=REVIEW_API milestone-task=secure-transport,credential-lease,adapter-injection,revocation -->

# Secure credential delivery follow-up plan

## For the Implementing Agent

Filling the implementation-owned sections of `CODE_REVIEW-*-G??.md` is mandatory. Run every verification command, record actual implementation notes and stdout/stderr with exit status, keep the active files in place, and report ready for review. If blocked, record only the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`; finalization belongs to the code-review skill.

## Background

The prior review found that SDD scenarios S10-S13 have no production implementation: credential operations are not mounted, the Client-Control Plane HTTP server and both internal transports remain plaintext, and provider authorization still crosses Edge-Node in the generic headers map. The required signed, Node-sealed lease, candidate binding, last-moment injection, and revocation fence are absent. This dependent subtask must remain unscheduled until predecessor `07+01,02,05_secret_material` produces `complete.log`.

## Archive Evidence Snapshot

- `plan_cloud_G10_1.log` and `code_review_cloud_G10_1.log`: current-pair predicted archives; verdict `FAIL` with 4 Required, 0 Suggested, and 0 Nit findings. Reviewer evidence shows plaintext transports, no credential-management listener, no lease packages/runtime field, generic-header provider auth forwarding, and no implementation verification output.
- `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/03+01,02_projection_auth/complete.log`: secret-free projection/cache and managed ingress auth passed.
- `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/04+03_principal_routes/complete.log`: principal-scoped route/discovery and no-fallback behavior passed.
- `agent-task/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log`: missing; implementation must not start until this exact predecessor evidence exists.

## Analysis

### Files Read

- `agent-task/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/PLAN-cloud-G10.md`
- `agent-task/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/CODE_REVIEW-cloud-G10.md`
- `agent-task/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/plan_cloud_G10_0.log`
- `agent-task/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/code_review_cloud_G10_0.log`
- `agent-roadmap/phase/operational-observability-provider-management/milestones/principal-provider-credential-slot-routing.md`
- `agent-roadmap/sdd/operational-observability-provider-management/principal-provider-credential-slot-routing/SDD.md`
- `agent-contract/inner/client-control-plane-wire.md`
- `agent-contract/inner/control-plane-edge-wire.md`
- `agent-contract/inner/edge-node-runtime-wire.md`
- `agent-contract/inner/edge-config-runtime-refresh.md`
- `agent-contract/outer/openai-compatible-api.md`
- `agent-contract/outer/anthropic-compatible-api.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-spec/runtime/provider-pool-config-refresh.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-spec/control/control-plane-operations.md`
- `apps/control-plane/cmd/control-plane/server.go`
- `apps/control-plane/internal/wire/edge_server.go`
- `apps/edge/internal/controlplane/connector.go`
- `apps/edge/internal/transport/server.go`
- `apps/edge/internal/openai/provider_tunnel.go`
- `apps/edge/internal/service/provider_tunnel.go`
- `apps/node/internal/transport/client.go`
- `apps/node/internal/node/tunnel_handler.go`
- `apps/node/internal/adapters/openai_compat/provider_tunnel.go`
- `packages/go/auth/auth.go`
- `packages/go/config/edge_types.go`
- `packages/go/config/validate.go`
- `proto/iop/control.proto`
- `proto/iop/runtime.proto`
- `configs/edge.yaml`

### SDD Criteria

- SDD: `agent-roadmap/sdd/operational-observability-provider-management/principal-provider-credential-slot-routing/SDD.md`; status `[승인됨]`, lock released.
- Milestone metadata: `secure-transport,credential-lease,adapter-injection,revocation`.
- Target scenarios: S10 authenticates and encrypts every credential-bearing hop; S11 binds and validates a tamper-evident lease; S12 permits only last-moment profile auth injection without secret observability; S13 fences new dispatch/retry after revoke or rotation while allowing only an already-started attempt to terminate.
- Evidence Map S09-S13 requires encrypted-store inspection, TLS peer matrices, lease scope/tamper tests, upstream sentinel/redaction evidence, and revocation race tests. Those requirements define the implementation checklist and final verification below.

### Verification Context

- No external handoff was supplied. Repository-native evidence came from the active pair, SDD, contracts, current source, local test rules, and fresh reviewer probes.
- Local preflight: Go `/config/.local/bin/go`, Go `1.26.2 linux/arm64`, GOROOT `/config/opt/go`; `protoc`, `protoc-gen-dart`, and Flutter are present.
- Fresh reviewer commands `go test -count=1 ./packages/go/credentiallease` and `go test -count=1 ./apps/control-plane/internal/credentiallease` exit 1 because both directories are absent. Every planned TLS/lease/injection test file is also absent.
- No external provider is required. Generate CA, peer, Ed25519 issuer, and X25519 recipient fixtures in `t.TempDir()` and use a local fake upstream. Full-cycle verification uses repository processes and temporary ports only.
- Fresh non-cached Go tests, race tests, deterministic double protobuf generation, Flutter tests/analyze, wire smoke, vet, diff checks, and structural secret scans are required. Confidence is high because the missing paths and current plaintext/header behavior are direct source evidence.

### Test Coverage Gaps

- API-1: no HTTPS credential handler or Client/CP-Edge/Edge-Node TLS peer matrix exists.
- API-2: no lease canonicalization, signature, X25519 sealing, expiry/replay, tamper, or issuer tests exist.
- API-3: no candidate-bound delivery, dedicated runtime lease field, header-collision, injection, cleanup, or sentinel-redaction test exists.
- API-4: no managed-mode composition or revoke/rotate/queue/retry ordering race test exists.
- Full-cycle: no three-process secure lease-to-upstream fixture or deterministic protobuf evidence exists.

### Symbol References

- No symbol is renamed or removed. Additive call sites are the Control Plane HTTP/wire composition, Edge connector/service/openai dispatch, Node transport/handler/adapter, config loaders, and protobuf generators listed in the modified-file summary.
- Existing generic provider-auth call chain to replace in managed mode: `Server.providerTunnelAuthHeaders` -> `SubmitProviderTunnelRequest.Headers` -> `buildProviderTunnelRequest` -> `Node.OnProviderTunnelRequest` -> `Adapter.TunnelProvider`.

### Split Judgment

- Keep one packet. TLS trust, lease signature/sealing, exact candidate scope, adapter injection, and revocation ordering form one production security invariant; independently activating any subset would expose or misroute a credential.
- Runtime predecessors encoded by `08+03,04,07_secure_delivery`: 03 and 04 are satisfied by the cited archive `complete.log` files; 07 is missing. The dispatcher must not schedule this packet until the exact active sibling `07+01,02,05_secret_material/complete.log` exists.

### Scope Rationale

- Keep Client protobuf hello-only; use a thin authenticated HTTPS lifecycle adapter. Remote bootstrap and remote unauthenticated administration remain prohibited.
- Exclude Flutter credential-management UI, provider failover/slot rotation policy, persistent leases, automatic rotation, A2A/native normalized credential injection, exhaustive migration/rollback, slot usage attribution, contract/spec synchronization, and live paid-provider qualification. Sibling tasks 09 and 10 own migration/attribution and final contract/qualification work.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer `finalize-task-policy.sh`, mode `pair`.
- Build closures are all true. Scores `2,2,2,2,2` produce `G10`; base and final route basis are `grade-boundary`, lane `cloud`, filename `PLAN-cloud-G10.md`.
- Review closures are all true. Scores `2,2,2,2,2` produce `G10`; route `official-review`, lane `cloud`, filename `CODE_REVIEW-cloud-G10.md`, Codex `gpt-5.6-sol` xhigh.
- `large_indivisible_context=true`; positive risks: `temporal_state`, `concurrent_consistency`, `boundary_contract`, `structured_interpretation`, `variant_product` (5).
- `review_rework_count=1`, `evidence_integrity_failure=true`; recovery boundary is matched but does not replace the existing grade-boundary basis. Capability gap: none.

## Implementation Checklist

- [ ] Enforce authenticated TLS 1.3 on every credential-bearing Client-Control Plane, Control Plane-Edge, and Edge-Node operation, with no plaintext fallback, and pass the complete peer matrix.
- [ ] Add a canonical issuer-signed, Node-sealed, bounded credential lease and pass scope, TTL, cache, replay, overflow, tamper, and redaction tests.
- [ ] Bind acquisition and delivery to the exact projection generation, candidate Node, principal/slot/route/profile/target and revisions; inject only at Node adapter admission and zero request-local plaintext on every terminal path.
- [ ] Activate managed mode only for a complete secure composition and pass deterministic revoke/rotate, queue, retry, in-flight, full-cycle, race, generated-contract, Flutter, vet, and secret-guard verification.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_API-1] Authenticated credential operations and TLS transport

**Problem:** `apps/control-plane/cmd/control-plane/server.go:75-81,154-165` does not mount credential operations and starts plain HTTP. `apps/control-plane/internal/wire/edge_server.go:61`, `apps/edge/internal/controlplane/connector.go:202`, `apps/edge/internal/transport/server.go:105`, and `apps/node/internal/transport/client.go:129-135` still use plaintext TCP.

**Solution:** Add tagged server/client TLS configuration and strict loaders. Mount a bounded principal-authenticated credential lifecycle adapter only on HTTPS; keep Client protobuf hello-only. Require TLS 1.3 and peer-role validation for CP-Edge and Edge-Node whenever credential mode is enabled, and make every reconnect path retain TLS without downgrade.

Before (`apps/control-plane/cmd/control-plane/server.go:154-165`):

```go
server := &http.Server{Addr: listenAddr, Handler: handler, ReadHeaderTimeout: 5 * time.Second}
if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
    errCh <- err
}
```

After:

```go
server := &http.Server{Addr: listenAddr, Handler: handler, TLSConfig: tlsConfig, ReadHeaderTimeout: 5 * time.Second}
if err := server.ListenAndServeTLS(certFile, keyFile); err != nil && err != http.ErrServerClosed {
    errCh <- err
}
```

**Modified Files and Checklist:**

- [ ] Add `packages/go/config/tls_types.go` and `packages/go/config/tls_types_test.go`; update `packages/go/auth/auth.go`, `packages/go/config/edge_types.go`, `packages/go/config/node_types.go`, `packages/go/config/load.go`, and `packages/go/config/validate.go`.
- [ ] Add `apps/control-plane/cmd/control-plane/credential_http_handlers.go` and its test; update Control Plane main/server composition.
- [ ] Update CP-Edge and Edge-Node server/client constructors and add all three credential TLS matrix tests.
- [ ] Update all three tracked YAML examples with secret-free certificate path placeholders.

**Test Strategy:** Generate a temporary CA plus distinct server, client, Edge, Node, and wrong-role identities. Test plaintext, no certificate, wrong CA, wrong name/role, valid peer, reconnect, content type, 64 KiB boundary, oversize/short read, principal isolation, stale revision, body zeroization, and response/log redaction.

**Verification:** `go test -count=1 ./packages/go/auth ./packages/go/config ./apps/control-plane/cmd/control-plane ./apps/control-plane/internal/wire ./apps/edge/internal/controlplane ./apps/edge/internal/transport ./apps/node/internal/transport` exits 0.

### [REVIEW_API-2] Signed and Node-sealed bounded lease

**Problem:** `proto/iop/control.proto` has only dormant projection messages; `proto/iop/runtime.proto:65-83` has no lease field. The shared lease package, issuer, recipient-key registration, bounded Edge cache, and Node replay set are absent.

**Solution:** Add canonical scope over principal, slot, route, profile, upstream target, selected Node, slot/route revisions, projection generation, issued/expiry timestamps, and lease ID. Seal the secret to the Node X25519 recipient key with HKDF/AES-GCM, sign scope plus envelope using a dedicated Ed25519 issuer, verify before decrypting, prune only expired entries, and fail closed rather than evicting a live replay fence.

Before (`proto/iop/runtime.proto:65-83`):

```proto
message ProviderTunnelRequest {
  map<string, string> headers = 7;
  bytes body = 8;
  string operation = 13;
}
```

After:

```proto
message ProviderTunnelRequest {
  map<string, string> headers = 7;
  bytes body = 8;
  string operation = 13;
  SignedCredentialLease credential_lease = 14;
}
```

**Modified Files and Checklist:**

- [ ] Add `packages/go/credentiallease/envelope.go` and exhaustive deterministic tests.
- [ ] Extend control/runtime proto sources and regenerate the exact Go and Dart outputs in the summary.
- [ ] Add the Control Plane lease issuer/service and tests, including revocation ordering.
- [ ] Wire recipient identity through authenticated registration, the Edge exact-key cache/provider, and startup validation.

**Test Strategy:** Use deterministic clocks and generated keys. Cover every scope dimension, wrong recipient/key ID, TTL 5..300, cache/replay bounds 1..4096, overflow, expiry pruning, duplicate lease ID, signature/ciphertext/scope tamper, revoked/rotated revision, unavailable Control Plane, no keyring-open on invalid input, no proto/log sentinel, and zeroization.

**Verification:** `go test -count=1 -race ./packages/go/credentiallease ./apps/control-plane/internal/credentiallease ./apps/edge/internal/controlplane ./apps/edge/internal/service ./apps/node/internal/node` exits 0.

### [REVIEW_API-3] Candidate-bound delivery and last-moment injection

**Problem:** `apps/edge/internal/openai/provider_tunnel.go:158-181` reads a caller provider token, `apps/edge/internal/service/provider_tunnel.go:384-405` copies it into generic protobuf headers, and `apps/node/internal/node/tunnel_handler.go:24-38` forwards those headers to `apps/node/internal/adapters/openai_compat/provider_tunnel.go:25` unchanged.

**Solution:** Resolve the route/profile/candidate first, request a recipient-bound lease, and attach only the signed sealed envelope to the dedicated field. At Node adapter admission, atomically consume and validate the lease, decrypt to request-local memory, reject an auth-header collision, inject the profile header immediately before the single upstream call, and zero all owned plaintext on success, error, cancellation, or validation failure. Managed mode explicitly rejects caller provider auth.

Before (`apps/edge/internal/service/provider_tunnel.go:384-405`):

```go
headers := make(map[string]string, len(req.Headers))
for k, v := range req.Headers { headers[k] = v }
return &iop.ProviderTunnelRequest{Headers: headers, Body: body, Operation: req.Operation}, runID, nil
```

After:

```go
return &iop.ProviderTunnelRequest{
    Headers: sanitizedHeaders,
    Body: body,
    Operation: req.Operation,
    CredentialLease: lease.ToProto(),
}, runID, nil
```

**Modified Files and Checklist:**

- [ ] Update all OpenAI/Anthropic dispatch-context handlers to carry trusted immutable binding and reject managed caller auth.
- [ ] Update Edge service/run types and add candidate/scope delivery tests.
- [ ] Update Node handler/runtime DTO/adapter and add validation, header collision, injection, cleanup, and no-generic-map tests.

**Test Strategy:** A fake upstream must receive exactly one expected bearer or x-api-key header. Invalid scope, stale generation/revision, decrypt failure, replay, or collision must produce zero upstream calls. A sentinel secret must be absent from protobuf `String`, logs, errors, status, metrics, response, generic maps, and Edge-owned DTOs.

**Verification:** `go test -count=1 ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/node/internal/node ./apps/node/internal/adapters/openai_compat` exits 0.

### [REVIEW_API-4] Secure activation, revocation fence, and integrated evidence

**Problem:** No credential-mode composition joins HTTPS, both mTLS hops, issuer/verifier/recipient keys, keyring, fresh projection, lease provider, and managed ingress. There is no immediate pre-send generation/revision fence or deterministic revoke/rotate queue/retry policy.

**Solution:** Enable managed mode only when the full secure composition validates before readiness. Preserve disabled legacy behavior, but never mix managed and legacy identity/provider-auth sources. Capture generation and revisions in the dispatch binding, evict stale leases on apply, validate immediately before direct/queued/recovery send, consume once at Node adapter admission, and allow only an already-started attempt to terminate after S13 rotation/revoke.

Before (`apps/control-plane/cmd/control-plane/server.go:78-81`):

```go
// the credential service ... is not attached to any listener yet and is reserved
// for later secure handler composition.
```

After:

```go
if cfg.CredentialPlane.Enabled {
    return composeManagedCredentialPlane(cfg, credentialService, edgeWire, nodeTransport)
}
return composeLegacyRuntime(cfg)
```

**Modified Files and Checklist:**

- [ ] Add fail-closed activation prerequisites in config loaders and Edge bootstrap/input composition.
- [ ] Fence direct, queued, and recovery delivery against the current projection generation and revisions.
- [ ] Add deterministic barrier/race cases and a three-process HTTPS+mTLS+lease+fake-upstream full cycle.
- [ ] Run deterministic proto generation, Flutter consumers, vet, diff, and secret guard; record intentional sealed/injection references and sentinel absence.

**Test Strategy:** Deterministic clocks and barriers under `-race` assert at most one upstream call, no stale retry/fallback, new-revision-only dispatch, complete disabled-mode compatibility, enabled-mode fail-closed startup, and secure three-process delivery without secret output.

**Verification:** Execute every command in Final Verification; every command exits 0 and the guarded runtime-proto search returns no match.

## Dependencies and Execution Order

1. `03+01,02_projection_auth` and `04+03_principal_routes` are complete by the cited archives.
2. Do not implement this task until `agent-task/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log` exists.
3. Implement REVIEW_API-1 and REVIEW_API-2, then REVIEW_API-3, then REVIEW_API-4. Do not activate a partial production path.
4. Sibling tasks 09 and 10 remain downstream of this task's `complete.log`.

## Modified Files Summary

| File | Items |
|------|-------|
| `packages/go/auth/auth.go` | REVIEW_API-1 |
| `packages/go/config/tls_types.go` | REVIEW_API-1 |
| `packages/go/config/tls_types_test.go` | REVIEW_API-1 |
| `packages/go/config/edge_types.go` | REVIEW_API-1, REVIEW_API-4 |
| `packages/go/config/node_types.go` | REVIEW_API-1, REVIEW_API-2 |
| `packages/go/config/load.go` | REVIEW_API-1, REVIEW_API-4 |
| `packages/go/config/validate.go` | REVIEW_API-1, REVIEW_API-4 |
| `packages/go/credentiallease/envelope.go` | REVIEW_API-2 |
| `packages/go/credentiallease/envelope_test.go` | REVIEW_API-2 |
| `packages/go/agentruntime/types.go` | REVIEW_API-3 |
| `proto/iop/control.proto` | REVIEW_API-2 |
| `proto/iop/runtime.proto` | REVIEW_API-2, REVIEW_API-3 |
| `proto/gen/iop/control.pb.go` | REVIEW_API-2 |
| `proto/gen/iop/runtime.pb.go` | REVIEW_API-2, REVIEW_API-3 |
| `apps/client/lib/gen/proto/iop/control.pb.dart` | REVIEW_API-2 |
| `apps/client/lib/gen/proto/iop/control.pbenum.dart` | REVIEW_API-2 |
| `apps/client/lib/gen/proto/iop/control.pbjson.dart` | REVIEW_API-2 |
| `apps/client/lib/gen/proto/iop/control.pbserver.dart` | REVIEW_API-2 |
| `apps/client/lib/gen/proto/iop/runtime.pb.dart` | REVIEW_API-2, REVIEW_API-3 |
| `apps/client/lib/gen/proto/iop/runtime.pbenum.dart` | REVIEW_API-2, REVIEW_API-3 |
| `apps/client/lib/gen/proto/iop/runtime.pbjson.dart` | REVIEW_API-2, REVIEW_API-3 |
| `apps/client/lib/gen/proto/iop/runtime.pbserver.dart` | REVIEW_API-2, REVIEW_API-3 |
| `apps/control-plane/cmd/control-plane/main.go` | REVIEW_API-1, REVIEW_API-2, REVIEW_API-4 |
| `apps/control-plane/cmd/control-plane/server.go` | REVIEW_API-1, REVIEW_API-2, REVIEW_API-4 |
| `apps/control-plane/cmd/control-plane/credential_http_handlers.go` | REVIEW_API-1 |
| `apps/control-plane/cmd/control-plane/credential_http_handlers_test.go` | REVIEW_API-1 |
| `apps/control-plane/cmd/control-plane/credential_commands_test.go` | REVIEW_API-1 |
| `apps/control-plane/internal/wire/edge_server.go` | REVIEW_API-1, REVIEW_API-2 |
| `apps/control-plane/internal/wire/credential_tls_test.go` | REVIEW_API-1 |
| `apps/control-plane/internal/credentiallease/service.go` | REVIEW_API-2 |
| `apps/control-plane/internal/credentiallease/service_test.go` | REVIEW_API-2 |
| `apps/control-plane/internal/credentiallease/revocation_test.go` | REVIEW_API-4 |
| `apps/edge/internal/controlplane/connector.go` | REVIEW_API-1, REVIEW_API-2 |
| `apps/edge/internal/transport/server.go` | REVIEW_API-1 |
| `apps/edge/internal/transport/credential_tls_test.go` | REVIEW_API-1 |
| `apps/edge/internal/bootstrap/runtime.go` | REVIEW_API-1, REVIEW_API-2, REVIEW_API-4 |
| `apps/edge/internal/input/manager.go` | REVIEW_API-2, REVIEW_API-4 |
| `apps/edge/internal/openai/dispatch_context.go` | REVIEW_API-3 |
| `apps/edge/internal/openai/chat_handler.go` | REVIEW_API-3 |
| `apps/edge/internal/openai/responses_handler.go` | REVIEW_API-3 |
| `apps/edge/internal/openai/anthropic_handler.go` | REVIEW_API-3 |
| `apps/edge/internal/openai/provider_tunnel.go` | REVIEW_API-3, REVIEW_API-4 |
| `apps/edge/internal/service/credential_lease.go` | REVIEW_API-2, REVIEW_API-4 |
| `apps/edge/internal/service/credential_lease_test.go` | REVIEW_API-2, REVIEW_API-4 |
| `apps/edge/internal/service/credential_delivery_test.go` | REVIEW_API-3, REVIEW_API-4 |
| `apps/edge/internal/service/provider_tunnel.go` | REVIEW_API-3, REVIEW_API-4 |
| `apps/edge/internal/service/run_types.go` | REVIEW_API-3, REVIEW_API-4 |
| `apps/node/internal/transport/client.go` | REVIEW_API-1, REVIEW_API-2 |
| `apps/node/internal/transport/credential_tls_test.go` | REVIEW_API-1 |
| `apps/node/internal/node/tunnel_handler.go` | REVIEW_API-2, REVIEW_API-3 |
| `apps/node/internal/node/credential_lease_test.go` | REVIEW_API-2, REVIEW_API-3, REVIEW_API-4 |
| `apps/node/internal/adapters/openai_compat/provider_tunnel.go` | REVIEW_API-3 |
| `apps/node/internal/adapters/openai_compat/credential_injection_test.go` | REVIEW_API-3 |
| `configs/control-plane.yaml` | REVIEW_API-1, REVIEW_API-2 |
| `configs/edge.yaml` | REVIEW_API-1, REVIEW_API-4 |
| `configs/node.yaml` | REVIEW_API-1, REVIEW_API-2 |
| `agent-task/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/CODE_REVIEW-cloud-G10.md` | all |

## Final Verification

Run from `/config/workspace/iop-s0`; Go tests must be fresh (`-count=1`). Do not run `iop-agent`.

```bash
command -v go && go version && go env GOROOT
command -v protoc && command -v protoc-gen-dart && command -v flutter
git status --short --branch
test -f agent-task/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log
make proto
make proto-dart
sha256sum proto/gen/iop/control.pb.go proto/gen/iop/runtime.pb.go apps/client/lib/gen/proto/iop/control.pb.dart apps/client/lib/gen/proto/iop/control.pbenum.dart apps/client/lib/gen/proto/iop/control.pbjson.dart apps/client/lib/gen/proto/iop/control.pbserver.dart apps/client/lib/gen/proto/iop/runtime.pb.dart apps/client/lib/gen/proto/iop/runtime.pbenum.dart apps/client/lib/gen/proto/iop/runtime.pbjson.dart apps/client/lib/gen/proto/iop/runtime.pbserver.dart > /tmp/iop-credential-proto-first.sha256
make proto
make proto-dart
sha256sum proto/gen/iop/control.pb.go proto/gen/iop/runtime.pb.go apps/client/lib/gen/proto/iop/control.pb.dart apps/client/lib/gen/proto/iop/control.pbenum.dart apps/client/lib/gen/proto/iop/control.pbjson.dart apps/client/lib/gen/proto/iop/control.pbserver.dart apps/client/lib/gen/proto/iop/runtime.pb.dart apps/client/lib/gen/proto/iop/runtime.pbenum.dart apps/client/lib/gen/proto/iop/runtime.pbjson.dart apps/client/lib/gen/proto/iop/runtime.pbserver.dart > /tmp/iop-credential-proto-second.sha256
diff -u /tmp/iop-credential-proto-first.sha256 /tmp/iop-credential-proto-second.sha256
make client-test
(cd apps/client && flutter analyze)
go test -count=1 ./packages/go/auth ./packages/go/config ./packages/go/credentiallease
go test -count=1 ./apps/control-plane/... ./apps/edge/... ./apps/node/...
go test -count=1 -race ./packages/go/credentiallease ./apps/control-plane/internal/credentiallease ./apps/edge/internal/authprojection ./apps/edge/internal/service ./apps/node/internal/node
make test-control-plane-edge-wire
go vet ./apps/control-plane/... ./apps/edge/... ./apps/node/... ./packages/go/...
git diff --check
if rg --sort path -n 'bytes[[:space:]]+(secret|provider_secret)|map<string, string>[[:space:]]+(credential|provider_auth)' proto/iop/runtime.proto; then exit 1; fi
```

Expected: predecessor 07 exists; generation hashes are identical; all tests, race, wire smoke, Flutter test/analyze, vet, and diff checks pass; the guarded proto scan returns no matches. In the review evidence, list the authenticated HTTPS input boundary, all intentional sealed-payload and adapter-injection references, and a deterministic sentinel-absence scan across proto strings, logs, status, errors, metrics, and responses.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
