<!-- task=m-iop-agent-cli-runtime/21+13,17,20_project_log_sink plan=3 tag=REVIEW_API -->

# Project-Wide Event Replay Identity

## For the Implementing Agent

Filling every implementation-owned section in `CODE_REVIEW-cloud-G10.md` is mandatory. Implement the checklist, run every verification command, paste actual notes and stdout/stderr into the review file, keep both active Markdown files in place, and report ready for review; only the code-review skill finalizes the task. If blocked, record only the exact blocker, attempted commands/output, and resume conditions in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The latest implementation retains stable event fingerprints, but the retained index is isolated inside each project/work journal. A caller can therefore reuse one manager `EventID` with changed logical content and a different work scope, causing replay lookup to miss the original entry and proceed as unseen. This follow-up makes manager event identity project-wide and atomically consistent with task-scoped journals.

## Archive Evidence Snapshot

- Current pair to archive during review finalization:
  - `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/plan_cloud_G10_2.log`
  - `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/code_review_cloud_G10_2.log`
- Prior verdict: `FAIL`.
- Required finding: `apps/agent/internal/projectlog/store.go:389` selects the caller-supplied work journal before checking `SeenRecords`, so changed logical content under one manager `EventID` is not rejected when `WorkUnitID` changes or the event crosses the project-only/work boundary.
- Suggested findings: none.
- Nit findings: none.
- Fresh reviewer evidence: a focused production-store reproducer appended the event under work A and checked the same record identity plus a changed logical fingerprint under work B; it returned `false, <nil>` instead of `ErrRecordReplayConflict`.
- Prior verification evidence: the declared focused, full, race, vet, formatting, contract, and diff commands passed, but `TestStoreRejectsLogicalEventIDReuse` reused the original scope and did not cover scope drift.
- Roadmap carryover remains `project-logs`; no completion may be reported until project-wide replay identity passes.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone document](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `project-logs`: project-local event/log plus WORK_LOG loop/attempt/locator and exactly-once archive lifecycle
- Completion mode: check-on-pass

## Analysis

### Files Read

- `agent-ops/rules/project/rules.md`
- `agent-ops/rules/common/rules-roadmap.md`
- `agent-ops/rules/common/rules-agent-spec.md`
- `agent-ops/rules/project/domain/agent/rules.md`
- `agent-ops/rules/project/domain/platform-common/rules.md`
- `agent-ops/rules/project/domain/testing/rules.md`
- `agent-ops/skills/common/router.md`
- `agent-ops/skills/common/code-review/SKILL.md`
- `agent-ops/skills/common/plan/SKILL.md`
- `agent-ops/skills/common/finalize-task-routing/SKILL.md`
- `agent-ops/skills/common/plan/templates/review-stub-template.md`
- `agent-test/local/rules.md`
- `agent-test/local/platform-common-smoke.md`
- `agent-roadmap/current.md`
- `agent-roadmap/phase/automation-runtime-bridge/PHASE.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- `agent-spec/index.md`
- `agent-contract/index.md`
- `agent-contract/inner/agent-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `packages/go/agentstate/store.go`
- `packages/go/agentstate/store_test.go`
- `apps/agent/internal/projectlog/sink.go`
- `apps/agent/internal/projectlog/sink_test.go`
- `apps/agent/internal/projectlog/store.go`
- `apps/agent/internal/projectlog/store_test.go`
- `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/PLAN-cloud-G10.md`
- `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/CODE_REVIEW-cloud-G10.md`
- `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/plan_local_G08_0.log`
- `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/code_review_cloud_G08_0.log`
- `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/plan_cloud_G10_1.log`
- `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/code_review_cloud_G10_1.log`
- `agent-task/archive/2026/07/m-iop-agent-cli-runtime/13_agent_domain/complete.log`
- `agent-task/archive/2026/07/m-iop-agent-cli-runtime/17+13_project_log_records/complete.log`
- `agent-task/archive/2026/07/m-iop-agent-cli-runtime/20+13,17_project_log_journal/complete.log`

### SDD Criteria

- SDD: `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- Status: approved; implementation lock: released.
- Targeted Acceptance Scenario: `S12`.
- Milestone Task id: `project-logs`.
- Evidence Map requirement: exact WORK_LOG loop/attempt/locator evidence, dynamic parallel work, replay-safe task-scoped terminal archive reconciliation, and stable identities under restart/crash variants.
- These rows require one manager event identity to remain unique while work scopes run and archive independently. The implementation checklist therefore couples the project-wide replay index, atomic journal/index commit, cross-scope conflict tests, restart/prune evidence, and the existing S12 race oracle.

### Verification Context

- No separate verification handoff was supplied.
- Sources read: the local test rules/profile, approved SDD, both inner contracts, `agentstate` persistence implementation/tests, the projectlog sink/store implementations/tests, the active pair, the two prior review loops, and the three exact split-predecessor completion logs.
- Environment: local checkout at `/config/workspace/iop-s0`.
- Tool preflight: `/config/.local/bin/go`, `go1.26.2 linux/arm64`, `GOROOT=/config/opt/go`.
- Applied commands and criteria: a fresh focused reviewer reproducer for cross-scope EventID reuse; focused atomic-CAS and projectlog replay tests; full `agentstate`/`projectlog` and `packages/go/...` suites; race coverage; vet; formatting; deterministic contract search; and `git diff --check`.
- Preconditions: preserve unrelated dirty-worktree changes; run from the workspace root; use `-count=1` because cached Go output is not acceptable for completion evidence.
- Constraints: local verification only; no external runner, daemon, provider, network, secret, or long-running runtime is required.
- External Verification Preflight: not applicable.
- Gap: no mixed-version process is run against one state file. Compatibility is covered by constructing retained scoped journal entries without the new global index and requiring deterministic migration/fail-closed behavior.
- Confidence: high; the defect, persistence boundary, concurrent writer set, and pass/fail oracles are deterministic in this checkout.
- Test-rule maintenance: not needed; the platform-common profile already covers `packages/go/**`, while projectlog uses repository-native Go tests.

### Test Coverage Gaps

- `packages/go/agentstate/store_test.go` does not cover an atomic compare-and-swap across multiple integration-record keys, all-or-nothing stale revision rejection, duplicate update keys, or sibling preservation.
- `TestStoreRejectsLogicalEventIDReuse` changes detail and attempt identity but calls `CheckEventReplay` with the original `WorkUnitID`; it does not cover work A → work B, project-only → work, or work → project-only scope drift.
- Existing replay tests prove same-scope fingerprint retention after prune/restart and volatile timestamp/state-revision changes, but not a project-wide index shared by independently sequenced work journals.
- Existing sink replay tests prove evidence short-circuit for unchanged same-scope content, but not fail-closed cross-scope reuse before evidence resolution.
- Existing S12 coverage runs parallel work and independent archives, but does not force both work scopes to contend on one shared manager-event identity index.

### Symbol References

- No symbol is renamed or removed.
- `agentstate.Store.LoadIntegrationRecord` callers are `apps/agent/internal/projectlog/store.go` and projectlog tests.
- `agentstate.Store.CompareAndSwapIntegrationRecord` callers are `apps/agent/internal/projectlog/store.go` and projectlog tests. The existing method must remain source-compatible and delegate to the new atomic batch primitive.
- `projectlog.Store.AppendEventRecord` production caller is `apps/agent/internal/projectlog/sink.go:259`; direct callers are in `apps/agent/internal/projectlog/store_test.go`.
- `projectlog.Store.CheckEventReplay` production caller is `apps/agent/internal/projectlog/sink.go:233`; direct callers are in `apps/agent/internal/projectlog/store_test.go`.
- The public `agenttask.EventSink.Emit` signature and the `projectlog.Sink.Emit` call graph remain unchanged.

### Split Judgment

The invariant is indivisible: every new event append must atomically claim its project-wide manager identity and update exactly one project/work journal, while replay and legacy recovery must consult the same retained index before trusting a supplied scope. Splitting out an unused multi-record CAS API would not produce a useful independently complete state and would leave the cross-key race open.

Split predecessors are satisfied:

- `13_agent_domain`: `agent-task/archive/2026/07/m-iop-agent-cli-runtime/13_agent_domain/complete.log`
- `17+13_project_log_records`: `agent-task/archive/2026/07/m-iop-agent-cli-runtime/17+13_project_log_records/complete.log`
- `20+13,17_project_log_journal`: `agent-task/archive/2026/07/m-iop-agent-cli-runtime/20+13,17_project_log_journal/complete.log`

### Scope Rationale

Do not change manager event generation/delivery, event fingerprint fields, evidence projection, task sequence ownership, archive artifact formats, provider adapters, policy, scheduler behavior, UI, roadmap files, or unrelated active tasks. Keep the shared identity index inside the existing device-local `agentstate` persistence boundary and preserve generic `AppendRecord` semantics. Do not add a database or a process-global in-memory lock as the source of truth.

### Final Routing

- evaluation_mode: `isolated-reassessment`
- finalizer: `finalize-task-policy.sh pair`
- build closures: scope/context/verification/evidence/ownership/decision all `true`
- build scores: scope `2`, state `2`, blast `2`, evidence `2`, verification `2`; grade `G10`
- build base/final route: `grade-boundary` / `grade-boundary`, lane `cloud`, filename `PLAN-cloud-G10.md`
- review closures: scope/context/verification/evidence/ownership/decision all `true`
- review scores: scope `2`, state `2`, blast `2`, evidence `2`, verification `2`; grade `G10`
- review route: `official-review`, lane `cloud`, adapter `codex`, model `gpt-5.6-sol`, reasoning `xhigh`, filename `CODE_REVIEW-cloud-G10.md`
- large_indivisible_context: `false`
- positive loop risks: `temporal_state`, `concurrent_consistency`, `boundary_contract` (count `3`)
- recovery signals: `review_rework_count=3`, `evidence_integrity_failure=true`
- risk boundary matched: `false`; recovery boundary matched: `true`; grade-boundary remains the route basis
- capability-gap evidence: none

## Implementation Checklist

- [ ] Add checksum-covered integration-record snapshot and atomic multi-record CAS primitives without breaking the single-record API.
- [ ] Enforce one retained project-wide event identity index and atomically couple it to project/work journal appends, including legacy scoped-index recovery.
- [ ] Add agentstate, store, and production sink regressions for stale batch CAS, scope drift, concurrency, migration, prune/restart replay, and align both runtime contracts.
- [ ] Run the focused, full, race, platform-common, vet, formatting, contract, and diff verification commands exactly as written.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Dependencies and Execution Order

1. The predecessor completion logs listed in `Analysis > Split Judgment` already satisfy subtask indices `13`, `17`, and `20`.
2. Implement the atomic `agentstate` primitive before wiring projectlog, then add projectlog migration/concurrency tests and contract wording.

### [REVIEW_API-1] Add Atomic Integration-Record Snapshot and Batch CAS

#### Problem

`packages/go/agentstate/store.go:64-98` can load only one known integration key. `packages/go/agentstate/store.go:100-147` atomically updates only one key, so projectlog cannot discover retained legacy event entries or commit a project-wide identity claim together with a task-scoped journal. Two writers targeting different work journals can otherwise both observe an unseen EventID.

#### Solution

Add immutable, cloned integration-record snapshot values with payload and key-local revision, plus a prefix-filtered snapshot load for migration. Add a public batch update value containing key, expected key-local revision, and bounded JSON payload. Validate the complete batch before locking, reject duplicate/invalid keys, acquire one exclusive store lock, verify every expected revision before mutating any record, update all records in memory, and call `writeUnlocked` once. Return each committed content revision. Keep `CompareAndSwapIntegrationRecord` source-compatible by delegating a one-element request to the batch primitive.

Before (`packages/go/agentstate/store.go:100-107`):

```go
func (s *Store) CompareAndSwapIntegrationRecord(
	ctx context.Context,
	key string,
	expected string,
	payload []byte,
) (string, error) {
```

After:

```go
type IntegrationRecordSnapshot struct {
	Payload  []byte
	Revision string
}

type IntegrationRecordUpdate struct {
	Key      string
	Expected string
	Payload  []byte
}

func (s *Store) LoadIntegrationRecords(
	ctx context.Context,
	prefix string,
) (map[string]IntegrationRecordSnapshot, error)

func (s *Store) CompareAndSwapIntegrationRecords(
	ctx context.Context,
	updates []IntegrationRecordUpdate,
) (map[string]string, error)
```

#### Modified Files and Checklist

- [ ] `packages/go/agentstate/store.go`: add cloned prefix snapshots, validated atomic batch CAS, and single-record delegation.
- [ ] `packages/go/agentstate/store_test.go`: cover snapshot isolation, successful two-key commit, stale all-or-nothing rejection, duplicate/invalid input, sibling preservation, reopen persistence, and competing writers.

#### Test Strategy

Write `TestStoreIntegrationRecordSnapshot` to assert prefix filtering and caller mutation isolation. Write table/boundary cases under `TestStoreIntegrationRecordBatchCAS` for success, one stale expected revision with zero partial writes, duplicate keys, invalid JSON, empty batch, preserved unrelated records, and disk reopen. Add a competing-writer subtest proving only one batch wins when both share one expected index revision.

#### Verification

Run:

```bash
go test -count=1 ./packages/go/agentstate -run 'TestStoreIntegrationRecordSnapshot|TestStoreIntegrationRecordBatchCAS'
```

Expected: fresh focused tests pass, including all-or-nothing stale-CAS and concurrency assertions.

### [REVIEW_API-2] Make Event Identity Project-Wide and Atomic

#### Problem

`apps/agent/internal/projectlog/store.go:357-371` routes an event directly to its project/work journal. `apps/agent/internal/projectlog/store.go:389-405` then selects that caller-supplied scope before looking up the retained fingerprint. The same record identity can therefore exist or be queried in different scope-local `SeenRecords` maps without a project-wide conflict decision.

#### Solution

Persist a schema-versioned replay index under a deterministic, domain-separated project/workspace integration key. Each entry owns `RecordID`, exact `WorkUnitID` (empty for project-only), assigned task-local sequence, and stable `EventFingerprint`. Validate the index identity and every entry on load.

`CheckEventReplay` must consult the project-wide index before selecting or loading a journal. A matching record identity with a different event fingerprint or scope returns `ErrRecordReplayConflict`; an exact entry returns replay immediately. When the global index is absent or lacks an entry, scan checksum-covered `projectlog:` integration snapshots for legacy journal `SeenRecords` belonging to the same project/workspace, reject conflicting duplicates, and persist the recovered entry with CAS before returning.

`AppendEventRecord` must use a bounded retry that loads/migrates the project-wide index and the target journal, applies the existing record/journal validation, and commits both payloads in one `CompareAndSwapIntegrationRecords` call. Every event writer, including project-only events, must share the index revision. Generic `AppendRecord` remains scope-local and source-compatible. Archive/prune must leave the separate replay index intact so exact logical replay still returns the original task-local sequence after restart.

Before (`apps/agent/internal/projectlog/store.go:357-415`):

```go
if record.WorkUnitID == "" {
	return s.appendRecord(ctx, record, eventFingerprint)
}
scoped, err := s.ForWorkUnit(record.WorkUnitID)
// ...
scope := s
if workUnitID != "" {
	scope, err = s.ForWorkUnit(workUnitID)
}
j, _, found, err := scope.loadJournal(ctx)
```

After:

```go
index, indexRevision, err := s.loadOrRecoverEventReplayIndex(ctx)
// Check recordID against index before trusting workUnitID.
// For an unseen event, mutate index and the selected journal in memory.
_, err = s.state.CompareAndSwapIntegrationRecords(ctx, []agentstate.IntegrationRecordUpdate{
	indexUpdate,
	journalUpdate,
})
```

#### Modified Files and Checklist

- [ ] `apps/agent/internal/projectlog/store.go`: add index schema/key/validation, legacy snapshot recovery, scope-independent replay checks, and atomic index+journal event append.
- [ ] `apps/agent/internal/projectlog/store_test.go`: cover all scope transitions, retained sequence/restart/prune, legacy recovery, malformed/conflicting index state, and concurrent cross-scope claims.

#### Test Strategy

Expand `TestStoreRejectsLogicalEventIDReuseAcrossScopes` as a table for work A → work B, project-only → work, and work → project-only. Each case must append the original event, change logical content under the same EventID, call both `CheckEventReplay` and `AppendEventRecord` through the changed scope, and require `ErrRecordReplayConflict` with no second journal record.

Write `TestStoreEventReplayIndexSerializesCrossScopeCAS` with two stores over one state file and coordinated concurrent writes using one record identity but different fingerprints/scopes; exactly one append succeeds and the loser reports replay conflict without partial state. Write `TestStoreEventReplayIndexRecoversLegacyScopedEntry` by persisting a valid current-schema scoped journal with an event fingerprint but no global index, reopening, checking first through a different scope, and requiring fail-closed migration that survives another reopen. Retain and strengthen `TestStoreEventReplayFingerprintSurvivesPruneAndRestart` to assert the global entry returns the original sequence and no archive ordinal is duplicated.

#### Verification

Run:

```bash
go test -count=1 ./apps/agent/internal/projectlog -run 'TestStoreRejectsLogicalEventIDReuseAcrossScopes|TestStoreEventReplayIndex|TestStoreEventReplayFingerprintSurvivesPruneAndRestart'
go test -count=1 -race ./packages/go/agentstate ./apps/agent/internal/projectlog -run 'TestStoreIntegrationRecordBatchCAS|TestStoreEventReplayIndexSerializesCrossScopeCAS'
```

Expected: scope drift fails closed, legacy/restart/prune replay converges, and the race-enabled shared-index writer test passes.

### [REVIEW_API-3] Prove the Production Sink Boundary and Align Contracts

#### Problem

`apps/agent/internal/projectlog/store_test.go:1773-1778` checks changed logical content using the original work scope. `apps/agent/internal/projectlog/sink_test.go:556-608` proves only unchanged same-scope replay short-circuits evidence. The contracts at `agent-contract/inner/agent-runtime.md:65` and `agent-contract/inner/iop-agent-cli-runtime.md:72` promise fail-closed EventID reuse but do not state that the retained identity owner is project-wide and committed atomically with the scoped journal.

#### Solution

Add a sink-level regression whose resolver succeeds for the original event and must not be invoked for a second event with the same EventID but changed logical content/work scope. Require `Sink.Emit` to return `ErrRecordReplayConflict`, proving the global check executes before evidence resolution. Preserve the existing timestamp/state-revision replay test to prove unchanged logical content still short-circuits.

Update both inner contracts to name the project-wide replay index, its retained work/project scope, the atomic index+journal commit, legacy index recovery, and the three scope-drift conflict directions. Point S12 evidence at the focused store/sink regression names and the race command.

Before (`apps/agent/internal/projectlog/store_test.go:1773-1778`):

```go
replayed, err := store.CheckEventReplay(
	ctx,
	event.WorkUnitID,
	recordID,
	conflictingFingerprint,
)
```

After:

```go
for _, scopeDrift := range []struct {
	name string
	from agenttask.WorkUnitID
	to   agenttask.WorkUnitID
}{/* work→work, project→work, work→project */} {
	// Reuse one record identity with changed logical content.
	// Check and append must both return ErrRecordReplayConflict.
}
```

#### Modified Files and Checklist

- [ ] `apps/agent/internal/projectlog/sink_test.go`: prove changed cross-scope reuse fails before the evidence resolver and unchanged volatile replay still short-circuits.
- [ ] `agent-contract/inner/agent-runtime.md`: specify project-wide ownership, atomic persistence, recovery, and focused evidence.
- [ ] `agent-contract/inner/iop-agent-cli-runtime.md`: align S12 evidence and task-scoped journal wording with the project-wide identity index.

#### Test Strategy

Write `TestSinkRejectsLogicalEventIDReuseAcrossScopesBeforeEvidenceResolution` using a counting resolver: the original work-A emit consumes one evidence call; the changed work-B replay under the same EventID returns `ErrRecordReplayConflict` while the call count remains one. Reuse `TestSinkReplayShortCircuitsEvidenceAfterClockAndStateAdvance` for the unchanged volatile case. Contract changes need deterministic search verification, not a separate parser test.

#### Verification

Run:

```bash
go test -count=1 ./apps/agent/internal/projectlog -run 'TestSinkRejectsLogicalEventIDReuseAcrossScopesBeforeEvidenceResolution|TestSinkReplayShortCircuitsEvidenceAfterClockAndStateAdvance'
rg --sort path -n 'project-wide replay index|atomic.*journal|scope drift|TestSinkRejectsLogicalEventIDReuseAcrossScopesBeforeEvidenceResolution|TestStoreEventReplayIndexSerializesCrossScopeCAS' agent-contract/inner/agent-runtime.md agent-contract/inner/iop-agent-cli-runtime.md
```

Expected: the production sink rejects cross-scope reuse without resolving evidence, unchanged volatile replay still converges, and both contracts expose the new invariant and evidence names.

## Modified Files Summary

| File | Item |
|------|------|
| `packages/go/agentstate/store.go` | REVIEW_API-1 |
| `packages/go/agentstate/store_test.go` | REVIEW_API-1 |
| `apps/agent/internal/projectlog/store.go` | REVIEW_API-2 |
| `apps/agent/internal/projectlog/store_test.go` | REVIEW_API-2 |
| `apps/agent/internal/projectlog/sink_test.go` | REVIEW_API-3 |
| `agent-contract/inner/agent-runtime.md` | REVIEW_API-3 |
| `agent-contract/inner/iop-agent-cli-runtime.md` | REVIEW_API-3 |
| `agent-task/m-iop-agent-cli-runtime/21+13,17,20_project_log_sink/CODE_REVIEW-cloud-G10.md` | REVIEW_API-1, REVIEW_API-2, REVIEW_API-3, verification evidence |

## Final Verification

Run from `/config/workspace/iop-s0`. Fresh execution is required; cached Go results are not acceptable.

```bash
command -v go
go version
go env GOROOT
test -z "$(gofmt -d packages/go/agentstate/store.go packages/go/agentstate/store_test.go apps/agent/internal/projectlog/store.go apps/agent/internal/projectlog/store_test.go apps/agent/internal/projectlog/sink_test.go)"
go test -count=1 ./packages/go/agentstate -run 'TestStoreIntegrationRecordSnapshot|TestStoreIntegrationRecordBatchCAS'
go test -count=1 ./apps/agent/internal/projectlog -run 'TestStoreRejectsLogicalEventIDReuseAcrossScopes|TestStoreEventReplayIndex|TestStoreEventReplayFingerprintSurvivesPruneAndRestart|TestSinkRejectsLogicalEventIDReuseAcrossScopesBeforeEvidenceResolution|TestSinkReplayShortCircuitsEvidenceAfterClockAndStateAdvance'
go test -count=1 -race ./packages/go/agentstate ./apps/agent/internal/projectlog -run 'TestStoreIntegrationRecordBatchCAS|TestStoreEventReplayIndexSerializesCrossScopeCAS|TestS12LoopParallelArchiveMatrix'
go test -count=1 ./packages/go/agentstate ./apps/agent/internal/projectlog
go test -count=1 ./packages/go/...
go test -count=1 -race ./packages/go/agentstate ./apps/agent/internal/projectlog
go vet ./packages/go/... ./apps/agent/internal/projectlog
rg --sort path -n 'project-wide replay index|atomic.*journal|scope drift|TestSinkRejectsLogicalEventIDReuseAcrossScopesBeforeEvidenceResolution|TestStoreEventReplayIndexSerializesCrossScopeCAS' agent-contract/inner/agent-runtime.md agent-contract/inner/iop-agent-cli-runtime.md
git diff --check
```

Expected:

- the Go tool preflight resolves the declared local toolchain;
- formatting produces no diff;
- focused agentstate/projectlog and production-sink regressions pass freshly;
- concurrent cross-scope identity claims and the S12 archive matrix pass under the race detector;
- full projectlog/agentstate, platform-common Go, race, and vet commands pass;
- both contracts contain the project-wide atomic replay invariant and exact evidence names;
- `git diff --check` reports no whitespace errors.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
