<!-- task=m-iop-agent-cli-runtime/11+06_workspace_overlay plan=3 tag=REVIEW_API -->

# Code Review Reference - REVIEW_API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-07-29
task=m-iop-agent-cli-runtime/11+06_workspace_overlay, plan=3, tag=REVIEW_API

## Roadmap Targets

- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone document](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
  - `overlay-workspace`: pinned base and task writable layer
- Completion mode: check-on-pass

## Archive Evidence Snapshot

- Prior task: `agent-task/m-iop-agent-cli-runtime/11+06_workspace_overlay`
- Prior plan: `agent-task/m-iop-agent-cli-runtime/11+06_workspace_overlay/plan_cloud_G10_2.log`
- Prior review: `agent-task/m-iop-agent-cli-runtime/11+06_workspace_overlay/code_review_cloud_G10_2.log`
- Verdict: `FAIL`
- Required finding:
  - `packages/go/agenttask/ports.go:209` permits arbitrary `Stdin`, `Stdout`, and `Stderr`, and `packages/go/agentworkspace/confinement.go:163-165` attaches them after the caller can open protected paths. A reviewer reproducer passed a canonical file opened with `O_WRONLY|O_APPEND` as stdout through the real proof and changed the canonical file under the read-only mount namespace.
- Suggested findings: None.
- Nit findings: None.
- Affected files: confinement launch ports and implementation, Manager/provider binding and cleanup fixtures, real-proof and Manager regressions, and both runtime contracts.
- Fresh verification: focused workspace and Manager tests, target suites, repetition, race, package-wide Go tests, Darwin cross-compile, vet, formatting, symbol search, and diff checks passed. The descriptor reproducer also passed, demonstrating the bypass.
- Roadmap carryover: S18 / `overlay-workspace` remains incomplete until the complete Manager-owned launch boundary prevents inherited protected writable descriptors.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G10.md` → `code_review_cloud_G10_3.log` and `PLAN-cloud-G10.md` → `plan_cloud_G10_3.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-iop-agent-cli-runtime/11+06_workspace_overlay/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, report completion event metadata. Roadmap state check and `update-roadmap` calls are runtime responsibilities.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_API-1 Make child I/O a confinement-owned capability | [x] |

## Implementation Checklist

- [x] Remove arbitrary caller-supplied stdio from `ConfinementCommand` and make `InvocationConfinement.Start` create and return the child's safe I/O handles.
- [x] Bind the confinement-created started handle in the Manager and close/terminate/reap all handle resources on every partial failure.
- [x] Synchronize both runtime contracts and add real-proof and Manager regressions for descriptor exclusion, handle identity, and cleanup.
- [x] Run fresh focused, target, repetition, race, package-wide, cross-platform compile, vet, formatting, search, and diff verification.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G10_3.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G10_3.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [x] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [x] If PASS, move active task directory `agent-task/m-iop-agent-cli-runtime/11+06_workspace_overlay/` to `agent-task/archive/YYYY/MM/m-iop-agent-cli-runtime/11+06_workspace_overlay/` and update this checklist at the final archive path.
- [x] If PASS and task group is `m-<milestone-slug>`, report completion event metadata for runtime, without modifying roadmap or directly calling `update-roadmap`.
- [x] If PASS for split work, remove empty active parent `agent-task/m-iop-agent-cli-runtime/` or verify it was kept due to remaining siblings/files.
- [ ] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

- None. Every final verification command was run exactly as written.
- The first race-detector run exposed a test-fixture synchronization issue: the
  two-phase fake provider counted an invocation as active at bind time, before
  the Manager durably persisted its process locator. The fixture now marks the
  invocation active when `Wait` begins, after locator persistence. The affected
  cancellation test passed 10 consecutive runs, and the exact race command was
  rerun successfully.

## Key Design Decisions

- `ConfinementCommand` carries only `Name`, `Args`, and `Env`; it has no path for
  a provider or Manager caller to attach an inheritable reader, writer, file, or
  raw descriptor.
- The validated confinement proof creates all three anonymous pipes, starts the
  child with their child endpoints, closes those copies in the parent, and
  returns the exact `StartedConfinement` handle containing the parent endpoints.
- `StartedConfinement.Abort` is idempotent and owns pipe closure, child
  termination, and reaping. The Manager invokes it for invalid handles, bind
  failures, and nil bound invocations before provider ownership is accepted.
- The real Linux regression keeps a host-opened writable descriptor outside the
  launch API, communicates only through proof-created pipes, and verifies that
  canonical content, metadata, snapshots, overlay records, sibling layers, and
  shared Git state remain unchanged.

## Reviewer Checkpoints

- `ConfinementCommand` contains launch data only; no provider or Manager caller can supply a child-inherited reader, writer, file, or raw descriptor.
- The validated proof creates stdin/stdout/stderr pipes, starts the child, and returns one exact started handle before provider binding.
- Bind and partial-start failures deterministically close pipe endpoints and terminate/reap any started child.
- A real confined child communicates through proof-owned pipes while canonical, sibling, snapshot, overlay-record, and shared-Git evidence remains unchanged.
- Existing metadata-complete Linux policy and retained root/config/grant replay behavior remain unchanged.

## Verification Results

Paste actual stdout/stderr and exit status under every command. Do not replace output with a summary. If a command changes, record the reason under `Deviations from Plan`.

### Host Go identity

```bash
command -v go && readlink -f "$(command -v go)" && go version && go env GOROOT
```

```text
/config/.local/bin/go
/config/opt/go/bin/go
go version go1.26.2 linux/arm64
/config/opt/go

exit 0
```

### Proof-owned child I/O and real confinement

```bash
go test -count=1 -run '^(TestConfinement|TestOverlayBackendConfinement)' -v ./packages/go/agentworkspace
```

```text
=== RUN   TestConfinementPlatformFailsWithTypedUnavailableError
--- PASS: TestConfinementPlatformFailsWithTypedUnavailableError (0.07s)
=== RUN   TestConfinementLinuxUsesMetadataCompleteMountNamespacePolicy
--- PASS: TestConfinementLinuxUsesMetadataCompleteMountNamespacePolicy (0.00s)
=== RUN   TestConfinementProofRejectsTamperedBinding
--- PASS: TestConfinementProofRejectsTamperedBinding (0.01s)
=== RUN   TestConfinementStartCreatesProofOwnedPipes
--- PASS: TestConfinementStartCreatesProofOwnedPipes (0.01s)
=== RUN   TestConfinementStartCleansPipeAndProcessFailures
=== RUN   TestConfinementStartCleansPipeAndProcessFailures/pipe_setup
=== RUN   TestConfinementStartCleansPipeAndProcessFailures/process_start
--- PASS: TestConfinementStartCleansPipeAndProcessFailures (0.01s)
    --- PASS: TestConfinementStartCleansPipeAndProcessFailures/pipe_setup (0.01s)
    --- PASS: TestConfinementStartCleansPipeAndProcessFailures/process_start (0.00s)
=== RUN   TestConfinementAbortClosesPipesAndReapsChild
--- PASS: TestConfinementAbortClosesPipesAndReapsChild (0.01s)
=== RUN   TestConfinementWriteHelper
--- PASS: TestConfinementWriteHelper (0.00s)
=== RUN   TestOverlayBackendConfinementDeniesActualAbsoluteWrites
    overlay_test.go:277: confined child output:
        === RUN   TestConfinementWriteHelper
            overlay_test.go:52: allowed write: child-view.txt
            overlay_test.go:52: allowed write: child-temp.txt
            overlay_test.go:52: allowed write: child-cache.txt
            overlay_test.go:64: denied write: canonical-child.txt: open /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/workspace/canonical-child.txt: read-only file system
            overlay_test.go:64: denied write: descriptor-protected.txt: open /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/workspace/descriptor-protected.txt: read-only file system
            overlay_test.go:64: denied write: sibling-child.txt: open /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/runtime/tasks/a65d79ce0b1134859495bad94ddb8db17ca6105c4034ee39dc13b38df35e3a97/view/sibling-child.txt: read-only file system
            overlay_test.go:64: denied write: snapshot-child.txt: open /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/runtime/snapshots/4878f56a36f8d326f3d47b93a772245a4bb267a3d74b78246a9f18cd44baf763/snapshot-child.txt: read-only file system
            overlay_test.go:64: denied write: confinement-child: open /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/workspace/.git/confinement-child: read-only file system
            overlay_test.go:75: allowed metadata chmod: child-view.txt
            overlay_test.go:75: allowed metadata utime: child-view.txt
            overlay_test.go:75: allowed metadata chown: child-view.txt
            overlay_test.go:75: allowed metadata setxattr: child-view.txt
            overlay_test.go:75: allowed metadata chmod: child-temp.txt
            overlay_test.go:75: allowed metadata utime: child-temp.txt
            overlay_test.go:75: allowed metadata chown: child-temp.txt
            overlay_test.go:75: allowed metadata setxattr: child-temp.txt
            overlay_test.go:75: allowed metadata chmod: child-cache.txt
            overlay_test.go:75: allowed metadata utime: child-cache.txt
            overlay_test.go:75: allowed metadata chown: child-cache.txt
            overlay_test.go:75: allowed metadata setxattr: child-cache.txt
            overlay_test.go:96: denied metadata chmod: shared.txt: chmod /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/workspace/shared.txt: read-only file system
            overlay_test.go:96: denied metadata utime: shared.txt: chtimes /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/workspace/shared.txt: read-only file system
            overlay_test.go:96: denied metadata chown: shared.txt: chown /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/workspace/shared.txt: read-only file system
            overlay_test.go:96: denied metadata setxattr: shared.txt: read-only file system
            overlay_test.go:96: denied metadata chmod: descriptor-protected.txt: chmod /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/workspace/descriptor-protected.txt: read-only file system
            overlay_test.go:96: denied metadata utime: descriptor-protected.txt: chtimes /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/workspace/descriptor-protected.txt: read-only file system
            overlay_test.go:96: denied metadata chown: descriptor-protected.txt: chown /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/workspace/descriptor-protected.txt: read-only file system
            overlay_test.go:96: denied metadata setxattr: descriptor-protected.txt: read-only file system
            overlay_test.go:96: denied metadata chmod: shared.txt: chmod /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/runtime/tasks/a65d79ce0b1134859495bad94ddb8db17ca6105c4034ee39dc13b38df35e3a97/view/shared.txt: read-only file system
            overlay_test.go:96: denied metadata utime: shared.txt: chtimes /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/runtime/tasks/a65d79ce0b1134859495bad94ddb8db17ca6105c4034ee39dc13b38df35e3a97/view/shared.txt: read-only file system
            overlay_test.go:96: denied metadata chown: shared.txt: chown /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/runtime/tasks/a65d79ce0b1134859495bad94ddb8db17ca6105c4034ee39dc13b38df35e3a97/view/shared.txt: read-only file system
            overlay_test.go:96: denied metadata setxattr: shared.txt: read-only file system
            overlay_test.go:96: denied metadata chmod: snapshot.json: chmod /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/runtime/snapshots/4878f56a36f8d326f3d47b93a772245a4bb267a3d74b78246a9f18cd44baf763/snapshot.json: read-only file system
            overlay_test.go:96: denied metadata utime: snapshot.json: chtimes /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/runtime/snapshots/4878f56a36f8d326f3d47b93a772245a4bb267a3d74b78246a9f18cd44baf763/snapshot.json: read-only file system
            overlay_test.go:96: denied metadata chown: snapshot.json: chown /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/runtime/snapshots/4878f56a36f8d326f3d47b93a772245a4bb267a3d74b78246a9f18cd44baf763/snapshot.json: read-only file system
            overlay_test.go:96: denied metadata setxattr: snapshot.json: read-only file system
            overlay_test.go:96: denied metadata chmod: overlay.json: chmod /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/runtime/tasks/2c12b91e8492432844c5321b67955a36bc8264fc0ea971fbaa113623a1092eec/overlay.json: read-only file system
            overlay_test.go:96: denied metadata utime: overlay.json: chtimes /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/runtime/tasks/2c12b91e8492432844c5321b67955a36bc8264fc0ea971fbaa113623a1092eec/overlay.json: read-only file system
            overlay_test.go:96: denied metadata chown: overlay.json: chown /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/runtime/tasks/2c12b91e8492432844c5321b67955a36bc8264fc0ea971fbaa113623a1092eec/overlay.json: read-only file system
            overlay_test.go:96: denied metadata setxattr: overlay.json: read-only file system
            overlay_test.go:96: denied metadata chmod: config: chmod /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/workspace/.git/config: read-only file system
            overlay_test.go:96: denied metadata utime: config: chtimes /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/workspace/.git/config: read-only file system
            overlay_test.go:96: denied metadata chown: config: chown /tmp/TestOverlayBackendConfinementDeniesActualAbsoluteWrites2408361363/001/workspace/.git/config: read-only file system
            overlay_test.go:96: denied metadata setxattr: config: read-only file system
        --- PASS: TestConfinementWriteHelper (0.00s)
        PASS
--- PASS: TestOverlayBackendConfinementDeniesActualAbsoluteWrites (0.77s)
PASS
ok  	iop/packages/go/agentworkspace	0.899s

exit 0
```

### Manager-owned start, handle binding, and cleanup

```bash
go test -count=1 -run '^(TestValidatePreparedIsolation|TestManager.*Confinement|TestDispatch.*Confinement)' -v ./packages/go/agenttask
```

```text
=== RUN   TestValidatePreparedIsolationRequiresExactConfinementProof
--- PASS: TestValidatePreparedIsolationRequiresExactConfinementProof (0.00s)
=== RUN   TestManagerOwnsConfinementStartBeforeBindingProviderInvocation
--- PASS: TestManagerOwnsConfinementStartBeforeBindingProviderInvocation (0.03s)
=== RUN   TestManagerConfinementLaunchFailuresDoNotBindOrLeakChildren
=== RUN   TestManagerConfinementLaunchFailuresDoNotBindOrLeakChildren/prepare_failure
=== RUN   TestManagerConfinementLaunchFailuresDoNotBindOrLeakChildren/proof_start_failure
=== RUN   TestManagerConfinementLaunchFailuresDoNotBindOrLeakChildren/nil_started_handle
=== RUN   TestManagerConfinementLaunchFailuresDoNotBindOrLeakChildren/invalid_started_handle_aborts_child_and_pipes
=== RUN   TestManagerConfinementLaunchFailuresDoNotBindOrLeakChildren/bind_failure_reaps_child
--- PASS: TestManagerConfinementLaunchFailuresDoNotBindOrLeakChildren (0.06s)
    --- PASS: TestManagerConfinementLaunchFailuresDoNotBindOrLeakChildren/prepare_failure (0.00s)
    --- PASS: TestManagerConfinementLaunchFailuresDoNotBindOrLeakChildren/proof_start_failure (0.00s)
    --- PASS: TestManagerConfinementLaunchFailuresDoNotBindOrLeakChildren/nil_started_handle (0.00s)
    --- PASS: TestManagerConfinementLaunchFailuresDoNotBindOrLeakChildren/invalid_started_handle_aborts_child_and_pipes (0.03s)
    --- PASS: TestManagerConfinementLaunchFailuresDoNotBindOrLeakChildren/bind_failure_reaps_child (0.03s)
PASS
ok  	iop/packages/go/agenttask	0.108s

exit 0
```

### Fresh target suites

```bash
go test -count=1 ./packages/go/agentworkspace ./packages/go/agentguard ./packages/go/agenttask
```

```text
ok  	iop/packages/go/agentworkspace	5.572s
ok  	iop/packages/go/agentguard	0.018s
ok  	iop/packages/go/agenttask	2.447s

exit 0
```

### Repetition

```bash
go test -count=20 ./packages/go/agentworkspace
```

```text
ok  	iop/packages/go/agentworkspace	52.875s

exit 0
```

### Race detector

```bash
go test -count=1 -race ./packages/go/agentworkspace ./packages/go/agenttask
```

```text
ok  	iop/packages/go/agentworkspace	9.211s
ok  	iop/packages/go/agenttask	3.987s

exit 0
```

### Shared Go packages

```bash
go test -count=1 ./packages/go/...
```

```text
ok  	iop/packages/go/agentconfig	0.059s
ok  	iop/packages/go/agentguard	0.023s
ok  	iop/packages/go/agentpolicy	0.054s
ok  	iop/packages/go/agentprovider/catalog	0.345s
ok  	iop/packages/go/agentprovider/cli	32.976s
?   	iop/packages/go/agentprovider/cli/internal/testutil	[no test files]
ok  	iop/packages/go/agentprovider/cli/status	41.071s
ok  	iop/packages/go/agentruntime	1.338s
ok  	iop/packages/go/agentstate	0.393s
ok  	iop/packages/go/agenttask	3.417s
ok  	iop/packages/go/agentworkspace	5.633s
ok  	iop/packages/go/audit	0.006s
?   	iop/packages/go/auth	[no test files]
ok  	iop/packages/go/config	0.402s
?   	iop/packages/go/events	[no test files]
ok  	iop/packages/go/hostsetup	0.040s
?   	iop/packages/go/jobs	[no test files]
?   	iop/packages/go/metadata	[no test files]
ok  	iop/packages/go/observability	0.094s
?   	iop/packages/go/policy	[no test files]
ok  	iop/packages/go/streamgate	0.957s
?   	iop/packages/go/version	[no test files]

exit 0
```

### Darwin cross-compile

```bash
CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go test -c -o /dev/null ./packages/go/agentworkspace
```

```text
exit 0
```

### Vet

```bash
go vet ./packages/go/agentworkspace ./packages/go/agentguard ./packages/go/agenttask
```

```text
exit 0
```

### Formatting

```bash
gofmt -d packages/go/agentworkspace packages/go/agentguard packages/go/agenttask
```

```text
exit 0
```

### Launch-boundary search

```bash
rg --sort path 'ConfinementCommand|ProviderLaunch|BindStarted|Confinement\.Start' packages/go
rg --sort path 'Stdin|Stdout|Stderr' packages/go/agenttask/ports.go packages/go/agentworkspace/confinement.go
```

```text
packages/go/agenttask/confinement_dispatch_test.go:	commandType := reflect.TypeOf(ConfinementCommand{})
packages/go/agenttask/confinement_dispatch_test.go:			t.Fatalf("ConfinementCommand still exposes caller-owned %s", forbidden)
packages/go/agenttask/confinement_dispatch_test.go:				harness.invoker.command = ConfinementCommand{Name: "sleep", Args: []string{"5"}}
packages/go/agenttask/confinement_dispatch_test.go:				harness.invoker.command = ConfinementCommand{Name: "sleep", Args: []string{"5"}}
packages/go/agenttask/dispatch.go:		var launch ProviderLaunch
packages/go/agenttask/dispatch.go:				started, err := isolation.Confinement.Start(invokeCtx, command)
packages/go/agenttask/dispatch.go:				invocation, err = launch.BindStarted(started)
packages/go/agenttask/failure_continuation_test.go:) (ProviderLaunch, error) {
packages/go/agenttask/failure_continuation_test.go:	return unobservedFailureLaunch{ProviderLaunch: launch}, nil
packages/go/agenttask/failure_continuation_test.go:	ProviderLaunch
packages/go/agenttask/failure_continuation_test.go:func (l unobservedFailureLaunch) BindStarted(
packages/go/agenttask/failure_continuation_test.go:	invocation, err := l.ProviderLaunch.BindStarted(started)
packages/go/agenttask/failure_continuation_test.go:) (ProviderLaunch, error) {
packages/go/agenttask/failure_continuation_test.go:func (continuationTestLaunch) Command() ConfinementCommand {
packages/go/agenttask/failure_continuation_test.go:	return ConfinementCommand{Name: "true"}
packages/go/agenttask/failure_continuation_test.go:func (l *continuationTestLaunch) BindStarted(
packages/go/agenttask/ports.go:// ConfinementCommand contains only non-I/O launch data. InvocationConfinement
packages/go/agenttask/ports.go:type ConfinementCommand struct {
packages/go/agenttask/ports.go:// validated executable confinement proof. BindStarted assumes ownership after
packages/go/agenttask/ports.go:	Start(context.Context, ConfinementCommand) (StartedConfinement, error)
packages/go/agenttask/ports.go:// ProviderLaunch is a side-effect-free provider launch plan. The manager owns
packages/go/agenttask/ports.go:type ProviderLaunch interface {
packages/go/agenttask/ports.go:	Command() ConfinementCommand
packages/go/agenttask/ports.go:	BindStarted(StartedConfinement) (ProviderInvocation, error)
packages/go/agenttask/ports.go:	// Manager invokes the returned command through InvocationConfinement.Start.
packages/go/agenttask/ports.go:	Prepare(context.Context, DispatchRequest) (ProviderLaunch, error)
packages/go/agenttask/test_support_test.go:	commands     []ConfinementCommand
packages/go/agenttask/test_support_test.go:	spec ConfinementCommand,
packages/go/agenttask/test_support_test.go:func (proof *fakeConfinement) startCommands() []ConfinementCommand {
packages/go/agenttask/test_support_test.go:	command           ConfinementCommand
packages/go/agenttask/test_support_test.go:) (ProviderLaunch, error) {
packages/go/agenttask/test_support_test.go:	command ConfinementCommand
packages/go/agenttask/test_support_test.go:func (launch *fakeLaunch) Command() ConfinementCommand {
packages/go/agenttask/test_support_test.go:func (launch *fakeLaunch) BindStarted(
packages/go/agentworkspace/confinement.go:	spec agenttask.ConfinementCommand,
packages/go/agentworkspace/confinement.go:	command, err := platformConfinementCommand(
packages/go/agentworkspace/confinement.go:	started, err := startConfinementCommand(command)
packages/go/agentworkspace/confinement.go:func startConfinementCommand(
packages/go/agentworkspace/confinement.go:	return startConfinementCommandWithPipes(command, os.Pipe)
packages/go/agentworkspace/confinement.go:func startConfinementCommandWithPipes(
packages/go/agentworkspace/confinement_darwin.go:func platformConfinementCommand(
packages/go/agentworkspace/confinement_linux.go:func platformConfinementCommand(
packages/go/agentworkspace/confinement_test.go:		agenttask.ConfinementCommand{Name: "true"},
packages/go/agentworkspace/confinement_test.go:	started, err := startConfinementCommand(exec.Command(
packages/go/agentworkspace/confinement_test.go:		t.Fatalf("startConfinementCommand: %v", err)
packages/go/agentworkspace/confinement_test.go:		if _, err := startConfinementCommandWithPipes(
packages/go/agentworkspace/confinement_test.go:		if _, err := startConfinementCommandWithPipes(
packages/go/agentworkspace/confinement_test.go:	started, err := startConfinementCommand(exec.Command("sleep", "5"))
packages/go/agentworkspace/confinement_test.go:		t.Fatalf("startConfinementCommand: %v", err)
packages/go/agentworkspace/confinement_unsupported.go:func platformConfinementCommand(
packages/go/agentworkspace/overlay_test.go:	started, err := first.Confinement.Start(
packages/go/agentworkspace/overlay_test.go:		agenttask.ConfinementCommand{
packages/go/agenttask/ports.go:	Stdin() io.WriteCloser
packages/go/agenttask/ports.go:	Stdout() io.ReadCloser
packages/go/agenttask/ports.go:	Stderr() io.ReadCloser
packages/go/agentworkspace/confinement.go:func (started *startedConfinement) Stdin() io.WriteCloser {
packages/go/agentworkspace/confinement.go:func (started *startedConfinement) Stdout() io.ReadCloser {
packages/go/agentworkspace/confinement.go:func (started *startedConfinement) Stderr() io.ReadCloser {
packages/go/agentworkspace/confinement.go:	if command.Stdin != nil || command.Stdout != nil || command.Stderr != nil {
packages/go/agentworkspace/confinement.go:	command.Stdin = stdinChild
packages/go/agentworkspace/confinement.go:	command.Stdout = stdoutChild
packages/go/agentworkspace/confinement.go:	command.Stderr = stderrChild

exit 0
```

### Diff integrity

```bash
git diff --check
```

```text
exit 0
```

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Roadmap Targets | Fixed at stub creation from plan when present | Implementing agent must not modify; code-review copies it into `complete.log` as `Roadmap Completion` only on PASS |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Agent UI Completion | Mixed | Present only for plan-required agent-ui code work; implementing agent fills actual evidence, review agent applies `구현됨` status/evidence update on PASS and copies the section into `complete.log` |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: PASS
- Dimension Assessment:
  - Correctness: Pass — the launch plan exposes only executable name, arguments, and environment; the validated confinement proof exclusively creates child stdio and the Manager binds the exact returned handle.
  - Completeness: Pass — the descriptor bypass, exact handle transfer, and partial-start cleanup requirements are implemented across the shared ports, Manager path, platform proof, tests, and both runtime contracts.
  - Test coverage: Pass — fresh proof-owned I/O, real Linux confinement, Manager ordering/identity, invalid-handle, bind-failure, repetition, race, and package-wide regressions cover the targeted invariant.
  - API contract: Pass — `ConfinementCommand` no longer carries caller-owned readers, writers, files, or raw descriptors, and the contracts match the implemented prepare → proof-owned start/I/O → bind boundary.
  - Code quality: Pass — the implementation is formatted, ownership is documented at the interfaces, cleanup is idempotent, and no debug or stale launch path remains.
  - Implementation deviation: Pass — the only disclosed fixture timing correction preserves the planned production behavior and is backed by repeated race-safe verification.
  - Verification trust: Pass — fresh reviewer runs reproduced the focused results and passed target, repetition, race, package-wide, cross-platform compile, vet, formatting, symbol, and diff checks.
  - Spec conformance: Pass — S18 evidence shows identical pinned isolation behavior and canonical/sibling/snapshot/overlay-record/shared-Git protection through proof-owned child I/O.
- Findings: None.
- Routing Signals:
  - `review_rework_count=3`
  - `evidence_integrity_failure=false`
- Next Step: PASS — write `complete.log`, archive this active pair and task directory, and report milestone completion metadata for the runtime.
