toki/iop
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: update roadmap and add agent task files

Browse source
This commit is contained in:
toki 2026-07-29 18:02:16 +09:00
parent bf64b7d865
commit 24127c5bb6
15 changed files with 2738 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md
View file

@ -80,7 +80,7 @@ Node와 독립 CLI가 같은 실행 구현을 소비하는 runtime capability를
- [x] [overlay-workspace] dependency-ready task마다 tracked·untracked·dirty content를 포함한 pinned base fingerprint와 독립 writable layer, 통합 read view 및 task별 temp/cache 경로를 제공한다. unattended/bypass child도 writable root가 해당 layer로 제한되어 canonical base·공용 Git index/ref·다른 task layer를 직접 변경하지 못한다.
- [x] [change-set-integration] 완료 overlay를 base fingerprint·file operation·write-set·검증 evidence를 가진 immutable change set으로 동결하고 dispatch ordinal에 따라 직렬 three-way 통합한다. clean 결과는 자동 승인하며 conflict·검증 실패·관리되지 않은 base drift는 원본 overlay를 보존한 task-local blocker가 되고 partial base mutation 없이 뒤의 독립 change set 통합은 계속된다.
- [ ] [shared-checkout-write-lock] COW/worktree/clone이 적용되지 않은 project 구현 checkout에서는 PLAN의 정확히 하나인 `Modified Files Summary`를 LLM 없이 정규화한 file write-set으로 사용하고, dispatcher가 workspace 전체 task group의 공통 ledger에서 worker 시작 전 전체 key를 원자적으로 claim해 worker·selfcheck·official review 동안 유지하며 follow-up PLAN에는 claim을 원자적으로 이관한다. 교집합은 dependency가 아닌 대기 상태로 두고, 누락·중복·빈 값·glob·workspace 외부·디렉터리 target, 통제되지 않은 PLAN revision 변경과 restart 시 소유권 불명확 상태는 fail-closed한다. verified completion과 live owner 부재가 확인되거나 명시적 reset이 task-owned mutation의 안전한 정리를 검증한 뒤에만 release/reconcile하고, shared checkout에서 만든 최종 evidence는 다른 active mutation이 없는 stable source 또는 격리 workspace에서 재검증한다.
- [x] [shared-checkout-write-lock] COW/worktree/clone이 적용되지 않은 project 구현 checkout에서는 PLAN의 정확히 하나인 `Modified Files Summary`를 LLM 없이 정규화한 file write-set으로 사용하고, dispatcher가 workspace 전체 task group의 공통 ledger에서 worker 시작 전 전체 key를 원자적으로 claim해 worker·selfcheck·official review 동안 유지하며 follow-up PLAN에는 claim을 원자적으로 이관한다. 교집합은 dependency가 아닌 대기 상태로 두고, 누락·중복·빈 값·glob·workspace 외부·디렉터리 target, 통제되지 않은 PLAN revision 변경과 restart 시 소유권 불명확 상태는 fail-closed한다. verified completion과 live owner 부재가 확인되거나 명시적 reset이 task-owned mutation의 안전한 정리를 검증한 뒤에만 release/reconcile하고, shared checkout에서 만든 최종 evidence는 다른 active mutation이 없는 stable source 또는 격리 workspace에서 재검증한다.
### Epic: [cli-delivery] Headless CLI와 운영 검증
@ -102,10 +102,10 @@ Flutter·Unity client의 process ownership과 같은 사용자 local control 경
- 상태: 진행중
- 요청일: 2026-07-28
- 완료 근거: [Node 공통 runtime bridge](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/01_common_runtime_node_bridge/complete.log), [provider catalog](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/02+01_provider_catalog/complete.log), [guardrail admission](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/03+01,02_guardrail_admission/complete.log), [AgentTaskManager](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/04+01,02,03_task_manager/complete.log), [config registry](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/06+05_config_registry/complete.log), [target policy](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/07+06_target_policy/complete.log), [quota/failure](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/08+06,07_quota_failure/complete.log), [workflow evidence](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/09+05_workflow_evidence/complete.log), [state recovery](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/10+06_state_recovery/complete.log), [workspace overlay](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/11+06_workspace_overlay/complete.log), [change-set integration](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/12+10,11_change_set_integration/complete.log)의 PASS와 현재 checkout의 공통 runtime 대상 fresh test를 근거로 12개 기능 Task를 완료 처리했다.
- 검토 항목: 나머지 7개 기능 Task의 구현과 SDD Evidence Map 검증이 남아 있다.
- 완료 근거: [Node 공통 runtime bridge](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/01_common_runtime_node_bridge/complete.log), [provider catalog](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/02+01_provider_catalog/complete.log), [guardrail admission](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/03+01,02_guardrail_admission/complete.log), [AgentTaskManager](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/04+01,02,03_task_manager/complete.log), [config registry](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/06+05_config_registry/complete.log), [target policy](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/07+06_target_policy/complete.log), [quota/failure](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/08+06,07_quota_failure/complete.log), [workflow evidence](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/09+05_workflow_evidence/complete.log), [state recovery](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/10+06_state_recovery/complete.log), [workspace overlay](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/11+06_workspace_overlay/complete.log), [change-set integration](../../../../agent-task/archive/2026/07/m-iop-agent-cli-runtime/12+10,11_change_set_integration/complete.log), [dispatcher workspace ownership](../../../../agent-task/archive/2026/07/dispatcher_workspace_ownership/complete.log)의 PASS와 현재 checkout의 공통 runtime 및 dispatcher 대상 fresh test를 근거로 13개 기능 Task를 완료 처리했다.
- 검토 항목: 나머지 6개 기능 Task의 구현과 SDD Evidence Map 검증이 남아 있다.
- agent-ui 상태 반영: 해당 없음
- 리뷰 코멘트: 12/19 기능 Task만 완료되어 Milestone 상태를 `[진행중]`으로 유지했다.
- 리뷰 코멘트: 13/19 기능 Task만 완료되어 Milestone 상태를 `[진행중]`으로 유지했다.
## 범위 제외

115
agent-task/m-iop-agent-cli-runtime/13_standalone_host_foundation/CODE_REVIEW-cloud-G09.md Normal file
View file

@ -0,0 +1,115 @@
<!-- task=m-iop-agent-cli-runtime/13_standalone_host_foundation plan=0 tag=API -->
# Code Review Reference - API
> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> Complete the checklist and implementation-owned evidence, leave active files in place, and report ready for review. If blocked, record exact evidence and resume conditions only. Finalization, user-review classification, log renames, `complete.log`, and archive moves are review-agent-only.
## Overview
date=2026-07-29
task=m-iop-agent-cli-runtime/13_standalone_host_foundation, plan=0, tag=API
## For the Review Agent
> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.
Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G09.md` → `code_review_cloud_G09_0.log` and `PLAN-cloud-G09.md` → `plan_cloud_G09_0.log`.
3. If PASS, write `complete.log` and move this task directory to the dated archive. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS, report the milestone completion event metadata without modifying the roadmap.
5. Check the `Review-Only Checklist` at the final log location before reporting.
## Implementation Item Completion
| Item | Status |
|------|--------|
| API-1 Agent application domain | [ ] |
| API-2 Host lifecycle | [ ] |
| API-3 Bootstrap composition | [ ] |
## Implementation Checklist
- [ ] Bootstrap the project-only `agent` domain rule and map `apps/agent/**` before adding application code.
- [ ] Implement and test the standalone host lifecycle and dependency ports without duplicating shared runtime behavior.
- [ ] Add and test bootstrap composition with deterministic startup rollback and reverse shutdown.
- [ ] Run fresh focused, race, vet, formatting, and diff verification.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
## Review-Only Checklist
> **[REVIEW AGENT ONLY]** Implementing agents must not modify this checklist.
- [ ] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified routing signals.
- [ ] Verify verdict, dimension assessment, and Required/Suggested/Nit classifications match.
- [ ] Archive `CODE_REVIEW-cloud-G09.md` to `code_review_cloud_G09_0.log`.
- [ ] Archive `PLAN-cloud-G09.md` to `plan_cloud_G09_0.log`.
- [ ] Verify the Agent-Ops managed block in `.gitignore`.
- [ ] If PASS, write `complete.log` from the canonical template and leave no active Markdown files.
- [ ] If PASS, move this task directory to the dated archive and update this checklist at the final location.
- [ ] If PASS, report milestone completion event metadata without editing the roadmap.
- [ ] If PASS, remove an empty active split parent or prove remaining siblings/files require it.
- [ ] If WARN/FAIL, write the next filesystem state and do not write `complete.log`.
## Deviations from Plan
_Implementer: replace with actual deviations or `None`._
## Key Design Decisions
_Implementer: replace with actual decisions._
## Reviewer Checkpoints
- The new domain rule exists and is mapped before application implementation.
- Host lifecycle is application-owned and does not duplicate shared runtime algorithms.
- Startup rollback and reverse shutdown retain all error identities and are race-free.
- Modified paths exactly match the plan.
## Verification Results
### Domain mapping
```bash
test -f agent-ops/rules/project/domain/agent/rules.md
test "$(rg -n 'apps/agent/\\*\\*' agent-ops/rules/project/rules.md | wc -l | tr -d ' ')" = 1
```
_Paste actual stdout/stderr and exit status._
### Focused and race tests
```bash
go test -count=1 ./apps/agent/internal/host ./apps/agent/internal/bootstrap
go test -count=1 -race ./apps/agent/internal/host ./apps/agent/internal/bootstrap
```
_Paste actual stdout/stderr and exit status._
### Static verification
```bash
go vet ./apps/agent/internal/host ./apps/agent/internal/bootstrap
git diff --check
```
_Paste actual stdout/stderr and exit status._
---
> **[IMPLEMENTING AGENT — BEFORE SAVING]** Fill every implementation-owned section, then leave review-agent-only sections unchanged.
## Section Ownership
| Section | Owner | Note |
|---------|-------|------|
| Header, Overview, Review Agent Instructions | Fixed at stub creation | Implementer must not modify or execute these |
| Implementation Item Completion | Implementing agent | Check item status only |
| Implementation Checklist | Implementing agent | Check status only; do not change text/order |
| Review-Only Checklist | Review agent | Implementer must not modify |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholders with actual evidence |
| Reviewer Checkpoints | Fixed at stub creation | Reviewer verifies them |
| Verification Results | Implementing agent | Paste actual output; command changes require a deviation |
| Code Review Result | Review agent appends | Not included in the stub |

223
agent-task/m-iop-agent-cli-runtime/13_standalone_host_foundation/PLAN-cloud-G09.md Normal file
View file

@ -0,0 +1,223 @@
<!-- task=m-iop-agent-cli-runtime/13_standalone_host_foundation plan=0 tag=API -->
# Standalone iop-agent Host Foundation
## For the Implementing Agent
Filling implementation-owned sections in `CODE_REVIEW-cloud-G09.md` is mandatory. Run every verification command, paste actual notes/output, leave the active pair in place, and report ready for review. Finalization belongs only to the code-review skill. If blocked, record the exact blocker, attempted commands/output, and resume condition in implementation-owned evidence fields; do not ask the user, call user-input tools, create stop files, classify next state, archive logs, or write `complete.log`.
## Background
The shared Go runtime packages exist, but there is no standalone application host that composes them into one device-local process. This foundation establishes an application-owned lifecycle and dependency boundary that later CLI, log, local-control, and client-process packets can implement independently.
## Analysis
### Files Read
- `agent-ops/rules/project/rules.md`
- `agent-ops/rules/project/domain/platform-common/rules.md`
- `agent-ops/rules/project/domain/testing/rules.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- `agent-contract/inner/agent-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `packages/go/agentconfig/runtime_config.go`
- `packages/go/agentconfig/watcher.go`
- `packages/go/agentstate/store.go`
- `packages/go/agenttask/ports.go`
- `packages/go/agenttask/types.go`
- `packages/go/agenttask/manager.go`
- `packages/go/agentconfig/runtime_config_test.go`
- `apps/node/cmd/node/main.go`
- `apps/node/cmd/node/main_test.go`
- `Makefile`
- `go.mod`
### SDD Criteria
The approved SDD is `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`. This packet is a compatibility-preserving prerequisite rather than a check-on-pass Roadmap task. It prepares the host seams required by S10 (`cli-surface`), S11 (`local-control`), S12 (`project-logs`), and S15 (`client-process-manager`) without claiming their Evidence Map rows. The checklist therefore requires a lifecycle-only host with deterministic unit evidence and no provider, socket, process, or logging implementation.
### Verification Context
No external verification handoff was supplied. Repository-native sources are `agent-test/local/rules.md`, `agent-test/local/profiles/platform-common-smoke.md`, and `agent-test/local/profiles/testing-smoke.md`; Go is available at `/config/.local/bin/go` as `go1.26.2 linux/arm64` for a module declaring Go 1.24. Use fresh focused tests, a package race run, `go vet`, and `git diff --check`; cached test output is not acceptable. No external runner is needed.
### Test Coverage Gaps
- No `apps/agent` package or host lifecycle test exists.
- Existing `agenttask.Manager` tests prove shared state transitions but not standalone ownership, startup rollback, or reverse shutdown ordering.
- No current test proves that application adapters remain outside `packages/go/**`.
### Symbol References
None. This packet adds application-owned symbols and does not rename or remove an existing symbol.
### Split Judgment
- `13_standalone_host_foundation`: stable lifecycle/DI contract; PASS requires only ordered start, rollback, reverse stop, and context cancellation tests.
- `14+13_cli_surface`: consumes this host and owns the command surface.
- `15+13_project_logs`: consumes lifecycle events through an interface and owns durable presentation logs.
- `16+13_local_control`: consumes host snapshots/commands and owns the socket boundary.
- `17+13,16_client_process_manager`: consumes the host and local-control operation seam.
- `18+14,15,16,17_logged_smoke`: validates the integrated product externally.
- `19+14,15,16,17,18_parity_cutover`: performs final behavior disposition and production-route cutover.
This task is dependency-free. The later predecessor references are currently missing because their active `complete.log` files do not yet exist.
### Scope Rationale
Do not add CLI commands, concrete provider adapters, socket transport, project-log serialization, subprocess ownership, or parity migration here. Do not change shared `agenttask`, `agentstate`, or `agentworkspace` semantics. The new `agent` domain rule is project-local; central `agent-ops/rules/common/**` remains untouched.
### Final Routing
- evaluation_mode: `first-pass`
- finalizer: `finalize-task-policy.sh pair`
- build: closure complete, grade `G09`, route `cloud`, basis `grade-boundary`, filename `PLAN-cloud-G09.md`
- review: closure complete, grade `G09`, route `cloud`, basis `official-review`, filename `CODE_REVIEW-cloud-G09.md`
- large_indivisible_context: `false`
- positive loop risks: `new application/domain bootstrap`, `multi-component lifecycle ordering` (count `2`)
- recovery signals: review rework `0`, evidence-integrity failure `false`
- capability-gap evidence: none; G09 grade boundary selected
## Implementation Checklist
- [ ] Bootstrap the project-only `agent` domain rule and map `apps/agent/**` before adding application code.
- [ ] Implement and test the standalone host lifecycle and dependency ports without duplicating shared runtime behavior.
- [ ] Add and test bootstrap composition with deterministic startup rollback and reverse shutdown.
- [ ] Run fresh focused, race, vet, formatting, and diff verification.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
### [API-1] Bootstrap the Agent Application Domain
#### Problem
`agent-ops/rules/project/rules.md:69-87` has no mapping for the planned `apps/agent/**` application, so implementation would enter a new domain without a checked project rule.
#### Solution
Create the empty `apps/agent` directory, then use the routed domain-rule creation workflow to add a project-only rule before any Go source. Update only the project mapping:
```text
Before (agent-ops/rules/project/rules.md:73-80)
apps/node/**, apps/edge/**, apps/control-plane/**, apps/client/**, packages/**
After
apps/agent/** -> agent-ops/rules/project/domain/agent/rules.md
```
The rule must define standalone daemon ownership, application-vs-common package boundaries, config/state locality, same-user control assumptions, test expectations, and explicit prohibitions against duplicating `agenttask` or provider runtime logic.
#### Modified Files and Checklist
- [ ] `agent-ops/rules/project/domain/agent/rules.md` — add the project-only domain rule.
- [ ] `agent-ops/rules/project/rules.md` — register `apps/agent/**` and document the new application root.
#### Test Strategy
No code test is needed. Verify the mapping is unique and every referenced rule path exists.
#### Verification
```bash
test -f agent-ops/rules/project/domain/agent/rules.md
test "$(rg -n 'apps/agent/\\*\\*' agent-ops/rules/project/rules.md | wc -l | tr -d ' ')" = 1
```
Expected: both commands exit 0.
### [API-2] Add the Host Lifecycle Boundary
#### Problem
`packages/go/agenttask/ports.go:19-25,40-349` exposes the host-neutral manager and its explicit execution ports, but no application owner coordinates those dependencies.
#### Solution
Add an application-owned `host` package. Define small `Component` and runtime-control ports, a `Host` that starts components in declared order, cancels the run context on failure, rolls back only started components, and stops in reverse order. Preserve error identity with joined errors and make repeated stop safe.
```go
// apps/agent/internal/host/host.go
package host
type Component interface {
Start(context.Context) error
Stop(context.Context) error
}
```
Do not wrap or reimplement `agenttask.Manager`; the future bootstrap adapter supplies it as a component.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/host/host.go` — implement lifecycle ownership.
- [ ] `apps/agent/internal/host/ports.go` — define narrow application-facing runtime/status ports.
- [ ] `apps/agent/internal/host/host_test.go` — cover order, rollback, cancellation, repeated stop, and error retention.
#### Test Strategy
Write table-driven tests `TestHostStartStopOrdering`, `TestHostStartRollback`, and `TestHostStopIsIdempotent` with deterministic fake components and an ordered trace.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/host
go test -count=1 -race ./apps/agent/internal/host
```
Expected: both commands pass with no race.
### [API-3] Add Bootstrap Composition
#### Problem
`apps/node/cmd/node/main.go:1` demonstrates an application entry point, but the standalone host has no constructor that validates dependencies and exposes one run/close boundary.
#### Solution
Add a bootstrap module that accepts explicit application dependencies, rejects nil/duplicate component names, builds the host, and exposes deterministic `Run`/`Close` behavior. Keep construction side-effect free; starting providers, sockets, and client processes belongs to later packets.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/bootstrap/module.go` — validate and compose host dependencies.
- [ ] `apps/agent/internal/bootstrap/module_test.go` — verify validation, lifecycle delegation, and startup failure cleanup.
#### Test Strategy
Write `TestNewModuleRejectsInvalidDependencies`, `TestModuleRunDelegatesLifecycle`, and `TestModuleStartupFailureRollsBack`.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/bootstrap
```
Expected: package passes.
## Dependencies and Execution Order
1. Complete API-1 before adding any `apps/agent` Go source.
2. Complete API-2 before API-3.
3. Run all final verification after the domain mapping and both packages exist.
## Modified Files Summary
| File | Item |
|------|------|
| `agent-ops/rules/project/domain/agent/rules.md` | API-1 |
| `agent-ops/rules/project/rules.md` | API-1 |
| `apps/agent/internal/host/host.go` | API-2 |
| `apps/agent/internal/host/ports.go` | API-2 |
| `apps/agent/internal/host/host_test.go` | API-2 |
| `apps/agent/internal/bootstrap/module.go` | API-3 |
| `apps/agent/internal/bootstrap/module_test.go` | API-3 |
## Final Verification
```bash
gofmt -w apps/agent/internal/host/*.go apps/agent/internal/bootstrap/*.go
go test -count=1 ./apps/agent/internal/host ./apps/agent/internal/bootstrap
go test -count=1 -race ./apps/agent/internal/host ./apps/agent/internal/bootstrap
go vet ./apps/agent/internal/host ./apps/agent/internal/bootstrap
git diff --check
```
Expected: all commands pass; no shared runtime package is modified. After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.

117
agent-task/m-iop-agent-cli-runtime/14+13_cli_surface/CODE_REVIEW-cloud-G06.md Normal file
View file

@ -0,0 +1,117 @@
<!-- task=m-iop-agent-cli-runtime/14+13_cli_surface plan=0 tag=API -->
# Code Review Reference - API
> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> Complete the checklist and evidence, leave active files in place, and report ready for review. Blockers belong only in implementation evidence. Do not classify next state or perform review-agent finalization.
## Overview
date=2026-07-29
task=m-iop-agent-cli-runtime/14+13_cli_surface, plan=0, tag=API
## Roadmap Targets
- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
- `cli-surface`: binary, split configuration, validation, discovery, selection, lifecycle, and status commands
- Completion mode: check-on-pass
## For the Review Agent
> **[REVIEW AGENT ONLY]** Implementing agents must not execute finalization.
Compare every item and actual output to source. Append verdict/signals; archive `CODE_REVIEW-cloud-G06.md` → `code_review_cloud_G06_0.log` and `PLAN-local-G06.md` → `plan_local_G06_0.log`; on PASS write `complete.log`, archive the task, and report completion metadata without editing the roadmap; on WARN/FAIL materialize the next code-review state.
## Implementation Item Completion
| Item | Status |
|------|--------|
| API-1 Split configs | [ ] |
| API-2 Command tree | [ ] |
| API-3 Binary/build | [ ] |
| API-4 Contract/transcript | [ ] |
## Implementation Checklist
- [ ] Add secret-free repo-global and user-local example configurations with strict validation tests.
- [ ] Implement the complete Cobra command tree over narrow host ports, including manual selection and side-effect-free preview.
- [ ] Add the `iop-agent` entry point and Makefile build target with command-level tests and Darwin cross-build.
- [ ] Update the standalone contract with actual S10 source/test paths and run a headless operation transcript.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
## Review-Only Checklist
> **[REVIEW AGENT ONLY]** Implementing agents must not modify this checklist.
- [ ] Append one verdict and verified `review_rework_count` / `evidence_integrity_failure`.
- [ ] Verify verdict, dimensions, and finding classifications match.
- [ ] Archive `CODE_REVIEW-cloud-G06.md` as `code_review_cloud_G06_0.log`.
- [ ] Archive `PLAN-local-G06.md` as `plan_local_G06_0.log`.
- [ ] Verify the Agent-Ops managed `.gitignore` block.
- [ ] If PASS, write canonical `complete.log` and leave no active Markdown files.
- [ ] If PASS, move this task directory to the dated archive and update this checklist there.
- [ ] If PASS, report `cli-surface` completion metadata without editing the roadmap.
- [ ] If PASS, remove an empty split parent or prove remaining siblings/files require it.
- [ ] If WARN/FAIL, write the exact next state and do not write `complete.log`.
## Deviations from Plan
_Implementer: replace with actual deviations or `None`._
## Key Design Decisions
_Implementer: replace with actual decisions._
## Reviewer Checkpoints
- Every S10 command exists and delegates through the host.
- Preview and unselected start are mutation-free.
- Repo-global input is secret-free/read-only; local example owns device paths.
- Binary runs outside a checkout with explicit paths and cross-builds for macOS.
## Verification Results
### Focused tests
```bash
go test -count=1 ./apps/agent/cmd/agent ./apps/agent/internal/command
go test -count=1 -race ./apps/agent/cmd/agent ./apps/agent/internal/command
```
_Paste actual stdout/stderr._
### Build and transcript
```bash
make build-agent
GOOS=darwin GOARCH=arm64 go build -trimpath -o /tmp/iop-agent-darwin-arm64 ./apps/agent/cmd/agent
build/bin/iop-agent --help
```
_Paste actual stdout/stderr._
### Static checks
```bash
go vet ./apps/agent/cmd/agent ./apps/agent/internal/command
git diff --check
```
_Paste actual stdout/stderr._
---
> **[IMPLEMENTING AGENT — BEFORE SAVING]** Fill every implementation-owned section and leave review-only content unchanged.
## Section Ownership
| Section | Owner | Note |
|---------|-------|------|
| Header, Overview, Roadmap Targets, Review Instructions | Fixed | Implementer must not modify |
| Implementation Item Completion, Implementation Checklist | Implementing agent | Check status only |
| Review-Only Checklist | Review agent | Implementer must not modify |
| Deviations, Decisions, Verification Results | Implementing agent | Record actual evidence |
| Reviewer Checkpoints | Fixed | Reviewer verifies them |
| Code Review Result and finalization | Review agent | Append/execute only after review |

247
agent-task/m-iop-agent-cli-runtime/14+13_cli_surface/PLAN-local-G06.md Normal file
View file

@ -0,0 +1,247 @@
<!-- task=m-iop-agent-cli-runtime/14+13_cli_surface plan=0 tag=API -->
# Headless iop-agent CLI Surface
## For the Implementing Agent
Filling implementation-owned sections in `CODE_REVIEW-cloud-G06.md` is mandatory. Run verification, paste actual output, leave active files in place, and report ready for review. Finalization is code-review-only. If blocked, record exact blocker evidence and resume conditions without asking the user, creating stop files, archiving, or writing `complete.log`.
## Background
The approved milestone requires a complete headless product surface before any Flutter or Unity client exists. This packet exposes the standalone host through deterministic Cobra commands and split configuration examples while preserving manual-first milestone selection and side-effect-free preview.
## Roadmap Targets
- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
- `cli-surface`: binary, split configuration, validation, discovery, selection, lifecycle, and status commands
- Completion mode: check-on-pass
## Analysis
### Files Read
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- `agent-contract/inner/agent-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `packages/go/agentconfig/runtime_config.go`
- `packages/go/agentconfig/runtime_config_test.go`
- `packages/go/agentconfig/watcher.go`
- `packages/go/agenttask/ports.go`
- `packages/go/agenttask/types.go`
- `configs/iop-agent.providers.yaml`
- `apps/node/cmd/node/main.go`
- `apps/node/cmd/node/main_test.go`
- `Makefile`
- `go.mod`
### SDD Criteria
The approved SDD scenario S10 maps to `cli-surface`. Its Evidence Map requires a binary plus split-config command integration test and a headless operation transcript. The checklist covers `validate`, provider/project/Milestone list and select, side-effect-free preview, `serve`, start/stop/resume, and coherent status including overlay, integration, and blockers; tests must also prove an unselected ready Milestone never starts.
### Verification Context
No handoff was supplied. Read `agent-test/local/rules.md`, `agent-test/local/profiles/platform-common-smoke.md`, and `agent-test/local/profiles/testing-smoke.md`. Current local toolchain is Go 1.26.2 on Linux arm64; the built CLI must also cross-compile for Darwin arm64. Use fresh tests (`-count=1`), a binary-level command transcript, `go vet`, and `git diff --check`; cached results are not accepted.
### Test Coverage Gaps
- Runtime config merge/validation is covered, but no binary invokes it.
- Shared manager tests cover lifecycle semantics, but no command parsing or manual-selection guard exists.
- There is no install-location-independent `iop-agent` build target or split config fixture.
### Symbol References
None. New Cobra commands and application adapters are added without renaming shared symbols.
### Split Judgment
This packet owns only the command/API surface and uses fake host ports for deterministic PASS. It depends on predecessor `13_standalone_host_foundation`; no active or archived `complete.log` currently satisfies index 13, so implementation must wait. Project logs, socket control, and client processes remain independent packets.
### Scope Rationale
Do not implement local proto-socket transport, client subprocesses, Python cutover, authenticated provider smoke, or a new selector. Do not embed secrets or device paths in repo-global config. The CLI delegates to the host/shared runtime and may use fakes only in tests.
### Final Routing
- evaluation_mode: `first-pass`
- finalizer: `finalize-task-policy.sh pair`
- build: closure complete, `local-G06`, basis `local-fit`, filename `PLAN-local-G06.md`
- review: closure complete, `cloud-G06`, basis `official-review`, filename `CODE_REVIEW-cloud-G06.md`
- large_indivisible_context: `false`
- positive loop risks: `broad command matrix` (count `1`)
- recovery signals: rework `0`, evidence-integrity failure `false`
- capability-gap evidence: none
## Implementation Checklist
- [ ] Add secret-free repo-global and user-local example configurations with strict validation tests.
- [ ] Implement the complete Cobra command tree over narrow host ports, including manual selection and side-effect-free preview.
- [ ] Add the `iop-agent` entry point and Makefile build target with command-level tests and Darwin cross-build.
- [ ] Update the standalone contract with actual S10 source/test paths and run a headless operation transcript.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
### [API-1] Add Split Configuration Fixtures
#### Problem
`packages/go/agentconfig/runtime_config.go:18-37` defines separate repo-global and user-local schemas, but `configs/` contains only the provider catalog and no runnable runtime examples.
#### Solution
Add a secret-free `configs/iop-agent.runtime.yaml` with defaults, selection, isolation, and retention. Add `configs/iop-agent.local.example.yaml` with placeholder absolute roots and project registration. Keep the provider catalog in `configs/iop-agent.providers.yaml`; the command bootstrap loads the catalog and runtime inputs as separate owned sources.
```yaml
# Before: no standalone runtime examples.
# After:
version: "1"
defaults:
auto_resume_interrupted: true
```
#### Modified Files and Checklist
- [ ] `configs/iop-agent.runtime.yaml` — add repo-global runtime defaults.
- [ ] `configs/iop-agent.local.example.yaml` — add secret-free device/project example.
- [ ] `apps/agent/internal/command/config_test.go` — validate examples and read-only behavior.
#### Test Strategy
Write `TestTrackedRuntimeExamplesLoad` and `TestValidateDoesNotMutateRepoConfig`; copy the local example into a temp root after substituting absolute paths.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/command -run 'TestTrackedRuntimeExamplesLoad|TestValidateDoesNotMutateRepoConfig'
```
Expected: both tests pass.
### [API-2] Implement the Command Tree
#### Problem
`agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md:152,177` requires the S10 headless command surface, but no standalone command package exists.
#### Solution
Create one Cobra root with explicit `--repo-config`, `--local-config`, and `--provider-catalog` flags. Implement `validate`, `provider list`, `project list`, `milestone list`, `milestone select`, `preview`, `serve`, `start`, `stop`, `resume`, and `status`. Define a narrow command service interface; preview must not call mutation methods, and `start` must reject a project without an explicitly selected Milestone.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/command/root.go` — construct root, flags, and subcommands.
- [ ] `apps/agent/internal/command/service.go` — define request/response DTOs and service port.
- [ ] `apps/agent/internal/command/root_test.go` — test the complete matrix and stable text/JSON output.
- [ ] `apps/agent/internal/command/config_test.go` — cover config commands.
#### Test Strategy
Write table tests `TestCommandMatrix`, `TestPreviewIsSideEffectFree`, `TestStartRequiresSelectedMilestone`, and `TestStatusIncludesOverlayIntegrationAndBlockers` using one recording fake.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/command
```
Expected: all commands parse and delegate exactly once; preview and unselected start mutate nothing.
### [API-3] Add the Binary and Build Target
#### Problem
`Makefile:30-48` builds only Edge and Node binaries; no `iop-agent` entry point exists.
#### Solution
Add `apps/agent/cmd/agent/main.go` with an injectable `run(args, stdout, stderr)` seam. Build to `build/bin/iop-agent`, include it in `build-local`, and keep default paths overrideable so the binary works outside a checkout.
```make
# Before (Makefile:30)
build-local: build-edge build-node
# After
build-local: build-edge build-node build-agent
```
#### Modified Files and Checklist
- [ ] `apps/agent/cmd/agent/main.go` — add the process entry point.
- [ ] `apps/agent/cmd/agent/main_test.go` — verify exit codes and output separation.
- [ ] `Makefile` — add `build-agent` and include it in local build.
#### Test Strategy
Test success, usage error, config error, and context cancellation. Build for local and Darwin arm64.
#### Verification
```bash
go test -count=1 ./apps/agent/cmd/agent
make build-agent
GOOS=darwin GOARCH=arm64 go build -trimpath -o /tmp/iop-agent-darwin-arm64 ./apps/agent/cmd/agent
```
Expected: tests and both builds pass.
### [API-4] Record S10 Sources and Transcript
#### Problem
`agent-contract/inner/iop-agent-cli-runtime.md:9-14` has no implemented S10 source paths.
#### Solution
Add the actual CLI/config paths and S10 evidence row without restating shared runtime semantics. Run a temp-fixture transcript covering every command, stable errors, and the no-unselected-start invariant.
#### Modified Files and Checklist
- [ ] `agent-contract/inner/iop-agent-cli-runtime.md` — record actual S10 sources/tests and evidence.
#### Test Strategy
No additional test file; API-2/API-3 tests are the contract evidence.
#### Verification
```bash
build/bin/iop-agent --help
build/bin/iop-agent validate --repo-config configs/iop-agent.runtime.yaml --local-config /tmp/iop-agent-cli/local.yaml --provider-catalog configs/iop-agent.providers.yaml
```
Expected: help lists the full surface and validate succeeds against the prepared temp fixture.
## Dependencies and Execution Order
Predecessor `13_standalone_host_foundation` must produce `agent-task/m-iop-agent-cli-runtime/13_standalone_host_foundation/complete.log` (or its exact archived counterpart) before implementation begins. No other dependency is encoded by `14+13_cli_surface`.
## Modified Files Summary
| File | Item |
|------|------|
| `configs/iop-agent.runtime.yaml` | API-1 |
| `configs/iop-agent.local.example.yaml` | API-1 |
| `apps/agent/internal/command/config_test.go` | API-1, API-2 |
| `apps/agent/internal/command/root.go` | API-2 |
| `apps/agent/internal/command/service.go` | API-2 |
| `apps/agent/internal/command/root_test.go` | API-2 |
| `apps/agent/cmd/agent/main.go` | API-3 |
| `apps/agent/cmd/agent/main_test.go` | API-3 |
| `Makefile` | API-3 |
| `agent-contract/inner/iop-agent-cli-runtime.md` | API-4 |
## Final Verification
```bash
gofmt -w apps/agent/cmd/agent/*.go apps/agent/internal/command/*.go
go test -count=1 ./apps/agent/cmd/agent ./apps/agent/internal/command
go test -count=1 -race ./apps/agent/cmd/agent ./apps/agent/internal/command
go vet ./apps/agent/cmd/agent ./apps/agent/internal/command
make build-agent
GOOS=darwin GOARCH=arm64 go build -trimpath -o /tmp/iop-agent-darwin-arm64 ./apps/agent/cmd/agent
build/bin/iop-agent --help
git diff --check
```
Expected: fresh tests, race, vet, local/Darwin builds, help transcript, and diff check pass. After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.

116
agent-task/m-iop-agent-cli-runtime/15+13_project_logs/CODE_REVIEW-cloud-G08.md Normal file
View file

@ -0,0 +1,116 @@
<!-- task=m-iop-agent-cli-runtime/15+13_project_logs plan=0 tag=API -->
# Code Review Reference - API
> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is mandatory.**
> Fill implementation evidence and actual outputs, then stop with active files in place. Review finalization is not an implementation action.
## Overview
date=2026-07-29
task=m-iop-agent-cli-runtime/15+13_project_logs, plan=0, tag=API
## Roadmap Targets
- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
- `project-logs`: project-local event/log plus WORK_LOG loop/attempt/locator and exactly-once archive lifecycle
- Completion mode: check-on-pass
## For the Review Agent
> **[REVIEW AGENT ONLY]** Implementing agents must not execute finalization.
Compare source and actual evidence to S12. Append verdict/signals; archive `CODE_REVIEW-cloud-G08.md` → `code_review_cloud_G08_0.log` and `PLAN-local-G08.md` → `plan_local_G08_0.log`; on PASS write `complete.log`, archive the task, and report completion metadata without editing the roadmap.
## Implementation Item Completion
| Item | Status |
|------|--------|
| API-1 Records | [ ] |
| API-2 CAS journal/archive | [ ] |
| API-3 Event sink/timeline | [ ] |
| API-4 S12 matrix | [ ] |
## Implementation Checklist
- [ ] Define a versioned, bounded ProjectLogRecord and stable project/work/attempt/locator identity schema.
- [ ] Implement CAS-backed append, retention, replay, terminal archive, and restart reconciliation over device-local roots.
- [ ] Implement the agenttask EventSink adapter and deterministic WORK_LOG projection without raw provider output.
- [ ] Prove the S12 11-retry, parallel-task, ordinal, crash-window, and exactly-once archive matrix under the race detector.
- [ ] Update the standalone contract with actual S12 source/test paths and verification evidence.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
## Review-Only Checklist
> **[REVIEW AGENT ONLY]** Implementing agents must not modify this checklist.
- [ ] Append one verdict and verified routing signals.
- [ ] Verify verdict, dimensions, and finding classifications.
- [ ] Archive this review as `code_review_cloud_G08_0.log`.
- [ ] Archive the plan as `plan_local_G08_0.log`.
- [ ] Verify the Agent-Ops managed `.gitignore` block.
- [ ] If PASS, write canonical `complete.log` and leave no active Markdown files.
- [ ] If PASS, move the task to the dated archive and update this checklist there.
- [ ] If PASS, report `project-logs` completion metadata without editing the roadmap.
- [ ] If PASS, remove an empty split parent or prove siblings/files remain.
- [ ] If WARN/FAIL, materialize the required next state without `complete.log`.
## Deviations from Plan
_Implementer: actual deviations or `None`._
## Key Design Decisions
_Implementer: actual decisions._
## Reviewer Checkpoints
- Accepted appends, archive intent, and cleanup are CAS/restart safe.
- Record schemas preserve exact identities and exclude secrets/raw output.
- The S12 test really contains 11 retries and an independent parallel task.
- Terminal-only archives are exactly once across injected crash windows.
## Verification Results
### Focused suite
```bash
go test -count=1 ./apps/agent/internal/projectlog
```
_Paste actual stdout/stderr._
### Race and S12 matrix
```bash
go test -count=1 -race ./apps/agent/internal/projectlog ./packages/go/agentstate
go test -count=1 -race ./apps/agent/internal/projectlog -run TestS12LoopParallelArchiveMatrix
```
_Paste actual stdout/stderr._
### Static checks
```bash
go vet ./apps/agent/internal/projectlog
git diff --check
```
_Paste actual stdout/stderr._
---
> **[IMPLEMENTING AGENT — BEFORE SAVING]** Fill every implementation-owned section and leave review-only content unchanged.
## Section Ownership
| Section | Owner | Note |
|---------|-------|------|
| Header, Overview, Roadmap Targets, Review Instructions | Fixed | Implementer must not modify |
| Implementation Item Completion, Implementation Checklist | Implementing agent | Check status only |
| Review-Only Checklist | Review agent | Implementer must not modify |
| Deviations, Decisions, Verification Results | Implementing agent | Record actual evidence |
| Reviewer Checkpoints | Fixed | Reviewer verifies them |
| Code Review Result and finalization | Review agent | Append/execute only after review |

215
agent-task/m-iop-agent-cli-runtime/15+13_project_logs/PLAN-local-G08.md Normal file
View file

@ -0,0 +1,215 @@
<!-- task=m-iop-agent-cli-runtime/15+13_project_logs plan=0 tag=API -->
# Durable Project Logs and WORK_LOG Timeline
## For the Implementing Agent
Fill every implementation-owned section in `CODE_REVIEW-cloud-G08.md`, including actual command output. Keep active files in place and report ready for review; only the review agent finalizes. Record blockers and resume conditions in evidence fields without asking the user or creating control-plane artifacts.
## Background
The shared manager emits normalized events and durable locators, but the standalone host has no project-local presentation/recovery log. S12 requires stable loop, attempt, locator, and completion archive evidence even through retries, parallel work, and restart.
## Roadmap Targets
- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
- `project-logs`: project-local event/log plus WORK_LOG loop/attempt/locator and exactly-once archive lifecycle
- Completion mode: check-on-pass
## Analysis
### Files Read
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- `agent-contract/inner/agent-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `packages/go/agenttask/ports.go`
- `packages/go/agenttask/types.go`
- `packages/go/agentstate/store.go`
- `packages/go/agentconfig/runtime_config.go`
- `agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md`
### SDD Criteria
The approved SDD scenario S12 maps to `project-logs`. Its Evidence Map requires a WORK_LOG loop/attempt/locator fixture, dynamic frontier behavior, and archive reconciliation. PASS evidence must show 11 retries/follow-ups for one task, an independent parallel task, separate archive ordinal, stable identities, and terminal-only exactly-once archive/cleanup.
### Verification Context
No handoff was supplied. Local rules are `agent-test/local/rules.md` plus the platform-common and testing smoke profiles. Use fresh focused tests, an agentstate/projectlog race run, filesystem restart fixtures, `go vet`, and `git diff --check`; cached output is not acceptable. No external service or secret is required.
### Test Coverage Gaps
- `agentstate.Store` has checksum/CAS tests but no typed project-log journal.
- `agenttask.EventSink` defaults to a no-op and has no durable standalone adapter.
- Dispatcher WORK_LOG tests are Python-specific and do not prove Go host restart/archive behavior.
### Symbol References
None. The new adapter implements the existing `agenttask.EventSink` without changing that interface.
### Split Judgment
The packet has one invariant: an accepted append and terminal archive must share one CAS-governed project journal so restart cannot duplicate or lose logical records. It depends only on index 13; `13_standalone_host_foundation` has no active or archived `complete.log` yet. CLI and local control are not dependencies because the sink exposes a stable adapter contract.
### Scope Rationale
Do not parse provider raw output, duplicate task-manager transitions, mutate `agent-task/**`, or store credentials/raw unbounded streams. Do not change the Python dispatcher; it is only behavioral reference. Do not add UI rendering.
### Final Routing
- evaluation_mode: `first-pass`
- finalizer: `finalize-task-policy.sh pair`
- build: `local-G08`, basis `local-fit`, filename `PLAN-local-G08.md`
- review: `cloud-G08`, basis `official-review`, filename `CODE_REVIEW-cloud-G08.md`
- large_indivisible_context: `false`
- positive loop risks: `CAS/archive crash windows`, `retry/parallel identity matrix` (count `2`)
- recovery signals: rework `0`, evidence-integrity failure `false`
- capability-gap evidence: none
## Implementation Checklist
- [ ] Define a versioned, bounded ProjectLogRecord and stable project/work/attempt/locator identity schema.
- [ ] Implement CAS-backed append, retention, replay, terminal archive, and restart reconciliation over device-local roots.
- [ ] Implement the agenttask EventSink adapter and deterministic WORK_LOG projection without raw provider output.
- [ ] Prove the S12 11-retry, parallel-task, ordinal, crash-window, and exactly-once archive matrix under the race detector.
- [ ] Update the standalone contract with actual S12 source/test paths and verification evidence.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
### [API-1] Define Stable Project Log Records
#### Problem
`agent-contract/inner/iop-agent-cli-runtime.md:50-61` describes `ProjectLogRecord`, while `packages/go/agenttask/types.go:266-403` contains the normalized identities/events, but no concrete bounded record exists.
#### Solution
Add a versioned record with project/work/attempt identity, loop and dispatch ordinals, event type, safe route/quota status, typed locator references, state revision, timestamp, and terminal marker. Validate IDs and cap message/metadata sizes. Never persist credentials, raw environment, or raw provider output.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/projectlog/record.go` — define/validate immutable records and archive manifests.
- [ ] `apps/agent/internal/projectlog/record_test.go` — cover valid, malformed, oversized, and secret-bearing inputs.
#### Test Strategy
Write `TestRecordValidationMatrix` and `TestRecordRejectsSensitiveOrUnboundedFields`.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/projectlog -run 'TestRecord'
```
Expected: normal and boundary matrices pass.
### [API-2] Implement CAS Journal and Archive Reconciliation
#### Problem
`packages/go/agentstate/store.go:50-136` supports opaque CAS integration records, but no project-log adapter uses it to coordinate append, retention, or archive state.
#### Solution
Use one namespaced integration record per project as the logical journal. Append by CAS with bounded retry, assign monotonic sequence and independent archive ordinal, prune only per configured retention after terminal evidence, and materialize redacted JSONL/timeline files using temp-file sync/rename. Persist archive intent/checksum before cleanup; on restart, reconcile a matching artifact idempotently and fail closed on conflicting content.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/projectlog/store.go` — implement append/replay/archive/reconcile.
- [ ] `apps/agent/internal/projectlog/store_test.go` — cover CAS conflict, retention, crash phases, restart, and exactly-once output.
#### Test Strategy
Use temp roots and real `agentstate.Store`. Inject failures before write, after artifact rename, before manifest commit, and before cleanup. Assert one logical archive and unchanged evidence on replay.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/projectlog -run 'TestStore|TestArchive|TestReconcile'
```
Expected: all crash/restart cases converge or fail closed without duplicates.
### [API-3] Add Event Sink and WORK_LOG Projection
#### Problem
`packages/go/agenttask/ports.go:345-350` permits an `EventSink`, but the standalone host has no durable implementation or human-readable timeline.
#### Solution
Implement `agenttask.EventSink` by normalizing manager events into journal records. Project a stable chronological WORK_LOG view with loop, attempt, role/stage, result, and locators while keeping raw streams external. Make projection a pure function of the durable journal so restart output is reproducible.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/projectlog/sink.go` — implement the event adapter and projection.
- [ ] `apps/agent/internal/projectlog/sink_test.go` — cover mapping and deterministic output.
#### Test Strategy
Write `TestSinkMapsEveryEventType` and `TestTimelineProjectionIsStableAndRedacted`.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/projectlog -run 'TestSink|TestTimeline'
```
Expected: all normalized event types are handled with stable ordering.
### [API-4] Prove the S12 Matrix
#### Problem
`agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md:154,179` requires the 11-attempt loop, independent parallel loop, archive ordinal separation, and terminal closure, but no Go test reproduces that matrix.
#### Solution
Add a single integration fixture that appends 11 failed/retry/follow-up attempts for task A while task B advances independently, restarts stores between selected phases, closes both tasks in different orders, and asserts distinct exactly-once archives plus retained locator identity.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/projectlog/store_test.go` — add `TestS12LoopParallelArchiveMatrix`.
- [ ] `agent-contract/inner/iop-agent-cli-runtime.md` — add S12 actual source/test entries.
#### Test Strategy
The named fixture is mandatory and must use real files plus concurrent goroutines. Run it with `-race`.
#### Verification
```bash
go test -count=1 -race ./apps/agent/internal/projectlog -run TestS12LoopParallelArchiveMatrix
```
Expected: one archive per terminal task, independent ordinals, 11 preserved attempts, no duplicate records.
## Dependencies and Execution Order
Predecessor index 13 must complete at `agent-task/m-iop-agent-cli-runtime/13_standalone_host_foundation/complete.log` or its exact same-group archive path before work begins. Complete API-1 before API-2/API-3; API-4 follows both.
## Modified Files Summary
| File | Item |
|------|------|
| `apps/agent/internal/projectlog/record.go` | API-1 |
| `apps/agent/internal/projectlog/record_test.go` | API-1 |
| `apps/agent/internal/projectlog/store.go` | API-2 |
| `apps/agent/internal/projectlog/store_test.go` | API-2, API-4 |
| `apps/agent/internal/projectlog/sink.go` | API-3 |
| `apps/agent/internal/projectlog/sink_test.go` | API-3 |
| `agent-contract/inner/iop-agent-cli-runtime.md` | API-4 |
## Final Verification
```bash
gofmt -w apps/agent/internal/projectlog/*.go
go test -count=1 ./apps/agent/internal/projectlog
go test -count=1 -race ./apps/agent/internal/projectlog ./packages/go/agentstate
go vet ./apps/agent/internal/projectlog
git diff --check
```
Expected: fresh and race suites pass, archives are exactly once, and no secret/raw-output field is persisted. After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.

121
agent-task/m-iop-agent-cli-runtime/16+13_local_control/CODE_REVIEW-cloud-G10.md Normal file
View file

@ -0,0 +1,121 @@
<!-- task=m-iop-agent-cli-runtime/16+13_local_control plan=0 tag=API -->
# Code Review Reference - API
> **[IMPLEMENTING AGENT — READ FIRST] Filling this file is mandatory.**
> Fill actual evidence and stop with active files in place. Do not perform review-only finalization or ask the user for next-state decisions.
## Overview
date=2026-07-29
task=m-iop-agent-cli-runtime/16+13_local_control, plan=0, tag=API
## Roadmap Targets
- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
- `local-control`: daemon-owned same-user local proto-socket lifecycle, state, events, and control endpoints
- Completion mode: check-on-pass
## For the Review Agent
> **[REVIEW AGENT ONLY]** Implementing agents must not execute finalization.
Review protocol and authorization as one invariant. Append verdict/signals; archive `CODE_REVIEW-cloud-G10.md` → `code_review_cloud_G10_0.log` and `PLAN-cloud-G10.md` → `plan_cloud_G10_0.log`; on PASS write `complete.log`, archive the task, and report completion metadata without editing the roadmap.
## Implementation Item Completion
| Item | Status |
|------|--------|
| API-1 Protocol | [ ] |
| API-2 Same-user socket | [ ] |
| API-3 Ledger/replay | [ ] |
| API-4 Host dispatch | [ ] |
| API-5 Contract | [ ] |
## Implementation Checklist
- [ ] Define and generate the versioned local-control protobuf envelope, requests, responses, events, errors, snapshots, and operation payloads.
- [ ] Implement a daemon-owned Unix proto-socket with strict permissions and Linux/macOS same-user peer authorization before frame dispatch.
- [ ] Implement bounded frame validation, command-id idempotency, ordered event retention/replay, snapshot recovery, and safe typed errors.
- [ ] Bind read/project mutation operations to narrow host ports and prove rejected frames perform zero mutation.
- [ ] Update Makefile and the standalone contract with actual S11 transport/source/test paths.
- [ ] Run fresh protocol, security, restart, race, and Linux/Darwin build verification.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
## Review-Only Checklist
> **[REVIEW AGENT ONLY]** Implementing agents must not modify this checklist.
- [ ] Append one verdict and verified routing signals.
- [ ] Verify verdict, dimensions, and security finding classifications.
- [ ] Archive review as `code_review_cloud_G10_0.log`.
- [ ] Archive plan as `plan_cloud_G10_0.log`.
- [ ] Verify the Agent-Ops managed `.gitignore` block.
- [ ] If PASS, write canonical `complete.log` and leave no active Markdown files.
- [ ] If PASS, move the task to the dated archive and update this checklist there.
- [ ] If PASS, report `local-control` completion metadata without editing the roadmap.
- [ ] If PASS, remove an empty split parent or prove siblings/files remain.
- [ ] If WARN/FAIL, materialize the required next state without `complete.log`.
## Deviations from Plan
_Implementer: actual deviations or `None`._
## Key Design Decisions
_Implementer: actual decisions._
## Reviewer Checkpoints
- Peer UID is kernel-derived before frame dispatch; no token fallback exists.
- Socket ownership/mode and stale-path handling fail closed.
- Command acceptance, idempotency, events, replay, and snapshots survive restart.
- Protocol errors are bounded and redacted; rejected frames have zero mutations.
- Linux execution and Darwin cross-build evidence are present.
## Verification Results
### Protocol and security
```bash
go test -count=1 ./apps/agent/internal/localcontrol
go test -count=1 -race ./apps/agent/internal/localcontrol ./packages/go/agentstate
```
_Paste actual stdout/stderr._
### Generated source and Darwin
```bash
make proto
GOOS=darwin GOARCH=arm64 go test -c -o /tmp/localcontrol-darwin.test ./apps/agent/internal/localcontrol
```
_Paste actual stdout/stderr._
### Static verification
```bash
go vet ./apps/agent/internal/localcontrol
rg -n --sort path 'S11|agent.proto|localcontrol|same OS user|SO_PEERCRED|getpeereid' agent-contract/inner/iop-agent-cli-runtime.md apps/agent/internal/localcontrol proto/iop/agent.proto
git diff --check
```
_Paste actual stdout/stderr._
---
> **[IMPLEMENTING AGENT — BEFORE SAVING]** Fill every implementation-owned section and leave review-only content unchanged.
## Section Ownership
| Section | Owner | Note |
|---------|-------|------|
| Header, Overview, Roadmap Targets, Review Instructions | Fixed | Implementer must not modify |
| Implementation Item Completion, Implementation Checklist | Implementing agent | Check status only |
| Review-Only Checklist | Review agent | Implementer must not modify |
| Deviations, Decisions, Verification Results | Implementing agent | Record actual evidence |
| Reviewer Checkpoints | Fixed | Reviewer verifies them |
| Code Review Result and finalization | Review agent | Append/execute only after review |

282
agent-task/m-iop-agent-cli-runtime/16+13_local_control/PLAN-cloud-G10.md Normal file
View file

@ -0,0 +1,282 @@
<!-- task=m-iop-agent-cli-runtime/16+13_local_control plan=0 tag=API -->
# Same-User Local Control Proto-Socket
## For the Implementing Agent
Fill all implementation-owned sections in `CODE_REVIEW-cloud-G10.md` with actual code and command evidence. Leave the pair active and report ready for review. Only the official reviewer may classify next state, archive, write `complete.log`, or create control-plane artifacts. Record blockers and exact resume conditions in evidence fields only.
## Background
The standalone daemon must expose one local control boundary shared by future Flutter and Unity clients without moving runtime ownership into either client. The accepted contract requires protobuf frames, same-OS-user authorization, mutation idempotency, replayable events, and fail-closed recovery.
## Roadmap Targets
- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
- `local-control`: daemon-owned same-user local proto-socket lifecycle, state, events, and control endpoints
- Completion mode: check-on-pass
## Analysis
### Files Read
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- `agent-contract/index.md`
- `agent-contract/inner/agent-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `packages/go/agenttask/ports.go`
- `packages/go/agenttask/types.go`
- `packages/go/agentstate/store.go`
- `proto/iop/control.proto`
- `apps/control-plane/internal/wire/client.go`
- `apps/control-plane/internal/wire/client_test.go`
- `Makefile`
- `go.mod`
### SDD Criteria
Approved SDD scenario S11 maps to `local-control`. The Evidence Map requires a new local-control agent contract, OS-user socket boundary test, no app-token fallback, denied cross-user dispatch, and snapshot recovery. The checklist derives directly from envelope/version, operation, authorization, command-id, event sequence, replay-gap, and safe-error rows in `agent-contract/inner/iop-agent-cli-runtime.md`.
### Verification Context
No handoff was supplied. Local sources are `agent-test/local/rules.md`, platform-common smoke, and testing smoke. Current runner is Linux arm64 with Go 1.26.2; required production targets are Linux and macOS. External Verification Preflight: repo `/config/workspace/iop-s0`, branch `feature/iop-agent-cli-runtime`, analyzed HEAD `bf64b7d86511a527ff48ddf196e33531551e79a5`, dirty only for current roadmap/plan artifacts; local proto-socket module resolves at `../proto-socket/go`. Tests must use ephemeral Unix socket paths under a temp directory, no fixed ports/hosts, and no external services. Cross-compile Darwin arm64 and run Linux same-user integration locally. Cached output is not accepted.
### Test Coverage Gaps
- Existing proto-socket use is TCP/WebSocket and has no Unix listener or OS peer credential boundary.
- No `LocalControlEnvelope` protobuf exists.
- No persistent command-id ledger, replay cursor, or snapshot recovery test exists.
- A real cross-user process is not available in the current unprivileged runner; denied-peer behavior needs a credential-source seam plus exact UID mismatch trace.
### Symbol References
None. This adds a new protocol and application package. Existing `control.proto` remains the Control Plane client contract and must not be repurposed.
### Split Judgment
Authorization, command idempotency, replay, and mutation dispatch are one indivisible security invariant: no frame may reach a mutator before all gates pass. The packet depends on `13_standalone_host_foundation`; its `complete.log` is currently missing. S15 depends on this packet because client-process operations are added to this stable control service later.
### Scope Rationale
Do not modify Control Plane WebSocket behavior, add app tokens, implement Flutter/Unity clients, expose TCP, duplicate shared task state transitions, or invent cross-user fallback. Concrete client process operations remain S15. Generated protobuf files must come only from `make proto`.
### Final Routing
- evaluation_mode: `first-pass`
- finalizer: `finalize-task-policy.sh pair`
- build: `cloud-G10`, basis `grade-boundary`, filename `PLAN-cloud-G10.md`
- review: `cloud-G10`, basis `official-review`, filename `CODE_REVIEW-cloud-G10.md`
- large_indivisible_context: `true`
- positive loop risks: `cross-platform peer credentials`, `durable idempotency/replay invariant` (count `2`)
- recovery signals: rework `0`, evidence-integrity failure `false`
- capability-gap evidence: none; G10 grade boundary selected
## Implementation Checklist
- [ ] Define and generate the versioned local-control protobuf envelope, requests, responses, events, errors, snapshots, and operation payloads.
- [ ] Implement a daemon-owned Unix proto-socket with strict permissions and Linux/macOS same-user peer authorization before frame dispatch.
- [ ] Implement bounded frame validation, command-id idempotency, ordered event retention/replay, snapshot recovery, and safe typed errors.
- [ ] Bind read/project mutation operations to narrow host ports and prove rejected frames perform zero mutation.
- [ ] Update Makefile and the standalone contract with actual S11 transport/source/test paths.
- [ ] Run fresh protocol, security, restart, race, and Linux/Darwin build verification.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
### [API-1] Define the Local-Control Protocol
#### Problem
`proto/iop/control.proto:1-16` is owned by Control Plane communication, while `agent-contract/inner/iop-agent-cli-runtime.md:91-120` requires a distinct versioned local envelope and error/replay model.
#### Solution
Add `proto/iop/agent.proto` with explicit envelope kind/version, typed request/response/event/error payloads, stable operations, command id, correlation id, state revision, event sequence, replay floor, and snapshot-required metadata. Reserve unused fields and keep credentials/raw paths out.
```proto
message AgentLocalEnvelope {
uint32 protocol_version = 1;
AgentLocalKind kind = 2;
string message_id = 3;
string correlation_id = 4;
uint64 event_sequence = 5;
string operation = 6;
oneof payload { /* typed messages */ }
}
```
#### Modified Files and Checklist
- [ ] `proto/iop/agent.proto` — add the canonical protocol.
- [ ] `proto/gen/iop/agent.pb.go` — regenerate via `make proto`, never edit directly.
- [ ] `Makefile` — include `agent.proto` in Go protobuf generation.
#### Test Strategy
Protocol validation tests live in API-3 and cover version, kind/payload pairing, required IDs, unsupported fields/operations, and size limits.
#### Verification
```bash
make proto
cp proto/gen/iop/agent.pb.go /tmp/iop-agent.pb.go
make proto
cmp -s proto/gen/iop/agent.pb.go /tmp/iop-agent.pb.go
```
Expected: the second generation is byte-for-byte deterministic.
### [API-2] Enforce the Same-User Unix Socket Boundary
#### Problem
Existing `apps/control-plane/internal/wire/client.go:17-78` binds WebSocket/TCP and origin checks; it cannot prove a local OS user. The standalone contract requires same-effective-UID authorization and no token fallback.
#### Solution
Create a Unix listener under the configured state root, require owner-only parent and socket modes, reject symlink/non-socket replacement, and wrap accepted `net.Conn` with proto-socket communicator framing. Read kernel peer credentials using `SO_PEERCRED` on Linux and `getpeereid` on Darwin in build-tagged files. Unsupported platforms fail before listening. Authorize UID before constructing/dispatching a protocol session.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/localcontrol/server.go` — own listener/session lifecycle.
- [ ] `apps/agent/internal/localcontrol/peercred.go` — define credential seam.
- [ ] `apps/agent/internal/localcontrol/peercred_linux.go` — implement Linux peer UID.
- [ ] `apps/agent/internal/localcontrol/peercred_darwin.go` — implement Darwin peer UID.
- [ ] `apps/agent/internal/localcontrol/peercred_unsupported.go` — fail closed elsewhere.
- [ ] `apps/agent/internal/localcontrol/server_test.go` — verify permissions, same-user session, denied UID, and replacement attacks.
#### Test Strategy
Use a real Linux Unix connection for same-user evidence and injected peer credentials for exact UID mismatch/zero-dispatch evidence. Cross-build Darwin to verify build tags and API shape.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/localcontrol -run 'TestServer|TestPeer'
GOOS=darwin GOARCH=arm64 go test -c -o /tmp/localcontrol-darwin.test ./apps/agent/internal/localcontrol
```
Expected: Linux tests pass and Darwin test binary cross-compiles.
### [API-3] Implement Idempotency, Replay, and Safe Failures
#### Problem
`packages/go/agentstate/store.go:50-136` offers opaque CAS records, but no local-control ledger prevents duplicate mutations or restores event replay after daemon restart.
#### Solution
Persist a versioned local-control ledger in an `agentstate.Store` integration record. Hash operation plus canonical immutable arguments under each command ID; return the accepted response on identical replay and `command_id_conflict` on mismatch. Assign monotonic event sequences, retain a bounded window, return `replay_unavailable` with snapshot-required metadata for gaps, and keep safe error messages free of paths/credentials/output.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/localcontrol/protocol.go` — validate/decode/encode frames and safe errors.
- [ ] `apps/agent/internal/localcontrol/ledger.go` — persist idempotency and replay state.
- [ ] `apps/agent/internal/localcontrol/protocol_test.go` — protocol/error matrix.
- [ ] `apps/agent/internal/localcontrol/ledger_test.go` — duplicate/conflict/restart/replay matrix.
#### Test Strategy
Write `TestProtocolValidationMatrix`, `TestCommandIdempotencySurvivesRestart`, `TestCommandIDConflictHasZeroMutation`, and `TestReplayGapRequiresSnapshot`.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/localcontrol -run 'TestProtocol|TestCommand|TestReplay'
```
Expected: every malformed/unauthorized/conflicting frame has zero mutations and stable typed errors.
### [API-4] Dispatch Through Narrow Host Ports
#### Problem
The contract operation matrix at `agent-contract/inner/iop-agent-cli-runtime.md:103-112` requires coherent reads and delegated project mutations, but a transport must not become a second lifecycle owner.
#### Solution
Define a `Service` with read-only snapshot methods and project start/stop/resume methods implemented by host adapters. Validate authorization and idempotency before calling it. Emit accepted mutation events only after durable command acceptance; expose current snapshot revision and replay cursor.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/localcontrol/service.go` — define operation dispatch and host ports.
- [ ] `apps/agent/internal/localcontrol/service_test.go` — test every operation and zero-call rejection.
- [ ] `apps/agent/internal/localcontrol/server.go` — connect authorized sessions to the service.
#### Test Strategy
Write a recording fake and cover all read/project operations, unsupported client operations, repeated requests, cancellation, and concurrent subscribers.
#### Verification
```bash
go test -count=1 -race ./apps/agent/internal/localcontrol -run 'TestService|TestConcurrent'
```
Expected: operations delegate exactly once and concurrent subscribers are race-free.
### [API-5] Record Concrete S11 Sources
#### Problem
`agent-contract/inner/iop-agent-cli-runtime.md:13,30,41,143` intentionally leaves the transport unspecified until implementation.
#### Solution
Replace only the speculative S11 source status with actual proto, localcontrol, peer credential, and focused test paths. Record Unix proto-socket selection and supported OS behavior without copying protobuf definitions.
#### Modified Files and Checklist
- [ ] `agent-contract/inner/iop-agent-cli-runtime.md` — add concrete S11 implementation/evidence links.
#### Test Strategy
No new file; the S11 matrix above supplies evidence.
#### Verification
```bash
rg -n --sort path 'S11|agent.proto|localcontrol|same OS user|SO_PEERCRED|getpeereid' agent-contract/inner/iop-agent-cli-runtime.md apps/agent/internal/localcontrol proto/iop/agent.proto
```
Expected: actual sources and both supported authorization implementations are present.
## Dependencies and Execution Order
Predecessor `13_standalone_host_foundation` must have a same-group active or archived `complete.log`; it is currently missing. Complete API-1 before protocol code, API-2 before accepting sessions, then API-3/API-4, followed by API-5 and final verification.
## Modified Files Summary
| File | Item |
|------|------|
| `proto/iop/agent.proto` | API-1 |
| `proto/gen/iop/agent.pb.go` | API-1 |
| `Makefile` | API-1 |
| `apps/agent/internal/localcontrol/server.go` | API-2, API-4 |
| `apps/agent/internal/localcontrol/peercred.go` | API-2 |
| `apps/agent/internal/localcontrol/peercred_linux.go` | API-2 |
| `apps/agent/internal/localcontrol/peercred_darwin.go` | API-2 |
| `apps/agent/internal/localcontrol/peercred_unsupported.go` | API-2 |
| `apps/agent/internal/localcontrol/server_test.go` | API-2 |
| `apps/agent/internal/localcontrol/protocol.go` | API-3 |
| `apps/agent/internal/localcontrol/ledger.go` | API-3 |
| `apps/agent/internal/localcontrol/protocol_test.go` | API-3 |
| `apps/agent/internal/localcontrol/ledger_test.go` | API-3 |
| `apps/agent/internal/localcontrol/service.go` | API-4 |
| `apps/agent/internal/localcontrol/service_test.go` | API-4 |
| `agent-contract/inner/iop-agent-cli-runtime.md` | API-5 |
## Final Verification
```bash
gofmt -w apps/agent/internal/localcontrol/*.go
make proto
go test -count=1 ./apps/agent/internal/localcontrol
go test -count=1 -race ./apps/agent/internal/localcontrol ./packages/go/agentstate
go vet ./apps/agent/internal/localcontrol
GOOS=darwin GOARCH=arm64 go test -c -o /tmp/localcontrol-darwin.test ./apps/agent/internal/localcontrol
git diff --check
```
Expected: generated sources are stable, Linux security/restart/race tests pass, Darwin cross-build passes, and every rejected request has zero mutation. After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.

120
agent-task/m-iop-agent-cli-runtime/17+13,16_client_process_manager/CODE_REVIEW-cloud-G10.md Normal file
View file

@ -0,0 +1,120 @@
<!-- task=m-iop-agent-cli-runtime/17+13,16_client_process_manager plan=0 tag=API -->
# Code Review Reference - API
> **[IMPLEMENTING AGENT — READ FIRST] This file must be completed.**
> Fill implementation evidence and actual output, then stop with active files in place. Finalization belongs only to the official reviewer.
## Overview
date=2026-07-29
task=m-iop-agent-cli-runtime/17+13,16_client_process_manager, plan=0, tag=API
## Roadmap Targets
- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
- `client-process-manager`: daemon-owned Flutter/Unity start, stop, reconnect, crash recovery, and detail routing
- Completion mode: check-on-pass
## For the Review Agent
> **[REVIEW AGENT ONLY]** Implementing agents must not execute finalization.
Review daemon ownership, durable identity, authorization inheritance, and cleanup together. Append verdict/signals; archive the active pair to `code_review_cloud_G10_0.log` and `plan_cloud_G10_0.log`; on PASS write `complete.log`, archive the task, and report completion metadata without editing the roadmap.
## Implementation Item Completion
| Item | Status |
|------|--------|
| API-1 Client config | [ ] |
| API-2 Process ownership | [ ] |
| API-3 Persistence/reconcile | [ ] |
| API-4 Control operations | [ ] |
| API-5 S15 evidence | [ ] |
## Implementation Checklist
- [ ] Extend only user-local runtime configuration with strict Flutter/Unity process specs, launch/restart policy, and no environment/credential fields.
- [ ] Implement one daemon-owned process slot per client kind with PID/start identity, cancellation, reaping, duplicate convergence, and bounded crash restart.
- [ ] Persist client lifecycle records and reconcile live, exited, stale, and ambiguous identities without duplicate launch.
- [ ] Implement authenticated local-control client operations and Unity-detail-to-Flutter start/focus routing with command-id idempotency.
- [ ] Prove fixture process ownership, disconnect/crash/reconnect, duplicate launch, focus routing, and daemon survival under race.
- [ ] Update the standalone contract with actual S15 source/test paths and run Darwin cross-build verification.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
## Review-Only Checklist
> **[REVIEW AGENT ONLY]** Implementing agents must not modify this checklist.
- [ ] Append one verdict and verified routing signals.
- [ ] Verify verdict, dimensions, and finding classifications.
- [ ] Archive this review as `code_review_cloud_G10_0.log`.
- [ ] Archive the plan as `plan_cloud_G10_0.log`.
- [ ] Verify the Agent-Ops managed `.gitignore` block.
- [ ] If PASS, write canonical `complete.log` and leave no active Markdown files.
- [ ] If PASS, move the task to the dated archive and update this checklist there.
- [ ] If PASS, report `client-process-manager` completion metadata without editing the roadmap.
- [ ] If PASS, remove an empty split parent or prove siblings/files remain.
- [ ] If WARN/FAIL, materialize the required next state without `complete.log`.
## Deviations from Plan
_Implementer: actual deviations or `None`._
## Key Design Decisions
_Implementer: actual decisions._
## Reviewer Checkpoints
- Config remains user-local, strict, and environment/credential free.
- PID/start identity and one waiter prevent duplicate/adopted-process races.
- Ambiguous recovery blocks instead of launching.
- Unity detail can reach Flutter only through daemon start/focus.
- All helper children are reaped while daemon context remains live.
## Verification Results
### Focused and race suites
```bash
go test -count=1 ./packages/go/agentconfig ./apps/agent/internal/clientprocess ./apps/agent/internal/localcontrol
go test -count=1 -race ./apps/agent/internal/clientprocess ./apps/agent/internal/localcontrol ./packages/go/agentstate
```
_Paste actual stdout/stderr._
### S15 and Darwin
```bash
go test -count=1 -race ./apps/agent/internal/clientprocess ./apps/agent/internal/localcontrol -run 'TestS15|TestUnityDetail'
GOOS=darwin GOARCH=arm64 go test -c -o /tmp/clientprocess-darwin.test ./apps/agent/internal/clientprocess
```
_Paste actual stdout/stderr._
### Static verification
```bash
go vet ./packages/go/agentconfig ./apps/agent/internal/clientprocess ./apps/agent/internal/localcontrol
git diff --check
```
_Paste actual stdout/stderr._
---
> **[IMPLEMENTING AGENT — BEFORE SAVING]** Fill every implementation-owned section and leave review-only content unchanged.
## Section Ownership
| Section | Owner | Note |
|---------|-------|------|
| Header, Overview, Roadmap Targets, Review Instructions | Fixed | Implementer must not modify |
| Implementation Item Completion, Implementation Checklist | Implementing agent | Check status only |
| Review-Only Checklist | Review agent | Implementer must not modify |
| Deviations, Decisions, Verification Results | Implementing agent | Record actual evidence |
| Reviewer Checkpoints | Fixed | Reviewer verifies them |
| Code Review Result and finalization | Review agent | Append/execute only after review |

267
agent-task/m-iop-agent-cli-runtime/17+13,16_client_process_manager/PLAN-cloud-G10.md Normal file
View file

@ -0,0 +1,267 @@
<!-- task=m-iop-agent-cli-runtime/17+13,16_client_process_manager plan=0 tag=API -->
# Daemon-Owned Flutter and Unity Process Manager
## For the Implementing Agent
Complete all implementation-owned fields in `CODE_REVIEW-cloud-G10.md` with actual verification output, leave active artifacts in place, and report ready for review. The official reviewer alone owns next-state classification, logs, archives, and `complete.log`. Record blockers and resume evidence without asking the user or creating control-plane files.
## Background
The single device-local daemon must remain the only process owner for future Flutter and Unity clients. S15 requires duplicate-safe launch, crash/reconnect handling, and Unity detail routing through the daemon to Flutter without allowing client exit to stop runtime ownership.
## Roadmap Targets
- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
- `client-process-manager`: daemon-owned Flutter/Unity start, stop, reconnect, crash recovery, and detail routing
- Completion mode: check-on-pass
## Analysis
### Files Read
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- `agent-contract/inner/agent-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `packages/go/agentconfig/runtime_config.go`
- `packages/go/agentconfig/runtime_config_test.go`
- `packages/go/agentconfig/watcher.go`
- `packages/go/agentstate/store.go`
- `packages/go/agenttask/ports.go`
- `packages/go/agenttask/types.go`
- `go.mod`
### SDD Criteria
Approved SDD scenario S15 maps to `client-process-manager`. The Evidence Map requires fixture Flutter/Unity process ownership, duplicate launch convergence, disconnect/crash/reconnect, and Unity detail command evidence with PID/start/focus traces. The checklist also enforces the contract states `stopped|starting|connected|crashed`, user-local policy ownership, and daemon survival when clients exit.
### Verification Context
No handoff was supplied. Repository-native sources are local rules plus platform-common/testing smoke profiles. Current runner is Linux arm64 with Go 1.26.2; fixture clients must be the test binary itself (`-test.run=TestHelperProcess`) so no external Flutter/Unity SDK is required. Use fresh and race tests, process cleanup assertions, Darwin cross-build, `go vet`, and `git diff --check`. Cached output is not accepted.
### Test Coverage Gaps
- User-local config has no `ClientProcessSpec`.
- No daemon-owned subprocess manager or stable process identity record exists.
- No local-control handler binds client operations to a process owner.
- No test proves client exit leaves the host alive or Unity detail cannot bypass Flutter routing.
### Symbol References
`agentconfig.UserLocalRuntimeConfig`, `RuntimeConfig`, and their deep-copy/validation paths gain client specifications; all constructors/tests that compare these structs must be updated. Search call sites with the exact final verification command before editing.
### Split Judgment
Process state, durable identity, restart policy, and local-control commands are one invariant and stay together. Predecessors 13 and 16 are encoded in the directory name; neither currently has an active or archived `complete.log`. The manager consumes the completed S11 protocol rather than changing its security boundary.
### Scope Rationale
Do not implement Flutter or Unity application code, direct client-to-client IPC, launch arbitrary shell strings, inherit credential environment fields from config, or let a client stop/restart the daemon. Do not add login-service installation; only honor a validated launch policy when the daemon starts.
### Final Routing
- evaluation_mode: `first-pass`
- finalizer: `finalize-task-policy.sh pair`
- build: `cloud-G10`, basis `grade-boundary`, filename `PLAN-cloud-G10.md`
- review: `cloud-G10`, basis `official-review`, filename `CODE_REVIEW-cloud-G10.md`
- large_indivisible_context: `true`
- positive loop risks: `process identity/reaping`, `crash restart concurrency`, `control idempotency integration` (count `3`)
- recovery signals: rework `0`, evidence-integrity failure `false`
- capability-gap evidence: none
## Implementation Checklist
- [ ] Extend only user-local runtime configuration with strict Flutter/Unity process specs, launch/restart policy, and no environment/credential fields.
- [ ] Implement one daemon-owned process slot per client kind with PID/start identity, cancellation, reaping, duplicate convergence, and bounded crash restart.
- [ ] Persist client lifecycle records and reconcile live, exited, stale, and ambiguous identities without duplicate launch.
- [ ] Implement authenticated local-control client operations and Unity-detail-to-Flutter start/focus routing with command-id idempotency.
- [ ] Prove fixture process ownership, disconnect/crash/reconnect, duplicate launch, focus routing, and daemon survival under race.
- [ ] Update the standalone contract with actual S15 source/test paths and run Darwin cross-build verification.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
### [API-1] Add User-Local Client Process Specs
#### Problem
`packages/go/agentconfig/runtime_config.go:29-37` contains device and project data but no validated client executable or restart policy, although the contract assigns it to user-local config.
#### Solution
Add a `clients` map keyed only by `flutter` or `unity`. Define absolute executable, argument arrays, launch-on-daemon-start, restart-on-crash, bounded restart policy, and Flutter focus arguments. Reject repo-global client fields, arbitrary environment maps, relative executables, duplicate/unknown kinds, negative limits, and Unity detail configuration that bypasses Flutter.
```go
type ClientProcessSpec struct {
Executable string
Args []string
LaunchOnStart bool
RestartOnCrash bool
FocusArgs []string
}
```
#### Modified Files and Checklist
- [ ] `packages/go/agentconfig/runtime_config.go` — add strict user-local client specs, validation, merge/copy behavior.
- [ ] `packages/go/agentconfig/runtime_config_test.go` — cover valid/boundary/unknown/immutable cases.
- [ ] `configs/iop-agent.local.example.yaml` — add disabled fixture-shaped Flutter/Unity examples without device secrets.
#### Test Strategy
Add `TestClientProcessSpecsAreUserLocalAndImmutable` and `TestClientProcessSpecValidationMatrix`.
#### Verification
```bash
go test -count=1 ./packages/go/agentconfig -run 'TestClientProcess'
```
Expected: valid local specs load and all unsafe fields fail strict decode/validation.
### [API-2] Implement Singleton Process Ownership
#### Problem
`agent-contract/inner/iop-agent-cli-runtime.md:122-128` assigns client start, stop, reaping, focus, and duplicate suppression to the daemon, but no package implements that owner.
#### Solution
Add a manager with one locked slot per kind. Start only an argv vector with explicit working directory, record PID plus an OS-verified start identity, begin one waiter, and converge concurrent duplicate starts to the live record. Stop by exact identity, signal then bounded wait/kill, always reap, and never cancel the daemon context on client exit.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/clientprocess/manager.go` — implement lifecycle and per-kind concurrency.
- [ ] `apps/agent/internal/clientprocess/process.go` — wrap start identity, signaling, wait, and focus.
- [ ] `apps/agent/internal/clientprocess/types.go` — define states/records/results.
- [ ] `apps/agent/internal/clientprocess/manager_test.go` — test singleton, stop, reaping, focus, and daemon survival.
#### Test Strategy
Use the Go test helper process. Assert exactly one distinct PID, one waiter, no zombie, idempotent stop, and a still-live parent context after every child outcome.
#### Verification
```bash
go test -count=1 -race ./apps/agent/internal/clientprocess -run 'TestManager|TestDuplicate|TestDaemon'
```
Expected: all lifecycle and concurrency tests pass.
### [API-3] Persist and Reconcile Client State
#### Problem
`packages/go/agentstate/store.go:50-136` can persist opaque host records, but process ownership would be lost or duplicated after daemon restart without an identity-bound journal.
#### Solution
Store versioned client slots under an integration-record key. On restart inspect the exact PID/start token: adopt proven live processes, retain connected/disconnected projection, mark proven exits, and block ambiguous identity instead of launching a replacement. Apply restart policy only to a conclusively reaped daemon-owned crash, with a bounded backoff/attempt budget.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/clientprocess/store.go` — persist/reconcile CAS records.
- [ ] `apps/agent/internal/clientprocess/store_test.go` — cover live/exited/stale/ambiguous/restart cases.
- [ ] `apps/agent/internal/clientprocess/manager.go` — connect durable transitions.
#### Test Strategy
Inject inspector outcomes and CAS conflicts; restart a second manager over the same real state file and assert no second child starts for live/ambiguous records.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/clientprocess -run 'TestStore|TestReconcile|TestCrashRestart'
```
Expected: no duplicate launch and exact retained blocker/state.
### [API-4] Add Local-Control Client Operations
#### Problem
`agent-contract/inner/iop-agent-cli-runtime.md:103-112` establishes protocol operations/idempotency, but S15 still lacks implementations for `client.start`, `client.stop`, `client.focus`, and `client.detail`.
#### Solution
Add a client-operation adapter in the existing `localcontrol` package. Dispatch only after predecessor authorization and command acceptance. Route Unity `client.detail` to Flutter: start Flutter if absent, otherwise focus it, then return the Flutter process identity. Never call Unity-to-Flutter directly.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/localcontrol/client_operations.go` — implement client commands over a `clientprocess` port.
- [ ] `apps/agent/internal/localcontrol/client_operations_test.go` — verify authorization/idempotency inheritance and detail routing.
#### Test Strategy
Write `TestClientOperationMatrix`, `TestUnityDetailStartsOrFocusesFlutter`, and `TestRejectedClientCommandHasZeroProcessCalls`.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/localcontrol -run 'TestClient|TestUnity'
```
Expected: all paths route through the daemon manager exactly once.
### [API-5] Prove S15 and Record Sources
#### Problem
`agent-contract/inner/iop-agent-cli-runtime.md:41-43,122-128` has requirements but no concrete S15 source or lifecycle trace.
#### Solution
Add actual config, manager, store, control adapter, and test paths to the contract. Add one S15 fixture test that runs Flutter and Unity helpers, crashes/reconnects, performs duplicate launches and detail routing, and records a deterministic PID/start/focus trace without leaking process environment.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/clientprocess/manager_test.go` — add `TestS15ClientLifecycleTrace`.
- [ ] `agent-contract/inner/iop-agent-cli-runtime.md` — record actual S15 sources and evidence.
#### Test Strategy
Run the named test fresh and under race. Validate cleanup using exact child identities, not broad process searches.
#### Verification
```bash
go test -count=1 -race ./apps/agent/internal/clientprocess ./apps/agent/internal/localcontrol -run 'TestS15|TestUnityDetail'
GOOS=darwin GOARCH=arm64 go test -c -o /tmp/clientprocess-darwin.test ./apps/agent/internal/clientprocess
```
Expected: deterministic lifecycle trace and Darwin cross-build pass.
## Dependencies and Execution Order
Required predecessor directories are `13_standalone_host_foundation` and `16+13_local_control`. Each must produce one same-group active or archived `complete.log`; both are currently missing. After they complete, implement API-1, then API-2/API-3, then API-4/API-5.
## Modified Files Summary
| File | Item |
|------|------|
| `packages/go/agentconfig/runtime_config.go` | API-1 |
| `packages/go/agentconfig/runtime_config_test.go` | API-1 |
| `configs/iop-agent.local.example.yaml` | API-1 |
| `apps/agent/internal/clientprocess/manager.go` | API-2, API-3 |
| `apps/agent/internal/clientprocess/process.go` | API-2 |
| `apps/agent/internal/clientprocess/types.go` | API-2 |
| `apps/agent/internal/clientprocess/manager_test.go` | API-2, API-5 |
| `apps/agent/internal/clientprocess/store.go` | API-3 |
| `apps/agent/internal/clientprocess/store_test.go` | API-3 |
| `apps/agent/internal/localcontrol/client_operations.go` | API-4 |
| `apps/agent/internal/localcontrol/client_operations_test.go` | API-4 |
| `agent-contract/inner/iop-agent-cli-runtime.md` | API-5 |
## Final Verification
```bash
gofmt -w packages/go/agentconfig/runtime_config.go packages/go/agentconfig/runtime_config_test.go apps/agent/internal/clientprocess/*.go apps/agent/internal/localcontrol/client_operations.go apps/agent/internal/localcontrol/client_operations_test.go
go test -count=1 ./packages/go/agentconfig ./apps/agent/internal/clientprocess ./apps/agent/internal/localcontrol
go test -count=1 -race ./apps/agent/internal/clientprocess ./apps/agent/internal/localcontrol ./packages/go/agentstate
go vet ./packages/go/agentconfig ./apps/agent/internal/clientprocess ./apps/agent/internal/localcontrol
GOOS=darwin GOARCH=arm64 go test -c -o /tmp/clientprocess-darwin.test ./apps/agent/internal/clientprocess
git diff --check
```
Expected: config, lifecycle, persistence, control routing, race, vet, Darwin build, and diff checks pass with no orphaned fixture process. After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.

131
agent-task/m-iop-agent-cli-runtime/18+14,15,16,17_logged_smoke/CODE_REVIEW-cloud-G07.md Normal file
View file

@ -0,0 +1,131 @@
<!-- task=m-iop-agent-cli-runtime/18+14,15,16,17_logged_smoke plan=0 tag=TEST -->
# Code Review Reference - TEST
> **[IMPLEMENTING AGENT — READ FIRST] Filling this file is mandatory.**
> Paste actual local and field evidence. If macOS preflight blocks, record it exactly and leave the active pair; do not fabricate success or perform reviewer finalization.
## Overview
date=2026-07-29
task=m-iop-agent-cli-runtime/18+14,15,16,17_logged_smoke, plan=0, tag=TEST
## Roadmap Targets
- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
- `logged-smoke`: authenticated macOS discovery-through-completion multi-project field validation
- Completion mode: check-on-pass
## For the Review Agent
> **[REVIEW AGENT ONLY]** Implementing agents must not execute finalization.
Require an actual schema-valid redacted macOS manifest for PASS. Append verdict/signals; archive the pair to `code_review_cloud_G07_0.log` and `plan_cloud_G07_0.log`; on PASS write `complete.log`, archive the task, and report completion metadata without editing the roadmap. External absence requires a normal follow-up, not a waiver.
## Implementation Item Completion
| Item | Status |
|------|--------|
| TEST-1 Daemon wiring | [ ] |
| TEST-2 Harness/preflight | [ ] |
| TEST-3 S14 lifecycle | [ ] |
| TEST-4 Redaction | [ ] |
| TEST-5 Make targets | [ ] |
## Implementation Checklist
- [ ] Wire the completed host, project-log, local-control, and client-process components into one daemon lifecycle without adding fallback implementations.
- [ ] Add a fail-fast, cleanup-safe macOS field harness with exact source/binary/config/login/workspace/socket/process preflight.
- [ ] Cover discovery, preview/start, stream/log, quota/status, cancel, new invocation, daemon restart/recovery, independent project failure, and completion.
- [ ] Emit and validate a bounded redacted manifest containing commit/binary/config revisions, provider readiness states, project pseudonyms, step results, and evidence locators.
- [ ] Add Makefile entry points and locally verify help/preflight/redaction/cleanup behavior without claiming S14 completion.
- [ ] Execute the harness on an actual logged-in macOS runner and paste the redacted manifest plus exact command output.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
## Review-Only Checklist
> **[REVIEW AGENT ONLY]** Implementing agents must not modify this checklist.
- [ ] Append one verdict and verified routing signals.
- [ ] Verify field evidence, dimensions, and finding classifications.
- [ ] Archive review as `code_review_cloud_G07_0.log`.
- [ ] Archive plan as `plan_cloud_G07_0.log`.
- [ ] Verify the Agent-Ops managed `.gitignore` block.
- [ ] If PASS, write canonical `complete.log` and leave no active Markdown files.
- [ ] If PASS, move the task to the dated archive and update this checklist there.
- [ ] If PASS, report `logged-smoke` completion metadata without editing the roadmap.
- [ ] If PASS, remove an empty split parent or prove siblings/files remain.
- [ ] If WARN/FAIL, create the exact next state without `complete.log`.
## Deviations from Plan
_Implementer: actual deviations/blocker or `None`._
## Key Design Decisions
_Implementer: actual decisions._
## Reviewer Checkpoints
- Current Linux output is never presented as S14 field completion.
- The macOS runner matches reviewed commit/binary/config revisions.
- Two distinct clean clones and actual CLI-owned logins are proven without secrets.
- Cancellation/failure of one project does not stop the sibling.
- Restart recovery and terminal archives preserve exact identities.
- Manifest schema/redaction searches pass and raw logs stay operator-local.
## Verification Results
### Local harness
```bash
bash -n scripts/e2e-iop-agent-logged-smoke.sh
scripts/e2e-iop-agent-logged-smoke.sh --help
go test -count=1 -race ./apps/agent/internal/bootstrap ./apps/agent/cmd/agent
make build-agent
```
_Paste actual stdout/stderr._
### External preflight and field run
```bash
scripts/e2e-iop-agent-logged-smoke.sh \
--binary "$PWD/build/bin/iop-agent" \
--repo-config "$PWD/configs/iop-agent.runtime.yaml" \
--local-config "$IOP_AGENT_SMOKE_LOCAL_CONFIG" \
--provider-catalog "$PWD/configs/iop-agent.providers.yaml" \
--project-a "$IOP_AGENT_SMOKE_PROJECT_A" \
--project-b "$IOP_AGENT_SMOKE_PROJECT_B" \
--expected-head "$(git rev-parse HEAD)" \
--output "$IOP_AGENT_SMOKE_OUTPUT"
```
_Paste actual macOS stdout/stderr or exact blocker and resume condition._
### Manifest validation
```bash
scripts/e2e-iop-agent-logged-smoke.sh --validate-manifest "$IOP_AGENT_SMOKE_OUTPUT/manifest.json"
rg -n -i 'authorization|bearer|api[_-]?key|token|/Users/|/home/' "$IOP_AGENT_SMOKE_OUTPUT/manifest.json" && exit 1 || true
git diff --check
```
_Paste actual stdout/stderr and the redacted manifest._
---
> **[IMPLEMENTING AGENT — BEFORE SAVING]** Fill every implementation-owned section and leave review-only content unchanged.
## Section Ownership
| Section | Owner | Note |
|---------|-------|------|
| Header, Overview, Roadmap Targets, Review Instructions | Fixed | Implementer must not modify |
| Implementation Item Completion, Implementation Checklist | Implementing agent | Check status only |
| Review-Only Checklist | Review agent | Implementer must not modify |
| Deviations, Decisions, Verification Results | Implementing agent | Record actual local/field evidence |
| Reviewer Checkpoints | Fixed | Reviewer verifies them |
| Code Review Result and finalization | Review agent | Append/execute only after review |

275
agent-task/m-iop-agent-cli-runtime/18+14,15,16,17_logged_smoke/PLAN-cloud-G07.md Normal file
View file

@ -0,0 +1,275 @@
<!-- task=m-iop-agent-cli-runtime/18+14,15,16,17_logged_smoke plan=0 tag=TEST -->
# Logged-in macOS Multi-Project Smoke
## For the Implementing Agent
Fill implementation-owned sections in `CODE_REVIEW-cloud-G07.md` with actual outputs. Keep the active pair in place and report ready for review. If the required macOS/login runner is unavailable, implement and locally verify the harness, then record the exact failed preflight and setup/resume command; do not fabricate field evidence, ask the user directly, create stop files, or finalize the task.
## Background
Unit and integration tests cannot prove real CLI authentication, process lifecycle, cancellation, restart recovery, and project isolation together. S14 therefore requires a redacted field manifest from an actual logged-in macOS device with at least two registered project clones.
## Roadmap Targets
- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
- `logged-smoke`: authenticated macOS discovery-through-completion multi-project field validation
- Completion mode: check-on-pass
## Analysis
### Files Read
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- `agent-contract/inner/agent-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `configs/iop-agent.providers.yaml`
- `packages/go/agentconfig/runtime_config.go`
- `packages/go/agenttask/types.go`
- `scripts/e2e-openai-cli-workspace.sh`
- `Makefile`
- `agent-test/local/rules.md`
- `agent-test/local/profiles/platform-common-smoke.md`
- `agent-test/local/profiles/testing-smoke.md`
### SDD Criteria
Approved SDD scenario S14 maps to `logged-smoke`. Its Evidence Map requires an actual logged-in macOS multi-project field manifest. The run must cover discovery, run/stream, quota/status, cancel, a new invocation after cancel, daemon restart/recovery, completion, per-project logs, and proof that one project failure does not stop the other, without recording credentials.
### Verification Context
No handoff was supplied. External Verification Preflight observed:
- runner: current container, repo `/config/workspace/iop-s0`
- OS/arch: `Linux aarch64` — mismatch; required `Darwin arm64|x86_64`
- branch/HEAD: `feature/iop-agent-cli-runtime` / `bf64b7d86511a527ff48ddf196e33531551e79a5` at analysis
- dirty state: roadmap synchronization plus these active plan artifacts only
- source sync: no macOS checkout supplied
- binary: `build/bin/iop-agent` absent at analysis
- CLI paths: `codex`, `claude`, `pi`, and `agy` are on current PATH; login state was not probed to avoid claiming field readiness from the wrong OS
- config: repo provider catalog exists; user-local macOS config path not supplied
- runtime identity/socket/process: none; no daemon is running
- ports/external hosts: no TCP port is required; the local Unix socket must be under the user-local state root; provider network hosts remain CLI-owned
Exact resume setup: on a logged-in macOS runner, sync the same reviewed commit, run `make build-agent`, prepare a user-local config with two clean registered clones, verify catalog-declared CLI logins with their status commands, and invoke the harness with explicit binary/config/workspace/expected-HEAD arguments. Current Linux cannot satisfy S14, so field execution is an expected external blocker until that setup exists. Confidence is high for harness-local checks and low for external result until executed.
### Test Coverage Gaps
- No authenticated `iop-agent` smoke exists.
- Existing workspace smoke uses a synthetic shell adapter and Edge/Node, not the standalone host.
- No test restarts the built daemon while two real provider tasks are independently active.
- No redacted manifest schema prevents accidental credential/path leakage.
### Symbol References
None. Integration wiring uses the completed predecessor package APIs; any signature drift must be recorded as a plan deviation rather than guessed.
### Split Judgment
This external packet is intentionally isolated so it can block without withholding implementation completion. It depends on indices 14, 15, 16, and 17; all four `complete.log` files are currently missing. Its stable PASS output is a deterministic harness plus one redacted field manifest from the exact built commit.
### Scope Rationale
Do not change provider authentication, download CLIs, add tokens, use the current working checkout as a provider workspace, or put raw paths/provider output in tracked files. Do not use synthetic adapters as S14 completion evidence. Product integration fixes discovered by the smoke are allowed only in the listed bootstrap/main files and must remain within predecessor contracts.
### Final Routing
- evaluation_mode: `first-pass`
- finalizer: `finalize-task-policy.sh pair`
- build: `cloud-G07`, basis `capability-gap`, filename `PLAN-cloud-G07.md`
- review: `cloud-G07`, basis `official-review`, filename `CODE_REVIEW-cloud-G07.md`
- large_indivisible_context: `false`
- positive loop risks: `external macOS state`, `authenticated provider variability`, `multi-process cleanup` (count `3`)
- recovery signals: rework `0`, evidence-integrity failure `false`
- capability-gap evidence: current runner is Linux and has no built binary/user-local macOS configuration
## Implementation Checklist
- [ ] Wire the completed host, project-log, local-control, and client-process components into one daemon lifecycle without adding fallback implementations.
- [ ] Add a fail-fast, cleanup-safe macOS field harness with exact source/binary/config/login/workspace/socket/process preflight.
- [ ] Cover discovery, preview/start, stream/log, quota/status, cancel, new invocation, daemon restart/recovery, independent project failure, and completion.
- [ ] Emit and validate a bounded redacted manifest containing commit/binary/config revisions, provider readiness states, project pseudonyms, step results, and evidence locators.
- [ ] Add Makefile entry points and locally verify help/preflight/redaction/cleanup behavior without claiming S14 completion.
- [ ] Execute the harness on an actual logged-in macOS runner and paste the redacted manifest plus exact command output.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
### [TEST-1] Wire the Complete Daemon
#### Problem
`agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md:156,181` requires one production binary to exercise the integrated S14 lifecycle, while the predecessor packets expose components independently.
#### Solution
Update bootstrap composition and the CLI entry point to construct project logs, local control, and client processes from the same immutable runtime snapshot/state store, then start/stop them through the host. Fail startup atomically and keep provider/runtime ownership alive when a client exits.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/bootstrap/module.go` — compose all completed adapters.
- [ ] `apps/agent/internal/bootstrap/module_test.go` — test wiring/order/rollback.
- [ ] `apps/agent/cmd/agent/main.go` — use production composition.
- [ ] `apps/agent/cmd/agent/main_test.go` — test serve cancellation and component cleanup.
#### Test Strategy
Add production-composition tests with temp roots and fake provider ports. Do not use live logins here.
#### Verification
```bash
go test -count=1 -race ./apps/agent/internal/bootstrap ./apps/agent/cmd/agent
```
Expected: lifecycle order and cleanup pass without races.
### [TEST-2] Add the Field Harness and Preflight
#### Problem
`agent-test/local/rules.md:1` governs external preflight, but no standalone script proves runner/source/binary/config/login/workspace assumptions before authenticated work.
#### Solution
Add `scripts/e2e-iop-agent-logged-smoke.sh` with explicit required flags. Require Darwin, supported arch, clean synced commit, exact binary SHA, executable/version output, catalog-declared auth status, two distinct clean clones, valid config, owner-only state root/socket, and no pre-existing daemon. Create only per-run temp/output roots, install traps before process start, and target exact recorded PIDs for cleanup.
#### Modified Files and Checklist
- [ ] `scripts/e2e-iop-agent-logged-smoke.sh` — implement preflight, steps, cleanup, and manifest.
- [ ] `scripts/fixtures/iop-agent-smoke-manifest.schema.json` — define bounded redacted output.
#### Test Strategy
Expose `--preflight-only` and `--validate-manifest`. On Linux, assert a deterministic OS mismatch before login/process calls. Test redaction with synthetic secret/path fixtures under `/tmp`.
#### Verification
```bash
bash -n scripts/e2e-iop-agent-logged-smoke.sh
scripts/e2e-iop-agent-logged-smoke.sh --help
preflight_output=$(mktemp)
if scripts/e2e-iop-agent-logged-smoke.sh --preflight-only >"$preflight_output" 2>&1; then exit 1; fi
test "$(rg -c 'requires Darwin' "$preflight_output")" = 1
```
Expected: syntax/help pass and Linux fails exactly at the OS gate.
### [TEST-3] Exercise the S14 Lifecycle
#### Problem
`agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md:156` requires discovery through completion, but no field sequence orchestrates it.
#### Solution
In the harness, validate configs; record provider readiness; list projects; preview both; start two distinct selected work units; observe stream/project log sequences; capture quota/status; cancel one; verify the sibling continues; start a new invocation; terminate/restart only the daemon; prove locator/state recovery; wait for terminal completion; and check per-project log/archive identity. Every wait has a deadline and focused diagnostic capture.
#### Modified Files and Checklist
- [ ] `scripts/e2e-iop-agent-logged-smoke.sh` — add the exact S14 sequence and assertions.
#### Test Strategy
The real field run is mandatory. Synthetic preflight tests cannot replace it.
#### Verification
```bash
scripts/e2e-iop-agent-logged-smoke.sh \
--binary "$PWD/build/bin/iop-agent" \
--repo-config "$PWD/configs/iop-agent.runtime.yaml" \
--local-config "$IOP_AGENT_SMOKE_LOCAL_CONFIG" \
--provider-catalog "$PWD/configs/iop-agent.providers.yaml" \
--project-a "$IOP_AGENT_SMOKE_PROJECT_A" \
--project-b "$IOP_AGENT_SMOKE_PROJECT_B" \
--expected-head "$(git rev-parse HEAD)" \
--output "$IOP_AGENT_SMOKE_OUTPUT"
```
Expected: exit 0 on logged-in macOS and a schema-valid redacted manifest.
### [TEST-4] Validate Evidence Redaction
#### Problem
`agent-contract/inner/iop-agent-cli-runtime.md:119-120,137` prohibits unsafe/raw local data, but no S14 evidence schema prevents provider output or device paths from leaking into task evidence.
#### Solution
Manifest records only provider IDs/readiness enums, hashed project aliases, commit/binary/config revisions, command step/status/duration, safe blocker codes, and relative evidence locator IDs. Reject token-like keys, authorization text, home paths, raw environment, prompts, and unbounded stdout/stderr. Save raw logs only in the operator-owned output root and cite their redacted locator/checksum.
#### Modified Files and Checklist
- [ ] `scripts/e2e-iop-agent-logged-smoke.sh` — enforce redaction and size bounds.
- [ ] `scripts/fixtures/iop-agent-smoke-manifest.schema.json` — constrain allowed fields.
#### Test Strategy
Feed a synthetic manifest containing token/path/auth fields and require validation failure; validate a safe fixture generated in `/tmp`.
#### Verification
```bash
scripts/e2e-iop-agent-logged-smoke.sh --validate-manifest "$IOP_AGENT_SMOKE_OUTPUT/manifest.json"
rg -n -i 'authorization|bearer|api[_-]?key|token|/Users/|/home/' "$IOP_AGENT_SMOKE_OUTPUT/manifest.json" && exit 1 || true
```
Expected: schema validation passes and forbidden search has zero matches.
### [TEST-5] Add Stable Make Targets
#### Problem
`Makefile:82-95` has smoke targets but none for standalone logged-in validation.
#### Solution
Add `test-iop-agent-logged-smoke-preflight` and `test-iop-agent-logged-smoke`. The field target must require explicit environment paths and never silently fall back to synthetic workspaces.
#### Modified Files and Checklist
- [ ] `Makefile` — add preflight and field targets.
#### Test Strategy
Run help/preflight on the current runner and confirm deterministic failure before authentication.
#### Verification
```bash
make test-iop-agent-logged-smoke-preflight
```
Expected on Linux: target returns the documented Darwin mismatch; on the field runner it passes all preflight gates.
## Dependencies and Execution Order
The runtime directory requires completed predecessors `14+13_cli_surface`, `15+13_project_logs`, `16+13_local_control`, and `17+13,16_client_process_manager`. Each must have one same-group active or archived `complete.log`; all are currently missing. Implement TEST-1 before the harness field run, then TEST-2/4/5, then TEST-3 on macOS.
## Modified Files Summary
| File | Item |
|------|------|
| `apps/agent/internal/bootstrap/module.go` | TEST-1 |
| `apps/agent/internal/bootstrap/module_test.go` | TEST-1 |
| `apps/agent/cmd/agent/main.go` | TEST-1 |
| `apps/agent/cmd/agent/main_test.go` | TEST-1 |
| `scripts/e2e-iop-agent-logged-smoke.sh` | TEST-2, TEST-3, TEST-4 |
| `scripts/fixtures/iop-agent-smoke-manifest.schema.json` | TEST-2, TEST-4 |
| `Makefile` | TEST-5 |
## Final Verification
```bash
gofmt -w apps/agent/internal/bootstrap/module.go apps/agent/internal/bootstrap/module_test.go apps/agent/cmd/agent/main.go apps/agent/cmd/agent/main_test.go
bash -n scripts/e2e-iop-agent-logged-smoke.sh
go test -count=1 -race ./apps/agent/internal/bootstrap ./apps/agent/cmd/agent
go vet ./apps/agent/internal/bootstrap ./apps/agent/cmd/agent
scripts/e2e-iop-agent-logged-smoke.sh --help
make build-agent
git diff --check
```
Then run the exact TEST-3 field command on the logged-in macOS runner and validate its manifest. Expected: all local checks pass and the field run exits 0; otherwise paste the exact preflight blocker and resume command without claiming S14. After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.

136
agent-task/m-iop-agent-cli-runtime/19+14,15,16,17,18_parity_cutover/CODE_REVIEW-cloud-G10.md Normal file
View file

@ -0,0 +1,136 @@
<!-- task=m-iop-agent-cli-runtime/19+14,15,16,17,18_parity_cutover plan=0 tag=REFACTOR -->
# Code Review Reference - REFACTOR
> **[IMPLEMENTING AGENT — READ FIRST] Filling this file is mandatory.**
> Fill every implementation field and paste actual outputs. Leave active files in place. Unclassified rows or non-zero dependency searches are blockers, not waiver candidates.
## Overview
date=2026-07-29
task=m-iop-agent-cli-runtime/19+14,15,16,17,18_parity_cutover, plan=0, tag=REFACTOR
## Roadmap Targets
- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
- `parity-cutover`: classify Python/Node behavior and cut production task-loop ownership to Go with zero unclassified/runtime dependency/duplicate
- Completion mode: check-on-pass
## For the Review Agent
> **[REVIEW AGENT ONLY]** Implementing agents must not execute finalization.
Require zero unclassified behavior and zero production Python/static/duplicate match. Append verdict/signals; archive the pair to `code_review_cloud_G10_0.log` and `plan_cloud_G10_0.log`; on PASS write `complete.log`, archive the task, and report completion metadata without editing the roadmap. Verify disposal remains reserved for the Milestone completion transition.
## Implementation Item Completion
| Item | Status |
|------|--------|
| REFACTOR-1 Disposition matrix | [ ] |
| REFACTOR-2 Go adapters | [ ] |
| REFACTOR-3 Go command | [ ] |
| REFACTOR-4 Skill cutover | [ ] |
| REFACTOR-5 Guards | [ ] |
| REFACTOR-6 Disposal evidence | [ ] |
| REFACTOR-7 Contract/regression | [ ] |
## Implementation Checklist
- [ ] Create a machine-validated disposition matrix covering every Python dispatcher/selector/observation and Node reference behavior as absorb, replace, or not-applicable.
- [ ] Implement standalone workflow, selection, provider, recovery, evidence, review, integration, and event adapters strictly over existing common Go contracts.
- [ ] Compose and test the production Go task-loop command, including dry-run, task-group filtering, retry-blocked, dependency-ready concurrency, lifecycle recovery, and terminal exit states.
- [ ] Redirect the project orchestration skill and testing rules to `iop-agent task-loop` and remove static model/route/capacity ownership from those surfaces.
- [ ] Add deterministic guards for zero unclassified rows, zero Python production callers/fallbacks, zero stale route/cap text, and zero Node duplicate implementation.
- [ ] Record exact Python reference-fixture disposal paths/checksums and the Milestone-completion deletion/verification procedure without deleting them before parity evidence closes.
- [ ] Update the standalone contract with actual S13 sources and run fresh package/full/race/vet/dry-run/cutover verification.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
## Review-Only Checklist
> **[REVIEW AGENT ONLY]** Implementing agents must not modify this checklist.
- [ ] Append one verdict and verified routing signals.
- [ ] Verify dimensions, findings, and every zero-match claim.
- [ ] Archive review as `code_review_cloud_G10_0.log`.
- [ ] Archive plan as `plan_cloud_G10_0.log`.
- [ ] Verify the Agent-Ops managed `.gitignore` block.
- [ ] If PASS, write canonical `complete.log` and leave no active Markdown files.
- [ ] If PASS, move the task to the dated archive and update this checklist there.
- [ ] If PASS, report `parity-cutover` completion metadata without editing the roadmap.
- [ ] If PASS, remove an empty split parent or prove siblings/files remain.
- [ ] If WARN/FAIL, materialize the exact next state without `complete.log`.
## Deviations from Plan
_Implementer: actual deviations/blockers or `None`._
## Key Design Decisions
_Implementer: actual decisions._
## Reviewer Checkpoints
- Every behavior row has one disposition and concrete Go evidence.
- Application adapters translate only; common packages retain lifecycle/policy/integration ownership.
- Skill production entry is Go and has no static provider/model/capacity table.
- Full tests do not invoke real providers.
- Python reference files have zero production callers and exact checksum disposal inventory.
- Node remains a consumer of common provider/runtime packages, not a duplicate owner.
## Verification Results
### Focused and race
```bash
go test -count=1 ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/cmd/agent
go test -count=1 -race ./apps/agent/internal/taskloop ./packages/go/agenttask ./packages/go/agentstate
```
_Paste actual stdout/stderr._
### Full regression and static analysis
```bash
go test -count=1 ./packages/go/... ./apps/agent/...
go vet ./packages/go/... ./apps/agent/...
make test-iop-agent-parity
```
_Paste actual stdout/stderr._
### Production cutover
```bash
make build-agent
build/bin/iop-agent task-loop --help
build/bin/iop-agent task-loop --dry-run --task-group m-iop-agent-cli-runtime
build/bin/iop-agent task-loop parity --disposal-manifest
```
_Paste actual stdout/stderr._
### Zero-match and diff evidence
```bash
rg -n --sort path 'dispatch\\.py|python3 .*orchestrate-agent-task-loop|gpt-5\\.6|claude-opus|Gemini|ornith|laguna' agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md agent-ops/rules/project/domain/testing/rules.md agent-ops/rules/project/rules.md
git diff --check
```
_Paste actual stdout/stderr; `rg` must exit 1 with no matches._
---
> **[IMPLEMENTING AGENT — BEFORE SAVING]** Fill every implementation-owned section and leave review-only content unchanged.
## Section Ownership
| Section | Owner | Note |
|---------|-------|------|
| Header, Overview, Roadmap Targets, Review Instructions | Fixed | Implementer must not modify |
| Implementation Item Completion, Implementation Checklist | Implementing agent | Check status only |
| Review-Only Checklist | Review agent | Implementer must not modify |
| Deviations, Decisions, Verification Results | Implementing agent | Record actual evidence |
| Reviewer Checkpoints | Fixed | Reviewer verifies them |
| Code Review Result and finalization | Review agent | Append/execute only after review |

369
agent-task/m-iop-agent-cli-runtime/19+14,15,16,17,18_parity_cutover/PLAN-cloud-G10.md Normal file
View file

@ -0,0 +1,369 @@
<!-- task=m-iop-agent-cli-runtime/19+14,15,16,17,18_parity_cutover plan=0 tag=REFACTOR -->
# Go Task-Loop Parity and Production Cutover
## For the Implementing Agent
Fill every implementation-owned section in `CODE_REVIEW-cloud-G10.md` with actual evidence and leave active files in place. Only the official reviewer owns verdict, archives, `complete.log`, and next-state classification. If a parity row or verification remains unresolved, record it as a blocker; do not waive it, ask the user, or fabricate zero-match evidence.
## Background
The Python dispatcher is the stabilized behavioral reference, while the accepted architecture makes the Go standalone runtime the production owner. This final packet composes the previously completed common packages and host features, proves a disposition-complete parity matrix, and redirects the project skill to the `iop-agent` entry point with no Python runtime dependency.
## Roadmap Targets
- Milestone: `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- Milestone link: [Milestone 문서](agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md)
- Task ids:
- `parity-cutover`: classify Python/Node behavior and cut production task-loop ownership to Go with zero unclassified/runtime dependency/duplicate
- Completion mode: check-on-pass
## Analysis
### Files Read
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-cli-runtime.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md`
- `agent-contract/index.md`
- `agent-contract/inner/agent-runtime.md`
- `agent-contract/inner/iop-agent-cli-runtime.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md`
- `agent-ops/skills/project/orchestrate-agent-task-loop/agents/openai.yaml`
- `agent-ops/skills/project/orchestrate-agent-task-loop/scripts/execution_target_policy.py`
- `agent-ops/skills/project/orchestrate-agent-task-loop/scripts/dispatcher_observation.py`
- `agent-ops/rules/project/rules.md`
- `agent-ops/rules/project/domain/testing/rules.md`
- `packages/go/agentconfig/runtime_config.go`
- `packages/go/agentconfig/runtime_config_test.go`
- `packages/go/agenttask/ports.go`
- `packages/go/agenttask/types.go`
- `packages/go/agentstate/store.go`
- `configs/iop-agent.providers.yaml`
- `Makefile`
### SDD Criteria
Approved scenario S13 maps to `parity-cutover`. Its Evidence Map requires a complete `absorb|replace|not-applicable` matrix, stale dependency/duplicate/Python fallback searches, zero unclassified rows, and Python disposal evidence at Milestone completion transition. The packet therefore makes Go the only production route and marks each reference file disposal-ready; reference Python sources may remain only until the explicit Milestone completion transition stated by the Milestone/SDD, and must have zero production callers before this task can PASS.
### Verification Context
No handoff was supplied. Local sources are `agent-test/local/rules.md` and platform-common/testing smoke profiles. Current runner is Linux arm64, Go 1.26.2, repo `/config/workspace/iop-s0`, branch `feature/iop-agent-cli-runtime`, analyzed HEAD `bf64b7d86511a527ff48ddf196e33531551e79a5`. The external S14 packet is a predecessor, so this packet consumes its redacted manifest rather than rerunning provider login smoke. Use fresh focused/full Go tests, race, vet, deterministic `rg --sort path` searches, Go command dry-run fixtures, and `git diff --check`. Cached results are not accepted.
### Test Coverage Gaps
- Common manager/provider/workspace packages exist, but no standalone task-loop adapter composes every required port.
- Python behavior is distributed across a large dispatcher/test suite and has no machine-validated disposition file.
- The project skill and testing rule still name `dispatch.py`.
- No zero-match guard prevents static route/model/capability tables or a Node-local duplicate from returning after cutover.
- Python physical deletion is intentionally reserved for Milestone completion transition; this packet must produce an exact disposal manifest and zero runtime callers first.
### Symbol References
- Production command references to `dispatch.py` occur in `agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md` and `agent-ops/rules/project/domain/testing/rules.md`; both are replaced.
- `agent-ops/rules/project/rules.md` maps the legacy dispatcher script/test paths and must be reclassified as reference-fixture-only until completion disposal.
- No shared Go symbol is renamed. The new task-loop adapters implement existing `agenttask` ports.
### Split Judgment
The cutover is indivisible: switching the skill before port composition/parity proof breaks the operator path, while proving parity without switching leaves Python in production. Required predecessors 14, 15, 16, 17, and 18 are encoded; none has a `complete.log` yet. The task is last so it can consume the actual CLI, project-log, control, client-process, and field-smoke contracts.
### Scope Rationale
Do not change Node wire behavior, copy shared manager/provider algorithms into `apps/agent`, keep a Python fallback flag, hard-code lane/model/capacity tables, or delete Python reference fixtures before the zero-caller/disposition checks pass. Physical Python implementation deletion is performed only in the later Milestone completion transition required by S13, using the exact generated disposal manifest; this task does not silently treat retained reference files as production.
### Final Routing
- evaluation_mode: `first-pass`
- finalizer: `finalize-task-policy.sh pair`
- build: `cloud-G10`, basis `grade-boundary`, filename `PLAN-cloud-G10.md`
- review: `cloud-G10`, basis `official-review`, filename `CODE_REVIEW-cloud-G10.md`
- large_indivisible_context: `true`
- positive loop risks: `large behavior inventory`, `atomic operator cutover`, `cross-package port composition`, `zero-match/disposal evidence` (count `4`)
- recovery signals: rework `0`, evidence-integrity failure `false`
- capability-gap evidence: none
## Implementation Checklist
- [ ] Create a machine-validated disposition matrix covering every Python dispatcher/selector/observation and Node reference behavior as absorb, replace, or not-applicable.
- [ ] Implement standalone workflow, selection, provider, recovery, evidence, review, integration, and event adapters strictly over existing common Go contracts.
- [ ] Compose and test the production Go task-loop command, including dry-run, task-group filtering, retry-blocked, dependency-ready concurrency, lifecycle recovery, and terminal exit states.
- [ ] Redirect the project orchestration skill and testing rules to `iop-agent task-loop` and remove static model/route/capacity ownership from those surfaces.
- [ ] Add deterministic guards for zero unclassified rows, zero Python production callers/fallbacks, zero stale route/cap text, and zero Node duplicate implementation.
- [ ] Record exact Python reference-fixture disposal paths/checksums and the Milestone-completion deletion/verification procedure without deleting them before parity evidence closes.
- [ ] Update the standalone contract with actual S13 sources and run fresh package/full/race/vet/dry-run/cutover verification.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
### [REFACTOR-1] Establish the Disposition Matrix
#### Problem
`agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md:155,180` requires every stabilized behavior to be classified, but no current artifact fails on an omitted or ambiguous row.
#### Solution
Add a YAML manifest keyed by stable behavior ID. Each row names reference sources/tests, one disposition, Go owner/source/test, invariants, and disposal status. Include routing/pinning, quota/promotion, prompt/session lifecycle, Pi selfcheck, official review, failure budgets, recovery, work claims, WORK_LOG, dependency frontier, process evidence, archive completion, and Node common-provider consumption. Validate unique IDs, existing paths, allowed dispositions, required Go evidence, no wildcard sources, and full reference symbol inventory.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/taskloop/testdata/parity.yaml` — add the complete disposition matrix.
- [ ] `apps/agent/internal/taskloop/parity_test.go` — validate schema, coverage, paths, owners, and zero unclassified rows.
#### Test Strategy
Write `TestParityManifestIsDispositionComplete` plus negative fixtures generated in memory for missing/duplicate/unclassified/stale paths.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/taskloop -run TestParityManifestIsDispositionComplete
```
Expected: zero missing, duplicate, or unclassified rows.
### [REFACTOR-2] Implement Standalone Task-Loop Adapters
#### Problem
`packages/go/agenttask/ports.go:40-349` defines workflow, selector, isolation, invoker, recovery, evidence, reviewer, integrator, and event ports; the standalone host has no production adapters for project task artifacts and CLI review flow.
#### Solution
Implement application adapters that translate project-owned PLAN/review artifacts into normalized `agenttask` snapshots, delegate route evaluation to immutable `agentpolicy`, construct catalog/common-runtime provider launches under `agentworkspace` confinement, inspect exact locators for recovery, observe/repair workflow evidence under shared contracts, invoke official review through the selected common provider, and delegate serial integration to `agentworkspace.SerialIntegrator`. Parsing remains application-owned; transitions/admission/integration decisions remain common-owned.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/taskloop/workflow.go` — parse registered project task artifacts and explicit predecessors.
- [ ] `apps/agent/internal/taskloop/workflow_test.go` — cover active/complete/malformed/dependency fixtures.
- [ ] `apps/agent/internal/taskloop/selector.go` — adapt immutable policy decisions.
- [ ] `apps/agent/internal/taskloop/selector_test.go` — cover route pin/tamper/failover.
- [ ] `apps/agent/internal/taskloop/provider.go` — adapt catalog/common provider launches.
- [ ] `apps/agent/internal/taskloop/provider_test.go` — prove confinement and locator ownership.
- [ ] `apps/agent/internal/taskloop/recovery.go` — inspect exact process/session/artifact locators.
- [ ] `apps/agent/internal/taskloop/recovery_test.go` — cover live/submitted/exited/ambiguous.
- [ ] `apps/agent/internal/taskloop/evidence.go` — observe/repair plan-review evidence.
- [ ] `apps/agent/internal/taskloop/evidence_test.go` — cover provider-neutral and Pi-only repair.
- [ ] `apps/agent/internal/taskloop/review.go` — invoke official review through common runtime.
- [ ] `apps/agent/internal/taskloop/review_test.go` — cover verdict and no premature review.
- [ ] `apps/agent/internal/taskloop/integration.go` — bind immutable change sets/integrator.
- [ ] `apps/agent/internal/taskloop/integration_test.go` — cover retained results/terminal-deferred continuation.
#### Test Strategy
Every adapter gets normal, boundary, malformed identity, cancellation, and restart tests with fake provider processes. No unit/integration test may launch real provider CLIs.
#### Verification
```bash
go test -count=1 ./apps/agent/internal/taskloop
go test -count=1 -race ./apps/agent/internal/taskloop
```
Expected: all adapter and ordering matrices pass without real provider calls.
### [REFACTOR-3] Compose the Go Task-Loop Command
#### Problem
`agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md:172-193` still calls Python, and no standalone CLI command owns scanning, lifecycle, or terminal exit codes.
#### Solution
Compose the adapters with `agentstate.Store`, `agenttask.Manager`, `agentworkspace`, project logs, and host lifecycle. Add `iop-agent task-loop [--dry-run] [--task-group NAME] [--retry-blocked]`. Preserve deterministic attention/lifecycle output while deriving provider/model/capacity from the immutable runtime catalog/policy. Exit 0 only when all in-scope work is terminal-complete, 2 for drained blockers, and 3 for non-terminal tracking state.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/taskloop/module.go` — compose stores/adapters/manager and terminal states.
- [ ] `apps/agent/internal/taskloop/module_test.go` — cover lifecycle, restart, frontier, blocker, and exit codes.
- [ ] `apps/agent/internal/command/task_loop.go` — add the Cobra subcommand.
- [ ] `apps/agent/internal/command/task_loop_test.go` — cover flags/output/exit behavior.
- [ ] `apps/agent/cmd/agent/main.go` — register production task-loop composition.
- [ ] `apps/agent/cmd/agent/main_test.go` — cover process exit mapping.
#### Test Strategy
Use two registered project fixtures with explicit dependencies, disjoint/overlapping work, one blocked provider, restart state, and completion. Assert only explicit predecessors gate execution and unrelated project work drains.
#### Verification
```bash
go test -count=1 -race ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/cmd/agent
make build-agent
build/bin/iop-agent task-loop --help
```
Expected: tests pass and help exposes all compatibility flags.
### [REFACTOR-4] Cut the Project Skill to Go
#### Problem
`agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md:172-193` invokes `dispatch.py`, and the skill owns static route/model/capacity tables that can drift from runtime config.
#### Solution
Rewrite procedure examples to call `iop-agent task-loop`; keep skill-level user interaction/final gates but delegate task scan, selection, capacity, recovery, logs, and lifecycle to the daemon command. Remove hard-coded provider/model/time/capacity tables and refer to runtime-config revisions/evidence. Update testing domain ownership from Python scripts/tests to the Go command and parity fixture. Retain Python paths only in the disposal manifest as non-production reference fixtures.
#### Modified Files and Checklist
- [ ] `agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md` — use Go runtime and remove static route/cap ownership.
- [ ] `agent-ops/rules/project/domain/testing/rules.md` — update dispatcher verification ownership.
- [ ] `agent-ops/rules/project/rules.md` — replace legacy path mappings with current task-loop/parity verification paths.
#### Test Strategy
Static tests in API-5 prove no runtime Python command or model table remains. Dry-run through the built binary proves the documented flags.
#### Verification
```bash
rg -n --sort path 'dispatch\\.py|python3 .*orchestrate-agent-task-loop|gpt-5\\.6|claude-opus|Gemini|ornith|laguna' \
agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md \
agent-ops/rules/project/domain/testing/rules.md \
agent-ops/rules/project/rules.md
```
Expected: zero matches.
### [REFACTOR-5] Add Cutover and Duplicate Guards
#### Problem
`agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md:155,180` requires zero Python fallback, stale static policy, and Node duplicate, but no executable guard enforces those zero-match conditions.
#### Solution
Add Go tests that run deterministic repository searches and inspect the parity manifest. Production surfaces must not invoke/reference Python dispatcher files; task-loop sources must not contain hard-coded model/capacity tables; Node must consume common `agentruntime`/`agentprovider` rather than define task manager/provider lifecycle duplicates. Permit Python filenames only inside the parity disposal manifest and their own reference directory.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/taskloop/cutover_test.go` — add zero-match and ownership guards.
- [ ] `Makefile` — add `test-iop-agent-parity`.
#### Test Strategy
`TestNoPythonProductionDependency`, `TestNoStaticRouteCapabilityOwnership`, and `TestNoNodeDuplicateAgentRuntime` must report exact paths/lines on failure.
#### Verification
```bash
make test-iop-agent-parity
```
Expected: disposition count is complete and all three zero-match guards pass.
### [REFACTOR-6] Prepare Python Disposal Evidence
#### Problem
`agent-roadmap/sdd/automation-runtime-bridge/iop-agent-cli-runtime/SDD.md:155,180` requires physical Python disposal at Milestone completion, but deletion before verified Go cutover would remove the behavioral oracle prematurely.
#### Solution
Record every Python reference source/test path, SHA-256, corresponding parity row, and `production_callers=0` in the manifest. Add a read-only `iop-agent task-loop parity --disposal-manifest` command that prints the exact paths and a completion-transition verification command. Do not add a Python fallback or an automatic delete flag. The later Milestone completion transition deletes only these manifest-resolved paths after all Roadmap tasks and completion review gates pass.
#### Modified Files and Checklist
- [ ] `apps/agent/internal/taskloop/testdata/parity.yaml` — add exact disposal inventory and hashes.
- [ ] `apps/agent/internal/taskloop/parity.go` — load/validate/report disposal readiness.
- [ ] `apps/agent/internal/command/task_loop.go` — expose read-only parity report.
- [ ] `apps/agent/internal/taskloop/parity_test.go` — verify hashes and zero production callers.
#### Test Strategy
Mutated hash/path/caller fixtures must fail. The report must be stable-sorted and contain no archive scan.
#### Verification
```bash
build/bin/iop-agent task-loop parity --disposal-manifest
go test -count=1 ./apps/agent/internal/taskloop -run 'TestParity|TestNoPython'
```
Expected: every retained Python reference is checksum-bound and has zero production callers.
### [REFACTOR-7] Record S13 Sources and Full Regression
#### Problem
`agent-contract/inner/iop-agent-cli-runtime.md:9-14,139-147` lacks actual S13 parity/cutover sources, and package tests alone cannot detect repository-wide regression.
#### Solution
Record taskloop/parity/skill source paths and the explicit completion-transition disposal boundary. Run focused, race, all Go package, vet, dry-run, parity, and static searches after the cutover.
#### Modified Files and Checklist
- [ ] `agent-contract/inner/iop-agent-cli-runtime.md` — add S13 source/evidence/disposal links.
#### Test Strategy
No new test file beyond API-1 through API-6; run the complete suite fresh.
#### Verification
```bash
go test -count=1 ./packages/go/... ./apps/agent/...
go vet ./packages/go/... ./apps/agent/...
build/bin/iop-agent task-loop --dry-run --task-group m-iop-agent-cli-runtime
git diff --check
```
Expected: all pass with no real provider launch in tests.
## Dependencies and Execution Order
Required predecessors are `14+13_cli_surface`, `15+13_project_logs`, `16+13_local_control`, `17+13,16_client_process_manager`, and `18+14,15,16,17_logged_smoke`. Each must have exactly one same-group active or archived `complete.log`; all are currently missing. Complete REFACTOR-1/2 before command composition, REFACTOR-3 before skill cutover, then REFACTOR-4/5/6/7.
## Modified Files Summary
| File | Item |
|------|------|
| `apps/agent/internal/taskloop/testdata/parity.yaml` | REFACTOR-1, REFACTOR-6 |
| `apps/agent/internal/taskloop/parity.go` | REFACTOR-6 |
| `apps/agent/internal/taskloop/parity_test.go` | REFACTOR-1, REFACTOR-6 |
| `apps/agent/internal/taskloop/workflow.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/workflow_test.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/selector.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/selector_test.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/provider.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/provider_test.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/recovery.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/recovery_test.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/evidence.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/evidence_test.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/review.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/review_test.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/integration.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/integration_test.go` | REFACTOR-2 |
| `apps/agent/internal/taskloop/module.go` | REFACTOR-3 |
| `apps/agent/internal/taskloop/module_test.go` | REFACTOR-3 |
| `apps/agent/internal/taskloop/cutover_test.go` | REFACTOR-5 |
| `apps/agent/internal/command/task_loop.go` | REFACTOR-3, REFACTOR-6 |
| `apps/agent/internal/command/task_loop_test.go` | REFACTOR-3 |
| `apps/agent/cmd/agent/main.go` | REFACTOR-3 |
| `apps/agent/cmd/agent/main_test.go` | REFACTOR-3 |
| `agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md` | REFACTOR-4 |
| `agent-ops/rules/project/domain/testing/rules.md` | REFACTOR-4 |
| `agent-ops/rules/project/rules.md` | REFACTOR-4 |
| `Makefile` | REFACTOR-5 |
| `agent-contract/inner/iop-agent-cli-runtime.md` | REFACTOR-7 |
## Final Verification
```bash
gofmt -w apps/agent/internal/taskloop/*.go apps/agent/internal/command/task_loop*.go apps/agent/cmd/agent/*.go
go test -count=1 ./apps/agent/internal/taskloop ./apps/agent/internal/command ./apps/agent/cmd/agent
go test -count=1 -race ./apps/agent/internal/taskloop ./packages/go/agenttask ./packages/go/agentstate
go test -count=1 ./packages/go/... ./apps/agent/...
go vet ./packages/go/... ./apps/agent/...
make build-agent
make test-iop-agent-parity
build/bin/iop-agent task-loop --help
build/bin/iop-agent task-loop --dry-run --task-group m-iop-agent-cli-runtime
build/bin/iop-agent task-loop parity --disposal-manifest
rg -n --sort path 'dispatch\\.py|python3 .*orchestrate-agent-task-loop|gpt-5\\.6|claude-opus|Gemini|ornith|laguna' agent-ops/skills/project/orchestrate-agent-task-loop/SKILL.md agent-ops/rules/project/domain/testing/rules.md agent-ops/rules/project/rules.md
git diff --check
```
Expected: every test/build/vet/dry-run/parity command passes and the final `rg` returns exit 1 with no matches. Python reference fixtures remain checksum-bound and have zero callers until the separate Milestone completion transition deletes exactly the disposal manifest paths. After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.