docs(agent-task): 템플릿 작업 계획을 작성한다

단일 요청 Plan과 Review 템플릿 변경을 구현·검증할 때 설정, 요청 스냅샷, 런타임 산출물의 경계를 한 작업 단위로 유지하기 위해 계획과 리뷰 기준을 고정한다.
2026-08-09 08:22:47 +09:00 · 2026-08-09 08:22:47 +09:00 · 8a8ea29abd
commit 8a8ea29abd
parent 6b5ee6c366
2 changed files with 800 additions and 0 deletions
--- a/agent-task/single_request_plan_review_templates/CODE_REVIEW-cloud-G07.md
+++ b/agent-task/single_request_plan_review_templates/CODE_REVIEW-cloud-G07.md
@ -0,0 +1,266 @@
+<!-- task=single_request_plan_review_templates plan=0 tag=API -->
+
+# Code Review Reference - API
+
+> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
+> The task is NOT complete until every implementation-owned section below is filled in.
+> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
+> Fill implementation-owned sections, then stop with active files in place and report ready for review.
+> Execute the plan's selected root cause, scope, files, and dependency decisions as written. Do not choose another owner, narrow/expand the write boundary, or replace a fix with another verification attempt.
+> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
+> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
+> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
+> Follow the ownership table at the bottom of this file for which sections you own.
+
+## Overview
+
+date=2026-08-09
+task=single_request_plan_review_templates, plan=0, tag=API
+
+## For the Review Agent
+
+> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.
+
+Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
+Review completion means the following steps are finished:
+
+1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
+2. Archive `CODE_REVIEW-cloud-G07.md` → `code_review_cloud_G07_0.log` and `PLAN-local-G07.md` → `plan_local_G07_0.log`.
+3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/single_request_plan_review_templates/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
+4. If PASS and task group is `m-<milestone-slug>`, preserve the first-line `milestone-task` metadata in `complete.log` and report it for the runtime aggregation event. Roadmap state evaluation belongs to `sync-milestone-workstate`.
+5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.
+
+---
+
+## Implementation Item Completion
+
+| Item | Status |
+|------|---------|
+| API-1 Bounded template contract and config loading | [ ] |
+| API-2 Immutable request-start template snapshot | [ ] |
+| API-3 Direct compact PlanMD stage | [ ] |
+| API-4 Compact Review artifact without changing the control loop | [ ] |
+| API-5 Operator contract, current specs, and integrated evidence | [ ] |
+
+## Implementation Checklist
+
+- [ ] [API-1] Add the bounded built-in Plan/Review template grammar, strict config-relative override loading, redacted live-refresh classification, and boundary tests.
+- [ ] [API-2] Freeze effective template content into immutable `SingleRequestBinding` admissions and verify clone/refresh isolation.
+- [ ] [API-3] Replace plan-stage JSON response formatting with direct compact PlanMD generation and structural validation.
+- [ ] [API-4] Render approved review artifacts through the compact Review template while preserving review/repair/final-output behavior.
+- [ ] [API-5] Update the operator example and current contracts/specs, then run fresh local and remote dev verification.
+- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
+
+## Review-Only Checklist
+
+> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
+> Implementing agents must not modify or check this section.
+
+- [ ] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
+- [ ] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
+- [ ] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G07_0.log`.
+- [ ] Archive active `PLAN-*-G??.md` to `plan_local_G07_0.log`.
+- [ ] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
+- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
+- [ ] If PASS, move active task directory `agent-task/single_request_plan_review_templates/` to `agent-task/archive/YYYY/MM/single_request_plan_review_templates/` and update this checklist at the final archive path.
+- [ ] If PASS and task group is `m-<milestone-slug>`, preserve and report `milestone-task` metadata for runtime aggregation, without modifying roadmap or directly calling `update-roadmap`.
+- [ ] If PASS for split work, remove empty active parent `agent-task/single_request_plan_review_templates/` or verify it was kept due to remaining siblings/files.
+- [ ] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.
+
+## Deviations from Plan
+
+_Record any deviations from the plan and the rationale here._
+
+## Key Design Decisions
+
+_Record key design decisions here._
+
+## Reviewer Checkpoints
+
+- Confirm the shared grammar has exactly the approved placeholders/headings, independent built-in fallback, 8192-byte cap, config-relative regular-file loading, and fail-closed invalid override behavior.
+- Confirm refresh detects same-path content changes as live-applied for new requests while evidence/provider/caller surfaces expose neither file paths nor template bodies.
+- Confirm every admitted binding freezes content and clone/workspace revalidation cannot observe source mutation.
+- Confirm Plan provider requests no longer set JSON response format and malformed/non-compact Markdown never reaches internal artifacts.
+- Confirm Review inspection/repair/tool-budget sequencing and caller final output remain unchanged while only approved internal Review artifacts use the selected template.
+- Confirm current contracts/specs match code and local plus remote evidence is fresh; treat a reproducible SOPS age-identity failure as external verification evidence, not as permission to substitute a provider credential.
+
+## Verification Results
+
+Paste actual stdout/stderr for every command. Do not summarize or reconstruct output. If output is too long, save it outside the repository and record the exact path and producing command.
+
+### API-1 — template/config/refresh tests
+
+```bash
+go test -count=1 ./packages/go/singlerequesttemplate ./packages/go/config ./apps/edge/internal/configrefresh
+```
+
+_Actual output pending implementation._
+
+### API-2 — binding and preset snapshot tests
+
+```bash
+go test -count=1 ./apps/edge/internal/service -run 'TestSingleRequestBinding'
+go test -count=1 ./apps/edge/internal/openai -run 'TestSingleRequestPresetBinding'
+```
+
+_Actual output pending implementation._
+
+### API-3 — direct PlanMD tests
+
+```bash
+go test -count=1 ./apps/edge/internal/openai -run 'TestSingleRequestPlanStage'
+```
+
+_Actual output pending implementation._
+
+### API-4 — Review template/control-loop tests
+
+```bash
+go test -count=1 ./apps/edge/internal/openai -run 'TestSingleRequestReviewStage'
+```
+
+_Actual output pending implementation._
+
+### API-5 — smoke self-test and race tests
+
+```bash
+make test-single-request-claude-smoke-self-test
+go test -race -count=1 ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/edge/internal/configrefresh ./packages/go/config ./packages/go/singlerequesttemplate
+```
+
+_Actual output pending implementation._
+
+### Final — formatting and complete local suite
+
+```bash
+test -z "$(gofmt -l packages/go/singlerequesttemplate/template.go packages/go/singlerequesttemplate/template_test.go packages/go/config/execution_preset_types.go packages/go/config/load.go packages/go/config/model_execution_preset_config_test.go apps/edge/internal/configrefresh/classify.go apps/edge/internal/configrefresh/execution_preset_classify_test.go apps/edge/internal/service/single_request_types.go apps/edge/internal/service/single_request_types_test.go apps/edge/internal/openai/single_request_preset_binding.go apps/edge/internal/openai/single_request_preset_binding_test.go apps/edge/internal/openai/single_request_plan_stage.go apps/edge/internal/openai/single_request_plan_stage_test.go apps/edge/internal/openai/single_request_review_stage.go apps/edge/internal/openai/single_request_review_stage_test.go)"
+go test -count=1 ./packages/go/singlerequesttemplate ./packages/go/config ./apps/edge/internal/configrefresh
+go test -count=1 ./apps/edge/internal/service -run 'TestSingleRequestBinding'
+go test -count=1 ./apps/edge/internal/openai -run 'TestSingleRequest(PlanStage|ReviewStage|PresetBinding)'
+go test -race -count=1 ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/edge/internal/configrefresh ./packages/go/config ./packages/go/singlerequesttemplate
+go test -count=1 ./apps/edge/... ./packages/go/...
+make test-single-request-claude-smoke-self-test
+```
+
+_Actual output pending implementation._
+
+### Final — pushed feature identity and remote runner sync
+
+```bash
+test "$(git branch --show-current)" = "feature/single-request-plan-review-templates"
+test -z "$(git status --porcelain)"
+git push origin HEAD:feature/single-request-plan-review-templates
+expected_commit="$(git rev-parse HEAD)"
+test "$(git ls-remote origin refs/heads/feature/single-request-plan-review-templates | cut -f1)" = "$expected_commit"
+ssh -o BatchMode=yes toki@toki-labs.com bash -s -- "$expected_commit" <<'REMOTE'
+set -eu
+repo=/Users/toki/agent-work/iop-dev
+cd "$repo"
+git fetch origin feature/single-request-plan-review-templates
+git switch --force-create feature/single-request-plan-review-templates origin/feature/single-request-plan-review-templates
+git reset --hard origin/feature/single-request-plan-review-templates
+git clean -fd
+test "$(git rev-parse HEAD)" = "$1"
+test -z "$(git status --porcelain)"
+test "$(/opt/homebrew/bin/go env GOOS)-$(/opt/homebrew/bin/go env GOARCH)" = "darwin-arm64"
+/opt/homebrew/bin/claude --version
+/opt/homebrew/bin/sops --version
+test -f /Users/toki/.config/iop/secrets/dev-openai-toki.sops.yaml
+test -f build/dev-runtime/node-codex.yaml
+test -f /Users/toki/agent-work/iop-s12-validation-20260808/source/build/s12/runtime/edge.yaml
+REMOTE
+```
+
+_Actual output pending implementation._
+
+### Final — remote dev rebuild/restart
+
+```bash
+ssh -o BatchMode=yes toki@toki-labs.com bash -s <<'REMOTE'
+set -eu
+repo=/Users/toki/agent-work/iop-dev
+cd "$repo"
+rm -rf /tmp/iop-single-request-template-build
+PATH=/opt/homebrew/bin:$PATH make build-edge build-node BUILD_DIR=/tmp/iop-single-request-template-build EDGE_TARGET=darwin-arm64
+cp /Users/toki/agent-work/iop-s12-validation-20260808/source/build/s12/runtime/edge.yaml build/dev-runtime/single-request-template-edge.yaml
+/tmp/iop-single-request-template-build/bin/iop-edge config check --config "$repo/build/dev-runtime/single-request-template-edge.yaml"
+for port in 18083 18084 19093 19101; do
+  /usr/sbin/lsof -nP -iTCP:"$port" -sTCP:LISTEN || true
+done
+edge_pid="$(/usr/sbin/lsof -tiTCP:18083 -sTCP:LISTEN 2>/dev/null || true)"
+if test -n "$edge_pid"; then
+  edge_cmd="$(ps -p "$edge_pid" -o command=)"
+  case "$edge_cmd" in
+    *iop-s12-validation-20260808*edge*) kill "$edge_pid"; wait "$edge_pid" 2>/dev/null || true ;;
+    *build/dev-runtime/bin/edge*) kill "$edge_pid"; wait "$edge_pid" 2>/dev/null || true ;;
+    *) printf 'unexpected 18083 owner: %s\n' "$edge_cmd" >&2; exit 1 ;;
+  esac
+fi
+node_pid="$(pgrep -f 'iop-s12-validation-20260808/.*/iop-node.*--config /Users/toki/agent-work/iop-dev/build/dev-runtime/node-codex.yaml serve' || true)"
+if test -n "$node_pid"; then kill "$node_pid"; wait "$node_pid" 2>/dev/null || true; fi
+install -m 0755 /tmp/iop-single-request-template-build/bin/iop-edge build/dev-runtime/bin/edge.next
+install -m 0755 /tmp/iop-single-request-template-build/bin/iop-node build/dev-runtime/bin/iop-node.next
+mv build/dev-runtime/bin/edge.next build/dev-runtime/bin/edge
+mv build/dev-runtime/bin/iop-node.next build/dev-runtime/bin/iop-node
+nohup build/dev-runtime/bin/edge --config "$repo/build/dev-runtime/single-request-template-edge.yaml" serve >build/dev-runtime/logs/edge.template.stdout.log 2>build/dev-runtime/logs/edge.template.stderr.log &
+echo $! >build/dev-runtime/edge.pid
+nohup build/dev-runtime/bin/iop-node --config "$repo/build/dev-runtime/node-codex.yaml" serve >build/dev-runtime/logs/node-template.stdout.log 2>build/dev-runtime/logs/node-template.stderr.log &
+echo $! >build/dev-runtime/node-codex.pid
+sleep 2
+kill -0 "$(cat build/dev-runtime/edge.pid)"
+kill -0 "$(cat build/dev-runtime/node-codex.pid)"
+/usr/sbin/lsof -nP -iTCP:18083 -sTCP:LISTEN
+REMOTE
+```
+
+_Actual output pending implementation._
+
+### Final — one deployed Claude single-request cycle
+
+After the approved SOPS age identity/loader populates `IOP_SINGLE_REQUEST_SMOKE_TOKEN` and the closed runtime-evidence file in the same remote shell, run:
+
+```bash
+cd /Users/toki/agent-work/iop-dev
+test -n "${IOP_SINGLE_REQUEST_SMOKE_TOKEN:-}"
+test -f /tmp/iop-single-request-template-runtime.json
+rm -rf /tmp/iop-single-request-template-workspace
+mkdir -m 700 /tmp/iop-single-request-template-workspace
+rm -f /tmp/iop-single-request-template-smoke.json
+PATH=/opt/homebrew/bin:$PATH make test-single-request-claude-smoke-preflight test-single-request-claude-smoke test-single-request-claude-smoke-validate \
+  IOP_SINGLE_REQUEST_SMOKE_CLAUDE_BIN=/opt/homebrew/bin/claude \
+  IOP_SINGLE_REQUEST_SMOKE_RUNTIME_EVIDENCE=/tmp/iop-single-request-template-runtime.json \
+  IOP_SINGLE_REQUEST_SMOKE_BASE_URL=http://127.0.0.1:18083 \
+  IOP_SINGLE_REQUEST_SMOKE_MODEL=iop-single-request-light \
+  IOP_SINGLE_REQUEST_SMOKE_EDGE_BIN=/Users/toki/agent-work/iop-dev/build/dev-runtime/bin/edge \
+  IOP_SINGLE_REQUEST_SMOKE_NODE_BIN=/Users/toki/agent-work/iop-dev/build/dev-runtime/bin/iop-node \
+  IOP_SINGLE_REQUEST_SMOKE_EDGE_CONFIG=/Users/toki/agent-work/iop-dev/build/dev-runtime/single-request-template-edge.yaml \
+  IOP_SINGLE_REQUEST_SMOKE_OBSERVATION_FILE=/Users/toki/agent-work/iop-s12-validation-20260808/source/build/s12/runtime/edge.log \
+  IOP_SINGLE_REQUEST_SMOKE_METRICS_URL=http://127.0.0.1:19101/metrics \
+  IOP_SINGLE_REQUEST_SMOKE_WORKSPACE=/tmp/iop-single-request-template-workspace \
+  IOP_SINGLE_REQUEST_SMOKE_OUTPUT=/tmp/iop-single-request-template-smoke.json \
+  IOP_SINGLE_REQUEST_SMOKE_SECRET_ENV=IOP_SINGLE_REQUEST_SMOKE_TOKEN
+```
+
+If the age identity remains unavailable, paste the raw SOPS failure and exact resume condition here; do not substitute a provider credential or reuse runtime evidence.
+
+_Actual output pending implementation._
+
+---
+
+> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
+> If anything is blank, go back and fill it in before saving this file.
+> Leave review-agent-only sections unchanged.
+
+## Section Ownership
+
+| Section | Owner | Note |
+|---------|-------|------|
+| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
+| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
+| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
+| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
+| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
+| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
+| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
+| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
+| Code Review Result | Review agent appends | Not included in stub |
--- a/agent-task/single_request_plan_review_templates/PLAN-local-G07.md
+++ b/agent-task/single_request_plan_review_templates/PLAN-local-G07.md
@ -0,0 +1,534 @@
+<!-- task=single_request_plan_review_templates plan=0 tag=API -->
+
+# Single-request Plan/Review Templates - API
+
+## For the Implementing Agent
+
+Implement every checklist item and run every verification command. Fill the implementation-owned sections of `CODE_REVIEW-cloud-G07.md` with actual notes and raw command output, keep both active files in place, and report ready for review. Finalization belongs only to the code-review skill: do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`. If blocked, record only the exact blocker, attempted command/output, and resume condition in the implementation-owned evidence fields.
+
+## Background
+
+The fixed single-request path currently asks the plan model for JSON and expands that into a minimal artifact, while the review artifact is a hard-coded summary. The selected design replaces that overhead with compact Plan/Review Markdown templates: safe built-ins are always available, and an operator may override either template with a bounded local file. Template contents must be immutable for an admitted request and refresh only future requests without exposing local paths or changing the existing review/repair authority boundary.
+
+## Analysis
+
+### Files Read
+
+- Runtime/config source: `packages/go/config/execution_preset_types.go`, `packages/go/config/load.go`, `apps/edge/internal/configrefresh/classify.go`, `apps/edge/internal/service/single_request_types.go`, `apps/edge/internal/openai/single_request_preset_binding.go`, `apps/edge/internal/openai/single_request_executor.go`, `apps/edge/internal/openai/single_request_plan_stage.go`, `apps/edge/internal/openai/single_request_review_stage.go`.
+- Tests: `packages/go/config/model_execution_preset_config_test.go`, `apps/edge/internal/configrefresh/execution_preset_classify_test.go`, `apps/edge/internal/service/single_request_types_test.go`, `apps/edge/internal/openai/single_request_preset_binding_test.go`, `apps/edge/internal/openai/single_request_plan_stage_test.go`, `apps/edge/internal/openai/single_request_review_stage_test.go`.
+- Operator/runtime verification: `configs/edge.yaml`, `Makefile`, `scripts/e2e-single-request-claude.sh`.
+- Current contracts/specs: `agent-contract/inner/edge-config-runtime-refresh.md`, `agent-contract/outer/anthropic-compatible-api.md`, `agent-spec/runtime/provider-pool-config-refresh.md`, `agent-spec/runtime/edge-node-execution.md`, `agent-spec/input/openai-compatible-surface.md`.
+
+### SDD Criteria
+
+not applicable. This is a bounded, non-Milestone follow-up and does not change a selected roadmap Milestone or SDD acceptance map.
+
+### Verification Context
+
+No separate verification handoff was supplied. Repository-native evidence came from the Go tests above, the strict `LoadEdge` path, the existing live-apply classifier, the Make build targets, and the repository-owned Claude single-request smoke harness.
+
+The requested external runner was checked read-only on 2026-08-09 KST:
+
+- Runner: `toki@toki-labs.com`, Darwin/arm64; repository root `/Users/toki/agent-work/iop-dev`.
+- Local runner checkout was `dev` at `0eaab4561d157b5649b3be6ccbdaf298b5df7426`; its cached `origin/dev` was stale and it contained the untracked `apps/edge/internal/openai/chat_policy.go.bak-20260804T190533`.
+- Actual remote `dev` and `feature/single-request-plan-review-templates` were both `6b5ee6c366a26a30cec9180fe30ce442d4df27fd` at preflight. Therefore verification must fetch, force the dedicated runner checkout to the exact pushed feature commit, and remove that stale untracked backup before building.
+- Tools: `/opt/homebrew/bin/go` reports Go 1.26.3 darwin/arm64; `/opt/homebrew/bin/claude` reports 2.1.177 and exposes the flags required by the harness.
+- Runtime paths exist at `/Users/toki/agent-work/iop-dev/build/dev-runtime/bin/edge`, `/Users/toki/agent-work/iop-dev/build/dev-runtime/bin/iop-node`, `/Users/toki/agent-work/iop-dev/build/dev-runtime/edge.yaml`, and `/Users/toki/agent-work/iop-dev/build/dev-runtime/node-codex.yaml`. The dev Edge config is older and has no execution preset; the currently approved validation config at `/Users/toki/agent-work/iop-s12-validation-20260808/source/build/s12/runtime/edge.yaml` declares public model `iop-single-request-light`, preset `preset-iop-single-request-light`, and stage engines `gemini`, `ornith-fast`, `gemini`. Verification must copy that operator-owned config to a task-specific ignored dev-runtime path rather than edit or commit it.
+- Ports 18083, 18084, 19093, and 19101 were owned by an older `iop-s12-validation-20260808` Edge, and the Node using the dev Node config was also an S12 binary. The implementation must prove process/binary/config identity before stopping only those superseded validation processes, then start the freshly built dev binaries.
+- The approved IOP caller-token store exists at `/Users/toki/.config/iop/secrets/dev-openai-toki.sops.yaml`; `/opt/homebrew/bin/sops` exists. Direct decrypt without an explicit matching age identity failed during preflight. The external smoke therefore has a concrete credential precondition: use the already approved dev SOPS identity/loader without printing the value; if that identity is still unavailable, preserve local verification and record the exact SOPS error plus the required identity as the external-verification resume condition.
+- The smoke harness writes request-level lifecycle evidence but removes internal Plan/Review artifacts. Exact built-in/override artifacts are therefore closed by deterministic Go tests; the external Claude run closes deployed one-ingress lifecycle, final output, observations, and timing.
+
+Confidence is high for the code/test boundary and medium for remote deployment until the SOPS identity and currently competing S12 process ownership are revalidated.
+
+### Test Coverage Gaps
+
+- Config loading has strict execution-preset tests but no built-in fallback, config-relative template-file, same-path content refresh, non-regular/symlink, unreadable, oversized, or invalid-placeholder coverage.
+- Binding tests cover option/dispatch clone isolation but not template-content snapshots or refresh isolation.
+- Plan-stage tests currently assert JSON schema injection and JSON-to-Markdown rendering; they do not cover direct template-shaped Markdown, field/cardinality limits, static-segment mismatches, or custom templates.
+- Review-stage tests cover pass, malformed output, inspection, repair, budgets, and final output separation; they do not cover `checks`/`verification` template rendering or custom-template snapshots.
+- The external harness does not retain internal artifacts. Unit tests must assert exact Plan/Review artifacts, and one fresh deployed Claude smoke must separately assert end-to-end lifecycle behavior.
+
+### Symbol References
+
+- Remove `singleRequestPlanResponseFormat`, `singleRequestPlanResult`, `singleRequestPlanResultAlias`, and their JSON-only use sites in `apps/edge/internal/openai/single_request_plan_stage.go`; references are confined to that file and `single_request_plan_stage_test.go`.
+- Extend `singleRequestReviewDecision` and `renderSingleRequestReview`; all direct construction/helper call sites are in `apps/edge/internal/openai/single_request_review_stage.go` and `single_request_review_stage_test.go`.
+- Preserve `NewSingleRequestBinding` for existing callers. Add a template-aware constructor used by `compileSingleRequestBinding`; current constructor and clone call sites are in `apps/edge/internal/service/single_request_types.go`, its tests, and `apps/edge/internal/openai/single_request_preset_binding.go`/tests.
+
+### Split Judgment
+
+Keep one plan. Template grammar, config-file loading, refresh classification, request-start snapshotting, plan parsing, and review rendering form one compatibility invariant: a template accepted at load/admission must be interpreted identically by both stages while an in-flight request remains unchanged. Splitting these changes would create an intermediate state that either admits an unusable template or runs a stage without the frozen content.
+
+### Scope Rationale
+
+Do not change caller request/response schemas, provider routing, model selection, workspace tool authority, review inspection/repair transitions, caller final-output separation, Node/proto contracts, dispatcher/Agent-Ops common files, file watching, UI, remote template stores, or caller-selected template paths/content. The only operator surface is two optional Edge config file paths; missing settings use built-ins, while configured-but-invalid files fail closed.
+
+### Final Routing
+
+- `evaluation_mode=pair`; finalizer `finalize-task-policy.sh`.
+- Build: closure `local-fit`, lane `local`, grade `G07`, catalog route `worker/local/G07`, canonical file `PLAN-local-G07.md`.
+- Review: closure `official-review`, lane `cloud`, grade `G07`, catalog route `review/cloud/G07`, canonical file `CODE_REVIEW-cloud-G07.md`.
+- `large_indivisible_context=false`.
+- Positive loop risks: `boundary_contract`, `structured_interpretation`, `variant_product`; count 3, risk boundary not matched.
+- `review_rework_count=0`, `evidence_integrity_failure=false`, recovery boundary not matched; no capability gap.
+
+## Implementation Checklist
+
+- [ ] [API-1] Add the bounded built-in Plan/Review template grammar, strict config-relative override loading, redacted live-refresh classification, and boundary tests.
+- [ ] [API-2] Freeze effective template content into immutable `SingleRequestBinding` admissions and verify clone/refresh isolation.
+- [ ] [API-3] Replace plan-stage JSON response formatting with direct compact PlanMD generation and structural validation.
+- [ ] [API-4] Render approved review artifacts through the compact Review template while preserving review/repair/final-output behavior.
+- [ ] [API-5] Update the operator example and current contracts/specs, then run fresh local and remote dev verification.
+- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.
+
+### [API-1] Bounded template contract and config loading
+
+**Problem**
+
+`ExecutionSingleRequestPolicy` has only workspace, limits, and stages (`packages/go/config/execution_preset_types.go:269-280`), and `LoadEdge` validates presets without resolving operator template files (`packages/go/config/load.go:53-87`, `204-209`). The current whole-policy refresh diff (`apps/edge/internal/configrefresh/classify.go:381-399`) would also stringify any newly embedded template text or local path into change evidence.
+
+**Solution**
+
+Create a dependency-light `packages/go/singlerequesttemplate` package as the single grammar owner. Its compiled defaults are:
+
+```markdown
+# Plan
+
+## Goal
+{{goal}}
+
+## Steps
+{{steps}}
+
+## Verification
+{{verification}}
+```
+
+and:
+
+```markdown
+# Review
+
+## Result
+PASS
+
+## Checks
+{{checks}}
+
+## Verification
+{{verification}}
+
+## Summary
+{{summary}}
+```
+
+The Plan inventory is exactly `goal`, `steps`, `verification`; the Review inventory is exactly `checks`, `verification`, `summary`. Each token must occur once, no unknown `{{...}}` token is allowed, required headings/order and literal `PASS` remain server-owned, and the template must be at most 8192 bytes. Plan parsing enforces a one-line non-empty goal, 2-6 `- ` step lines, 1-3 `- ` verification lines, exact static fragments, no unresolved token, and the stage output cap. Review rendering enforces non-empty bounded fields and exact static replacement.
+
+Extend the policy with source fields `templates.plan_file` and `templates.review_file` plus effective content/digests excluded from YAML/mapstructure. After strict decode and structural preset validation, resolve each configured path against `filepath.Dir(v.ConfigFileUsed())`; use its built-in independently when omitted. Use `Lstat` and reject symlinks/non-regular files, read at most 8193 bytes, validate before admission, and fail `LoadEdge` when a configured file is missing, unreadable, oversized, or invalid. Refresh compares effective digests/content but reports only a redacted changed marker/digest, never template body or resolved path.
+
+Before (`execution_preset_types.go:272-280`):
+
+```go
+type ExecutionSingleRequestPolicy struct {
+    WorkspaceRef string                       `mapstructure:"workspace_ref" yaml:"workspace_ref,omitempty"`
+    Limits       ExecutionSingleRequestLimits `mapstructure:"limits" yaml:"limits"`
+    Stages       ExecutionSingleRequestStages `mapstructure:"stages" yaml:"stages"`
+}
+```
+
+After:
+
+```go
+import "iop/packages/go/singlerequesttemplate"
+
+type ExecutionSingleRequestPolicy struct {
+    WorkspaceRef string                          `mapstructure:"workspace_ref" yaml:"workspace_ref,omitempty"`
+    Limits       ExecutionSingleRequestLimits    `mapstructure:"limits" yaml:"limits"`
+    Stages       ExecutionSingleRequestStages    `mapstructure:"stages" yaml:"stages"`
+    Templates    ExecutionSingleRequestTemplates `mapstructure:"templates" yaml:"templates,omitempty"`
+}
+
+type ExecutionSingleRequestTemplates struct {
+    PlanFile     string `mapstructure:"plan_file" yaml:"plan_file,omitempty"`
+    ReviewFile   string `mapstructure:"review_file" yaml:"review_file,omitempty"`
+    EffectivePlan   string `mapstructure:"-" yaml:"-"`
+    EffectiveReview string `mapstructure:"-" yaml:"-"`
+}
+
+var _ = singlerequesttemplate.MaxTemplateBytes
+```
+
+The implementation may avoid the illustrative blank import use, but `singlerequesttemplate` must remain the only template grammar/default owner.
+
+**Modified Files and Checklist**
+
+- [ ] Add defaults, closed-token validation, Plan extraction/cardinality validation, Review rendering, and safe digests in `packages/go/singlerequesttemplate/template.go`.
+- [ ] Add normal and boundary table tests in `packages/go/singlerequesttemplate/template_test.go`.
+- [ ] Add source/effective template fields and deep-clone behavior in `packages/go/config/execution_preset_types.go`.
+- [ ] Resolve and validate template files relative to the loaded Edge config in `packages/go/config/load.go`.
+- [ ] Add built-in, per-file override/fallback, relative-path, missing/unreadable, symlink/non-regular, 8192/8193-byte, duplicate/missing/unknown-token, and malformed-layout tests in `packages/go/config/model_execution_preset_config_test.go`.
+- [ ] Redact template text/path while preserving `StatusApplied` detection in `apps/edge/internal/configrefresh/classify.go` and test same-path content changes in `apps/edge/internal/configrefresh/execution_preset_classify_test.go`.
+
+**Test Strategy**
+
+Write `TestValidatePlanTemplate`, `TestParsePlan`, `TestValidateReviewTemplate`, and `TestRenderReview` table tests with built-in/custom templates and every boundary above. Extend `TestLoadEdge...` cases using `t.TempDir()` with the config in a child directory to prove resolution is config-relative, not cwd-relative. Extend `TestClassifyExecutionPresetLiveApply` or add a focused test proving only new request configuration is live-applied and change evidence contains neither template content nor path.
+
+**Verification**
+
+```bash
+go test -count=1 ./packages/go/singlerequesttemplate ./packages/go/config ./apps/edge/internal/configrefresh
+```
+
+Expected: fresh PASS; invalid configured files fail closed and refresh evidence is redacted.
+
+### [API-2] Immutable request-start template snapshot
+
+**Problem**
+
+`SingleRequestBinding` freezes models, workspace, limits, and dispatch (`apps/edge/internal/service/single_request_types.go:31-72`) but has no template snapshot. Its constructor and clone (`:208-293`, `:313-324`) cannot prevent an admitted request from observing later config/template mutations. `compileSingleRequestBinding` currently calls the legacy constructor with no effective template content (`apps/edge/internal/openai/single_request_preset_binding.go:67-82`).
+
+**Solution**
+
+Add a content-only `SingleRequestTemplateBinding{Plan, Review string}` to the admission value. Preserve `NewSingleRequestBinding` as a compatibility wrapper using built-ins, and add `NewSingleRequestBindingWithTemplates` for preset admission. Both validate through the shared template package and copy strings; `Clone` and workspace revalidation retain the frozen values. `compileSingleRequestBinding` passes `sr.Templates.EffectivePlan/EffectiveReview` after defense-in-depth validation. No config path crosses into service, provider messages, artifacts, logs, or caller responses.
+
+Before (`single_request_preset_binding.go:75-82`):
+
+```go
+return edgeservice.NewSingleRequestBinding(
+    publicModel, sr.WorkspaceRef,
+    *planBinding, *workBinding, *reviewBinding, limits,
+)
+```
+
+After:
+
+```go
+return edgeservice.NewSingleRequestBindingWithTemplates(
+    publicModel, sr.WorkspaceRef,
+    *planBinding, *workBinding, *reviewBinding, limits,
+    edgeservice.SingleRequestTemplateBinding{
+        Plan: sr.Templates.EffectivePlan,
+        Review: sr.Templates.EffectiveReview,
+    },
+)
+```
+
+**Modified Files and Checklist**
+
+- [ ] Add template snapshot, compatibility constructor, validation, and clone preservation in `apps/edge/internal/service/single_request_types.go`.
+- [ ] Add default/custom constructor, mutation isolation, clone, and workspace revalidation tests in `apps/edge/internal/service/single_request_types_test.go`.
+- [ ] Pass only validated effective content during preset compilation in `apps/edge/internal/openai/single_request_preset_binding.go`.
+- [ ] Extend preset binding managed, defensive-copy, and refresh-isolation tests in `apps/edge/internal/openai/single_request_preset_binding_test.go`.
+
+**Test Strategy**
+
+Write focused service tests asserting legacy callers receive built-ins, invalid template content is rejected, clones are independent, and workspace admission retains the exact snapshot. Extend preset refresh isolation by mutating the source policy after compilation and proving the admitted binding still holds the original content while a newly compiled binding receives the new content.
+
+**Verification**
+
+```bash
+go test -count=1 ./apps/edge/internal/service -run 'TestSingleRequestBinding'
+go test -count=1 ./apps/edge/internal/openai -run 'TestSingleRequestPresetBinding'
+```
+
+Expected: fresh PASS with legacy constructor compatibility and request-start isolation.
+
+### [API-3] Direct compact PlanMD stage
+
+**Problem**
+
+The plan stage asks for JSON (`apps/edge/internal/openai/single_request_plan_stage.go:13`), injects a provider `json_schema` (`:35-72`), decodes it, and then hard-codes Markdown (`:86-126`). This adds structured-output overhead and cannot honor the selected template.
+
+**Solution**
+
+Read the frozen Plan template from `ctrl.Binding()`, build a concise system prompt containing that exact template and server-owned field/cardinality limits, omit `ResponseFormat`, and accept exactly one Markdown document. Parse it with the shared static-fragment compiler and enforce goal/step/verification and byte limits before writing the internal Plan artifact. A missing/invalid binding template is a validation/malformed stage failure; there is no fallback after request admission.
+
+Before (`single_request_plan_stage.go:68-77`):
+
+```go
+response, err := s.provider.submit(ctx, singleRequestProviderStageRequest{
+    Messages:       []chatMessage{{Role: "system", Content: singleRequestPlanPrompt}, {Role: "user", Content: req.Task}},
+    ResponseFormat: singleRequestPlanResponseFormat(),
+})
+content, err := renderSingleRequestPlan(response.Output, req.Limits.MaxOutputBytes)
+```
+
+After:
+
+```go
+binding := ctrl.Binding()
+if binding == nil {
+    return nil, quality.validation(errSingleRequestPlanStage)
+}
+response, err := s.provider.submit(ctx, singleRequestProviderStageRequest{
+    Messages: []chatMessage{
+        {Role: "system", Content: singleRequestPlanPrompt(binding.Templates.Plan)},
+        {Role: "user", Content: req.Task},
+    },
+})
+content, err := singlerequesttemplate.ParsePlan(
+    binding.Templates.Plan, response.Output, req.Limits.MaxOutputBytes,
+)
+```
+
+Use the real return type chosen by the shared package; the contract is validated canonical artifact bytes.
+
+**Modified Files and Checklist**
+
+- [ ] Remove JSON schema/result code, inject the frozen template, and parse direct Markdown in `apps/edge/internal/openai/single_request_plan_stage.go`.
+- [ ] Rewrite `apps/edge/internal/openai/single_request_plan_stage_test.go` fixtures to assert no `response_format`, exact built-in/custom artifacts, controller binding use, byte cap, static mismatch, unknown/unresolved token, and step/verification cardinalities.
+
+**Test Strategy**
+
+Replace JSON-shape expectations rather than layering new tests over obsolete behavior. Keep existing envelope, artifact-write, provider-error, and quality-classification assertions. Add table cases for 1/2/6/7 steps, 0/1/3/4 verification bullets, multiline goal, altered heading/static text, trailing content, custom valid template, and max-output boundary.
+
+**Verification**
+
+```bash
+go test -count=1 ./apps/edge/internal/openai -run 'TestSingleRequestPlanStage'
+```
+
+Expected: fresh PASS; provider requests contain no JSON response format and only valid compact PlanMD reaches the artifact store.
+
+### [API-4] Compact Review artifact without changing the control loop
+
+**Problem**
+
+The review pass schema has only `decision`, `output`, and `summary` (`apps/edge/internal/openai/single_request_review_stage.go:45-67`), and the artifact renderer writes only `# Review` plus summary (`:408-434`). The inspection/repair loop and caller final output are already correct and must remain unchanged (`:74-135`).
+
+**Solution**
+
+Keep tool-call versus pass JSON as the review control protocol. Add required non-empty `checks` and `verification` fields to the pass object and prompt; render only the approved internal Review artifact with the frozen Review template. Continue returning `output` unchanged as the caller-visible final result and `summary` as runtime metadata. Preserve the exact not-found→repair rule, tool budgets, sequence transitions, quality mapping, and no-pass-after-repair invariant.
+
+Before (`single_request_review_stage.go:50-54`, `425-434`):
+
+```go
+type singleRequestReviewDecision struct {
+    Decision string `json:"decision"`
+    Output   string `json:"output"`
+    Summary  string `json:"summary"`
+}
+
+artifact := []byte("# Review\n\n" + summary + "\n")
+```
+
+After:
+
+```go
+type singleRequestReviewDecision struct {
+    Decision     string `json:"decision"`
+    Output       string `json:"output"`
+    Checks       string `json:"checks"`
+    Verification string `json:"verification"`
+    Summary      string `json:"summary"`
+}
+
+artifact, err := singlerequesttemplate.RenderReview(
+    binding.Templates.Review,
+    singlerequesttemplate.ReviewFields{
+        Checks: decision.Checks, Verification: decision.Verification, Summary: decision.Summary,
+    },
+    maximum,
+)
+```
+
+Thread the frozen template or binding into the renderer without adding caller-controlled input.
+
+**Modified Files and Checklist**
+
+- [ ] Extend pass validation/prompt and template rendering only in `apps/edge/internal/openai/single_request_review_stage.go`.
+- [ ] Update all pass fixtures and exact-body assertions in `apps/edge/internal/openai/single_request_review_stage_test.go`; add built-in/custom artifact, missing/unknown field, output/artifact cap, and snapshot cases while retaining every tool/repair test.
+
+**Test Strategy**
+
+Update the shared review-pass fixture helper so all existing control-loop tests exercise the new strict fields. Add exact artifact assertions and explicitly prove the caller output is still `decision.output`, not the Review Markdown. Existing inspection, repair, malformed/tool-budget, sequencing, and quality tests must continue unchanged in meaning.
+
+**Verification**
+
+```bash
+go test -count=1 ./apps/edge/internal/openai -run 'TestSingleRequestReviewStage'
+```
+
+Expected: fresh PASS; Review artifacts use the selected template and all repair/final-output invariants remain green.
+
+### [API-5] Operator contract, current specs, and integrated evidence
+
+**Problem**
+
+The commented preset example ends at stage bindings (`configs/edge.yaml:576-593`), and current refresh/surface/runtime documents do not describe template-file safety, request-start snapshot semantics, direct PlanMD, or templated Review artifacts.
+
+**Solution**
+
+Add a comment-only example:
+
+```yaml
+#       templates:
+#         plan_file: "templates/plan.md"     # relative to this edge.yaml
+#         review_file: "templates/review.md" # relative to this edge.yaml
+```
+
+Document omitted-per-file built-in fallback, configured-file fail-closed behavior, 8 KiB/regular-file/closed-token limits, live-apply for new requests only, content/path privacy, direct Plan artifact validation, and unchanged review/tool/caller-output semantics. Keep the outer request schema unchanged and state that templates are operator-only configuration.
+
+**Modified Files and Checklist**
+
+- [ ] Update the comment-only operator example in `configs/edge.yaml`.
+- [ ] Update refresh admission/snapshot behavior in `agent-contract/inner/edge-config-runtime-refresh.md`.
+- [ ] Update single-request Claude/Anthropic-compatible behavior without adding caller fields in `agent-contract/outer/anthropic-compatible-api.md`.
+- [ ] Synchronize refresh behavior in `agent-spec/runtime/provider-pool-config-refresh.md`.
+- [ ] Synchronize request-start template binding and internal artifacts in `agent-spec/runtime/edge-node-execution.md`.
+- [ ] Synchronize the OpenAI-compatible single-request surface and unchanged final-output contract in `agent-spec/input/openai-compatible-surface.md`.
+- [ ] Run all fresh local checks, push the exact feature commit, sync/rebuild the remote dev checkout, and execute one Claude single-request smoke or record the exact SOPS identity blocker.
+
+**Test Strategy**
+
+No separate documentation test is needed. The config parser tests validate the documented YAML surface, the focused Go tests validate both artifact variants, and the existing repository-owned harness provides deployed lifecycle evidence.
+
+**Verification**
+
+```bash
+make test-single-request-claude-smoke-self-test
+go test -race -count=1 ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/edge/internal/configrefresh ./packages/go/config ./packages/go/singlerequesttemplate
+```
+
+Expected: fresh PASS; no cached output is accepted.
+
+## Modified Files Summary
+
+| File | Item |
+|---|---|
+| `packages/go/singlerequesttemplate/template.go` | API-1 |
+| `packages/go/singlerequesttemplate/template_test.go` | API-1 |
+| `packages/go/config/execution_preset_types.go` | API-1 |
+| `packages/go/config/load.go` | API-1 |
+| `packages/go/config/model_execution_preset_config_test.go` | API-1 |
+| `apps/edge/internal/configrefresh/classify.go` | API-1 |
+| `apps/edge/internal/configrefresh/execution_preset_classify_test.go` | API-1 |
+| `apps/edge/internal/service/single_request_types.go` | API-2 |
+| `apps/edge/internal/service/single_request_types_test.go` | API-2 |
+| `apps/edge/internal/openai/single_request_preset_binding.go` | API-2 |
+| `apps/edge/internal/openai/single_request_preset_binding_test.go` | API-2 |
+| `apps/edge/internal/openai/single_request_plan_stage.go` | API-3 |
+| `apps/edge/internal/openai/single_request_plan_stage_test.go` | API-3 |
+| `apps/edge/internal/openai/single_request_review_stage.go` | API-4 |
+| `apps/edge/internal/openai/single_request_review_stage_test.go` | API-4 |
+| `configs/edge.yaml` | API-5 |
+| `agent-contract/inner/edge-config-runtime-refresh.md` | API-5 |
+| `agent-contract/outer/anthropic-compatible-api.md` | API-5 |
+| `agent-spec/runtime/provider-pool-config-refresh.md` | API-5 |
+| `agent-spec/runtime/edge-node-execution.md` | API-5 |
+| `agent-spec/input/openai-compatible-surface.md` | API-5 |
+| `agent-task/single_request_plan_review_templates/CODE_REVIEW-cloud-G07.md` | API-1, API-2, API-3, API-4, API-5 evidence |
+
+## Final Verification
+
+Run from `/config/workspace/iop-s2` on `feature/single-request-plan-review-templates`. Fresh output is required; Go test cache is disabled with `-count=1`.
+
+```bash
+test -z "$(gofmt -l packages/go/singlerequesttemplate/template.go packages/go/singlerequesttemplate/template_test.go packages/go/config/execution_preset_types.go packages/go/config/load.go packages/go/config/model_execution_preset_config_test.go apps/edge/internal/configrefresh/classify.go apps/edge/internal/configrefresh/execution_preset_classify_test.go apps/edge/internal/service/single_request_types.go apps/edge/internal/service/single_request_types_test.go apps/edge/internal/openai/single_request_preset_binding.go apps/edge/internal/openai/single_request_preset_binding_test.go apps/edge/internal/openai/single_request_plan_stage.go apps/edge/internal/openai/single_request_plan_stage_test.go apps/edge/internal/openai/single_request_review_stage.go apps/edge/internal/openai/single_request_review_stage_test.go)"
+go test -count=1 ./packages/go/singlerequesttemplate ./packages/go/config ./apps/edge/internal/configrefresh
+go test -count=1 ./apps/edge/internal/service -run 'TestSingleRequestBinding'
+go test -count=1 ./apps/edge/internal/openai -run 'TestSingleRequest(PlanStage|ReviewStage|PresetBinding)'
+go test -race -count=1 ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/edge/internal/configrefresh ./packages/go/config ./packages/go/singlerequesttemplate
+go test -count=1 ./apps/edge/... ./packages/go/...
+make test-single-request-claude-smoke-self-test
+```
+
+Expected: all commands PASS, no formatting output, no race report, and no cached test result accepted.
+
+After the local commands pass, commit and push the exact feature HEAD, then run this source-identity preflight from `/config/workspace/iop-s2`:
+
+```bash
+test "$(git branch --show-current)" = "feature/single-request-plan-review-templates"
+test -z "$(git status --porcelain)"
+git push origin HEAD:feature/single-request-plan-review-templates
+expected_commit="$(git rev-parse HEAD)"
+test "$(git ls-remote origin refs/heads/feature/single-request-plan-review-templates | cut -f1)" = "$expected_commit"
+ssh -o BatchMode=yes toki@toki-labs.com bash -s -- "$expected_commit" <<'REMOTE'
+set -eu
+repo=/Users/toki/agent-work/iop-dev
+cd "$repo"
+git fetch origin feature/single-request-plan-review-templates
+git switch --force-create feature/single-request-plan-review-templates origin/feature/single-request-plan-review-templates
+git reset --hard origin/feature/single-request-plan-review-templates
+git clean -fd
+test "$(git rev-parse HEAD)" = "$1"
+test -z "$(git status --porcelain)"
+test "$(/opt/homebrew/bin/go env GOOS)-$(/opt/homebrew/bin/go env GOARCH)" = "darwin-arm64"
+/opt/homebrew/bin/claude --version
+/opt/homebrew/bin/sops --version
+test -f /Users/toki/.config/iop/secrets/dev-openai-toki.sops.yaml
+test -f build/dev-runtime/node-codex.yaml
+test -f /Users/toki/agent-work/iop-s12-validation-20260808/source/build/s12/runtime/edge.yaml
+REMOTE
+```
+
+Expected: the runner is a clean exact copy of the pushed feature commit, Darwin/arm64 tools/configs exist, and no secret value is printed. `git clean -fd` intentionally removes the preflight-observed untracked backup; do not preserve it.
+
+On that runner, build into a clean task-specific directory, validate config, verify current port owners before stopping only the superseded S12 validation Edge/Node, atomically install the new binaries, and restart the dev runtime:
+
+```bash
+ssh -o BatchMode=yes toki@toki-labs.com bash -s <<'REMOTE'
+set -eu
+repo=/Users/toki/agent-work/iop-dev
+cd "$repo"
+rm -rf /tmp/iop-single-request-template-build
+PATH=/opt/homebrew/bin:$PATH make build-edge build-node BUILD_DIR=/tmp/iop-single-request-template-build EDGE_TARGET=darwin-arm64
+cp /Users/toki/agent-work/iop-s12-validation-20260808/source/build/s12/runtime/edge.yaml build/dev-runtime/single-request-template-edge.yaml
+/tmp/iop-single-request-template-build/bin/iop-edge config check --config "$repo/build/dev-runtime/single-request-template-edge.yaml"
+for port in 18083 18084 19093 19101; do
+  /usr/sbin/lsof -nP -iTCP:"$port" -sTCP:LISTEN || true
+done
+edge_pid="$(/usr/sbin/lsof -tiTCP:18083 -sTCP:LISTEN 2>/dev/null || true)"
+if test -n "$edge_pid"; then
+  edge_cmd="$(ps -p "$edge_pid" -o command=)"
+  case "$edge_cmd" in
+    *iop-s12-validation-20260808*edge*) kill "$edge_pid"; wait "$edge_pid" 2>/dev/null || true ;;
+    *build/dev-runtime/bin/edge*) kill "$edge_pid"; wait "$edge_pid" 2>/dev/null || true ;;
+    *) printf 'unexpected 18083 owner: %s\n' "$edge_cmd" >&2; exit 1 ;;
+  esac
+fi
+node_pid="$(pgrep -f 'iop-s12-validation-20260808/.*/iop-node.*--config /Users/toki/agent-work/iop-dev/build/dev-runtime/node-codex.yaml serve' || true)"
+if test -n "$node_pid"; then kill "$node_pid"; wait "$node_pid" 2>/dev/null || true; fi
+install -m 0755 /tmp/iop-single-request-template-build/bin/iop-edge build/dev-runtime/bin/edge.next
+install -m 0755 /tmp/iop-single-request-template-build/bin/iop-node build/dev-runtime/bin/iop-node.next
+mv build/dev-runtime/bin/edge.next build/dev-runtime/bin/edge
+mv build/dev-runtime/bin/iop-node.next build/dev-runtime/bin/iop-node
+nohup build/dev-runtime/bin/edge --config "$repo/build/dev-runtime/single-request-template-edge.yaml" serve >build/dev-runtime/logs/edge.template.stdout.log 2>build/dev-runtime/logs/edge.template.stderr.log &
+echo $! >build/dev-runtime/edge.pid
+nohup build/dev-runtime/bin/iop-node --config "$repo/build/dev-runtime/node-codex.yaml" serve >build/dev-runtime/logs/node-template.stdout.log 2>build/dev-runtime/logs/node-template.stderr.log &
+echo $! >build/dev-runtime/node-codex.pid
+sleep 2
+kill -0 "$(cat build/dev-runtime/edge.pid)"
+kill -0 "$(cat build/dev-runtime/node-codex.pid)"
+/usr/sbin/lsof -nP -iTCP:18083 -sTCP:LISTEN
+REMOTE
+```
+
+Expected: only the explicitly matched validation/dev owners are replaced; the new dev Edge and Node remain alive and the configured OpenAI ingress listens on 18083. If config check shows different declared ports, record the mismatch and update the command under `Deviations from Plan` before any stop/start action.
+
+Finally, after the matching age identity/loader has populated `IOP_SINGLE_REQUEST_SMOKE_TOKEN` in the same remote shell without printing it, generate fresh runtime evidence for the exact feature commit/binaries/task config and run:
+
+```bash
+cd /Users/toki/agent-work/iop-dev
+test -n "${IOP_SINGLE_REQUEST_SMOKE_TOKEN:-}"
+test -f /tmp/iop-single-request-template-runtime.json
+rm -rf /tmp/iop-single-request-template-workspace
+mkdir -m 700 /tmp/iop-single-request-template-workspace
+rm -f /tmp/iop-single-request-template-smoke.json
+PATH=/opt/homebrew/bin:$PATH make test-single-request-claude-smoke-preflight test-single-request-claude-smoke test-single-request-claude-smoke-validate \
+  IOP_SINGLE_REQUEST_SMOKE_CLAUDE_BIN=/opt/homebrew/bin/claude \
+  IOP_SINGLE_REQUEST_SMOKE_RUNTIME_EVIDENCE=/tmp/iop-single-request-template-runtime.json \
+  IOP_SINGLE_REQUEST_SMOKE_BASE_URL=http://127.0.0.1:18083 \
+  IOP_SINGLE_REQUEST_SMOKE_MODEL=iop-single-request-light \
+  IOP_SINGLE_REQUEST_SMOKE_EDGE_BIN=/Users/toki/agent-work/iop-dev/build/dev-runtime/bin/edge \
+  IOP_SINGLE_REQUEST_SMOKE_NODE_BIN=/Users/toki/agent-work/iop-dev/build/dev-runtime/bin/iop-node \
+  IOP_SINGLE_REQUEST_SMOKE_EDGE_CONFIG=/Users/toki/agent-work/iop-dev/build/dev-runtime/single-request-template-edge.yaml \
+  IOP_SINGLE_REQUEST_SMOKE_OBSERVATION_FILE=/Users/toki/agent-work/iop-s12-validation-20260808/source/build/s12/runtime/edge.log \
+  IOP_SINGLE_REQUEST_SMOKE_METRICS_URL=http://127.0.0.1:19101/metrics \
+  IOP_SINGLE_REQUEST_SMOKE_WORKSPACE=/tmp/iop-single-request-template-workspace \
+  IOP_SINGLE_REQUEST_SMOKE_OUTPUT=/tmp/iop-single-request-template-smoke.json \
+  IOP_SINGLE_REQUEST_SMOKE_SECRET_ENV=IOP_SINGLE_REQUEST_SMOKE_TOKEN
+```
+
+Expected: preflight, one Claude single-request cycle, and manifest validation PASS; the manifest identifies the exact feature commit, rebuilt binaries/config, planning→working→reviewing→finalizing lifecycle, final output, observations, and timing. Runtime-evidence generation must follow the closed schema accepted by `scripts/e2e-single-request-claude.sh` and bind the exact HEAD, clean worktree, binaries, copied config, `iop-single-request-light`, stage engines, workspace, and command-output digests. It is currently blocked because the remote SOPS file cannot be decrypted without its matching age identity; do not fabricate/reuse evidence or substitute the Claude provider credential. Record the raw SOPS failure and resume condition in `Verification Results` for official external-execution review.
+
+After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.