<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=28 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Preserve Gemini thought signatures privately and execute the eleventh guarded qualification

## For the Implementing Agent

Resolve R28 by admitting only the exact Gemini OpenAI-compatible `extra_content.google.thought_signature` shape. Discard terminal text signatures, preserve a Review tool-call signature only in the private resumed Gemini message, and prove it never reaches artifacts, output, or logs. Rebuild the disposable Edge, pass fresh provider-free gates, then use the continuing task-scoped authorization for exactly one `sole-live-11` Claude-through-IOP invocation.

## Background

`sole-live-10.rc-69` proves exact caller cardinality and one Gemini Plan tunnel, but the Plan response still fails before content parsing. R26 already admits and discards `reasoning_content`. Google's current Gemini thought-signature contract documents `extra_content.google.thought_signature` in OpenAI-compatible function calls, requires exact replay for Gemini 3 tool continuations, and notes that thinking models can return a signature on non-function final content. The private Plan message allowlist rejects message `extra_content`; the Review tool-call codec also rejects and cannot replay it.

Primary contract: https://ai.google.dev/gemini-api/docs/generate-content/thought-signatures

## Finding Resolution Map

| Finding | Resolution | Acceptance evidence |
|---|---|---|
| R28 | Strict typed Google thought-signature envelope in Plan and Review; private continuation-only replay | Positive Plan/final Review/tool Review fixtures, resumed-body equality, nested wrong-type/unknown/empty rejection, zero artifact/result/log leak |
| R29 | Exact sync/rebuild/readiness and one eleventh guard | One ingress, ordered stages, verified workspace/terminal/manifest or closed new failure evidence |

## Scope and Safety

- Keep Work's Ornith response decoder unchanged; Google-specific metadata belongs only to Gemini Plan and Review paths.
- `extra_content` admits exactly one `google` object containing exactly one non-empty string `thought_signature`. No arbitrary provider extension is accepted.
- Plan and terminal Review signatures are discarded. A Review tool-call signature exists only in request-local memory and is copied exactly into the immediately resumed assistant tool-call message required by Gemini; it never enters a stage result, artifact, caller output, structured observation, or durable evidence.
- Canonical `/Users/toki/agent-work/iop-dev` remains read-only. Claude calls only `https://127.0.0.1:18483`; Gemini/Ornith credentials and routes remain IOP-owned.

## Modified Files Summary

| File | Change |
|---|---|
| `apps/edge/internal/openai/single_request_provider_stage.go` | Strict message-level Google thought-signature type and Plan discard |
| `apps/edge/internal/openai/single_request_provider_stage_test.go` | Positive/negative exact-envelope coverage |
| `apps/edge/internal/openai/single_request_review_stage.go` | Review-specific response/tool-call types and private signature replay |
| `apps/edge/internal/openai/single_request_review_stage_test.go` | Terminal discard, tool continuation replay, malformed nested-shape and leakage coverage |
| `agent-contract/outer/anthropic-compatible-api.md` | Private Gemini signature boundary |
| `agent-spec/runtime/edge-node-execution.md` | Implemented Plan/Review signature ownership |
| `agent-test/dev/edge-smoke.md` | S12 signature privacy/replay verification |

## Implementation Checklist

- [x] Add exact typed Plan message signature admission/discard and strict nested negative tests.
- [x] Decouple Review provider message/tool-call types where needed; preserve a valid signature only in the matching resumed provider request.
- [x] Prove signature text never appears in Plan/Review artifacts, final output, tool results, or structured observations.
- [x] Run local ordinary/race/harness/diff checks.
- [x] Sync exact changes to isolated dev, run remote ordinary/race/self-tests, rebuild/restart Edge, and refresh runtime evidence.
- [x] Pass TLS/fleet/catalog/count-token/structured-log/preflight with ten finalized guards and no artifacts.
- [x] Create/finalize exactly one `sole-live-11` invocation with title/retry suppression and no wrapper retry.
- [x] Publish only full schema-valid S12 evidence; otherwise retain closed evidence and continue after diagnosis.
- [x] Fill implementation-owned review sections and stop for official review.

## Final Verification

1. Exact message and tool-call signature fixtures pass; empty, null, non-string, unknown nested members, and duplicate keys fail closed.
2. Review continuation body retains the exact private signature beside only its originating tool call; Work remains Google-extension-free.
3. Local and isolated dev ordinary/race/harness/diff checks pass.
4. Rebuilt managed Edge identity and `edge-runtime.log` are bound into fresh runtime evidence; ingress remains zero through preflight.
5. The eleventh run qualifies only if ingress delta is one and Plan -> Work -> Review, workspace verification/cleanup, terminal, manifest schema, and privacy all pass.
