<!-- task=m-principal-provider-credential-slot-routing/10+08,09_verification_contracts plan=2 tag=REVIEW_TEST milestone-task=slot-smoke,contract-ops -->

# Code Review Reference - REVIEW_TEST

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-02
task=m-principal-provider-credential-slot-routing/10+08,09_verification_contracts, plan=2, tag=REVIEW_TEST

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/plan_local_G07_1.log`.
- Prior review: `agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/code_review_cloud_G07_1.log`.
- Verdict: FAIL. Findings: 4 Required, 0 Suggested, 0 Nit. Routing signals: `review_rework_count=1`, `evidence_integrity_failure=true`.
- Required scope: repair early live-mode parsing/gating and the actual one-shot path; make the deterministic smoke executable and acceptance-complete; synchronize every planned canonical contract/spec/index/runbook; replace reconstructed evidence and the false predecessor blocker with exact fresh results.
- Affected implementation files are the credential-slot smoke and fixture plus the canonical contract/spec/runbook files listed in `Modified Files Summary`; no production Go change was authorized by this follow-up.
- Fresh reviewer evidence: `bash -n` and fixture JSON validation passed; `./scripts/e2e-credential-slot-smoke.sh --self-test-live-gate` exited 1 and `make test-credential-slot-smoke` exited 2 because the script executed binaries from a noexec `/tmp`; the exact broad package test exited 1 in the same noexec environment, while the affected package set passed with an executable external `TMPDIR`; `go vet`, pointer/leak checks, and `git diff --check` passed.
- Both predecessor gates are already satisfied by exact PASS evidence at `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/complete.log` and `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/09+08_migration_attribution/complete.log`. Do not search archive siblings or require restoration into active task paths.
- Roadmap carryover: milestone `principal-provider-credential-slot-routing`, task ids `slot-smoke,contract-ops`, SDD criteria S16-S17. Do not write `complete.log` or update roadmap state from implementation.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G10.md` → `code_review_cloud_G10_2.log` and `PLAN-cloud-G10.md` → `plan_cloud_G10_2.log`.
3. If PASS, write `complete.log` and move the active task directory to `agent-task/archive/YYYY/MM/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, preserve the first-line `milestone-task` metadata in `complete.log` and report it for the runtime aggregation event. Roadmap state evaluation belongs to `sync-milestone-workstate`.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_TEST-1 — Repair deterministic full-cycle qualification | [ ] |
| REVIEW_TEST-2 — Repair the gated representative live one-shot | [x] |
| REVIEW_TEST-3 — Synchronize canonical contracts, specs, indexes, and runbooks | [x] |
| REVIEW_TEST-4 — Replace untrustworthy verification evidence | [x] |

## Implementation Checklist

- [ ] Repair deterministic temp/TLS/fixture setup and prove the complete two-slot credential lifecycle with exact security assertions.
- [x] Repair early live argument parsing, fail-before-I/O gating, one-attempt real-provider routing, and the deterministic live-gate self-test.
- [x] Synchronize every listed canonical contract, spec, index, and operator guide with implemented 08/09 behavior.
- [x] Run fresh deterministic, package, vet, pointer, drift, leak, and diff verification with literal output and exit codes.
- [x] Record the single live attempt only when already authorized; otherwise record the exact external blocker and resume command without claiming S16 PASS.
- [x] Fill all implementation-owned sections in `CODE_REVIEW-*-G??.md` and leave review-only finalization untouched.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G10_2.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G10_2.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory `agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/` to `agent-task/archive/YYYY/MM/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/` and update this checklist at the final archive path.
- [ ] If PASS and task group is `m-principal-provider-credential-slot-routing`, preserve and report `milestone-task=slot-smoke,contract-ops` for runtime aggregation, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove empty active parent `agent-task/m-principal-provider-credential-slot-routing/` or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

- REVIEW_TEST-1 remains incomplete. The corrected full-stack smoke reaches the managed Chat route, then the managed `seulgi_messages` request fails with HTTP 502 before Node/upstream dispatch. Source tracing shows that `packages/go/credentiallease.validateScope` requires `http.CanonicalHeaderKey(scope.HeaderName) == scope.HeaderName`, while the built-in `seulgi_messages` profile supplies lowercase `x-api-key`; lease issuance therefore rejects the API-key scope. The plan explicitly forbids widening this follow-up into production Go, so the failure is recorded rather than bypassed with legacy caller auth, a bearer profile, or another slot.
- The exact broad package test also exits 1 in unrelated `packages/go/agentprovider/cli` and `packages/go/agentworkspace` tests because the required external `TMPDIR` filesystem cannot provide their permission/xattr confinement semantics. All credential-path packages shown in the literal output pass. No unrelated production or workspace-confinement code was changed.
- The representative external command was not executed. Explicit live-provider authorization was not supplied, and the plan additionally permits the one-shot only after every deterministic command passes; the deterministic smoke and broad package command did not pass.

## Key Design Decisions

- Parse and validate every mode flag before resolving repository paths, creating a workspace, reading stdin, building, or opening a socket. The self-test proves the rejected child leaves its FIFO input unread, creates no child workspace, and makes zero provider calls.
- Use one temporary Go helper for CA-signed role/name identities, random credential/key material, the strict loopback provider, and ciphertext-only SQLite inspection. The tracked JSON fixture supplies both concrete profile/operation/auth contracts and two explicit same-model route selectors.
- Run Control Plane credential HTTPS, CP-Edge mTLS, Edge-Node mTLS, and Edge HTTPS as one temporary managed stack. The fake compares exact bearer/API-key values and exposes safe counters only; logs run at a level that does not retain provider bodies, and cleanup redacts failure tails before deleting exact task-owned paths.
- Keep live mode on the same managed stack and fixture-selected real endpoint, with one non-stream request, no application retry, structural response validation, body disposal, and one six-field sanitized JSON record.
- Synchronize canonical documents to the active projection/lease/TLS implementation while explicitly documenting the current managed API-key fail-closed limitation. Legacy request-time provider auth is described only as a credential-plane-disabled compatibility path.

## Reviewer Checkpoints

- Confirm argument parsing and live opt-in validation occur before build, stdin read, and all network setup; mode functions are defined before invocation.
- Confirm deterministic default mode is loopback-only and honors/preflights an executable task-owned `TMPDIR` without leaving repository artifacts.
- Confirm certificates are signed by one test CA with the role/name/SAN/EKU expected by credential HTTPS, CP-Edge, and Edge-Node TLS loaders, including plaintext/no-cert/wrong-peer negative checks.
- Confirm the tracked fixture drives runtime profiles/routes and the fake validates exact bearer and API-key values on both Chat and Messages operation paths.
- Confirm ciphertext-only persistence, rotation revision, safe attribution, post-revoke request fencing, unchanged lease/upstream counters, and no same-model fallback.
- Confirm live mode uses the selected real endpoint/model through a temporary managed IOP slot, sends exactly one no-retry request, discards prompt/body/secret, and emits only the approved sanitized fields.
- Confirm all listed contracts/specs/indexes/runbooks describe active 08/09 behavior and no longer call managed projection inactive, the authenticated connector plaintext, or caller provider-auth forwarding current.
- Confirm verification output is literal and fresh, predecessor evidence cites the two archived PASS logs, and no secret/private key/prompt/body/lease id appears in tracked files or evidence.

## Verification Results

### Environment, syntax, deterministic gate, and full smoke

Command:

```bash
credential_smoke_parent="$(mktemp -d /config/workspace/iop-credential-slot-review.XXXXXX)"
trap 'rmdir "$credential_smoke_parent" 2>/dev/null || true' EXIT
command -v go && go version && go env GOROOT
command -v bash && command -v jq && command -v openssl && openssl version
command -v sops && command -v curl && command -v netstat
git status --short --branch
bash -n scripts/e2e-credential-slot-smoke.sh
jq -e '.profiles | length >= 4 and any(.[]; .id == "seulgi_chat") and any(.[]; .id == "seulgi_messages")' scripts/fixtures/credential-slot-vendors.json >/dev/null
TMPDIR="$credential_smoke_parent" ./scripts/e2e-credential-slot-smoke.sh --self-test-live-gate
TMPDIR="$credential_smoke_parent" make test-credential-slot-smoke
```

Actual sanitized stdout, stderr, and exit statuses:

`command -v go && go version && go env GOROOT`

```text
/config/.local/bin/go
go version go1.26.2 linux/arm64
/config/opt/go
```

Exit status: `0`.

`command -v bash && command -v jq && command -v openssl && openssl version`

```text
/bin/bash
/bin/jq
/bin/openssl
OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024)
```

Exit status: `0`.

`command -v sops && command -v curl && command -v netstat`

```text
/config/.local/bin/sops
/bin/curl
/bin/netstat
```

Exit status: `0`.

`git status --short --branch`

```text
## agent/dispatcher-work-log-artifact-loop...origin/agent/dispatcher-work-log-artifact-loop
 M Makefile
 M agent-contract/index.md
 M agent-contract/inner/client-control-plane-wire.md
 M agent-contract/inner/control-plane-edge-wire.md
 M agent-contract/inner/edge-config-runtime-refresh.md
 M agent-contract/inner/edge-node-runtime-wire.md
 M agent-contract/outer/anthropic-compatible-api.md
 M agent-contract/outer/openai-compatible-api.md
 M agent-roadmap/phase/operational-observability-provider-management/PHASE.md
 M agent-roadmap/phase/operational-observability-provider-management/milestones/principal-provider-credential-slot-routing.md
 M agent-spec/control/control-plane-operations.md
 M agent-spec/index.md
 M agent-spec/input/openai-compatible-surface.md
 M agent-spec/runtime/edge-node-execution.md
 M agent-spec/runtime/provider-pool-config-refresh.md
 D agent-task/m-principal-provider-credential-slot-routing/01_principal_store/CODE_REVIEW-cloud-G06.md
 D agent-task/m-principal-provider-credential-slot-routing/01_principal_store/PLAN-local-G06.md
 D agent-task/m-principal-provider-credential-slot-routing/02+01_credential_catalog/CODE_REVIEW-cloud-G07.md
 D agent-task/m-principal-provider-credential-slot-routing/02+01_credential_catalog/PLAN-local-G07.md
 D agent-task/m-principal-provider-credential-slot-routing/02+01_credential_catalog/code_review_cloud_G07_0.log
 D agent-task/m-principal-provider-credential-slot-routing/02+01_credential_catalog/plan_local_G07_0.log
 D agent-task/m-principal-provider-credential-slot-routing/03+01,02_projection_auth/CODE_REVIEW-cloud-G09.md
 D agent-task/m-principal-provider-credential-slot-routing/03+01,02_projection_auth/PLAN-cloud-G09.md
 D agent-task/m-principal-provider-credential-slot-routing/03+01,02_projection_auth/code_review_cloud_G10_0.log
 D agent-task/m-principal-provider-credential-slot-routing/03+01,02_projection_auth/plan_cloud_G10_0.log
 D agent-task/m-principal-provider-credential-slot-routing/04+03_principal_routes/CODE_REVIEW-cloud-G08.md
 D agent-task/m-principal-provider-credential-slot-routing/04+03_principal_routes/PLAN-local-G07.md
 D agent-task/m-principal-provider-credential-slot-routing/04+03_principal_routes/code_review_cloud_G09_0.log
 D agent-task/m-principal-provider-credential-slot-routing/04+03_principal_routes/plan_local_G08_0.log
 D agent-task/m-principal-provider-credential-slot-routing/05+01,02_management_core/CODE_REVIEW-cloud-G06.md
 D agent-task/m-principal-provider-credential-slot-routing/05+01,02_management_core/PLAN-local-G06.md
 D agent-task/m-principal-provider-credential-slot-routing/05+01,02_management_core/code_review_cloud_G08_1.log
 D agent-task/m-principal-provider-credential-slot-routing/05+01,02_management_core/code_review_cloud_G10_0.log
 D agent-task/m-principal-provider-credential-slot-routing/05+01,02_management_core/plan_cloud_G10_0.log
 D agent-task/m-principal-provider-credential-slot-routing/05+01,02_management_core/plan_local_G07_1.log
 D agent-task/m-principal-provider-credential-slot-routing/06+01,02_host_local_bootstrap/CODE_REVIEW-cloud-G06.md
 D agent-task/m-principal-provider-credential-slot-routing/06+01,02_host_local_bootstrap/PLAN-local-G06.md
 M apps/client/lib/gen/proto/iop/control.pb.dart
 M apps/client/lib/gen/proto/iop/control.pbjson.dart
 M apps/client/lib/gen/proto/iop/runtime.pb.dart
 M apps/client/lib/gen/proto/iop/runtime.pbjson.dart
 M apps/control-plane/cmd/control-plane/config_test.go
 M apps/control-plane/cmd/control-plane/main.go
 M apps/control-plane/cmd/control-plane/server.go
 M apps/control-plane/internal/wire/edge.go
 M apps/control-plane/internal/wire/edge_server.go
 M apps/control-plane/internal/wire/edge_server_test.go
 M apps/control-plane/internal/wire/edge_test.go
 M apps/edge/internal/bootstrap/runtime.go
 M apps/edge/internal/configrefresh/classify.go
 M apps/edge/internal/controlplane/connector.go
 M apps/edge/internal/controlplane/connector_test.go
 M apps/edge/internal/input/manager.go
 M apps/edge/internal/input/manager_test.go
 M apps/edge/internal/node/registry.go
 M apps/edge/internal/openai/anthropic_handler.go
 M apps/edge/internal/openai/anthropic_surface_test.go
 M apps/edge/internal/openai/chat_handler.go
 M apps/edge/internal/openai/dispatch_context.go
 M apps/edge/internal/openai/identity_metering_test.go
 M apps/edge/internal/openai/principal.go
 M apps/edge/internal/openai/provider_tunnel.go
 M apps/edge/internal/openai/responses_handler.go
 M apps/edge/internal/openai/responses_protocol_profile_test.go
 M apps/edge/internal/openai/route_resolution.go
 M apps/edge/internal/openai/routes.go
 M apps/edge/internal/openai/server.go
 M apps/edge/internal/openai/stream_gate_runtime.go
 M apps/edge/internal/openai/usage_metrics.go
 M apps/edge/internal/openai/usage_metrics_test.go
 M apps/edge/internal/service/provider_pool.go
 M apps/edge/internal/service/provider_tunnel.go
 M apps/edge/internal/service/run_dispatch_internal_test.go
 M apps/edge/internal/service/run_types.go
 M apps/edge/internal/service/service.go
 M apps/edge/internal/service/usage_attribution_dispatch_test.go
 M apps/edge/internal/transport/connection_handlers.go
 M apps/edge/internal/transport/integration_test.go
 M apps/edge/internal/transport/server.go
 M apps/node/internal/adapters/openai_compat/provider_tunnel.go
 M apps/node/internal/adapters/openai_compat/provider_tunnel_test.go
 M apps/node/internal/adapters/vllm/provider_tunnel.go
 M apps/node/internal/bootstrap/module.go
 M apps/node/internal/node/node.go
 M apps/node/internal/node/provider_tunnel_test.go
 M apps/node/internal/node/tunnel_handler.go
 M apps/node/internal/transport/client.go
 M configs/control-plane.yaml
 M configs/edge.yaml
 M configs/node.yaml
 M docs/edge-local-dev-guide.md
 M docs/openai-usage-grafana.md
 M go.mod
 M go.sum
 M go.work.sum
 M packages/go/agentruntime/types.go
 M packages/go/auth/auth.go
 M packages/go/config/edge_types.go
 M packages/go/config/load.go
 M packages/go/config/node_types.go
 M packages/go/config/validate.go
 M proto/gen/iop/control.pb.go
 M proto/gen/iop/runtime.pb.go
 M proto/iop/control.proto
 M proto/iop/runtime.proto
?? agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/
?? agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/
?? agent-task/m-principal-provider-credential-slot-routing/WORK_LOG.md
?? apps/control-plane/cmd/control-plane/credential_commands.go
?? apps/control-plane/cmd/control-plane/credential_commands_test.go
?? apps/control-plane/cmd/control-plane/credential_http_handlers.go
?? apps/control-plane/cmd/control-plane/credential_http_handlers_test.go
?? apps/control-plane/cmd/control-plane/credential_store_test.go
?? apps/control-plane/cmd/control-plane/secure_delivery_integration_test.go
?? apps/control-plane/internal/credentiallease/
?? apps/control-plane/internal/credentialops/
?? apps/control-plane/internal/credentialseal/
?? apps/control-plane/internal/credentialstore/
?? apps/edge/internal/authprojection/
?? apps/edge/internal/bootstrap/credential_plane_mode_test.go
?? apps/edge/internal/openai/credential_migration_test.go
?? apps/edge/internal/openai/principal_routes.go
?? apps/edge/internal/openai/principal_routes_test.go
?? apps/edge/internal/service/provider_tunnel_credential_test.go
?? packages/go/auth/auth_test.go
?? packages/go/config/credential_plane_config_test.go
?? packages/go/config/tls_types.go
?? packages/go/config/tls_types_test.go
?? packages/go/credentiallease/
?? scripts/e2e-credential-slot-smoke.sh
?? scripts/fixtures/credential-slot-vendors.json
```

Exit status: `0`.

`bash -n scripts/e2e-credential-slot-smoke.sh`

Literal captured stdout/stderr: empty. Exit status: `0`.

Fixture `jq -e` command

Literal captured stdout/stderr: empty. Exit status: `0`.

`TMPDIR="$credential_smoke_parent" ./scripts/e2e-credential-slot-smoke.sh --self-test-live-gate`

```text
{"mode":"self-test-live-gate","zero_io_without_opt_in":true,"stdin_unread_without_opt_in":true,"authorized_upstream_calls":1,"retries":0,"forwarded_options":true,"sanitized_output":true,"result":"success"}
```

Exit status: `0`.

`TMPDIR="$credential_smoke_parent" make test-credential-slot-smoke`

```text
./scripts/e2e-credential-slot-smoke.sh
[credential-slot-smoke] building fresh Control Plane, Edge, and Node binaries
[credential-slot-smoke] bootstrapping one principal without exposing its one-time token
[credential-slot-smoke] ERROR: Messages request returned HTTP 502
=== control-plane.log (sanitized tail) ===
2026/08/02 06:34:26 http: TLS handshake error from 127.0.0.1:56746: client sent an HTTP request to an HTTPS server
2026/08/02 06:34:26 http: TLS handshake error from 127.0.0.1:56758: local error: tls: bad record MAC
=== edge.log (sanitized tail) ===
[Fx] PROVIDE	fx.Lifecycle <= go.uber.org/fx.New.func1()
[Fx] PROVIDE	fx.Shutdowner <= go.uber.org/fx.(*App).shutdowner-fm()
[Fx] PROVIDE	fx.DotGraph <= go.uber.org/fx.(*App).dotGraph-fm()
[Fx] PROVIDE	*config.EdgeConfig <= iop/apps/edge/internal/bootstrap.Module.func1()
[Fx] PROVIDE	*bootstrap.Runtime <= iop/apps/edge/internal/bootstrap.NewRuntime()
[Fx] INVOKE		iop/apps/edge/internal/bootstrap.Module.func2()
[Fx] RUN	provide: go.uber.org/fx.New.func1()
[Fx] RUN	provide: iop/apps/edge/internal/bootstrap.Module.func1()
[Fx] RUN	provide: iop/apps/edge/internal/bootstrap.NewRuntime()
[Fx] HOOK OnStart		iop/apps/edge/internal/bootstrap.Module.func2.1() executing (caller: iop/apps/edge/internal/bootstrap.Module.func2)
[Fx] HOOK OnStart		iop/apps/edge/internal/bootstrap.Module.func2.1() called by iop/apps/edge/internal/bootstrap.Module.func2 ran successfully in 31.217542ms
[Fx] RUNNING
[Fx] TERMINATED
[Fx] HOOK OnStop		iop/apps/edge/internal/bootstrap.Module.func2.2() executing (caller: iop/apps/edge/internal/bootstrap.Module.func2)
[Fx] HOOK OnStop		iop/apps/edge/internal/bootstrap.Module.func2.2() called by iop/apps/edge/internal/bootstrap.Module.func2 ran successfully in 405.959µs
=== node.log (sanitized tail) ===
[Fx] PROVIDE	fx.Lifecycle <= go.uber.org/fx.New.func1()
[Fx] PROVIDE	fx.Shutdowner <= go.uber.org/fx.(*App).shutdowner-fm()
[Fx] PROVIDE	fx.DotGraph <= go.uber.org/fx.(*App).dotGraph-fm()
[Fx] PROVIDE	*config.NodeConfig <= iop/apps/node/internal/bootstrap.Module.func2()
[Fx] PROVIDE	*zap.Logger <= iop/apps/node/internal/bootstrap.Module.func3()
[Fx] INVOKE		iop/apps/node/internal/bootstrap.Module.func4()
[Fx] RUN	provide: go.uber.org/fx.New.func1()
[Fx] RUN	provide: iop/apps/node/internal/bootstrap.Module.func2()
[Fx] RUN	provide: iop/apps/node/internal/bootstrap.Module.func3()
[Fx] RUN	provide: go.uber.org/fx.(*App).shutdowner-fm()
[Fx] HOOK OnStart		iop/apps/node/internal/bootstrap.Module.func4.1() executing (caller: iop/apps/node/internal/bootstrap.Module.func4)
[Fx] HOOK OnStart		iop/apps/node/internal/bootstrap.Module.func4.1() called by iop/apps/node/internal/bootstrap.Module.func4 ran successfully in 64.291µs
[Fx] RUNNING
{"level":"info","ts":1785620065.9838872,"caller":"bootstrap/runtime_supervisor.go:116","msg":"connecting to edge","initial":true,"attempt":1,"max_attempts":30,"unlimited":false,"interval_sec":1}
{"level":"info","ts":1785620066.0956202,"caller":"transport/client.go:209","msg":"registered with edge","node_id":"node-smoke","alias":"Credential Smoke Node"}
{"level":"info","ts":1785620066.0994937,"caller":"store/store.go:62","msg":"store ready","dsn":"file:iop.db?cache=shared&mode=rwc"}
{"level":"info","ts":1785620066.1017473,"caller":"bootstrap/module.go:163","msg":"connected to edge","node_id":"node-smoke","alias":"Credential Smoke Node"}
{"level":"info","ts":1785620066.5588357,"caller":"node/tunnel_handler.go:18","msg":"provider tunnel request received","run_id":"manual-1785620066556470839","tunnel_id":"manual-1785620066556470839-tunnel","adapter":"credential-smoke-chat-provider","target":"credential-smoke-shared-model"}
[Fx] TERMINATED
[Fx] HOOK OnStop		iop/apps/node/internal/bootstrap.Module.func4.2() executing (caller: iop/apps/node/internal/bootstrap.Module.func4)
{"level":"info","ts":1785620066.582018,"caller":"transport/session.go:137","msg":"disconnected from edge","transport_close_reason":"local_close","transport_close_error":"read tcp 127.0.0.1:47552->127.0.0.1:31024: use of closed network connection"}
[edge-event] disconnected reason="local_shutdown" transport_close_reason="local_close" transport_close_error="read tcp 127.0.0.1:47552->127.0.0.1:31024: use of closed network connection"
[Fx] HOOK OnStop		iop/apps/node/internal/bootstrap.Module.func4.2() called by iop/apps/node/internal/bootstrap.Module.func4 ran successfully in 1.002666ms
[credential-slot-smoke] failure evidence was sanitized before cleanup
make: *** [Makefile:108: test-credential-slot-smoke] Error 1
```

Exit status: `2`.

The full smoke did not emit a success record. It reached only the Chat tunnel; the Messages API-key lease failed before a second Node/upstream request. REVIEW_TEST-1 and S16 remain incomplete.

### Package, vet, and diff verification

Command:

```bash
TMPDIR="$credential_smoke_parent" go test -count=1 ./apps/control-plane/... ./apps/edge/... ./apps/node/... ./packages/go/...
TMPDIR="$credential_smoke_parent" go vet ./apps/control-plane/... ./apps/edge/... ./apps/node/... ./packages/go/...
git diff --check
```

Actual stdout, stderr, and exit statuses:

`TMPDIR="$credential_smoke_parent" go test -count=1 ./apps/control-plane/... ./apps/edge/... ./apps/node/... ./packages/go/...`

```text
go: downloading github.com/stretchr/testify v1.9.0
go: downloading github.com/kylelemons/godebug v1.1.0
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
ok  	iop/apps/control-plane/cmd/control-plane	7.067s
ok  	iop/apps/control-plane/internal/credentiallease	0.690s
ok  	iop/apps/control-plane/internal/credentialops	3.838s
ok  	iop/apps/control-plane/internal/credentialseal	0.570s
ok  	iop/apps/control-plane/internal/credentialstore	10.253s
ok  	iop/apps/control-plane/internal/wire	2.170s
ok  	iop/apps/edge/cmd/edge	0.716s
ok  	iop/apps/edge/internal/authprojection	0.057s
ok  	iop/apps/edge/internal/bootstrap	8.564s
ok  	iop/apps/edge/internal/configrefresh	0.533s
ok  	iop/apps/edge/internal/controlplane	6.628s
ok  	iop/apps/edge/internal/edgecmd	0.281s
ok  	iop/apps/edge/internal/edgevalidate	0.071s
ok  	iop/apps/edge/internal/events	0.056s
ok  	iop/apps/edge/internal/input	0.093s
ok  	iop/apps/edge/internal/input/a2a	0.071s
ok  	iop/apps/edge/internal/node	0.073s
ok  	iop/apps/edge/internal/openai	7.743s
ok  	iop/apps/edge/internal/opsconsole	0.092s
ok  	iop/apps/edge/internal/service	5.983s
ok  	iop/apps/edge/internal/transport	4.897s
ok  	iop/apps/node/cmd/node	0.137s
ok  	iop/apps/node/internal/adapters	0.108s
?   	iop/apps/node/internal/adapters/mock	[no test files]
ok  	iop/apps/node/internal/adapters/ollama	0.061s
ok  	iop/apps/node/internal/adapters/openai_compat	0.180s
ok  	iop/apps/node/internal/adapters/vllm	0.161s
ok  	iop/apps/node/internal/bootstrap	1.584s
ok  	iop/apps/node/internal/node	0.914s
ok  	iop/apps/node/internal/router	0.519s
ok  	iop/apps/node/internal/store	0.123s
ok  	iop/apps/node/internal/transport	5.597s
ok  	iop/packages/go/agentconfig	0.139s
ok  	iop/packages/go/agentguard	1.007s
ok  	iop/packages/go/agentpolicy	0.049s
ok  	iop/packages/go/agentprovider/catalog	0.297s
--- FAIL: TestCLIWorkspacePreflightFailures (0.02s)
    --- FAIL: TestCLIWorkspacePreflightFailures/Helper (0.00s)
        cli_workspace_test.go:189: failed to create inaccessible dir: mkdir /config/workspace/iop-credential-slot-review.j336Co/TestCLIWorkspacePreflightFailuresHelper1136893710/001/inaccessible: permission denied
        testing.go:1464: TempDir RemoveAll cleanup: unlinkat /config/workspace/iop-credential-slot-review.j336Co/TestCLIWorkspacePreflightFailuresHelper1136893710/001: directory not empty
FAIL
FAIL	iop/packages/go/agentprovider/cli	30.411s
?   	iop/packages/go/agentprovider/cli/internal/testutil	[no test files]
ok  	iop/packages/go/agentprovider/cli/status	40.016s
ok  	iop/packages/go/agentruntime	0.683s
ok  	iop/packages/go/agentstate	0.431s
ok  	iop/packages/go/agenttask	4.217s
--- FAIL: TestConfinementProofRejectsTamperedBinding (0.02s)
    confinement_test.go:75: Prepare: agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestOverlayBackendConfinementDeniesActualAbsoluteWrites (0.66s)
    overlay_test.go:158: Prepare(first): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestOverlayBackendConcurrentTasksSharePinnedDirtyBaseAndIsolateWrites (0.52s)
    overlay_test.go:381: Prepare task 0: agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestOverlayBackendIdempotencyAndFailureRetention (0.01s)
    overlay_test.go:485: Prepare(first): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestOverlayBackendRejectsRetainedIdentityRebinding (0.02s)
    overlay_test.go:581: Prepare(first): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestOverlayBackendRejectsCanonicalSymlinkEscapeBeforeCreatingTask (0.02s)
    overlay_test.go:662: Prepare error = agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported, want absolute symlink confinement failure
--- FAIL: TestOverlayBackendRejectsNestedSharedGitMetadata (0.02s)
    overlay_test.go:682: Prepare error = agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported, want nested Git metadata failure
--- FAIL: TestFreezeChangeSetCapturesContentModeSymlinkAndDeletion (0.59s)
    integrator_test.go:40: Prepare(freeze): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestSerialIntegratorAppliesDisjointSetsAndReplaysAfterRestart (0.25s)
    integrator_test.go:97: Prepare(first): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestSerialIntegratorThreeWayMergesManagedPredecessor (0.17s)
    integrator_test.go:172: Prepare(first): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestSerialIntegratorRetainsConflictAndAdvancesIndependentChangeSet (0.19s)
    integrator_test.go:213: Prepare(first): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestSerialIntegratorRejectsUnmanagedDriftWithoutMutation (0.29s)
    integrator_test.go:266: Prepare(drift): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestSerialIntegratorRollsBackFailedValidationAndReplaysTerminalResult (0.30s)
    integrator_test.go:300: Prepare(validation): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestSerialIntegratorRestartRecoversInterruptedApplyByRollback (0.26s)
    integrator_test.go:347: Prepare(restart): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestSerialIntegratorPreservesManagedDescendantAcrossDirectoryDeletion (0.24s)
    integrator_test.go:403: Prepare(first): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestSerialIntegratorReplacesNonEmptyDirectoryByType (0.44s)
    --- FAIL: TestSerialIntegratorReplacesNonEmptyDirectoryByType/regular (0.27s)
        integrator_test.go:498: Prepare(replace-tree-regular): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
    --- FAIL: TestSerialIntegratorReplacesNonEmptyDirectoryByType/symlink (0.17s)
        integrator_test.go:498: Prepare(replace-tree-symlink): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestSerialIntegratorValidationMutationDoesNotEscapeCandidateView (0.17s)
    integrator_test.go:535: Prepare(mutate): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
--- FAIL: TestSerialIntegratorRevisedChangeSetAfterConflictAndLaterAdvance (0.17s)
    integrator_test.go:597: Prepare(predecessor): agentworkspace: executable filesystem confinement is unavailable: metadata-complete mount namespace policy: probe filesystem xattr support: operation not supported
FAIL
FAIL	iop/packages/go/agentworkspace	4.544s
ok  	iop/packages/go/audit	0.011s
ok  	iop/packages/go/auth	10.077s
ok  	iop/packages/go/config	1.780s
ok  	iop/packages/go/credentiallease	0.098s
?   	iop/packages/go/events	[no test files]
ok  	iop/packages/go/hostsetup	0.152s
?   	iop/packages/go/jobs	[no test files]
?   	iop/packages/go/metadata	[no test files]
ok  	iop/packages/go/observability	0.067s
?   	iop/packages/go/policy	[no test files]
ok  	iop/packages/go/streamgate	0.900s
?   	iop/packages/go/version	[no test files]
FAIL
```

Exit status: `1`.

`TMPDIR="$credential_smoke_parent" go vet ./apps/control-plane/... ./apps/edge/... ./apps/node/... ./packages/go/...`

Literal captured stdout/stderr: empty. Exit status: `0`.

`git diff --check`

Literal captured stdout/stderr: empty. Exit status: `0`.

### Contract/spec pointers, source drift, and leak scan

Command:

```bash
python3 - <<'PY'
import re
from pathlib import Path
for index in (Path('agent-contract/index.md'), Path('agent-spec/index.md')):
    data = index.read_text()
    targets = set(re.findall(r'`((?:agent-contract|agent-spec)/[^`\s]+\.md)`', data))
    targets.update(re.findall(r'\(((?:agent-contract|agent-spec)/[^)\s]+\.md)\)', data))
    for target in sorted(targets):
        if not Path(target.split('#', 1)[0]).is_file():
            raise SystemExit(f'broken pointer: {index}: {target}')
PY
rg -n 'SetCredentialPlane|PrincipalProjectionApplyRequest|AcquireCredentialLease|SetCredentialLeaseProvider|CredentialLease' apps/control-plane apps/edge apps/node
if rg -n 'projection.*inactive|plain connector|caller.*provider.*auth.*current' agent-contract agent-spec docs; then exit 1; fi
if rg --sort path -n --hidden --glob '!agent-task/archive/**' --glob '!*.sops.yaml' --glob '!go.sum' --glob '!PLAN-*.md' --glob '!*.log' 'BEGIN (AGE|OPENSSH|RSA|EC) PRIVATE KEY|sk-[A-Za-z0-9_-]{20,}' agent-contract agent-spec docs scripts agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts; then exit 1; fi
rmdir "$credential_smoke_parent"
trap - EXIT
```

Actual stdout, stderr, and exit statuses:

Pointer validation Python command: literal captured stdout/stderr was empty; exit status `0`.

Source-symbol search:

```text
apps/control-plane/internal/credentiallease/service_test.go:79:	binding := &iop.CredentialLeaseBinding{
apps/control-plane/cmd/control-plane/main.go:145:		if cfg.CredentialPlane.LeaseTTLSeconds < config.MinCredentialLeaseTTLSeconds || cfg.CredentialPlane.LeaseTTLSeconds > config.MaxCredentialLeaseTTLSeconds {
apps/control-plane/cmd/control-plane/main.go:146:			return cfg, fmt.Errorf("credential_plane.lease_ttl_seconds must be between %d and %d", config.MinCredentialLeaseTTLSeconds, config.MaxCredentialLeaseTTLSeconds)
apps/control-plane/internal/credentiallease/service.go:123:func validBinding(b *iop.CredentialLeaseBinding) bool {
apps/control-plane/internal/wire/edge_server_test.go:163:	parsers[proto_socket.TypeNameOf(&iop.PrincipalProjectionApplyRequest{})] = func(data []byte) (proto.Message, error) {
apps/control-plane/internal/wire/edge_server_test.go:164:		request := &iop.PrincipalProjectionApplyRequest{}
apps/control-plane/internal/wire/edge_server_test.go:834:	server.SetCredentialPlane(func(context.Context) (*iop.PrincipalProjection, error) {
apps/control-plane/internal/wire/edge_server_test.go:853:		proto_socket.AddRequestListenerTyped(&client.Communicator, func(request *iop.PrincipalProjectionApplyRequest) (*iop.PrincipalProjectionApplyResponse, error) {
apps/control-plane/internal/wire/edge_server_test.go:900:	server.SetCredentialPlane(func(context.Context) (*iop.PrincipalProjection, error) {
apps/control-plane/internal/wire/edge_server_test.go:918:		proto_socket.AddRequestListenerTyped(&client.Communicator, func(request *iop.PrincipalProjectionApplyRequest) (*iop.PrincipalProjectionApplyResponse, error) {
apps/control-plane/internal/wire/edge_server_test.go:947:	proto_socket.AddRequestListenerTyped(&client.Communicator, func(request *iop.PrincipalProjectionApplyRequest) (*iop.PrincipalProjectionApplyResponse, error) {
apps/control-plane/internal/wire/edge_server_test.go:965:	server.SetCredentialPlane(func(context.Context) (*iop.PrincipalProjection, error) {
apps/control-plane/internal/wire/edge_server_test.go:988:	proto_socket.AddRequestListenerTyped(&client.Communicator, func(request *iop.PrincipalProjectionApplyRequest) (*iop.PrincipalProjectionApplyResponse, error) {
apps/control-plane/internal/wire/edge_server_test.go:1037:	server.SetCredentialPlane(func(context.Context) (*iop.PrincipalProjection, error) {
apps/control-plane/internal/wire/edge_server_test.go:1078:	server.SetCredentialPlane(func(context.Context) (*iop.PrincipalProjection, error) {
apps/control-plane/internal/wire/edge_server_test.go:1130:	server.SetCredentialPlane(func(context.Context) (*iop.PrincipalProjection, error) {
apps/node/internal/node/provider_tunnel_test.go:219:func TestNodeConsumesExactCredentialLeaseOnceAtAdapterAdmission(t *testing.T) {
apps/node/internal/node/provider_tunnel_test.go:247:	binding := &iop.CredentialLeaseBinding{
apps/node/internal/node/provider_tunnel_test.go:253:	req := &iop.ProviderTunnelRequest{RunId: "run-lease", TunnelId: "tunnel-lease", Adapter: "openai_compat", Target: "qwen", CredentialLease: envelope.ToProto(), CredentialBinding: binding}
apps/control-plane/cmd/control-plane/credential_commands_test.go:451:	"PrincipalProjectionApplyRequest":  {},
apps/control-plane/cmd/control-plane/credential_commands_test.go:502:		{"reserved projection foundation", protoBootstrapManagementViolation, "message ProjectedPrincipalToken {}\nmessage ProjectedPrincipalRoute {}\nmessage PrincipalProjection {}\nmessage PrincipalProjectionApplyRequest {}\nmessage PrincipalProjectionApplyResponse {}", false},
apps/control-plane/internal/wire/edge_server.go:253:// SetCredentialPlane installs the secret-free projection source and lease
apps/control-plane/internal/wire/edge_server.go:256:func (s *EdgeServer) SetCredentialPlane(projection func(context.Context) (*iop.PrincipalProjection, error), issuer func(context.Context, *iop.AcquireLeaseRequest) (*iop.AcquireLeaseResponse, error), refreshInterval time.Duration) {
apps/control-plane/internal/wire/edge_server.go:390:		resp, sendErr := proto_socket.SendRequestTyped[*iop.PrincipalProjectionApplyRequest, *iop.PrincipalProjectionApplyResponse](
apps/control-plane/internal/wire/edge_server.go:391:			&target.client.Communicator, &iop.PrincipalProjectionApplyRequest{Projection: projection}, pushTimeout)
apps/edge/internal/authprojection/cache.go:56:func (c *Cache) ValidateBinding(binding *iop.CredentialLeaseBinding) error {
apps/node/internal/node/tunnel_handler.go:84:	if n.credentialConsumer != nil || req.GetCredentialLease() != nil || req.GetCredentialBinding() != nil {
apps/node/internal/node/tunnel_handler.go:85:		if n.credentialConsumer == nil || req.GetCredentialLease() == nil || req.GetCredentialBinding() == nil {
apps/node/internal/node/tunnel_handler.go:90:		envelope, err := credentiallease.FromProto(req.GetCredentialLease())
apps/edge/internal/openai/server.go:76:// SetCredentialPlaneManaged selects the request authentication and provider
apps/edge/internal/openai/server.go:80:func (s *Server) SetCredentialPlaneManaged(enabled bool) {
apps/control-plane/cmd/control-plane/server.go:97:		edgeServer.SetCredentialPlane(
apps/edge/internal/openai/identity_metering_test.go:36:	srv.SetCredentialPlaneManaged(true)
apps/edge/internal/service/provider_tunnel.go:262:	if err := s.attachCredentialLease(ctx, req, selected.entry, target, tunnelReq); err != nil {
apps/edge/internal/service/provider_tunnel.go:267:		defer s.releaseCredentialLease()
apps/edge/internal/service/provider_tunnel.go:311:	if err := s.attachCredentialLease(ctx, req, entry, req.Target, tunnelReq); err != nil {
apps/edge/internal/service/provider_tunnel.go:315:		defer s.releaseCredentialLease()
apps/edge/internal/service/provider_tunnel.go:332:func (s *Service) attachCredentialLease(ctx context.Context, req SubmitProviderTunnelRequest, entry *edgenode.NodeEntry, target string, tunnelReq *iop.ProviderTunnelRequest) error {
apps/edge/internal/service/provider_tunnel.go:340:	if !s.reserveCredentialLease() {
apps/edge/internal/service/provider_tunnel.go:346:			s.releaseCredentialLease()
apps/edge/internal/service/provider_tunnel.go:349:	binding := &iop.CredentialLeaseBinding{
apps/edge/internal/service/provider_tunnel.go:359:	lease, err := provider.AcquireCredentialLease(ctx, binding, entry.CredentialRecipientPublicKey)
apps/edge/internal/service/provider_tunnel.go:375:	tunnelReq.CredentialLease = lease
apps/edge/internal/service/provider_tunnel.go:380:func credentialLeaseScopeMatchesBinding(scope *iop.CredentialLeaseScope, binding *iop.CredentialLeaseBinding) bool {
apps/edge/internal/service/provider_tunnel.go:396:func (s *Service) validateCredentialFence(binding *iop.CredentialLeaseBinding) error {
apps/edge/internal/service/provider_tunnel.go:457:	if lease := tunnelReq.GetCredentialLease(); lease != nil && lease.GetScope() != nil {
apps/edge/internal/bootstrap/runtime.go:121:		svc.SetCredentialLeaseProvider(connector)
apps/edge/internal/bootstrap/runtime.go:122:		svc.SetCredentialLeaseLimit(cfg.CredentialPlane.LeaseCacheSize)
apps/edge/internal/service/usage_attribution_dispatch_test.go:219:	provider := &fakeCredentialLeaseProvider{valid: true}
apps/edge/internal/service/usage_attribution_dispatch_test.go:220:	env.svc.SetCredentialLeaseProvider(provider)
apps/edge/internal/service/usage_attribution_dispatch_test.go:221:	env.svc.SetCredentialLeaseLimit(1)
apps/edge/internal/input/manager.go:27:	openaiServer.SetCredentialPlaneManaged(cfg.CredentialPlane.Mode() == config.CredentialPlaneModeManaged)
apps/edge/internal/service/provider_tunnel_credential_test.go:13:type fakeCredentialLeaseProvider struct {
apps/edge/internal/service/provider_tunnel_credential_test.go:16:	gotBinding   *iop.CredentialLeaseBinding
apps/edge/internal/service/provider_tunnel_credential_test.go:17:	mutateScope  func(*iop.CredentialLeaseScope)
apps/edge/internal/service/provider_tunnel_credential_test.go:20:func (p *fakeCredentialLeaseProvider) ValidateCredentialBinding(binding *iop.CredentialLeaseBinding) error {
apps/edge/internal/service/provider_tunnel_credential_test.go:27:func (p *fakeCredentialLeaseProvider) AcquireCredentialLease(_ context.Context, binding *iop.CredentialLeaseBinding, publicKey []byte) (*iop.SignedCredentialLease, error) {
apps/edge/internal/service/provider_tunnel_credential_test.go:33:	scope := &iop.CredentialLeaseScope{
apps/edge/internal/service/provider_tunnel_credential_test.go:43:	return &iop.SignedCredentialLease{Scope: scope}, nil
apps/edge/internal/service/provider_tunnel_credential_test.go:46:func TestAttachCredentialLeaseBindsSelectedCandidateAndUsesDedicatedFields(t *testing.T) {
apps/edge/internal/service/provider_tunnel_credential_test.go:47:	provider := &fakeCredentialLeaseProvider{valid: true}
apps/edge/internal/service/provider_tunnel_credential_test.go:49:	service.SetCredentialLeaseProvider(provider)
apps/edge/internal/service/provider_tunnel_credential_test.go:50:	service.SetCredentialLeaseLimit(1)
apps/edge/internal/service/provider_tunnel_credential_test.go:57:	if err := service.attachCredentialLease(context.Background(), req, entry, "selected-target", tunnel); err != nil {
apps/edge/internal/service/provider_tunnel_credential_test.go:60:	defer service.releaseCredentialLease()
apps/edge/internal/service/provider_tunnel_credential_test.go:64:	if tunnel.GetCredentialLease() == nil || tunnel.GetCredentialBinding() == nil {
apps/edge/internal/service/provider_tunnel_credential_test.go:74:func TestAttachCredentialLeaseFailsBeforeAcquireOnStaleBindingOrCollision(t *testing.T) {
apps/edge/internal/service/provider_tunnel_credential_test.go:75:	provider := &fakeCredentialLeaseProvider{valid: false}
apps/edge/internal/service/provider_tunnel_credential_test.go:77:	service.SetCredentialLeaseProvider(provider)
apps/edge/internal/service/provider_tunnel_credential_test.go:78:	service.SetCredentialLeaseLimit(1)
apps/edge/internal/service/provider_tunnel_credential_test.go:81:	if err := service.attachCredentialLease(context.Background(), req, entry, "target", &iop.ProviderTunnelRequest{}); err == nil || provider.acquireCalls != 0 {
apps/edge/internal/service/provider_tunnel_credential_test.go:85:	if err := service.attachCredentialLease(context.Background(), req, entry, "target", &iop.ProviderTunnelRequest{Headers: map[string]string{"authorization": "caller-value"}}); err == nil || !strings.Contains(err.Error(), "collision") {
apps/edge/internal/service/provider_tunnel_credential_test.go:93:func TestAttachCredentialLeaseRejectsMismatchedReturnedScope(t *testing.T) {
apps/edge/internal/service/provider_tunnel_credential_test.go:94:	provider := &fakeCredentialLeaseProvider{valid: true, mutateScope: func(scope *iop.CredentialLeaseScope) {
apps/edge/internal/service/provider_tunnel_credential_test.go:98:	service.SetCredentialLeaseProvider(provider)
apps/edge/internal/service/provider_tunnel_credential_test.go:99:	service.SetCredentialLeaseLimit(1)
apps/edge/internal/service/provider_tunnel_credential_test.go:105:	err := service.attachCredentialLease(context.Background(), req, entry, "target", &iop.ProviderTunnelRequest{})
apps/edge/internal/service/provider_tunnel_credential_test.go:111:func TestSubmitProviderPoolTunnelAttachesCredentialLeaseAfterCandidateSelection(t *testing.T) {
apps/edge/internal/service/provider_tunnel_credential_test.go:113:	provider := &fakeCredentialLeaseProvider{valid: true}
apps/edge/internal/service/provider_tunnel_credential_test.go:114:	env.svc.SetCredentialLeaseProvider(provider)
apps/edge/internal/service/provider_tunnel_credential_test.go:115:	env.svc.SetCredentialLeaseLimit(1)
apps/edge/internal/service/provider_tunnel_credential_test.go:134:	if captured.GetCredentialLease() == nil || captured.GetCredentialBinding() == nil {
apps/edge/internal/service/provider_pool.go:327:	if err := s.attachCredentialLease(ctx, tunnelReq, selected.entry, target, tunnelReqResolved); err != nil {
apps/edge/internal/service/provider_pool.go:332:		defer s.releaseCredentialLease()
apps/edge/internal/service/service.go:37:	credentialLeases     CredentialLeaseProvider
apps/edge/internal/service/service.go:41:type CredentialLeaseProvider interface {
apps/edge/internal/service/service.go:42:	AcquireCredentialLease(context.Context, *iop.CredentialLeaseBinding, []byte) (*iop.SignedCredentialLease, error)
apps/edge/internal/service/service.go:43:	ValidateCredentialBinding(*iop.CredentialLeaseBinding) error
apps/edge/internal/service/service.go:46:func (s *Service) SetCredentialLeaseProvider(provider CredentialLeaseProvider) {
apps/edge/internal/service/service.go:55:func (s *Service) SetCredentialLeaseLimit(limit int) {
apps/edge/internal/service/service.go:64:func (s *Service) credentialLeaseProvider() CredentialLeaseProvider {
apps/edge/internal/service/service.go:70:func (s *Service) reserveCredentialLease() bool {
apps/edge/internal/service/service.go:85:func (s *Service) releaseCredentialLease() {
apps/edge/internal/controlplane/connector.go:55:	ValidateBinding(*iop.CredentialLeaseBinding) error
apps/edge/internal/controlplane/connector.go:58:func (c *Connector) ValidateCredentialBinding(binding *iop.CredentialLeaseBinding) error {
apps/edge/internal/controlplane/connector.go:296:	toki.AddRequestListenerTyped(&cl.Communicator, func(req *iop.PrincipalProjectionApplyRequest) (*iop.PrincipalProjectionApplyResponse, error) {
apps/edge/internal/controlplane/connector.go:502:// AcquireCredentialLease requests a lease over the currently authenticated
apps/edge/internal/controlplane/connector.go:504:func (c *Connector) AcquireCredentialLease(_ context.Context, binding *iop.CredentialLeaseBinding, recipientPublicKey []byte) (*iop.SignedCredentialLease, error) {
apps/edge/internal/controlplane/connector.go:561:		toki.TypeNameOf(&iop.PrincipalProjectionApplyRequest{}): func(b []byte) (proto.Message, error) {
apps/edge/internal/controlplane/connector.go:562:			m := &iop.PrincipalProjectionApplyRequest{}
```

Exit status: `0`.

Stale-claim guard: literal captured stdout/stderr was empty; exit status `0`; no match was returned.

Secret/private-key guard: literal captured stdout/stderr was empty; exit status `0`; no match was returned.

The failed broad package test left one unusable temporary directory entry after its own cleanup error. That exact test-owned residue was removed, after which `rmdir "$credential_smoke_parent"` produced literal empty stdout/stderr and exited `0`; `trap - EXIT` is a shell state change and produced no output.

### Representative live one-shot

Command — execute once only when explicit authorization is already present and every deterministic command has passed:

```bash
credential_smoke_parent="$(mktemp -d /config/workspace/iop-credential-slot-live.XXXXXX)"
trap 'rmdir "$credential_smoke_parent" 2>/dev/null || true' EXIT
SOPS_AGE_KEY_FILE=/config/.config/sops/age/keys.txt \
  sops --decrypt --input-type yaml --output-type binary /config/.config/sops/iop/openai.sops.yaml \
  | IOP_ALLOW_LIVE_PROVIDER=1 TMPDIR="$credential_smoke_parent" ./scripts/e2e-credential-slot-smoke.sh \
      --live --secret-stdin --profile openai --model gpt-5.6-luna \
      --reasoning-effort high --max-completion-tokens 128
rmdir "$credential_smoke_parent"
trap - EXIT
```

Sanitized stdout, sanitized stderr, and exit status, or exact blocker and resume condition:

Not executed; exit status: not applicable.

Exact blockers:

- Explicit live-provider authorization (`IOP_ALLOW_LIVE_PROVIDER=1` supplied by the execution context) was not present.
- The deterministic prerequisites did not all pass: `make test-credential-slot-smoke` exited `2` at the managed Messages API-key lease, and the exact broad package command exited `1` on external-filesystem permission/xattr semantics.

Resume condition: fix the production API-key lease header canonicalization defect within a separately authorized production change, obtain clean deterministic verification, and receive explicit live-provider authorization. Then run the command above unchanged exactly once. No provider, model, credential source, or request was substituted, and S16/`slot-smoke` PASS is not claimed.

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail
  - Completeness: Fail
  - Test coverage: Fail
  - API contract: Fail
  - Code quality: Pass
  - Implementation deviation: Fail
  - Verification trust: Fail
  - Spec conformance: Fail
- Findings:
  - Required — `packages/go/credentiallease/envelope.go:307`, `apps/control-plane/internal/credentiallease/service.go:99`, and `packages/go/config/protocol_profile.go:271`: the lease validator requires an already-canonical HTTP header name, while the Control Plane forwards the built-in `seulgi_messages` profile's lowercase `x-api-key` unchanged. Fresh `make test-credential-slot-smoke` evidence shows Chat reaches Node once, then Messages returns HTTP 502 before a second Node or upstream call. Canonicalize the trusted profile header at the lease-issuance boundary without weakening CR/LF rejection, add an API-key profile regression that consumes the issued lease as `X-Api-Key`, and rerun the complete deterministic smoke.
  - Required — `scripts/e2e-credential-slot-smoke.sh:885`: the leak guard matches `BEGIN (AGE|OPENSSH|RSA|EC) PRIVATE KEY`, but the smoke helper emits a PKCS#8 `-----BEGIN PRIVATE KEY-----` block. The concrete marker probe returns no match, so the recorded exit-zero guard does not prove that generated private material is absent. Use one shared matcher that includes generic PKCS#8 and the existing key forms, add a deterministic positive-control self-check for the marker, and rerun the repository leak scan with that matcher.
- Routing Signals:
  - `review_rework_count=2`
  - `evidence_integrity_failure=true`
- Next Step: Create a freshly routed FAIL follow-up plan for the exact task path; do not write `complete.log` or update the roadmap.
