<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=20 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - Fifth authorized Claude-through-IOP S12 call

> **[IMPLEMENTING AGENT — READ FIRST]** Complete renewed TLS readiness, fresh gates, and exactly one guarded call. Fill every implementation-owned section, then stop. Never retry, call a provider directly, append a verdict, archive files, or classify the next state.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=20, tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_19.log` / `code_review_cloud_G10_19.log`; verdict `FAIL`, Required R13, `review_rework_count=18`, `evidence_integrity_failure=false`.
- Resolved external stop: `user_review_7.log`; the user explicitly authorized one fifth guarded execution and no retry.
- Existing guards `sole-live.rc-69`, `sole-live-2.rc-69`, `sole-live-3.rc-69`, and `sole-live-4.rc-69` are immutable. No `sole-live-5*` guard exists at plan start.
- Disposable Edge PID 16840 contains the reviewed thinking-redaction repair. Control Plane 8782 and Node 8790 were alive at plan start; certificates were expired and must be deterministically refreshed before readiness can pass.

## For the Review Agent

Verify TLS setup made no model call, every provider-free gate preceded guard creation, exactly one fifth call occurred, privacy/cardinality are closed, and publication matches the terminal result. Append one verdict and materialize the matching next state.

## Implementation Item Completion

| Item | Status |
|---|---|
| REVIEW_API-1 | [x] |
| REVIEW_API-2 | [x] |
| REVIEW_API-3 | [x] |
| REVIEW_API-4 | [x] |

## Implementation Checklist

- [x] Renew expired disposable managed TLS deterministically and prove no model/guard activity during setup.
- [x] Pass fresh local and remote provider-free gates against the exact candidate and renewed runtime.
- [x] Create `sole-live-5` and execute exactly one authorized Claude-through-IOP call with no retry.
- [x] Publish stable S12 evidence and bounded qualification owners only on complete schema-valid PASS.
- [x] On failure, retain only closed diagnostics and make no success claim.
- [x] Fill implementation-owned review sections and stop for official review.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementers must not modify this section.

- [x] Append one verdict and verified routing signals.
- [x] Verify TLS setup, sole-live cardinality, IOP-owned routing, privacy, S12 evidence, and publication decision.
- [x] Archive the active pair and materialize the verdict's next state.

## Deviations from Plan

- The first remote full service race run failed only `TestSingleRequestInternalToolRequestWallClockBudgetOwnership` because iteration 12 did not reach Node. No guard or Claude process existed. The exact test then passed ten race iterations, and a fresh full service race suite passed. Execution stayed blocked until both were green.
- The authorized call returned HTTP 400 before accepted ingress. Per the no-retry boundary, no second invocation was attempted and no PASS-only publication was performed.

## Key Design Decisions

- Certificate renewal reused only deterministic local fake-provider material. Existing disposable certificate files and logs were retained with `.pre-live5-cert` backups; canonical dev and provider state were untouched.
- `tokens.toki-dev-cline` was decrypted from SOPS only into the remote process and used as Claude's `x-api-key` to IOP. Claude received no provider credential or provider endpoint.
- The durable guard was created before the sole invocation and finalized regardless of result. HTTP 400 with ingress delta zero is classified only as a pre-ingress API rejection; no model output or stage result is inferred.

## Verification Results

### 1. Disposable TLS renewal and runtime health

- Initial inspection proved all prior disposable CA/leaf certificates had expired at `2026-08-08 06:46:03 UTC`; Claude process count was 0, four prior guards were finalized, and no `sole-live-5*` guard existed.
- A fresh `scripts/e2e-credential-slot-smoke.sh` run with `/opt/homebrew/bin` on `PATH` completed against local fake providers and produced matching CP/Edge/Node subjects and SANs. The first attempt stopped before material creation because `go` was not on `PATH`; it made no request or guard.
- Backups were retained as `ca.pem.pre-live5-cert`, `{control-plane,edge,node}.{pem,key}.pre-live5-cert`, and matching log backups. New certificates are valid from `2026-08-08 08:51:48 UTC` through `10:51:48 UTC`.
- Only the disposable managed fleet restarted: CP/Edge/Node PIDs `8782/16840/8790` became `47248/47254/47260`. The repaired Edge binary was unchanged, certificate lifetime exceeded 900 seconds, the catalog remained healthy, Claude count remained 0, and fifth-guard/artifact count remained 0 during setup.

### 2. Fresh local and remote provider-free gates

- Local focused OpenAI tests passed in 8.506s; race OpenAI and service suites passed in 12.920s and 9.305s; the single-request Claude harness self-test passed; `git diff --check` passed.
- Remote focused OpenAI passed in 8.811s and race OpenAI passed in 12.483s. After the one timing-only service race deviation noted above, the exact failing test passed ten race iterations in 7.882s and a fresh full service race suite passed in 9.645s.
- Authenticated `/count_tokens` matrix before guard creation: baseline, advanced-tool-use beta, defer-loading, redact-thinking beta, display omitted, and display summarized returned 200; tool strict, eager input streaming, and invalid display returned 400. Catalog returned 200 with exactly one `iop-single-request-light` model.
- Across the matrix, ingress delta was 0, provider/stage/model-output deltas were 0, Claude process count was 0, four prior guards remained finalized, and manifest/workspace result were absent.
- Harness preflight returned `[single-request-claude-smoke] preflight passed without a Claude invocation`; ingress delta was 0 and no fifth guard or result existed.

### 3. Fifth durable guard and sole live call

- The wrapper used the canonical executable-name detector, atomically created `sole-live-5.started`, created a fresh Claude config, supplied the renewed managed CA, decrypted the SOPS caller only into memory, and called the harness `--run` exactly once.
- Closed output: `[single-request-claude-smoke] validation failed: Claude invocation failed (status 1 class api-rejected reason http-400)`.
- The wrapper closed with `live_rc=69`, renamed the guard to `sole-live-5.rc-69`, and observed `ingress_delta=0`, `claude_process_delta=0`, `manifest_present=false`, `workspace_result_present=false`, and `retry_count=0`.
- Final guard set is exactly `sole-live.rc-69`, `sole-live-2.rc-69`, `sole-live-3.rc-69`, `sole-live-4.rc-69`, and `sole-live-5.rc-69`; no `.started` guard or Claude process remains.

### 4. IOP stages, workspace, terminal, and publication

- Not applicable for Gemini plan/review, Ornith-fast work, stage timing, workspace result/cleanup, or model terminal: the request returned HTTP 400 before accepted ingress.
- No provider generation, stage, model output, workspace result, or manifest exists. S12 qualification owners and success-only contract/spec/roadmap state were not updated.
- The retained closed evidence does not identify the exact rejected request member because Edge does not log pre-ingress Anthropic validation reasons and the harness retains only the bounded `http-400` reason. Subsequent static inspection is diagnostic evidence, not model output and not a basis for a success claim.

### 5. Privacy and final hygiene

- SOPS caller material was never printed or persisted, and was unset with the wrapper process. No prompt, response body, model output, workspace content, private key, caller value, or sensitive digest was added to task evidence.
- Runtime logs contain no retained pre-ingress rejection subtype. Searches of the disposable managed/source/workspace roots and recent Claude config/debug locations found no fifth-call raw/debug artifact to recover.
- Static inspection of installed Claude 2.1.177 proves API-key auth excludes the OAuth beta, but also shows remote-feature-controlled request variants (`context-hint`, tool strict/eager, diagnostics, and related betas) that the harness currently does not freeze. This is a compatibility-risk finding; it does not prove which variant caused this deleted raw 400.
- `git diff --check` passed before the call. No PASS artifact was published, all five guards are closed, no Claude process remains, and the active task pair contains the complete implementation-owned evidence.

---

> Implementer: fill every implementation-owned field, then stop for official review.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Fail | The fifth authorized call was rejected with HTTP 400 before accepted ingress, so no S12 execution occurred. |
| Completeness | Fail | There is no ingress, Gemini/Ornith stage sequence, workspace result, terminal, or manifest. |
| Test coverage | Pass | Fresh local/remote focused and race suites, provider-free status matrix, fleet/catalog checks, preflight, guard cardinality, and artifact checks are closed. |
| API contract | Pass | No success-only API/SDD claim was published; the existing bounded Anthropic contract remained fail-closed. |
| Code quality | Pass | This packet made no source change and kept TLS setup, guard creation, execution, and failure publication boundaries explicit. |
| Implementation deviation | Pass | The one unrelated timing race was isolated for ten iterations and followed by a fresh passing full suite before authorization was consumed. |
| Verification trust | Pass | `sole-live-5.rc-69`, ingress/process delta zero, absent result/manifest, live fleet, and no retry agree. The deleted raw 400 subtype is explicitly not overclaimed. |
| Spec conformance | Fail | SDD S12 requires ingress 1, ordered Gemini -> Ornith-fast -> Gemini stages, timing, verified workspace cleanup/result, and one terminal. |

### Findings

- Required R14 — `scripts/e2e-single-request-claude.sh:862`: the harness forwards the installed Claude process with its ambient experimental-feature decision surface. Claude 2.1.177 static code shows that remote flags can add request variants such as `context-hint-2026-04-09`, tool `strict`/`eager_input_streaming`, diagnostics, and corresponding fields, while the provider-free matrix intentionally leaves unsupported neighbors at HTTP 400. The fifth raw rejection subtype was not retained, so no one optional field may be asserted as its cause. Before requesting another real authorization, make the smoke request deterministic by setting `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1` only for the harness child, extend the fake self-test to require that environment boundary, and add a bounded secret-free pre-ingress rejection subtype to harness/Edge diagnostics so a future 400 identifies only an allowlisted field/beta class without retaining body, prompt, or credentials. Prove the installed-client semantics statically and pass local/remote provider-free tests; do not invoke Claude, Gemini, Ornith, or any provider generation during the repair.

### Routing Signals

- `evaluation_mode=isolated-reassessment`
- `verdict=FAIL`
- `review_rework_count=19`
- `evidence_integrity_failure=false`
- `next_state=plan`
