<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=30 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - canonical IOP Work rebind and thirteenth qualification

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=30

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_29.log` / `code_review_cloud_G10_29.log`; verdict `FAIL`, Required R29, `review_rework_count=28`, `evidence_integrity_failure=false`.
- `sole-live-12.rc-69` is immutable: ingress `1 -> 2`, provider tunnels `8 -> 10`, Plan success 1, Work provider error 1, cleanup success 1, terminal provider error 1, no result/manifest, and no retry.
- The latest Node error is byte-identical to live 11 (`sha256:24e422f5af13d03b7494c7f2dade2557d3dd17725d6b5f4b411a7b228d2fc252`, `no route to host`). Proxy variables are absent; system LAN clients pass. Canonical dev IOP health/models return 200 with `ornith-fast` using the designated SOPS IOP key.

## Implementation Item Completion

| Item | Status |
|---|---|
| credential-route-rebind | [x] |
| config-runtime-identity | [x] |
| provider-free-readiness | [x] |
| thirteenth-call | [x] |
| publication | [x] closed failure; no partial publication |

## Implementation Checklist

- [x] Preserve recovery backups and rebind only the disposable Work credential/route/config.
- [x] Pass config/fleet/runtime/catalog/harness provider-free verification.
- [x] Execute and finalize exactly one thirteenth guard with no retry.
- [x] Publish only a complete schema-valid S12 result/manifest; retain closed evidence on failure.
- [x] Fill implementation fields and stop for official review.

## Review-Only Checklist

- [x] Append one verdict and verified routing signals.
- [x] Verify R29, credential privacy, canonical read-only boundary, identity, cardinality, ordered stages, and S12 publication.
- [x] Archive and materialize the verdict's next state, or write completion evidence and archive the task on PASS.

## Deviations from Plan

- The first credential API client used macOS `/usr/bin/python3` and failed TLS verification before its first API read. The same prepared operation resumed with `/opt/homebrew/bin/python3`; no model invocation occurred and no credential mutation preceded the failure.
- The endpoint-only config edit also had to replace the two matching provider served-model values with `ornith-fast`; otherwise the frozen route/model admission facts would not match the nested canonical IOP catalog. The change remained confined to the disposable config.
- The first provider-free catalog assertion compared the managed OpenAI internal route UUID to the public alias and failed. It was corrected to query the managed Anthropic catalog with the required version header; no generation occurred.
- Runtime evidence was first refreshed without the workspace-owner digest. Harness preflight rejected it before generation; the owner digest was added and the full provider-free preflight then passed.

## Key Design Decisions

- Canonical `/Users/toki/agent-work/iop-dev` config, database, source, and processes remained read-only. The disposable Work route calls canonical IOP at `http://127.0.0.1:18083/v1`; canonical IOP's existing RTX Node remains the only Ornith provider owner.
- The `s12-ornith` secret was decrypted from SOPS only into process memory, rotated into the disposable encrypted credential store, and never printed or written as plaintext.
- A failed guarded call remains terminal: `sole-live-13` was finalized once with exit 69, was not retried, and produced neither manifest nor result.

## Verification Results

- Recovery artifacts: new non-overwriting `edge.yaml.pre-plan30-iop-route`, `credentials.db.pre-plan30-iop-route`, and `runtime-evidence.json.pre-plan30-iop-route` were created in the disposable runtime.
- Credential state: active slot `s12-ornith` revision 2; prior route `s12-ornith-route` revoked; replacement `s12-ornith-iop-route` active with profile `openai`, model `ornith-fast`, selector `rtx5090-lemonade`.
- Runtime identity: config `sha256:e06fd3deb9fc1882440eee79f8eae1b6ed827be62ab4edc33b5b66b3bbd4bc42`; config check `sha256:94d438c58d250ad651eef8ae9352130595e50a9dedab2b93dff10c454fd47049`; stage binding `sha256:5a1bf5933f3cd871262f007dae19c062217b787fc0933c496ce45576b472195b`; workspace owner `sha256:8b4249697d18b4d715f633665404dfd2c505b2fa6cf39cf6e8a014435969d932`.
- Provider-free preflight output:

```text
[single-request-claude-smoke] preflight passed without a Claude invocation
HARNESS_PREFLIGHT=PASS INGRESS=0->0 PROVIDER_TUNNELS=10->10
```

- Single guarded execution output:

```text
[single-request-claude-smoke] preflight passed without a Claude invocation
[single-request-claude-smoke] validation failed: Claude invocation failed (status 1 class api-rejected reason api-error)
SOLE_LIVE_13_RC=69
INGRESS=0->1
PROVIDER_TUNNELS=10->12
CLAUDE_PROCESSES=0->0
OBSERVATION_COUNT=cleanup|none|success|none|1
OBSERVATION_COUNT=request|none|success|none|1
OBSERVATION_COUNT=stage|plan|success|none|1
OBSERVATION_COUNT=stage|work|error|validation|1
OBSERVATION_COUNT=terminal|none|error|validation|1
```

- Isolated Edge correlation `sr-52d7da9d23c27a5995c94910bb6f59fb`: Plan success in 4327 ms, Work validation error in 1123 ms, cleanup success in 4 ms, terminal validation error in 5456 ms. The workspace contains no `smoke-result.txt`; no result or manifest was published.
- Canonical IOP correlation `req.manual-1786192088899580000`: dispatch selected `ornith-fast` on `rtx5090-lemonade`, provider response body was 1168 bytes, terminal committed successfully, and the model emitted one `workspace_write` tool call. Its logged reasoning was: `The task is simple: write "IOP single-request Claude smoke verified" to smoke-result.txt and verify it. Let me use the workspace tools to do this.`
- The canonical provider uses llama.cpp. Its response family includes top-level `system_fingerprint` and `timings`; canonical IOP preserves non-streaming provider bytes, while the isolated Work decoder currently admits only `id`, `object`, `created`, `model`, `choices`, and `usage` at `apps/edge/internal/openai/single_request_work_stage.go:331`.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Fail | Plan reaches Gemini and Work reaches `ornith-fast`, but the Work response is rejected before its valid tool call can run. |
| Completeness | Fail | Required schema-valid manifest and exact workspace result are absent. |
| Test coverage | Fail | Existing Work codec tests do not cover canonical llama.cpp `system_fingerprint`/`timings` response extensions. |
| API contract | Fail | The supported IOP-through-IOP Work path cannot consume the byte-preserved canonical OpenAI-compatible response. |
| Code quality | Pass | Runtime mutation was backed up, scoped, redacted, and left canonical dev read-only. |
| Implementation deviation | Warn | Two served-model values and provider-free validation commands changed for justified admission/catalog reasons. |
| Verification trust | Pass | One immutable guard, counter deltas, structured correlations, no-retry behavior, and no-publication state agree. |

### Findings

- Required R30 — `apps/edge/internal/openai/single_request_work_stage.go:331` rejects the canonical llama.cpp envelope's bounded top-level diagnostics (`system_fingerprint`, `timings`) before decoding the otherwise valid `workspace_write` tool call. Admit and discard only these exact extension names, retain rejection of every other unknown field, add regression coverage in `apps/edge/internal/openai/single_request_work_stage_test.go:801`, rebuild the disposable Edge, and qualify with one new no-retry guard.

### Routing Signals

- `review_rework_count=29`
- `evidence_integrity_failure=false`

### Next Step

- Prepare a routed WARN/FAIL follow-up for R30; do not write `complete.log` or update the roadmap.
