<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=9 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

> Implement the paired plan exactly. The sole live call is non-retriable. Fill implementation-owned evidence without secrets or raw execution content; final verdict, archival, `complete.log`, and next-state classification are review-owned.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=9, tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G05_8.log` / `code_review_cloud_G05_8.log`; verdict `FAIL`, `review_rework_count=7`, `evidence_integrity_failure=false`.
- `user_review_3.log` records explicit authorization for exactly one new non-retriable live invocation.
- The repaired local harness requires and passes exactly one `--verbose`; the remote candidate must be synchronized and rebound before preflight.
- Expected starting state: HEAD `70d22850d01714fdef734dafa42e82fed79e0786`, ingress 0, result absent, manifest absent, canonical Claude 2.1.177, Edge PID 35091, Node PID 25114.

## Implementation Item Completion

| Item | Status |
|---|---|
| REMOTE-BINDING-1 | [x] |
| LIVE-S12-2 | [ ] |
| QUALIFICATION-SYNC-3 | [ ] |
| REVIEW-EVIDENCE-4 | [x] |

## Implementation Checklist

- [x] Synchronize the repaired harness and refresh the remote candidate worktree binding atomically; pass all no-provider gates.
- [x] Confirm clean API-key auth and zero-child state, then consume no more than one live invocation with `live_rc` and no retry.
- [ ] On manifest PASS only, publish local evidence and update the bounded S12 qualification statements.
- [x] Fill all implementation-owned review sections with actual safe results.

## Review-Only Checklist

- [x] Append one verdict and verified routing signals.
- [x] Verify findings and all review dimensions.
- [x] Archive this pair to suffix 9.
- [x] Verify task artifacts are not ignored.
- [ ] On PASS only, write `complete.log`, move the task under the dated archive, and report runtime completion metadata.
- [x] On non-PASS, materialize the required next state without `complete.log`.

## Deviations from Plan

- The first zero-child preflight passed a relative output and stopped at `output target unsafe`. The second used absolute runtime/config paths and stopped at `config check identity mismatch`, because the frozen config-check digest binds the relative config argument. Both failures occurred before a Claude child. The corrected preflight used an absolute output and the evidence-bound relative runtime arguments and passed.
- The sole live call exited once with harness status 69 and Claude child status 1. It was not retried. Success-only manifest publication and contract/spec synchronization were skipped.
- A task-prefixed mode-700 temporary config directory older than the current run remained under `/tmp`. After confirming that no Claude child existed, that it was a real user-owned directory, and that it was older than 300 seconds, one stale directory was removed. The current live wrapper's config was already removed by its explicit cleanup.

## Key Design Decisions

- Installed the exact reviewed local script SHA-256 `9c01d0b6b4994ceff2c54e3f39b26eb6526cccf98bb67609b295e42c8f339af8` into only the disposable candidate and passed remote syntax and deterministic self-test before changing runtime evidence.
- Recomputed the worktree digest with the harness's own input set and atomically changed only `source.worktree_digest`, from the previously matching value to `sha256:693baad8d5037098e7c1964cae67eb5ee3ef5b8da69a4a32a07eadd4c92e8262`. All other runtime-evidence fields were preserved and the passing preflight revalidated them.
- Treated `auth status=api_key` only as CLI selection evidence. The live failure proves neither API-key validity nor Edge principal acceptance: the Edge ingress metric increments only after authentication, request decoding, and single-request route selection.
- Preserved the irreversible boundary. Exactly one `--run` was executed with `live_rc`; no alternate CLI, direct API request, provider call, or retry followed. Raw child captures were deleted by the harness and were not read or reconstructed.

## Reviewer Checkpoints

- Confirm the installed remote script digest equals the reviewed local script digest and the runtime evidence changes only in the source worktree binding.
- Confirm clean config selects `api_key` before both preflight and live execution.
- Confirm exactly one `--run` occurs, `live_rc` is used, and no retry/direct request/alternate caller occurs.
- Confirm completion is derived only from a schema-valid redacted manifest with ingress delta 1, ordered stages/timing, changed verified workspace, and one terminal.
- Confirm qualification wording is bounded to the selected dev runtime/run and does not make macOS a product requirement.

## Verification Results

### 1. Local no-provider gate

```text
./scripts/e2e-single-request-claude.sh --self-test
[single-request-claude-smoke] self-test passed: exact Claude base-route coverage, model/Edge/Node/runtime binding, zero-child preflight, derived verification, redaction, cleanup, signal handling, and atomic publication
ok  iop/apps/edge/internal/service  1.058s
ok  iop/apps/edge/internal/openai   1.073s
focused source assertions: passed
exit status: 0
```

### 2. Remote repaired-harness synchronization and deterministic gate

```text
remote_script_sha256=9c01d0b6b4994ceff2c54e3f39b26eb6526cccf98bb67609b295e42c8f339af8
[single-request-claude-smoke] self-test passed: exact Claude base-route coverage, model/Edge/Node/runtime binding, zero-child preflight, derived verification, redaction, cleanup, signal handling, and atomic publication
runtime_evidence_change=source.worktree_digest_only
recorded_tree=sha256:693baad8d5037098e7c1964cae67eb5ee3ef5b8da69a4a32a07eadd4c92e8262
exit status: 0
```

### 3. Runtime binding, exact candidate, and clean API-key state

```text
auth=api_key
candidate=ready
state=ingress0-result_absent-manifest_absent
config_check_binding=relative_path
exit status: 0
```

### 4. Zero-child preflight

Two pre-invocation command-construction failures were corrected without a Claude child:

```text
[single-request-claude-smoke] validation failed: output target unsafe
[single-request-claude-smoke] validation failed: config check identity mismatch
```

Final zero-child gate:

```text
auth=api_key
[single-request-claude-smoke] preflight passed without a Claude invocation
state=ingress0-result_absent-manifest_absent
exit status: 0
```

### 5. Sole live Claude invocation

```text
auth=api_key
[single-request-claude-smoke] validation failed: Claude invocation failed (status 1)
live_exit=69
```

Exactly one `--run` occurred. Read-only post-failure state after cleanup:

```text
ingress=0
result=absent
manifest=absent
claude_child=absent
temp_config=absent
```

### 6. Success-only manifest publication

Not run. The live harness failed, no remote manifest exists, and the stable local manifest remains absent.

### 7. Success-only document and final hygiene

Not run. Manifest PASS is absent, so all three owner documents retain deferred S12 wording.

## Section Ownership

| Section | Owner |
|---|---|
| Header, overview, archive snapshot, reviewer checkpoints | Fixed |
| Implementation completion/checklist, deviations, decisions, verification results | Implementing agent |
| Review-only checklist and Code Review Result | Review agent |

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Result | Evidence |
|---|---|---|
| Correctness | Fail | The repaired `--verbose` invariant and remote runtime binding pass, but the sole child still exits 1 and produces no accepted single-request admission. |
| Completeness | Fail | Ingress remains 0; workspace result, remote/local manifest, and qualification document updates are absent. |
| Test coverage | Fail | Deterministic coverage catches the CLI flag regression, but preflight validates only secret presence and an unauthenticated listener response; it does not prove Edge principal acceptance or advertised-model access. |
| API contract | Pass | No public API/wire/config/schema or qualification owner was changed without evidence. |
| Code quality | Warn | Failure cleanup is bounded and no raw capture persists, but the only surfaced failure evidence is child status 1, which is insufficient to distinguish local CLI, authentication, route, or transport failure. |
| Implementation deviation | Warn | Two zero-child command-path mistakes were corrected before the live boundary; the sole live call itself used the reviewed candidate, clean config, and `live_rc` as planned. |
| Verification trust | Pass | Script/runtime hashes, auth selection, preflight, live exit, no-retry boundary, and post-failure absence state are fresh and mutually consistent. No raw evidence is claimed. |
| Spec conformance | Fail | SDD S12 still lacks one actual accepted request, ordered stages/timing, changed verified workspace, and terminal evidence. |

### Findings

- **Required R1** — `scripts/e2e-single-request-claude.sh:688-697,768-778` checks only that the secret environment value is non-empty and that unauthenticated `OPTIONS` returns 401/405. `auth status=api_key` likewise proves only CLI credential selection. The Edge authenticates before dispatch (`apps/edge/internal/openai/routes.go:32-47`) and increments S12 ingress only after authentication, request decoding, and single-request route resolution (`apps/edge/internal/openai/anthropic_handler.go:144-160`). Therefore the consumed live call could fail at Edge authentication/model admission while every current preflight passes. Add a no-provider authenticated, bounded model-admission probe that carries the secret only in process memory, requires the selected public model, leaves S12 ingress unchanged, and has deterministic fake coverage for rejected credentials/model absence/redaction.
- **Required R2** — `scripts/e2e-single-request-claude.sh:899-907` reduces every non-zero Claude failure to numeric child status after capturing bounded stdout/stderr, then cleanup deletes those captures. The latest call consequently yields only status 1 and cannot safely distinguish local CLI validation, authentication/API rejection, or transport failure. Add an allowlisted closed failure classifier over the bounded temporary captures, emit only the category (never raw text), and cover recognized and unknown cases in the deterministic fake before another live authorization is requested.
- **Required R3** — SDD S12 remains incomplete: the one repaired live call ended with ingress 0, no workspace result, and no manifest. After R1-R2 pass provider-free review, a new user-controlled exactly-one authorization is still required for another live attempt.

### Routing Signals

- `review_rework_count=8`
- `evidence_integrity_failure=false`

Seven prior archived reviews have FAIL verdicts; this task-level non-PASS result raises the count to eight. Evidence remains trustworthy because the live call was not retried and no output was promoted.

### Next Step

Create a provider-free repository repair plan for authenticated model-admission preflight and closed Claude failure classification. Do not invoke Claude/provider or request a new live authorization until that repair passes official review.
