<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=13 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Repair Claude pre-ingress compatibility and close provider-free S12 gates

## For the Implementing Agent

Repair the concrete Anthropic request-shape boundary exposed by the sole failed Claude Code call. Accept and bound Claude Code's top-level `context_management` compatibility field without forwarding it to Gemini or using it for identity, routing, or workspace authority. Preserve a closed, secret-free rejection status/reason in the harness, then rebuild and verify the disposable managed IOP runtime without any provider generation. Do not execute another Claude `--run`, do not call Gemini/Ornith/Claude directly, and do not change the canonical dev runtime. Fill implementation-owned review sections before official review.

## Background

Plan 12 brought up an isolated managed Control Plane/Edge/Node stack and admitted exactly one `iop-single-request-light` model for the selected SOPS caller. Its only authorized Claude invocation exited 69 as `api-rejected` before Edge recorded ingress, so no provider stage or model output exists and the authorization is consumed. Static inspection of installed Claude 2.1.177 shows that requests can emit a top-level `context_management` object with the `context-management-2025-06-27` beta, while Edge's strict Anthropic decoder and beta allowlist currently declare neither. The managed selector also needs a deterministic local token counter so `count_tokens` can be qualified without provider selection.

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_12.log` / `code_review_cloud_G10_12.log`; verdict `FAIL`, `review_rework_count=11`, `evidence_integrity_failure=false`.
- Sole live result: wrapper `live_rc=69`, sanitized class `api-rejected`, accepted ingress `0 -> 0`, no result/manifest, and no request/stage/provider/model-output log. Durable guard: `/Users/toki/agent-work/iop-s12-managed-validation-20260808/sole-live.rc-69`.
- Disposable managed root: `/Users/toki/agent-work/iop-s12-managed-validation-20260808`; canonical `/Users/toki/agent-work/iop-dev` remains read-only and untouched.
- All Claude, Gemini, and Ornith traffic remains IOP-owned. No direct provider invocation is authorized.

## Analysis

### SDD Criteria

- S04 workspace binding requires containment to be Edge-generated and Node-enforced; `context_management` cannot acquire workspace authority or alter the marked preset.
- S12 Claude smoke requires one admitted Anthropic request and ordered Gemini -> Ornith-fast -> Gemini execution. This packet repairs and proves the pre-ingress compatibility boundary only; it must not claim S12 success or consume a new live attempt.

### Verification Context

- `apps/edge/internal/openai/anthropic_types.go` uses strict JSON decoding, so an undeclared top-level Claude field is rejected before single-request admission.
- `apps/edge/internal/openai/anthropic_bridge_test.go` already exercises Claude Code beta/header compatibility and verifies the normalized Chat request sent to the provider bridge.
- `scripts/e2e-single-request-claude.sh` currently retains only a broad failure class after deleting raw stdout/stderr. It needs a bounded diagnostic that never records request bodies, response bodies, bearer values, or arbitrary CLI text.
- `agent-contract/outer/anthropic-compatible-api.md` owns the external Anthropic request contract and must state the compatibility field's validation and non-authoritative/non-forwarded semantics.
- Remote qualification stays on the isolated macOS dev runtime, with the caller decrypted from SOPS only into process memory. The managed preset's selector catalog model must use a local deterministic `token_counter` because managed virtual dispatch retains that selector's authority/model-group key for provider-free `count_tokens`.

### Root Cause and Safety Boundary

- Root cause selected for repair: Edge's strict Anthropic envelope omits both the Claude Code `context_management` request member and its associated beta allowlist entry.
- `context_management` is accepted only when absent, `null`, or a JSON object. It is not interpreted as an IOP route, credential, workspace, tool, or stage control, and is not forwarded to normalized Chat providers.
- Diagnostics are closed enum/status tokens derived from local CLI output and HTTP-like status markers; raw captures remain temporary and are removed.
- No `--run`, direct provider URL, provider credential use, or success evidence publication is in scope.

## Finding Resolution Map

| Finding | Resolution | Completion evidence |
|---|---|---|
| R6 | Direct fix: declare and validate bounded `context_management` compatibility input at the strict Anthropic decoder; keep it outside routing/workspace/provider payloads. | Decoder/bridge tests accept an object and reject scalar/array shapes before wire activity. |
| R6 | Direct fix: retain a closed, redacted failure status/reason after raw capture cleanup. | Harness self-tests prove classification, redaction, cleanup, and no arbitrary text propagation. |
| R6 | Direct fix: add provider-free managed gates before any future live authorization. | Remote rebuilt Edge passes authenticated catalog and local `count_tokens` through IOP with unchanged ingress and no provider execution. |

## Dependencies and Execution Order

1. Update the strict Anthropic request type/validation and provider-bridge regression tests.
2. Document the bounded compatibility contract and extend harness diagnostics with self-tests.
3. Run fresh local no-provider tests and hygiene checks.
4. Sync only reviewed source changes to the disposable remote source, rebuild/restart only the managed Edge as needed, and configure the preset selector model's deterministic local token counter.
5. Run authenticated IOP catalog and `count_tokens` gates; verify ingress/provider-run counts stay unchanged. Do not run a Messages generation request or Claude `--run`.
6. Fill the active review and stop for official review. A later real call requires new explicit authorization.

## Plan Items

### 1. COMPAT-1 — accept bounded Claude context management input

**Problem:** Claude Code can legally include `context_management` with the supported beta, but Edge's strict decoder rejects unknown top-level fields before admission.

**Solution:** add the beta allowlist entry plus an optional raw JSON field to `anthropicMessageRequest`, and validate the field as `null` or a JSON object. Treat it as a decoded-client compatibility annotation only. Do not map it into Chat provider payloads, principal projection, preset selection, workspace bindings, or tool policy.

**Modified Files and Checklist:**

- [ ] `apps/edge/internal/openai/anthropic_types.go`
- [ ] `apps/edge/internal/openai/anthropic_bridge_test.go`

**Test Strategy:** extend the existing Claude Code bridge case with the beta and object, assert provider payload omission, and add invalid scalar/array rejection with zero provider wire activity.

**Verification:** focused tests prove an object passes strict decoding, invalid shapes return 400, and no `context_management` member reaches the Chat request.

### 2. DIAGNOSTIC-2 — retain closed, secret-free rejection evidence

**Problem:** the previous harness deleted raw output correctly but retained only `api-rejected`, leaving the precise pre-ingress HTTP/status family unavailable.

**Solution:** derive a bounded status/reason enum from temporary output before cleanup, validate it against a closed allowlist, and emit/store only that enum alongside the existing failure class. Never retain raw response text, prompts, headers, tokens, or arbitrary CLI fragments.

**Modified Files and Checklist:**

- [ ] `scripts/e2e-single-request-claude.sh`

**Test Strategy:** extend self-test fixtures for HTTP 400-style schema rejection, authentication, transport, unknown, redaction, cleanup, and disallowed text.

**Verification:** `--self-test` passes and generated diagnostic artifacts contain only allowlisted values after raw files are absent.

### 3. CONTRACT-3 — state the compatibility and authority boundary

**Problem:** accepting a new top-level field without a contract could imply that IOP interprets or forwards Claude context-management controls.

**Solution:** document that `context_management` is optional, object-shaped compatibility input on decoded Messages/counting surfaces; it grants no authority and is omitted from normalized Chat provider requests. Native raw-tunnel behavior remains governed by its existing contract.

**Modified Files and Checklist:**

- [ ] `agent-contract/outer/anthropic-compatible-api.md`

**Test Strategy:** source assertions bind the documented field name, shape, non-forwarding rule, and non-authoritative rule to the implementation/tests.

**Verification:** contract wording matches decoder behavior and does not claim successful S12 generation.

### 4. PREFLIGHT-4 — qualify the repaired boundary without provider generation

**Problem:** catalog admission alone did not exercise the Claude request shape or token-count prerequisite before the sole live call.

**Solution:** rebuild the reviewed Edge in the existing disposable managed runtime, add a deterministic local `token_counter` to the preset selector's canonical catalog model (the managed dispatch model-group key), and perform authenticated catalog plus `POST /v1/messages/count_tokens` through IOP. Use unit/bridge tests—not a Messages generation request—to prove the new request shape. Preserve current managed routes and all IOP ownership boundaries.

**Modified Files and Checklist:**

- [ ] Remote-only disposable runtime config/binary under `/Users/toki/agent-work/iop-s12-managed-validation-20260808`.
- [ ] No canonical dev or tracked success-evidence changes.
- [ ] No Claude `--run` and no direct Gemini/Ornith/Claude request.

**Test Strategy:** fresh remote package tests, config check, isolated Edge restart, authenticated catalog/count_tokens requests, process/log/metric inspection.

**Verification:** selected catalog count is one; count_tokens returns HTTP 200 through IOP; accepted ingress and provider-run/stage/model-output counts are unchanged; managed CP/Edge/Node remain healthy.

### 5. REVIEW-EVIDENCE-5 — record actual provider-free results

**Problem:** the reviewer needs to distinguish repaired readiness from an unperformed live S12 attempt.

**Solution:** fill all implementation-owned sections with exact local/remote commands, safe counts/statuses, runtime identity, no-live cardinality, and any deviation. Explicitly record that a future live call remains blocked on new user authorization.

**Modified Files and Checklist:**

- [ ] `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G09.md`

**Test Strategy:** verify no placeholders, secrets, raw bodies, private keys, or success claims remain.

**Verification:** every implementation-owned section is complete and the next external-execution boundary is explicit.

## Implementation Checklist

- [ ] Accept and validate bounded `context_management` without forwarding or authority changes.
- [ ] Retain only closed, secret-free harness rejection diagnostics.
- [ ] Synchronize the external Anthropic compatibility contract.
- [ ] Pass fresh local no-provider compatibility and harness gates.
- [ ] Pass remote managed catalog/count_tokens gates through IOP with no provider generation or live Claude run.
- [ ] Fill implementation-owned review evidence and stop for official review.

## Modified Files Summary

| File | Reason |
|---|---|
| `apps/edge/internal/openai/anthropic_types.go` | Bounded Claude Code request compatibility field and validation |
| `apps/edge/internal/openai/anthropic_bridge_test.go` | Acceptance, rejection, and non-forwarding regressions |
| `scripts/e2e-single-request-claude.sh` | Closed failure status/reason evidence and self-tests |
| `agent-contract/outer/anthropic-compatible-api.md` | External compatibility and authority boundary |
| `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G09.md` | Provider-free implementation evidence |

## Final Verification

1. Format and focused source gates: `gofmt -w apps/edge/internal/openai/anthropic_types.go apps/edge/internal/openai/anthropic_bridge_test.go`; `go test -count=1 -race ./apps/edge/internal/openai ./apps/edge/internal/service`.
2. Harness gates: `bash -n scripts/e2e-single-request-claude.sh`; `scripts/e2e-single-request-claude.sh --self-test`.
3. Contract/source assertions: verify object/null validation, invalid-shape rejection, provider omission, and non-authoritative wording.
4. Hygiene: `git diff --check`; scan changed review/contract/script output for secrets, raw bodies, private keys, and placeholders without printing secret candidates.
5. Remote source/build: sync reviewed files only to `/Users/toki/agent-work/iop-s12-validation-20260808/source`, run fresh macOS OpenAI/service package tests, rebuild the disposable Edge, and pass `config check` with the deterministic local token counter.
6. Remote provider-free IOP gates: authenticate with SOPS caller through stdin/memory, require selected catalog count 1 and `count_tokens` HTTP 200, then prove ingress/provider-run/stage/model-output counters and existing Claude child count are unchanged.
7. Forbidden in this packet: Claude `--run`, Messages generation, direct provider requests, provider output capture, success manifest/spec claims, and canonical dev mutation.

After completing all changes, fill implementation-owned sections in `CODE_REVIEW-cloud-G09.md`.

## Final Routing

- `evaluation_mode=isolated-reassessment`
- `finalizer=finalize-task-policy.sh`, `finalizer_mode=pair`
- build closures: scope/context/verification/evidence/ownership/decision all true
- build scores: `2/1/2/2/2` => `G09`; `base_route_basis=grade-boundary`
- `large_indivisible_context=false`; matched risks: `boundary_contract`, `structured_interpretation`, `variant_product`; count 3
- `review_rework_count=11`, `evidence_integrity_failure=false`; recovery boundary matched without replacing grade basis
- build: `worker/cloud/G09`, `PLAN-cloud-G09.md`
- review scores: `2/1/2/2/2` => `review/cloud/G09`, `CODE_REVIEW-cloud-G09.md`
