<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=31 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - REVIEW_API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> Execute the plan's selected root cause, scope, files, and dependency decisions as written. Do not choose another owner, narrow/expand the write boundary, or replace a fix with another verification attempt.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=31, tag=REVIEW_API

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_30.log` / `code_review_cloud_G10_30.log`; verdict `FAIL`, Required R30, `review_rework_count=29`, `evidence_integrity_failure=false`.
- `sole-live-13.rc-69` is immutable: ingress `0 -> 1`, provider tunnels `10 -> 12`, Plan success 1, Work validation error 1, cleanup success 1, terminal validation error 1, no result/manifest, and no retry.
- Canonical IOP correlation `req.manual-1786192088899580000` selected `ornith-fast`/`rtx5090-lemonade`, received a 1168-byte response, logged one `workspace_write` tool call, and committed terminal success. Canonical IOP preserves provider bytes; llama.cpp emits top-level `system_fingerprint` and `timings` in Chat Completions responses.

## For the Review Agent

> **[REVIEW AGENT ONLY]** Compare every item against source and actual output. Append one verdict, archive this pair to suffix 31, and then write the required next state. PASS alone may write `complete.log` and archive the task; WARN/FAIL must prepare a routed follow-up or a justified user-review state. Do not update the roadmap directly.

## Implementation Item Completion

| Item | Status |
|---|---|
| canonical-diagnostic-codec | [x] |
| codec-regression-tests | [x] |
| disposable-rebuild-and-guard | [x] closed failure; no partial publication |

## Implementation Checklist

- [x] Admit and discard only Work envelope `system_fingerprint` and `timings`, retaining every existing fail-closed authority check.
- [x] Add canonical accept/discard regression coverage and retain explicit rejection of an unrecognized top-level field.
- [x] Run fresh focused, package, race, and Edge test/build verification.
- [x] Sync only the two changed source files, rebuild/restart the disposable runtime from the current source identity, refresh runtime evidence, and pass every provider-free gate.
- [x] Create/finalize exactly one `sole-live-14` guard around one harness `--run`; validate complete S12 evidence on success or prove no partial publication on failure, with no retry.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G10_31.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G10_31.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory to `agent-task/archive/YYYY/MM/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/` and update this checklist at the final archive path.
- [ ] If PASS, preserve and report `milestone-task=workspace-binding,claude-smoke` for runtime aggregation without modifying roadmap.
- [x] If WARN/FAIL, write the next filesystem state matching the verdict and do not write `complete.log`.

## Deviations from Plan

- Local `rsync` was unavailable after the non-overwriting remote backups were created, so the exact two reviewed files were transferred with `scp` and both SHA-256 values were compared before testing.
- The first remote OpenAI package run hit the unrelated timing-sensitive `TestSingleRequestExecutorRequestBudgetOwnership/request_wall_clock` case once. That subtest passed for 20 fresh repetitions and the whole package then passed freshly; the failure did not touch runtime state.
- `/opt/homebrew/bin/make` was absent. After all tests had passed, the declared build was rerun with discovered `/usr/bin/make` and completed successfully.
- The first provider-free wrapper stopped before catalog, count-token, harness, guard, or generation because `pgrep` returning 1 for the valid zero-process state tripped `pipefail`. The corrected zero-safe process counter then passed the complete provider-free gate with no activity delta.
- `sole-live-14` closed with harness exit 69. It was finalized once, was not retried, and published neither workspace result nor manifest.

## Key Design Decisions

- The Work codec admits `system_fingerprint` and `timings` only in the exact top-level allowlist and retains neither field; arbitrary top-level fields, malformed messages, and authority-bearing tool fields remain closed.
- Canonical `/Users/toki/agent-work/iop-dev` state remained read-only. Only the disposable Edge binary was rebuilt and restarted; the existing Control Plane and Node processes were preserved.
- SOPS `tokens.toki-dev-cline` was decrypted only into remote process memory for IOP caller authentication. Claude, Gemini, and Ornith all remained behind the declared IOP routes.
- The failed fourteenth call is immutable evidence. Follow-up diagnosis used existing Edge/Node/canonical IOP logs and official llama.cpp response construction only; it did not issue another generation request.

## Reviewer Checkpoints

- Verify R30 admits exactly `system_fingerprint` and `timings` only at the Work envelope boundary and retains neither value.
- Verify arbitrary top-level extensions, Work `extra_content`, malformed tool calls, role/finish-reason mismatches, and invalid completion JSON still fail closed.
- Verify source sync and runtime identities correspond to the reviewed two-file diff; canonical dev remains read-only and secrets remain process-memory only.
- Verify thirteen finalized guards precede exactly one `sole-live-14`, no `.started` remains, and no retry occurs.
- PASS requires one ingress, ordered Gemini → ornith-fast → Gemini, verified workspace output, cleanup, one terminal, exact result, and schema-valid redacted manifest.

## Verification Results

### Formatting

Command:

```text
gofmt -w apps/edge/internal/openai/single_request_work_stage.go apps/edge/internal/openai/single_request_work_stage_test.go
```

Actual output: completed with no formatter output and no formatting change outside the two files.

### Focused Work codec tests

Command:

```text
go test ./apps/edge/internal/openai -run 'TestSingleRequestWorkStage(AdmitsCanonicalIOPDiagnostics|RejectsMalformedResponsesAndOptions|DrivesOrderedToolLoop)$' -count=1
```

Actual output: `ok iop/apps/edge/internal/openai 0.036s`.

### OpenAI package tests

Command:

```text
go test ./apps/edge/internal/openai -count=1
```

Actual output: `ok iop/apps/edge/internal/openai 9.843s`.

### Focused race tests

Command:

```text
go test -race ./apps/edge/internal/openai -run 'TestSingleRequestWorkStage(AdmitsCanonicalIOPDiagnostics|RejectsMalformedResponsesAndOptions|DrivesOrderedToolLoop)$' -count=1
```

Actual output: `ok iop/apps/edge/internal/openai 1.069s`.

### Edge regression tests

Command:

```text
go test ./apps/edge/... -count=1
```

Actual output: all `apps/edge/...` packages passed freshly.

### Edge build

Command:

```text
make build-edge
```

Actual output: PASS; local default `linux/arm64` Edge binary built successfully.

### Disposable dev preflight and sole live guard

Record the exact source sync, build digest, config/runtime evidence, fleet/catalog/harness preflight, guard cardinality, single fixed harness output, structured observations, workspace result, manifest validation, and no-retry proof here.

Actual output:

- Exact remote file digests after `scp`: Work codec `149ccfda8b433bfc5c9ef5c47261f89510a3b85fff707a193617a43967d4a6e3`; test `2755b44c8f9ba9ffca18cba8e029a23d3a5a203dea85c977524eaaf04b0fe5a1`.
- Remote focused tests, focused race, full `apps/edge/...`, and fresh OpenAI package rerun: PASS. The one timing flake and its 20-repeat/fresh-package closure are recorded under deviations.
- Remote `/usr/bin/make build-edge BUILD_DIR=build/s12 EDGE_TARGET=darwin-arm64`: PASS. Worktree `sha256:35e988444d6a60f0f4aa37125a3be6831d031ca1baf7e5a302980b22f3e9a041`; Edge `sha256:d3e9651b8885504f76d273d3bbe619d4751f272cfc87c4222cb255e4d90fb40e`.
- Disposable fleet after deployment: Control Plane PID 35448, Edge PID 54114, Node PID 43830; listeners 18483/18484/19401/19402/19404 each singular and Node reconnected ready. Config `sha256:e06fd3deb9fc1882440eee79f8eae1b6ed827be62ab4edc33b5b66b3bbd4bc42`; config check `sha256:94d438c58d250ad651eef8ae9352130595e50a9dedab2b93dff10c454fd47049`; stage binding `sha256:5a1bf5933f3cd871262f007dae19c062217b787fc0933c496ce45576b472195b`; workspace owner `sha256:8b4249697d18b4d715f633665404dfd2c505b2fa6cf39cf6e8a014435969d932`.
- Harness self-test: PASS. Authenticated canonical IOP catalog: HTTP 200 with exactly one `ornith-fast`. Managed IOP count-token: HTTP 200 with positive `input_tokens`. Harness preflight: PASS. Provider-free activity remained ingress `0 -> 0`, provider tunnels `12 -> 12`, Claude processes `0 -> 0`; thirteen finalized guards, zero started guards, and no result/manifest preceded the call.
- Guarded fixed output:

```text
[single-request-claude-smoke] validation failed: Claude invocation failed (status 1 class api-rejected reason api-error)
SOLE_LIVE_14_RC=69
INGRESS=0->1
PROVIDER_TUNNELS=12->14
CLAUDE_PROCESSES=0->0
FINAL_GUARD=sole-live-14.rc-69
OBSERVATION_COUNT=cleanup|none|success|none|1
OBSERVATION_COUNT=request|none|success|none|1
OBSERVATION_COUNT=stage|plan|success|none|1
OBSERVATION_COUNT=stage|work|error|validation|1
OBSERVATION_COUNT=terminal|none|error|validation|1
OBSERVATION_CORRELATIONS=1
WORKSPACE_RESULT=absent MANIFEST=absent
```

- Isolated correlation `sr-1cb6ad595a14c06d80118318664b9637`: Plan success 4149 ms, Work validation error 862 ms, cleanup success 2 ms, terminal validation error 5018 ms. Canonical IOP correlation `req.manual-1786194974536857000`: `ornith-fast`/`rtx5090-lemonade`, 1082-byte response, one `workspace_write`, terminal success.
- Post-failure static diagnosis: official llama.cpp `common_chat_msg::to_json_oaicompat` emits `content: ""` when parsed tool-call content is empty. The current Work codec accepts a tool call only when `Content == nil`; therefore the plan-31 test's `content:null` fixture did not cover the byte-exact canonical shape.

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---|---|---|
| Header, Overview, Review Agent instructions | Fixed | Implementing agent must not modify or execute finalization |
| Archive Evidence Snapshot | Fixed | Use it as prior-loop context; read only cited logs if more detail is required |
| Implementation Item Completion | Implementing agent | Check status only |
| Implementation Checklist | Implementing agent | Check status only; do not change text/order |
| Review-Only Checklist | Review agent | Implementing agent must not modify |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholders with actual content |
| Reviewer Checkpoints | Fixed | Review acceptance criteria |
| Verification Results | Implementing agent | Fill actual output; command changes require a deviation entry |
| Code Review Result | Review agent | Appended only during official review |

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Fail | The diagnostic fields are admitted, but byte-exact llama.cpp tool-call content remains incompatible and Work still closes before executing the valid call. |
| Completeness | Fail | S12 workspace result and schema-valid manifest remain absent. |
| Test coverage | Fail | The new positive fixture uses `content:null`; canonical llama.cpp emits `content:""` when tool-call content is empty. |
| API contract | Fail | The supported IOP-through-IOP Work route cannot yet consume the canonical llama.cpp OpenAI-compatible tool-call message. |
| Code quality | Pass | The allowlist change is exact, diagnostic data is discarded, and arbitrary fields remain rejected. |
| Implementation deviation | Warn | Transfer/build path fallbacks and one corrected zero-process preflight wrapper were justified and provider-free. |
| Verification trust | Pass | Guard 14, activity deltas, two matching runtime correlations, no-retry behavior, and absent artifacts agree. |

### Findings

- Required R31 — `apps/edge/internal/openai/single_request_work_stage.go:504`: canonical llama.cpp serializes a tool-call message with `content:""` when there is no visible assistant content, while Work accepts only `Content == nil`. Admit only `nil` or an empty string for the single-tool-call branch, continue rejecting non-empty content alongside tool calls, replace the positive canonical fixture with the exact empty-string shape, and add a negative non-empty-content case. Rebuild the disposable Edge and qualify with one new non-retriable guard.

### Routing Signals

- `evaluation_mode=isolated-reassessment`
- `verdict=FAIL`
- `review_rework_count=30`
- `evidence_integrity_failure=false`
- `next_state=plan`
- `finalizer=finalize-task-policy.sh`
- `finalizer_mode=pair`
- build route `worker/cloud/G10`; review route `review/cloud/G10`

### Next Step

- Route Required R31 into a fresh plan. Preserve `sole-live-14.rc-69`, do not write `complete.log`, and use a distinct no-retry guard only after the exact codec regression and all provider-free gates pass.
