<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=16 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - Third authorized Claude-through-IOP S12 call

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> Complete every implementation-owned section and checklist, then stop with the active pair in place for official review.
> The user's authorization covers one guarded Claude-through-IOP call only. Do not retry, call a provider directly, archive files, write `complete.log`, create user-review state, or classify the next state.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=16, tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_15.log` / `code_review_cloud_G10_15.log`; verdict `FAIL`, rework 14.
- Resolved external stop: `user_review_5.log`; current user instruction authorizes exactly one new guarded Claude-through-IOP call.
- Both prior guards remain immutable. The new attempt must use `sole-live-3`, stay entirely behind IOP, and never retry.

## For the Review Agent

Compare every implementation item against source/runtime evidence. Append one verdict and routing signals, archive the pair, and materialize the matching next state. Write completion evidence only for a fully qualified PASS.

## Implementation Item Completion

| Item | Status |
|---|---|
| FRESH-GATES-1 | [x] |
| SOLE-LIVE-3 | [x] |
| SUCCESS-SYNC-3 | [x] Correctly skipped after live FAIL |
| REVIEW-EVIDENCE-4 | [x] |

## Implementation Checklist

- [x] Pass all fresh local and remote provider-free gates against the repaired runtime.
- [x] Create `sole-live-3` and execute exactly one newly authorized Claude-through-IOP call.
- [x] Keep Gemini/Ornith/Claude provider routing entirely inside IOP and never retry.
- [x] On PASS only, publish schema-valid redacted evidence and synchronize bounded qualification owners.
- [x] On failure, retain only closed diagnostics and make no success claim.
- [x] Fill implementation-owned review evidence and stop for official review.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementing agents must not modify or check this section.

- [x] Append one verdict and verified routing signals.
- [x] Verify sole-live cardinality, IOP-owned routing, privacy, S12 evidence, and success-only publication decision.
- [x] Archive the active pair and verify task artifacts are tracked.
- [x] Materialize the verdict's next state; write completion artifacts only on PASS.

## Deviations from Plan

- The first wrapper launch stopped before guard creation and before any Claude invocation because the process-safety check searched complete command strings and matched the wrapper's own command text. Fresh evidence showed `sole-live-3` absent, zero Claude executable processes, zero ingress change, and no result/manifest. The check was corrected to compare `ps ... comm` executable names, so the authorization remained unconsumed until the guarded call.
- The actual guarded call ended with harness rc 69, class `api-rejected`, reason `http-400`, before accepted ingress. Per the one-call authorization there was no retry and no direct provider fallback.
- Because the call failed, the PASS-only manifest and contract/spec qualification synchronization were deliberately skipped.

## Key Design Decisions

- The user's approval was bound to exactly one new `sole-live-3` attempt. `sole-live-3.rc-69` is the durable consumed-authorization record.
- Claude Code called only the managed IOP endpoint. Gemini and Ornith-fast remained IOP-owned internal routes; neither stage ran because accepted ingress stayed at zero.
- Only closed diagnostics were retained. The harness removed raw CLI/API response content, prompts, model output, and temporary caller material.

## Reviewer Checkpoints

- Confirm fresh provider-free compatibility/preflight passed before the third guard existed.
- Confirm exactly one third guard and one `--run`, with no retry or direct provider request.
- Confirm Claude called only IOP and Gemini/Ornith executed only as IOP-owned internal stages.
- Confirm secrets, prompts, raw provider/model output, workspace paths, and CLI captures were not published.
- Confirm manifest/contract/spec success updates occurred only after a complete schema-valid PASS.

## Verification Results

### 1. Fresh local and remote readiness

- Local focused Edge compatibility tests passed (`go test ./apps/edge/internal/openai`, 0.059s). Full race gates passed (`go test -race ./apps/edge/internal/openai`, 12.494s; `./apps/edge/internal/service`, 9.273s). Harness syntax/self-test, source/contract assertions, redaction checks, and `git diff --check` passed.
- Remote Control Plane/Edge/Node PIDs 89097/698/89104 were alive. Catalog returned HTTP 200 with exactly one selected public model, the exact prompt-caching-scope count-token compatibility probe returned HTTP 200, one Edge and one Node were online, and both provider snapshots were healthy.
- Before guard creation, generation/activity deltas and Claude executable count were zero. Prior guards existed; the third guard, result, and manifest did not. Fresh harness `--preflight-only` passed with a temporary Claude config, managed CA, and in-memory SOPS caller credential without invoking Claude.

### 2. Third durable guard and sole live call

- `sole-live-3.started` was created immediately before the only `--run` and finalized as `sole-live-3.rc-69` after capturing `live_rc=69`.
- The closed harness result was `Claude invocation failed (status 1 class api-rejected reason http-400)`. Accepted ingress delta was 0, Claude executable process delta was 0, remote result/manifest were absent, and retry count was 0.
- The earlier wrapper self-match did not create a guard or invoke Claude and therefore did not consume the authorization. The corrected executable-name detector preceded the one actual call.

### 3. IOP stages, workspace, terminal, and privacy

- No IOP execution stage, workspace result, terminal event, Gemini output, Ornith output, or Claude model output existed because the request was rejected before accepted ingress.
- No direct Gemini, Ornith, or Claude provider request was issued. Claude's configured base remained `https://127.0.0.1:18483`, and internal provider routes remained owned by IOP.
- Raw CLI/API captures and temporary caller config were removed. No secret, prompt, response body, model output, workspace content/path, or credential digest was published.

### 4. Manifest and PASS-only synchronization

- `live_outcome=failed`; the remote manifest was absent. Schema validation and stable evidence publication were therefore inapplicable.
- No PASS-only evidence file was created and no S12 qualification claim was added to the contract or specs.

### 5. Final hygiene

- The fresh local focused/race/harness/diff/redaction gates passed before execution. Guard cardinality is three immutable finalized guards total and exactly one new `sole-live-3.rc-69` for this authorization.
- Provider-free follow-up probes against the current Edge returned: baseline 200; `advanced-tool-use-2025-11-20` beta 400; tool `defer_loading` 400; tool `strict` 400; tool `eager_input_streaming` 400; thinking display 400. These probes changed neither generation nor provider activity.
- Static inspection of the installed Claude Code 2.1.177 request builder shows the first-party tool-search path can add `advanced-tool-use-2025-11-20` and tool `defer_loading`. The probes establish two concrete current Edge compatibility gaps, but do not recover the deleted raw error subtype and are not presented as proof of which field triggered the live 400.

---

> Implementer: fill every implementation-owned section and checklist, then stop for official review. Do not modify review-only state or append a verdict.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Fail | The authorized Claude 2.1.177 call was rejected with HTTP 400 before ingress, and provider-free probes independently reproduce rejection for the installed tool-search beta and tool declaration field. |
| Completeness | Fail | The one-call execution and failure handling are complete, but the required S12 ingress/stage/workspace/terminal evidence does not exist. |
| Test coverage | Fail | Existing tests cover prior Claude compatibility fields but do not cover `advanced-tool-use-2025-11-20` or tool `defer_loading`. |
| API contract | Fail | The current allowlist and tool schema reject two bounded compatibility inputs emitted by the installed Claude tool-search path. |
| Code quality | Pass | The harness preserved one-shot cardinality, removed raw captures, and made no success claim or retry. |
| Implementation deviation | Pass | The wrapper self-match stopped before guard creation or invocation, was diagnosed with executable-level process evidence, and did not consume authorization. |
| Verification trust | Pass | Guard rc, zero ingress/stages/model output, absent manifest, no retry, provider-free probes, and static CLI inspection are mutually consistent; the exact deleted raw subtype is not overclaimed. |
| Spec conformance | Fail | Milestone `claude-smoke` still requires ingress 1, ordered Gemini -> Ornith-fast -> Gemini stages, verified workspace output, timing, and terminal evidence. |

### Findings

- Required R10 — `apps/edge/internal/openai/anthropic_types.go:19`: Claude Code 2.1.177's first-party tool-search request path can emit `Anthropic-Beta: advanced-tool-use-2025-11-20` and boolean tool `defer_loading`, while the current Edge rejects both independently with provider-free count-token HTTP 400. Add only this beta to the bounded allowlist and `defer_loading` to the decoded tool compatibility schema, keep both non-authoritative and absent from normalized Chat provider requests, document the contract, and add regression tests. Rebuild the disposable dev Edge and prove the two exact probes return HTTP 200 while unsupported `strict`, `eager_input_streaming`, and thinking-display shapes remain HTTP 400. Do not make another live Claude call without new authorization.

### Routing Signals

- `review_rework_count=15`
- `evidence_integrity_failure=false`

### Next Step

FOLLOW-UP — repair R10 in the repository and disposable dev runtime, complete provider-free compatibility probes and preflight, and do not invoke Claude or any provider directly.
