<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=13 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - Claude pre-ingress compatibility

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> Execute the plan's selected root cause, scope, files, and dependency decisions as written. Do not choose another owner, narrow/expand the write boundary, or replace a fix with another verification attempt.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=13, tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_12.log` / `code_review_cloud_G10_12.log`; verdict `FAIL`, rework 11.
- The sole authorized Claude run returned `live_rc=69` / `api-rejected` before accepted ingress; no retry is authorized in this packet.
- All Claude, Gemini, and Ornith traffic must remain behind IOP. The canonical dev runtime is read-only.

## For the Review Agent

Compare implementation of each item against source files and verify that output in `Verification Results` matches code. Review completion means: append verdict/routing signals; archive the active pair; on WARN/FAIL fully materialize the next state; on PASS only write completion evidence and archive the task; then check applicable review-only items at the final log location.

## Implementation Item Completion

| Item | Status |
|---|---|
| COMPAT-1 | [x] |
| DIAGNOSTIC-2 | [x] |
| CONTRACT-3 | [x] |
| PREFLIGHT-4 | [x] |
| REVIEW-EVIDENCE-5 | [x] |

## Implementation Checklist

- [x] Accept and validate bounded `context_management` without forwarding or authority changes.
- [x] Retain only closed, secret-free harness rejection diagnostics.
- [x] Synchronize the external Anthropic compatibility contract.
- [x] Pass fresh local no-provider compatibility and harness gates.
- [x] Pass remote managed catalog/count_tokens gates through IOP with no provider generation or live Claude run.
- [x] Fill implementation-owned review evidence and stop for official review.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify verdict, dimension assessment, and Required/Suggested/Nit classifications.
- [x] Archive the active review and plan using the next collision-free suffix.
- [x] Verify the Agent-Ops managed `.gitignore` block tracks task markdown/log files and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log`, preserve milestone metadata, archive the task directory, and handle the active parent as required.
- [x] If WARN/FAIL, write the next filesystem state matching the verdict and do not write `complete.log`.

## Deviations from Plan

- Source comparison showed that both the `context_management` body member and its `context-management-2025-06-27` beta allowlist entry were absent. The plan was corrected before implementation and both sides of the same compatibility boundary were repaired.
- Local `rsync` was unavailable (`exit 127`), so the same three reviewed files were copied to their exact isolated-source destinations with `scp`; no additional remote path was synchronized.
- The first remote candidate config placed `token_counter` on the public virtual model. Config check passed, but the provider-free request returned the closed result `400 not_supported_error|provider-selection` because managed virtual dispatch retains the selector model-group key. The counter was moved to canonical selector `gemini-3.6-flash`, the managed Edge was restarted, and the same IOP `count_tokens` gate passed. No provider generation or Messages request occurred during either diagnostic.
- The Edge config checker rejects a temporary filename ending in `.next` as an unsupported config type. The identical candidate was renamed to `edge.next.yaml`, then passed config check before atomic replacement.

## Key Design Decisions

- `context_management` is stored as `json.RawMessage` only to keep strict top-level decoding compatible. It must be absent, `null`, or an object; nested contents are not granted IOP semantics.
- `context-management-2025-06-27` is explicitly allowlisted. Chat bridge tests prove the compatibility object is omitted from the Gemini-normalized payload, while invalid scalar/array forms stop before provider wire activity.
- Harness failure evidence is the closed pair `class + reason`; reasons are allowlisted tokens such as `http-400`. Temporary CLI output still owns raw details and is deleted, and self-tests prove an arbitrary raw marker is not propagated.
- Remote caller authentication used SOPS `tokens.toki-dev-cline` only as Claude/Anthropic-to-IOP authentication through process memory and curl config stdin. The local deterministic counter sits on the managed selector key solely to prevent count-token provider selection.
- Managed runtime changes were restricted to `/Users/toki/agent-work/iop-s12-managed-validation-20260808`; Control Plane PID 89097 and Node PID 89104 stayed running, and only managed Edge was rebuilt/restarted to final PID 93597.

## Reviewer Checkpoints

- Confirm `context_management` accepts only object/null input and is not forwarded to Chat providers or interpreted as routing/workspace authority.
- Confirm harness diagnostics are closed/redacted and raw captures are deleted.
- Confirm remote catalog/count_tokens checks traverse IOP and no Messages generation/direct provider request/Claude `--run` occurs.
- Confirm canonical dev state and prior sole-live guard remain unchanged.

## Verification Results

### 1. Local compatibility and race tests

- `gofmt -w apps/edge/internal/openai/anthropic_types.go apps/edge/internal/openai/anthropic_bridge_test.go`: PASS.
- `go test -count=1 -race ./apps/edge/internal/openai ./apps/edge/internal/service`: PASS (`openai` 12.579s, `service` 9.304s).
- Focused `TestAnthropicContextManagementNullCompatibility|ChatBridgeClaudeCodeRequest|ChatBridgeRejectsUnsupportedBeforeWire`: PASS locally and on remote macOS; null/object accepted, scalar/array rejected, no Chat payload forwarding.

### 2. Harness diagnostic gates

- `bash -n scripts/e2e-single-request-claude.sh`: PASS locally and on the remote macOS isolated source.
- `scripts/e2e-single-request-claude.sh --self-test`: PASS after the final `API Error: 400` classifier fixture; closed classification, redaction, cleanup, signal handling, and atomic publication all passed.
- Diagnostic fixtures covered `cli-usage`, authentication, connection refusal, HTTP 400/429, and unclassified cases. `rejected-field-marker` remained only in the deleted raw capture and did not reach harness stderr.

### 3. Contract and hygiene

- Contract/source assertions: PASS for beta allowlist, object/null validation, invalid-shape error, provider omission, and non-authoritative wording.
- `git diff --check`: PASS; the untracked harness also passed a direct trailing-whitespace scan.
- Secret/raw-output/placeholder scan: PASS for private-key, AGE key, common API-key patterns, arbitrary diagnostic marker, and unresolved implementation placeholders. No secret/digest/raw response was printed or retained.

### 4. Remote managed provider-free gates

- Fresh remote package tests and disposable Edge rebuild/config check: PASS (`openai` 8.805s, `service` 9.151s); final `edge.yaml` config check PASS; managed Edge PID 93597 healthy on loopback TLS.
- Authenticated selected catalog count: HTTP 200, `iop-single-request-light` count exactly 1.
- IOP `count_tokens` HTTP status/count: HTTP 200 with one positive integer `input_tokens`; request included `context-management-2025-06-27` and an object-shaped `context_management`.
- Ingress/provider-run/stage/model-output and Claude child deltas: `iop_anthropic_single_request_ingress_total=0`, lifecycle=0, hot-path dispatch=0, terminal=0 before/after; process detector `0 -> 0`; provider generation none.
- Managed fleet: one online `edge-smoke`, connected `node-smoke`, two healthy snapshots (`mac-gemini-api`, `rtx5090-lemonade`).
- Canonical dev identity and sole-live guard: canonical runtime untouched; managed guard remains the existing directory `sole-live.rc-69`. Temporary local validation files and two remote status captures were removed after use.

### 5. External execution boundary

- Claude `--run` / Messages generation / direct provider requests: none. All catalog/count-token traffic traversed IOP; Gemini and Ornith were not invoked directly or indirectly for generation.
- Future live authorization status: not consumed in this packet. The user's current `진행해` instruction authorizes continuing the IOP-routed test; the next plan must bind that authorization to exactly one new Claude-through-IOP live attempt with no retry.

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---|---|---|
| Header, Overview, Review Agent Instructions | Fixed | Implementer does not alter review finalization state |
| Archive Evidence Snapshot | Fixed | Read only cited evidence when needed |
| Implementation Item Completion | Implementer checks status only | Item names stay fixed |
| Implementation Checklist | Implementer checks status only | Text/order stays fixed |
| Review-Only Checklist | Review agent only | Implementer does not modify |
| Deviations, Key Design Decisions | Implementer | Replace placeholders with actual evidence |
| Reviewer Checkpoints | Fixed | Pre-filled from plan |
| Verification Results | Implementer | Fill exact outcomes; deviations must be recorded |
| Code Review Result | Review agent | Appended after implementation |

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Pass | The beta/body compatibility repair accepts object/null, rejects scalar/array, and does not forward the field to normalized Gemini Chat payloads. |
| Completeness | Fail | S12 still has no newly admitted Messages request, ordered Gemini -> Ornith-fast -> Gemini execution, workspace result, or qualification manifest. |
| Test coverage | Pass | Fresh local race/self-tests, remote macOS tests, and the managed IOP count-token request cover the repository-owned pre-ingress boundary without provider generation. |
| API contract | Pass | The external contract matches the allowlist, validation, raw-tunnel distinction, and non-authoritative/non-forwarded Chat semantics. |
| Code quality | Pass | The decoder and closed diagnostic changes are focused, bounded, formatted, and reuse existing strict/cleanup paths. |
| Implementation deviation | Pass | `scp`, `.yaml` temporary naming, and selector-key counter placement were evidence-driven corrections within the disposable runtime. |
| Verification trust | Pass | Reviewer evidence is fresh and consistent: catalog/count_tokens 200, all single-request/hot-path counters zero, no provider generation, and the prior live guard unchanged. |
| Spec conformance | Fail | SDD S12 requires one real Claude-through-IOP execution and resulting runtime/workspace evidence; the newly authorized execution belongs to the follow-up packet and has not run yet. |

### Findings

- Required R7 — `CODE_REVIEW-cloud-G09.md:112`: the repository-owned compatibility and provider-free gates now pass, but this packet intentionally did not execute Claude Messages generation, so S12 still lacks the one ingress and Gemini -> Ornith-fast -> Gemini evidence required by the active milestone contract. The user's current `진행해` instruction supplies a new authorization to continue the IOP-routed test. Route a follow-up that binds it to exactly one new live `--run` on `toki@toki-labs.com` using runtime `/Users/toki/agent-work/iop-s12-managed-validation-20260808`, SOPS caller `tokens.toki-dev-cline` only for Claude-to-IOP authentication, and IOP-owned Gemini/Ornith routes; preserve the old `sole-live.rc-69` guard and use a new durable cardinality guard with no retry.

### Routing Signals

- `review_rework_count=12`
- `evidence_integrity_failure=false`

### Next Step

FOLLOW-UP PLAN — archive the current pair and route the user's new authorization into exactly one guarded Claude-through-IOP live attempt; do not ask again about Gemini/Ornith routing and do not issue any direct provider request.
