<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=18 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - Fourth authorized Claude-through-IOP S12 call

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> Complete the planned fresh gates and exactly one guarded call, fill every implementation-owned section, then stop. Do not retry, call a provider directly, append a verdict, archive files, write `complete.log`, or classify the next state.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=18, tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_17.log` / `code_review_cloud_G10_17.log`; verdict `FAIL`, Required R11, `review_rework_count=16`, `evidence_integrity_failure=false`.
- Resolved external stop: `user_review_6.log`; the current user instruction authorizes one fourth guarded Claude-through-IOP execution and no retry.
- Existing guards `sole-live.rc-69`, `sole-live-2.rc-69`, and `sole-live-3.rc-69` are immutable. No `sole-live-4*` guard exists at plan start.
- Managed runtime `/Users/toki/agent-work/iop-s12-managed-validation-20260808` is healthy with one Edge, one Node, two healthy provider snapshots, current runtime evidence, fresh managed TLS material, and zero Claude processes.

## For the Review Agent

Verify every implementation item against source/runtime evidence. Append one verdict and routing signals, archive the pair, and materialize the matching next state. Write completion evidence only for a complete S12 PASS.

## Implementation Item Completion

| Item | Status |
|---|---|
| REVIEW_API-1 | [x] |
| REVIEW_API-2 | [x] |
| REVIEW_API-3 | [x] |
| REVIEW_API-4 | [x] |

## Implementation Checklist

- [x] Pass fresh local and remote provider-free gates against the exact repaired candidate and managed runtime.
- [x] Create `sole-live-4` and execute exactly one newly authorized Claude-through-IOP call with no retry or direct provider request.
- [x] On PASS only, validate and publish redacted S12 evidence and synchronize bounded qualification owners. The call failed, so all success-only writes were correctly skipped.
- [x] On failure, retain only closed diagnostics, preserve privacy, and make no success claim.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementing agents must not modify or check this section.

- [ ] Append one verdict and verified routing signals.
- [ ] Verify sole-live cardinality, IOP-owned routing, privacy, S12 evidence, and PASS-only publication decision.
- [ ] Archive the active pair and verify task artifacts are tracked.
- [ ] Materialize the verdict's next state; write completion artifacts only on PASS.

## Deviations from Plan

None. The authorized call failed before admitted ingress, so the planned closed-failure branch ran and PASS-only publication was skipped.

## Key Design Decisions

- Consumed the authorization once under a new immutable fourth guard and did not infer authorization for a retry.
- Used the exact installed Claude executable with a fresh temporary config, managed CA, and SOPS caller credential held only in process memory. Claude targeted only IOP; no provider endpoint was called directly.
- Kept the failure record closed: status/class/reason, ingress/process cardinality, guard state, and artifact absence only. Prompt, response body, raw CLI output, and model output were not retained or published.

## Reviewer Checkpoints

- Confirm every fresh provider-free gate passed before the fourth guard existed.
- Confirm exactly one fourth guard and one `--run`, with no retry or direct provider request.
- Confirm Claude called only IOP and Gemini/Ornith ran only as IOP-owned internal stages.
- Confirm secrets, prompts, raw provider/model output, workspace paths/content, and CLI captures were not published.
- Confirm manifest/contract/spec success updates occurred only after a complete schema-valid PASS.

## Verification Results

### 1. Fresh local and remote readiness

Commands:

1. `go test -count=1 ./apps/edge/internal/openai`
2. `go test -count=1 -race ./apps/edge/internal/openai ./apps/edge/internal/service`
3. `bash -n scripts/e2e-single-request-claude.sh && scripts/e2e-single-request-claude.sh --self-test`
4. `git diff --check`
5. Authenticated remote catalog/count-token/status/activity/process/guard/artifact checks and `scripts/e2e-single-request-claude.sh --preflight-only` against the disposable managed runtime.

- Focused package: `ok  iop/apps/edge/internal/openai  8.554s`.
- Race: `ok  iop/apps/edge/internal/openai  12.784s`; `ok  iop/apps/edge/internal/service  9.353s`.
- Harness syntax/self-test: exit 0; `[single-request-claude-smoke] self-test passed: exact Claude base-route coverage, authenticated model admission, closed failure classification, model/Edge/Node/runtime binding, zero-child preflight, derived verification, redaction, cleanup, signal handling, and atomic publication`.
- `git diff --check`: exit 0, no output.
- Remote certificate had more than 900 seconds remaining. Managed process IDs were Control Plane 8782, Edge 8786, and Node 8790; fleet was one Edge, one Node, and two healthy provider snapshots.
- Catalog returned HTTP 200 with selected-model count 1. Provider-free matrix was baseline 200, advanced beta 200, `defer_loading` 200, `strict` 400, `eager_input_streaming` 400, and thinking-display 400.
- Generation activity delta was zero; Claude executable process count was zero; exactly three finalized prior guards and no fourth guard existed; workspace result and manifest were absent.
- Preflight output was `[single-request-claude-smoke] preflight passed without a Claude invocation`; Claude process delta was zero and neither output nor fourth guard was created.

### 2. Fourth durable guard and sole live call

- The wrapper atomically created `sole-live-4.started`, invoked the harness `--run` once, and finalized the guard as `sole-live-4.rc-69`.
- Closed harness result: `Claude invocation failed (status 1 class api-rejected reason http-400)`; `live_rc=69`; ingress delta 0; exact Claude executable process delta 0.
- There are now four finalized `sole-live*.rc-69` guards and zero `.started` guards. `retry_count=0`; no fifth guard, second `--run`, or direct provider request occurred.

### 3. IOP stages, workspace, terminal, and privacy

- Not applicable for internal stages, timings, workspace, or terminal: HTTP 400 occurred before accepted ingress, so no Gemini plan/review, Ornith-fast work, workspace result, or model output existed.
- The caller base remained `https://127.0.0.1:18483`; the SOPS value authenticated Claude only to IOP. No direct provider credential or provider endpoint was supplied to Claude.
- The closed record contains no token, private key, prompt, raw response/CLI capture, model output, workspace content, or digest derived from sensitive content.

### 4. Manifest and PASS-only synchronization

- Remote manifest was absent and workspace result was absent. Because `live_rc != 0`, schema validation/publication and stable evidence copy were not attempted.
- No S12 evidence manifest or success-only contract/spec/roadmap qualification statement was created or updated.

### 5. Final hygiene

- Fresh local/race/self-test/diff gates passed before the call. Post-failure guard inspection proved four finalized guards, zero in-progress guards, zero Claude processes, and no result/manifest.
- A subsequent provider-free `/count_tokens` diagnostic returned baseline 200, `redact-thinking-2026-02-12` 400, `thinking.display=omitted` 400, `thinking.display=summarized` 400, and invalid display 400, with ingress 0 before/after. This diagnostic made no generation request and is review evidence only.
- Active plan/review headers and archive snapshots remain identical. No unresolved implementation placeholder remains outside the review-only section.

---

> Implementer: fill every implementation-owned section and checklist, then stop for official review.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Pass | The fourth authorization was consumed once under an immutable guard, caller routing stayed Claude-to-IOP only, and failure handling retained closed evidence. |
| Completeness | Fail | The call was rejected HTTP 400 before ingress, so S12 has no internal stage, workspace, terminal, timing, or manifest evidence. |
| Test coverage | Pass | Fresh local/race/harness/diff gates, remote readiness/status matrix, sole-call cardinality, and post-failure provider-free probes agree. |
| API contract | Fail | Installed Claude 2.1.177 can emit either the redacted-thinking beta or `thinking.display`; the current strict Edge boundary rejects both. |
| Code quality | Pass | No speculative success write or retry was made, and the next repair can remain one typed beta/enum compatibility boundary. |
| Implementation deviation | Pass | The closed-failure branch matched the plan exactly; PASS-only publication was correctly skipped. |
| Verification trust | Pass | Four finalized guards, zero started guards, ingress delta 0, process delta 0, absent artifacts, and retry count 0 are mutually consistent. |
| Spec conformance | Fail | SDD S12 still requires accepted ingress 1, Gemini -> Ornith-fast -> Gemini, workspace result/cleanup, timings, and one terminal. |

### Findings

- Required R12 — `apps/edge/internal/openai/anthropic_types.go:19` and `apps/edge/internal/openai/anthropic_types.go:74`: static inspection of the exact installed Claude 2.1.177 request builder shows that its thinking-redaction path either adds `redact-thinking-2026-02-12` or, when display is explicit, removes that beta and sends `thinking.display`. The current disposable Edge independently rejects the beta, `display="omitted"`, and `display="summarized"` as HTTP 400 while baseline is 200 and ingress stays zero. Add only the bounded beta and optional `omitted|summarized` display compatibility, keep display non-authoritative and omitted from normalized Chat, preserve native raw behavior, reject other values, cover source/contract/provider-free before-after evidence, and do not infer authorization for another real call.

### Routing Signals

- `evaluation_mode=isolated-reassessment`
- `verdict=FAIL`
- `review_rework_count=17`
- `evidence_integrity_failure=false`
- `next_state=plan`
