<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=14 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - Newly authorized managed IOP S12 call

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=14

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G09_13.log` / `code_review_cloud_G09_13.log`; verdict `FAIL`, rework 12.
- Compatibility/catalog/count_tokens readiness is closed; the user's current `진행해` instruction authorizes exactly one new IOP-routed live attempt.
- Existing `sole-live.rc-69` remains prior evidence. The new attempt requires a distinct durable guard and no retry.

## Implementation Item Completion

| Item | Status |
|---|---|
| FRESH-GATES-1 | [x] |
| SOLE-LIVE-2 | [x] |
| SUCCESS-SYNC-3 | [x] Correctly skipped after live FAIL |
| REVIEW-EVIDENCE-4 | [x] |

## Implementation Checklist

- [x] Pass all fresh local and remote provider-free gates against current runtime evidence.
- [x] Create the new durable guard and execute exactly one newly authorized Claude-through-IOP `--run`.
- [x] Keep Gemini/Ornith/Claude provider routing entirely inside IOP and never retry.
- [x] On PASS only, publish schema-valid redacted evidence and synchronize the contract/spec owners.
- [x] On failure, retain only closed diagnostics and no success claims.
- [x] Fill implementation-owned review evidence and stop for official review.

## Review-Only Checklist

- [x] Append one verdict and verified routing signals.
- [x] Verify live cardinality, IOP provider ownership, secret/redaction handling, and S12 evidence.
- [x] Archive the active pair and verify task artifacts are tracked.
- [x] Materialize the verdict's next state; write completion artifacts only on PASS.

## Deviations from Plan

- The first preflight used `/opt/homebrew/bin/claude`, which is a symlink and was correctly rejected by the harness before a Claude process or live guard existed. The canonical executable `/opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe` was then used.
- The next preflight did not yet inject the managed private CA and failed its authenticated catalog probe before a Claude process or live guard existed. The final preflight set `CURL_CA_BUNDLE` and `NODE_EXTRA_CA_CERTS` to the managed CA and passed. Neither preflight failure consumed the authorization.
- The sole live call returned `live_rc=69`, closed class `api-rejected`, reason `http-400`, before accepted ingress. The new guard was finalized as `sole-live-2.rc-69`; there was no retry.
- Static inspection after the call found that Claude Code 2.1.177 deterministically adds `prompt-caching-scope-2026-01-05` on this first-party-provider/custom-base, noninteractive path, while the Edge allowlist lacks that beta. This is follow-up diagnosis only; the failed request was not replayed.

## Key Design Decisions

- The user's current `진행해` authorization was bound to one new guard and one live `--run` only. Preflight failures before guard creation did not count as live attempts; the guarded HTTP 400 consumed the authorization.
- Claude was only the authenticated caller to IOP. Gemini plan/review and Ornith-fast work remained IOP-owned routes and were never called directly. Because ingress stayed zero, none of those provider stages executed.
- The harness retained only `live_rc`, closed class/reason, counters, and artifact presence. Raw CLI/API response bodies, prompts, secrets, and model output were deleted with the temporary run context.
- Success-only manifest, contract qualification, and runtime/input spec qualification were correctly left unchanged because the call did not pass.

## Reviewer Checkpoints

- Confirm exactly one new guard and one new `--run`, with no retry regardless of result.
- Confirm Claude calls only IOP and Gemini/Ornith routes execute only inside IOP.
- Confirm caller/provider secrets and raw model/provider output are absent from argv, logs, review, and tracked evidence.
- Confirm success-only evidence/docs change only after schema-valid manifest PASS.

## Verification Results

### 1. Fresh local and remote readiness

- `go test -count=1 -race ./apps/edge/internal/openai ./apps/edge/internal/service`: PASS (`openai` 12.391s, `service` 9.282s).
- `bash -n scripts/e2e-single-request-claude.sh` and `scripts/e2e-single-request-claude.sh --self-test`: PASS.
- Contract/source/redaction assertions and `git diff --check`: PASS; no secret, raw response, or unresolved implementation placeholder was retained.
- Current compatibility source was synchronized to the isolated macOS source, the managed Edge was rebuilt, and config check passed. Runtime evidence was atomically regenerated for the current binary/config.
- Provider-free readiness through IOP: selected catalog HTTP 200 with one `iop-single-request-light`; object-shaped `context_management` count_tokens HTTP 200; ingress/lifecycle/hot-path dispatch/terminal remained `0`; one Edge, one connected Node, and two healthy provider snapshots.
- Final preflight with Claude 2.1.177 canonical executable and the managed CA: PASS; Claude process detector `0 -> 0`, ingress unchanged, new guard/result/manifest absent, and temporary caller config cleaned.

### 2. New durable guard and sole live call

- A new durable `sole-live-2.started` directory was atomically created immediately before the invocation and renamed after return to `sole-live-2.rc-69`. The prior `sole-live.rc-69` evidence was not modified.
- Exactly one Claude Code `--run` path was executed with the canonical executable, disposable workspace, SOPS caller held only in memory, and IOP base URL/public model. Result: `live_rc=69`, class `api-rejected`, reason `http-400`.
- Claude process detector remained `0 -> 0` after child settlement; accepted ingress remained `0 -> 0`. Retry count was exactly zero, and the finalized guard prevents a second call under this authorization.

### 3. IOP stages, workspace, terminal, and privacy

- The request failed before IOP admission, so lifecycle, Gemini plan/review, Ornith-fast work, provider dispatch, model output, workspace operation, cleanup stage, and terminal counters all remained zero.
- The disposable workspace result was absent and its verified success state was not claimed. No direct Gemini, Ornith, or Claude provider request was issued; only Claude Code -> IOP Edge was attempted.
- Raw caller/provider payloads and CLI output were confined to the temporary run context and deleted. Review evidence contains only the closed HTTP status family and zero/nonzero cardinality facts.
- Static post-failure comparison, without replay, identified the next deterministic request-boundary mismatch: Claude 2.1.177 adds `prompt-caching-scope-2026-01-05`, which the current Edge beta allowlist rejects.

### 4. Manifest and success-only synchronization

- Remote and workspace success manifests were absent, as required for a failed run. No schema/hash publication was attempted.
- The stable S12 evidence and success-only runtime/input spec qualification statements were not changed. The existing contract change remains limited to the previously verified context-management compatibility and makes no S12 success claim.

### 5. Final hygiene

- Fresh race, syntax, harness self-test, contract/source, redaction, and diff checks all passed before the live call.
- Post-call checks confirmed both durable guards, zero retry, absent result/manifest, unchanged canonical dev root, and no retained temporary caller config or raw response capture.
- No credential, key material, digest, prompt, private provider response, or model output was printed or written into tracked task evidence.

---

> Implementer: fill every implementation-owned section and checklist, then stop for official review. Do not modify review-only state or append a verdict.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Pass | Exactly one new guarded Claude-through-IOP call was made, the guard was finalized with rc 69, and no retry or direct provider call occurred. |
| Completeness | Fail | The call was rejected with HTTP 400 before accepted ingress, so S12 still lacks Gemini plan/review, Ornith-fast work, workspace output, terminal evidence, and a qualification manifest. |
| Test coverage | Pass | Fresh local races/self-tests and managed catalog/count-token/preflight gates passed; a provider-free prompt-caching-scope probe deterministically reproduces HTTP 400 without generation. |
| API contract | Fail | Claude Code 2.1.177 adds `prompt-caching-scope-2026-01-05` on the exact noninteractive custom-base path, but `supportedAnthropicBetas` rejects it. |
| Code quality | Pass | The existing compatibility and harness changes remain focused and pass fresh checks; the new failure is a distinct allowlist gap. |
| Implementation deviation | Pass | Both preflight corrections occurred before guard creation or Claude invocation and were necessary to use the canonical executable and managed CA. |
| Verification trust | Pass | The durable guard, `live_rc=69`, closed `http-400`, zero ingress/stage/workspace deltas, absent manifest, and zero retry agree across evidence. |
| Spec conformance | Fail | SDD S12 requires one admitted real Claude-through-IOP execution and complete IOP-owned stage/workspace evidence, none of which occurred after the pre-ingress rejection. |

### Findings

- Required R8 — `apps/edge/internal/openai/anthropic_types.go:19`: the current beta allowlist is one deterministic default Claude Code beta behind the installed 2.1.177 request path. Static inspection proves that, with `ANTHROPIC_BASE_URL` set to IOP, Claude still classifies the API provider as first-party and unconditionally adds `prompt-caching-scope-2026-01-05` for this custom non-Haiku model; a provider-free IOP `count_tokens` request with the exact bounded beta set returns HTTP 400 on the current Edge. Add only this compatibility beta, prove it remains non-authoritative and does not alter Gemini/Ornith routing or normalized provider payloads, update the external contract, rebuild the disposable managed Edge, and require the same provider-free request to return HTTP 200 with all generation counters unchanged. Do not invoke Claude again: the current authorization was consumed by `sole-live-2.rc-69`.

### Routing Signals

- `review_rework_count=13`
- `evidence_integrity_failure=false`

### Next Step

FOLLOW-UP PLAN — repair the bounded prompt-caching-scope beta compatibility gap and re-run provider-free IOP gates only; retain both live guards and do not run Claude or any provider directly without a new explicit authorization.
