<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=22 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Execute the sixth guarded Claude-through-IOP qualification call

## For the Implementing Agent

The user's `승인할테니 바로해` authorizes exactly one sixth guarded Claude Code `--run` against the repaired disposable dev runtime. Run fresh provider-free readiness, atomically create `sole-live-6.started`, execute the harness once with a fresh Claude config and the SOPS caller held only in process memory, finalize the guard as `sole-live-6.rc-N`, and never retry. Claude calls only IOP; Gemini plan/review and Ornith-fast work remain internal IOP routes. Publish S12 evidence only on complete schema-valid PASS.

## Background

The fifth call was consumed as `sole-live-5.rc-69` and failed HTTP 400 before accepted ingress. Required R14 now passes: the child sets `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1`, closed pre-ingress classes are retained without arbitrary values, the isolated Edge was rebuilt, the provider-free compatibility matrix and preflight passed, ingress remained 0, and no result/manifest exists.

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_21.log` / `code_review_cloud_G10_21.log`; verdict `FAIL`, Required R15, `review_rework_count=20`, `evidence_integrity_failure=false`.
- Resolved external stop: `user_review_8.log`; the user explicitly authorized one sixth guarded execution and no retry.
- Existing guards `sole-live.rc-69` through `sole-live-5.rc-69` are immutable. No `sole-live-6*` guard exists at plan start.
- Disposable CP/Edge/Node are `47248/62931/47260`; canonical `/Users/toki/agent-work/iop-dev` remains read-only.

## Finding Resolution Map

| Finding | Mode | Exact evidence | Changed precondition |
|---|---|---|---|
| R15 | direct external execution | Resolved `user_review_8.log`, fresh provider-free readiness, `sole-live-6` guard, one harness `--run` | The user explicitly authorized exactly one new call after child request determinism and closed diagnostics passed review. |

## Analysis

### SDD Criteria

S12 requires one real Claude request, ingress delta 1, ordered Gemini -> Ornith-fast -> Gemini stages, redacted stage/total timing, verified workspace result and cleanup, and exactly one terminal. A pre-ingress failure cannot qualify S12.

### Execution Boundary

- Runner: `toki@toki-labs.com`; isolated source `/Users/toki/agent-work/iop-s12-validation-20260808/source`; workspace `/Users/toki/agent-work/iop-s12-validation-20260808/workspace`; managed root `/Users/toki/agent-work/iop-s12-managed-validation-20260808`.
- Claude: `/opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe`; public model `iop-single-request-light`; base URL `https://127.0.0.1:18483`.
- Caller: SOPS `tokens.toki-dev-cline`, decrypted only into process memory and used only for Claude-to-IOP authentication.
- No retry, direct Gemini/Ornith/provider request, canonical dev mutation, or success claim on partial evidence.

### Final Routing

- `evaluation_mode=isolated-reassessment`; `finalizer=finalize-task-policy.sh`; `finalizer_mode=pair`.
- Build `worker/cloud/G10`; review `review/cloud/G10`; `base_route_basis=grade-boundary`; scores `2/2/2/2/2`; `large_indivisible_context=true`.
- Loop risks: `temporal_state`, `concurrent_consistency`, `boundary_contract`, `variant_product`; count 4.
- `review_rework_count=20`, `evidence_integrity_failure=false`.

## Implementation Checklist

- [x] Reconfirm the exact repaired runtime, certificate, catalog, provider-free frozen/unsupported shapes, preflight, zero ingress/process, five finalized guards, and absent artifacts.
- [x] Atomically create only `sole-live-6.started` after every readiness gate passes.
- [x] Run the Claude-through-IOP harness exactly once with fresh config and in-memory SOPS caller; never retry.
- [x] Finalize the guard as `sole-live-6.rc-N` and capture only closed result/cardinality evidence.
- [x] Publish manifest and success-only owners only on complete S12 PASS; otherwise leave them untouched.
- [x] Fill implementation-owned review sections and stop for official review.

## Final Verification

1. Fresh runtime/fleet/certificate/catalog/count-token/preflight gates with zero ingress and no sixth guard.
2. One atomic sixth guard and one harness `--run` only.
3. Post-run ingress, stage/terminal, process, guard, workspace, manifest, privacy, and no-retry checks.
4. Schema validation and success-only publication only if all S12 evidence passes.

After execution, fill `CODE_REVIEW-cloud-G10.md` and leave the active pair for official review.
