<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=3 tag=REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Platform-neutral workspace admission and dev Claude qualification

## For the Implementing Agent

Filling the implementation-owned sections of `CODE_REVIEW-cloud-G10.md` is the mandatory last implementation step. Run every verification command, paste actual stdout/stderr, keep both active files in place, and report ready for review. Only the official code-review skill may append a verdict, archive files, write `complete.log`, or classify a next state. If blocked, record the exact blocker, attempted command/output, and resume condition in the review evidence fields; do not ask the user, create a control-plane stop file, or auto-retry the live Claude invocation.

## Background

The user retracted `/config/workspace/iop-s2`, removed Mac/Darwin as a functional requirement, selected the `dev` runtime on `toki@toki-labs.com`, delegated disposable source/workspace paths, identified `/config/workspace/iop/token/.claude` as the API-key source, and authorized a dev rebuild plus exactly one live Claude invocation after preflight. The selected runner happens to be Darwin, but the product contract must admit an approved Linux or Darwin IOP Node with exact host/catalog matching. The current loader, Node runtime, S12 schema, and harness still hard-code Darwin, so those defects must pass local regression first. The API-key value must exist only in `ANTHROPIC_API_KEY` in the invoked process and must never enter commands, chat, logs, config, or tracked evidence.

## Archive Evidence Snapshot

- Immediate prior plan/review: `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/plan_cloud_G08_2.log` and `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/code_review_cloud_G08_2.log`; verdict `FAIL`, `review_rework_count=1`, `evidence_integrity_failure=false`.
- Required R1 was the only unresolved finding: every repository-owned dependency and self-test passed, but caller-owned live inputs were empty, so preflight failed closed, Claude child count remained zero, and no S12 manifest or qualification update was produced.
- Resolved user decision is preserved in `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/user_review_0.log`: `iop-s2` is withdrawn; dev runner, disposable paths, API-key binding, rebuild authorization, and one non-retriable invocation are fixed.
- Dependency evidence already accepted by the prior review: `agent-task/archive/2026/08/m-iop-owned-single-request-agent-execution/23+22_error_cancel/complete.log` and `agent-task/archive/2026/08/m-iop-owned-single-request-agent-execution/24+22_claude_smoke_harness/complete.log`.
- Stable required evidence path remains `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json`.

## Finding Resolution Map

| Finding | Mode | Fix/evidence | Changed precondition |
|---------|------|--------------|----------------------|
| R1 | direct-fix | Generalize the Darwin-only platform boundary, bind the selected Node binary into S12 runtime evidence, materialize/build a disposable dev candidate, pass local and remote preflight, then invoke Claude exactly once and publish the validated redacted manifest. | The user supplied every formerly absent external input and authorized the bounded dev mutation and API-key use. |

## Analysis

### Files Read

- Project/roadmap/test routing: `AGENTS.md`, project/private/roadmap/agent-spec rules, router, roadmap-sdd, plan, code-review, finalize-task-routing, orchestrate-agent-task-loop, dev-runtime-deploy, local/dev test rules and Edge/Node/platform/testing smoke profiles.
- Current design owners: the active Milestone and approved SDD; `agent-contract/index.md`; `agent-contract/inner/edge-config-runtime-refresh.md`; `agent-contract/inner/edge-node-runtime-wire.md`; `agent-contract/outer/anthropic-compatible-api.md`; `agent-spec/index.md`; `agent-spec/runtime/edge-node-execution.md`; `agent-spec/runtime/provider-pool-config-refresh.md`; `agent-spec/input/openai-compatible-surface.md`; `agent-test/dev/edge-smoke.md`.
- Config/runtime: `packages/go/config/edge_types.go`, `packages/go/config/load.go`, `packages/go/config/workspace_config_test.go`, `apps/node/internal/workspace/runtime.go`, `apps/node/internal/workspace/runtime_test.go`, `apps/node/internal/bootstrap/module.go`, `apps/node/internal/bootstrap/workspace_runtime_test.go`, Unix/other cleanup, identity, and command-process implementations, `configs/edge.yaml`.
- Harness/build: `scripts/e2e-single-request-claude.sh`, `scripts/fixtures/single-request-claude-smoke-manifest.schema.json`, and `Makefile`.
- Immediate prior task-local plan/review and resolved `USER_REVIEW` snapshot listed above. No broad archive search was used.

### SDD Criteria

- Approved SDD D03/S02/S04 require an operator-approved IOP Node workspace; operating system is not the public functional requirement. Current implementation can truthfully support the existing Unix-safe implementations on the closed set `darwin|linux`, with exact catalog platform equal to the Node host. Windows and unknown hosts continue to fail closed.
- S12 requires one actual Claude request, one Edge Messages ingress, ordered `gemini -> ornith-fast -> gemini`, stage-pure/total timings, one terminal, and verified workspace change. One run identity must bind source, Edge, selected workspace Node, config, public model, logs/metrics, and workspace owner without storing raw values.
- S11 remains owned by completed task 23. This packet does not reopen error/cancel behavior except for the harness's existing no-retry and cleanup assertions.

### Verification Context

- Repository-native baseline on 2026-08-08: `go test -count=1 ./packages/go/config ./apps/node/internal/workspace ./apps/node/internal/bootstrap` PASS; `make test-single-request-claude-smoke-self-test` PASS.
- Selected inventory: SSH `toki@toki-labs.com`; canonical managed checkout `/Users/toki/agent-work/iop-dev`; runner Darwin arm64; Go `/opt/homebrew/bin/go` 1.26.3; Claude `/opt/homebrew/bin/claude` 2.1.177. Canonical checkout is branch `dev`, HEAD `61016d5bd0940033d68e1862bc20e1b7108b8875`, with an unrelated untracked `.bak` file. It is discovery/control input only and must not be reset, synchronized, or overwritten.
- Active selected dev runtime before mutation: Edge PID 80428 listens on 18083/18084/19093/19101 from `build/dev-runtime/bin/edge --config build/dev-runtime/edge.yaml`; workspace Node PID 18753 runs `build/dev-runtime/bin/iop-node --config build/dev-runtime/node-codex.yaml serve`. `dev-corp` is a separate runtime and is excluded.
- Safe config allowlist confirms Edge id `edge-toki-labs-dev`, public model catalogs `gemini-3.6-flash` and `ornith-fast`, providers `mac-gemini-api` and `rtx5090-lemonade`, no existing workspace/preset, metrics `127.0.0.1:19101`, runner base URL `http://127.0.0.1:18083/v1`, and public bootstrap base `http://toki-labs.com:18083/v1`. Secret/hash/token values were not printed.
- Disposable paths are fixed: source `/Users/toki/agent-work/iop-s12-validation-20260808/source`; workspace `/Users/toki/agent-work/iop-s12-validation-20260808/workspace`. Both were absent during preflight. Materialize the current `/config/workspace/iop-s0` Git HEAD/branch plus working tree using a temporary Git bundle and an overlay that excludes `.git/` and `build/`; do not publish the branch or touch `iop-s2`.
- Build all declared Node targets and the Darwin Edge from that one snapshot under `build/s12`, but replace only the selected dev Edge and selected Mac workspace Node for this compatible no-wire-change candidate. Do not touch `dev-corp` or provider hosts. Preserve the managed binary/config paths as the rollback source.
- Credential injection is stdin-to-environment only: the remote shell reads one line into `ANTHROPIC_API_KEY`, exports it, and execs the harness. Never place the key in an argv, file, report, config, or shell trace. Preflight may validate presence but must not start the Claude child.
- Confidence is high: source/runtime identities and listeners were read-only verified, the target paths are new, dependencies are complete, and the only shared mutation is bounded by exact process/config/path checks and rollback.

### Test Coverage Gaps

- Existing config tests reject Linux and existing Node runtime tests treat a Linux host as the mismatch case. Add Linux-positive, catalog/host mismatch, and unsupported-host regressions.
- Existing bootstrap composition covers Darwin only. Add a Linux catalog/host composition case or table the existing case across both supported Unix hosts.
- Existing S12 self-test validates Darwin as a constant and does not bind the selected Node binary/version. Extend its positive and mutation matrix; a schema-only edit is insufficient.
- No deterministic test can replace the authorized live Claude invocation. The live run remains exactly once after both local and remote preflight pass.

### Symbol References

- No public Go symbol is renamed or removed.
- The existing `WorkspaceDefinition.Platform`, `WorkspaceConfig.platform`, runtime `hostOS`, runtime evidence `workspace_os`, and Make `IOP_SINGLE_REQUEST_SMOKE_*` surface remain; their validation changes from Darwin-constant to closed `darwin|linux` plus exact host match.
- New harness input/evidence fields `--node-bin`, `IOP_SINGLE_REQUEST_SMOKE_NODE_BIN`, `node_digest`, and `node_version_digest` must be updated together in parser, validation, self-test fake, schema, manifest builder, Make targets, and dev invocation.

### Split Judgment

Keep one plan. Platform admission, selected Node identity, source/runtime fingerprint, dev candidate restart, one ingress, fresh observation offsets, workspace mutation, and atomic manifest form one correctness identity. Splitting would permit a platform claim or S12 PASS against a runtime not built from the claimed source. Local platform tests and remote preflight remain hard gates inside the same packet.

### Scope Rationale

Include only Darwin/Linux workspace admission, exact host matching, selected Node evidence binding, S12 harness/schema/Make updates, current contract/spec/test-profile terminology, the isolated dev candidate, one live invocation, and the stable redacted manifest. Exclude Windows workspace execution, wire/schema protobuf changes, generic deployment release/tag/push, canonical checkout cleanup, provider-host redeployment, `dev-corp`, `iop-s2`, credential persistence, retries, benchmarks, roadmap completion mutation, and raw model/provider/tool/workspace output.

### Final Routing

- `evaluation_mode=isolated-reassessment`; build/review closures `scope`, `context`, `verification`, `evidence`, `ownership`, and `decision` are all true; capability gap is absent.
- Finalizer `finalize-task-policy.sh`, mode `pair`. Build scores `2/2/2/2/2` => G10, base/final `grade-boundary`, `worker/cloud/G10`, `PLAN-cloud-G10.md`. Review scores `2/2/2/2/2` => G10, `official-review`, `review/cloud/G10`, `CODE_REVIEW-cloud-G10.md`.
- `large_indivisible_context=false`; matched risks are `temporal_state`, `concurrent_consistency`, `boundary_contract`, `structured_interpretation` (4); `review_rework_count=1`; `evidence_integrity_failure=false`; risk boundary matches but grade-boundary remains authoritative; recovery boundary is false.

## Dependencies and Execution Order

1. Keep the accepted task-23/task-24 completion evidence fixed. Implement platform/harness changes and pass all credential-free local tests first.
2. Materialize the current worktree into the new remote source, create the new empty workspace, patch a candidate copy of the dev config with virtual model `iop-single-request-light`, preset `preset-iop-single-request-light`, and workspace ref `ws-iop-s12-validation-20260808`, then build Edge and all Node targets from one snapshot.
3. Validate exact old process identities, stop only the selected dev workspace Node and Edge, start the candidate Edge and Darwin Node, and prove health/config/provider/workspace/log/metrics identities. On any setup/preflight failure, stop candidate processes and restore the managed dev Edge/Node; do not invoke Claude.
4. Generate closed runtime-evidence from the candidate facts, pass `--preflight-only` with child count zero, then run `--run` exactly once. Never auto-retry, even if the invocation fails.
5. Validate and copy the redacted manifest to the stable local path, update bounded qualification owners only after PASS, and leave the selected dev runtime in the reviewed candidate state unless rollback is required by a failed pre-invocation gate.

## Implementation Checklist

- [ ] Admit only `darwin` and `linux` workspace catalogs, require exact Node host/catalog matching, and add config/runtime/bootstrap regressions while preserving unsupported-host and mismatch failure.
- [ ] Generalize the S12 schema/harness from Darwin-constant to supported Unix host ownership, bind the selected Node binary/version, expand the source fingerprint, and keep zero-child preflight/redaction/atomic publication guarantees.
- [ ] Synchronize current config/inner-contract/runtime-spec/dev-test terminology with the platform-neutral approved IOP Node contract without claiming Windows support.
- [ ] Materialize and build the isolated dev source, patch a candidate config without exposing secrets, restart only the selected dev Edge/workspace Node with rollback, and record exact non-secret runtime identity.
- [ ] Pass remote preflight with zero Claude children, inject `ANTHROPIC_API_KEY` from `/config/workspace/iop/token/.claude`, invoke actual Claude exactly once, and atomically publish/validate the stable redacted S12 manifest without retry.
- [ ] After evidence PASS only, update the outer Anthropic contract and matching current specs from deferred to bounded qualification; run all final regression, proto, document, redaction, and diff checks freshly.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_API-1] Make workspace platform admission Unix-capable and host-exact

**Problem**

`packages/go/config/load.go:446-486` rejects every platform except `darwin`; `apps/node/internal/workspace/runtime.go:135-177` rejects every non-Darwin host and does not compare each catalog entry to the selected supported host independently. This contradicts approved D03 and would make the platform-neutral SDD/document edits false.

**Solution**

Define one closed supported workspace platform predicate/constants for `darwin` and `linux`. Edge config accepts only those values. A non-empty Node catalog accepts only a supported Unix host and every entry must exactly equal that host before any root is opened. Empty catalogs remain backward-compatible on any host. Preserve all existing root, symlink, identity, operation, command, environment, limit, cleanup, and no-follow behavior. Do not admit Windows because file/command authority implementations intentionally fail closed there.

Before (`packages/go/config/load.go:485`):

```go
if workspaces[j].Platform != "darwin" {
    return fmt.Errorf("nodes[%d].workspaces[%d]: platform must be \"darwin\", got %q", nodeIdx, j, workspaces[j].Platform)
}
```

After:

```go
if !IsSupportedWorkspacePlatform(workspaces[j].Platform) {
    return fmt.Errorf("nodes[%d].workspaces[%d]: unsupported workspace platform %q", nodeIdx, j, workspaces[j].Platform)
}
```

Before (`apps/node/internal/workspace/runtime.go:152-156`):

```go
if hostOS != "darwin" {
    return nil, errors.New("workspace catalog requires darwin")
}
for _, cfg := range configs {
    entry, err := openCatalogEntry(cfg)
```

After:

```go
if !config.IsSupportedWorkspacePlatform(hostOS) {
    return nil, errors.New("workspace catalog requires a supported host")
}
for _, cfg := range configs {
    entry, err := openCatalogEntry(cfg, hostOS)
```

**Modified Files and Checklist**

- [ ] Update `packages/go/config/edge_types.go` with closed platform constants/predicate and platform-neutral comments.
- [ ] Update `packages/go/config/load.go` to accept `darwin|linux` only.
- [ ] Update `packages/go/config/workspace_config_test.go` with Linux-positive and Windows/unknown-negative cases.
- [ ] Update `apps/node/internal/workspace/runtime.go` with supported-host and exact catalog/host checks before opening roots.
- [ ] Update `apps/node/internal/workspace/runtime_test.go` with Darwin/Linux positive, cross-platform mismatch, and unsupported-host cases.
- [ ] Update `apps/node/internal/bootstrap/workspace_runtime_test.go` so composition-before-ready succeeds for both supported hosts and still redacts startup failure.

**Test Strategy**

Write regressions in the listed existing test files. Assert Edge loads both supported platforms and rejects unsupported values; Node opens a catalog only when platform equals host; empty catalog compatibility stays unchanged; root errors remain redacted.

**Verification**

`go test -count=1 ./packages/go/config ./apps/node/internal/workspace ./apps/node/internal/bootstrap` must pass with fresh output.

### [REVIEW_API-2] Bind platform-neutral Node runtime into S12 evidence

**Problem**

`scripts/e2e-single-request-claude.sh:135-167,357,570` omits config/Node platform owners from the worktree fingerprint and fixes `workspace_os` to Darwin. `scripts/fixtures/single-request-claude-smoke-manifest.schema.json:69` repeats the constant, while the harness validates no selected Node binary/version. A rebuilt Edge paired with a stale Node could therefore produce plausible evidence.

**Solution**

Add `packages/go/config`, `apps/node/internal/workspace`, and `apps/node/internal/bootstrap` to the deterministic worktree fingerprint. Add required `--node-bin`, validate its executable/version/hash before invocation, and bind `node_digest` plus `node_version_digest` into runtime evidence and final manifest. Accept only `darwin|linux` and require `workspace_os == runner_os`, since the harness mutates and verifies a local path controlled by the selected workspace Node runner. Change the self-test fixture to the actual supported host, add a fake Node, toggle to the other supported OS for mismatch, and keep all existing secret/redaction/process-cleanup/atomic-publication assertions.

Before (`scripts/fixtures/single-request-claude-smoke-manifest.schema.json:69`):

```json
"workspace_os": { "const": "darwin" }
```

After:

```json
"workspace_os": { "enum": ["darwin", "linux"] },
"node_digest": { "$ref": "#/$defs/digest" },
"node_version_digest": { "$ref": "#/$defs/digest" }
```

**Modified Files and Checklist**

- [ ] Update `scripts/e2e-single-request-claude.sh` parser, usage, runtime loader, snapshot validation, manifest builder/validator, worktree fingerprint, fake Node, positive cases, and mutation matrix.
- [ ] Update `scripts/fixtures/single-request-claude-smoke-manifest.schema.json` with supported workspace OS and closed Node identity fields.
- [ ] Update `Makefile` comments/targets with required `IOP_SINGLE_REQUEST_SMOKE_NODE_BIN` and `--node-bin` forwarding.

**Test Strategy**

Extend the credential-free self-test. Positive preflight/run must bind the fake Node; platform mismatch, unsupported workspace OS, missing/non-executable Node, Node version failure, digest drift, and post-snapshot Node drift must fail with zero or one child as appropriate and no partial evidence.

**Verification**

`make test-single-request-claude-smoke-self-test` must pass and report zero-child preflight, model/Edge/Node/runtime binding, redaction, cleanup, signal handling, and atomic publication.

### [REVIEW_API-3] Synchronize current platform contracts and examples

**Problem**

Current config comments, inner contracts, runtime specs, and dev smoke profile still state “fixed Darwin” or “Mac Node,” while the approved design and implementation support a platform-neutral approved Node with a deliberately closed Unix implementation set.

**Solution**

State `darwin|linux` as the current implementation support and exact catalog/host matching as the admission rule. Describe OS as runtime evidence, not a caller-visible functional selector. Retain restart-required catalog semantics, opaque workspace refs, raw-path privacy, and Windows fail-closed scope. Replace only current normative/deferred text; preserve dated history as history.

**Modified Files and Checklist**

- [ ] Update `configs/edge.yaml` operator workspace example/comments and include both platform examples without enabling either.
- [ ] Update `agent-contract/inner/edge-config-runtime-refresh.md` and `agent-contract/inner/edge-node-runtime-wire.md`.
- [ ] Update `agent-spec/runtime/edge-node-execution.md` and `agent-spec/runtime/provider-pool-config-refresh.md` platform semantics.
- [ ] Update `agent-test/dev/edge-smoke.md` to say approved IOP Node rather than Mac-only execution.

**Test Strategy**

No separate document test. Deterministic `rg` must leave no current normative fixed-Darwin/Mac-only claim outside explicit history, build-target names, and Darwin-specific fixtures.

**Verification**

Run Final Verification commands 4 and 10 after code changes.

### [REVIEW_API-4] Build the isolated dev candidate and execute one S12 run

**Problem**

The managed dev checkout is dirty and lacks a workspace/preset. Mutating it would overwrite unrelated state. The prior preflight received empty inputs, so no real Claude request or stable manifest exists.

**Solution**

After local PASS, create a temporary Git bundle for current HEAD/branch, clone it only into the absent delegated source path, and overlay the current worktree excluding `.git/` and `build/`. Copy the managed dev config to `build/s12/runtime/edge.yaml` and patch only the candidate copy: append virtual model `iop-single-request-light`, preset `preset-iop-single-request-light` with Gemini high -> ornith-fast -> Gemini high, workspace `ws-iop-s12-validation-20260808` on `mac-codex-node`, bounded read/list/write operations, candidate log path, and unchanged secret/provider/auth values. Validate via the candidate Edge before stopping anything.

Build Edge and all declared Node targets from the same source. Derive a closed `runtime-evidence.json` from the exact HEAD/branch/worktree digest, runner/workspace OS+arch, workspace/config ownership, Claude/Edge/Node binary+version hashes, schema, base URL, public model, and stage binding. Validate one old Edge and one old selected workspace Node process before stop; restart only those two using candidate paths. Confirm other provider Nodes reconnect, candidate config/health/Messages/metrics/log/workspace checks pass, and retain exact managed paths for rollback.

Run preflight by streaming `/config/workspace/iop/token/.claude` to a remote `read`, exporting only `ANTHROPIC_API_KEY`, and executing the harness. Assert preflight exits zero and Claude child count is zero. Then execute the identical `--run` command once. Never loop, retry, or invoke Claude outside the harness. On live failure, preserve evidence and stop; no automatic rollback-and-retry. On pre-invocation failure, restore managed dev Edge/Node.

**Modified Files and Checklist**

- [ ] Create `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json` only by validating and atomically transferring the remote harness output.
- [ ] Record exact non-secret source/build/config/process/runtime/preflight/run/rollback facts and actual outputs in `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md`.
- [ ] After manifest PASS only, update `agent-contract/outer/anthropic-compatible-api.md`, `agent-spec/runtime/edge-node-execution.md`, and `agent-spec/input/openai-compatible-surface.md` with the stable evidence path and bounded one-run qualification.

**Test Strategy**

The remote candidate preflight is the zero-child integration gate; the actual harness `--run` is the sole live integration test. Validate ingress delta one, ordered engines, stage/terminal timings, terminal count one, expected file digest, Node/Edge/runtime identity, and zero forbidden matches. Do not reconstruct evidence from logs.

**Verification**

Run Final Verification commands 5-9 in order. Command 8 is the only live Claude invocation and must be executed at most once.

## Modified Files Summary

| File | Items |
|------|-------|
| `packages/go/config/edge_types.go` | REVIEW_API-1 |
| `packages/go/config/load.go` | REVIEW_API-1 |
| `packages/go/config/workspace_config_test.go` | REVIEW_API-1 |
| `apps/node/internal/workspace/runtime.go` | REVIEW_API-1 |
| `apps/node/internal/workspace/runtime_test.go` | REVIEW_API-1 |
| `apps/node/internal/bootstrap/workspace_runtime_test.go` | REVIEW_API-1 |
| `scripts/e2e-single-request-claude.sh` | REVIEW_API-2 |
| `scripts/fixtures/single-request-claude-smoke-manifest.schema.json` | REVIEW_API-2 |
| `Makefile` | REVIEW_API-2 |
| `configs/edge.yaml` | REVIEW_API-3 |
| `agent-contract/inner/edge-config-runtime-refresh.md` | REVIEW_API-3 |
| `agent-contract/inner/edge-node-runtime-wire.md` | REVIEW_API-3 |
| `agent-spec/runtime/provider-pool-config-refresh.md` | REVIEW_API-3 |
| `agent-test/dev/edge-smoke.md` | REVIEW_API-3 |
| `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json` | REVIEW_API-4 |
| `agent-contract/outer/anthropic-compatible-api.md` | REVIEW_API-4 |
| `agent-spec/runtime/edge-node-execution.md` | REVIEW_API-3, REVIEW_API-4 |
| `agent-spec/input/openai-compatible-surface.md` | REVIEW_API-4 |
| `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md` | REVIEW_API-1, REVIEW_API-2, REVIEW_API-3, REVIEW_API-4 |

## Final Verification

Fresh output is required. Commands 1-6 are credential-free; command 7 is a zero-child remote preflight; command 8 is the only authorized live Claude invocation and must never be auto-rerun.

1. `go test -count=1 ./packages/go/config ./apps/node/internal/workspace ./apps/node/internal/bootstrap` — Darwin/Linux config, exact host matching, unsupported-host rejection, composition, and redaction tests pass.
2. `make test-single-request-claude-smoke-self-test` — platform-neutral Edge/Node/runtime binding, zero-child preflight, derived verification, redaction, cleanup, signal handling, and atomic publication pass.
3. `go test -race -count=1 ./packages/go/config ./packages/go/streamgate ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/node/internal/bootstrap ./apps/node/internal/node ./apps/node/internal/transport ./apps/node/internal/workspace` — common SDD regressions pass freshly.
4. `make proto && git diff --exit-code -- proto/gen/iop && go test -count=1 ./...` — protobuf output is reproducible, there is no wire delta, and the full Go suite passes.
5. `bash -c 'set -euo pipefail; test "$(git branch --show-current)" = feature/iop-owned-single-request-agent-execution; test "$(git rev-parse HEAD)" = 70d22850d01714fdef734dafa42e82fed79e0786; test -x /usr/bin/rsync; test -f /config/workspace/iop/token/.claude; test "$(stat -c %a /config/workspace/iop/token/.claude)" = 600; ssh -o BatchMode=yes toki@toki-labs.com "test ! -e /Users/toki/agent-work/iop-s12-validation-20260808/source; test ! -e /Users/toki/agent-work/iop-s12-validation-20260808/workspace; test -x /opt/homebrew/bin/go; test -x /opt/homebrew/bin/claude; test -f /Users/toki/agent-work/iop-dev/build/dev-runtime/edge.yaml; test -f /Users/toki/agent-work/iop-dev/build/dev-runtime/node-codex.yaml"'` — local/remote immutable setup assumptions hold before source materialization. If current HEAD changed only because this plan's implementation committed nothing, record the actual reviewed HEAD in runtime evidence and the deviation; do not reset.
6. `ssh -o BatchMode=yes toki@toki-labs.com 'cd /Users/toki/agent-work/iop-s12-validation-20260808/source && build/s12/bin/iop-edge config check --config build/s12/runtime/edge.yaml && build/s12/bin/iop-edge version && build/s12/bin/iop-node-darwin-arm64 version && test "$(uname -s)" = Darwin && test "$(uname -m)" = arm64 && test -d /Users/toki/agent-work/iop-s12-validation-20260808/workspace && test -w /Users/toki/agent-work/iop-s12-validation-20260808/workspace && curl --fail --silent --show-error http://127.0.0.1:18083/healthz >/dev/null && curl --fail --silent --show-error http://127.0.0.1:19101/metrics | rg -q "^iop_anthropic_single_request_ingress_total"'` — candidate config/binaries/host/workspace/health/metrics are live before harness preflight.
7. `ssh -o BatchMode=yes toki@toki-labs.com 'IFS= read -r ANTHROPIC_API_KEY; export ANTHROPIC_API_KEY; cd /Users/toki/agent-work/iop-s12-validation-20260808/source; exec ./scripts/e2e-single-request-claude.sh --preflight-only --claude /opt/homebrew/bin/claude --runtime-evidence build/s12/runtime/runtime-evidence.json --base-url http://127.0.0.1:18083/v1 --model iop-single-request-light --edge-bin build/s12/bin/iop-edge --node-bin build/s12/bin/iop-node-darwin-arm64 --edge-config build/s12/runtime/edge.yaml --observation-file build/s12/runtime/edge.log --metrics-url http://127.0.0.1:19101/metrics --workspace /Users/toki/agent-work/iop-s12-validation-20260808/workspace --output agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json --secret-env ANTHROPIC_API_KEY' < /config/workspace/iop/token/.claude` — exits zero without invoking Claude or exposing the API key.
8. `ssh -o BatchMode=yes toki@toki-labs.com 'IFS= read -r ANTHROPIC_API_KEY; export ANTHROPIC_API_KEY; cd /Users/toki/agent-work/iop-s12-validation-20260808/source; exec ./scripts/e2e-single-request-claude.sh --run --claude /opt/homebrew/bin/claude --runtime-evidence build/s12/runtime/runtime-evidence.json --base-url http://127.0.0.1:18083/v1 --model iop-single-request-light --edge-bin build/s12/bin/iop-edge --node-bin build/s12/bin/iop-node-darwin-arm64 --edge-config build/s12/runtime/edge.yaml --observation-file build/s12/runtime/edge.log --metrics-url http://127.0.0.1:19101/metrics --workspace /Users/toki/agent-work/iop-s12-validation-20260808/workspace --output agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json --secret-env ANTHROPIC_API_KEY' < /config/workspace/iop/token/.claude` — exactly one Claude child produces one atomic remote manifest; never rerun automatically.
9. `bash -c 'set -euo pipefail; mkdir -p agent-test/evidence/iop-owned-single-request-agent-execution; tmp="$(mktemp agent-test/evidence/iop-owned-single-request-agent-execution/.claude-smoke-evidence.XXXXXX)"; trap '\''unlink "$tmp" 2>/dev/null || true'\'' EXIT; scp -q toki@toki-labs.com:/Users/toki/agent-work/iop-s12-validation-20260808/source/agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json "$tmp"; ./scripts/e2e-single-request-claude.sh --validate-manifest "$tmp"; test ! -e agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; mv "$tmp" agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; trap - EXIT; ./scripts/e2e-single-request-claude.sh --validate-manifest agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json'` — only validated redacted evidence is atomically published locally.
10. `rg --sort path -n 'fixed to "darwin"|fixed Darwin|Mac Node|Actual Claude/Mac|workspace_os.*const.*darwin' --glob '!agent-task/archive/**' --glob '!agent-roadmap/archive/**' --glob '!agent-task/**/plan_*.log' --glob '!agent-task/**/code_review_*.log' --glob '!agent-task/**/user_review_*.log' agent-contract agent-spec agent-test configs packages apps scripts` — output contains only intentional historical labels, platform-specific build/fixture names, or selected-runner facts documented in review; no normative Mac-only workspace claim remains.
11. `rg --sort path -n 'agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json|S12|claude-smoke|ingress|Gemini|gemini|ornith-fast|Plan|Work|Review|stage|total|terminal|workspace|node_digest|node_version_digest|qualified' agent-contract/outer/anthropic-compatible-api.md agent-spec/runtime/edge-node-execution.md agent-spec/input/openai-compatible-surface.md agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json` — bounded docs and manifest agree on one qualified run and selected Node identity.
12. `git diff --check` — no whitespace errors.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
