<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=26 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Remove Claude title ingress and admit standard provider usage before the ninth qualification

## For the Implementing Agent

Resolve R23/R24 with strict provider-free evidence, rebuild the disposable Edge, rerun all readiness gates, then use the user's continuing task-scoped authorization for exactly one ninth guarded Claude-through-IOP call. Claude calls only IOP; all Gemini/Ornith routes and credentials remain internal. Never reuse the eighth guard or retry a failed invocation.

## Background

`sole-live-8.rc-69` is consumed. Correct structured logs prove two simultaneous retry-count-zero requests, both failing Plan as malformed. Provider-free capture identifies one as Claude's generated session title and one as the actual task. Installed code gates title generation with `CLAUDE_CODE_DISABLE_TERMINAL_TITLE`. Separately, the private stage response decoder's exact top-level allowlist omits standard Chat Completions `usage`; real provider envelopes elsewhere in this repository include it while `successBody` does not.

## Finding Resolution Map

| Finding | Resolution | Acceptance evidence |
|---|---|---|
| R23 | Add typed/bounded ignored standard `usage` to the private provider response envelope | Success fixture includes usage; standard usage passes; duplicate/unknown top-level still rejected |
| R24 | Force `CLAUDE_CODE_DISABLE_TERMINAL_TITLE=1` only in the supervised child | Opposing parent fake test and delayed installed-CLI local capture show one task request, zero title request |
| R25 | Sync/rebuild/restart, fresh gates, and one ninth guard | Exact candidate identity, ingress 1, full ordered stages/workspace/terminal, schema-valid publication |

## Scope and Safety

- Modify only the existing private single-request provider codec/tests, harness, and matching project contract/spec/test documentation.
- Standard `usage` is validated as a bounded known object and discarded; it grants no routing, credential, workspace, tool, or result authority.
- Title disabling changes only harness-child behavior. Parent/user Claude configuration is untouched.
- Canonical `/Users/toki/agent-work/iop-dev` remains read-only. Use isolated source and disposable managed runtime only.

## Implementation Checklist

- [x] Add standard `usage` envelope support with strict negative tests.
- [x] Add child-only terminal-title disable with opposing-parent fake coverage.
- [x] Prove installed Claude emits one retry-zero tool-bearing request and no title request against a local delayed fake.
- [x] Update matching project contract/spec/dev-test text and run local ordinary/race/harness/diff checks.
- [x] Sync exact changed files to isolated dev, run remote tests, rebuild/restart Edge, and atomically refresh runtime evidence.
- [x] Pass TLS/fleet/catalog/count-token/structured-log/preflight/cardinality gates with eight finalized guards and no artifacts.
- [x] Create `sole-live-9.started`, invoke the harness exactly once, finalize `sole-live-9.rc-N`, and never retry.
- [x] Publish manifest and S12 completion owners only on full schema-valid success; otherwise retain closed evidence and continue after diagnosis.
- [x] Fill implementation-owned review sections and stop for official review.

## Final Verification

1. Strict response decoder accepts only the known provider bookkeeping addition and still rejects unknown/duplicate structure.
2. Provider-free installed CLI capture reports exactly one actual Messages request with retry count zero.
3. Rebuilt managed Edge identity and `edge-runtime.log` are bound into fresh runtime evidence; ingress remains zero through preflight.
4. The ninth run qualifies only if ingress delta is 1 and Plan -> Work -> Review, workspace verification/cleanup, terminal, manifest schema, and privacy all pass.
