<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=35 tag=REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - completion eligibility and mandatory repair

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=35

## Implementation Item Completion

| Item | Status |
|---|---|
| work-completion-eligibility | [x] |
| review-mandatory-repair | [x] |
| disposable-guard-18 | [x] PASS |

## Implementation Checklist

- [x] Work request mode and runtime both enforce successful-tool completion eligibility.
- [x] Initial/missing Work requests cannot be diverted into response-format completion.
- [x] Review requires and validates repair after exact `not_found` before accepting pass.
- [x] Exact request-mode, provider-noncompliance, positive coordinator, and negative coordinator tests pass.
- [x] Fresh local/remote tests, race, harness self-test, and builds pass.
- [x] Exactly one guard 18 is finalized with no retry and complete success/closed failure evidence is validated.
- [x] All implementation-owned evidence is filled.

## Review-Only Checklist

- [x] Append one verdict and routing signals.
- [x] Verify scope, tests, identities, credential boundary, guard cardinality, exact bytes, manifest, and evidence integrity.
- [x] Archive suffix 35 and materialize the verdict's next state.
- [x] On PASS write `complete.log`, archive the task, and preserve milestone task ids without direct roadmap mutation.

## Deviations from Plan

- The first full OpenAI package run exposed four executor fixtures that returned an immediate Work completion. They were updated to perform one successful workspace read before completing, preserving their intended pass/inspection/repair/provenance assertions. The subsequent package, race, and full Edge runs passed.
- No runtime, credential, provider, route, config, canonical dev, or harness deviation occurred.

## Key Design Decisions

- Work carries an explicit server-owned completion-eligibility bit. Tool-required bodies omit `response_format`; only a successful tool result enables `auto` and the exact completion schema. A provider completion while ineligible is rejected even if the provider ignores `tool_choice`.
- Review carries an explicit repair-required bit. Exact `not_found` sets it; pass and inspection are rejected, the next body requires a tool, and only a successful non-inspection repair clears it.
- These state variables are derived only from quality-gated internal tool results, not provider text or user options.

## Verification Results

### Local Go and build

Formatting and diff check PASS. Focused mode/noncompliance/coordinator tests PASS (`0.036s`). After correcting the integration fixtures, OpenAI package PASS (`8.554s`), focused race PASS (`1.092s`), all Edge packages PASS, and `make build-edge` PASS.

### Harness self-test

Local and isolated remote `./scripts/e2e-single-request-claude.sh --self-test` PASS without harness changes.

### Remote rebuild and provider-free gates

Exact synchronized digests: Work source `0dda64b6513619a59d89ca12dfad25522c033b5635995fe0bc477652d038d90b`; Work test `337579a33177ebd08f0ee137fda1b95981c48ac42ce6db8b820277d3df6b6d3b`; Review source `1aa02ab5b7f41f08224705773d36ab42628c86f70fffadb2c9627f7b83f6b046`; Review test `129d48e16e158955d16ef63c01d598343ecd8b286d032b289ea0d2f1a50f5848`; executor test `e418f825ea5da1b83efe657171dafa99fc3c50d90d71e4bb6a9c376a881a9b2b`.

Remote focused (`0.606s`), package (`8.633s`), race (`1.695s`), all Edge packages, Darwin arm64 build (`2.68s`), and harness self-test PASS. Runtime identities: worktree `sha256:f69d007378ccd10249d95385980c10820fb6e1f78843a26172356dd2cac75df8`; Edge `sha256:2d7ace01d9c820a62883604296f498f59b52d8231f4759295d559fa764ca1845`; isolated Control Plane PID 89925, Edge PID 16600, Node PID 89945. Other runtime/config/binding identities remained unchanged.

Provider-free preflight PASS with ingress `0 -> 0`, provider tunnels `25 -> 25`, Claude processes 0, seventeen finalized guards, zero started guards, empty workspace, absent manifest, and 4666 TLS seconds.

### Sole live guard 18

Exactly one `sole-live-18` finalized successfully with no retry:

```text
[single-request-claude-smoke] run manifest validated and written (redacted evidence only)
SOLE_LIVE_18_RC=0
INGRESS=0->1
PROVIDER_TUNNELS=25->30
CLAUDE_PROCESSES=0->0
FINAL_GUARD=sole-live-18.rc-0
WORKSPACE_RESULT=present MANIFEST=present
```

Correlation `sr-149b7d8c2060558e11cf06a356f3642b`: Plan success 4647 ms; Work `workspace_write` success and stage success 2036 ms with tool count 1; Review `workspace_read` success and stage success 4949 ms with tool count 1; cleanup success 3 ms; exactly one successful `end_turn` terminal in 11661 ms with result.

Canonical Work logs prove the enforced mode transition: run `req.manual-1786199101204381000` emitted exactly one `workspace_write` and no content; resumed run `req.manual-1786199102383529000` emitted the structured completion with zero tool calls. Managed Node records the write, Review read, and cleanup under `ws-357dceee2d1e8d2ae3dca9b2`.

Independent result verification: exact expected bytes including LF, 42 bytes, one line, last byte `0a`, SHA-256 `a35f0e4ed7ffe237d87c5af56e896db839ddb1f12fcc6afbd18c75e63dd9f57c`. The manifest independently validates against the closed schema; SHA-256 `9ea7c4b2970e7e40dcb1c936746d2dbe779b09ed3da53e27c815ef79135dc2c6`, stage engines `[gemini, ornith-fast, gemini]`, ingress delta 1, workspace changed, verifier exit 0, and forbidden key/match counts both 0. Eighteen finalized guards exist, zero started guards remain, and Claude process count is zero.

## Reviewer Checkpoints

- Provider noncompliance cannot create a zero-tool Work success.
- Completion schema remains exact and server-owned whenever emitted.
- Review cannot pass or inspect again while a missing artifact still requires repair.
- Seventeen prior guards precede one guard 18, and PASS meets every S12 manifest condition.

## Section Ownership

Implementation sections belong to the implementing agent; Review-Only Checklist and Code Review Result belong to the official reviewer.

## Code Review Result

### Overall Verdict

PASS

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Pass | Provider noncompliance cannot bypass Work execution; the live path performed write, Review read, cleanup, and one successful terminal. |
| Completeness | Pass | Exact result bytes and the schema-valid redacted S12 manifest are published. |
| Test coverage | Pass | Exact request modes, provider violation, mandatory-repair positive/negative coordinator paths, package, race, full Edge, and harness gates pass locally and remotely. |
| API contract | Pass | Tool/completion authority is server-owned, strict output remains closed, and repair-required state is not provider-controlled. |
| Code quality | Pass | State is explicit and derived only from quality-gated results; prior guards remain intact. |
| Implementation deviation | Pass | Fixture corrections align tests with the strengthened production invariant and all final runs are fresh. |
| Verification trust | Pass | Runtime identities, guard cardinality, model/tunnel logs, exact bytes, observations, and manifest mutually agree. |

### Findings

- No required finding remains.

### Routing Signals

- `evaluation_mode=isolated-reassessment`
- `verdict=PASS`
- `review_rework_count=33`
- `evidence_integrity_failure=false`
- `next_state=complete`
- `finalizer=finalize-task-policy.sh`
- `finalizer_mode=pair`

### Next Step

- Archive suffix 35, write `complete.log` from the exact plan header with `milestone-task=workspace-binding,claude-smoke`, archive this completed task, and reconcile milestone workstate through the managed sync workflow.
