<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=31 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Admit canonical IOP llama.cpp diagnostics and prepare the fourteenth guard

## For the Implementing Agent

Resolve R30 exactly as scoped, run every provider-free verification, and fill all implementation-owned sections of `CODE_REVIEW-cloud-G10.md` with actual output. Keep the active pair in place and report ready for official review. Do not append a verdict, archive files, write `complete.log`, create a user-review state, or invoke a model if any provider-free gate fails. After all gates pass, execute exactly one `sole-live-14` Claude-through-IOP run with no retry.

## Background

`sole-live-13` proved the loopback IOP route works: Plan succeeded and canonical IOP obtained a successful 1168-byte llama.cpp response containing one `workspace_write` call. The isolated Work codec rejected the response before executing that call because its top-level allowlist excludes llama.cpp's bounded diagnostic fields `system_fingerprint` and `timings`. The next change admits and discards only those exact names while preserving every authority-bearing Work validation rule.

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_30.log` / `code_review_cloud_G10_30.log`; verdict `FAIL`, Required R30, `review_rework_count=29`, `evidence_integrity_failure=false`.
- `sole-live-13.rc-69` is immutable: ingress `0 -> 1`, provider tunnels `10 -> 12`, Plan success 1, Work validation error 1, cleanup success 1, terminal validation error 1, no result/manifest, and no retry.
- Canonical IOP correlation `req.manual-1786192088899580000` selected `ornith-fast`/`rtx5090-lemonade`, received a 1168-byte response, logged one `workspace_write` tool call, and committed terminal success. Canonical IOP preserves provider bytes; llama.cpp emits top-level `system_fingerprint` and `timings` in Chat Completions responses.

## Finding Resolution Map

| Finding | Mode | Exact resolution | Changed precondition and acceptance evidence |
|---|---|---|---|
| R30 | direct-fix | Extend only the Work envelope field allowlist in `apps/edge/internal/openai/single_request_work_stage.go` with `system_fingerprint` and `timings`, discard both, and add exact accept/reject regression cases in `apps/edge/internal/openai/single_request_work_stage_test.go` | Live 13 reached Ornith and returned a valid tool call but failed before tool execution. Unit evidence must prove both canonical fields pass without retention while any other top-level field still fails; live evidence still requires one complete S12 result. |

## Analysis

### Files Read

- `apps/edge/internal/openai/single_request_work_stage.go`
- `apps/edge/internal/openai/single_request_work_stage_test.go`
- `agent-test/dev/rules.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-owned-single-request-agent-execution.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md`
- `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/plan_cloud_G10_30.log`
- `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/code_review_cloud_G10_30.log`

### SDD Criteria

- SDD: `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md`, status `[승인됨]`, lock released.
- Milestone tasks: `workspace-binding`, `claude-smoke`.
- Target scenarios: S04 keeps workspace authority on the approved IOP Node; S12 requires one actual Claude request with Gemini → ornith-fast → Gemini, exact ingress/terminal cardinality, timing, workspace result, verification, and redacted evidence.
- Evidence Map: S04 fail-closed workspace evidence and S12 actual Claude plus counter/log/workspace before-after evidence determine the rejection regression test and final guarded run.

### Verification Context

- Environment: dev validation via `ssh toki@toki-labs.com`; canonical `/Users/toki/agent-work/iop-dev` remains read-only. Disposable source is `/Users/toki/agent-work/iop-s12-validation-20260808/source`, runtime is `/Users/toki/agent-work/iop-s12-managed-validation-20260808/runtime`, and workspace is `/Users/toki/agent-work/iop-s12-validation-20260808/workspace`.
- Current isolated endpoint is `https://127.0.0.1:18483`; canonical nested IOP is `http://127.0.0.1:18083/v1`; Work route alias is `s12-ornith-iop-route` with upstream `ornith-fast` and selector `rtx5090-lemonade`.
- Source and binary identities must be recomputed after the two-file sync and disposable Edge rebuild. Secret input remains SOPS `tokens.toki-dev-cline`, process memory only.
- External preflight must prove SSH identity, source diff limited to the two files, Homebrew Go, current configs, live PIDs/ports, canonical authenticated `ornith-fast` catalog, CP route, runtime-evidence digests, thirteen finalized guards, zero started guards, zero result/manifest, counters unchanged by preflight, and harness self-test/preflight. Any mismatch blocks guard creation.
- Confidence: high for the codec root cause because canonical IOP logged a successfully assembled tool call and llama.cpp's response construction includes both diagnostic fields; final qualification remains external and must not be inferred from unit tests.

### Test Coverage Gaps

- Existing malformed-response coverage rejects an arbitrary top-level field but has no positive canonical llama.cpp envelope case.
- Existing ordered Work tool-loop coverage remains the behavior regression baseline; add an exact diagnostic-field case without weakening unknown-field, role, finish-reason, tool-count, argument, or completion validation.

### Symbol References

- None; no symbol is renamed or removed.

### Split Judgment

- Keep one plan. The allowlist change, fail-closed regression test, disposable rebuild identity, and one S12 guard form one indivisible compatibility/qualification invariant.

### Scope Rationale

- Do not change generic Plan/Review codecs, canonical dev IOP, llama.cpp/Lemonade, workspace authority, credential semantics, public response schemas, or the harness. R30 is confined to Work response diagnostics and its qualification evidence.

### Final Routing

- `evaluation_mode=isolated-reassessment`; `finalizer=finalize-task-policy.sh`, mode `pair`.
- Build closures: scope/context/verification/evidence/ownership/decision all true. Scores `2/2/2/2/2`, grade G10, base/final basis `grade-boundary`, cloud, `PLAN-cloud-G10.md`.
- Review closures: all true. Scores `2/2/2/2/2`, `official-review`, cloud G10, `CODE_REVIEW-cloud-G10.md`.
- `large_indivisible_context=false`; positive risks: `temporal_state`, `boundary_contract`, `structured_interpretation`; count 3.
- `review_rework_count=29`; `evidence_integrity_failure=false`; recovery boundary true but does not relabel the G10 grade boundary.

## Implementation Checklist

- [x] Admit and discard only Work envelope `system_fingerprint` and `timings`, retaining every existing fail-closed authority check.
- [x] Add canonical accept/discard regression coverage and retain explicit rejection of an unrecognized top-level field.
- [x] Run fresh focused, package, race, and Edge test/build verification.
- [x] Sync only the two changed source files, rebuild/restart the disposable runtime from the current source identity, refresh runtime evidence, and pass every provider-free gate.
- [x] Create/finalize exactly one `sole-live-14` guard around one harness `--run`; validate complete S12 evidence on success or prove no partial publication on failure, with no retry.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_API-1] Admit bounded llama.cpp response diagnostics

**Problem:** `apps/edge/internal/openai/single_request_work_stage.go:331` admits only six top-level fields, so canonical IOP's byte-preserved llama.cpp diagnostics cause a validation failure before a valid Work tool call is decoded.

**Solution:** Add the exact non-authoritative names `system_fingerprint` and `timings` to the envelope allowlist. Do not add them to the retained response struct, branch on their values, or admit any other field.

**Modified Files and Checklist:**

- [x] `apps/edge/internal/openai/single_request_work_stage.go` — extend the exact Work envelope allowlist only.

**Test Strategy:** Regression coverage is required in REVIEW_API-2.

**Verification:** `gofmt -w apps/edge/internal/openai/single_request_work_stage.go apps/edge/internal/openai/single_request_work_stage_test.go`; no formatting diff outside the two files.

### [REVIEW_API-2] Prove accept/discard and fail-closed behavior

**Problem:** `apps/edge/internal/openai/single_request_work_stage_test.go:801` has negative unknown-field coverage but no canonical diagnostic-field success fixture.

**Solution:** Add a deterministic tool-call response containing `system_fingerprint` and a representative `timings` object, prove it decodes into exactly one tool call, and retain the existing `unexpected` rejection. Cover diagnostic values as ignored data, not execution authority.

**Modified Files and Checklist:**

- [x] `apps/edge/internal/openai/single_request_work_stage_test.go` — add canonical positive and preserved negative cases.

**Test Strategy:** Write the regression in this file; assert tool id/name/arguments and no relaxation of arbitrary fields.

**Verification:** `go test ./apps/edge/internal/openai -run 'TestSingleRequestWorkStage(AdmitsCanonicalIOPDiagnostics|RejectsMalformedResponsesAndOptions|DrivesOrderedToolLoop)$' -count=1`; all selected tests pass freshly.

### [REVIEW_API-3] Rebuild disposable Edge and run one final guard

**Problem:** Unit success does not satisfy S12; the changed codec must consume the real nested IOP response and complete workspace write/verification/review in one Claude ingress.

**Solution:** Sync only the two changed files into the disposable source, rebuild the disposable Edge for Darwin arm64, refresh all binary/source/runtime-evidence identities, restart only the disposable fleet components required for the new Edge, then run provider-free gates. Only after they pass, create one `sole-live-14.started`, invoke the harness once, and atomically finalize `sole-live-14.rc-N` without retry.

**Modified Files and Checklist:**

- [x] `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md` — record exact local/remote commands, fixed output, counters, correlations, manifest/result validation, and deviations.

**Test Strategy:** Reuse the existing harness and schema; do not modify them. A non-zero call closes this plan as failure and publishes no partial artifacts.

**Verification:** Provider-free preflight must change neither ingress nor provider-tunnel counts. The sole live call must produce ingress delta 1, ordered Plan/Work/Review success, workspace write plus verifier success, cleanup and one terminal, exact result, and schema-valid redacted manifest.

## Modified Files Summary

| File | Item |
|---|---|
| `apps/edge/internal/openai/single_request_work_stage.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/single_request_work_stage_test.go` | REVIEW_API-2 |
| `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md` | REVIEW_API-3 evidence |

## Final Verification

1. `gofmt -w apps/edge/internal/openai/single_request_work_stage.go apps/edge/internal/openai/single_request_work_stage_test.go`
2. `go test ./apps/edge/internal/openai -run 'TestSingleRequestWorkStage(AdmitsCanonicalIOPDiagnostics|RejectsMalformedResponsesAndOptions|DrivesOrderedToolLoop)$' -count=1`
3. `go test ./apps/edge/internal/openai -count=1`
4. `go test -race ./apps/edge/internal/openai -run 'TestSingleRequestWorkStage(AdmitsCanonicalIOPDiagnostics|RejectsMalformedResponsesAndOptions|DrivesOrderedToolLoop)$' -count=1`
5. `go test ./apps/edge/... -count=1`
6. `make build-edge`
7. On the declared dev runner, prove exact two-file source sync, rebuild the disposable Darwin arm64 Edge, recompute source/binary/config/stage/workspace identities, restart the disposable runtime as needed, and pass config/fleet/catalog/harness preflight without generation.
8. After thirteen finalized guards, zero `.started`, and no artifacts are proven, execute exactly one `sole-live-14` through the harness. Never call Claude, Gemini, or Ornith directly and never retry.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
