<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=26 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - Provider usage and Claude title cardinality repair

> **[IMPLEMENTING AGENT — READ FIRST]** Complete R23-R25, fill implementation evidence, and stop. Do not reuse a guard, retry, call providers directly, or publish partial success.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=26, tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_25.log` / `code_review_cloud_G10_25.log`; verdict `FAIL`, Required R23-R25.
- Eight prior guards are immutable. Correct structured evidence closes the eighth failure at Plan with two concurrent retry-zero requests.

## Implementation Item Completion

| Item | Status |
|---|---|
| provider-usage | [x] |
| title-cardinality | [x] |
| local-remote-validation | [x] |
| ninth-call | [x] |
| publication | [x] |

## Implementation Checklist

- [x] Add and test bounded standard provider `usage` acceptance.
- [x] Add and test child-only terminal-title disabling.
- [x] Prove one installed-CLI request against a provider-free delayed fake.
- [x] Update project docs and pass local/remote ordinary/race/harness checks.
- [x] Rebuild/restart disposable Edge and refresh runtime identity/readiness.
- [x] Execute/finalize exactly one ninth guard with no retry.
- [x] Publish only complete schema-valid S12 evidence.
- [x] Fill implementation-owned fields and stop for official review.

## Review-Only Checklist

- [ ] Append one verdict and verified routing signals.
- [ ] Verify R23-R25, cardinality, privacy, and S12 evidence/publication.
- [ ] Archive the pair and materialize the correct next state.

## Deviations from Plan

- Adding standard `usage` to the shared success fixture exposed that the Work and Review private provider envelopes had separate exact top-level allowlists. The same typed usage object was added to all three stage envelopes, and the full executor tests then passed.
- The first focused race run exposed a deterministic test-order defect: `TestSingleRequestArtifactLifecycle` acknowledged finalization before asynchronous workspace cleanup completed. Production correctly rejected the early acknowledgement. The test now uses the existing cleanup waiter; the exact case passed 10 race iterations and the fresh full race set passed.
- The ninth invocation reached exactly one ingress but still failed Plan as `malformed`; no Work/Review/result/manifest was produced.

## Key Design Decisions

- The standard `usage` object is typed, non-negative, bounded by the existing response limit, limited to known token/detail members, and discarded. Plan/Work/Review share this exact bookkeeping type.
- `CLAUDE_CODE_DISABLE_TERMINAL_TITLE=1` is scoped beside the existing child-only retry and beta controls. Provider-free delayed capture proves it removes the title JSON-Schema request without mutating parent/user settings.
- The ninth guard is consumed as `sole-live-9.rc-69`. Correct cardinality is now proven independently of successful stage decoding.
- Plan and Review intentionally use `reasoning_effort=high`. Existing Gemini/OpenAI-compatible response paths and repository fixtures recognize `reasoning_content`, but the private Plan message decoder permits only role/content/tool calls. The unretained standard reasoning member is now the strongest closed explanation for the remaining pre-content `malformed` result.

## Verification Results

- Local ordinary packages passed (`8.377s`, `8.214s`); the repaired artifact lifecycle passed 10 race iterations and focused race packages passed (`1.822s`, `3.361s`). Harness self-test and diff checks passed.
- Remote ordinary packages passed (`8.783s`, `9.122s`), artifact lifecycle passed 10 race iterations (`1.585s`), focused race packages passed (`2.607s`, `3.646s`), and harness self-test passed.
- Installed Claude provider-free delayed capture with terminal titles disabled produced exactly one request: retry-count `0`, thinking present, three tools, no title schema.
- Disposable Edge rebuilt to `sha256:6e05049e5f45a339cd5f33bd36866b68e7bae6a6ebbccb85e7c57f8347bf10b7`, restarted as PID `8823`, and reconnected to CP/Node. Runtime evidence atomically refreshed for source/Edge/version/config-check identities.
- Final provider-free readiness: wrong observation blocked 69, frozen count-token 200, unsupported neighbor 400, ingress `0 -> 0`, eight finalized guards, no started guard/artifact, and positive structured-log preflight.
- Ninth execution: one harness invocation, wrapper retry 0, child retry 0/title disabled, guard `sole-live-9.rc-69`, ingress `0 -> 1`, provider tunnel delta 1, Claude `0 -> 0`, no result/manifest. Structured evidence is request success, Plan error/validation after `4287ms`, cleanup success, terminal error/validation at `4288ms`, and one `malformed` HTTP 502 rejection.

---

> Implementer: fill every implementation-owned field, then stop for official review.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Fail | R23/R24 are closed and ingress is exactly one, but Plan still rejects the provider message envelope as malformed. |
| Completeness | Fail | Work, Review, workspace result, successful terminal, and manifest are absent. |
| Test coverage | Pass | All local/remote ordinary/race/self-tests, installed-client cardinality capture, rebuild/readiness, guard/process/log checks pass. |
| API contract | Fail | The private stage message allowlist omits the standard private `reasoning_content` member used by high-reasoning OpenAI-compatible responses. |
| Code quality | Pass | Usage is typed/discarded and title control is child-scoped; the unrelated test race now waits on the production cleanup contract. |
| Implementation deviation | Pass | Discovered stage allowlists and test ordering were repaired and reverified before the sole live call. |
| Verification trust | Pass | One correct structured log, one ingress, one provider tunnel, one terminal rejection, guard/process/artifact state all agree. |
| Spec conformance | Fail | S12 still lacks the successful ordered stage/workspace/terminal evidence. |

### Findings

- Required R26 — `apps/edge/internal/openai/single_request_provider_stage.go:252`: add a typed optional `reasoning_content` string to the private Chat message envelope and the Work/Review equivalents, validate the exact field name/type, and discard it from stage output/artifacts. Put reasoning content in shared success/tool fixtures so Plan, Work, Review, and executor tests prove it cannot leak; unknown message members remain rejected.
- Required R27 — rebuild/restart the disposable Edge, refresh runtime evidence, repeat provider-free gates, and use continuing task-scoped authorization for a distinct `sole-live-10` invocation. Preserve title/retry suppression and one-ingress requirement; never reuse the ninth guard or call a provider directly.

### Routing Signals

- `evaluation_mode=isolated-reassessment`
- `verdict=FAIL`
- `review_rework_count=25`
- `evidence_integrity_failure=false`
- `next_state=plan`
- `finalizer=finalize-task-policy.sh`
- `finalizer_mode=pair`
- build route `worker/cloud/G10`; review route `review/cloud/G10`
