<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=12 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Provision a disposable managed IOP runtime and execute S12

## For the Implementing Agent

Build a separate managed Control Plane/Edge/Node stack from the reviewed candidate source. Use remote SOPS `tokens.toki-dev-cline` only as Claude Code -> IOP caller authentication, migrate the already configured Gemini provider secret into an IOP credential slot, and keep Gemini/Ornith/Claude routing inside IOP. Do not change or stop the canonical dev processes. The existing one-call authorization remains conditional: run Claude exactly once only after the managed model catalog is admitted with zero children and unchanged ingress. Fill implementation-owned review sections before official review.

## Background

Plan 11 proved the selected SOPS caller token authenticates, but the running legacy Edge intentionally suppresses marked `single_request` presets. Source confirms managed principal projection is mandatory. The current dev Control Plane database has no credential-plane schema/state, so a process restart or one-field toggle cannot repair it. The user has already decided that all providers, including Gemini, are IOP-owned and that testing runs in the remote dev environment.

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_11.log` / `code_review_cloud_G10_11.log`; verdict `FAIL`, `review_rework_count=10`, `evidence_integrity_failure=false`.
- Valid caller source: `/Users/toki/.config/iop/secrets/dev-openai-toki.sops.yaml`, key `tokens.toki-dev-cline`, decrypted with the configured AGE key only in process memory.
- Candidate source: `/Users/toki/agent-work/iop-s12-validation-20260808/source`; script digest `d19874140ee53985e9c13acdc9730190cc1975495a7222b7bbd6b17608ef0092`; worktree digest `sha256:a759f41c83a1573eb2c52856f991093128b556733d2c3bc240fef1443db2e598`.
- Existing legacy S12 state remains ingress 0 with no result/manifest. The authorized live call was not started.

## Analysis

### SDD Criteria

SDD S12 requires one real Claude Code request through the IOP Anthropic surface, one ingress, ordered Gemini plan -> Ornith-fast work -> Gemini review/repair, bounded Node workspace operations, a changed verified workspace, one terminal, and redacted timing evidence. Managed route resolution must authorize exactly one projected route for each canonical stage model before the virtual preset is advertised.

### Verification Context

- `apps/edge/internal/openai/principal_routes.go` resolves a marked virtual preset only when every canonical stage reference has exactly one principal-projected managed route.
- `apps/edge/internal/openai/route_resolution.go` and `single_request_preset_binding.go` intentionally reject the same marked preset in unmanaged mode.
- `scripts/e2e-credential-slot-smoke.sh` already provides fresh CP/Edge/Node builds, CA/cert/key material, managed TLS configuration, principal/slot/route projection, and secret-leak checks. Reuse its generated material instead of inventing crypto/bootstrap files.
- Candidate `build/s12/runtime/edge.yaml` already owns the S12 model/preset/workspace and legacy Gemini provider declaration. The managed derivative removes static headers and projects the provider secret through the Control Plane.
- The dev inventory declares `mac-gemini-api` and `rtx5090-lemonade`; the managed disposable Node may host both provider resource definitions while calling their already declared endpoints. Canonical dev nodes/processes stay untouched.
- Cached test output is not accepted. Every gate in this packet is fresh.

### Safety Boundary

- Managed runtime root: `/Users/toki/agent-work/iop-s12-managed-validation-20260808` on distinct loopback ports.
- Canonical `/Users/toki/agent-work/iop-dev` processes/config/database are read-only.
- SOPS caller plaintext, legacy Gemini secret, generated slot material, private keys, raw captures, and provider response bodies must not appear in argv, logs, review text, or tracked files.
- A disposable database may persist only token digests and encrypted slot ciphertext. Provider secret transfer is memory-only.
- No direct Gemini, Ornith, or Claude provider request is allowed. The only real generation call is the conditional S12 Claude request through IOP.

## Finding Resolution Map

| Finding | Resolution | Completion evidence |
|---|---|---|
| R4 | Replace the legacy admission boundary with a disposable managed principal projection while preserving the exact SOPS caller token. | Authenticated managed catalog contains exactly one `iop-single-request-light`; unchanged ingress and zero Claude children. |
| R5 | Build isolated managed CP/Edge/Node configs, TLS/key material, provider slots, and canonical stage routes from existing declarations. | Fresh binaries/config checks, mTLS readiness, projected Gemini/Ornith routes, connected Node provider/workspace snapshot, no static credential fields. |
| S12 | Execute the previously authorized sole live call after all closed gates pass. | Schema-valid redacted manifest proving ingress delta 1, ordered stages, workspace verification, cleanup, and one terminal. |

## Dependencies and Execution Order

1. Complete all local no-provider gates and build the remote managed material/binaries without touching canonical processes.
2. Materialize/config-check the disposable CP/Edge/Node stack and enroll the selected SOPS caller plus IOP-owned provider slots/routes.
3. Start CP -> Edge -> Node, prove mTLS/projection/runtime identity, and pass authenticated zero-child catalog admission with unchanged ingress.
4. Only then execute one `--run`; capture `live_rc` and never retry.
5. On manifest PASS only, publish evidence and synchronize the three qualification owners.
6. Fill the active review and stop for official review.

## Plan Items

### 1. MANAGED-RUNTIME-1 — materialize an isolated managed stack

**Problem:** the running dev stack is legacy and cannot advertise marked S12 presets; changing it in place would disturb unrelated dev traffic.

**Solution:** run the existing deterministic credential-slot smoke against the candidate to generate and validate fresh binaries plus TLS/issuer/recipient/keyring material. Copy only required outputs into the fixed managed runtime root. Derive CP/Edge/Node configs from the candidate S12 config, use distinct loopback ports, keep only one local managed Node, move the existing Gemini and Ornith-fast resource definitions onto it, retain the approved workspace capability, and remove all legacy/static auth fields.

Before (`build/s12/runtime/edge.yaml`):

```yaml
credential_plane: disabled/absent
openai:
  principal_tokens: <legacy mappings>
nodes:
  - id: mac-codex-node
    providers: [mac-gemini-api]
  - id: rtx5090-lemonade-node
    providers: [rtx5090-lemonade]
```

After (disposable managed config):

```yaml
credential_plane:
  enabled: true
control_plane:
  enabled: true
tls: <managed mTLS material>
openai:
  tls: <managed HTTPS material>
nodes:
  - id: node-smoke
    providers: [mac-gemini-api, rtx5090-lemonade]
    workspaces: [ws-iop-s12-validation-20260808]
```

**Modified Files and Checklist:**

- [ ] Remote-only managed runtime material/config/binaries under the fixed disposable root.
- [ ] No canonical process/config/database changes.
- [ ] Fresh `config check` and secret-field structural scan pass.

**Test Strategy:** reuse the full deterministic managed credential smoke, then run all three built binaries' config/startup gates. No external provider generation occurs.

**Verification:** deterministic smoke returns `result=success`; distinct ports are free; all managed configs pass; canonical PID/listener identities are unchanged.

### 2. MANAGED-PROJECTION-2 — enroll the exact caller and provider routes

**Problem:** host-local bootstrap only generates a new random token, while the user selected the existing SOPS `toki-dev-cline` caller. The legacy Gemini key must also leave static Edge headers and become a managed provider slot.

**Solution:** initialize one disposable principal with the supported offline bootstrap, immediately discard its generated raw token, then atomically replace only that disposable token digest/ref with the in-memory digest of SOPS `toki-dev-cline` and bump projection generation. Start CP and use in-memory HTTPS operations to create a Gemini bearer slot/route from the existing configured provider secret. Create a separate generated bearer slot for the unauthenticated local Ornith endpoint and bind it to the existing `openai` profile/resource selector. Persist only encrypted slot ciphertext and token digests.

Before:

```text
principal projection: absent
gemini provider auth: static legacy header
ornith-fast managed route: absent
```

After:

```text
one active principal token digest == in-memory SOPS caller digest
one gemini/bearer -> gemini route -> mac-gemini-api
one vllm/bearer -> openai route -> rtx5090-lemonade
no static provider/caller secret in managed YAML
```

**Modified Files and Checklist:**

- [ ] Disposable SQLite principal/token/slot/route state only.
- [ ] Caller and provider plaintext never printed, placed in argv, or persisted unencrypted.
- [ ] Projection generation increases and each canonical stage model resolves exactly once.

**Test Strategy:** inspect only counts/status/aliases and constant-time match booleans; scan configs/logs/database for known plaintext values without emitting them.

**Verification:** one principal, two active slots, two active routes, encrypted ciphertext rows only, and zero plaintext matches.

### 3. MANAGED-PREFLIGHT-3 — prove runtime identity and zero-child admission

**Problem:** the sole live call must not be consumed until the exact managed runtime can authenticate the chosen caller and advertise the marked virtual model.

**Solution:** start CP, Edge, and Node in order; require process/binary/config identities, mTLS listeners, Edge enrollment, Node connection, both provider resource snapshots, workspace ref, route projection, and exact catalog membership. Run the repaired Claude harness with a fresh config and SOPS caller under `--preflight-only`; require no Claude child, unchanged ingress 0, absent result/manifest, and cleanup.

**Modified Files and Checklist:**

- [ ] Remote runtime evidence updated to the managed PID/config/binary identities.
- [ ] Exact selected model count is one for the authenticated caller.
- [ ] Ingress/result/manifest/child/temp-config state is unchanged/absent.

**Test Strategy:** provider-free HTTPS/catalog/runtime inspection plus the existing zero-child harness gate.

**Verification:** authenticated catalog HTTP 200 includes exactly one selected model; preflight exits 0; ingress remains 0.

### 4. SOLE-LIVE-S12-4 — execute the authorized S12 request once

**Problem:** S12 has no accepted real request evidence.

**Solution:** with a second fresh Claude config, decrypt only SOPS `toki-dev-cline` into the remote process environment and execute the repaired harness `--run` exactly once. Capture `live_rc`, unset/clean immediately, and never retry regardless of outcome.

**Modified Files and Checklist:**

- [ ] Exactly one live Claude child and one Edge ingress.
- [ ] No direct provider command or endpoint substitution.
- [ ] Remote manifest exists only when every closed assertion passes.

**Test Strategy:** this is the required full-cycle S12 verification; it is not replaceable by mocks or generic provider smoke.

**Verification:** `live_rc=0`, ingress delta 1, ordered Gemini -> Ornith-fast -> Gemini stages, bounded tools, changed verified workspace, cleanup, and terminal count 1.

### 5. EVIDENCE-DOC-SYNC-5 — publish only closed success evidence

**Problem:** qualification owners must not claim a runtime result until the redacted manifest is valid and identical locally/remotely.

**Solution:** on live PASS only, validate the remote manifest against the existing schema, copy it atomically, verify identical SHA-256, and add bounded S12 wording to the Anthropic contract plus input/runtime specs. On failure, write none of these success-only files.

**Modified Files and Checklist:**

- [ ] `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json`
- [ ] `agent-contract/outer/anthropic-compatible-api.md`
- [ ] `agent-spec/runtime/edge-node-execution.md`
- [ ] `agent-spec/input/openai-compatible-surface.md`

**Test Strategy:** JSON Schema validation, exact hash equality, redaction scans, bounded wording assertions, and `git diff --check`.

**Verification:** schema and redaction checks pass; only the four success-owned files change.

### 6. REVIEW-EVIDENCE-6 — record actual evidence

**Problem:** official review needs exact command outcomes and any deviation without secrets/raw responses.

**Solution:** fill every implementation-owned section in `CODE_REVIEW-cloud-G10.md`, including process identities, counts, safe status lines, live-call cardinality, and success/failure boundaries.

**Modified Files and Checklist:**

- [ ] `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md`

**Test Strategy:** verify review text contains no secret, raw provider body, private key, or unresolved placeholder.

**Verification:** implementation table/checklist/evidence are complete and safe.

## Implementation Checklist

- [ ] Materialize and config-check a fresh isolated managed stack.
- [ ] Enroll the exact SOPS caller and create projected Gemini/Ornith routes without disclosure.
- [ ] Pass managed runtime identity and authenticated zero-child admission gates.
- [ ] Execute the authorized S12 live call exactly once with no retry.
- [ ] On PASS only, publish the manifest and bounded contract/spec wording.
- [ ] Fill implementation-owned review evidence.

## Modified Files Summary

| File | Reason |
|---|---|
| `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json` | Success-only redacted S12 manifest |
| `agent-contract/outer/anthropic-compatible-api.md` | Success-only bounded qualification statement |
| `agent-spec/runtime/edge-node-execution.md` | Success-only runtime evidence link |
| `agent-spec/input/openai-compatible-surface.md` | Success-only input evidence link |
| `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md` | Managed runtime and S12 evidence |

## Final Verification

1. Local: `bash -n scripts/e2e-single-request-claude.sh scripts/e2e-credential-slot-smoke.sh`; both deterministic self-tests; focused Edge races; source assertions; `git diff --check`.
2. Remote build/material: run fresh deterministic `scripts/e2e-credential-slot-smoke.sh` with retained temp material and require its sanitized `result=success` record.
3. Remote managed config: build exact candidate CP/Edge/Node binaries; run every config check; assert distinct free ports, managed switches/TLS paths, zero static auth, exact model/preset/workspace/provider definitions, and unchanged canonical PID/listeners.
4. Remote projection: seed only the selected SOPS caller digest in the disposable DB; create two encrypted slots/routes through CP HTTPS; require one principal/two slots/two routes and no known plaintext in managed YAML/log/DB.
5. Remote preflight: require CP/Edge/Node mTLS readiness, connected `node-smoke`, both provider resources, exact workspace, selected model catalog count 1, harness `--preflight-only` exit 0, ingress 0, no child/result/manifest/temp config.
6. Remote live: in a new config execute harness `--run` once, save `live_rc`, never retry, clean/unset, and require the closed manifest.
7. Success-only: validate/copy manifest atomically, compare SHA-256, update only the three owners, and run JSON Schema/redaction/document/hygiene checks.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-cloud-G10.md`.

## Final Routing

- `evaluation_mode=isolated-reassessment`
- `finalizer=finalize-task-policy.sh`, `finalizer_mode=pair`
- build closures: scope/context/verification/evidence/ownership/decision all true
- build scores: `2/2/2/2/2` => `G10`; `base_route_basis=grade-boundary`
- `large_indivisible_context=true`; matched risks: `temporal_state`, `concurrent_consistency`, `boundary_contract`, `variant_product`; count 4
- `review_rework_count=10`, `evidence_integrity_failure=false`; risk/recovery boundaries matched without replacing grade basis
- build: `worker/cloud/G10`, `PLAN-cloud-G10.md`
- review scores: `2/2/2/2/2` => `review/cloud/G10`, `CODE_REVIEW-cloud-G10.md`
