<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=5 tag=REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - REVIEW_REVIEW_REVIEW_API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> Execute the plan's selected root cause, scope, files, and dependency decisions as written. Do not choose another owner, narrow/expand the write boundary, or replace a fix with another verification attempt.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=5, tag=REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Immediate prior plan/review: `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/plan_cloud_G09_4.log` and `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/code_review_cloud_G09_4.log`; verdict `FAIL`, `review_rework_count=3`, `evidence_integrity_failure=false`.
- Required R2: `apps/edge/internal/service/single_request_tool_loop.go:137` defers `onToolExit` until after `ContinueInternalTool` at line 220. The first exact race run reported five lifecycle events instead of request/tool/plan/work/review/cleanup/terminal; source inspection confirms resumed envelopes can advance first.
- Accepted prior work remains read-only in this packet: origin-form Claude base validation and exact-route zero-child fixtures in `scripts/e2e-single-request-claude.sh`, plus the dedicated lifecycle registry seam in `apps/edge/internal/service/single_request_metrics.go` and `apps/edge/internal/openai/single_request_handler_test.go`.
- Fresh review evidence: harness syntax/self-test passed; the dedicated-registry OpenAI observation test passed under `-race -count=20`; a focused service lifecycle run passed under `-race -count=100`; and three later full race suites passed. These reruns establish intermittency, not acceptance, because the code ordering remains wrong.
- Fresh read-only SSH preflight passed for `/Users/toki/agent-work/iop-s12-validation-20260808/source`: health 200, `/v1/messages` 401/405, `/v1/v1/messages` 404, ingress 0, writable workspace, and no result or manifest. Candidate Edge PID 25372 and selected Node PID 25114 were alive when reviewed.
- Live Claude authorization remains consumed. Do not run Claude. After repository repair and clean remote preflight, the official reviewer owns the separate `external-execution` gate.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G09.md` → `code_review_cloud_G09_5.log` and `PLAN-cloud-G09.md` → `plan_cloud_G09_5.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, preserve the first-line `milestone-task` metadata in `complete.log` and report it for the runtime aggregation event. Roadmap state evaluation belongs to `sync-milestone-workstate`.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_REVIEW_REVIEW_API-1 | [x] |
| REVIEW_REVIEW_REVIEW_API-2 | [x] |
| REVIEW_REVIEW_REVIEW_API-3 | [x] |

## Implementation Checklist

- [x] Close the tool observation exactly once before continuation can advance resumed stages, preserving failure/cancel and continuation-error terminal classification without holding `h.mu` across external code.
- [x] Add a deterministic synchronous-continuation lifecycle regression and pass all local no-retry race, harness, suite, protobuf-reproducibility, and hygiene gates.
- [x] Refresh only the disposable selected Edge from the two reviewed files, reconcile runtime identity, pass origin-based remote `--preflight-only` with zero Claude children/ingress and no manifest, and retain deferred S12 state.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G09_5.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G09_5.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/` to `agent-task/archive/YYYY/MM/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/` and update this checklist at the final archive path.
- [ ] If PASS and task group is `m-<milestone-slug>`, preserve and report `milestone-task` metadata for runtime aggregation, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove empty active parent `agent-task/m-iop-owned-single-request-agent-execution/` or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

없음. 필수 검증 1~10은 PLAN의 명령과 순서를 그대로 사용했고 실패 재실행은 없었다. 필수 검증 전에 신규 테스트의 컴파일과 단일 동작을 확인하는 비수락용 focused run을 한 번 수행했으며, 이를 아래 acceptance evidence로 대체하지 않았다.

## Key Design Decisions

- `executeInternalWorkspaceTool`의 단일 goroutine에 지역 `toolObserved` guard와 `observeTool` closer를 두었다. 성공 결과의 identity/output budget 검증과 `pendingResultReady` 설정 뒤 `h.mu`를 해제하고 tool success를 명시적으로 관측한 다음 continuation을 호출한다.
- validation/open/wire/timeout/cancel/budget 조기 반환은 기존처럼 deferred closer가 분류된 outcome을 한 번 기록한다. continuation 오류가 발생해도 이미 성공한 workspace tool은 success event 한 번으로 고정되고 request/stage terminal만 `internal_tool_failed`로 전환된다.
- 신규 synchronous executor는 `ContinueInternalTool` 안에서 plan 재개, work, review, finalizing envelope을 반환 전에 직접 제출한다. 성공 사례는 request/tool/plan/work/review/cleanup/terminal 7개와 정확한 시간·count·correlation privacy를, 오류 사례는 성공 tool 1회와 `internal_tool_failed` stage/terminal을 검증한다.
- 원격에는 두 reviewed R2 파일만 overlay했다. 기존 disposable Edge PID 25372를 rollback 사본 보호 아래 교체해 PID 35091로 기동했고, 선택된 Node/config/workspace에는 쓰지 않았다. runtime evidence를 원자적으로 재계산한 뒤 origin base와 canonical Claude executable로 `--preflight-only`만 실행했다.

## Reviewer Checkpoints

- Verify successful `onToolExit` completes exactly once before `ContinueInternalTool` can submit any resumed envelope and `h.mu` is not held across continuation.
- Verify early validation/wire/budget/timeout/cancel paths still emit one classified tool event and continuation error still produces the expected terminal error without a duplicate tool event.
- Verify the new synchronous-continuation test deterministically forces the formerly intermittent ordering and asserts all seven classes, exact stages/durations/counts, cleanup, terminal, correlation privacy, and no duplicates.
- Verify accepted R1 harness and dedicated-registry files are unchanged by this packet and retain their fresh regression evidence.
- Verify a failed required local gate was not retried for acceptance; all recorded commands/output match the code.
- Verify the remote overlay contains only the two reviewed R2 files, only the selected disposable Edge was restarted with rollback available, selected Node/unrelated processes remained untouched, and runtime evidence matches the candidate.
- Verify preflight used the origin base and canonical Claude executable, started zero Claude children, retained ingress 0, printed no secret, created no result/manifest, and never used `--run`.
- Verify S12 remains deferred and no contract/spec/roadmap qualification claim was promoted.

## Verification Results

Fill each section with the exact command's stdout/stderr and exit status. Do not summarize or reconstruct output. A failure in commands 1-5 ends local acceptance; do not rerun it and substitute a later pass. Commands 6 and 8 are read-only remote checks. Command 7 refreshes only the selected disposable candidate. Command 9 is `--preflight-only`; no command may contain `--run`.

### 1. Deterministic synchronous-continuation race regression

Command:

```sh
go test -race -count=100 ./apps/edge/internal/service -run '^TestSingleRequestObservationSynchronousContinuationOrdering$'
```

Output:

```text
ok  	iop/apps/edge/internal/service	1.452s
exit status: 0
```

### 2. Dedicated-registry HTTP observation regression

Command:

```sh
go test -race -count=20 ./apps/edge/internal/openai -run '^TestAnthropicSingleRequestObservation$'
```

Output:

```text
ok  	iop/apps/edge/internal/openai	1.179s
exit status: 0
```

### 3. Three consecutive required race suites

Command:

```sh
bash -c 'set -euo pipefail; for run in 1 2 3; do echo "race-suite-run=$run"; go test -race -count=1 ./packages/go/config ./packages/go/streamgate ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/node/internal/bootstrap ./apps/node/internal/node ./apps/node/internal/transport ./apps/node/internal/workspace; done'
```

Output:

```text
race-suite-run=1
ok  	iop/packages/go/config	1.970s
ok  	iop/packages/go/streamgate	2.043s
ok  	iop/apps/edge/internal/openai	12.543s
ok  	iop/apps/edge/internal/service	9.334s
ok  	iop/apps/node/internal/bootstrap	2.563s
ok  	iop/apps/node/internal/node	3.774s
ok  	iop/apps/node/internal/transport	6.654s
ok  	iop/apps/node/internal/workspace	6.127s
race-suite-run=2
ok  	iop/packages/go/config	1.886s
ok  	iop/packages/go/streamgate	2.035s
ok  	iop/apps/edge/internal/openai	12.558s
ok  	iop/apps/edge/internal/service	9.348s
ok  	iop/apps/node/internal/bootstrap	2.498s
ok  	iop/apps/node/internal/node	3.666s
ok  	iop/apps/node/internal/transport	6.631s
ok  	iop/apps/node/internal/workspace	6.054s
race-suite-run=3
ok  	iop/packages/go/config	1.825s
ok  	iop/packages/go/streamgate	1.957s
ok  	iop/apps/edge/internal/openai	12.407s
ok  	iop/apps/edge/internal/service	9.297s
ok  	iop/apps/node/internal/bootstrap	2.506s
ok  	iop/apps/node/internal/node	3.616s
ok  	iop/apps/node/internal/transport	6.643s
ok  	iop/apps/node/internal/workspace	5.865s
exit status: 0
```

### 4. Harness and full Go suite

Command:

```sh
bash -n scripts/e2e-single-request-claude.sh && make test-single-request-claude-smoke-self-test && go test -count=1 ./...
```

Output:

```text
./scripts/e2e-single-request-claude.sh --self-test
[single-request-claude-smoke] self-test passed: exact Claude base-route coverage, model/Edge/Node/runtime binding, zero-child preflight, derived verification, redaction, cleanup, signal handling, and atomic publication
ok  	iop/apps/control-plane/cmd/control-plane	3.297s
ok  	iop/apps/control-plane/internal/credentiallease	0.101s
ok  	iop/apps/control-plane/internal/credentialops	0.166s
ok  	iop/apps/control-plane/internal/credentialseal	0.064s
ok  	iop/apps/control-plane/internal/credentialstore	0.256s
ok  	iop/apps/control-plane/internal/wire	1.986s
ok  	iop/apps/edge/cmd/edge	0.222s
ok  	iop/apps/edge/internal/authprojection	0.057s
ok  	iop/apps/edge/internal/bootstrap	0.634s
ok  	iop/apps/edge/internal/configrefresh	0.118s
ok  	iop/apps/edge/internal/controlplane	6.667s
ok  	iop/apps/edge/internal/edgecmd	0.145s
ok  	iop/apps/edge/internal/edgevalidate	0.103s
ok  	iop/apps/edge/internal/events	0.049s
ok  	iop/apps/edge/internal/input	0.139s
ok  	iop/apps/edge/internal/input/a2a	0.103s
ok  	iop/apps/edge/internal/node	0.083s
ok  	iop/apps/edge/internal/openai	8.405s
ok  	iop/apps/edge/internal/opsconsole	0.067s
ok  	iop/apps/edge/internal/service	8.226s
ok  	iop/apps/edge/internal/transport	4.811s
ok  	iop/apps/node/cmd/node	0.086s
ok  	iop/apps/node/internal/adapters	0.068s
?   	iop/apps/node/internal/adapters/mock	[no test files]
ok  	iop/apps/node/internal/adapters/ollama	0.039s
ok  	iop/apps/node/internal/adapters/openai_compat	0.164s
ok  	iop/apps/node/internal/adapters/vllm	0.151s
ok  	iop/apps/node/internal/bootstrap	1.407s
ok  	iop/apps/node/internal/node	1.016s
ok  	iop/apps/node/internal/router	0.514s
ok  	iop/apps/node/internal/store	0.024s
ok  	iop/apps/node/internal/transport	5.575s
ok  	iop/apps/node/internal/workspace	0.692s
?   	iop/apps/worker/cmd/worker	[no test files]
ok  	iop/packages/go/audit	0.006s
ok  	iop/packages/go/auth	10.026s
ok  	iop/packages/go/config	0.134s
ok  	iop/packages/go/credentiallease	0.024s
?   	iop/packages/go/events	[no test files]
ok  	iop/packages/go/execution	0.006s
ok  	iop/packages/go/hostsetup	0.008s
?   	iop/packages/go/jobs	[no test files]
?   	iop/packages/go/metadata	[no test files]
ok  	iop/packages/go/observability	0.020s
?   	iop/packages/go/policy	[no test files]
ok  	iop/packages/go/streamgate	0.884s
?   	iop/packages/go/version	[no test files]
ok  	iop/packages/go/workspaceprotocol	0.014s
?   	iop/proto/gen/iop	[no test files]
ok  	iop/scripts/inventory-query	0.010s
exit status: 0
```

### 5. Protobuf current-worktree reproducibility and hygiene

Command:

```sh
bash -c 'set -euo pipefail; tmp="$(mktemp -d)"; trap '\''rm -rf "$tmp"'\'' EXIT; find proto/gen/iop -type f -print0 | sort -z | xargs -0 sha256sum >"$tmp/before"; make proto; find proto/gen/iop -type f -print0 | sort -z | xargs -0 sha256sum >"$tmp/after"; cmp "$tmp/before" "$tmp/after"; test ! -e agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; git diff --check'
```

Output:

```text
protoc \
	--go_out=. \
	--go_opt=module=iop \
	--proto_path=. \
	proto/iop/runtime.proto \
	proto/iop/node.proto \
	proto/iop/control.proto \
	proto/iop/job.proto
exit status: 0
```

### 6. Read-only candidate pre-mutation check

Command:

```sh
ssh -o BatchMode=yes toki@toki-labs.com 'set -eu; root=/Users/toki/agent-work/iop-s12-validation-20260808/source; cd "$root"; test "$(git rev-parse HEAD)" = 70d22850d01714fdef734dafa42e82fed79e0786; test -d /Users/toki/agent-work/iop-s12-validation-20260808/workspace; test -w /Users/toki/agent-work/iop-s12-validation-20260808/workspace; test ! -e /Users/toki/agent-work/iop-s12-validation-20260808/workspace/smoke-result.txt; test ! -e agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; test "$(curl -sS -o /dev/null -w "%{http_code}" http://127.0.0.1:18083/healthz)" = 200; code="$(curl -sS -o /dev/null -w "%{http_code}" -X OPTIONS http://127.0.0.1:18083/v1/messages)"; test "$code" = 401 -o "$code" = 405; test "$(curl -sS -o /dev/null -w "%{http_code}" -X OPTIONS http://127.0.0.1:18083/v1/v1/messages)" = 404; curl -fsS http://127.0.0.1:19101/metrics | grep -Eq "^iop_anthropic_single_request_ingress_total 0(\\.0+)?$"'
```

Output:

```text
(no stdout/stderr)
exit status: 0
```

### 7. Bounded source overlay and selected Edge rebuild/restart

Command:

```sh
bash -c 'set -euo pipefail; tar -cf - apps/edge/internal/service/single_request_tool_loop.go apps/edge/internal/service/single_request_observation_test.go | ssh -o BatchMode=yes toki@toki-labs.com '\''set -eu; root=/Users/toki/agent-work/iop-s12-validation-20260808/source; cd "$root"; tar -xf -; git diff --check -- apps/edge/internal/service/single_request_tool_loop.go apps/edge/internal/service/single_request_observation_test.go; PATH=/opt/homebrew/bin:$PATH; /opt/homebrew/bin/go build -trimpath -o build/s12/bin/iop-edge.next ./apps/edge/cmd/edge; build/s12/bin/iop-edge.next config check --config build/s12/runtime/edge.yaml; old_pid="$(pgrep -f "^$root/build/s12/bin/iop-edge --config $root/build/s12/runtime/edge.yaml serve$")"; test -n "$old_pid"; test "$(printf "%s\\n" "$old_pid" | wc -l | tr -d " ")" = 1; cp -p build/s12/bin/iop-edge build/s12/bin/iop-edge.pre-r2; kill "$old_pid"; stopped=0; for attempt in 1 2 3 4 5 6 7 8 9 10; do if ! kill -0 "$old_pid" 2>/dev/null; then stopped=1; break; fi; sleep 1; done; test "$stopped" = 1; mv build/s12/bin/iop-edge.next build/s12/bin/iop-edge; nohup "$root/build/s12/bin/iop-edge" --config "$root/build/s12/runtime/edge.yaml" serve >>"$root/build/s12/runtime/edge.log" 2>&1 </dev/null & new_pid=$!; ok=0; for attempt in 1 2 3 4 5 6 7 8 9 10; do if curl -fsS http://127.0.0.1:18083/healthz >/dev/null 2>&1; then ok=1; break; fi; sleep 1; done; if test "$ok" != 1; then kill "$new_pid" 2>/dev/null || true; for attempt in 1 2 3 4 5 6 7 8 9 10; do if ! kill -0 "$new_pid" 2>/dev/null; then break; fi; sleep 1; done; mv build/s12/bin/iop-edge.pre-r2 build/s12/bin/iop-edge; nohup "$root/build/s12/bin/iop-edge" --config "$root/build/s12/runtime/edge.yaml" serve >>"$root/build/s12/runtime/edge.log" 2>&1 </dev/null & exit 1; fi; rm build/s12/bin/iop-edge.pre-r2; printf "old_edge_pid=%s new_edge_pid=%s\\n" "$old_pid" "$new_pid"'\'''
```

Output:

```text
OK build/s12/runtime/edge.yaml
old_edge_pid=25372 new_edge_pid=35091
exit status: 0
```

### 8. Atomic runtime-evidence reconciliation and identity check

Command:

```sh
ssh -o BatchMode=yes toki@toki-labs.com 'set -eu
cd /Users/toki/agent-work/iop-s12-validation-20260808/source
python3 - build/s12/runtime/runtime-evidence.json <<'"'"'PY'"'"'
import hashlib, json, os, subprocess, sys, tempfile

path = sys.argv[1]
root = os.getcwd()

def sha_bytes(value):
    return "sha256:" + hashlib.sha256(value).hexdigest()

def sha_text(value):
    return sha_bytes(value.encode())

def sha_file(path_value):
    digest = hashlib.sha256()
    with open(path_value, "rb") as stream:
        for block in iter(lambda: stream.read(1024 * 1024), b""):
            digest.update(block)
    return "sha256:" + digest.hexdigest()

inputs = [
    "apps/edge/internal/openai",
    "apps/edge/internal/service",
    "apps/node/internal/bootstrap",
    "apps/node/internal/workspace",
    "packages/go/config",
    "scripts/e2e-single-request-claude.sh",
    "scripts/fixtures/single-request-claude-smoke-manifest.schema.json",
    "Makefile",
]
files = []
for rel in inputs:
    candidate = os.path.join(root, rel)
    if os.path.isdir(candidate):
        for current, dirs, names in os.walk(candidate):
            dirs.sort()
            for name in sorted(names):
                item = os.path.join(current, name)
                if os.path.isfile(item) and not os.path.islink(item):
                    files.append(item)
    elif os.path.isfile(candidate) and not os.path.islink(candidate):
        files.append(candidate)
tree = hashlib.sha256()
for item in sorted(files):
    rel = os.path.relpath(item, root).replace(os.sep, "/")
    tree.update(rel.encode() + b"\0" + sha_file(item)[7:].encode() + b"\0")

with open(path, encoding="utf-8") as stream:
    data = json.load(stream)
runtime = data["runtime"]
data["source"]["head"] = subprocess.check_output(["git", "rev-parse", "HEAD"], text=True).strip()
data["source"]["branch_digest"] = sha_text(subprocess.check_output(["git", "rev-parse", "--abbrev-ref", "HEAD"], text=True).strip())
data["source"]["worktree_digest"] = "sha256:" + tree.hexdigest()
runtime["edge_digest"] = sha_file("build/s12/bin/iop-edge")
runtime["edge_version_digest"] = sha_bytes(subprocess.check_output(["build/s12/bin/iop-edge", "version"], stderr=subprocess.STDOUT))
runtime["config_digest"] = sha_file("build/s12/runtime/edge.yaml")
runtime["config_check_digest"] = sha_bytes(subprocess.check_output(["build/s12/bin/iop-edge", "config", "check", "--config", "build/s12/runtime/edge.yaml"], stderr=subprocess.STDOUT))
runtime["base_url_digest"] = sha_text("http://127.0.0.1:18083")
owner = "|".join([runtime["workspace_os"], runtime["workspace_arch"], runtime["workspace_root_digest"], runtime["config_digest"], runtime["node_digest"], runtime["node_version_digest"]])
runtime["workspace_owner_digest"] = sha_text(owner)
binding = "|".join([runtime["config_digest"], runtime["config_check_digest"], runtime["base_url_digest"], runtime["public_model_digest"], *runtime["stage_engines"]])
runtime["stage_binding_digest"] = sha_text(binding)
descriptor, temporary = tempfile.mkstemp(prefix=".runtime-evidence.", dir=os.path.dirname(path), text=True)
try:
    os.fchmod(descriptor, 0o600)
    with os.fdopen(descriptor, "w", encoding="utf-8") as stream:
        json.dump(data, stream, sort_keys=True, separators=(",", ":"))
        stream.write("\n")
    os.replace(temporary, path)
except Exception:
    if os.path.exists(temporary):
        os.unlink(temporary)
    raise
PY
build/s12/bin/iop-edge config check --config build/s12/runtime/edge.yaml
build/s12/bin/iop-edge version
build/s12/bin/iop-node-darwin-arm64 version
test "$(uname -s)" = Darwin
test "$(uname -m)" = arm64
curl -fsS http://127.0.0.1:18083/healthz >/dev/null
curl -fsS http://127.0.0.1:19101/metrics | grep -Eq "^iop_anthropic_single_request_ingress_total 0(\\.0+)?$"
test ! -e agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json'
```

Output:

```text
OK build/s12/runtime/edge.yaml
0.1.0
0.1.0
exit status: 0
```

### 9. Origin-based zero-child remote preflight only

Command:

```sh
ssh -o BatchMode=yes toki@toki-labs.com 'IFS= read -r ANTHROPIC_API_KEY; export ANTHROPIC_API_KEY; cd /Users/toki/agent-work/iop-s12-validation-20260808/source; exec ./scripts/e2e-single-request-claude.sh --preflight-only --claude /opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe --runtime-evidence build/s12/runtime/runtime-evidence.json --base-url http://127.0.0.1:18083 --model iop-single-request-light --edge-bin build/s12/bin/iop-edge --node-bin build/s12/bin/iop-node-darwin-arm64 --edge-config build/s12/runtime/edge.yaml --observation-file build/s12/runtime/edge.log --metrics-url http://127.0.0.1:19101/metrics --workspace /Users/toki/agent-work/iop-s12-validation-20260808/workspace --output /Users/toki/agent-work/iop-s12-validation-20260808/source/agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json --secret-env ANTHROPIC_API_KEY' < /config/workspace/iop/token/.claude
```

Output:

```text
[single-request-claude-smoke] preflight passed without a Claude invocation
exit status: 0
```

### 10. Deferred qualification and final diff hygiene

Command:

```sh
bash -c 'set -euo pipefail; test ! -e agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; rg --sort path -n "actual external Claude qualification remains explicitly deferred|Actual Claude timing evidence on an approved IOP Node is explicitly deferred|actual Claude timing evidence on an approved IOP Node is explicitly deferred" agent-contract/outer/anthropic-compatible-api.md agent-spec/runtime/edge-node-execution.md agent-spec/input/openai-compatible-surface.md; git diff --check'
```

Output:

```text
agent-contract/outer/anthropic-compatible-api.md:203:while actual external Claude qualification remains explicitly deferred to S12 (`claude-smoke`).
agent-spec/runtime/edge-node-execution.md:210:| single-request observation evidence | Stage-pure timing, tool/cleanup/total counts, cardinality-bounded labels, Node logs, and raw-free correlation are documented for the single-request path. `iop_anthropic_single_request_ingress_total` is strictly unlabeled. Internal tool names, raw arguments, and private results are absent from public output and log projections. Actual Claude timing evidence on an approved IOP Node is explicitly deferred to `claude-smoke` (SDD S12); deterministic coordinator/tool-loop tests do not imply external qualification. |
agent-spec/runtime/edge-node-execution.md:252:Single-request lifecycle observation evidence links ingress=1, request-total=1, terminal=1, stage/tool/cleanup counts, and raw-free correlation for one real POST. `iop_anthropic_single_request_ingress_total` is strictly unlabeled (no request_id, stage_id, provider identity, content, or workspace reference). Internal tool names, raw arguments, and private results are absent from public output and log projections. Stage-pure timing, cardinality-bounded labels, and privacy semantics are documented here. Actual Claude timing evidence on an approved IOP Node is explicitly deferred to `claude-smoke` (SDD S12); deterministic coordinator/tool-loop tests do not imply external qualification.
agent-spec/runtime/edge-node-execution.md:344:- The composite single-request executor is installed at Edge input startup (`apps/edge/internal/input/manager.go`), wiring the active Plan -> Work -> Review stage pipeline for single-request execution. Private stage outcomes use the implemented closed S11 terminal policy and stop without retry/fallback or a second request. Deterministic local activation and terminal evidence are proven, while actual external Claude qualification remains explicitly deferred to S12 (`claude-smoke`).
agent-spec/runtime/edge-node-execution.md:345:- Single-request observation evidence (ingress=1, request-total=1, terminal=1, stage/tool/cleanup counts, raw-free correlation) is documented and tested. `iop_anthropic_single_request_ingress_total` is strictly unlabeled. Internal tool names, raw arguments, and private results are absent from public output and log projections. Actual Claude timing evidence on an approved IOP Node is explicitly deferred to `claude-smoke` (SDD S12); deterministic coordinator/tool-loop tests do not imply external qualification.
agent-spec/input/openai-compatible-surface.md:168:| marked single-request observation evidence | A single real POST links ingress=1, request-total=1, terminal=1, stage/tool/cleanup counts, and raw-free correlation without public tool protocol. `iop_anthropic_single_request_ingress_total` is unlabeled (no request_id, stage_id, provider identity, or content). Internal tool names, raw arguments, private results, and workspace references are absent from the public terminal and from log projections. Stage-pure timing, cardinality-bounded labels, and privacy semantics are documented here; actual Claude timing evidence on an approved IOP Node is explicitly deferred to `claude-smoke` (SDD S12). |
agent-spec/input/openai-compatible-surface.md:258:- Marked single-request observation evidence links ingress=1, request-total=1, terminal=1, stage/tool/cleanup counts, and raw-free correlation for one real POST. `iop_anthropic_single_request_ingress_total` is strictly unlabeled: no request_id, stage_id, provider identity, content, or workspace reference appears as a metric label. Internal tool names (`workspace_read`, `workspace_write`, etc.), raw arguments, private results, and workspace references are absent from the public terminal JSON and from log projections. Stage-pure timing, cardinality-bounded labels, and privacy semantics are documented here. Actual Claude timing evidence on an approved IOP Node is explicitly deferred to `claude-smoke` (SDD S12); deterministic coordinator/tool-loop tests do not imply external qualification.
agent-spec/input/openai-compatible-surface.md:315:- The marked single-request SSE projector and private workspace continuation do not add event kinds, filters, release rules, or recovery behavior to the generic Stream Evidence Gate. The active Plan -> Work -> Review composite and request-artifact cleanup use the closed S11 `error-cancel`/length policy with deterministic local evidence. S11 is implemented; only actual external Claude qualification remains explicitly deferred to S12 (`claude-smoke`).
agent-spec/input/openai-compatible-surface.md:347:- 2026-08-08: Repaired current-state contradiction: the active Plan -> Work -> Review composite, request-artifact cleanup via generic private-stage failure projection, and deterministic local evidence are now documented as active; only actual external Claude qualification remains explicitly deferred to S12 (`claude-smoke`). Added exact manager/executor/test source evidence paths.
exit status: 0
```

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Result | Evidence |
|-----------|--------|----------|
| Correctness | Pass | The successful tool observation closes exactly once before `ContinueInternalTool`; no `h.mu` lock is held across continuation, and continuation failure retains one successful tool event with the existing `internal_tool_failed` request/stage terminal. |
| Completeness | Fail | The repository repair and zero-ingress remote preflight are complete, but the selected `claude-smoke` contribution still lacks the actual Claude invocation, ingress delta 1, workspace mutation, ordered stage/timing evidence, terminal, and stable manifest required by SDD S12. |
| Test coverage | Pass | Fresh review passed the deterministic synchronous-continuation race regression 100 times, the dedicated-registry HTTP observation regression 20 times, the required race matrix three consecutive times, the harness self-test, the full Go suite, protobuf reproducibility, and hygiene checks. |
| API contract | Pass | The repair preserves the private continuation and one-ingress Anthropic boundary; the outer contract correctly remains deferred rather than claiming unsupported external qualification. |
| Code quality | Pass | The two reviewed source files are formatted, `go vet ./apps/edge/internal/service` and `git diff --check` pass, and no debug/TODO/stale removed-symbol residue was found in the reviewed path. |
| Implementation deviation | Pass | The implementation followed the bounded packet: only the reviewed ordering/test files were refreshed on the disposable candidate, the selected Edge alone was restarted, and execution stopped at `--preflight-only` without a second live provider invocation. |
| Verification trust | Pass | Fresh local results match the recorded outputs. A read-only remote cross-check confirmed the two source hashes, Edge PID 35091, unchanged Node PID 25114, health/route distinction, ingress 0, and absent result/manifest. |
| Spec conformance | Fail | `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md:136` requires actual-Claude request-count=1 end-to-end/elapsed evidence for S12, while the candidate remains at preflight with ingress 0 and no manifest. |

### Findings

- **Required R1** — `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md:136`: the `claude-smoke` acceptance evidence is still absent. The previous exactly-one live authorization was consumed by a failed invocation, and this packet correctly forbids another `--run`; current remote evidence remains ingress 0 with no workspace result or manifest. Obtain explicit authorization for one new non-retriable live Claude invocation on the already selected disposable runner/candidate, then execute a freshly routed external-verification plan that first revalidates identity/preflight and records a redacted manifest proving ingress POST 1, `gemini -> ornith-fast -> gemini`, stage/total timing, final workspace mutation/verification, and terminal 1.

### Routing Signals

- `review_rework_count=4`
- `evidence_integrity_failure=false`

The three prior archived verdicts with review findings are `FAIL`; the two earlier superseded stubs have no verdict. The current non-PASS verdict therefore raises the rework count from 3 to 4. Recorded implementation output is present and consistent with fresh reviewer evidence.

### Next Step

Archive the current pair and write `USER_REVIEW.md` with the `external-execution` gate. Resume through a freshly routed external-verification plan only after the user explicitly authorizes one new non-retriable live Claude invocation on the selected runner/candidate.
