<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=29 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - Ornith live admission and twelfth qualification

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=29

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_28.log` / `code_review_cloud_G10_28.log`; verdict `FAIL`, Required R29, `review_rework_count=27`, `evidence_integrity_failure=false`.
- `sole-live-11.rc-69` is immutable: ingress `0 -> 1`, provider tunnels `6 -> 8`, Plan success 1, Work provider error 1, cleanup success 1, terminal provider error 1, no result/manifest, and no retry.
- Current changed prerequisite: direct RTX status reports ready with the exact profile/listener/Edge connection; the managed Mac receives HTTP 200 from health and `/v1/models`, and the catalog contains the exact Ornith model.

## Implementation Item Completion

| Item | Status |
|---|---|
| ornith-admission | [x] |
| provider-free-readiness | [x] |
| twelfth-call | [x] |
| publication | [x] |

## Implementation Checklist

- [x] Prove the current RTX and managed-Mac non-generating readiness boundary.
- [x] Pass TLS/fleet/runtime/count-token/harness/guard provider-free checks.
- [x] Execute and finalize exactly one twelfth guard with no retry.
- [x] Publish only a complete schema-valid S12 result/manifest; no partial result or manifest was published.
- [x] Fill implementation fields and stop for official review.

## Review-Only Checklist

- [x] Append one verdict and verified routing signals.
- [x] Verify R29, changed precondition, privacy, cardinality, ordered stages, and S12 publication.
- [x] Archive and materialize the verdict's next state, or write completion evidence and archive the task on PASS.

## Deviations from Plan

- A local temporary-file status command was rejected by the execution policy before it ran; the direct RTX status was immediately reissued as a pipe-only read and passed without filesystem or runtime mutation.
- Despite RTX readiness and Mac health/catalog success immediately before guard creation, the managed `iop-node` again returned the identical 126-byte `no route to host` transport error in 5 ms. System `nc`, `curl`, and Python on the same Mac connect repeatedly; the Node process has no proxy variables and its binary is ad-hoc signed as identifier `a.out`. This narrows the blocker to the executable-specific Mac LAN boundary rather than provider health or request schema.
- The canonical dev IOP at `127.0.0.1:18083` remains read-only and provider-free catalog verification with the SOPS caller key returns health/models 200 and exposes `ornith-fast`. It is the bounded IOP-owned replacement route for the isolated Work stage.

## Key Design Decisions

- Gate the twelfth guard on both the declared RTX operator status and Mac-local health/catalog rather than assuming static inventory health.
- Finalize `sole-live-12.rc-69` immutably and retain only fixed harness classification, structured observations, counter deltas, and hashed/sanitized Node transport evidence.
- Do not add an unbound local proxy or call Ornith directly. Reuse the already running canonical dev IOP ingress as the next Work upstream, authenticated by the user-designated SOPS IOP key, while leaving canonical configuration and processes untouched.

## Verification Results

- Direct RTX status passed: ready, health ok, exact model loaded/profile valid, public listener active, and canonical Edge connection true.
- Managed Mac non-generating admission passed: RTX health HTTP 200, `/v1/models` HTTP 200, exact Ornith model matched. Canonical dev IOP health/models also returned 200 and its authenticated catalog exposes `ornith-fast`.
- Provider-free IOP readiness passed: supported count-token HTTP 200, unsupported beta HTTP 400, harness preflight passed, ingress `1 -> 1`, provider tunnels `8 -> 8`, Claude processes `0 -> 0`, eleven finalized guards, zero started guards, and no result/manifest.
- Twelfth execution ran once only: `sole-live-12.rc-69`; ingress `1 -> 2`; provider tunnels `8 -> 10`; Claude processes `0 -> 0`; request success 1, Plan success 1, Work provider error 1, cleanup success 1, terminal provider error 1; no result/manifest.
- Latest Node evidence repeats the same error digest `sha256:24e422f5af13d03b7494c7f2dade2557d3dd17725d6b5f4b411a7b228d2fc252`, class `no route to host`, for the Work request. System `nc` passed three consecutive connections and Python TCP passed; all standard proxy variables are absent from the Node process.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Pass | The readiness and exactly-once guard procedure behaved as specified and Plan remains successful. |
| Completeness | Fail | Work, Review, verified workspace output, successful terminal, and manifest are absent. |
| Test coverage | Pass | The plan exercised direct host status, Mac health/catalog, IOP count-token/preflight, counters, guard finalization, and closed diagnostics. |
| API contract | Pass | Claude and generation stayed behind IOP; direct checks were non-generating status/catalog only. |
| Code quality | Pass | No repository code or canonical runtime was changed and no proxy/debug artifact was added. |
| Implementation deviation | Pass | The failed status wrapper never executed; its safe pipe-only replacement preserved scope. |
| Verification trust | Pass | Two identical Node error digests plus contrasting system-tool connectivity close the executable-specific LAN diagnosis. |
| Spec conformance | Fail | SDD S12 success evidence remains missing. |

### Findings

- Required R29 — replace the isolated Work provider's direct LAN endpoint with the already declared canonical dev IOP loopback route. Back up the disposable config/database/evidence, rotate only `s12-ornith` to the process-memory SOPS IOP caller key, replace its active route with profile `openai`, upstream model `ornith-fast`, and the same managed resource selector, and point both isolated `rtx5090-lemonade` endpoint declarations at `http://127.0.0.1:18083/v1`. Keep canonical dev read-only, rebuild no source, revalidate exact identities/catalogs, and then use one distinct non-retriable guard through Claude -> isolated IOP -> canonical IOP -> Ornith.

### Routing Signals

- `evaluation_mode=isolated-reassessment`
- `verdict=FAIL`
- `review_rework_count=28`
- `evidence_integrity_failure=false`
- `next_state=plan`
- `finalizer=finalize-task-policy.sh`
- `finalizer_mode=pair`
- build route `worker/cloud/G10`; review route `review/cloud/G10`

### Next Step

- Invoke the plan skill with Required R29 and materialize the freshly routed managed-route repair and guarded verification plan before archiving this pair.
