<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=16 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Execute the third authorized sole Claude-through-IOP S12 call

## For the Implementing Agent

The user's current `승인할테니 시작해` instruction resolves `user_review_5.log` and authorizes exactly one new Claude Code `--run` against the repaired disposable managed IOP runtime. Run fresh local and remote provider-free gates first. Only after they pass, create the distinct durable `sole-live-3.started` guard and invoke once. Rename the guard to an rc-specific final state and never retry regardless of outcome. Claude is only the IOP caller; Gemini plan/review and Ornith-fast work remain IOP-owned internal routes and must never be called directly. Publish redacted S12 evidence and update bounded qualification owners only on a closed PASS. Fill implementation-owned review evidence before official review.

## Background

Two earlier one-call authorizations are durably consumed as `sole-live.rc-69` and `sole-live-2.rc-69`. Both failed with HTTP 400 before accepted ingress and neither reached Gemini or Ornith. Plans 13 and 15 repaired the two concrete Claude 2.1.177 compatibility gaps: object/null `context_management` plus `context-management-2025-06-27`, then `prompt-caching-scope-2026-01-05`. The exact authenticated provider-free beta request now returns HTTP 200 through IOP, the managed runtime evidence matches the rebuilt Edge, and harness preflight passes without a Claude invocation.

The user has now explicitly approved one additional live execution. This approval does not authorize retries, direct provider calls, canonical dev mutation, or a different runner/runtime.

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_15.log` / `code_review_cloud_G10_15.log`; verdict `FAIL`, `review_rework_count=14`, `evidence_integrity_failure=false`.
- Resolved stop: `user_review_5.log`; the required external action was exactly one new guarded Claude-through-IOP execution, now authorized by `승인할테니 시작해`.
- Managed runtime: `/Users/toki/agent-work/iop-s12-managed-validation-20260808`; current process identities at resolution were Control Plane PID 89097, Edge PID 698, Node PID 89104; one connected Node and two healthy provider snapshots.
- Isolated source/workspace: `/Users/toki/agent-work/iop-s12-validation-20260808/source` and `/Users/toki/agent-work/iop-s12-validation-20260808/workspace`. Canonical `/Users/toki/agent-work/iop-dev` remains read-only.
- Caller credential: remote SOPS `tokens.toki-dev-cline`, decrypted only into process memory and used only for Claude-to-IOP authentication.

## Analysis

### Acceptance and Cardinality Boundary

- Fresh local focused/race/self-test/diff/redaction gates must pass against the exact reviewed source.
- Fresh remote config/runtime identity, fleet/catalog, exact prompt-caching-scope count-token request, zero-generation counters, workspace/result/manifest absence, and harness `--preflight-only` must pass before guard creation.
- Preflight uses the canonical Claude executable `/opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe`, managed private CA, fresh temporary Claude config, IOP base `https://127.0.0.1:18483`, and public model `iop-single-request-light`.
- Existing guards are immutable. `sole-live-3.started` must be created atomically immediately before the new call and renamed to `sole-live-3.rc-N`, where N is the captured harness exit code.
- Exactly one harness `--run` is allowed. No retry, fallback, direct Gemini/Ornith/Claude provider call, or second guard is allowed.

### PASS Boundary

- PASS requires one accepted Messages ingress, exactly three ordered internal stages `gemini -> ornith-fast -> gemini`, one verified workspace result, cleanup, one success terminal, and schema-valid redacted stage/total timing evidence.
- Only a PASS manifest may be copied atomically to `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json` and used to replace explicit S12-deferred wording in the Anthropic contract plus current runtime/input specs.
- On failure, retain only closed class/reason, guard rc, safe counters, artifact presence, and cleanup evidence. Do not publish a manifest or success claim.

### Split Judgment

The guarded call, its exact cardinality evidence, and PASS-only qualification publication form one indivisible external-verification packet. Splitting execution from result ownership would allow a failed or stale call to be promoted into current qualification evidence.

## Finding Resolution Map

| Finding | Mode | Exact evidence | Changed precondition |
|---|---|---|---|
| R9 | direct external execution | Resolved `user_review_5.log`, fresh provider-free preflight, `sole-live-3` guard, one harness `--run`, no retry | The user has explicitly authorized the single remaining real S12 execution after repository-owned compatibility gates passed. |

## Dependencies and Execution Order

1. Re-run fresh local source/harness gates and confirm no unreviewed compatibility drift.
2. Revalidate the managed processes, runtime evidence, fleet, catalog, exact count-token request, guards, workspace, counters, and canonical-dev exclusion.
3. Run harness `--preflight-only` with a fresh Claude config and SOPS caller held only in memory; require zero child and unchanged ingress.
4. Atomically create `sole-live-3.started`, run the harness exactly once, capture `live_rc`, and finalize the guard. Never retry.
5. On PASS only, validate/publish the redacted manifest and synchronize bounded contract/spec qualification statements.
6. Record exact safe post-call evidence, fill the active review, and stop for official review.

## Plan Items

### 1. FRESH-GATES-1 — freeze the exact repaired candidate

**Solution:** pass fresh local focused/race/harness/contract/redaction/diff checks, then prove current managed binary/config/runtime identity, process/fleet health, catalog, prompt-caching-scope count-token compatibility, and zero-generation state.

**Checklist:**

- [ ] Local focused/race, harness syntax/self-test, contract/source, redaction, and diff gates pass.
- [ ] Managed source/binary/config/runtime evidence and CP/Edge/Node identities agree.
- [ ] Catalog and exact count-token probes return HTTP 200 with all generation/activity deltas zero.

### 2. SOLE-LIVE-3 — execute the newly authorized call exactly once

**Solution:** pass a fresh zero-child preflight, create `sole-live-3.started`, and invoke the harness once with the approved managed IOP base/model/workspace and in-memory SOPS caller. Capture `live_rc`, finalize the guard, and do not retry.

**Checklist:**

- [ ] Preflight passes before guard creation with no Claude child/result/manifest/ingress change.
- [ ] One new guard precedes one `--run`; no retry or direct provider command occurs.
- [ ] Post-call ingress/stage/terminal/workspace/process/artifact evidence is recorded safely.

### 3. SUCCESS-SYNC-3 — publish only a closed PASS

**Solution:** only when `live_rc=0` and the remote manifest satisfies the existing schema, validate it again, copy atomically to the stable local evidence path, require identical content, and replace only explicit S12-deferred wording in the contract and two current specs with bounded qualification facts/evidence. On failure, change none of these success-only owners.

**Success-only Files:**

- [ ] `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json`
- [ ] `agent-contract/outer/anthropic-compatible-api.md`
- [ ] `agent-spec/runtime/edge-node-execution.md`
- [ ] `agent-spec/input/openai-compatible-surface.md`

### 4. REVIEW-EVIDENCE-4 — record the actual one-call outcome

**Solution:** fill all implementation-owned review sections with fresh gates, guard/rc/cardinality, stage/provider families, workspace/cleanup/terminal facts, manifest/publication state, process identities, privacy evidence, deviations, and no-retry proof.

**File:**

- [ ] `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md`

## Implementation Checklist

- [ ] Pass all fresh local and remote provider-free gates against the repaired runtime.
- [ ] Create `sole-live-3` and execute exactly one newly authorized Claude-through-IOP call.
- [ ] Keep Gemini/Ornith/Claude provider routing entirely inside IOP and never retry.
- [ ] On PASS only, publish schema-valid redacted evidence and synchronize bounded qualification owners.
- [ ] On failure, retain only closed diagnostics and make no success claim.
- [ ] Fill implementation-owned review evidence and stop for official review.

## Modified Files Summary

| File | Reason |
|---|---|
| `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json` | PASS-only stable redacted S12 manifest |
| `agent-contract/outer/anthropic-compatible-api.md` | PASS-only bounded external qualification statement |
| `agent-spec/runtime/edge-node-execution.md` | PASS-only current runtime qualification evidence |
| `agent-spec/input/openai-compatible-surface.md` | PASS-only current input-surface qualification evidence |
| `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md` | Exact authorized-call evidence |

## Final Verification

1. Fresh local focused Edge tests, full Edge/service race tests, harness syntax/self-test, contract/source assertions, secret/redaction scan, and `git diff --check`.
2. Managed process/config/runtime identity, one connected Node, two healthy snapshots, catalog HTTP 200, exact prompt-caching-scope count-token HTTP 200, both prior guards, absent third guard/result/manifest, and zero generation/activity.
3. Fresh temporary Claude config plus managed CA and SOPS caller; harness `--preflight-only` exit 0, zero Claude child, unchanged ingress, absent output, cleanup complete.
4. Create the third guard; execute one harness `--run`; capture/finalize rc; no retry.
5. PASS requires ingress delta 1, ordered three-stage evidence, verified workspace result, cleanup, one terminal, redacted timings, and schema-valid manifest. Failure retains only closed safe evidence.
6. PASS-only publication uses atomic copy, schema validation, identical content, bounded contract/spec updates, and final diff/redaction checks.

## Final Routing

- `evaluation_mode=isolated-reassessment`
- `finalizer=finalize-task-policy.sh`, `finalizer_mode=pair`
- build scores `2/2/2/2/2` => `G10`, `base_route_basis=grade-boundary`
- `large_indivisible_context=true`; matched risks: `temporal_state`, `concurrent_consistency`, `boundary_contract`, `variant_product`; count 4
- `review_rework_count=14`, `evidence_integrity_failure=false`; risk/recovery boundaries matched without replacing grade basis
- build `worker/cloud/G10`, `PLAN-cloud-G10.md`; review `review/cloud/G10`, `CODE_REVIEW-cloud-G10.md`
