<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=25 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - Observation trust repair and eighth guarded qualification

> **[IMPLEMENTING AGENT — READ FIRST]** Complete R19-R22, fill every implementation-owned section, and stop. Do not reuse a guard, retry a failed invocation, retain raw output, or publish partial S12 evidence.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=25, tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_24.log` / `code_review_cloud_G10_24.log`; verdict `FAIL`, Required R19-R22.
- Seven prior guards are immutable. Continuing task-scoped user approval permits the next guarded IOP execution after repair/readiness without another user-review stop.

## For the Review Agent

Verify observation source semantics, closed transport classifications, disposable TLS/fleet readiness, exactly one eighth invocation, privacy/cardinality, full S12 evidence, and PASS-only publication. Append one verdict and materialize the correct next state.

## Implementation Item Completion

| Item | Status |
|---|---|
| observation-trust | [x] |
| transport-classification | [x] |
| TLS-and-readiness | [x] |
| sole-eighth-call | [x] |
| publication | [x] |

## Implementation Checklist

- [x] Add semantic structured-observation validation and self-tests; use `edge-runtime.log` in dev execution.
- [x] Add redaction-safe `connection-error` and `tls-certificate` failure classes and self-tests.
- [x] Run local/remote syntax, focused ordinary/race tests, and harness self-test.
- [x] Refresh disposable TLS and restore exact managed fleet/runtime identity readiness.
- [x] Pass provider-free preflight with the correct structured log and zero live cardinality.
- [x] Execute and finalize exactly one `sole-live-8` invocation with no retry.
- [x] Publish only complete schema-valid S12 evidence; otherwise retain only closed diagnostics.
- [x] Fill implementation-owned review sections and stop for official review.

## Review-Only Checklist

- [ ] Append one verdict and verified routing signals.
- [ ] Verify R19-R22, no direct provider call, privacy, guard cardinality, and S12 publication.
- [ ] Archive the active pair and materialize the verdict's next state.

## Deviations from Plan

- The first remote test shell did not include `/opt/homebrew/bin`, so harness self-test passed and the following `go` command failed before running. The exact ordinary/race commands were rerun with the dev toolchain path and passed.
- The first eighth-call wrapper readiness used `find -type f` for historical guards, but all prior atomic guards are directories. It stopped before SOPS preflight, guard creation, Claude, or ingress. The corrected wrapper required seven finalized directories and used atomic `mkdir`.
- The eighth invocation failed at Plan. One Claude child created two concurrent retry-count-zero Messages requests: one session-title request and one actual task request. Both were accepted and both terminated malformed before Work.

## Key Design Decisions

- Observation preflight reads at most the last 1 MiB and requires a JSON object with fixed Edge message, level, and numeric timestamp fields. This rejects `edge.log` while preserving append-prefix and rotation checks.
- Connection and TLS classifiers use only fixed byte patterns and emit closed reasons; raw CLI text remains temporary and is deleted.
- The eighth call is consumed as `sole-live-8.rc-69`. Correct structure logs are sufficient to prove two Plan validation terminals, but not to expose or infer raw provider output.
- Provider-free local capture established the exact second-request role without IOP/provider generation: Claude 2.1.177 concurrently starts `generate_session_title` using a title JSON Schema and the actual tool-bearing task. Static installed-code inspection shows `CLAUDE_CODE_DISABLE_TERMINAL_TITLE` gates this title request.
- The private provider decoder currently excludes the standard top-level Chat Completions `usage` member. Repository fixtures for real normalized provider responses include `usage`, while the single-request success fixture omits it; this is the strongest closed cause of both Plan `malformed` terminals.

## Verification Results

- Local: shell syntax, harness self-test, `git diff --check`, ordinary OpenAI/service tests, and focused race tests passed.
- Remote isolated source: harness self-test passed; ordinary packages passed (`8.833s`, `9.168s`) and focused race packages passed (`2.821s`, `3.822s`).
- Disposable TLS was regenerated by the deterministic fake-provider credential smoke. Seven recoverable `.pre-plan25-cert` backups exist; new leaf validity is `2026-08-08 10:42:58Z` to `12:42:58Z`. CP/Edge/Node restarted as `95584/95593/95602`, reconnected, and certificate margin exceeded 3600 seconds.
- Runtime evidence was atomically refreshed for the changed harness worktree digest. Negative preflight rejected `edge.log` with `observation log incompatible`; positive SOPS-backed provider-free preflight accepted `edge-runtime.log` without starting Claude.
- Catalog/count-token readiness: frozen supported beta set `200`, unsupported context-hint neighbor `400`, ingress `0 -> 0`, no provider generation, seven finalized guards, no started guard/result/manifest.
- Eighth execution: one harness invocation, wrapper retry 0, child retry-count header 0, guard `sole-live-8.rc-69`, ingress `0 -> 2`, provider tunnel delta 2, Claude process `0 -> 0`, no result/manifest. Correct structured evidence contains two request observations, two Plan `outcome=error/error_class=validation`, two cleanups, two terminal validation observations, and two `terminal_error_class=malformed` HTTP 502 rejections; Work/Review success counts are zero.
- Provider-free delayed local capture proved both retry-count-zero requests arrived in the same millisecond. The title request had tool count 0 and a `title` JSON Schema; the actual request had thinking plus Bash/Edit/Read. No prompt, credential, provider response, or workspace body was retained.

---

> Implementer: fill every implementation-owned field, then stop for official review.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Fail | R19-R21 are repaired, but the eighth execution produced two ingress requests and both failed Plan decoding. |
| Completeness | Fail | No Work, Review, workspace result, successful terminal, or manifest exists. |
| Test coverage | Pass | Local/remote ordinary/race/self-tests, structured-log negative/positive preflights, TLS/fleet, count-token, guard/cardinality, and provider-free request-shape capture are closed. |
| API contract | Fail | The private OpenAI-compatible provider decoder rejects standard top-level `usage`, so a valid provider envelope cannot reach the Plan content parser. |
| Code quality | Pass | Observation and closed transport repairs are narrow, bounded, redacted, and test-covered. |
| Implementation deviation | Pass | Both pre-guard setup deviations stopped before live authority; the one actual invocation was durably finalized and not retried. |
| Verification trust | Pass | Correct `edge-runtime.log`, metrics, Node tunnel log, guard, process, and artifacts agree on two Plan-malformed requests and zero later stages. |
| Spec conformance | Fail | S12 requires one ingress and a successful Gemini -> Ornith-fast -> Gemini path. |

### Findings

- Required R23 — `apps/edge/internal/openai/single_request_provider_stage.go:209`: admit and discard only the bounded standard Chat Completions `usage` object in the private stage response envelope. Preserve duplicate/unknown top-level rejection, add `usage` to the success fixture, and prove standard usage passes while unrecognized top-level members still fail closed.
- Required R24 — `scripts/e2e-single-request-claude.sh:916`: set `CLAUDE_CODE_DISABLE_TERMINAL_TITLE=1` only in the supervised child. Require it in the fake under an opposing parent value, and use a delayed provider-free capture to prove installed Claude 2.1.177 emits exactly one actual tool-bearing request with retry count zero and no title-schema request.
- Required R25 — after R23/R24, rebuild/restart the disposable Edge, refresh runtime evidence, repeat provider-free gates, and use the user's task-scoped continuing authorization for one distinct `sole-live-9` guarded Claude-through-IOP invocation. Never reuse `sole-live-8`, call a provider directly, or retry the wrapper; publish only full schema-valid S12 evidence.

### Routing Signals

- `evaluation_mode=isolated-reassessment`
- `verdict=FAIL`
- `review_rework_count=24`
- `evidence_integrity_failure=false`
- `next_state=plan`
- `finalizer=finalize-task-policy.sh`
- `finalizer_mode=pair`
- build route `worker/cloud/G10`; review route `review/cloud/G10`
