<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=19 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Repair Claude thinking-redaction request compatibility

## For the Implementing Agent

Repair only the thinking-redaction boundary independently proven after `sole-live-4.rc-69`: accept the exact installed Claude 2.1.177 beta `redact-thinking-2026-02-12` and optional `thinking.display` values `omitted|summarized`. Keep both non-authoritative in decoded Chat/single-request routing, preserve native raw behavior, reject all other display values, rebuild only the disposable isolated dev Edge, and verify with provider-free `/count_tokens` probes. Do not run Claude, Gemini, Ornith, another harness `--run`, or any direct provider generation request.

## Background

The fourth authorized Claude-through-IOP call failed HTTP 400 before admitted ingress and was finalized as `sole-live-4.rc-69` with no retry. Static inspection of the exact installed Claude request builder shows a mutually paired path: it normally emits `redact-thinking-2026-02-12`, but removes that beta when explicit `thinking.display` is present. The current disposable Edge independently returns 400 for the beta, `display="omitted"`, and `display="summarized"`, while baseline returns 200 and ingress remains zero. The deleted live error body prevents claiming which member caused the call, so repair both members of this single bounded installed-client boundary and nothing adjacent.

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_18.log` / `code_review_cloud_G10_18.log`; verdict `FAIL`, Required R12, `review_rework_count=17`, `evidence_integrity_failure=false`.
- Fourth execution evidence: immutable `sole-live-4.rc-69`, `live_rc=69`, HTTP 400 before ingress, ingress/process delta zero, no internal stage/model output/result/manifest, and retry count zero.
- Provider-free before matrix: baseline 200; `redact-thinking-2026-02-12` 400; `thinking.display=omitted` 400; `thinking.display=summarized` 400; invalid display 400; ingress delta zero.
- Disposable candidate/runtime roots remain `/Users/toki/agent-work/iop-s12-validation-20260808/source` and `/Users/toki/agent-work/iop-s12-managed-validation-20260808`; canonical `/Users/toki/agent-work/iop-dev` is read-only for this repair.

## Finding Resolution Map

| Finding | Mode | Exact evidence | Changed precondition |
|---|---|---|---|
| R12 | direct repository repair | Installed Claude builder, typed Edge schema, local regression tests, contract, isolated rebuild, exact provider-free before/after matrix | Both variants of the installed thinking-redaction request path are independently known and can be qualified without a model call. |

## Analysis

### Files Read

- `apps/edge/internal/openai/anthropic_types.go`
- `apps/edge/internal/openai/anthropic_bridge_test.go`
- `agent-contract/outer/anthropic-compatible-api.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-owned-single-request-agent-execution.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md`
- `agent-test/dev/rules.md`
- `agent-test/dev/edge-smoke.md`
- `scripts/e2e-single-request-claude.sh`
- Exact installed Claude 2.1.177 binary request-builder fragments on the dev Mac.

### SDD Criteria

SDD S12 remains unqualified until a separately authorized real Claude request proves ingress 1, ordered Gemini -> Ornith-fast -> Gemini stages, timings, workspace result/cleanup, and one terminal. This repair may only restore input compatibility and provider-free readiness; it must not publish S12 success.

### Verification Context

- Local source tests run in the current checkout.
- Dev verification uses the isolated source on `toki@toki-labs.com` (Darwin/arm64), not canonical dev.
- The SOPS caller authenticates only `/count_tokens` requests to IOP and remains in process memory. `/count_tokens` must not increment single-request ingress or provider generation activity.
- Rebuild only the isolated Edge binary, refresh runtime evidence atomically, and retain recoverable pre-repair binary/evidence backups.

### Test Coverage Gaps

- No test currently accepts the redacted-thinking beta.
- Strict decoding currently rejects every `thinking.display`; there is no enum validation or normalized omission assertion.
- Current provider-free matrix proves only the pre-repair 400s.

### Symbol References

- `supportedAnthropicBetas`
- `anthropicThinkingConfig`
- `decodeAnthropicMessageRequest`
- `TestAnthropicChatBridgeClaudeCodeRequest`
- `TestAnthropicChatBridgeRejectsUnsupportedBeforeWire`

### Split Judgment

The beta, display enum, normalized omission, contract, isolated rebuild, and status matrix are one small compatibility boundary and should remain one packet.

### Scope Rationale

Exclude `strict`, `eager_input_streaming`, other installed betas, display values beyond `omitted|summarized`, routing or provider authority, model generation, live retry, canonical dev mutation, dispatcher/Pi execution, and common Agent-Ops changes.

### Final Routing

- `evaluation_mode=isolated-reassessment`; `finalizer=finalize-task-policy.sh`; `finalizer_mode=pair`.
- Build `worker/cloud/G10`, `PLAN-cloud-G10.md`; review `review/cloud/G10`, `CODE_REVIEW-cloud-G10.md`.
- `base_route_basis=grade-boundary`; scores `2/2/2/2/2`; `large_indivisible_context=true`.
- Loop risks: `temporal_state`, `concurrent_consistency`, `boundary_contract`, `variant_product`; count 4.
- `review_rework_count=17`, `evidence_integrity_failure=false`.

## Implementation Checklist

- [x] Add the exact redacted-thinking beta and typed optional display enum validation.
- [x] Prove decoded Chat accepts supported variants, strips compatibility metadata, and rejects invalid display before provider wire.
- [x] Document native raw preservation and normalized non-authoritative omission.
- [x] Pass fresh local focused/race/harness/diff checks.
- [x] Synchronize only the changed repair files to the isolated source, rebuild/restart only disposable Edge, and verify exact provider-free after matrix with zero ingress/activity.
- [x] Fill implementation-owned sections in `CODE_REVIEW-cloud-G10.md` and stop for official review.

### REVIEW_API-1 — Add bounded request decoding

**Problem:** the strict Anthropic boundary rejects both variants of the installed Claude thinking-redaction path.

**Solution:** add `redact-thinking-2026-02-12` to the existing allowlist, add optional `Display` to `anthropicThinkingConfig`, and accept only empty, `omitted`, or `summarized`.

**Modified Files and Checklist:**

- [x] `apps/edge/internal/openai/anthropic_types.go` — beta, typed field, enum validation.

**Test Strategy:** source-level accepted and rejected request cases.

**Verification:** supported variants decode; invalid/scalar/unknown fields remain 400.

### REVIEW_API-2 — Lock non-authoritative bridge behavior

**Problem:** compatibility metadata must not gain Chat/provider/routing authority.

**Solution:** extend the representative Claude request and focused tests to assert the beta header and `thinking.display` do not appear in normalized Chat/provider wire; retain adjacent rejection cases.

**Modified Files and Checklist:**

- [x] `apps/edge/internal/openai/anthropic_bridge_test.go` — acceptance, omission, and fail-closed regression tests.

**Test Strategy:** fake provider bridge and count-token decoder tests.

**Verification:** one accepted provider wire for supported Chat bridge cases, zero provider wires for invalid display.

### REVIEW_API-3 — Synchronize the contract

**Problem:** accepted beta/display syntax and authority boundaries need an explicit public contract.

**Solution:** list the beta, define `omitted|summarized`, native raw preservation, and decoded normalized omission/non-authority.

**Modified Files and Checklist:**

- [x] `agent-contract/outer/anthropic-compatible-api.md` — bounded compatibility semantics.

**Test Strategy:** source/contract string assertions and diff review.

**Verification:** contract matches implementation without claiming S12 success.

### REVIEW_API-4 — Qualify the disposable dev boundary without generation

**Problem:** local acceptance alone does not prove the running candidate.

**Solution:** sync only the three changed files, test and rebuild isolated Edge, restart it with the existing managed runtime, then run authenticated `/count_tokens` probes.

**Modified Files and Checklist:**

- [x] `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md` — exact build/runtime/status/zero-activity evidence.

**Test Strategy:** baseline/redact-beta/display-omitted/display-summarized must be 200; invalid display, `strict`, and `eager_input_streaming` must be 400.

**Verification:** ingress/activity delta zero, zero Claude processes, four finalized guards unchanged, no result/manifest, preflight only if certificate/runtime validity permits.

## Modified Files Summary

| File | Item |
|---|---|
| `apps/edge/internal/openai/anthropic_types.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/anthropic_bridge_test.go` | REVIEW_API-2 |
| `agent-contract/outer/anthropic-compatible-api.md` | REVIEW_API-3 |
| `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md` | REVIEW_API-4 |

## Final Verification

1. `gofmt -w apps/edge/internal/openai/anthropic_types.go apps/edge/internal/openai/anthropic_bridge_test.go`
2. `go test -count=1 ./apps/edge/internal/openai`
3. `go test -count=1 -race ./apps/edge/internal/openai ./apps/edge/internal/service`
4. `bash -n scripts/e2e-single-request-claude.sh && scripts/e2e-single-request-claude.sh --self-test`
5. `git diff --check` and focused contract/redaction/task checks.
6. Isolated remote focused/race tests, Edge rebuild/restart/identity verification, exact provider-free 200/200/200/200 and 400/400/400 matrix, zero activity/Claude process, unchanged four guards, absent artifacts, and harness preflight when valid.

After completing all changes, fill implementation-owned sections in `CODE_REVIEW-cloud-G10.md`.
