<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=11 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Execute S12 with the SOPS-managed IOP caller credential

## For the Implementing Agent

Use `tokens.toki-dev-cline` from the remote SOPS file only as Claude Code → IOP Edge caller authentication. Keep all Claude, Gemini, and other provider selection/credentials inside the already declared IOP runtime. This packet authorizes exactly one `--run` after zero-child preflight passes. Any live exit consumes authorization and forbids retry. Never output, copy, persist, or place a credential in argv.

## Background

`user_review_4.log` corrects the credential boundary: `/config/workspace/iop/token/.claude` is an IOP-internal Claude provider credential, not the Edge caller key. The remote SOPS file contains `toki-dev-cline` and `toki-dev-pi`; both decrypt in memory and match configured Edge principal hashes. The user selected `toki-dev-cline`, reaffirmed that all providers including Gemini run through IOP, and authorized one conditional live S12 call.

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_10.log` / `code_review_cloud_G10_10.log`; verdict `FAIL`, `review_rework_count=9`, `evidence_integrity_failure=false`.
- Repaired candidate script: `d19874140ee53985e9c13acdc9730190cc1975495a7222b7bbd6b17608ef0092`; runtime worktree digest `sha256:a759f41c83a1573eb2c52856f991093128b556733d2c3bc240fef1443db2e598`.
- Credential source: `/Users/toki/.config/iop/secrets/dev-openai-toki.sops.yaml`; AGE key `/Users/toki/.config/sops/age/keys.txt`; SOPS `/opt/homebrew/bin/sops`; selected token ref `toki-dev-cline`.
- Starting state: Edge/Node candidate processes unchanged, selected model configured, ingress 0, result/manifest absent, no Claude child/temp config.

## Finding Resolution Map

| Finding | Resolution | Completion evidence |
|---|---|---|
| R3 | Decrypt only `tokens.toki-dev-cline` into the remote runner process, verify it still matches the configured principal hash without emitting either value/hash, and pass authenticated zero-child catalog admission with unchanged ingress. | Closed preflight PASS and `ingress=0/result=absent/manifest=absent`. |
| S12 | Execute the repaired harness once with the same caller token and existing IOP provider routing. | Schema-valid redacted manifest proving ingress delta 1, ordered `gemini -> ornith-fast -> gemini`, timing, changed verified workspace, and one terminal. |
| S12-doc | On manifest PASS only, publish stable evidence and update the contract/two specs with bounded selected-runtime wording. | Validated identical remote/local manifest and bounded document assertions. |

## Scope and Safety

- Do not change the Edge/Node config, provider routing, credentials, processes, canonical dev checkout, product runtime code, schema, roadmap, or SDD.
- SOPS plaintext may exist only in the remote shell/Claude child environment. Decrypt through a pipe into a shell variable, never a file; unset it after preflight/live and delete the temporary Claude config.
- The installed CLI's `auth status=api_key` is selection evidence; the repaired authenticated model probe is actual caller/model admission evidence.
- Success-only local writes: stable redacted manifest, Anthropic contract, runtime spec, input spec, and active review.

## Final Routing

- Finalizer `pair`; build `grade-boundary`, scores `2/2/2/2/2`, large context, four risks, `review_rework_count=9`, `evidence_integrity_failure=false` => cloud `G10`.
- Review `official-review`, scores `2/2/2/2/2` => cloud `G10`.

## Dependencies and Execution Order

1. Revalidate local syntax/self-test/focused races/source assertions and absent local manifest.
2. Revalidate exact remote script/runtime/process/state and SOPS-to-config principal binding without outputting secrets or hashes.
3. With a fresh `CLAUDE_CONFIG_DIR`, decrypt `toki-dev-cline` in memory and pass one `--preflight-only`; require unchanged ingress 0 and absent result/manifest.
4. With another fresh config and the same in-memory caller token, execute `--run` exactly once using `live_rc`. Never retry.
5. On success only, validate/copy the manifest atomically, synchronize the three qualification owners, and run final hygiene.
6. Fill the active review and stop for official review.

## Implementation Checklist

- [ ] Pass local and exact remote no-provider gates.
- [ ] Pass authenticated zero-child preflight using SOPS `toki-dev-cline`.
- [ ] Execute exactly one live S12 call with no retry and require the closed manifest.
- [ ] On PASS only, publish evidence and bounded qualification wording.
- [ ] Fill implementation-owned review evidence.

## Modified Files Summary

| File | Reason |
|---|---|
| `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json` | Success-only redacted S12 manifest |
| `agent-contract/outer/anthropic-compatible-api.md` | Success-only bounded qualification |
| `agent-spec/runtime/edge-node-execution.md` | Success-only runtime evidence link |
| `agent-spec/input/openai-compatible-surface.md` | Success-only input evidence link |
| `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md` | Safe execution/review evidence |

## Final Verification

1. Local no-provider: credential/source existence and permissions without reading values, manifest absence, `bash -n`, deterministic self-test, two focused race tests, source assertions, and `git diff --check`.
2. Remote identity: exact HEAD/script/runtime worktree/process/model/state plus memory-only SOPS decryption and configured principal-hash match.
3. Zero-child: fresh config, SOPS `toki-dev-cline` as `ANTHROPIC_API_KEY`, safe auth projection, repaired `--preflight-only`, unchanged ingress 0, result/manifest absent, child/temp absent.
4. Sole live: same isolation in a new config, repaired `--run` exactly once, capture `live_rc`, clean/unset, and stop on any non-zero.
5. Success-only: validate remote manifest, require ingress 1/result+manifest present, copy atomically, validate locally, update only three owners, and run redaction/hygiene checks.

After implementation, fill `CODE_REVIEW-cloud-G10.md`.
