<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=15 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - Claude prompt-caching-scope compatibility

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> Execute the plan's selected root cause, scope, files, and dependency decisions as written. Do not choose another owner, narrow/expand the write boundary, or replace the fix with another verification attempt.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=15, tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_14.log` / `code_review_cloud_G10_14.log`; verdict `FAIL`, rework 13.
- Required R8 is the deterministic `prompt-caching-scope-2026-01-05` allowlist gap. The current provider-free IOP probe returns HTTP 400.
- Both live authorizations are consumed and preserved as `sole-live.rc-69` and `sole-live-2.rc-69`; no Claude/provider live call is allowed in this packet.

## For the Review Agent

Compare implementation of each item against source files and verify that output in `Verification Results` matches code. Review completion means: append verdict/routing signals; archive the active pair; on WARN/FAIL fully materialize the next state; on PASS only write completion evidence and archive the task; then check applicable review-only items at the final log location.

## Implementation Item Completion

| Item | Status |
|---|---|
| COMPAT-1 | [x] |
| BRIDGE-2 | [x] |
| CONTRACT-3 | [x] |
| PROVIDER-FREE-4 | [x] |
| REVIEW-EVIDENCE-5 | [x] |

## Implementation Checklist

- [x] Add only the missing prompt-caching-scope beta and retain strict unknown-beta rejection.
- [x] Prove normalized Gemini/Ornith routing and payload authority are unchanged.
- [x] Synchronize the external Anthropic compatibility contract.
- [x] Pass fresh local and managed macOS provider-free IOP gates.
- [x] Preserve both live guards and perform no Claude/provider generation or retry.
- [x] Leave success-only S12 evidence/spec qualification deferred.
- [x] Fill implementation-owned review evidence and stop for official review.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify verdict, dimension assessment, and Required/Suggested/Nit classifications.
- [x] Archive the active review and plan using the next collision-free suffix.
- [x] Verify the Agent-Ops managed `.gitignore` block tracks task markdown/log files and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log`, preserve milestone metadata, archive the task directory, and handle the active parent as required.
- [x] If WARN/FAIL, write the next filesystem state matching the verdict and do not write `complete.log`.

## Deviations from Plan

- The macOS non-login shell has no `/usr/bin/ps`; the restart preflight stopped before mutation and was repeated with canonical `/bin/ps`.
- The system Xcode Python 3.9 TLS stack rejected the managed endpoint protocol during handshake before any IOP request. The identical in-memory provider-free checker was repeated with `/opt/homebrew/bin/python3` using OpenSSL 3.6.3 and passed. No Claude or provider call occurred in either case.
- The disposable Edge restart changed only the Edge process from PID 93597 to PID 698. Control Plane PID 89097 and Node PID 89104 stayed alive; a recoverable `iop-edge.pre-prompt-scope` binary and `runtime-evidence.pre-prompt-scope.json` backup were retained.

## Key Design Decisions

- The code change is one allowlist entry: `prompt-caching-scope-2026-01-05`. No other beta, `speed`, `diagnostics`, cache behavior, route behavior, or workspace authority was added.
- The representative Claude Code bridge test now sends the beta and explicitly proves that normalized Chat provider headers do not contain `Anthropic-Beta`; existing cache-controlled content mapping and unknown-beta before-wire rejection remain in the same test package.
- The contract describes the beta as caller compatibility metadata only. Native Messages tunnel forwarding remains unchanged, while normalized Gemini/Ornith Chat routing receives neither the beta nor new authority.
- The remote caller secret came from SOPS only into process memory and authenticated catalog/count-token/preflight requests to IOP. No provider generation, direct Gemini/Ornith/Claude request, or live guard was created.

## Reviewer Checkpoints

- Confirm only `prompt-caching-scope-2026-01-05` was added and unknown betas still fail before provider wire.
- Confirm the beta grants no cache/routing/workspace authority and is absent from normalized Gemini/Ornith payloads.
- Confirm the exact provider-free IOP probe changes from HTTP 400 to 200 with zero generation counters.
- Confirm both live guards, canonical dev, workspace/result/manifest, secrets, and raw output remain unchanged.

## Verification Results

### 1. Static boundary and code repair

- Installed Claude Code 2.1.177 inspection showed `l8()` remains `firstParty` with a custom `ANTHROPIC_BASE_URL`, `NN()` therefore remains enabled, and `Sk8()` adds `prompt-caching-scope-2026-01-05` for the custom non-Haiku model. Noninteractive `--print` suppresses redact-thinking, fast mode is off, and custom-base `T3()` is false, so `speed` and `diagnostics` are outside this request.
- Before repair, the exact authenticated IOP `count_tokens` request with the bounded default beta set returned HTTP 400. `supportedAnthropicBetas` now adds only `prompt-caching-scope-2026-01-05`.
- Existing `unknown-beta-2099-01-01` coverage still requires HTTP 400 and zero provider-wire requests. No request schema field, routing selector, provider binding, or workspace policy changed.

### 2. Local tests and contract

- Focused `TestAnthropic(ChatBridgeClaudeCodeRequest|ChatBridgeRejectsUnsupportedBeforeWire|ContextManagementNullCompatibility)`: PASS locally (`0.040s`) and on macOS (`0.548s`).
- `go test -count=1 -race ./apps/edge/internal/openai ./apps/edge/internal/service`: PASS locally (`openai` 12.678s, `service` 9.282s) and on macOS (`openai` 12.943s, `service` 9.776s).
- `bash -n scripts/e2e-single-request-claude.sh` and harness `--self-test`: PASS; no harness behavior changed in this plan.
- Contract/source assertions: PASS for the exact allowlist entry, representative bridge header omission, unknown-beta rejection, and non-authoritative cache/route/stage/provider/workspace/authorization wording.

### 3. Managed provider-free IOP validation

- Only the three reviewed files were synchronized to `/Users/toki/agent-work/iop-s12-validation-20260808/source`. The disposable Edge candidate built, reported version, and passed `config check` before restart.
- Managed runtime after restart: Control Plane PID 89097, Edge PID 698, Node PID 89104; Control Plane health HTTP 200 and `edge-smoke` registration status HTTP 200.
- Current fleet status: one online Edge, one connected Node, and two provider snapshots, both `available` / `healthy`.
- Runtime evidence was regenerated atomically for the new binary and exact current source/config. Harness `--preflight-only`: PASS without a Claude invocation; output remained absent.
- Authenticated catalog: HTTP 200 with `iop-single-request-light` count exactly 1. Exact prompt-caching-scope `count_tokens`: HTTP 200 with a positive integer `input_tokens`.
- Before/after totals for single-request ingress, hot-path stage/dispatch/terminal/cleanup/orphan, observation records, and model-output markers were identical; every delta was zero.

### 4. No-live, privacy, and success-only state

- Claude canonical-process detector remained zero before/after provider-free probes and preflight. Claude `--run`, Gemini, Ornith-fast, and all provider generation were not invoked.
- Both `sole-live.rc-69` and `sole-live-2.rc-69` remain directories; no `sole-live*.started` or third guard exists and retry count is zero.
- Disposable `smoke-result.txt`, remote output manifest, and stable S12 qualification manifest remain absent. No success-only S12 qualification wording was added to runtime/input specs.
- SOPS caller material, provider credentials, request bodies, raw responses, model output, and digests were not printed or tracked. Temporary values existed only in process memory.
- Canonical `/Users/toki/agent-work/iop-dev` was not written. Managed binary/runtime-evidence backups make the disposable Edge change recoverable.

### 5. Final hygiene

- `gofmt` and `git diff --check`: PASS.
- Focused secret/redaction scan over the changed source/test/contract diff: PASS for private-key, AGE-key, Anthropic/OpenAI/Gemini credential patterns and raw response markers.
- Active plan/review headers agree on plan 15, task, tag, and `milestone-task=workspace-binding,claude-smoke`; archived pair 14 exists with final verdict/checklist and the Agent-Ops `.gitignore` block is intact.
- The working tree contains unrelated/pre-existing changes, including existing spec modifications; this plan did not edit or revert them. Its write set is limited to the allowlist, representative test, contract, active task evidence, and KST work log.

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---|---|---|
| Header, Overview, Review Agent Instructions | Fixed | Implementer does not alter review finalization state |
| Archive Evidence Snapshot | Fixed | Read only cited evidence when needed |
| Implementation Item Completion | Implementer checks status only | Item names stay fixed |
| Implementation Checklist | Implementer checks status only | Text/order stays fixed |
| Review-Only Checklist | Review agent only | Implementer does not modify |
| Deviations, Key Design Decisions | Implementer | Replace placeholders with actual evidence |
| Reviewer Checkpoints | Fixed | Pre-filled from plan |
| Verification Results | Implementer | Fill exact outcomes; deviations must be recorded |
| Code Review Result | Review agent | Appended after implementation |

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Pass | The exact missing beta is accepted, unrelated unknown betas remain rejected, and normalized Chat forwarding/routing authority is unchanged. |
| Completeness | Fail | Repository and provider-free managed validation are complete, but the required real Claude-through-IOP S12 execution has not been rerun after the repair. |
| Test coverage | Pass | Focused bridge tests, local/remote race suites, harness self-test/preflight, before/after provider-free HTTP status, zero generation deltas, and fleet checks all pass. |
| API contract | Pass | Source and external contract agree on the allowlist, native-tunnel distinction, normalized omission, and non-authoritative semantics. |
| Code quality | Pass | The implementation adds one sorted allowlist entry, one focused header assertion, and bounded documentation with no speculative fields or debug behavior. |
| Implementation deviation | Pass | macOS path/TLS corrections occurred before any mutating or live request boundary; the disposable Edge restart and recoverable backups stayed within the plan. |
| Verification trust | Pass | Fresh local/macOS results, exact HTTP 400-before/200-after probe, runtime-evidence preflight, zero activity deltas, and unchanged guards are mutually consistent. |
| Spec conformance | Fail | The milestone still requires one actual Claude request with ingress 1, ordered Gemini -> Ornith-fast -> Gemini stages, workspace verification, one terminal, and redacted timing evidence. |

### Findings

- Required R9 — `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-owned-single-request-agent-execution.md:90`: the repository-owned compatibility boundary is now closed, but S12 cannot be qualified from provider-free evidence. A new user-controlled external execution must authorize exactly one additional Claude Code `--run` against the repaired disposable managed IOP runtime. The run must use a new `sole-live-3.started` -> `sole-live-3.rc-<live_rc>` guard, SOPS `tokens.toki-dev-cline` only for Claude-to-IOP authentication, canonical Claude 2.1.177 plus the managed CA, and IOP-owned Gemini plan/review and Ornith-fast work routes, with no direct provider request and no retry. The prior authorization was consumed by `sole-live-2.rc-69`, so automatic continuation is unsafe without a new explicit authorization.

### Routing Signals

- `review_rework_count=14`
- `evidence_integrity_failure=false`

### Next Step

USER_REVIEW — request explicit authorization for exactly one new guarded Claude-through-IOP live execution on `toki@toki-labs.com`; after authorization, archive the user-review stop into a fresh routed one-run packet. Do not ask the user to choose Gemini/Ornith routing, and never call either provider directly.
