<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=7 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> Execute the plan's selected root cause, scope, files, and dependency decisions as written. Do not choose another owner, narrow/expand the write boundary, or replace a fix with another verification attempt.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=7, tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Immediate prior pair: `plan_cloud_G10_6.log` / `code_review_cloud_G10_6.log`; verdict `FAIL`, `review_rework_count=5`, `evidence_integrity_failure=false`.
- Resolved gate: `user_review_2.log` authorizes exactly one new live call using the canonical remote executable and API-key authentication.
- Changed precondition: a temporary empty `CLAUDE_CONFIG_DIR` makes the selected CLI report `loggedIn=True`, `authMethod=api_key`, `apiProvider=firstParty`; the value is not printed or persisted.
- Frozen candidate: remote HEAD `70d22850d01714fdef734dafa42e82fed79e0786`, Edge PID `35091`, Node PID `25114`, health 200, ingress 0, absent result/manifest.

## For the Review Agent

> **[REVIEW AGENT ONLY]** Append the verdict, archive this pair to suffix 7, write `complete.log` and move the task only on PASS, otherwise materialize the required next state. Preserve `milestone-task=workspace-binding,claude-smoke` for runtime aggregation and do not edit roadmap state directly.

## Implementation Item Completion

| Item | Status |
|---|---|
| REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-1 | [x] |
| REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-2 | [ ] |
| REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-3 | [ ] |
| REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-4 | [x] |

## Implementation Checklist

- [x] Revalidate the frozen disposable candidate and clean-config `api_key` auth, then pass one zero-child preflight with ingress 0 and absent result/manifest.
- [ ] Consume exactly one live Claude invocation under the isolated API-key config without retry and require the harness-owned atomic redacted manifest.
- [ ] Validate and atomically publish the stable local manifest, then synchronize bounded S12 qualification wording in the Anthropic contract and two living specs only after manifest PASS.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementing agents must not modify this section.

- [x] Append one verdict and verified `review_rework_count` / `evidence_integrity_failure`.
- [x] Verify verdict dimensions and finding severity.
- [x] Archive this file to `code_review_cloud_G10_7.log`.
- [x] Archive `PLAN-cloud-G10.md` to `plan_cloud_G10_7.log`.
- [x] Verify generated task artifacts are not ignored.
- [ ] If PASS, write `complete.log`, move the task under `agent-task/archive/2026/08/`, and report runtime completion metadata.
- [x] If WARN/FAIL, write the next state and do not write `complete.log`.

## Deviations from Plan

- Final Verification 4 used `status=$?` in the remote zsh wrapper. `status` is a zsh read-only special parameter, so after the harness had already reported `Claude invocation failed (status 1)`, the wrapper emitted `zsh:1: read-only variable: status` and returned 1 instead of preserving the harness exit 69. This happened after the sole Claude child ended and did not create another invocation.
- The authorized live call was not retried. Success-only commands 5-7 were skipped.

## Key Design Decisions

- The clean temporary config correctly forced `loggedIn=True`, `authMethod=api_key`, `apiProvider=firstParty`; API-key selection was not the remaining failure.
- Static inspection of the installed 2.1.177 executable after the consumed call found the exact built-in validation text `Error: When using --print, --output-format=stream-json requires --verbose`. The harness command at `scripts/e2e-single-request-claude.sh:801-804` supplies `--print --output-format stream-json` but omits `--verbose`. Together with child status 1 and ingress 0, this identifies a pre-HTTP CLI option-validation failure; raw child stderr was not retained and was not read.
- The remote failure state is ingress 0, result absent, manifest absent, Claude child absent, and temporary config absent. The local manifest and three deferred qualification documents remain unchanged.

## Reviewer Checkpoints

- Confirm `authMethod=api_key` under a temporary empty config before the zero-child and live commands.
- Confirm the live harness command occurs exactly once and no retry, direct API call, alternate executable, or replacement provider call occurs.
- Confirm ingress remains 0 before live execution and becomes exactly 1 only on successful manifest production.
- Confirm the manifest contains no credential, endpoint, path, raw output/tool/provider data, or unbounded identifier.
- Confirm the three owner documents change only after manifest PASS and state a bounded selected-runtime/run qualification without making macOS a product requirement.

## Verification Results

Paste actual secret-safe stdout/stderr and exit status. Never paste the credential, raw Claude captures, workspace result content, raw observation lines, or temporary config paths.

### 1. Local no-provider gate

Command: Final Verification 1 from `PLAN-cloud-G10.md`.

Output:

```text
./scripts/e2e-single-request-claude.sh --self-test
[single-request-claude-smoke] self-test passed: exact Claude base-route coverage, model/Edge/Node/runtime binding, zero-child preflight, derived verification, redaction, cleanup, signal handling, and atomic publication
ok  iop/apps/edge/internal/service  1.054s
ok  iop/apps/edge/internal/openai   1.083s
exit status: 0
```

### 2. Exact remote candidate and API-key selection check

Command: Final Verification 2 from `PLAN-cloud-G10.md`.

Output:

```text
auth=api_key
exit status: 0
```

### 3. One zero-child preflight with isolated API-key config

Command: Final Verification 3 and its read-only absence check.

Output:

```text
auth=api_key
[single-request-claude-smoke] preflight passed without a Claude invocation
ingress=0 result=absent manifest=absent
exit status: 0
```

### 4. Sole live Claude invocation

Command: Final Verification 4 exactly once with no retry.

Output:

```text
auth=api_key
[single-request-claude-smoke] validation failed: Claude invocation failed (status 1)
zsh:1: read-only variable: status
wrapper exit status: 1
```

The single live authorization was consumed. No retry, direct API call, alternate executable, or replacement provider call was made.

Read-only post-failure state:

```text
ingress=0 result=absent manifest=absent claude_child=absent temp_config=absent
exit status: 0
```

### 5. Remote closed-evidence check

Command: Final Verification 5 only after live success.

Output:

```text
Not run. The live harness did not succeed and no remote manifest exists.
```

### 6. Atomic local evidence publication

Command: Final Verification 6 only after remote validation.

Output:

```text
Not run. No validated remote manifest exists; the local stable manifest remains absent.
```

### 7. Evidence-gated document and final hygiene check

Command: Final Verification 7 after updating only the three owners.

Output:

```text
Not run. Manifest PASS is absent, so the three owner documents retain deferred S12 wording.
```

## Section Ownership

| Section | Owner | Note |
|---|---|---|
| Header, Overview, Archive Evidence, Reviewer instructions/checkpoints | Fixed at stub creation | Implementing agent must not modify. |
| Implementation completion/checklist | Implementing agent | Check only after matching evidence exists. |
| Review-Only Checklist | Review agent | Implementer must not modify. |
| Deviations, Key Design Decisions, Verification Results | Implementing agent | Replace placeholders with actual safe evidence. |
| Code Review Result | Review agent | Appended only by official review. |

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Result | Evidence |
|---|---|---|
| Correctness | Fail | The canonical Claude 2.1.177 executable rejects `--print --output-format=stream-json` without `--verbose`; the harness command omits that required flag and exits before HTTP ingress. |
| Completeness | Fail | The sole live call produced ingress 0, no workspace result, no manifest, and no S12 document promotion. |
| Test coverage | Fail | The harness self-test passed even though its fake CLI help and invocation do not require `--verbose`, so it does not model the installed CLI's argument contract. |
| API contract | Pass | No public API, wire, config, or qualification statement changed; the three owners correctly remain deferred. |
| Code quality | Pass | Failure cleanup removed the child and temporary config, left no raw/secret artifact, and preserved the no-retry boundary. |
| Implementation deviation | Warn | The live wrapper used zsh's read-only `status` parameter and therefore returned 1 after the harness failure instead of preserving exit 69; this did not cause a second call or change the failure state. |
| Verification trust | Pass | Clean-config auth, preflight, ingress/output absence, installed-binary static validation text, and harness argument source agree. No raw child stderr was reconstructed or claimed as captured evidence. |
| Spec conformance | Fail | SDD S12 still lacks one actual accepted request, ordered stages/timing, changed verified workspace, and terminal evidence. |

### Findings

- **Required R1** — `scripts/e2e-single-request-claude.sh:657,803,1181,1197`: the harness validates and supplies `--print --output-format stream-json` without the installed CLI's required `--verbose`. The remote executable contains the exact validation `Error: When using --print, --output-format=stream-json requires --verbose`, the child exited 1, and ingress stayed 0. Add `--verbose` to required help flags and the supervised command, update fake help, and make the fake reject live invocation unless exactly one `--verbose` argument is present so self-test fails on regression.
- Nit — the next external command must use a non-reserved variable such as `live_rc` instead of zsh's read-only `status` parameter.

### Routing Signals

- `review_rework_count=6`
- `evidence_integrity_failure=false`

Five prior archived reviews have FAIL verdicts; this non-PASS result raises the rework count to six. The implementation and fresh review report the same clean-auth, zero-ingress, no-output failure state.

### Next Step

Create a fresh routed follow-up that fixes the repository-owned Claude CLI argument contract and deterministic fake coverage without another external provider invocation. After that repair is reviewed, a separate user-authorized one-run packet may resume S12.
