<!-- task=m-principal-provider-credential-slot-routing/10+08,09_verification_contracts plan=3 tag=REVIEW_REVIEW_TEST milestone-task=slot-smoke,contract-ops -->

# Repair managed API-key lease issuance and private-key evidence guards

## For the Implementing Agent

Implement only this follow-up scope. Preserve unrelated dirty-worktree changes. Run every applicable verification command with fresh output and fill all implementation-owned sections in `CODE_REVIEW-*-G??.md`, then leave the active pair in place and report ready for review. Final verdicts, user-review classification, task logs, `complete.log`, archive moves, and roadmap changes belong only to the official review/runtime flow. If blocked, record the exact command, output, blocker, and resume condition; do not ask the user, call user-input tools, create stop files, substitute evidence, or execute the live provider command unless authorization is already supplied through the execution context.

## Background

The deterministic credential-slot smoke now reaches the managed Chat route but fails the Messages route because the Control Plane passes the built-in lowercase `x-api-key` profile header into a lease scope that intentionally accepts only canonical header spelling. The same review found that the evidence scan cannot detect the generic PKCS#8 private-key marker emitted by the smoke helper. This follow-up authorizes the narrow production fix, its regression coverage, a positive-control leak guard, removal of the temporary blocker caveats, and fresh deterministic evidence; it does not redesign the credential lease or public auth model.

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/plan_cloud_G10_2.log`.
- Prior review: `agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/code_review_cloud_G10_2.log`.
- Verdict: FAIL. Findings: 2 Required, 0 Suggested, 0 Nit. Routing signals: `review_rework_count=2`, `evidence_integrity_failure=true`.
- Required scope: canonicalize the resolved profile header at the Control Plane lease-issuance boundary and prove API-key lease consumption; make the smoke and repository evidence detect generic PKCS#8 private-key markers with a positive control; rerun complete deterministic qualification; replace the temporary managed API-key blocker statements with repaired behavior.
- Fresh reviewer evidence: syntax, fixture validation, live-gate self-test, focused Go tests/vet, pointer checks, stale-claim checks, and `git diff --check` passed. `TMPDIR` on an executable workspace path made the environment reproducible. `make test-credential-slot-smoke` exited 2: Chat reached Node/upstream once, Messages returned sanitized HTTP 502 before a second Node/upstream call. A literal `-----BEGIN PRIVATE KEY-----` probe did not match the existing regex.
- The broad `./packages/go/...` command also exposed unrelated external-`TMPDIR` permission/xattr failures in `packages/go/agentprovider/cli` and `packages/go/agentworkspace`; those packages are outside this repair and are not a success gate. The affected package set passed fresh.
- Predecessor gates remain satisfied by `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/complete.log` and `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/09+08_migration_attribution/complete.log`. Do not search archive siblings.
- Roadmap carryover: milestone `principal-provider-credential-slot-routing`, task ids `slot-smoke,contract-ops`, SDD scenarios S16-S17 with the S12 adapter-injection invariant. Implementation must not write `complete.log` or change roadmap state.

## Roadmap Targets

- Phase: `agent-roadmap/phase/operational-observability-provider-management/PHASE.md`
- Milestone: `agent-roadmap/phase/operational-observability-provider-management/milestones/principal-provider-credential-slot-routing.md`
- SDD: `agent-roadmap/sdd/operational-observability-provider-management/principal-provider-credential-slot-routing/SDD.md`
- Task ids: `slot-smoke`, `contract-ops`
- Acceptance: S16 deterministic vendor/profile/two-slot qualification plus one explicitly authorized representative live request with safe evidence; S17 canonical contract/spec/runbook drift checks and no raw-secret evidence.

## Analysis

### Files Read

- `agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/PLAN-cloud-G10.md`
- `agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/CODE_REVIEW-cloud-G10.md`
- `agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/code_review_cloud_G07_1.log`
- `agent-roadmap/phase/operational-observability-provider-management/PHASE.md`
- `agent-roadmap/phase/operational-observability-provider-management/milestones/principal-provider-credential-slot-routing.md`
- `agent-roadmap/sdd/operational-observability-provider-management/principal-provider-credential-slot-routing/SDD.md`
- `agent-test/local/rules.md`
- `agent-test/local/profiles/control-plane-smoke.md`
- `agent-test/local/profiles/edge-smoke.md`
- `agent-test/local/profiles/node-smoke.md`
- `agent-test/local/profiles/platform-common-smoke.md`
- `agent-test/local/profiles/testing-smoke.md`
- `apps/control-plane/internal/credentiallease/service.go`
- `apps/control-plane/internal/credentiallease/service_test.go`
- `packages/go/credentiallease/envelope.go`
- `packages/go/credentiallease/envelope_test.go`
- `packages/go/config/protocol_profile.go`
- `packages/go/config/protocol_profile_test.go`
- `scripts/e2e-credential-slot-smoke.sh`
- `scripts/fixtures/credential-slot-vendors.json`
- `agent-contract/index.md`
- `agent-contract/inner/client-control-plane-wire.md`
- `agent-contract/inner/control-plane-edge-wire.md`
- `agent-contract/inner/edge-node-runtime-wire.md`
- `agent-contract/inner/edge-config-runtime-refresh.md`
- `agent-contract/outer/openai-compatible-api.md`
- `agent-contract/outer/anthropic-compatible-api.md`
- `agent-spec/index.md`
- `agent-spec/control/control-plane-operations.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-spec/runtime/provider-pool-config-refresh.md`
- `agent-spec/input/openai-compatible-surface.md`
- `docs/edge-local-dev-guide.md`
- `docs/openai-usage-grafana.md`

### SDD Criteria

- The SDD is required, approved, and implementation-unlocked. First-line metadata preserves `milestone-task=slot-smoke,contract-ops`.
- S12 requires a valid Chat/Messages profile plus credential lease to place only the expected auth header upstream and never expose the raw secret. The API-key regression and complete two-profile smoke directly restore this invariant.
- S16 requires credential-free deterministic fixtures and an opt-in representative one-shot whose evidence contains only provider/model/safe slot ref/date/revision/result. This drives the full smoke and guarded live verification checklist items.
- S17 requires contract/spec index validation and a repository credential leak scan. This drives the blocker-caveat synchronization, positive-control private-key matcher, pointer check, and final leak scan.
- Evidence Map rows S16 (`slot-smoke`) and S17 (`contract-ops`) require the safe one-shot record and drift/raw-secret evidence respectively; they shape both the implementation checklist and final commands below.

### Verification Context

- No separate handoff was supplied. The current plan/review evidence, source, SDD, contracts/specs, local test rules, and reviewer reruns listed above are the verification sources.
- Reproduction used Go `go1.26.2 linux/arm64`, `jq`, `rg`, `openssl`, `sops`, and an executable `TMPDIR` below `/config/workspace`. Syntax, fixture, live-gate, affected tests/vet, pointer, stale-claim, and diff checks passed; the full smoke deterministically isolated lease issuance before Node/upstream as the Messages failure boundary.
- Fresh Go execution is required (`-count=1`); cached results are not acceptable. The deterministic smoke must make zero external provider calls. The live command remains opt-in, reads one secret from stdin, permits one request with retries disabled, and must not run without explicit authorization and readable encrypted-key inputs.
- External Verification Preflight: runner is this local Linux/aarch64 container; repository root/workdir is `/config/workspace/iop-s0`; observed branch is `agent/dispatcher-work-log-artifact-loop`, HEAD is `89ae148c628303e48ea09c5948c466ecc142c029`, and the checkout is intentionally dirty with broader milestone work. Local dirty source is authoritative and must not be synchronized or rebuilt from another checkout. Go is `/config/.local/bin/go`; `sops` is `/config/.local/bin/sops`; deterministic binaries/TLS/config are rebuilt under the task-selected executable temporary root. Live config paths are `/config/.config/sops/iop/openai.sops.yaml` and `/config/.config/sops/age/keys.txt`; the selected upstream is the built-in OpenAI profile host, while deterministic ports/process identities are loopback and dynamically allocated by the smoke. The preflight below rechecks branch/HEAD/dirty state, OS/arch, tools, readable live inputs, and opt-in before any external request. Any mismatch or missing authorization is recorded as a blocker; no source sync, provider substitution, port reuse, or retry is allowed.
- Confidence is high for the production defect and leak-guard defect because each has a direct source mismatch and reproducible boundary observation. The only remaining external gap is authorization/credential availability for the representative one-shot after deterministic verification passes.

### Test Coverage Gaps

- Existing Control Plane lease tests cover bearer `Authorization` only; no test exercises a built-in lowercase API-key profile through issuance and consumption. Add a regression.
- Existing smoke covers two managed profiles but currently stops at API-key lease issuance. The repaired full smoke is required to prove exact Chat/Messages injection, revocation, attribution, and no fallback.
- Existing leak evidence has no positive control for its regex. Add a generic PKCS#8 marker self-check before scanning actual artifacts.
- Documentation has no executable semantic test; pointer validation, stale-blocker search, deterministic smoke, and leak scan are the selected drift oracles.

### Symbol References

- None. No symbol is renamed or removed.

### Split Judgment

This remains one compact boundary: the resolved profile header must become the canonical signed lease header, the deterministic smoke must prove that behavior across Control Plane/Edge/Node, and the same passing behavior must replace temporary canonical documentation caveats. Splitting code, evidence matcher, and docs would permit another false qualification claim.

### Scope Rationale

- Keep `packages/go/credentiallease/envelope.go` strict; accepting arbitrary case there would weaken the canonical signed-scope invariant. Normalize the trusted profile instruction before `lease.Issue` instead.
- Do not change built-in profile declarations, public caller-auth equivalence, projection/wire schemas, Node injection, credential storage, fixture shape, or attribution labels; their behavior is already covered and the defect is localized to issuance normalization.
- Do not repair unrelated `agentprovider/cli` or `agentworkspace` external-filesystem tests and do not use the broad `./packages/go/...` command as a gate.
- Do not perform external provider execution without existing authorization and readable configured credentials. Record the exact blocker after all deterministic checks instead of substituting a local provider.

### Final Routing

- `evaluation_mode=isolated-reassessment`; `finalizer=finalize-task-policy.sh`; `finalizer_mode=pair`.
- Build closures: scope/context/verification/evidence/ownership/decision are closed. Scores: scope coupling 2, state concurrency 1, blast/irreversibility 1, evidence diagnosis 2, verification complexity 2; grade G08. Base route `local-fit`, final route `recovery-boundary`, cloud, filename `PLAN-cloud-G08.md`.
- Review closures: scope/context/verification/evidence/ownership/decision are closed. Scores: 2/1/1/2/2; route `official-review`, cloud G08, Codex `gpt-5.6-sol` xhigh, filename `CODE_REVIEW-cloud-G08.md`.
- `large_indivisible_context=false`; positive loop-risk signature: `boundary_contract` (count 1); risk boundary false.
- Recovery signals: `review_rework_count=2`, `evidence_integrity_failure=true`; recovery boundary true. No capability gap is present.

## Implementation Checklist

- [ ] Canonicalize the resolved managed API-key profile header at Control Plane lease issuance and add a fresh issuance/consumption regression.
- [ ] Make the credential-slot smoke detect generic PKCS#8 and existing private-key markers with a positive control, then complete deterministic Chat/Messages qualification.
- [ ] Replace temporary managed API-key blocker caveats with the repaired canonical lease behavior in the affected contract, spec, and operator guides.
- [ ] Run fresh scoped verification and the representative live one-shot only when authorization is already present; record exact outputs or the exact blocker.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## [REVIEW_REVIEW_TEST-1] Canonicalize API-key headers before lease issuance

### Problem

`apps/control-plane/internal/credentiallease/service.go:96-102` passes `profile.Auth.Header` unchanged into `lease.Issue`. Built-in Messages profiles use lowercase `x-api-key` at `packages/go/config/protocol_profile.go:183,271`, while `packages/go/credentiallease/envelope.go:301-309` deliberately rejects a noncanonical signed scope. The valid managed Messages route therefore fails closed after the secret-at-rest open but before Node/upstream.

### Solution

Add the standard HTTP package and canonicalize only the trusted resolved profile header at the issuance boundary. Leave `validateScope` unchanged so malformed, CR/LF-bearing, empty, and directly supplied noncanonical scopes still fail.

Before (`apps/control-plane/internal/credentiallease/service.go:96-102`):

```go
envelope, err := lease.Issue(lease.Scope{
    LeaseID: leaseID, PrincipalRef: b.GetPrincipalRef(), CredentialSlotRef: b.GetCredentialSlotRef(),
    RouteID: b.GetRouteId(), ProfileID: b.GetProfileId(), UpstreamTarget: b.GetUpstreamTarget(),
    NodeID: b.GetNodeId(), RecipientKeyID: b.GetRecipientKeyId(), HeaderName: profile.Auth.Header,
```

After:

```go
import "net/http"

headerName := http.CanonicalHeaderKey(profile.Auth.Header)
envelope, err := lease.Issue(lease.Scope{
    LeaseID: leaseID, PrincipalRef: b.GetPrincipalRef(), CredentialSlotRef: b.GetCredentialSlotRef(),
    RouteID: b.GetRouteId(), ProfileID: b.GetProfileId(), UpstreamTarget: b.GetUpstreamTarget(),
    NodeID: b.GetNodeId(), RecipientKeyID: b.GetRecipientKeyId(), HeaderName: headerName,
```

Add `TestAcquireCanonicalizesAPIKeyProfileHeader` beside the existing bearer test. Create a `seulgi_messages` route and API-key slot, acquire and consume its lease, then assert `HeaderName == "X-Api-Key"`, empty scheme, exact secret, and one opener call.

### Modified Files and Checklist

- [ ] `apps/control-plane/internal/credentiallease/service.go`: canonicalize the resolved header immediately before issuing the signed lease.
- [ ] `apps/control-plane/internal/credentiallease/service_test.go`: add the API-key built-in profile regression.

### Test Strategy

Write `TestAcquireCanonicalizesAPIKeyProfileHeader` in `apps/control-plane/internal/credentiallease/service_test.go`. It must exercise the actual durable slot/route lookup, lease issue, recipient consume, header/scheme, and secret material. Existing envelope tests remain the rejection coverage for invalid scope input.

### Verification

```bash
credential_smoke_parent="$(mktemp -d /config/workspace/iop-credential-slot-review.XXXXXX)"
trap 'rmdir "$credential_smoke_parent" 2>/dev/null || true' EXIT
TMPDIR="$credential_smoke_parent" go test -count=1 ./apps/control-plane/internal/credentiallease ./packages/go/credentiallease ./packages/go/config
rmdir "$credential_smoke_parent"
trap - EXIT
```

Expected: exit 0 with fresh execution; the new test consumes `X-Api-Key` material and the strict envelope package remains green.

## [REVIEW_REVIEW_TEST-2] Turn private-key scanning into trustworthy qualification evidence

### Problem

`scripts/e2e-credential-slot-smoke.sh:885-888` scans `BEGIN (AGE|OPENSSH|RSA|EC) PRIVATE KEY`, but the same script emits `-----BEGIN PRIVATE KEY-----` from PKCS#8 material. A literal marker probe currently exits 1, so a clean scan can be a false negative.

### Solution

Define one private-key marker expression that covers generic PKCS#8, encrypted PKCS#8, and the existing AGE/OpenSSH/RSA/EC forms (plus AGE secret-key text if retained). Before scanning artifacts, pipe the harmless literal marker `-----BEGIN PRIVATE KEY-----` into the matcher and fail if it is not detected. Reuse the same expression for actual capture files; never print matched secret values.

Before (`scripts/e2e-credential-slot-smoke.sh:885-888`):

```bash
if rg -a -n 'BEGIN (AGE|OPENSSH|RSA|EC) PRIVATE KEY|lease[_-]?id|credential qualification|QUALIFIED' \
    "${files[@]}" >/dev/null 2>&1; then
    die "private key, lease id, prompt, or provider body appeared in config/log evidence"
fi
```

After:

```bash
local private_key_pattern='BEGIN (AGE |OPENSSH |RSA |EC |ENCRYPTED )?PRIVATE KEY|AGE-SECRET-KEY-'
printf '%s\n' '-----BEGIN PRIVATE KEY-----' | rg -a -q "$private_key_pattern" \
    || die "private-key evidence matcher rejected its positive control"
if rg -a -n "$private_key_pattern|lease[_-]?id|credential qualification|QUALIFIED" \
    "${files[@]}" >/dev/null 2>&1; then
    die "private key, lease id, prompt, or provider body appeared in config/log evidence"
fi
```

Keep the live gate, exact two-profile auth assertions, safe output, no-retry rule, and revocation assertions unchanged. After REVIEW_REVIEW_TEST-1, the full deterministic script must finish both profiles.

### Modified Files and Checklist

- [ ] `scripts/e2e-credential-slot-smoke.sh`: add the shared matcher, positive control, and trustworthy capture scan without exposing matches.

### Test Strategy

The script self-check is the regression because it runs on every deterministic qualification. Also run `bash -n`, fixture validation, the zero-I/O live-gate self-test, the literal matcher probe, and the complete Make target.

### Verification

```bash
bash -n scripts/e2e-credential-slot-smoke.sh
jq -e '.profiles | length >= 4 and any(.[]; .id == "seulgi_chat") and any(.[]; .id == "seulgi_messages")' scripts/fixtures/credential-slot-vendors.json >/dev/null
private_key_pattern='BEGIN (AGE |OPENSSH |RSA |EC |ENCRYPTED )?PRIVATE KEY|AGE-SECRET-KEY-'
printf '%s\n' '-----BEGIN PRIVATE KEY-----' | rg -a -q "$private_key_pattern"
credential_smoke_parent="$(mktemp -d /config/workspace/iop-credential-slot-review.XXXXXX)"
trap 'rmdir "$credential_smoke_parent" 2>/dev/null || true' EXIT
TMPDIR="$credential_smoke_parent" ./scripts/e2e-credential-slot-smoke.sh --self-test-live-gate
TMPDIR="$credential_smoke_parent" make test-credential-slot-smoke
rmdir "$credential_smoke_parent"
trap - EXIT
```

Expected: every command exits 0; the self-test proves zero I/O without opt-in and one sanitized authorized mock call, and the deterministic smoke completes exact Chat and Messages auth, safe attribution, revocation, and artifact scans.

## [REVIEW_REVIEW_TEST-3] Replace temporary blocker caveats with the repaired contract

### Problem

The prior review correctly recorded the production blocker in `agent-contract/outer/anthropic-compatible-api.md:295-297`, `agent-spec/input/openai-compatible-surface.md:252,274`, `docs/edge-local-dev-guide.md:255`, and `docs/openai-usage-grafana.md:113`. Those statements become false after REVIEW_REVIEW_TEST-1 and would violate S17 if retained.

### Solution

Replace the limitation language with the implemented boundary: profile auth headers may be declared case-insensitively, the Control Plane canonicalizes the resolved name before signing, the Node injects only that exact lease instruction, and failure never permits bearer-slot or caller-auth fallback. Update the spec history entry to describe the repair and deterministic two-profile evidence. Keep inbound IOP `X-Api-Key`/Bearer equivalence distinct from outbound provider auth.

### Modified Files and Checklist

- [ ] `agent-contract/outer/anthropic-compatible-api.md`: replace the current-limitation section with the canonical managed API-key issuance contract.
- [ ] `agent-spec/input/openai-compatible-surface.md`: replace the blocker and update the history entry with repaired behavior/evidence.
- [ ] `docs/edge-local-dev-guide.md`: replace the known-blocker warning with the expected deterministic qualification behavior.
- [ ] `docs/openai-usage-grafana.md`: replace the attribution caveat with the two-profile success interpretation and no-fallback rule.

### Test Strategy

No prose-only unit test is added. The full deterministic smoke proves the behavior; a deterministic stale-claim search, pointer validation, and leak scan guard contract/spec/runbook drift.

### Verification

```bash
if rg --sort path -n 'Current managed API-key limitation|currently blocked|known managed API-key blocker|Current qualification caveat' agent-contract/outer/anthropic-compatible-api.md agent-spec/input/openai-compatible-surface.md docs/edge-local-dev-guide.md docs/openai-usage-grafana.md; then exit 1; fi
python3 - <<'PY'
import re
from pathlib import Path
for index in (Path('agent-contract/index.md'), Path('agent-spec/index.md')):
    data = index.read_text()
    targets = set(re.findall(r'`((?:agent-contract|agent-spec)/[^`\s]+\.md)`', data))
    targets.update(re.findall(r'\(((?:agent-contract|agent-spec)/[^)\s]+\.md)\)', data))
    for target in sorted(targets):
        if not Path(target.split('#', 1)[0]).is_file():
            raise SystemExit(f'broken pointer: {index}: {target}')
PY
```

Expected: both commands exit 0; no temporary blocker claim remains and every indexed contract/spec path resolves.

## [REVIEW_REVIEW_TEST-4] Produce fresh bounded verification evidence

### Problem

The current loop has two evidence-integrity failures. S16/S17 cannot close on reconstructed output, a false-negative private-key matcher, a partial Chat-only smoke, or unrelated broad-package failures.

### Solution

Run the exact fresh affected-package, vet, smoke, pointer, stale-claim, leak, and diff commands below using an executable external temporary root. Paste literal stdout/stderr and exit status into the active review. Run the representative provider pipeline exactly once only after deterministic success and when authorization plus readable encrypted inputs are already present; otherwise record the precise failed precondition and unchanged resume command.

### Modified Files and Checklist

- [ ] `agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/CODE_REVIEW-cloud-G08.md`: record actual decisions, exact command output/exit status, or exact live blocker/resume condition.

### Test Strategy

No additional test file is needed beyond REVIEW_REVIEW_TEST-1/2. This item executes the repository-native oracles with fresh Go runs and preserves literal evidence.

### Verification

Run every command in `Final Verification`. Expected: all deterministic commands exit 0. The live command either emits one sanitized success record after one authorized call or is explicitly marked not run with the exact failed preflight condition.

## Dependencies and Execution Order

1. The directory dependency `08` is satisfied by `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/complete.log`.
2. The directory dependency `09` is satisfied by `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/09+08_migration_attribution/complete.log`.
3. Implement REVIEW_REVIEW_TEST-1, then REVIEW_REVIEW_TEST-2, then REVIEW_REVIEW_TEST-3. Run REVIEW_REVIEW_TEST-4 only after all edits are complete.

## Modified Files Summary

| File | Item |
|------|------|
| `apps/control-plane/internal/credentiallease/service.go` | REVIEW_REVIEW_TEST-1 |
| `apps/control-plane/internal/credentiallease/service_test.go` | REVIEW_REVIEW_TEST-1 |
| `scripts/e2e-credential-slot-smoke.sh` | REVIEW_REVIEW_TEST-2 |
| `agent-contract/outer/anthropic-compatible-api.md` | REVIEW_REVIEW_TEST-3 |
| `agent-spec/input/openai-compatible-surface.md` | REVIEW_REVIEW_TEST-3 |
| `docs/edge-local-dev-guide.md` | REVIEW_REVIEW_TEST-3 |
| `docs/openai-usage-grafana.md` | REVIEW_REVIEW_TEST-3 |
| `agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts/CODE_REVIEW-cloud-G08.md` | REVIEW_REVIEW_TEST-4 |

## Reviewer Checkpoints

- Confirm header canonicalization occurs only after trusted profile resolution and before `lease.Issue`; `validateScope` remains strict and CR/LF rejection is unchanged.
- Confirm the regression issues and consumes a real `seulgi_messages` lease as `X-Api-Key` with no scheme and exact secret, not a hand-built envelope.
- Confirm the private-key matcher detects generic PKCS#8 plus existing forms through a positive control and suppresses matched contents in actual scans.
- Confirm the deterministic smoke reaches Node/upstream exactly once for both Chat and Messages with exact header semantics, no fallback, safe attribution, and post-revoke fencing.
- Confirm contract/spec/guides distinguish inbound IOP auth from outbound provider auth and contain no temporary blocker claim after the fix.
- Confirm all evidence is literal fresh output; unrelated broad-package environment failures are neither repaired nor presented as this packet's success evidence.
- Confirm the live pipeline was never executed without explicit opt-in and readable configured credentials, and at most one no-retry request was attempted.

## Final Verification

### Environment and affected Go packages

```bash
git branch --show-current
git rev-parse HEAD
git status --short
uname -s
uname -m
command -v go
go version
command -v jq
command -v rg
command -v openssl
command -v sops
credential_smoke_parent="$(mktemp -d /config/workspace/iop-credential-slot-final.XXXXXX)"
trap 'rmdir "$credential_smoke_parent" 2>/dev/null || true' EXIT
TMPDIR="$credential_smoke_parent" go test -count=1 ./apps/control-plane/... ./apps/edge/... ./apps/node/... ./packages/go/auth ./packages/go/config ./packages/go/credentiallease
TMPDIR="$credential_smoke_parent" go vet ./apps/control-plane/... ./apps/edge/... ./apps/node/... ./packages/go/auth ./packages/go/config ./packages/go/credentiallease
```

Expected: tool/preflight commands identify this dirty local checkout and required tools; affected fresh tests and vet exit 0. Preserve literal output; do not replace with cached or broad-package results.

### Deterministic qualification

```bash
bash -n scripts/e2e-credential-slot-smoke.sh
jq -e '.profiles | length >= 4 and any(.[]; .id == "seulgi_chat") and any(.[]; .id == "seulgi_messages")' scripts/fixtures/credential-slot-vendors.json >/dev/null
private_key_pattern='BEGIN (AGE |OPENSSH |RSA |EC |ENCRYPTED )?PRIVATE KEY|AGE-SECRET-KEY-'
printf '%s\n' '-----BEGIN PRIVATE KEY-----' | rg -a -q "$private_key_pattern"
TMPDIR="$credential_smoke_parent" ./scripts/e2e-credential-slot-smoke.sh --self-test-live-gate
TMPDIR="$credential_smoke_parent" make test-credential-slot-smoke
```

Expected: every command exits 0; deterministic execution makes no external provider call and proves both managed profile paths, no retry/fallback, revocation fencing, and safe artifact evidence.

### Contract/spec and leak guards

```bash
python3 - <<'PY'
import re
from pathlib import Path
for index in (Path('agent-contract/index.md'), Path('agent-spec/index.md')):
    data = index.read_text()
    targets = set(re.findall(r'`((?:agent-contract|agent-spec)/[^`\s]+\.md)`', data))
    targets.update(re.findall(r'\(((?:agent-contract|agent-spec)/[^)\s]+\.md)\)', data))
    for target in sorted(targets):
        if not Path(target.split('#', 1)[0]).is_file():
            raise SystemExit(f'broken pointer: {index}: {target}')
PY
if rg --sort path -n 'Current managed API-key limitation|currently blocked|known managed API-key blocker|Current qualification caveat' agent-contract/outer/anthropic-compatible-api.md agent-spec/input/openai-compatible-surface.md docs/edge-local-dev-guide.md docs/openai-usage-grafana.md; then exit 1; fi
private_key_pattern='BEGIN (AGE |OPENSSH |RSA |EC |ENCRYPTED )?PRIVATE KEY|AGE-SECRET-KEY-'
printf '%s\n' '-----BEGIN PRIVATE KEY-----' | rg -a -q "$private_key_pattern"
if rg --sort path -a -n --hidden --glob '!agent-task/archive/**' --glob '!*.sops.yaml' --glob '!go.sum' --glob '!PLAN-*.md' --glob '!*.log' "$private_key_pattern|sk-[A-Za-z0-9_-]{20,}" agent-contract agent-spec docs scripts agent-task/m-principal-provider-credential-slot-routing/10+08,09_verification_contracts; then exit 1; fi
git diff --check
rmdir "$credential_smoke_parent"
trap - EXIT
```

Expected: pointer and positive-control commands exit 0; stale-claim and repository leak searches return no matches under their inverted guards; diff check exits 0; the temporary root is empty and removed.

### Representative live one-shot

Preflight after every deterministic command passes:

```bash
test "${IOP_ALLOW_LIVE_PROVIDER:-}" = "1"
test -r /config/.config/sops/iop/openai.sops.yaml
test -r /config/.config/sops/age/keys.txt
```

If and only if all three preflight commands exit 0, execute exactly once:

```bash
credential_smoke_parent="$(mktemp -d /config/workspace/iop-credential-slot-live.XXXXXX)"
trap 'rmdir "$credential_smoke_parent" 2>/dev/null || true' EXIT
SOPS_AGE_KEY_FILE=/config/.config/sops/age/keys.txt \
  sops --decrypt --input-type yaml --output-type binary /config/.config/sops/iop/openai.sops.yaml \
  | IOP_ALLOW_LIVE_PROVIDER=1 TMPDIR="$credential_smoke_parent" ./scripts/e2e-credential-slot-smoke.sh \
      --live --secret-stdin --profile openai --model gpt-5.6-luna \
      --reasoning-effort high --max-completion-tokens 128
rmdir "$credential_smoke_parent"
trap - EXIT
```

Expected when authorized: one no-retry request and one sanitized JSON result containing only provider, model, safe slot ref, date, revision, and result. If preflight fails, do not decrypt or run the provider command; record each preflight exit status, exact blocker, and this unchanged resume command.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
