<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=6 tag=REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Execute the sole authorized Claude smoke and publish bounded S12 evidence

## For the Implementing Agent

Filling the implementation-owned sections of `CODE_REVIEW-cloud-G10.md` is the mandatory last implementation step. Run the verification commands in order, paste actual stdout/stderr without secrets or raw provider/tool/workspace content, keep both active files in place, and report ready for review. Only the official code-review skill may append a verdict, archive files, write `complete.log`, create `USER_REVIEW.md`, or classify the next state. This packet authorizes exactly one live Claude S12 invocation. A non-zero live result consumes that authorization: do not retry, replace the command, start another Claude/provider child, or promote qualification wording.

## Background

The previous review accepted the deterministic tool-observation repair, repeated race coverage, disposable Edge refresh, runtime identity reconciliation, and origin-form zero-child preflight. SDD S12 remains incomplete only because no successful real Claude request has produced the closed redacted manifest. `user_review_1.log` records the user's renewed authorization for one non-retriable invocation on the already selected dev runner and confirms that macOS is incidental runtime evidence rather than a product requirement.

## Archive Evidence Snapshot

- Immediate prior plan/review: `plan_cloud_G09_5.log` and `code_review_cloud_G09_5.log`; verdict `FAIL`, `review_rework_count=4`, `evidence_integrity_failure=false`.
- Resolved gate: `user_review_1.log` authorizes exactly one new live Claude invocation, reads `/config/workspace/iop/token/.claude` only as `ANTHROPIC_API_KEY` in the remote runner process, and forbids automatic retry or raw/secret evidence.
- Accepted repository evidence: the synchronous-continuation regression passed under `-race -count=100`, the dedicated registry observation regression passed under `-race -count=20`, three required race matrices passed, and the full Go/harness/protobuf hygiene gates passed in plan 5.
- Accepted remote evidence: disposable source `/Users/toki/agent-work/iop-s12-validation-20260808/source` at HEAD `70d22850d01714fdef734dafa42e82fed79e0786`, workspace `/Users/toki/agent-work/iop-s12-validation-20260808/workspace`, Edge PID `35091`, Node PID `25114`, health 200, origin `/v1/messages` distinction, ingress 0, and absent result/manifest.
- Fresh planner read-only check on 2026-08-08 confirmed Edge PID `35091`, Node PID `25114` using `/Users/toki/agent-work/iop-dev/build/dev-runtime/node-codex.yaml`, health 200, `/v1/messages` 401, `/v1/v1/messages` 404, ingress 0, absent result/manifest, executable canonical Claude, readable runtime evidence, non-empty local credential input, and unchanged hashes `51c5c52f...` / `db89857c...` for the two plan-5 repair files.

## Finding Resolution Map

| Finding | Resolution type | Selected resolution | Completion evidence |
|---|---|---|---|
| R1 | external-verification | Revalidate the frozen disposable candidate, run the origin-based harness preflight once, then consume exactly one newly authorized `--run` invocation with no retry. | A closed manifest validates locally and remotely and proves ingress delta 1, ordered `gemini -> ornith-fast -> gemini`, non-negative stage/total timing, changed and verified workspace, terminal 1, and zero forbidden evidence. |
| R1-doc | evidence-gated-sync | Only after the manifest passes, replace S12 deferred wording in the Anthropic contract and two matching living specs with a bounded qualification claim linked to the stable manifest. | No deferred S12 qualification wording remains in the three owner documents; each claim is limited to the selected runner/runtime and does not claim general availability, benchmarking, or OS requirement. |

## Analysis

### Files Read

- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-owned-single-request-agent-execution.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md`
- `agent-contract/index.md`
- `agent-contract/outer/anthropic-compatible-api.md`
- `agent-ops/rules/common/rules-agent-spec.md`
- `agent-spec/index.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-test/dev/rules.md`
- `agent-test/dev/edge-smoke.md`
- `scripts/e2e-single-request-claude.sh` manifest/preflight/run/publish paths
- `scripts/fixtures/single-request-claude-smoke-manifest.schema.json`
- `plan_cloud_G09_5.log`, `code_review_cloud_G09_5.log`, and `user_review_1.log`

### SDD Criteria

- S12 requires one actual Claude request against a selected writable approved IOP Node workspace.
- Acceptance requires actual Edge ingress POST delta 1, ordered Gemini plan / ornith-fast work / Gemini review, stage and total timing, a changed and verified final workspace file, and terminal count 1.
- Secret values, raw prompt/output/tool data, endpoint strings, and workspace paths are excluded from the tracked manifest. The dev runner's Darwin/arm64 identity is evidence only and does not change D03's platform-neutral product contract.

### Verification Context

- Runner: `ssh -o BatchMode=yes toki@toki-labs.com`.
- Disposable source/workspace: `/Users/toki/agent-work/iop-s12-validation-20260808/source` and `/Users/toki/agent-work/iop-s12-validation-20260808/workspace`.
- Runtime: Edge origin `http://127.0.0.1:18083`, metrics `http://127.0.0.1:19101/metrics`, Edge binary/config `build/s12/bin/iop-edge` / `build/s12/runtime/edge.yaml`, Node binary `build/s12/bin/iop-node-darwin-arm64`, runtime evidence `build/s12/runtime/runtime-evidence.json`, observation file `build/s12/runtime/edge.log`.
- Claude: `/opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe`; public model `iop-single-request-light`.
- Credential input: `/config/workspace/iop/token/.claude`, read through stdin and exported only inside the remote runner command. Never print, hash, copy, persist, or include its value in task/model output.
- Stable remote output: `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json`; requested workspace result: `smoke-result.txt`.
- The canonical `/Users/toki/agent-work/iop-dev` checkout, selected Node process/config, unrelated providers/processes, and the already running Edge binary/config are read-only in this packet. The disposable workspace result and manifest are the only remote persistent writes.

### Test Coverage Gaps

- Deterministic tests cannot replace the actual Claude executable, provider stages, Edge ingress counter, Node workspace mutation, or measured stage/terminal evidence.
- The one live call is non-repeatable within this authorization. Harness failure is evidence of failure, not permission to rerun.

### Symbol and Evidence References

- `scripts/e2e-single-request-claude.sh:304-418` closes and validates the manifest shape and redaction.
- `scripts/e2e-single-request-claude.sh:750-790` validates runtime/caller/credential/listener state without starting Claude.
- `scripts/e2e-single-request-claude.sh:927-1122` derives the manifest only after one successful child, ingress delta 1, fresh observation, changed workspace, exact result verification, and atomic no-replace publication.
- `scripts/fixtures/single-request-claude-smoke-manifest.schema.json` closes the S12 evidence vocabulary.
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md:136` is the acceptance owner.

### Split Judgment

Keep one packet. Preflight, the one irreversible invocation, manifest publication, and evidence-gated document sync are one transaction: splitting would either allow documentation without the accepted manifest or lose ownership of the consumed one-run authorization.

### Scope Rationale

Write only the active review evidence, the stable redacted manifest, and the three current qualification owner documents after manifest PASS. Do not change production code, harness/schema, config/protobuf, roadmap/SDD, dev inventory, canonical dev checkout, Edge/Node binaries or processes, provider state, or any unrelated dirty file. Remote writes are limited to the harness-owned temporary run directory, `workspace/smoke-result.txt`, and the atomic manifest target.

### Final Routing

- `status=routed`, `evaluation_mode=isolated-reassessment`, `finalizer=finalize-task-policy.sh`, `finalizer_mode=pair`.
- Build closures: scope/context/verification/evidence/ownership/decision all `true`; no capability gap.
- Build scores: scope `2`, state `2`, blast `2`, evidence `2`, verification `2` => `G10`; base/route basis `grade-boundary`, lane `cloud`, filename `PLAN-cloud-G10.md`, catalog route `worker/cloud/G10`.
- Build signals: `large_indivisible_context=true`; matched loop-risk signatures `temporal_state`, `concurrent_consistency`, `boundary_contract`, `structured_interpretation`; loop-risk count `4`; `review_rework_count=4`; `evidence_integrity_failure=false`.
- Review closures all `true`; scores `2/2/2/2/2` => `G10`; route basis `official-review`, lane `cloud`, filename `CODE_REVIEW-cloud-G10.md`, catalog route `review/cloud/G10`.

## Dependencies and Execution Order

1. Pass the local no-provider regressions and confirm the credential file is present without reading its value into output.
2. Revalidate the exact remote source repair hashes, process identities, routes, ingress 0, writable empty target, runtime evidence, and absent result/manifest.
3. Run the harness `--preflight-only` exactly once; recheck ingress 0 and no result/manifest.
4. Run the one live `--run` command exactly once. Whether it succeeds or fails, never run that command or another live Claude/provider invocation again in this packet.
5. On success only, validate the remote manifest, atomically copy it to the local stable evidence path, validate the local copy, and verify remote/local digests match.
6. On manifest PASS only, update the Anthropic contract and matching living specs from deferred to bounded selected-runtime qualification. Then run final redaction, document, harness, manifest, scope, and diff checks.
7. Fill `CODE_REVIEW-cloud-G10.md` with exact safe output and stop for official review.

## Implementation Checklist

- [ ] Revalidate the unchanged disposable candidate and pass one origin-based zero-child `--preflight-only` with ingress 0 and absent result/manifest.
- [ ] Consume exactly one authorized live Claude invocation without retry and require the harness-owned atomic redacted manifest.
- [ ] Validate and atomically publish the stable local manifest, then synchronize bounded S12 qualification wording in the Anthropic contract and two living specs only after evidence PASS.
- [ ] Fill every implementation-owned section of `CODE_REVIEW-cloud-G10.md` with actual safe output and leave finalization to the official reviewer.

### [REVIEW_REVIEW_REVIEW_REVIEW_API-1] Freeze candidate state and preflight

Run Final Verification 1-3 in order. Any failure stops before live execution. The read-only candidate check must use the actual Node config `/Users/toki/agent-work/iop-dev/build/dev-runtime/node-codex.yaml`, preserve Edge PID `35091` and Node PID `25114`, and require the two plan-5 repair hashes. `--preflight-only` may read the credential through stdin but must start no Claude child, keep ingress 0, and create neither result nor manifest.

### [REVIEW_REVIEW_REVIEW_REVIEW_API-2] Consume the sole live authorization

Run Final Verification 4 once. Do not wrap it in a retry loop, rerun it after any exit, replace it with direct Claude/API calls, or invoke another provider path. The harness owns the child process group, captures bounded raw output only in its temporary ignored directory, validates fresh observation/metrics/workspace evidence, and publishes the remote manifest atomically only after every condition passes. Record only the harness's safe stdout/stderr and exit status.

### [REVIEW_REVIEW_REVIEW_REVIEW_API-3] Publish evidence and synchronize current qualification

Only if Final Verification 4 exits zero, run 5-7. Validate the remote manifest before copying. Copy through a local temporary file, validate it, require the remote/local SHA-256 to match, and move it into the previously absent stable path. Update only qualification statements and change records in the three owner documents. State that one selected dev runner/runtime passed S12 with the stable redacted manifest; preserve the product's platform-neutral approved IOP Node contract and avoid availability, performance, benchmark, or all-platform claims.

### [REVIEW_REVIEW_REVIEW_REVIEW_API-4] Complete implementation evidence

Fill the implementation checklist, deviations, key decisions, and every verification output in `CODE_REVIEW-cloud-G10.md`. If live execution fails, record the consumed one-run authorization, exact safe failure, unchanged local manifest/docs, and the resume condition without asking the user or creating a control-plane file.

## Modified Files Summary

| File | Change |
|---|---|
| `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json` | New closed redacted S12 manifest, only after live PASS. |
| `agent-contract/outer/anthropic-compatible-api.md` | Replace deferred S12 language with bounded selected-runtime qualification linked to the manifest, only after PASS. |
| `agent-spec/runtime/edge-node-execution.md` | Synchronize current runtime qualification and evidence pointer, only after PASS. |
| `agent-spec/input/openai-compatible-surface.md` | Synchronize current input-surface qualification and evidence pointer, only after PASS. |
| `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md` | Implementation-owned evidence output. |

## Final Verification

Run in order. Commands 1-3 must pass before command 4. Command 4 is the only live Claude invocation and must be attempted at most once. Commands 5-7 are permitted only after command 4 exits zero. Never print the credential, raw Claude captures, workspace result content, or raw observation lines.

1. Local no-provider gate:

   ```sh
   bash -c 'set -euo pipefail; test -s /config/workspace/iop/token/.claude; test "$(stat -c %a /config/workspace/iop/token/.claude)" = 600; test ! -e agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; bash -n scripts/e2e-single-request-claude.sh; make test-single-request-claude-smoke-self-test; go test -race -count=1 ./apps/edge/internal/service -run "^TestSingleRequestObservationSynchronousContinuationOrdering$"; go test -race -count=1 ./apps/edge/internal/openai -run "^TestAnthropicSingleRequestObservation$"; git diff --check'
   ```

2. Exact read-only remote candidate check:

   ```sh
   ssh -o BatchMode=yes toki@toki-labs.com 'set -eu; root=/Users/toki/agent-work/iop-s12-validation-20260808/source; workspace=/Users/toki/agent-work/iop-s12-validation-20260808/workspace; cd "$root"; test "$(git rev-parse HEAD)" = 70d22850d01714fdef734dafa42e82fed79e0786; test "$(sha256sum apps/edge/internal/service/single_request_tool_loop.go | awk "{print \\$1}")" = 51c5c52fd5e19fa6966e05dd8c59db3aef9e6f4b1b3943b763565e8f093e2acf; test "$(sha256sum apps/edge/internal/service/single_request_observation_test.go | awk "{print \\$1}")" = db89857c6f7de81b310973081bfecbceddc7cc506bf480e275abc1f3c5d0e1be; test "$(pgrep -f "^$root/build/s12/bin/iop-edge --config $root/build/s12/runtime/edge.yaml serve$")" = 35091; test "$(pgrep -f "^$root/build/s12/bin/iop-node-darwin-arm64 --config /Users/toki/agent-work/iop-dev/build/dev-runtime/node-codex.yaml serve$")" = 25114; test -d "$workspace"; test -w "$workspace"; test ! -e "$workspace/smoke-result.txt"; test ! -e agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; test -x /opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe; test -s build/s12/runtime/runtime-evidence.json; test "$(curl -sS -o /dev/null -w "%{http_code}" http://127.0.0.1:18083/healthz)" = 200; code="$(curl -sS -o /dev/null -w "%{http_code}" -X OPTIONS http://127.0.0.1:18083/v1/messages)"; test "$code" = 401 -o "$code" = 405; test "$(curl -sS -o /dev/null -w "%{http_code}" -X OPTIONS http://127.0.0.1:18083/v1/v1/messages)" = 404; curl -fsS http://127.0.0.1:19101/metrics | grep -Eq "^iop_anthropic_single_request_ingress_total 0(\\.0+)?$"'
   ```

3. One zero-child origin preflight:

   ```sh
   ssh -o BatchMode=yes toki@toki-labs.com 'IFS= read -r ANTHROPIC_API_KEY; export ANTHROPIC_API_KEY; cd /Users/toki/agent-work/iop-s12-validation-20260808/source; exec ./scripts/e2e-single-request-claude.sh --preflight-only --claude /opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe --runtime-evidence build/s12/runtime/runtime-evidence.json --base-url http://127.0.0.1:18083 --model iop-single-request-light --edge-bin build/s12/bin/iop-edge --node-bin build/s12/bin/iop-node-darwin-arm64 --edge-config build/s12/runtime/edge.yaml --observation-file build/s12/runtime/edge.log --metrics-url http://127.0.0.1:19101/metrics --workspace /Users/toki/agent-work/iop-s12-validation-20260808/workspace --output /Users/toki/agent-work/iop-s12-validation-20260808/source/agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json --secret-env ANTHROPIC_API_KEY' < /config/workspace/iop/token/.claude
   ```

   Then read-only confirm ingress remains 0 and both result/manifest remain absent. Do not run command 4 if this fails.

4. Sole live Claude invocation — execute this command once, with no retry:

   ```sh
   ssh -o BatchMode=yes toki@toki-labs.com 'IFS= read -r ANTHROPIC_API_KEY; export ANTHROPIC_API_KEY; cd /Users/toki/agent-work/iop-s12-validation-20260808/source; exec ./scripts/e2e-single-request-claude.sh --run --claude /opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe --runtime-evidence build/s12/runtime/runtime-evidence.json --base-url http://127.0.0.1:18083 --model iop-single-request-light --edge-bin build/s12/bin/iop-edge --node-bin build/s12/bin/iop-node-darwin-arm64 --edge-config build/s12/runtime/edge.yaml --observation-file build/s12/runtime/edge.log --metrics-url http://127.0.0.1:19101/metrics --workspace /Users/toki/agent-work/iop-s12-validation-20260808/workspace --output /Users/toki/agent-work/iop-s12-validation-20260808/source/agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json --secret-env ANTHROPIC_API_KEY' < /config/workspace/iop/token/.claude
   ```

5. Remote closed-evidence check, only after live success:

   ```sh
   ssh -o BatchMode=yes toki@toki-labs.com 'set -eu; cd /Users/toki/agent-work/iop-s12-validation-20260808/source; manifest=agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; ./scripts/e2e-single-request-claude.sh --validate-manifest "$manifest"; test -f /Users/toki/agent-work/iop-s12-validation-20260808/workspace/smoke-result.txt; curl -fsS http://127.0.0.1:19101/metrics | grep -Eq "^iop_anthropic_single_request_ingress_total 1(\\.0+)?$"; python3 - "$manifest" <<'"'"'PY'"'"'
import json, sys
data = json.load(open(sys.argv[1]))
print("ingress_delta=" + str(data["ingress"]["delta"]))
print("stage_engines=" + "->".join(data["runtime"]["stage_engines"]))
print("stage_duration_ms=" + ",".join(str(item["duration_ms"]) for item in data["stages"]))
print("terminal_count=" + str(data["terminal"]["count"]))
print("terminal_duration_ms=" + str(data["terminal"]["duration_ms"]))
print("workspace_changed=" + str(data["workspace"]["changed"]).lower())
print("verification_exit_code=" + str(data["verification"]["exit_code"]))
print("forbidden_counts=" + str(data["redaction"]["forbidden_match_count"]) + "," + str(data["redaction"]["forbidden_key_count"]))
PY'
   ```

6. Atomic local evidence publication, only after remote validation:

   ```sh
   bash -c 'set -euo pipefail; target=agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; mkdir -p "$(dirname "$target")"; test ! -e "$target"; tmp="$(mktemp "$(dirname "$target")/.claude-smoke-evidence.XXXXXXXX")"; trap '\''rm -f "$tmp"'\'' EXIT; scp -q toki@toki-labs.com:/Users/toki/agent-work/iop-s12-validation-20260808/source/agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json "$tmp"; ./scripts/e2e-single-request-claude.sh --validate-manifest "$tmp"; remote_sha="$(ssh -o BatchMode=yes toki@toki-labs.com "sha256sum /Users/toki/agent-work/iop-s12-validation-20260808/source/agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json | awk '\''{print \\$1}'\''")"; test "$(sha256sum "$tmp" | awk '\''{print $1}'\'')" = "$remote_sha"; mv "$tmp" "$target"; trap - EXIT; ./scripts/e2e-single-request-claude.sh --validate-manifest "$target"'
   ```

7. Evidence-gated document and final hygiene check, after updating only the three owner documents:

   ```sh
   bash -c 'set -euo pipefail; manifest=agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; ./scripts/e2e-single-request-claude.sh --validate-manifest "$manifest"; make test-single-request-claude-smoke-self-test; ! rg -n "actual external Claude qualification remains explicitly deferred|Actual Claude timing evidence on an approved IOP Node is explicitly deferred|actual Claude timing evidence on an approved IOP Node is explicitly deferred|only actual external Claude qualification remains explicitly deferred|S12 external Claude qualification.*pending" agent-contract/outer/anthropic-compatible-api.md agent-spec/runtime/edge-node-execution.md agent-spec/input/openai-compatible-surface.md; rg -n "agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json" agent-contract/outer/anthropic-compatible-api.md agent-spec/runtime/edge-node-execution.md agent-spec/input/openai-compatible-surface.md; python3 - "$manifest" <<'"'"'PY'"'"'
import json, re, sys
data = json.load(open(sys.argv[1]))
body = open(sys.argv[1], "rb").read()
assert data["ingress"]["delta"] == 1
assert data["runtime"]["stage_engines"] == ["gemini", "ornith-fast", "gemini"]
assert data["terminal"]["count"] == 1 and data["terminal"]["stop_reason"] == "end_turn"
assert data["workspace"]["changed"] is True and data["verification"]["exit_code"] == 0
assert data["redaction"] == {"forbidden_key_count": 0, "forbidden_match_count": 0}
assert not re.search(rb"sk-ant-|Bearer\\s|https?://|/Users/|RAW_|SECRET_", body, re.I)
PY
git diff --check; git diff --name-only -- agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json agent-contract/outer/anthropic-compatible-api.md agent-spec/runtime/edge-node-execution.md agent-spec/input/openai-compatible-surface.md'
   ```
