<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=7 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Execute S12 with isolated API-key Claude authentication

## For the Implementing Agent

Filling the implementation-owned sections of `CODE_REVIEW-cloud-G10.md` is the mandatory last implementation step. Run the verification commands in order, paste only secret-safe stdout/stderr, keep both active files in place, and report ready for review. Only the official code-review skill may append a verdict, archive files, write `complete.log`, create `USER_REVIEW.md`, or classify the next state. This packet authorizes exactly one live Claude invocation. Any live exit consumes the authorization; do not retry, substitute another caller, or promote qualification without a schema-valid manifest.

## Background

The prior live child exited before Edge ingress because the remote CLI selected stored `claude.ai` state instead of the supplied API key. `user_review_2.log` records the user's approval to continue with the canonical remote executable and exactly one new non-retriable invocation. A fresh temporary `CLAUDE_CONFIG_DIR` now deterministically reports `authMethod=api_key`; the same isolation must surround preflight and the sole live harness run.

## Archive Evidence Snapshot

- Immediate prior pair: `plan_cloud_G10_6.log` and `code_review_cloud_G10_6.log`; verdict `FAIL`, `review_rework_count=5`, `evidence_integrity_failure=false`.
- Resolved gate: `user_review_2.log` confirms credential readiness and exactly one new live authorization. The credential is read only from `/config/workspace/iop/token/.claude` into `ANTHROPIC_API_KEY` and is never printed, hashed, copied, or persisted.
- Prior safe failure: Claude child status 1, harness exit 69, Edge ingress 0, no workspace result, no remote/local manifest, and no document promotion.
- Changed precondition: `/opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe` 2.1.177 reports `loggedIn=True`, `authMethod=api_key`, `apiProvider=firstParty` when run with the user key and an empty temporary `CLAUDE_CONFIG_DIR`.
- Frozen candidate: remote HEAD `70d22850d01714fdef734dafa42e82fed79e0786`, Edge PID `35091`, Node PID `25114`, health 200, ingress 0, and absent result/manifest were revalidated on 2026-08-08.

## Finding Resolution Map

| Finding | Resolution type | Selected resolution | Completion evidence |
|---|---|---|---|
| R1 | external-verification | Force API-key selection with a fresh temporary `CLAUDE_CONFIG_DIR`, verify the closed auth status, pass the unchanged candidate and zero-child gates, then execute one live harness call without retry. | A schema-valid redacted manifest proves ingress delta 1, ordered `gemini -> ornith-fast -> gemini`, stage/total timing, changed and verified workspace, terminal 1, and zero forbidden evidence. |
| R1-doc | evidence-gated-sync | Only after manifest PASS, replace deferred S12 wording in the Anthropic contract and two living specs with a bounded selected-runtime qualification linked to the stable manifest. | All three owner documents cite the manifest and retain the platform-neutral, single-run, non-benchmark limitation. |

## Analysis

### Files Read

- `agent-roadmap/current.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/PHASE.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-owned-single-request-agent-execution.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/iop-owned-single-request-agent-execution/SDD.md`
- `agent-contract/index.md`
- `agent-contract/outer/anthropic-compatible-api.md`
- `agent-spec/index.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-test/dev/rules.md`
- `agent-test/dev/edge-smoke.md`
- `scripts/e2e-single-request-claude.sh` preflight, credential, child environment, manifest, and publication paths
- `scripts/fixtures/single-request-claude-smoke-manifest.schema.json`
- `plan_cloud_G10_6.log`, `code_review_cloud_G10_6.log`, and `user_review_2.log`

### SDD Criteria

- The Milestone is `[진행중]`, implementation lock is released, SDD is approved and unlocked, and first-line contribution ids remain `workspace-binding,claude-smoke`.
- S12 requires one actual Claude request against a selected writable approved IOP Node workspace. PASS requires actual ingress delta 1, ordered Gemini plan / ornith-fast work / Gemini review, non-negative stage and total timing, changed and verified final workspace output, and one terminal.
- Evidence Map S12 requires actual Claude, ingress counter, Edge/Node/provider timing, and workspace before/after. Those facts define the live harness and manifest gates below. Secret values, raw prompt/output/tool content, endpoint strings, and workspace paths remain excluded from tracked evidence.

### Verification Context

- Handoff facts: the user selected dev, the remote runner `toki@toki-labs.com`, the canonical executable `/opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe`, API-key authentication, and exactly one new live call.
- External runner: Darwin/arm64, disposable source `/Users/toki/agent-work/iop-s12-validation-20260808/source`, workspace `/Users/toki/agent-work/iop-s12-validation-20260808/workspace`.
- Runtime: Edge origin `http://127.0.0.1:18083`, metrics `http://127.0.0.1:19101/metrics`, Edge binary/config `build/s12/bin/iop-edge` / `build/s12/runtime/edge.yaml`, Node binary `build/s12/bin/iop-node-darwin-arm64`, Node dev config `/Users/toki/agent-work/iop-dev/build/dev-runtime/node-codex.yaml`, runtime evidence `build/s12/runtime/runtime-evidence.json`, observation `build/s12/runtime/edge.log`.
- Claude/auth: executable 2.1.177; a clean temporary `CLAUDE_CONFIG_DIR` plus the supplied environment key reports `api_key`. The harness copies the parent environment into the Claude child, so this variable reaches the exact live executable without changing the binary path or runtime-evidence digest.
- Stable output: `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json`; requested result `smoke-result.txt`. The canonical dev checkout and running processes remain read-only; only the disposable workspace result, harness temporary files, and atomic manifest are writable.
- Fresh evidence is required. Cached external output is not acceptable, and failure after the live command cannot be retried in this packet.

### Test Coverage Gaps

- Existing self-tests prove isolation, redaction, cleanup, process supervision, and manifest rejection, but cannot prove a real Claude-to-Edge request.
- `auth status` proves CLI selection of the API-key method without a provider call; only the authorized live harness can prove request admission and full S12 behavior.

### Symbol References

No production symbol is renamed or removed. The only runtime input change is the parent-process `CLAUDE_CONFIG_DIR`; `scripts/e2e-single-request-claude.sh:786-812` preserves it through `env=os.environ.copy()` into the canonical Claude child.

### Split Judgment

Keep one packet. Authentication isolation, the irreversible one-call boundary, manifest publication, and evidence-gated contract/spec promotion form one transaction; splitting would allow a caller or document state that is not tied to the accepted manifest.

### Scope Rationale

Write only the active review evidence, stable redacted manifest, and the three qualification owner documents after manifest PASS. Do not modify production code, harness/schema, config/protobuf, roadmap/SDD, dev inventory, canonical dev checkout, running Edge/Node processes, provider state, or unrelated dirty files. Temporary Claude config is created outside the repository and deleted on every exit path.

### Final Routing

- `status=routed`, `evaluation_mode=isolated-reassessment`, `finalizer=finalize-task-policy.sh`, `finalizer_mode=pair`.
- Build closures scope/context/verification/evidence/ownership/decision are all `true`; no capability gap. Scores `2/2/2/2/2` => `G10`; base/route basis `grade-boundary`, lane `cloud`, filename `PLAN-cloud-G10.md`, catalog route `worker/cloud/G10`.
- Build signals: `large_indivisible_context=true`; matched risks `temporal_state`, `concurrent_consistency`, `boundary_contract`, `structured_interpretation`; count `4`; `review_rework_count=5`; `evidence_integrity_failure=false`; risk and recovery boundaries match but do not replace `grade-boundary`.
- Review closures are all `true`; scores `2/2/2/2/2` => `G10`; route basis `official-review`, lane `cloud`, filename `CODE_REVIEW-cloud-G10.md`, catalog route `review/cloud/G10`.

## Dependencies and Execution Order

1. Pass local no-provider regressions and the exact remote candidate/auth read-only checks.
2. Pass one zero-child harness preflight with a temporary empty Claude config, then confirm ingress/result/manifest remain unchanged.
3. Execute the live harness once with a new empty Claude config and the verified API-key method. Never retry after any exit.
4. On live PASS only, validate and copy the remote manifest atomically, then update the three owner documents and run final hygiene.
5. Fill `CODE_REVIEW-cloud-G10.md` with safe actual output and stop for official review.

## Implementation Checklist

- [ ] Revalidate the frozen disposable candidate and clean-config `api_key` auth, then pass one zero-child preflight with ingress 0 and absent result/manifest.
- [ ] Consume exactly one live Claude invocation under the isolated API-key config without retry and require the harness-owned atomic redacted manifest.
- [ ] Validate and atomically publish the stable local manifest, then synchronize bounded S12 qualification wording in the Anthropic contract and two living specs only after manifest PASS.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-1] Isolate API-key auth and preflight

**Problem**

The prior `--run` at `code_review_cloud_G10_6.log` inherited `/Users/toki/.claude*`; the CLI chose `claude.ai` and exited before Edge ingress even though `ANTHROPIC_API_KEY` was non-empty.

**Solution**

Create a mode-700 temporary `CLAUDE_CONFIG_DIR`, export it with `ANTHROPIC_API_KEY`, reduce `auth status --json` to the closed `loggedIn/authMethod/apiProvider` fields, and require `api_key` before harness preflight. Handle the credential file's missing final newline with `read ... || test -n`.

Before (`code_review_cloud_G10_6.log`, prior live environment):

```sh
export ANTHROPIC_API_KEY
./scripts/e2e-single-request-claude.sh --run ...
```

After:

```sh
export ANTHROPIC_API_KEY CLAUDE_CONFIG_DIR
claude auth status --json | verify_api_key_fields
./scripts/e2e-single-request-claude.sh --preflight-only ...
```

**Modified Files and Checklist**

- [ ] Record only the safe auth projection and preflight output in `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md`.

**Test Strategy**

No code test is added. Final Verification 1 exercises existing deterministic harness/race coverage; commands 2-3 prove the exact external identity and zero-child auth/preflight conditions.

**Verification**

Run Final Verification 1-3; all must exit zero, auth must equal `api_key`, and remote ingress/result/manifest must stay `0/absent/absent`.

### [REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-2] Consume the sole live authorization

**Problem**

SDD S12 at line 119 and Evidence Map line 136 still lack one successful actual-Claude request and closed full-cycle evidence.

**Solution**

Run Final Verification 4 once using the same clean-config API-key boundary. The harness remains the only caller, supervises the canonical executable, collects bounded temporary raw output outside tracked evidence, and publishes only after ingress, observation, workspace, terminal, and redaction checks pass.

**Modified Files and Checklist**

- [ ] Generate `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json` only through the successful harness and atomic copy.
- [ ] Record the safe command result in `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md`.

**Test Strategy**

The exactly-once external call is the integration test. No retry, alternate CLI, direct API request, or reconstructed evidence is permitted.

**Verification**

Final Verification 4 exits zero and creates the remote manifest and verified workspace result; any non-zero exit ends the packet.

### [REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-3] Publish bounded qualification

**Problem**

Deferred S12 wording remains at `agent-contract/outer/anthropic-compatible-api.md:139,203`, `agent-spec/runtime/edge-node-execution.md:210,239,243,252,344-345`, and `agent-spec/input/openai-compatible-surface.md:168,258,315`.

**Solution**

Only after remote manifest validation, copy it atomically to the stable path and update those owner statements plus change history. State only that the recorded selected dev runtime/run passed S12; preserve the platform-neutral product contract and do not claim general availability, benchmark quality, performance, or all-platform coverage.

Before (`agent-contract/outer/anthropic-compatible-api.md:203`):

```text
actual external Claude qualification remains explicitly deferred to S12
```

After:

```text
the selected dev runtime/run is qualified by the closed S12 manifest; this is not a general availability or platform requirement claim
```

**Modified Files and Checklist**

- [ ] Add the validated manifest at `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json`.
- [ ] Update `agent-contract/outer/anthropic-compatible-api.md`.
- [ ] Update `agent-spec/runtime/edge-node-execution.md`.
- [ ] Update `agent-spec/input/openai-compatible-surface.md`.

**Test Strategy**

No production test is added. The schema validator, redaction assertions, exact manifest digest, bounded-document searches, self-test, and diff hygiene form the deterministic oracle.

**Verification**

Run Final Verification 5-7 only after Final Verification 4 succeeds.

### [REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-4] Complete implementation evidence

**Problem**

Official review cannot distinguish a consumed live authorization from an unexecuted or retried call without exact safe command output.

**Solution**

Fill the active review checklist, decisions, deviations, and all seven verification sections. Record secret-safe failure classification only; never paste raw captures, result content, observation lines, credential material, or temporary config paths.

**Modified Files and Checklist**

- [ ] Fill `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md`.

**Test Strategy**

No test file is added; official review replays deterministic checks and compares the external state projection.

**Verification**

The review file has no placeholder in implementation-owned sections and accurately marks every executed/skipped command.

## Modified Files Summary

| File | Items |
|---|---|
| `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json` | REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-2, REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-3 |
| `agent-contract/outer/anthropic-compatible-api.md` | REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-3 |
| `agent-spec/runtime/edge-node-execution.md` | REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-3 |
| `agent-spec/input/openai-compatible-surface.md` | REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-3 |
| `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md` | REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-1, REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-2, REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API-4 |

## Final Verification

Run in order. Commands 1-3 must pass before command 4. Command 4 is the only live Claude/provider invocation and may run at most once. Commands 5-7 are success-only. Never print credential material, raw Claude output, workspace result content, raw observation lines, or temporary config paths.

1. Local no-provider gate:

   ```sh
   bash -c 'set -euo pipefail; test -s /config/workspace/iop/token/.claude; test "$(stat -c %a /config/workspace/iop/token/.claude)" = 600; test ! -e agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; bash -n scripts/e2e-single-request-claude.sh; make test-single-request-claude-smoke-self-test; go test -race -count=1 ./apps/edge/internal/service -run "^TestSingleRequestObservationSynchronousContinuationOrdering$"; go test -race -count=1 ./apps/edge/internal/openai -run "^TestAnthropicSingleRequestObservation$"; git diff --check'
   ```

2. Exact remote candidate and API-key selection check:

   ```sh
   ssh -o BatchMode=yes toki@toki-labs.com 'set -eu; root=/Users/toki/agent-work/iop-s12-validation-20260808/source; workspace=/Users/toki/agent-work/iop-s12-validation-20260808/workspace; cd "$root"; test "$(git rev-parse HEAD)" = 70d22850d01714fdef734dafa42e82fed79e0786; test "$(sha256sum apps/edge/internal/service/single_request_tool_loop.go | cut -d " " -f1)" = 51c5c52fd5e19fa6966e05dd8c59db3aef9e6f4b1b3943b763565e8f093e2acf; test "$(sha256sum apps/edge/internal/service/single_request_observation_test.go | cut -d " " -f1)" = db89857c6f7de81b310973081bfecbceddc7cc506bf480e275abc1f3c5d0e1be; test "$(pgrep -f "^$root/build/s12/bin/iop-edge --config $root/build/s12/runtime/edge.yaml serve$")" = 35091; test "$(pgrep -f "^$root/build/s12/bin/iop-node-darwin-arm64 --config /Users/toki/agent-work/iop-dev/build/dev-runtime/node-codex.yaml serve$")" = 25114; test -x /opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe; test -d "$workspace" -a -w "$workspace"; test ! -e "$workspace/smoke-result.txt"; test ! -e agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; test "$(curl -sS -o /dev/null -w "%{http_code}" http://127.0.0.1:18083/healthz)" = 200; curl -fsS http://127.0.0.1:19101/metrics | grep -Eq "^iop_anthropic_single_request_ingress_total 0(\\.0+)?$"; ANTHROPIC_API_KEY=""; IFS= read -r ANTHROPIC_API_KEY || test -n "$ANTHROPIC_API_KEY"; export ANTHROPIC_API_KEY; cfg="$(mktemp -d /tmp/iop-s12-claude-config.XXXXXX)"; chmod 700 "$cfg"; trap '\''rm -rf "$cfg"'\'' EXIT HUP INT TERM; export CLAUDE_CONFIG_DIR="$cfg"; /opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe auth status --json | python3 -c '\''import json,sys; d=json.load(sys.stdin); assert d.get("loggedIn") is True and d.get("authMethod") == "api_key" and d.get("apiProvider") == "firstParty"; print("auth=api_key")'\''' < /config/workspace/iop/token/.claude
   ```

3. One zero-child preflight with isolated API-key config:

   ```sh
   ssh -o BatchMode=yes toki@toki-labs.com 'set -eu; ANTHROPIC_API_KEY=""; IFS= read -r ANTHROPIC_API_KEY || test -n "$ANTHROPIC_API_KEY"; export ANTHROPIC_API_KEY; cfg="$(mktemp -d /tmp/iop-s12-claude-config.XXXXXX)"; chmod 700 "$cfg"; trap '\''rm -rf "$cfg"'\'' EXIT HUP INT TERM; export CLAUDE_CONFIG_DIR="$cfg"; /opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe auth status --json | python3 -c '\''import json,sys; d=json.load(sys.stdin); assert d.get("authMethod") == "api_key"; print("auth=api_key")'\''; cd /Users/toki/agent-work/iop-s12-validation-20260808/source; ./scripts/e2e-single-request-claude.sh --preflight-only --claude /opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe --runtime-evidence build/s12/runtime/runtime-evidence.json --base-url http://127.0.0.1:18083 --model iop-single-request-light --edge-bin build/s12/bin/iop-edge --node-bin build/s12/bin/iop-node-darwin-arm64 --edge-config build/s12/runtime/edge.yaml --observation-file build/s12/runtime/edge.log --metrics-url http://127.0.0.1:19101/metrics --workspace /Users/toki/agent-work/iop-s12-validation-20260808/workspace --output /Users/toki/agent-work/iop-s12-validation-20260808/source/agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json --secret-env ANTHROPIC_API_KEY' < /config/workspace/iop/token/.claude
   ```

   Then confirm read-only: ingress is 0 and both result/manifest are absent. Do not continue if any assertion fails.

4. Sole live Claude invocation with isolated API-key config — execute once, never retry:

   ```sh
   ssh -o BatchMode=yes toki@toki-labs.com 'set -eu; ANTHROPIC_API_KEY=""; IFS= read -r ANTHROPIC_API_KEY || test -n "$ANTHROPIC_API_KEY"; export ANTHROPIC_API_KEY; cfg="$(mktemp -d /tmp/iop-s12-claude-config.XXXXXX)"; chmod 700 "$cfg"; trap '\''rm -rf "$cfg"'\'' EXIT HUP INT TERM; export CLAUDE_CONFIG_DIR="$cfg"; /opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe auth status --json | python3 -c '\''import json,sys; d=json.load(sys.stdin); assert d.get("loggedIn") is True and d.get("authMethod") == "api_key" and d.get("apiProvider") == "firstParty"; print("auth=api_key")'\''; cd /Users/toki/agent-work/iop-s12-validation-20260808/source; set +e; ./scripts/e2e-single-request-claude.sh --run --claude /opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe --runtime-evidence build/s12/runtime/runtime-evidence.json --base-url http://127.0.0.1:18083 --model iop-single-request-light --edge-bin build/s12/bin/iop-edge --node-bin build/s12/bin/iop-node-darwin-arm64 --edge-config build/s12/runtime/edge.yaml --observation-file build/s12/runtime/edge.log --metrics-url http://127.0.0.1:19101/metrics --workspace /Users/toki/agent-work/iop-s12-validation-20260808/workspace --output /Users/toki/agent-work/iop-s12-validation-20260808/source/agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json --secret-env ANTHROPIC_API_KEY; status=$?; set -e; rm -rf "$cfg"; trap - EXIT HUP INT TERM; exit "$status"' < /config/workspace/iop/token/.claude
   ```

5. Remote closed-evidence check, only after live success:

   ```sh
   ssh -o BatchMode=yes toki@toki-labs.com 'set -eu; cd /Users/toki/agent-work/iop-s12-validation-20260808/source; manifest=agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; ./scripts/e2e-single-request-claude.sh --validate-manifest "$manifest"; test -f /Users/toki/agent-work/iop-s12-validation-20260808/workspace/smoke-result.txt; curl -fsS http://127.0.0.1:19101/metrics | grep -Eq "^iop_anthropic_single_request_ingress_total 1(\\.0+)?$"; python3 - "$manifest" <<'"'"'PY'"'"'
import json, sys
d=json.load(open(sys.argv[1]))
print("ingress_delta="+str(d["ingress"]["delta"]))
print("stage_engines="+"->".join(d["runtime"]["stage_engines"]))
print("terminal_count="+str(d["terminal"]["count"]))
print("workspace_changed="+str(d["workspace"]["changed"]))
print("verification_exit="+str(d["verification"]["exit_code"]))
print("forbidden_matches="+str(d["redaction"]["forbidden_match_count"]))
PY'
   ```

6. Atomic local evidence publication:

   ```sh
   bash -c 'set -euo pipefail; target=agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; mkdir -p "$(dirname "$target")"; test ! -e "$target"; tmp="$(mktemp "$(dirname "$target")/.claude-smoke-evidence.XXXXXXXX")"; trap '\''rm -f "$tmp"'\'' EXIT; scp -q toki@toki-labs.com:/Users/toki/agent-work/iop-s12-validation-20260808/source/agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json "$tmp"; ./scripts/e2e-single-request-claude.sh --validate-manifest "$tmp"; remote_sha="$(ssh -o BatchMode=yes toki@toki-labs.com "sha256sum /Users/toki/agent-work/iop-s12-validation-20260808/source/agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json | cut -d '\'' '\'' -f1")"; test "$(sha256sum "$tmp" | cut -d " " -f1)" = "$remote_sha"; mv "$tmp" "$target"; trap - EXIT; ./scripts/e2e-single-request-claude.sh --validate-manifest "$target"'
   ```

7. Evidence-gated document and final hygiene check, after updating only the three owner documents:

   ```sh
   bash -c 'set -euo pipefail; manifest=agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json; ./scripts/e2e-single-request-claude.sh --validate-manifest "$manifest"; make test-single-request-claude-smoke-self-test; ! rg -n "actual external Claude qualification remains explicitly deferred|Actual Claude timing evidence on an approved IOP Node is explicitly deferred|actual Claude timing evidence on an approved IOP Node is explicitly deferred|only actual external Claude qualification remains explicitly deferred|S12 external Claude qualification.*pending" agent-contract/outer/anthropic-compatible-api.md agent-spec/runtime/edge-node-execution.md agent-spec/input/openai-compatible-surface.md; rg -n "agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json" agent-contract/outer/anthropic-compatible-api.md agent-spec/runtime/edge-node-execution.md agent-spec/input/openai-compatible-surface.md; python3 - "$manifest" <<'"'"'PY'"'"'
import json, re, sys
d=json.load(open(sys.argv[1])); body=open(sys.argv[1],"rb").read()
assert d["ingress"]["delta"] == 1
assert d["runtime"]["stage_engines"] == ["gemini","ornith-fast","gemini"]
assert d["terminal"]["count"] == 1 and d["terminal"]["stop_reason"] == "end_turn"
assert d["workspace"]["changed"] is True and d["verification"]["exit_code"] == 0
assert d["redaction"] == {"forbidden_key_count":0,"forbidden_match_count":0}
assert not re.search(rb"sk-ant-|Bearer\\s|https?://|/Users/|RAW_|SECRET_", body, re.I)
PY
git diff --check'
   ```

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
