<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=12 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - Disposable managed IOP S12

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=12

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_11.log` / `code_review_cloud_G10_11.log`; verdict `FAIL`, rework 10.
- The selected SOPS caller authenticated against legacy Edge, but marked S12 admission requires managed projection.
- Provider routing remains entirely IOP-owned, including Gemini and Claude; the authorized live call remains unused.

## Implementation Item Completion

| Item | Status |
|---|---|
| MANAGED-RUNTIME-1 | [x] |
| MANAGED-PROJECTION-2 | [x] |
| MANAGED-PREFLIGHT-3 | [x] |
| SOLE-LIVE-S12-4 | [x] Executed once; failed before accepted ingress; no retry |
| EVIDENCE-DOC-SYNC-5 | [x] Correctly skipped because the live manifest did not pass |
| REVIEW-EVIDENCE-6 | [x] |

## Implementation Checklist

- [x] Materialize and config-check a fresh isolated managed stack.
- [x] Enroll the exact SOPS caller and create projected Gemini/Ornith routes without disclosure.
- [x] Pass managed runtime identity and authenticated zero-child admission gates.
- [x] Execute the authorized S12 live call exactly once with no retry.
- [x] On PASS only, publish the manifest and bounded contract/spec wording; no success files were written after FAIL.
- [x] Fill implementation-owned review evidence.

## Review-Only Checklist

- [x] Append one verdict and verified routing signals.
- [x] Verify provider ownership, secret handling, runtime isolation, and live cardinality.
- [x] Archive pair to suffix 12 and verify artifacts are not ignored.
- [x] On PASS only write `complete.log` and archive the task; otherwise materialize the correct next state.

## Deviations from Plan

- The deterministic credential smoke initially exposed two macOS portability gaps. TLS leaf material was changed from Ed25519 to ECDSA P-256 while the credential issuer remained Ed25519, and the negative OpenSSL probe now distinguishes a timeout from a rejected handshake.
- The managed catalog exposed an initial route revision of zero. Edge incorrectly rejected that valid Control Plane revision, so the binding now permits route revision zero while keeping credential revisions positive, with focused regression tests.
- The generated workspace containment guard used GNU-only `realpath -e --`; it now uses portable `realpath` and passes the same containment suite on Linux and macOS.
- The Claude harness authenticated catalog probe used Python TLS, which cannot negotiate the managed TLS 1.3 endpoint on this remote macOS Python. It now sends the secret only through curl config stdin and validates the bounded response separately.
- The isolated HTTPS leaf certificates gained loopback SANs so Claude can use `https://127.0.0.1:18483` without modifying system DNS or `/etc/hosts`.
- The sole live call failed with the sanitized class `api-rejected` before accepted single-request ingress. The no-retry rule was honored, so no success evidence or contract/spec update was produced.

## Key Design Decisions

- Claude, Gemini, and Ornith remained behind IOP for every runtime check. No direct provider request was issued.
- Remote SOPS `tokens.toki-dev-cline` was used only as Claude-to-IOP caller authentication. The existing Gemini provider credential was migrated into an encrypted managed slot and was never reused as caller authentication.
- Only the disposable managed stack under `/Users/toki/agent-work/iop-s12-managed-validation-20260808` was restarted. The canonical `/Users/toki/agent-work/iop-dev` runtime remained untouched.
- Caller/provider plaintext was kept out of argv, logs, tracked files, and review text. Secret-bearing HTTP headers were supplied over stdin; the disposable database retained only caller digest and encrypted slot ciphertext.

## Verification Results

### 1. Local no-provider gates

- `go test -count=1 -race ./apps/edge/internal/service ./apps/edge/internal/openai`: PASS.
- `bash -n scripts/e2e-single-request-claude.sh scripts/e2e-credential-slot-smoke.sh`: PASS.
- `scripts/e2e-single-request-claude.sh --self-test`: PASS, including authenticated admission, zero-child preflight, cleanup, signal, redaction, and atomic publication cases.
- `TMPDIR=/config/workspace/iop-s0/build scripts/e2e-credential-slot-smoke.sh`: PASS with deterministic two-slot projection and TLS negative matrix.
- `git diff --check`: PASS.

### 2. Managed material, binaries, and config

- Remote macOS `go test -count=1 ./apps/edge/internal/service ./apps/edge/internal/openai`: PASS after the portable containment repair.
- Fresh managed Edge build and `config check --config .../runtime/edge.yaml`: PASS.
- Fresh remote deterministic credential smoke: `result=success`; ECDSA P-256 loopback certificate SAN and TLS rejection matrix verified.
- Final disposable process identities: Control Plane PID 89097, Edge PID 89102, Node PID 89104. All commands resolve under the disposable runtime root.
- Control Plane status: one connected Node, two provider snapshots, both healthy. Canonical dev files/processes were not written or stopped.

### 3. Caller/provider projection and secret hygiene

- Authenticated catalog returned three entries: two managed route ids and exactly one `iop-single-request-light`.
- Disposable state contains one principal, two active credential slots, and two active routes: Gemini through `mac-gemini-api`, Ornith-fast through `rtx5090-lemonade`.
- Managed YAML contains no static caller/provider authorization header. The configured secrets were not emitted; plaintext scans against managed config/log/database were negative.

### 4. Runtime identity and zero-child preflight

- CP status returned one connected `node-smoke`, two healthy providers, and the declared workspace capability.
- Claude harness `--preflight-only`: PASS. The already-running unrelated Claude process count stayed 1 before/after; the harness introduced no live Claude invocation.
- Authenticated probe and preflight kept `iop_anthropic_single_request_ingress_total` at 0; result and manifest remained absent; the fresh preflight config directory was removed.

### 5. Sole live S12 invocation

- The guarded `--run` command was started exactly once. Durable guard state is `sole-live.rc-69`; no second `--run` was issued.
- Harness result: `Claude invocation failed (status 1 class api-rejected)`, wrapper `live_rc=69`.
- Accepted ingress remained 0 -> 0, existing Claude process count remained 1 -> 1, and both `smoke-result.txt` and the manifest remained absent.
- Edge/Node logs contain no request, stage, provider-run, or model-output record for the attempt; they contain only startup and connection lifecycle records. Therefore there is no Gemini/Ornith model output log to report—the request was rejected before those stages.
- The harness intentionally discarded raw CLI/API bodies during cleanup. The exact pre-ingress rejection subtype is not proven from retained evidence; plausible compatibility candidates must be tested provider-free rather than asserted as the cause.

### 6. Success-only manifest and documents

- Not executed by design. No qualification manifest was published, and the Anthropic contract plus runtime/input specs were not given a success claim.

## Reviewer Checkpoints

- Confirm canonical dev PIDs/config/database/listeners were unchanged.
- Confirm SOPS caller and provider plaintext never appeared in argv/output/tracked files and only encrypted slot ciphertext persisted.
- Confirm the authenticated managed catalog authorized exactly one canonical route per stage and one virtual model.
- Confirm Gemini/Ornith/Claude stayed behind IOP, exactly one live `--run` occurred, and there was no retry.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Fail | The only authorized real Claude request returned `api-rejected` before accepted ingress. |
| Completeness | Fail | S12 produced no ordered stages, workspace result, terminal, or manifest. |
| Test coverage | Fail | Deterministic tests cover the implemented boundaries, but the provider-free pre-ingress gate did not reproduce the request shape that the real Claude CLI rejected. |
| API contract | Fail | The managed Anthropic surface admitted the catalog but rejected the real Claude CLI before `recordSingleRequestIngress`. |
| Code quality | Pass | Portability and revision fixes are focused, formatted, and regression-tested. |
| Implementation deviation | Pass | Deviations repair concrete macOS/runtime blockers and stayed within the disposable stack. |
| Verification trust | Pass | The failed live outcome, unchanged ingress, absent outputs, and no-retry cardinality are consistently recorded; no success claim was written. |
| Spec conformance | Fail | SDD S12 requires one ingress plus Gemini -> Ornith-fast -> Gemini execution and verified workspace evidence; none was produced. |

### Findings

- Required R6 — `CODE_REVIEW-cloud-G10.md:91`: the sole live call exited `69` with sanitized class `api-rejected`, ingress stayed zero, and no model/stage output exists, so the S12 acceptance criteria at `PLAN-cloud-G10.md:164` and `PLAN-cloud-G10.md:170` remain unmet. Before requesting another live authorization, identify and repair the concrete pre-ingress Claude/Anthropic incompatibility with a provider-free request-shape gate; extend `scripts/e2e-single-request-claude.sh:979` to retain a bounded, secret-free rejection status/reason so the next failure is diagnosable without raw bodies.

### Routing Signals

- `review_rework_count=11`
- `evidence_integrity_failure=false`

### Next Step

Invoke the plan skill with Required R6 and the retained failed-run evidence; do not perform another live generation call without a new explicit authorization after the provider-free compatibility gate passes.
