<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=14 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Execute the newly authorized sole managed IOP S12 call

## For the Implementing Agent

Use the user's current `진행해` instruction as authorization for exactly one new Claude Code `--run` against the already repaired disposable managed IOP runtime. Refresh all runtime identity evidence first, pass a fresh zero-child/provider-free preflight, create a new durable cardinality guard, and then invoke once with no retry regardless of outcome. Claude is only the IOP caller; Gemini plan/review and Ornith-fast work remain IOP-owned provider routes. Never call any provider directly. Publish the manifest and update qualification owners only on closed PASS. Fill implementation-owned review evidence before official review.

## Background

Plan 13 repaired the concrete pre-ingress incompatibility: Edge now accepts `context-management-2025-06-27` plus object/null `context_management`, strips it from normalized Gemini Chat payloads, and the harness retains closed failure class/reason without raw output. The isolated managed runtime passes authenticated catalog and `count_tokens` through IOP with zero single-request/provider activity. The previous authorization was consumed by the failed Plan 12 attempt and is preserved as `sole-live.rc-69`; the user's current instruction supplies one new authorization for this follow-up only.

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G09_13.log` / `code_review_cloud_G09_13.log`; verdict `FAIL`, `review_rework_count=12`, `evidence_integrity_failure=false`.
- Managed runtime: `/Users/toki/agent-work/iop-s12-managed-validation-20260808`; CP PID 89097, Edge PID 93597, Node PID 89104; one connected Node and two healthy IOP provider snapshots.
- Closed readiness: catalog HTTP 200 with exactly one `iop-single-request-light`; object-shaped `context_management` count_tokens HTTP 200; ingress/lifecycle/dispatch/terminal all zero; no provider generation.
- Caller credential: remote SOPS key `tokens.toki-dev-cline`, decrypted only into process memory and used only for Claude-to-IOP authentication.

## Analysis

### Acceptance and Safety Boundary

- SDD S12 requires one admitted real Claude Code request, ingress delta 1, Gemini plan -> Ornith-fast work -> Gemini review/repair, bounded Node workspace operations, one verified changed result, cleanup, one terminal, and redacted stage/total timing evidence.
- Canonical `/Users/toki/agent-work/iop-dev` stays read-only. All execution remains under the disposable managed/source/workspace roots.
- Existing `sole-live.rc-69` is immutable prior evidence. New guard `sole-live-2.started` must be atomically created before invocation and renamed to `sole-live-2.rc-<live_rc>` afterward. Either name prevents any second attempt.
- Raw caller/provider secrets, prompts, provider bodies, model output, private workspace paths, and CLI captures must not be printed or tracked. The harness may inspect temporary bounded captures and must delete them.
- No direct Gemini, Ornith, or Claude provider endpoint is allowed. The only live action is Claude Code -> IOP Edge; IOP resolves every provider stage.

### Runtime Identity Refresh

- The managed Edge binary/config changed after Plan 12, so `runtime/runtime-evidence.json` must be regenerated atomically from the current isolated source, Claude 2.1.177, managed Edge/Node binaries, current config-check output, schema, base URL, public model, workspace identity, and canonical stage bindings.
- Run `--preflight-only` with the regenerated evidence and a fresh temporary Claude config. Require exact catalog membership, no Claude child, unchanged ingress, absent result/manifest, and cleanup before consuming the new guard.

## Finding Resolution Map

| Finding | Resolution | Completion evidence |
|---|---|---|
| R7 | Execute the user's new authorization exactly once through the repaired managed IOP boundary. | New durable guard, one `--run`, one captured `live_rc`, no retry, and closed harness result. |
| R7/S12 | On PASS, validate and publish only redacted S12 evidence and synchronize current owners. | Schema-valid identical manifest, ingress/stage/workspace/terminal assertions, bounded contract/spec qualification wording. |
| R7/S12 | On failure, preserve only safe diagnostics and leave qualification deferred. | Closed class/reason, guard rc, counter/log deltas, absent manifest/success-doc changes. |

## Dependencies and Execution Order

1. Re-run fresh local source/harness gates and sync the exact reviewed files to the isolated remote source.
2. Regenerate current runtime evidence atomically; verify managed process identities, fleet health, config, catalog, count_tokens, workspace/result absence, and old/new guard state.
3. Run a fresh harness `--preflight-only` with SOPS caller via memory/stdin; require zero child and unchanged ingress.
4. Atomically create `sole-live-2.started`, execute one harness `--run`, capture `live_rc`, and rename the guard. Never retry.
5. If PASS only, validate/copy the redacted manifest and update contract/runtime/input specs from S12 deferred to bounded qualification.
6. Run post-call cardinality/privacy/hygiene checks, fill review evidence, and stop for official review.

## Plan Items

### 1. FRESH-GATES-1 — freeze the repaired candidate and runtime identity

**Solution:** run fresh focused race/self-tests, synchronize only reviewed source, regenerate `runtime-evidence.json` against current managed binaries/config, and prove CP/Edge/Node plus catalog/count_tokens readiness. Do not mutate canonical dev.

**Checklist:**

- [ ] Fresh local race, harness self-test, syntax, contract/source, and diff checks pass.
- [ ] Current isolated source/binary/config/runtime evidence digests agree.
- [ ] Managed fleet/catalog/count_tokens/preflight pass with zero generation and unchanged ingress.

### 2. SOLE-LIVE-2 — execute exactly one newly authorized call

**Solution:** with a fresh Claude config and SOPS caller held only in memory, create the new durable guard and execute the harness once against `https://127.0.0.1:18483`, public model `iop-single-request-light`, the approved disposable workspace, managed Edge/Node, observation log, metrics endpoint, and refreshed runtime evidence. Capture only `live_rc` plus closed class/reason on failure.

**Checklist:**

- [ ] One new guard is created before the invocation and renamed to its rc afterward.
- [ ] Exactly one Claude child/one `--run`; no retry or direct provider command.
- [ ] Record ingress, stage/provider/terminal, workspace, cleanup, and process cardinality after return.

### 3. SUCCESS-SYNC-3 — publish only a closed PASS

**Solution:** only when `live_rc=0` and the remote manifest satisfies the existing schema, validate it again, copy atomically to the stable evidence path, require identical SHA-256, and replace only the explicit S12-deferred wording in the Anthropic contract plus two current specs with bounded qualification facts/evidence link. On failure, modify none of these success-only files.

**Success-only Files:**

- [ ] `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json`
- [ ] `agent-contract/outer/anthropic-compatible-api.md`
- [ ] `agent-spec/runtime/edge-node-execution.md`
- [ ] `agent-spec/input/openai-compatible-surface.md`

### 4. REVIEW-EVIDENCE-4 — record the actual one-call result

**Solution:** fill all implementation-owned sections with the new guard, `live_rc`, closed result, exact safe counters, model-stage families, workspace verification, manifest state, process identities, no-retry proof, and success-only doc decision.

**File:**

- [ ] `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md`

## Implementation Checklist

- [ ] Pass all fresh local and remote provider-free gates against current runtime evidence.
- [ ] Create the new durable guard and execute exactly one newly authorized Claude-through-IOP `--run`.
- [ ] Keep Gemini/Ornith/Claude provider routing entirely inside IOP and never retry.
- [ ] On PASS only, publish schema-valid redacted evidence and synchronize the contract/spec owners.
- [ ] On failure, retain only closed diagnostics and no success claims.
- [ ] Fill implementation-owned review evidence and stop for official review.

## Modified Files Summary

| File | Reason |
|---|---|
| `agent-test/evidence/iop-owned-single-request-agent-execution/claude-smoke-evidence.json` | Success-only stable redacted S12 manifest |
| `agent-contract/outer/anthropic-compatible-api.md` | Success-only bounded external qualification statement |
| `agent-spec/runtime/edge-node-execution.md` | Success-only current runtime qualification evidence |
| `agent-spec/input/openai-compatible-surface.md` | Success-only current input-surface qualification evidence |
| `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md` | Exact new-call evidence |

## Final Verification

1. Local fresh gates: focused Edge races, `bash -n`, harness `--self-test`, contract/source assertions, secret/redaction scan, and `git diff --check`.
2. Remote readiness: exact current source/binary/config/runtime-evidence identity; CP/Edge/Node alive; one connected Node; two healthy provider snapshots; selected catalog count 1; context-management `count_tokens` 200; old guard present/new guard absent; workspace result/manifest absent.
3. Remote preflight: fresh Claude config, SOPS caller only in process memory, harness `--preflight-only` exit 0, no child/result/manifest, unchanged ingress, cleanup complete.
4. Sole live: atomically create new guard; call `--run` once; capture `live_rc`; rename guard; do not retry.
5. Post-call: require exact ingress and terminal/stage/workspace/cleanup evidence on PASS, or closed class/reason plus absent success artifacts on failure; scan Edge/Node observations without printing raw model/provider payloads.
6. PASS-only publication: validate schema remotely/locally, atomic copy, identical SHA-256, bounded contract/spec update, and final hygiene. Never publish from a failure.

## Final Routing

- `evaluation_mode=isolated-reassessment`
- `finalizer=finalize-task-policy.sh`, `finalizer_mode=pair`
- build scores `2/2/2/2/2` => `G10`, `base_route_basis=grade-boundary`
- `large_indivisible_context=true`; matched risks: `temporal_state`, `concurrent_consistency`, `boundary_contract`, `variant_product`; count 4
- `review_rework_count=12`, `evidence_integrity_failure=false`; risk/recovery boundaries matched without replacing grade basis
- build `worker/cloud/G10`, `PLAN-cloud-G10.md`; review `review/cloud/G10`, `CODE_REVIEW-cloud-G10.md`
