# Complete - m-principal-provider-credential-slot-routing/04+03_principal_routes

## Completion Time

2026-08-01

## Summary

Completed the dormant managed principal route binding foundation after four reviewed loops (three FAIL, one final PASS); Required=0, Suggested=0, Nit=0.

## Loop History

| Plan | Review | Verdict | Notes |
|------|--------|---------|-------|
| `plan_local_G07_1.log` | `code_review_cloud_G08_1.log` | FAIL | Separated public route, internal model group, provider resource, and credential slot identities; required immutable projection and metadata fixes. |
| `plan_cloud_G08_2.log` | `code_review_cloud_G09_2.log` | FAIL | Required fixture fidelity, real initial/recovery admission coverage, native count-tokens coverage, and trustworthy command output. |
| `plan_cloud_G05_3.log` | `code_review_cloud_G05_3.log` | FAIL | Required complete Run/Tunnel binding assertions on all managed surfaces and the Chat public model echo. |
| `plan_cloud_G03_4.log` | `code_review_cloud_G03_4.log` | PASS | Complete binding oracle and fresh local verification passed. |

## Implementation and Cleanup

- Preserved projected resource selectors and route/credential revisions in deterministic managed projection fixtures.
- Proved distinct public route, internal catalog group, explicit provider resource, and credential slot binding across Chat, Responses, Anthropic Messages, local/native count-tokens, and initial/recovery admission.
- Asserted the exact trusted route/credential metadata on both recorded Run and Tunnel templates for Chat, Responses, and Messages.
- Proved Chat rewrites a provider-served model response echo to the caller-selected public route while Responses and Anthropic passthrough behavior remains unchanged.
- Retained generation-swap and fail-closed/no-fallback coverage without activating the plain Control Plane-Edge projection transport.
- Retained the initial plan=0 draft logs as non-verdict setup evidence; they are not counted as a reviewed loop.

## Final Verification

- `test "$(find agent-task/archive -type f -path '*/m-principal-provider-credential-slot-routing/03+01,02_projection_auth/complete.log' -print | wc -l)" -eq 1` - PASS; exactly one predecessor completion exists.
- `test -z "$(gofmt -d apps/edge/internal/openai/principal_routes_test.go)"` - PASS; no formatting diff.
- `GOTMPDIR=/config/workspace/iop-s0/.cache/go-build GOCACHE=/config/workspace/iop-s0/.cache/go-cache go vet ./apps/edge/internal/authprojection ./apps/edge/internal/openai ./apps/edge/internal/service` - PASS; no vet findings.
- `GOTMPDIR=/config/workspace/iop-s0/.cache/go-build GOCACHE=/config/workspace/iop-s0/.cache/go-cache go test -count=1 ./apps/edge/internal/authprojection ./apps/edge/internal/openai -run 'ManagedSurfacesUseDistinctBinding|ManagedProjectionFixture|ManagedCountTokensLocalAndNative|ManagedRecoveryReentersProviderPool|GenerationSwap|NoFallback'` - PASS; focused managed binding and recovery tests passed.
- `GOTMPDIR=/config/workspace/iop-s0/.cache/go-build GOCACHE=/config/workspace/iop-s0/.cache/go-cache go test -race -count=1 ./apps/edge/internal/authprojection ./apps/edge/internal/openai -run 'ManagedSurfacesUseDistinctBinding|ManagedCountTokensLocalAndNative|ManagedRecoveryReentersProviderPool|GenerationSwap|NoFallback'` - PASS; focused race tests passed.
- `GOTMPDIR=/config/workspace/iop-s0/.cache/go-build GOCACHE=/config/workspace/iop-s0/.cache/go-cache go test -count=1 ./apps/edge/internal/authprojection ./apps/edge/internal/openai ./apps/edge/internal/service` - PASS; affected package suites passed.
- `GOTMPDIR=/config/workspace/iop-s0/.cache/go-build GOCACHE=/config/workspace/iop-s0/.cache/go-cache go test -count=1 ./apps/edge/...` - PASS; full Edge regression suite passed.
- `if rg --sort path -n 'PrincipalProjection' apps/control-plane/internal/wire/edge_server.go apps/edge/internal/controlplane/connector.go apps/edge/internal/bootstrap/runtime.go; then exit 1; else exit 0; fi` - PASS; unauthenticated runtime activation remains absent.
- `git diff --check` - PASS; no whitespace errors.

## Remaining Nits

- None.

## Follow-up Work

- None for this task packet. Managed projection transport activation and roadmap Task completion remain outside this dormant foundation packet.
