<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=17 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - Claude tool-search request compatibility

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> Complete implementation and verification exactly as planned, fill every implementation-owned section, then stop with the active files in place. Do not append a verdict, archive files, write `complete.log`, invoke a live model/provider, or classify the next state.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=17, tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Closed pair: `plan_cloud_G10_16.log` / `code_review_cloud_G10_16.log`; verdict `FAIL`, Required R10, `review_rework_count=15`, `evidence_integrity_failure=false`.
- The authorized execution created `sole-live-3.rc-69`, had ingress delta 0, no Gemini/Ornith stage or model output, no manifest, and no retry. All three live guards are immutable.
- Before repair, authenticated provider-free probes returned baseline 200, `advanced-tool-use-2025-11-20` 400, tool `defer_loading` 400, and unsupported tool `strict`, `eager_input_streaming`, and thinking-display shapes 400, with generation deltas zero.
- Disposable runtime root is `/Users/toki/agent-work/iop-s12-managed-validation-20260808`; isolated source is `/Users/toki/agent-work/iop-s12-validation-20260808/source`; canonical `/Users/toki/agent-work/iop-dev` remains read-only.

## For the Review Agent

Compare each item against source, contract, tests, managed runtime identity, provider-free status/counter evidence, and immutable guards. Append one verdict and routing signals, archive the pair, and materialize the matching next state. This plan cannot qualify S12 and must not create PASS-only smoke evidence.

## Implementation Item Completion

| Item | Status |
|---|---|
| REVIEW_API-1 | [x] |
| REVIEW_API-2 | [x] |
| REVIEW_API-3 | [x] |
| REVIEW_API-4 | [x] |

## Implementation Checklist

- [x] Add bounded `advanced-tool-use-2025-11-20` and boolean tool `defer_loading` compatibility without normalized Chat authority or forwarding.
- [x] Add regression and boundary assertions, and update the external Anthropic compatibility contract.
- [x] Rebuild only the disposable managed dev Edge and pass exact provider-free repaired/unsupported-field probes with zero generation activity.
- [x] Run fresh local and remote focused/race/harness/diff/redaction gates without any live or direct provider call.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified routing signals.
- [x] Verify verdict dimensions and Required/Suggested/Nit classifications.
- [x] Archive active review to `code_review_cloud_G10_17.log` and plan to `plan_cloud_G10_17.log`.
- [x] Verify the Agent-Ops managed `.gitignore` task-artifact block.
- [x] Materialize the verdict's next filesystem state; write no `complete.log` unless fully PASS.

## Deviations from Plan

- The plan's focused regex named a nonexistent `TestAnthropicRejectsUnknownFieldsAndBetas`. It was replaced with `go test -count=1 ./apps/edge/internal/openai -run 'TestAnthropic(ChatBridgeClaudeCodeRequest|ChatBridgeRejectsUnsupportedBeforeWire)'`, which ran both actual tests and passed.
- The first post-rebuild fleet checker used HTTP for the managed Control Plane TLS port and stopped at HTTP 400 before any count-token request. It was corrected to HTTPS with the managed CA.
- Two harness preflight attempts stopped at the health probe because the disposable two-hour CA and all leaf certificates expired at 04:44:20 UTC during validation. Neither attempt can invoke Claude because both used `--preflight-only` and stopped before the authenticated catalog probe.
- The expired CA meant an Edge-only leaf refresh was impossible. The existing deterministic credential-slot smoke generated fresh ECDSA managed CA/leaf material using only its local fake providers; the disposable CP/Edge/Node were restarted together, recoverable `*.pre-tool-search-cert` backups were retained, and the script's retained temporary directory was deleted. No canonical dev or external provider was touched.

## Key Design Decisions

- Added exactly one beta allowlist value and one boolean decoded tool field. The normalized converter remains field-by-field and therefore omits `defer_loading`; the regression test asserts omission at both tool and function levels.
- Kept `strict`, `eager_input_streaming`, and thinking-display unsupported in the strict schema. This avoids granting compatibility beyond the installed request path established by current evidence.
- Reused the SOPS caller only for authenticated IOP catalog/count-token/preflight requests. All probes were provider-free; the three consumed live guards stayed immutable and no live authorization was inferred.

## Reviewer Checkpoints

- Confirm only the beta allowlist and boolean `defer_loading` compatibility schema changed; unsupported neighboring shapes remain rejected.
- Confirm the representative Claude request passes and normalized Chat contains neither the beta header nor `defer_loading`.
- Confirm only the disposable isolated source/runtime changed, canonical dev stayed untouched, and runtime identity matches the rebuilt Edge.
- Confirm exact provider-free status matrix, zero generation/activity, zero Claude processes, unchanged three guards, and no live/direct provider request.
- Confirm contract language makes both inputs non-authoritative and no S12 success claim or manifest was published.

## Verification Results

### 1. Source, regression, and contract

- `supportedAnthropicBetas` now contains `advanced-tool-use-2025-11-20`; `anthropicTool` now decodes boolean `DeferLoading` from `defer_loading`.
- `TestAnthropicChatBridgeClaudeCodeRequest` sends both inputs and asserts no Anthropic beta header or `defer_loading` key reaches normalized Chat. `TestAnthropicChatBridgeRejectsUnsupportedBeforeWire` now locks `strict`, `eager_input_streaming`, thinking-display, and unknown-beta rejection before provider wire.
- Contract lines 227-242 and 313-320 describe beta/tool compatibility, native raw preservation, normalized omission, and the absence of route/provider/workspace/tool-policy/authorization authority.
- Corrected focused command output: `ok  iop/apps/edge/internal/openai  0.033s`.

### 2. Local fresh gates

Commands:

1. `gofmt -w apps/edge/internal/openai/anthropic_types.go apps/edge/internal/openai/anthropic_bridge_test.go`
2. `go test -count=1 ./apps/edge/internal/openai`
3. `go test -count=1 -race ./apps/edge/internal/openai ./apps/edge/internal/service`
4. `bash -n scripts/e2e-single-request-claude.sh && scripts/e2e-single-request-claude.sh --self-test`
5. `git diff --check`

- `gofmt`: exit 0, no output.
- Focused package: `ok  iop/apps/edge/internal/openai  8.542s`.
- Race: `ok  iop/apps/edge/internal/openai  12.552s`; `ok  iop/apps/edge/internal/service  9.328s`.
- Harness syntax/self-test: exit 0; `[single-request-claude-smoke] self-test passed: exact Claude base-route coverage, authenticated model admission, closed failure classification, model/Edge/Node/runtime binding, zero-child preflight, derived verification, redaction, cleanup, signal handling, and atomic publication`.
- `git diff --check`: exit 0, no output.

### 3. Disposable managed dev rebuild

- Synchronized exactly `anthropic_types.go`, `anthropic_bridge_test.go`, and `anthropic-compatible-api.md` to `/Users/toki/agent-work/iop-s12-validation-20260808/source`. No command targeted canonical `/Users/toki/agent-work/iop-dev`; it remained on branch `dev` and differs from the isolated candidate.
- Remote tests: `ok  iop/apps/edge/internal/openai  8.742s`; race `openai 12.435s`, `service 9.867s`.
- Rebuilt only the candidate Edge from the isolated source. Initial Edge PID changed 698 -> 7011; backups `iop-edge.pre-tool-search` and `runtime-evidence.pre-tool-search.json` were retained and runtime evidence was atomically refreshed.
- During the required certificate refresh, disposable CP/Edge/Node PIDs changed 89097/7011/89104 -> 8782/8786/8790. Current fleet is one online Edge, one connected Node, and two `available`/`healthy` provider snapshots. Fresh managed cert/key backups use the exact `*.pre-tool-search-cert` suffix.

### 4. Provider-free compatibility and no-live proof

Expected status matrix: baseline 200; advanced beta 200; tool `defer_loading` 200; tool `strict` 400; tool `eager_input_streaming` 400; thinking-display 400.

- Final authenticated IOP matrix exactly matched: baseline 200; advanced beta 200; tool `defer_loading` 200; tool `strict` 400; tool `eager_input_streaming` 400; thinking-display 400. HTTP 200 bodies contained positive integer `input_tokens`; HTTP 400 bodies were `invalid_request_error`.
- Catalog returned HTTP 200 with `iop-single-request-light` count 1. Ingress, single-request lifecycle, hot-path dispatch/terminal, and OpenAI provider request counter sums were identical before/after: `generation_activity_delta=0`.
- Final harness output: `[single-request-claude-smoke] preflight passed without a Claude invocation`; preflight output absent, workspace result absent, Claude executable processes 0.
- Guards: three finalized `sole-live*.rc-69`, zero `.started`; no new guard, `--run`, Gemini/Ornith/Claude provider call, retry, result, manifest, or model output occurred.

### 5. Privacy and final hygiene

- SOPS caller material remained in process memory and was unset after each probe. No token, private key, prompt, response body, model output, or digest was printed or tracked. The temporary credential-smoke directory was safely removed after managed cert rotation.
- Source/contract redaction scan: PASS. `git diff --check`: PASS. Active and archived task artifacts are unignored: PASS. The active pair has identical headers/snapshots, 15 `REVIEW_` prefixes, and no unresolved routing-template token.
- No stable S12 evidence manifest or success-only qualification statement was created. This packet closes R10 compatibility only; a new real call still requires separate user authorization after official review.

---

> Implementer: fill every implementation-owned field, then stop for official review. Leave review-only state unchanged.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Pass | The two installed tool-search inputs now decode successfully, grant no normalized authority, and adjacent unsupported shapes remain fail-closed. |
| Completeness | Fail | R10 implementation and provider-free dev qualification are complete, but S12 still lacks one admitted real Claude execution. |
| Test coverage | Pass | Representative acceptance, normalized omission, unknown/adjacent rejection, local/remote focused/race suites, and exact dev status probes cover the change. |
| API contract | Pass | Source and contract agree on accepted beta/tool syntax, native raw behavior, normalized omission, and non-authoritative semantics. |
| Code quality | Pass | The change is one sorted allowlist entry, one typed field, bounded regression assertions, and focused documentation without speculative schema expansion. |
| Implementation deviation | Pass | HTTP/TLS preflight failures stopped before generation; expired disposable certificates were refreshed with existing deterministic tooling, recoverable backups, and no canonical or provider mutation. |
| Verification trust | Pass | Fresh local/remote tests, exact 200/200/200 and 400/400/400 probe matrix, zero activity, healthy fleet, preflight PASS, zero Claude processes, and unchanged guards agree. |
| Spec conformance | Fail | SDD S12 and roadmap `claude-smoke` require actual ingress 1, ordered Gemini -> Ornith-fast -> Gemini stages, workspace result, timing, cleanup, and one terminal. |

### Findings

- Required R11 — `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/iop-owned-single-request-agent-execution.md:90`: the repository-owned Claude 2.1.177 compatibility boundary and repaired disposable dev runtime now pass provider-free validation, but S12 cannot be qualified without one actual Claude Code request through IOP. The previous authorization was consumed exactly once by `sole-live-3.rc-69`; require a new explicit authorization before creating a distinct `sole-live-4.started` -> `sole-live-4.rc-<live_rc>` guard and running exactly one call. Keep the SOPS caller credential only for Claude-to-IOP auth, keep Gemini plan/review and Ornith-fast work as IOP-owned internal routes, and prohibit retry or direct provider calls.

### Routing Signals

- `review_rework_count=16`
- `evidence_integrity_failure=false`

### Next Step

USER_REVIEW — request explicit authorization for exactly one fourth guarded Claude-through-IOP execution on the repaired disposable dev runtime; do not reuse the consumed authorization or invoke any provider directly.
