<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=10 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Close S12 credential preflight and failure-classification gaps

## For the Implementing Agent

Implement only the provider-free harness repair and its deterministic coverage, then synchronize the reviewed script to the disposable candidate and run `--preflight-only`. Do not execute Claude `--print`/`--run`, call a provider, create a manifest, update qualification owners, request live authorization, or write `complete.log`. Fill the implementation-owned review sections with secret-safe outputs.

## Background

Plan 9 synchronized the repaired `--verbose` command and consumed exactly one authorized live invocation. Clean config selected `api_key`, but the child exited 1 after roughly the bounded call interval, ingress stayed 0, and no result/manifest appeared. Official review found that current preflight proves only secret presence and unauthenticated listener reachability, not Edge principal/model admission. It also discards bounded child captures while surfacing only numeric status, preventing safe diagnosis.

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_9.log` / `code_review_cloud_G10_9.log`; verdict `FAIL`, `review_rework_count=8`, `evidence_integrity_failure=false`.
- Remote candidate after plan 9: source HEAD `70d22850d01714fdef734dafa42e82fed79e0786`, reviewed script digest `9c01d0b6...`, runtime evidence bound to worktree digest `sha256:693baad8...`, Edge/Node processes unchanged, ingress 0, result/manifest absent.
- Exact prior live outcome: `auth=api_key`, harness 69, child 1, no retry, no raw capture retained, no qualification promotion.
- Edge ordering evidence: authentication occurs before dispatch; S12 ingress increments only after authentication, request decoding, route selection, and single-request capability resolution.

## Finding Resolution Map

| Finding | Resolution | Verification |
|---|---|---|
| R1 | Add an authenticated, bounded, no-provider Anthropic model-catalog probe to preflight using the in-memory secret; require HTTP 200, exact response structure, selected public model presence, and unchanged S12 ingress. | Deterministic fake success plus credential rejection, model absence, malformed body, counter-change, and redaction cases; remote `--preflight-only` classifies actual admission without Claude. |
| R2 | Classify bounded temporary Claude stdout/stderr into a closed allowlist before cleanup and emit only the class with status. | Fake failures cover CLI validation, authentication rejection, transport failure, API rejection, and unknown while asserting no raw value or temporary capture remains. |
| R3 | Preserve the live boundary. | No Claude/provider invocation or manifest/document promotion occurs in this packet. |

## Analysis

### Files Read

- `scripts/e2e-single-request-claude.sh` preflight, supervisor, cleanup, fake listener, fixtures, preflight mutation matrix, and run-failure matrix
- `apps/edge/internal/openai/routes.go:32-47`
- `apps/edge/internal/openai/anthropic_handler.go:144-160`
- `apps/edge/internal/openai/common_types.go:49-62`
- `apps/edge/internal/openai/anthropic_types.go:142-165`
- `plan_cloud_G10_9.log` / `code_review_cloud_G10_9.log`

### Design

- Derive the authenticated catalog URL from the validated origin as `/anthropic/v1/models` and supply `x-api-key` plus `anthropic-version` from process memory only. Never place the secret in argv, output, files, or tracked evidence.
- Bound the response to 8192 bytes, require an exact top-level Anthropic catalog shape and a unique `data[].id` match for the selected model, and map every error to one closed preflight message.
- Snapshot the S12 ingress counter immediately before and after the catalog probe and require equality. The catalog call must not be accepted as an S12 request.
- Classify only allowlisted byte patterns from the already bounded temporary child captures. Output one of `cli-validation`, `authentication-rejected`, `transport-failure`, `api-rejected`, or `unknown`; never output matched text.

### Test Coverage

- Extend the existing fake HTTP listener and preflight matrix; all rejection cases must start zero fake Claude children and preserve empty output/temporary directories.
- Extend the fake Claude failure matrix with recognized/unknown classes and assert the closed class is present while the sentinel secret/model/base/workspace/output are absent.
- Keep all existing lifecycle, signal, redaction, runtime binding, manifest mutation, and atomic publication cases.

### Scope Rationale

Modify only `scripts/e2e-single-request-claude.sh` and active review evidence locally. After local review gates pass, synchronize that exact script to only the existing disposable remote candidate, atomically refresh only its `source.worktree_digest`, and run zero-child preflight. Do not change product runtime code, schemas, configs, canonical dev checkout, processes, workspace result, evidence manifest, contract/spec/roadmap, or credential storage.

### Final Routing

- Finalizer `pair`; build `grade-boundary`, scores `2/2/2/2/2`, `large_indivisible_context=true`, four matched risks, `review_rework_count=8`, `evidence_integrity_failure=false` => cloud `G10`.
- Review `official-review`, scores `2/2/2/2/2` => cloud `G10`.

## Implementation Checklist

- [ ] Add the bounded authenticated catalog probe and unchanged-ingress assertion before observation capture.
- [ ] Add closed child failure classification without persisting or emitting raw content.
- [ ] Extend deterministic fake coverage for every new success/failure/redaction invariant.
- [ ] Pass local gates, sync exact script and worktree binding to the disposable candidate, and run only remote `--preflight-only`.
- [ ] Fill implementation-owned review evidence.

## Modified Files Summary

| File | Reason |
|---|---|
| `scripts/e2e-single-request-claude.sh` | Authenticated model-admission preflight, ingress invariance, closed failure classification, deterministic coverage |
| `agent-task/m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification/CODE_REVIEW-cloud-G10.md` | Safe implementation/verification evidence |

## Final Verification

1. `bash -n scripts/e2e-single-request-claude.sh`.
2. `make test-single-request-claude-smoke-self-test`; no installed Claude/provider process is allowed.
3. Focused source assertions require the authenticated catalog route/headers, bounded exact parsing, before/after ingress equality, closed five-class allowlist, and fake rejection cases.
4. `go test -race -count=1 ./apps/edge/internal/service -run '^TestSingleRequestObservationSynchronousContinuationOrdering$'` and `go test -race -count=1 ./apps/edge/internal/openai -run '^TestAnthropicSingleRequestObservation$'`.
5. `git diff --check` and task-artifact ignore check.
6. After 1-5 pass, copy the exact script to a temporary path in the disposable candidate, verify SHA-256, atomically install mode 755, run remote syntax/self-test, recompute the harness worktree digest, and atomically update only runtime-evidence `source.worktree_digest`.
7. Run exactly one remote `--preflight-only` with fresh `CLAUDE_CONFIG_DIR` and the configured API key. Record only `auth=api_key`, the closed harness result, unchanged ingress, and absent result/manifest. This command must start no Claude child and must not call a provider.

After implementation, fill the active review and stop for official review.
