<!-- task=m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual plan=6 tag=REVIEW_REVIEW_TEST milestone-task=hot-smoke -->

# Complete - m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual

## Completed At

2026-08-05

## Summary

Closed the provider-credential boundary and pilot-evidence integrity follow-up after seven plan/review pairs; final verdict PASS. This is a `hot-smoke` contribution and does not assert S16 or Milestone Task completion.

## Loop History

| Plan | Review | Verdict | Notes |
|------|--------|---------|-------|
| `plan_local_G07_0.log` | `code_review_cloud_G07_0.log` | unknown | Initial pair was archived without a recorded verdict. |
| `plan_local_G07_1.log` | `code_review_cloud_G07_1.log` | FAIL | Runtime/profile identity and fresh observation binding were incomplete, and the actual matrix was absent. |
| `plan_cloud_G07_2.log` | `code_review_cloud_G07_2.log` | FAIL | Production observation parsing, native Pi events, and empty-reservation handling were incompatible. |
| `plan_cloud_G09_3.log` | `code_review_cloud_G09_3.log` | FAIL | Timeout closure and Pi JSON error-exit semantics were incompatible. |
| `plan_cloud_G08_4.log` | `code_review_cloud_G08_4.log` | FAIL | Repository fixes passed, but the matching external runtime inputs remained unavailable. |
| `plan_cloud_G06_5.log` | `code_review_cloud_G06_5.log` | FAIL | Cleanup evidence false-passed without `ss`, and the Pi pilot reused inbound caller auth as provider auth. |
| `plan_cloud_G05_6.log` | `code_review_cloud_G05_6.log` | PASS | Config admission, deterministic cleanup evidence, and Pi row invalidation passed fresh review. |

## Implementation/Cleanup

- Added case-insensitive, whitespace-normalized rejection of `Authorization` and `X-Api-Key` as legacy `openai.provider_auth.from_header` values.
- Added focused negative cases while preserving the dedicated default and custom provider-header success controls.
- Replaced the prior false-pass cleanup claim with fail-closed root, worktree, process, listener, and credential-retention evidence.
- Reclassified `pi:direct` and `pi:repair` as `invalid_auth_setup` with no S16 credit; S16 and `hot-smoke` remain open.

## Final Verification

- `TMPDIR=/config/workspace/iop-s0 go test -count=1 ./packages/go/config -run 'TestLoadEdge_OpenAIProviderAuth(EnabledDefaults|Override|RejectsBlankHeaders|RejectsInboundCallerAuthHeaders)$'` - PASS; `ok iop/packages/go/config`.
- `TMPDIR=/config/workspace/iop-s0 go test -count=1 ./packages/go/config` - PASS; `ok iop/packages/go/config`.
- `TMPDIR=/config/workspace/iop-s0 go test -race -count=1 ./packages/go/config ./apps/edge/internal/openai ./apps/node/internal/adapters ./apps/node/internal/node` - PASS; all four packages passed with the race detector.
- `TMPDIR=/config/workspace/iop-s0 go vet ./packages/go/...` - PASS; no output.
- Deterministic cleanup/retention block - PASS; root absent, iop-s2 clean, and process/listener/secret/endpoint counts all zero.
- `git diff --check` - PASS; no output.

## Remaining Nits

- None.

## Follow-up Work

- A future task must produce contract-valid actual Claude/Pi evidence for SDD S16. This completion does not close `hot-smoke`.
