<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=11 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - SOPS IOP caller S12

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=11

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_10.log` / `code_review_cloud_G10_10.log`; verdict `FAIL`, rework 9.
- `user_review_4.log` selects remote SOPS `tokens.toki-dev-cline` for caller auth and conditionally authorizes exactly one live call.
- Provider routing remains entirely IOP-owned, including Claude and Gemini.

## Implementation Item Completion

| Item | Status |
|---|---|
| LOCAL-REMOTE-GATES-1 | [x] |
| SOPS-PREFLIGHT-2 | [x] blocked at authenticated model admission |
| SOLE-LIVE-S12-3 | [ ] |
| EVIDENCE-DOC-SYNC-4 | [ ] |
| REVIEW-EVIDENCE-5 | [x] |

## Implementation Checklist

- [x] Pass local and remote no-provider gates.
- [x] Run authenticated SOPS caller zero-child preflight and stop closed on rejection.
- [ ] Execute one live S12 call with no retry.
- [ ] On PASS only, publish manifest and bounded docs.
- [x] Fill safe evidence.

## Review-Only Checklist

- [x] Append verdict/routing signals and verify all dimensions.
- [x] Archive pair to suffix 11 and verify artifacts are not ignored.
- [x] On PASS only write `complete.log` and archive the task; otherwise materialize the correct next state.

## Deviations from Plan

The authenticated zero-child preflight returned the harness's closed `authenticated model probe rejected` result. A bounded diagnostic request to the same catalog returned HTTP 200, proving caller authentication succeeded, but `iop-single-request-light` was absent. No Claude child and no live `--run` started, so the one-call authorization remains unused. Success-only evidence and documents were not written.

## Key Design Decisions

- Kept `toki-dev-cline` strictly as Claude Code -> IOP Edge caller authentication; decrypted it only in remote process memory and emitted neither plaintext nor a digest.
- Kept Claude, Gemini, Ornith, and every provider route inside IOP. No provider-direct fallback or substitution was attempted.
- Stopped before the sole live call because the preflight admission gate failed.
- Traced the catalog omission to the current legacy credential mode: marked `single_request` presets are deliberately rejected by `compileSingleRequestBindingForUnmanaged`, and the catalog skips presets whose route resolution fails.
- Chose a separate disposable managed dev runtime as the repair boundary. The canonical dev runtime will not be weakened, and the unmanaged guard will not be bypassed.

## Verification Results

### 1. Local no-provider gate

```text
bash -n: pass
self-test: pass
focused race tests:
  ok  iop/apps/edge/internal/service  1.066s
  ok  iop/apps/edge/internal/openai   1.065s
focused source assertions: pass
git diff --check: pass
local manifest: absent
```

### 2. Remote identity and SOPS principal binding

```text
remote_script_sha256=d19874140ee53985e9c13acdc9730190cc1975495a7222b7bbd6b17608ef0092
runtime_worktree_digest=sha256:a759f41c83a1573eb2c52856f991093128b556733d2c3bc240fef1443db2e598
sops_principal=toki-dev-cline-matched
candidate_state=ingress0-result_absent-manifest_absent
```

The SOPS file, AGE key, and selected caller principal were checked without printing secret material. Both candidate and canonical dev Edge configs are legacy (`credential_plane` absent/default false).

### 3. Authenticated zero-child preflight

```text
auth=api_key
[single-request-claude-smoke] validation failed: authenticated model probe rejected
preflight_exit=69
state=ingress0-result_absent-manifest_absent
claude_child=absent
temp_config=absent
```

A bounded provider-free catalog diagnostic returned HTTP 200 with the expected catalog envelope, but the selected `iop-single-request-light` model was absent. Authentication therefore passed; managed route admission did not exist in the running legacy runtime.

### 4. Sole live S12 invocation

Not run. The zero-child gate failed before `--run`; live authorization remains available for a future attempt only after a fresh managed-runtime preflight passes.

### 5. Success-only manifest and documents

Not run by design. No manifest exists, and no qualification wording was published.

## Reviewer Checkpoints

- Confirm SOPS caller plaintext/hash never appears in argv/output/files.
- Confirm all provider routing remains inside IOP and no direct provider substitution occurs.
- Confirm exactly one live `--run`, no retry, and completion only from the redacted manifest.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Result | Evidence |
|---|---|---|
| Correctness | Pass | The SOPS caller authenticated, and the closed preflight stopped before a provider child or live S12 request. |
| Completeness | Fail | The selected marked single-request model is suppressed by the running legacy credential mode; S12 remains unexecuted. |
| Test coverage | Pass | Local syntax, deterministic self-test, focused source assertions/race tests, remote identity, SOPS binding, and zero-child state checks are fresh. |
| API contract | Pass | All probes used the existing IOP Anthropic-compatible surface; no provider-direct call or contract change occurred. |
| Code quality | Pass | Secret material stayed in process memory, diagnostics were bounded, and no caller/provider credential was persisted or logged. |
| Implementation deviation | Pass | The live call and success-only writes were correctly skipped after the mandatory preflight failed. |
| Verification trust | Pass | HTTP 200 plus selected-model absence separates successful caller auth from route admission failure; ingress and child counts remained zero. |
| Spec conformance | Fail | SDD S12 still requires one accepted request and its closed, redacted manifest. |

### Findings

- **Required R4 — managed credential runtime:** the candidate and canonical dev runtimes use legacy credential mode. `compileSingleRequestBindingForUnmanaged` intentionally rejects every preset carrying `single_request`, and catalog construction omits the unresolved route. The valid SOPS caller token therefore cannot admit `iop-single-request-light` until a managed credential-plane projection exists. Do not remove this guard or weaken admission.
- **Required R5 — disposable managed provisioning:** the running Control Plane config/database has no managed credential-plane state or route/slot projections. Build a separate dev CP/Edge/Node runtime with the required TLS/keyring/issuer/recipient material and project the already declared IOP-owned provider credentials/routes into it. Gemini and Claude must remain IOP providers; no direct CLI-to-provider path is allowed.
- **Required S12:** after the new runtime passes exact identity, route-catalog, zero-child, and unchanged-ingress gates, execute the already authorized sole live call once with no retry. Authorization was not consumed in this review pass.

### Routing Signals

- `review_rework_count=10`
- `evidence_integrity_failure=false`

### Next Step

Create a follow-up plan that provisions and validates a disposable managed dev runtime without changing the canonical dev processes, imports only the already declared IOP caller/provider material without disclosure, then reruns the zero-child admission gate. The sole live S12 call remains conditional on that gate passing.
