<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=30 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Rebind isolated Work through canonical dev IOP and execute the thirteenth guard

## For the Implementing Agent

Perform the disposable runtime repair and verification below, fill every implementation-owned section of `CODE_REVIEW-cloud-G10.md`, keep the active pair in place, and stop for official review. Do not append a verdict, archive task files, write `complete.log`, or create user-review state. Keep canonical dev configuration and processes read-only. If any provider-free setup or identity check fails, create no guard and invoke no model. After all gates pass, execute exactly one `sole-live-13` Claude-through-IOP run with no retry.

## Background

Two guarded runs prove the isolated ad-hoc Mac `iop-node` cannot open the direct RTX LAN endpoint even while system curl/nc/Python and provider health succeed. The canonical dev IOP on the same Mac is already running, its authenticated catalog exposes `ornith-fast`, and its canonical Windows Node owns the RTX provider connection. Rebinding only the disposable Work upstream to that loopback IOP preserves the intended IOP-owned inference boundary and avoids an untracked proxy or direct model call.

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_29.log` / `code_review_cloud_G10_29.log`; verdict `FAIL`, Required R29, `review_rework_count=28`, `evidence_integrity_failure=false`.
- `sole-live-12.rc-69` is immutable: ingress `1 -> 2`, provider tunnels `8 -> 10`, Plan success 1, Work provider error 1, cleanup success 1, terminal provider error 1, no result/manifest, and no retry.
- The latest Node error is byte-identical to live 11 (`sha256:24e422f5af13d03b7494c7f2dade2557d3dd17725d6b5f4b411a7b228d2fc252`, `no route to host`). Proxy variables are absent; system LAN clients pass. Canonical dev IOP health/models return 200 with `ornith-fast` using the designated SOPS IOP key.

## Finding Resolution Map

| Finding | Mode | Exact resolution | Changed precondition and acceptance evidence |
|---|---|---|---|
| R29 | direct-fix | Transactionally back up and rebind disposable `s12-ornith` credential/route plus both isolated provider endpoint declarations to canonical dev IOP loopback model `ornith-fast`; refresh runtime identity and run one new guard | Direct LAN failed twice only inside isolated Node. Canonical IOP loopback catalog is reachable and owns the working RTX Node path. Success still requires one isolated ingress and ordered Gemini -> Ornith -> Gemini, verified workspace, cleanup, terminal, redacted manifest. |

## Scope and Safety

- Back up the disposable `edge.yaml`, `credentials.db`, and `runtime-evidence.json` to new non-overwriting `.pre-plan30-iop-route` files before mutation. Restore them and restart the disposable fleet if setup fails before guard creation.
- Rotate only active slot alias `s12-ornith` with the process-memory value of SOPS `tokens.toki-dev-cline`. Revoke only its old active route and create one replacement with profile `openai`, upstream model `ornith-fast`, and resource selector `rtx5090-lemonade`. Never print or persist the plaintext outside encrypted CP storage.
- Change exactly the two isolated `rtx5090-lemonade` endpoint declarations from the LAN URL to `http://127.0.0.1:18083/v1`. Do not mutate `/Users/toki/agent-work/iop-dev`, canonical DB/config, or canonical processes.
- Restart only the disposable Edge/Node as required, rebind config/config-check digests in runtime evidence, and prove Control Plane/Edge/Node plus canonical IOP catalog connectivity.
- Require twelve finalized guards, zero `.started`, and no result/manifest. A failed `sole-live-13` is not retried and publishes no partial evidence.

## Modified Files Summary

| Target | Change |
|---|---|
| Disposable `runtime/edge.yaml` | Point both `rtx5090-lemonade` endpoint declarations at canonical dev IOP loopback |
| Disposable `runtime/credentials.db` | Rotate encrypted Work slot and replace its active route with upstream `ornith-fast` |
| Disposable `runtime/runtime-evidence.json` | Rebind the changed config and config-check digests while preserving verified source/binary identities |
| Disposable guard/evidence | Create exactly one `sole-live-13` guard and publish only complete harness-owned evidence |

## Implementation Checklist

- [x] Capture safe pre-state, create non-overwriting recovery backups, and verify the exact active Work slot/route plus canonical IOP `ornith-fast` catalog.
- [x] Rotate the Work slot from SOPS process memory, revoke the exact old route by CAS, create the replacement route, and verify safe aliases/revisions without exposing ciphertext or secrets.
- [x] Change exactly two isolated endpoint values, pass config check/diff scope, restart only disposable Edge/Node, and prove fleet/catalog connections.
- [x] Atomically refresh runtime evidence for the changed config/config-check identities and pass harness self-validation/preflight with no generation.
- [x] Prove twelve finalized guards, zero started guards, no output artifacts, supported/unsupported count-token behavior, and unchanged ingress/provider-tunnel/Claude counts.
- [x] Create/finalize exactly one `sole-live-13` guard around one harness `--run`; retain only fixed diagnostics and structured counts and never retry.
- [x] On success validate schema, exact result, ingress delta 1, ordered stages, workspace verification, cleanup, terminal, binding, and redaction; on failure prove no partial publication.
- [x] Fill implementation-owned review fields and stop for official review.

## Final Verification

1. The disposable CP lists one active rotated `s12-ornith` slot and one active replacement route with upstream `ornith-fast`; old route is revoked and no plaintext secret appears.
2. Exact config diff contains only two endpoint replacements, config check passes, runtime evidence matches current source/binaries/config, and provider-free harness preflight changes no live counters.
3. Exactly one thirteenth Claude invocation uses `https://127.0.0.1:18483`; Work reaches canonical IOP through loopback, whose existing IOP Node owns Ornith execution.
4. PASS requires the closed schema-valid manifest and exact workspace result. Any failure finalizes `sole-live-13.rc-N`, publishes nothing, and is not retried.
