<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=21 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - Deterministic Claude child and closed pre-ingress diagnostics

> **[IMPLEMENTING AGENT — READ FIRST]** Implement only Required R14, run provider-free verification, fill every implementation-owned section, and stop. Do not run Claude or any provider generation, create a sixth guard, append a verdict, archive files, request user input, or write completion evidence.

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=21, tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_20.log` / `code_review_cloud_G10_20.log`; verdict `FAIL`, Required R14, `review_rework_count=19`, `evidence_integrity_failure=false`.
- All five authorizations are consumed as immutable guards ending in `.rc-69`. No model invocation is authorized in this packet.
- Disposable managed fleet is CP/Edge/Node `47248/47254/47260`; canonical dev remains read-only.

## For the Review Agent

Verify the child-only environment freeze follows installed Claude semantics, diagnostics use fixed classes and cannot leak arbitrary input, existing strict rejection behavior remains intact, isolated provider-free gates pass, and no model/guard/publication activity occurred. Append one verdict and materialize its required next state.

## Implementation Item Completion

| Item | Status |
|---|---|
| REVIEW_API-1 | [x] |
| REVIEW_API-2 | [x] |
| REVIEW_API-3 | [x] |
| REVIEW_API-4 | [x] |

## Implementation Checklist

- [x] Freeze the supervised Claude child with `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1` and no broader process mutation.
- [x] Require the fake Claude to observe that exact value and preserve every existing supervisor/cardinality invariant.
- [x] Add fixed-enum harness and Edge rejection classification with no raw request/error interpolation.
- [x] Cover known safe classes plus arbitrary/secret-shaped unknown input collapsing to generic validation.
- [x] Pass local focused/race/self-test/diff and isolated macOS focused/race/rebuild/provider-free/preflight gates.
- [x] Prove zero model/provider generation, unchanged five guards, zero Claude process, and absent result/manifest.
- [x] Fill implementation-owned review sections and stop for official review.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** Implementers must not modify this section.

- [x] Append one verdict and verified routing signals.
- [x] Verify installed-client semantics, child environment scope, diagnostic non-leak, tests, isolated runtime, and no-model cardinality.
- [x] Archive the active pair and materialize the verdict's next state.

## Deviations from Plan

- The first remote synchronization copied the locally accumulated `single_request_handler_test.go` and exposed one unrelated helper dependency absent from the isolated source. The remote baseline was restored from the pre-R14 backup and only the R14 test block was reapplied; the final focused and race suites passed.
- The first runtime non-leak scan looked at the stale bootstrap `edge.log` after the entire provider-free matrix had already passed. Process file-descriptor inspection identified the live target as `edge-runtime.log`; the existing event there proved the fixed `unknown_field` class and marker absence without repeating the request.
- The first preflight stopped before authenticated probes because the rebuilt Edge's version-output digest had been calculated from a different representation. The exact captured `iop-edge version` bytes were hashed, the runtime evidence was atomically replaced with a recoverable backup, and the fresh preflight passed. No model call or accepted ingress occurred in any deviation.

## Key Design Decisions

- `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1` is assigned only in `run_claude_child`; the parent shell, user configuration, credentials, and provider routes remain unchanged.
- The harness may inspect its private temporary error capture but emits only the closed reasons `unsupported-beta`, `unknown-field`, `invalid-thinking`, `invalid-output-config`, or the existing generic HTTP class. Fake cases assert that secret-shaped raw markers never reach the closed output.
- Edge records only `surface=messages`, a repository-owned `rejection_class`, and `http_status`. Classification consumes the validation error internally, while the existing client-visible Anthropic error status/body behavior remains unchanged.
- Qualification remained provider-free: catalog, local `/count_tokens`, one deliberately invalid pre-ingress Messages request, static installed-client inspection, and harness preflight were allowed; `--run` and all Claude/Gemini/Ornith generation remained prohibited.

## Verification Results

### 1. Harness child environment and self-test

- `run_claude_child` now places `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1` beside the child-only Anthropic base URL/model/key assignments. No global export or persisted Claude configuration was added.
- The fake exits 27 unless that variable is exactly `1`. Added beta, unknown-field, thinking, and output-config HTTP-400 cases verify fixed classification and reject every embedded marker from stderr.
- `bash -n` passed. The full deterministic self-test passed twice, including the final official-review rerun, with exact base-route, model admission, closed failure classification, supervisor/cardinality, zero-child preflight, redaction, cleanup, signal, and atomic publication coverage.

### 2. Closed rejection classification and non-leak

- Harness output is restricted to the new fixed reasons plus the existing closed failure classes. Edge uses the fixed event `edge_anthropic_pre_ingress_rejection` and the enum set `method`, `invalid_header`, `unsupported_beta`, `body_read`, `body_limit`, `invalid_envelope`, `invalid_max_tokens`, `route`, `unknown_field`, `invalid_thinking`, `invalid_output_config`, `invalid_request`, and `runtime_unavailable`.
- Focused unit tests cover known classification, generic fallback, secret-shaped unknown field/beta inputs, one fixed event, and log-marker absence. The final focused reviewer run passed in 0.058s.
- The isolated live Edge returned the intentionally invalid Messages request as `400 invalid_request_error`, left ingress at 0, and wrote only `surface=messages`, `rejection_class=unknown_field`, and `http_status=400`; `R14_PRIVATE_MARKER_DO_NOT_LOG` was absent from the live log.

### 3. Local and installed-client verification

- Local OpenAI focused tests passed in 8.407s; OpenAI and service race suites passed in 12.602s and 9.633s. `gofmt`, shell syntax, harness self-test, `git diff --check`, and focused non-leak scans passed.
- Static inspection of installed Claude 2.1.177 proved `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1` makes `LEH()` true, disables the first-party experimental selector, strips experimental tool keys, and disables context-hint, advisor, and cache-diagnostic gates. API-key auth also remains outside the OAuth-beta path. Claude was not used for generation during this repair.

### 4. Isolated macOS provider-free qualification

- Only the R14 script, handler, and focused test changes remain synchronized to `/Users/toki/agent-work/iop-s12-validation-20260808/source`; canonical `/Users/toki/agent-work/iop-dev` stayed read-only. Remote focused OpenAI passed in 0.567s; OpenAI and service race suites passed in 12.565s and 9.772s.
- Rebuilt and restarted only disposable Edge: CP/Edge/Node are `47248/62931/47260`. Edge digest is `sha256:96400227375699400f3aab44e31c89d7f18b3fd3fa051feec990a96f73b4b70a`; exact version-output digest is `sha256:e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67`; source worktree digest is `sha256:b5d7f9e9495e0a7e066ba1816811abd39a1db86af5f9c337b41543cdbffa52a7`.
- Authenticated catalog returned 200 with exactly one `iop-single-request-light`. `/count_tokens` baseline, advanced beta, defer-loading, redact beta, display omitted, display summarized, and the frozen non-experimental Claude core returned 200 with positive tokens; strict, eager streaming, invalid display, context-hint beta/field, and diagnostics field returned `400 invalid_request_error`.
- Fresh harness preflight returned `[single-request-claude-smoke] preflight passed without a Claude invocation`; ingress remained 0 before/after. Fleet health and certificate lifetime over 900 seconds passed. All five `.rc-69` guard directories remain, no `.started` guard exists, canonical Claude process count is 0, and manifest/workspace results are absent.

### 5. Privacy and final hygiene

- The SOPS caller was decrypted only into remote process memory, used solely to authenticate catalog/count-token/preflight requests to IOP, never printed or persisted, and unset on exit. No raw client error, header value, prompt, model output, workspace content, key, or caller value was written to task evidence.
- Live log inspection found the fixed rejection event and no private marker; recent fatal/panic scan was empty. Local and remote `git diff --check` passed.
- No `--run`, sixth guard, retry, accepted ingress, Claude/Gemini/Ornith generation, provider generation, result, or manifest occurred. The active task pair and KST work log contain the complete implementation evidence for official review.

---

> Implementer: fill every implementation-owned field, then stop for official review.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Assessment | Evidence |
|---|---|---|
| Correctness | Pass | Required R14 is implemented: the supervised child freezes experimental betas, fixed harness/Edge classifications are closed, and client behavior remains unchanged. |
| Completeness | Fail | S12 still has no admitted Claude request, stage sequence, workspace result, terminal, or qualification manifest. |
| Test coverage | Pass | Local/remote focused and race suites, harness self-test, installed-client static checks, provider-free matrix, live non-leak probe, and preflight passed. |
| API contract | Pass | Supported request shapes still return local token counts, unsupported neighbors remain fail-closed, and the public error response contract was not changed. |
| Code quality | Pass | Child scope is explicit, diagnostic values are repository-owned literals, and arbitrary request/error material is excluded from logs and task output. |
| Implementation deviation | Pass | The remote test-file scope, live-log path, and version-digest deviations were each diagnosed provider-free, corrected with recoverable state, and followed by fresh passing gates. |
| Verification trust | Pass | Edge digest/PID, preflight, ingress 0, five finalized guards, zero started guards/processes, absent artifacts, and live fixed-class log evidence agree. |
| Spec conformance | Fail | SDD S12 requires ingress 1, ordered Gemini -> Ornith-fast -> Gemini execution, redacted timing, verified workspace cleanup/result, and exactly one terminal. |

### Findings

- Resolved R14 — `scripts/e2e-single-request-claude.sh`, `apps/edge/internal/openai/anthropic_handler.go`, and `apps/edge/internal/openai/single_request_handler_test.go`: installed Claude 2.1.177's ambient experimental decision surface is disabled only for the supervised child, the fake requires the boundary, and a future pre-ingress 400 can retain only an allowlisted harness/Edge class. Static, unit, isolated-runtime, non-leak, matrix, and preflight evidence all pass. This does not retroactively identify which deleted raw member caused the fifth HTTP 400.
- Required R15 — external execution authorization: all five prior one-call authorizations are durably consumed as `.rc-69`, while S12 still requires one admitted real Claude-through-IOP execution. A sixth guard and exactly one new harness `--run` require a new explicit user authorization; it must use the repaired disposable runtime, Claude must call only IOP, Gemini/Ornith must remain internal IOP routes, and no retry is allowed regardless of outcome.

### Routing Signals

- `evaluation_mode=isolated-reassessment`
- `verdict=FAIL`
- `review_rework_count=20`
- `evidence_integrity_failure=false`
- `next_state=user-review`
