<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=10 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Code Review Reference - REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API

## Overview

date=2026-08-08
task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification, plan=10

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_9.log` / `code_review_cloud_G10_9.log`; verdict `FAIL`, `review_rework_count=8`, `evidence_integrity_failure=false`.
- One repaired live call was consumed without retry: clean API-key selection, child 1, ingress 0, no result/manifest.
- This packet is provider-free. It may synchronize the disposable candidate and run `--preflight-only`, but may not run Claude or promote S12.

## Implementation Item Completion

| Item | Status |
|---|---|
| AUTH-MODEL-PREFLIGHT-1 | [x] |
| CLOSED-FAILURE-CLASS-2 | [x] |
| DETERMINISTIC-COVERAGE-3 | [x] |
| REMOTE-ZERO-CHILD-4 | [x] |
| REVIEW-EVIDENCE-5 | [x] |

## Implementation Checklist

- [x] Add bounded authenticated catalog admission and unchanged-ingress enforcement.
- [x] Add the closed five-class child failure classifier.
- [x] Extend deterministic fake success/failure/redaction coverage.
- [x] Pass local gates, sync the reviewed script/runtime binding, and run only remote zero-child preflight.
- [x] Fill implementation evidence without raw or secret data.

## Review-Only Checklist

- [x] Append verdict and routing signals.
- [x] Verify findings/dimensions and provider-free boundary.
- [x] Archive pair to suffix 10 and verify artifacts are not ignored.
- [x] Materialize the correct next state without `complete.log` unless full S12 is actually complete.

## Deviations from Plan

None. The remote zero-child preflight was expected to either pass admission or stop with a closed rejection; it stopped at the new authenticated model gate before any Claude child. No live/provider call or success-only publication occurred.

## Key Design Decisions

- Added a bounded `GET /anthropic/v1/models` probe with the secret supplied only through the Python child environment, `x-api-key` and required Anthropic version headers, disabled proxy inheritance, a five-second timeout, an 8193-byte overrun sentinel, exact catalog structure, and exactly one selected model match.
- Snapshotted S12 ingress before and after the authenticated catalog probe and required exact equality. Fake coverage mutates the counter during the catalog response and proves preflight rejects the side effect with zero children.
- Classified only allowlisted byte patterns from already bounded temporary Claude stdout/stderr into `cli-validation`, `authentication-rejected`, `transport-failure`, `api-rejected`, or `unknown`. Only the constant is emitted; existing cleanup still removes both raw captures.
- Synchronized exact local script digest `d19874140ee53985e9c13acdc9730190cc1975495a7222b7bbd6b17608ef0092` to the disposable candidate and atomically changed only runtime-evidence `source.worktree_digest` to `sha256:a759f41c83a1573eb2c52856f991093128b556733d2c3bc240fef1443db2e598`.
- Treated the real remote rejection as an external credential/admission decision, not a reason to retry. The configured model is present, but the `.claude` key cannot pass the authenticated catalog boundary for that selected principal/runtime.

## Verification Results

### 1. Syntax

```text
(no stdout/stderr)
exit status: 0
```

### 2. Deterministic self-test

```text
./scripts/e2e-single-request-claude.sh --self-test
[single-request-claude-smoke] self-test passed: exact Claude base-route coverage, authenticated model admission, closed failure classification, model/Edge/Node/runtime binding, zero-child preflight, derived verification, redaction, cleanup, signal handling, and atomic publication
exit status: 0
```

### 3. Focused assertions and race tests

```text
focused source assertions: passed
ok  iop/apps/edge/internal/service  1.050s
ok  iop/apps/edge/internal/openai   1.101s
exit status: 0
```

### 4. Diff/artifact hygiene

```text
hygiene=passed
task artifacts: not ignored
exit status: 0
```

### 5. Remote script/runtime synchronization

```text
remote_script_sha256=d19874140ee53985e9c13acdc9730190cc1975495a7222b7bbd6b17608ef0092
[single-request-claude-smoke] self-test passed: exact Claude base-route coverage, authenticated model admission, closed failure classification, model/Edge/Node/runtime binding, zero-child preflight, derived verification, redaction, cleanup, signal handling, and atomic publication
runtime_evidence_change=source.worktree_digest_only
recorded_tree=sha256:a759f41c83a1573eb2c52856f991093128b556733d2c3bc240fef1443db2e598
exit status: 0
```

### 6. Remote authenticated zero-child preflight

```text
auth=api_key
[single-request-claude-smoke] validation failed: authenticated model probe rejected
preflight_exit=69
state=ingress0-result_absent-manifest_absent
configured_model=present
claude_key_matches_legacy_bearer=false
claude_child=absent
temp_config=absent
```

This is a provider-free preflight failure. It proves the selected key is visible to Claude Code as an API key, differs from the configured legacy Edge caller token, and is not admitted by any configured Edge principal path to the selected model catalog. It does not consume or request another live authorization.

## Reviewer Checkpoints

- Confirm the secret appears in neither argv, logs, captures after cleanup, nor tracked files.
- Confirm catalog response size/shape/model are bounded and S12 ingress is unchanged.
- Confirm failure classification emits only the five constants and never raw matched text.
- Confirm remote verification starts no Claude child and makes no provider call.

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Result | Evidence |
|---|---|---|
| Correctness | Pass | Authenticated catalog admission, exact selected-model validation, unchanged-ingress enforcement, and closed failure classes are implemented as planned. |
| Completeness | Fail | The repository repair is complete, but the selected `.claude` credential fails actual Edge catalog admission and S12 remains unexecuted after the repair. |
| Test coverage | Pass | Deterministic fake coverage includes accepted admission, rejected credential, missing model, malformed catalog, ingress mutation, all five failure classes, redaction, cleanup, and the full prior matrix. |
| API contract | Pass | The probe uses the existing Anthropic model surface and does not change API/wire/config/schema contracts. |
| Code quality | Pass | Secret material remains in process memory, responses/captures are bounded, emitted failures are closed constants, and existing cleanup remains authoritative. |
| Implementation deviation | Pass | Only the harness/review and disposable script/worktree binding changed; no Claude/provider call, manifest, owner document, runtime process, or config changed. |
| Verification trust | Pass | Local/remote self-tests, focused races, exact script/worktree digests, zero-child rejection, unchanged ingress, and direct constant-time legacy-token comparison are fresh and consistent. |
| Spec conformance | Fail | SDD S12 still lacks the successful accepted request and closed manifest required for qualification. |

### Findings

- **Required R3** — external credential decision: `/config/workspace/iop/token/.claude` makes Claude Code report `authMethod=api_key`, but the new authenticated catalog preflight rejects it while the selected model is configured. A constant-time in-memory comparison also proves it is not the candidate's configured legacy Edge caller token, and the catalog rejection proves it is not admitted through either configured principal path. Claude Code uses `ANTHROPIC_API_KEY` as the `x-api-key` sent to IOP Edge; this runtime needs an Edge caller credential, not merely an Anthropic-format provider key. Before another live authorization, the user must choose an admitted caller credential or explicitly authorize Edge principal enrollment/reconfiguration.

### Routing Signals

- `review_rework_count=9`
- `evidence_integrity_failure=false`

Eight prior archived reviews have FAIL verdicts; this task-level non-PASS result raises the count to nine. The repository repair itself passes and no live authorization was consumed.

### Next Step

USER_REVIEW — ask the user to select the Edge caller credential strategy. Recommended: use the existing disposable dev Edge `openai.bearer_token` as Claude Code's in-memory `ANTHROPIC_API_KEY`, leaving `.claude` out of the caller path. Alternatives require an explicit enrolled principal credential source or authorization to enroll/reconfigure `.claude`. After the chosen credential passes the new zero-child preflight, obtain exactly-one live authorization before `--run`.
