Record Glas production pilot evidence

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

docs/evidence/ACTIVITY-WP-0032-glas-profile-pilot-2026-08-23.md

@@ -0,0 +1,50 @@
+# ACTIVITY-WP-0032 Glas profile pilot evidence — 2026-08-23
+
+Environment: railiance01, namespace `activity-core`  
+Definition: `glas-profile-pilot` (`3afae1c4-8c20-50eb-bd64-6ca01d990378`)  
+Activity Core source: `01ee87d`
+
+This evidence contains only allowlisted queue, Glas, and lifecycle facts. It
+does not include worker tokens, provider responses, prompts, or tool output.
+
+## Production alignment
+
+- Re-ran the additive migration Job: Alembic advanced `0007 -> 0008` and
+  `alembic current` reported `0008 (head)`.
+- A non-matching claim probe returned HTTP 200, and the real
+  `rein-aharness@railiance01` poll loop recovered from HTTP 500 to HTTP 200.
+- Built and imported `activity-core:railiance01-prod` from source `01ee87d`.
+  API, worker, and event-router run image config
+  `sha256:f2a054949389e9074164615b14814ea7004a33ec3c0a74baacb6269a1992a431`.
+- The disabled pilot definition was projected and synced. It emits one task,
+  targets only `executor-sandbox`, and selects
+  `harness.agent-dev-local@1.0.0` with assignment/correlation ref
+  `ACTIVITY-WP-0032-T05`.
+
+## Fail-closed production probes
+
+1. Run `70461991-e7cd-45b5-8d96-afc26056acaf` was emitted by the superseded
+   production image without the selector. Rein classified it as `unmatched`
+   and failed it without repository execution. This exposed that the imported
+   image predated T03 even though it already contained the T02 schema fields.
+2. After the current image rollout, run
+   `977fccfe-394c-4132-b757-de171d516f78` preserved the pinned profile and both
+   refs, resolved Glas/rein/model/tool/sandbox metadata, and failed at
+   `sandbox_create` because railiance01 lacked the `bwrap` executable. Activity
+   Core stored the normalized failure envelope and dropped direct caller
+   output.
+3. Installed Ubuntu package `bubblewrap` `0.9.0-1ubuntu0.1`. Direct sand-boxer
+   preflight `2dc461bf` reached `ready` with `profile.bwrap-local`, then reached
+   `destroyed` through the normal lifecycle.
+4. Run `43063207-7012-41cd-89d5-2adcd1df56f2` again preserved the profile and
+   refs, then exposed a consumer adapter mismatch before sandbox creation:
+   rein-aharness passed queue worker id `rein-aharness@railiance01` as the
+   sand-boxer governance actor, whose contract permits only `adm`, `agt`, or
+   `atm`. No repository commit occurred.
+
+The normalized production evidence surface is therefore proven for both
+profile resolution and failure. A successful commit/teardown proof remains
+pending the rein adapter fix. Handoff messages:
+
+- rein-aharness: `c9a4ae44-f092-424f-9a4d-9b4cf58d65fd`
+- glas-harness: `b36b575b-7366-4b66-b916-ace705c57f4a`

docs/runbook.md

@@ -474,6 +474,12 @@ from that safe envelope. If those fields are missing, inspect the executor
 payload before assuming Glas ran; do not paste raw provider output into
 `ops_runs.result`.
 
+For `harness.agent-dev-local@1.0.0`, the railiance01 claim host must provide
+`bwrap` on the claim service `PATH`. Verify `command -v bwrap` and a
+sand-boxer `profile.bwrap-local` create/destroy preflight before enabling a
+profiled definition. Profile validation alone only checks the catalog; it does
+not prove the host executable or kernel namespace path.
+
 **Railiance rollout (T07):** full checklist with image import, migrate job,
 smoke trigger, claim test, and dual-path residual:
 

workplans/ACTIVITY-WP-0032-glas-profile-execution-contract.md

@@ -250,6 +250,16 @@ drift: the live image expects migration `0008`, while PostgreSQL was still at
 `0007`, making `/ops-runs/claim` fail with `UndefinedColumnError`. Apply and
 verify the additive migration before scheduling the pilot.
 
+Live progress 2026-08-23 is recorded in
+`docs/evidence/ACTIVITY-WP-0032-glas-profile-pilot-2026-08-23.md`. Migration,
+current image rollout, definition sync, selector/refs, profile resolution, and
+normalized failure evidence are proven. Installing the missing Ubuntu
+`bubblewrap` package enabled a direct create/destroy preflight. The remaining
+consumer mismatch is rein-aharness passing queue worker id
+`rein-aharness@railiance01` as sand-boxer's governance actor instead of `agt`;
+handoff `c9a4ae44-f092-424f-9a4d-9b4cf58d65fd` requests the minimal adapter fix
+without weakening queue ownership identity.
+
 ## Acceptance
 
 - [x] Invocation shape decided and recorded as an ADR, with the boundary stated
@@ -259,5 +269,5 @@ verify the additive migration before scheduling the pilot.
 - [x] Malformed/absent profile refs are refused at emission; unknown-but-well-formed
       refs are refused by Glas before sandbox creation, never at claim
 - [x] `approach_hint` cannot override or substitute for a profile ref, proven by test
-- [ ] Normalized Glas evidence is visible in production status
+- [x] Normalized Glas evidence is visible in production status
 - [ ] One definition proven on railiance01 end to end