tegwick
202e5048d4
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f
69 lines
3.9 KiB
Markdown
69 lines
3.9 KiB
Markdown
# ACTIVITY-WP-0032 Glas profile pilot evidence — 2026-08-23
|
|
|
|
Environment: railiance01, namespace `activity-core`
|
|
Definition: `glas-profile-pilot` (`3afae1c4-8c20-50eb-bd64-6ca01d990378`)
|
|
Activity Core source: `01ee87d`
|
|
|
|
This evidence contains only allowlisted queue, Glas, and lifecycle facts. It
|
|
does not include worker tokens, provider responses, prompts, or tool output.
|
|
|
|
## Production alignment
|
|
|
|
- Re-ran the additive migration Job: Alembic advanced `0007 -> 0008` and
|
|
`alembic current` reported `0008 (head)`.
|
|
- A non-matching claim probe returned HTTP 200, and the real
|
|
`rein-aharness@railiance01` poll loop recovered from HTTP 500 to HTTP 200.
|
|
- Built and imported `activity-core:railiance01-prod` from source `01ee87d`.
|
|
API, worker, and event-router run image config
|
|
`sha256:f2a054949389e9074164615b14814ea7004a33ec3c0a74baacb6269a1992a431`.
|
|
- The disabled pilot definition was projected and synced. It emits one task,
|
|
targets only `executor-sandbox`, and selects
|
|
`harness.agent-dev-local@1.0.0` with assignment/correlation ref
|
|
`ACTIVITY-WP-0032-T05`.
|
|
|
|
## Fail-closed production probes
|
|
|
|
1. Run `70461991-e7cd-45b5-8d96-afc26056acaf` was emitted by the superseded
|
|
production image without the selector. Rein classified it as `unmatched`
|
|
and failed it without repository execution. This exposed that the imported
|
|
image predated T03 even though it already contained the T02 schema fields.
|
|
2. After the current image rollout, run
|
|
`977fccfe-394c-4132-b757-de171d516f78` preserved the pinned profile and both
|
|
refs, resolved Glas/rein/model/tool/sandbox metadata, and failed at
|
|
`sandbox_create` because railiance01 lacked the `bwrap` executable. Activity
|
|
Core stored the normalized failure envelope and dropped direct caller
|
|
output.
|
|
3. Installed Ubuntu package `bubblewrap` `0.9.0-1ubuntu0.1`. Direct sand-boxer
|
|
preflight `2dc461bf` reached `ready` with `profile.bwrap-local`, then reached
|
|
`destroyed` through the normal lifecycle.
|
|
4. Run `43063207-7012-41cd-89d5-2adcd1df56f2` again preserved the profile and
|
|
refs, then exposed a consumer adapter mismatch before sandbox creation:
|
|
rein-aharness passed queue worker id `rein-aharness@railiance01` as the
|
|
sand-boxer governance actor, whose contract permits only `adm`, `agt`, or
|
|
`atm`. No repository commit occurred.
|
|
5. Rein-aharness source `c633291` fixed and deployed that mapping. Queue claim
|
|
ownership remains `rein-aharness@railiance01`, while the Glas execution actor
|
|
is now `agt`. Rein triggered the exact disabled pilot once after deployment;
|
|
activity-core did not duplicate that trigger.
|
|
6. Post-fix run `ededc939-266f-473c-8386-ffd3f027f5f0` preserved profile
|
|
`harness.agent-dev-local@1.0.0` and assignment/correlation ref
|
|
`ACTIVITY-WP-0032-T05`. It resolved `rein-aharness` `0.1.0`, model route
|
|
`claude-code-cli`, and model `claude-sonnet-4-6`, then created sandbox
|
|
`d750cd5c` with governance actor `agt`.
|
|
7. The run failed closed at `session_start`, before Claude/provider dispatch.
|
|
It emitted no token or tool events and produced no artifact or commit.
|
|
Sand-boxer reports `d750cd5c` as `destroyed` with no lifecycle error, and the
|
|
corresponding workspace is absent.
|
|
|
|
The normalized production evidence surface is therefore proven for both
|
|
profile resolution and failure. The actor adapter mismatch is resolved. A
|
|
successful commit proof remains blocked by upstream `GLAS-IN-0002`: the managed
|
|
consumer is denied `nsenter`, and the rein/model runtime and egress contract is
|
|
absent inside the sandbox. Teardown after the normalized `session_start`
|
|
failure is proven. Handoff messages:
|
|
|
|
- rein-aharness: `c9a4ae44-f092-424f-9a4d-9b4cf58d65fd`
|
|
- glas-harness: `b36b575b-7366-4b66-b916-ace705c57f4a`
|
|
- rein-aharness post-fix: `923338e3-deb2-4764-98b6-ebe525d12acd`
|
|
- rein-aharness post-fix run: `64568b0a-f5b4-41f2-8abd-9acc7e10ee38`
|
|
- glas-harness actor validation: `726686fb-a356-47cd-952a-11c10dabc0e1`
|