Run `.venv/bin/python scripts/inspect-local-runtime.py` to inspect the current
`profile.bwrap-local` from inside owner-mediated execution. This is a
non-secret inventory, not a model call or a readiness bypass. It does not read
credentials or the interactive user's authentication files. Exit zero means
the inventory ran and cleaned up; it does not mean the profile is ready.
Recorded run: sandbox `236f3683`, consumer `agt` / `glas-runtime-baseline`,
run id `glas-wp-0012-baseline`. Inventory completed successfully; final state
was `destroyed` and the workspace was absent.
| Requirement | Current evidence | Required owner deliverable |
|---|---|---|
| Owner execution | Real gateway boundary proof passed in GLAS-WP-0005 | Retain exact identity, argv/stdin, timeout, and teardown semantics |
| Rein runtime | `rein-aharness`, `rein_aharness`, and `llm_connect` absent from sandbox discovery | Read-only, reproducible runtime with all required Python dependencies and working CLI entrypoint |
| Claude runtime | `claude` discoverable; startup/authentication not tested | Pin runtime version; prove startup, model selection, tools, and streaming options under the owner environment |
| Persona preparation | `kaizen-agentic` absent | Explicitly accept the rein's recorded `persona_source=none` for this fixture, or provide the optional runtime |
| Authentication | Selected Glas profile declares no credential route | Claude-compatible value-free route id, owner approval/implementation, delivery and revocation behavior |
| Writable runtime state | Owner sets `HOME` to the copied worktree | Define private auth/cache/state locations and ensure they cannot enter an agent commit |
The `SANDBOXER_CREDENTIAL_ROUTE_REFS` environment field only carries route
labels. In the reviewed broker it does not acquire or deliver credentials.
Glas must not invent a route id, borrow an interactive login, or use the
OpenRouter credential as a substitute for the selected Claude route.
The bwrap implementation unconditionally creates an isolated network namespace
and does not create an outbound interface. Declaring an egress hostname in YAML
alone cannot make the current runtime reach it. Sand-boxer owns the enforcement
implementation and its negative tests.
The rein uses `llm_connect.claude_code.ClaudeCodeAdapter` and launches Claude
with cwd pinned to the sandbox and a named tool allow-list. Host environment
overrides do not survive the owner's sanitized child environment. The runtime
must work under that actual environment, including Git author configuration,
private writable state, and the applicable tool/streaming CLI options.
## Owner return contract
Record exact non-secret artifact/revision references for:
1. The installed sandbox owner path and host. Glas currently calls the local
creating `SandboxManager`; if the intended deployment requires authenticated
HTTP instead, supply that contract and adapt/prove the client before claiming
equivalence with the local manager proof.
2. The sandbox profile and read-only rein/Claude runtime artifact, Python
dependencies, trust store, executable paths, and writable state placement.
3. The Claude-compatible credential route, delivering component, consumer scope,
and cleanup/revocation behavior. Evidence contains route ids and outcomes,
never values, auth files, or provider responses.
4. The enforced egress destinations and ports, DNS/TLS requirements, and proof
that an undeclared destination remains denied. Provider connectivity does
not grant the agent additional network tools.
5. Non-secret startup checks (`rein-aharness --help`, `claude --version` or
