docs: record enforced provider egress acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/evidence/GLAS-WP-0012-egress-2026-09-05.md

@@ -0,0 +1,25 @@
+# Local provider egress acceptance
+
+Sand-boxer now supports owner allowlisted HTTPS CONNECT egress with isolated
+network namespaces. No credentials were read or model calls made.
+
+- Extension smoke sandbox `e290e788`: Anthropic verified TLS, HTTP 404;
+  undeclared example.com and direct 1.1.1.1:443 denied; proxy/workspace removed.
+- Persisted-manager smoke sandbox `1c64fa89`: the same checks passed after
+  reconstructing the manager/store, including proxy teardown from saved state.
+- Glas regression: 101 tests passed in its .venv. The system Python lacks the
+  sandboxer dependency and could not collect the suite; the configured venv passed.
+- Glas deterministic boundary smoke `741a9b87`: source absent/unchanged,
+  exact identity, task mode0600/removal, only lo and workspace teardown passed.
+
+Implementation and scope: ../sand-boxer/docs/bwrap-egress.md. The proxy enforces
+connection destinations, not HTTP path or TLS SNI on shared hosting; the trusted
+host resolver supplies addresses and non-global results refuse. Existing
+production profiles remain blocked and opt out of the new egress by default.
+
+Remaining GLAS-WP-0012-T02 / SAND-WP-0015-T04: concrete machine auth binding,
+protected credential delivery from confirmed KV version 2, pinned Claude
+executable and real authentication/task acceptance. The platform CCR applier
+currently supports OIDC/Kubernetes and transitional token auth, not AppRole;
+local machine identity must be implemented through its owner before activation.
+Do not use the operator UI session as runtime authentication.

workplans/GLAS-WP-0012-first-local-profile-production-proof.md

@@ -202,3 +202,12 @@ One version-pinned local profile runs its actual rein/model task entirely in
 the declared sandbox, produces validated local output, and tears down cleanly.
 Its readiness describes the proven runtime scope. Other profile readiness and
 consumer schedules remain independently governed.
+
+## 2026-09-05 egress owner return
+
+Owner-controlled HTTPS egress is implemented and live-tested through both the
+extension and a persisted manager: provider TLS/HTTP response, undeclared-host
+and direct-IP denial, isolated namespace and proxy/workspace cleanup passed.
+See [egress evidence](../docs/evidence/GLAS-WP-0012-egress-2026-09-05.md).
+T02 remains waiting on machine auth, protected credential delivery, the pinned
+Claude executable and the combined production acceptance. Profiles remain blocked.