docs: record enforced provider egress acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/evidence/GLAS-WP-0012-egress-2026-09-05.md

@@ -0,0 +1,25 @@
+# Local provider egress acceptance
+
+Sand-boxer now supports owner allowlisted HTTPS CONNECT egress with isolated
+network namespaces. No credentials were read or model calls made.
+
+- Extension smoke sandbox `e290e788`: Anthropic verified TLS, HTTP 404;
+  undeclared example.com and direct 1.1.1.1:443 denied; proxy/workspace removed.
+- Persisted-manager smoke sandbox `1c64fa89`: the same checks passed after
+  reconstructing the manager/store, including proxy teardown from saved state.
+- Glas regression: 101 tests passed in its .venv. The system Python lacks the
+  sandboxer dependency and could not collect the suite; the configured venv passed.
+- Glas deterministic boundary smoke `741a9b87`: source absent/unchanged,
+  exact identity, task mode0600/removal, only lo and workspace teardown passed.
+
+Implementation and scope: ../sand-boxer/docs/bwrap-egress.md. The proxy enforces
+connection destinations, not HTTP path or TLS SNI on shared hosting; the trusted
+host resolver supplies addresses and non-global results refuse. Existing
+production profiles remain blocked and opt out of the new egress by default.
+
+Remaining GLAS-WP-0012-T02 / SAND-WP-0015-T04: concrete machine auth binding,
+protected credential delivery from confirmed KV version 2, pinned Claude
+executable and real authentication/task acceptance. The platform CCR applier
+currently supports OIDC/Kubernetes and transitional token auth, not AppRole;
+local machine identity must be implemented through its owner before activation.
+Do not use the operator UI session as runtime authentication.