Record pinned Claude runtime startup and owner handoff

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/evidence/GLAS-WP-0015-claude-startup-2026-09-06.json

@@ -0,0 +1,94 @@
+{
+  "build": {
+    "runtime": {
+      "path": "/tmp/sandboxer-claude-runtime-20260906",
+      "sha256": "5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922"
+    },
+    "build": {
+      "python": "3.12.3",
+      "packages": {
+        "idna": "3.19",
+        "h11": "0.16.0",
+        "httpcore": "1.0.9",
+        "llm-connect": "0.1.0",
+        "certifi": "2026.7.22",
+        "PyYAML": "6.0.3",
+        "toml": "0.10.2",
+        "typing_extensions": "4.16.0",
+        "httpx": "0.28.1",
+        "rein-aharness": "0.1.0",
+        "anyio": "4.15.1"
+      },
+      "claude": {
+        "path": "/opt/sandboxer/runtime/bin/claude",
+        "sha256": "26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba",
+        "expected_version": "2.1.263",
+        "source": "/home/worsch/.local/share/claude/versions/2.1.263"
+      },
+      "source_revisions": {
+        "rein-aharness": "1429db5ad4c83331b6375349ffde1eb13af9575b",
+        "llm-connect": "00560945f81ba6ff1f5cacd9fe99c7fe756cc4b1"
+      }
+    }
+  },
+  "smoke": {
+    "ok": true,
+    "sandbox_id": "f8821ec2",
+    "runtime_sha256": "5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922",
+    "proof": {
+      "rein_cli_started": true,
+      "adapter_imported": true,
+      "runtime_readonly": true,
+      "source_absent": true,
+      "home_outside_workspace": true,
+      "home_mode": "0700",
+      "worktree_clean": true,
+      "interfaces": [
+        "lo"
+      ],
+      "python_prefix": "/opt/sandboxer/runtime",
+      "claude_version": "2.1.263 (Claude Code)",
+      "https_proxy_present": true,
+      "claude_provider_request_proven": false,
+      "credential_refs": []
+    },
+    "workspace_removed": true,
+    "exit_code": 0,
+    "model_run_proven": false,
+    "private_state_persisted": true,
+    "proxy_removed": true
+  },
+  "verification": {
+    "lint": "passed",
+    "tests_passed": 175
+  },
+  "production_deployed": false,
+  "provenance": "Explicitly selected installed native executable; no interactive HOME copied.",
+  "absolute_path_smoke": {
+    "ok": true,
+    "sandbox_id": "979c0208",
+    "runtime_sha256": "5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922",
+    "proof": {
+      "rein_cli_started": true,
+      "adapter_imported": true,
+      "runtime_readonly": true,
+      "source_absent": true,
+      "home_outside_workspace": true,
+      "home_mode": "0700",
+      "worktree_clean": true,
+      "interfaces": [
+        "lo"
+      ],
+      "python_prefix": "/opt/sandboxer/runtime",
+      "claude_version": "2.1.263 (Claude Code)",
+      "https_proxy_present": true,
+      "claude_provider_request_proven": false,
+      "credential_refs": []
+    },
+    "workspace_removed": true,
+    "exit_code": 0,
+    "model_run_proven": false,
+    "private_state_persisted": true,
+    "proxy_removed": true
+  }
+}

docs/production-dependency-handoffs.md

@@ -175,3 +175,14 @@ a reply in this review. See GLAS-WP-0015 for the receipt summary.
   and audit prerequisites.
 - Five follow-ups delivered in production-owner-review-followups-2026-09-06.json.
   Platform custody acknowledgement and the Claude executable pin remain open.
+
+
+## Claude executable candidate returned — 2026-09-06
+
+SAND-WP-0015-T05 now provides a pinned native Claude 2.1.263 binary and actual
+bwrap startup proof in the proxy environment. Complete candidate runtime digest:
+5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922.
+See evidence/GLAS-WP-0015-claude-startup-2026-09-06.json. The previously open
+binary pin/startup gate is resolved for this candidate. Protected installation,
+owner configuration, real Claude provider request and credentials remain open;
+/tmp placement and --version success are not production readiness.

docs/production-runtime-handoff-receipts-2026-09-06.json

@@ -0,0 +1,14 @@
+[
+  {
+    "id": "1b37c430-41d6-4347-a865-25d889f8a049",
+    "to_agent": "secrets-engine",
+    "thread_id": "7ab6d325-11a2-4f94-9736-b17335054e3c",
+    "created_at": "2026-09-06T21:52:30.770708Z"
+  },
+  {
+    "id": "fd2e2ace-19a0-48e9-ba6c-0eead94253c3",
+    "to_agent": "sand-boxer",
+    "thread_id": "481b18b6-54ae-44bc-bb31-ffd130d6d8ad",
+    "created_at": "2026-09-06T21:52:35.157233Z"
+  }
+]

workplans/GLAS-WP-0012-first-local-profile-production-proof.md

@@ -326,3 +326,22 @@ verified, approval release published and pinned, audit T03 complete, dedicated
 PDP revision 3 enforces adopted short-lived caller identity. See GLAS-WP-0015
 and its evidence receipts. T02 remains wait until remaining owner admission and
 runtime gates are verified; no real model run or readiness promotion.
+
+
+## Pinned Claude startup progress — 2026-09-06
+
+Advanced sand-boxer SAND-WP-0015-T05 independently of custody: runtime builder
+now copies only an explicitly digest-pinned native Claude executable. Selected
+installed Claude 2.1.263, binary digest
+26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba;
+complete candidate runtime digest
+5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922.
+Sandbox f8821ec2 passed actual Claude --version, rein CLI/import, read-only
+runtime, private HOME/state persistence, source absence, clean tree and teardown
+with owner proxy environment present. Lint and all 175 sand-boxer tests pass.
+Evidence: docs/evidence/GLAS-WP-0015-claude-startup-2026-09-06.json.
+
+This resolves candidate binary pin/startup, not protected runtime deployment,
+Claude provider-request compatibility, credential delivery or a real model run.
+The candidate is in /tmp; no production profile readiness changed. Existing
+credential and acceptance tasks remain open. No new owner replies at session start.

workplans/GLAS-WP-0015-production-dependency-coordination.md

@@ -159,3 +159,22 @@ issued-token expiry and fresh-token recovery. Temporary forward removed and
 proof process exited. Final owner receipt deliveries recorded in
 `docs/production-caller-access-receipts-2026-09-06.json`. This establishes the
 operator path; consumer adoption and native action authorization remain open.
+
+
+## Pinned Claude startup progress — 2026-09-06
+
+Advanced sand-boxer SAND-WP-0015-T05 independently of custody: runtime builder
+now copies only an explicitly digest-pinned native Claude executable. Selected
+installed Claude 2.1.263, binary digest
+26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba;
+complete candidate runtime digest
+5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922.
+Sandbox f8821ec2 passed actual Claude --version, rein CLI/import, read-only
+runtime, private HOME/state persistence, source absence, clean tree and teardown
+with owner proxy environment present. Lint and all 175 sand-boxer tests pass.
+Evidence: docs/evidence/GLAS-WP-0015-claude-startup-2026-09-06.json.
+
+This resolves candidate binary pin/startup, not protected runtime deployment,
+Claude provider-request compatibility, credential delivery or a real model run.
+The candidate is in /tmp; no production profile readiness changed. Existing
+credential and acceptance tasks remain open. No new owner replies at session start.