plan: define first local profile acceptance and runtime blockers

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/intakes/residuals.md

@@ -93,6 +93,13 @@ description: |
   does not satisfy this production acceptance. GLAS-WP-0005 can close its
   boundary-hardening scope with this registered live residual still open.
 
+  GLAS-WP-0012 now tracks the first (Claude) local-profile acceptance, starting
+  from harness.agent-dev-local@1.0.0. Its owner return contract and baseline
+  are in docs/local-profile-acceptance.md. The corresponding owner dependency
+  is SAND-WP-0014-T05; its current OpenRouter credential requirement does not
+  establish the Claude route. Keep this intake open for the open-weight
+  profile even after the first Claude profile is proven.
+
   Done when a non-secret probe and one real rein command execute inside the
   namespace, the source checkout is not visible/mutable, required egress is
   explicit, and teardown removes the sandbox workspace.

docs/local-profile-acceptance.md

@@ -0,0 +1,125 @@
+# First local profile: runtime requirements and acceptance
+
+Work record: [GLAS-WP-0012](../workplans/GLAS-WP-0012-first-local-profile-production-proof.md).
+Live residual: `GLAS-IN-0002`. Owner dependency: `SAND-WP-0014-T05`.
+
+Start from `harness.agent-dev-local@1.0.0`: rein-aharness / Claude Code /
+`claude-sonnet-4-6` / `green-commit-only`. The future proof candidate is
+`harness.agent-dev-local@1.1.0`; it is not yet in the catalog because its runtime,
+sandbox profile, and credential route are not resolved.
+
+## Reviewed baseline, 2026-09-05
+
+Glas owner adapter: `63a7f9f`. Sand-boxer:
+`b6655d88590e03820675719d6dd574e5f5a9f82e`. Rein-aharness source:
+`1429db5ad4c83331b6375349ffde1eb13af9575b`.
+
+Run `.venv/bin/python scripts/inspect-local-runtime.py` to inspect the current
+`profile.bwrap-local` from inside owner-mediated execution. This is a
+non-secret inventory, not a model call or a readiness bypass. It does not read
+credentials or the interactive user's authentication files. Exit zero means
+the inventory ran and cleaned up; it does not mean the profile is ready.
+
+Recorded run: sandbox `236f3683`, consumer `agt` / `glas-runtime-baseline`,
+run id `glas-wp-0012-baseline`. Inventory completed successfully; final state
+was `destroyed` and the workspace was absent.
+
+| Requirement | Current evidence | Required owner deliverable |
+|---|---|---|
+| Owner execution | Real gateway boundary proof passed in GLAS-WP-0005 | Retain exact identity, argv/stdin, timeout, and teardown semantics |
+| Rein runtime | `rein-aharness`, `rein_aharness`, and `llm_connect` absent from sandbox discovery | Read-only, reproducible runtime with all required Python dependencies and working CLI entrypoint |
+| Claude runtime | `claude` discoverable; startup/authentication not tested | Pin runtime version; prove startup, model selection, tools, and streaming options under the owner environment |
+| Persona preparation | `kaizen-agentic` absent | Explicitly accept the rein's recorded `persona_source=none` for this fixture, or provide the optional runtime |
+| Authentication | Selected Glas profile declares no credential route | Claude-compatible value-free route id, owner approval/implementation, delivery and revocation behavior |
+| Network | `default: deny`, empty egress, only `lo` | Explicit enforced provider route, required DNS/TLS support, denied-destination proof |
+| Writable runtime state | Owner sets `HOME` to the copied worktree | Define private auth/cache/state locations and ensure they cannot enter an agent commit |
+
+The `SANDBOXER_CREDENTIAL_ROUTE_REFS` environment field only carries route
+labels. In the reviewed broker it does not acquire or deliver credentials.
+Glas must not invent a route id, borrow an interactive login, or use the
+OpenRouter credential as a substitute for the selected Claude route.
+
+The bwrap implementation unconditionally creates an isolated network namespace
+and does not create an outbound interface. Declaring an egress hostname in YAML
+alone cannot make the current runtime reach it. Sand-boxer owns the enforcement
+implementation and its negative tests.
+
+The rein uses `llm_connect.claude_code.ClaudeCodeAdapter` and launches Claude
+with cwd pinned to the sandbox and a named tool allow-list. Host environment
+overrides do not survive the owner's sanitized child environment. The runtime
+must work under that actual environment, including Git author configuration,
+private writable state, and the applicable tool/streaming CLI options.
+
+## Owner return contract
+
+Record exact non-secret artifact/revision references for:
+
+1. The installed sandbox owner path and host. Glas currently calls the local
+   creating `SandboxManager`; if the intended deployment requires authenticated
+   HTTP instead, supply that contract and adapt/prove the client before claiming
+   equivalence with the local manager proof.
+2. The sandbox profile and read-only rein/Claude runtime artifact, Python
+   dependencies, trust store, executable paths, and writable state placement.
+3. The Claude-compatible credential route, delivering component, consumer scope,
+   and cleanup/revocation behavior. Evidence contains route ids and outcomes,
+   never values, auth files, or provider responses.
+4. The enforced egress destinations and ports, DNS/TLS requirements, and proof
+   that an undeclared destination remains denied. Provider connectivity does
+   not grant the agent additional network tools.
+5. Non-secret startup checks (`rein-aharness --help`, `claude --version` or
+   owner-equivalent checks), exact actor/project/run identity, absent source
+   checkout, and destroyed/absent workspace under the deployed path.
+
+The current SAND-WP-0014-T05 text mentions an OpenRouter AppRole read. That is
+a separate route from the chosen first Claude profile. Resolve this distinction
+in owner work before selecting credentials or treating T02 as complete.
+
+## Real acceptance fixture
+
+After owner dependencies pass, review the exact versioned candidate as
+`unverified` and run it on a disposable repository with no push remote. Use a
+local test Git identity and a small non-secret task: create only `PROOF.md`
+with a fixed expected line and make exactly one local commit. Bound the run
+within the reviewed profile's token/time limits.
+
+Use the actual Glas gateway, concrete `ReinAharness` adapter, installed
+`rein-aharness` CLI, and selected Claude model. The GLAS-WP-0005 deterministic
+dispatch cannot substitute for this test.
+
+Before teardown, validate through owner execution:
+
+- The expected file content, exactly one new commit, expected changed paths,
+  and a clean working tree.
+- Host source path absent from the sandbox; the source sentinel and Git HEAD
+  remain unchanged when independently checked on the host.
+- Exact actor/project/request id as `consumer.run_id` at create and exec;
+  declared credential route and network policy match the reviewed candidate.
+- No task/auth/cache artifacts in the accepted commit; generated task removed
+  before destroy, followed by destroyed state and absent workspace.
+
+Retain actual commit/content-validation results before gateway teardown
+destroys the workspace. A returned commit SHA alone is insufficient artifact
+verification. Keep the proof observer in the acceptance fixture unless a
+separate product requirement justifies a general artifact API.
+
+Also retain failed-run cleanup evidence for an unavailable runtime, refused
+credential route, denied required egress, and timeout. Use owner-controlled
+negative fixtures; do not disable host networking or mutate real credentials.
+
+The current Glas adapter supplies `--no-metrics` and has no repository-grant
+field. Rein-aharness explicitly refuses repository-grant runs with
+`--no-metrics`. This proof therefore validates its disposable output
+independently; it must not claim that the repository-grant contract was exercised.
+Production grant propagation, if required by the owner return contract, needs
+an explicit adapter/state-storage design before the proof candidate can pass.
+
+## Readiness and rollback
+
+Only the proven candidate becomes `ready`, with evidence recording the exact
+host/runtime scope and revisions. A ready catalog entry is not a live health
+probe for every host. Preserve the blocked `1.0.0` version as the rollback pin;
+returning to it must refuse, never invoke another runtime. Do not silently
+retarget existing consumers or enable production schedules.
+
+The open-weight profile remains blocked until its own route and real-rein
+proof pass. Keep that portion of `GLAS-IN-0002` live after this workplan closes.