plan: define first local profile acceptance and runtime blockers

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

workplans/GLAS-WP-0012-first-local-profile-production-proof.md

@@ -0,0 +1,160 @@
+---
+id: GLAS-WP-0012
+type: workplan
+title: "Prove the first local rein profile end to end"
+domain: infotech
+repo: glas-harness
+status: blocked
+owner: codex
+topic_slug: first-local-profile-production-proof
+created: "2026-09-05"
+updated: "2026-09-05"
+state_hub_workstream_id: "170bf1ae-337f-5553-8d1e-03b07100e08f"
+---
+
+# Prove the first local rein profile end to end
+
+## Context and scope
+
+Follow up the Claude-route portion of live residual `GLAS-IN-0002`, originating
+in finished `GLAS-WP-0005`. Boundary hardening is committed at `63a7f9f` and
+proved with a deterministic non-secret dispatch. That proof did not execute
+the real rein CLI or make a model call.
+
+Start from `harness.agent-dev-local@1.0.0` (rein-aharness,
+`claude-sonnet-4-6`, `claude-code-cli`, `green-commit-only`). Review a new
+versioned candidate after the owner runtime contract is available. Keep the
+existing blocked selection as the rollback pin. The open-weight profile and
+remote profile do not acquire readiness from this workplan.
+
+Glas owns profile selection, its adapter, and acceptance evidence. Sand-boxer
+owns runtime provisioning, execution environment, isolation, egress enforcement,
+and teardown. The selected rein and credential owner own authentication and
+credential acquisition. Use existing owner work `SAND-WP-0014-T05`; its current
+OpenRouter dependency must be distinguished from this first Claude-route proof.
+
+## Establish the exact local baseline and acceptance requirements
+
+```task
+id: GLAS-WP-0012-T01
+status: done
+priority: high
+state_hub_task_id: "711aeb7e-4664-5078-8c65-3fe6f46f7999"
+```
+
+Completed 2026-09-05. Reviewed Glas `63a7f9f`, sand-boxer `b6655d8`, and
+rein-aharness `1429db5`. Added a reproducible non-secret owner-execution runtime
+inventory and the [acceptance contract](../docs/local-profile-acceptance.md).
+
+The baseline can discover Python, Git, and a `claude` command. It cannot
+discover `rein-aharness`, its Python module, or `llm_connect`. Command discovery
+alone does not prove that Claude can start or authenticate. The namespace has
+only loopback; declared egress and credential route references are empty.
+Owner execution and workspace teardown pass. The baseline is therefore
+insufficient for a real rein run.
+
+Reviewed the plan against current implementation. Local preparation is done;
+remaining execution waits on the owner inputs in T02.
+
+## Resolve and verify the owner runtime, credential, and egress contract
+
+```task
+id: GLAS-WP-0012-T02
+status: wait
+priority: high
+state_hub_task_id: "4209f564-a9ee-57f9-9522-3708988801ef"
+```
+
+Dependency: sand-boxer `SAND-WP-0014-T05`, with rein-aharness and its credential
+owner. Required deliverables are listed in `docs/local-profile-acceptance.md`:
+
+- Exact runtime artifact/revision, in-sandbox entrypoints and dependencies,
+  sanitized environment, private writable state, and deployment/host identity.
+- A Claude-compatible catalog credential route and owner implementation that
+  delivers it to the selected runtime. An environment label containing route
+  references is not credential delivery.
+- An owner-defined sandbox profile with explicit enforced provider egress,
+  DNS/TLS requirements, and negative egress tests. Editing an egress list alone
+  does not provide connectivity in the current loopback-only implementation.
+- Non-secret startup, identity, source-absence, and cleanup evidence through
+  the same manager/service path the gateway will use.
+
+Done when these deliverables exist at reviewable revisions and their owner
+proofs pass. No rein installation in the source checkout, host home mount,
+credential injection from the interactive shell, or unrestricted network
+substitution is an acceptance path.
+
+## Review and validate the versioned Glas proof candidate
+
+```task
+id: GLAS-WP-0012-T03
+status: wait
+priority: high
+state_hub_task_id: "c660808a-1724-555c-bc59-7318870d3591"
+```
+
+Depends on T02. Prepare `harness.agent-dev-local@1.1.0` only once the real
+sandbox profile and credential route are known. Keep the rein/model route and
+tool profile explicit; choose bounded proof limits no greater than the current
+900 seconds / 60,000 tokens. Record runtime and sandbox revisions and the
+validated host scope in evidence. Account for dependency versions that are not
+represented directly in the Glas profile schema.
+
+Use `unverified` only after known blockers are resolved, to label the bounded
+real proof. Validate schema, capabilities, route propagation, timeout behavior,
+and refusal of the old blocked version. Version coexistence must make an
+unversioned selection ambiguous rather than silently changing consumers.
+
+Done when the exact candidate resolves, the real runtime starts through its
+owner, the focused tests and full suite pass, and rollback to the blocked
+`harness.agent-dev-local@1.0.0` pin is documented.
+
+## Prove one real bounded rein task inside the sandbox
+
+```task
+id: GLAS-WP-0012-T04
+status: wait
+priority: high
+state_hub_task_id: "3e791432-8f37-54bd-a44a-55eeff11ac19"
+```
+
+Depends on T03. Run the actual `ReinAharness` adapter and installed
+`rein-aharness` CLI with Claude through the candidate profile on a disposable
+Git fixture. Do not substitute deterministic dispatch or change the source
+checkout to satisfy the task. Verify the acceptance assertions in the contract,
+including exactly one intended commit, a clean final tree, unchanged/inaccessible
+host source, exact identity, bounded duration, task cleanup, and destruction.
+
+Collect and validate the sandbox artifact before gateway teardown removes the
+workspace. Implement the smallest necessary proof observer in the acceptance
+fixture; direct evidence must distinguish actual content validation from a
+reported commit SHA. Preserve compact value-free evidence only.
+
+Done when the bounded real run and relevant failure/cleanup checks pass with
+the exact selected profile/runtime pins and credential route identified.
+
+## Publish evidence and mark only the proven profile ready
+
+```task
+id: GLAS-WP-0012-T05
+status: wait
+priority: high
+state_hub_task_id: "f7635cf6-e044-52d4-8242-0512e0ccbd7b"
+```
+
+Depends on T04. Update only the proven candidate to `ready` with evidence that
+identifies the host/runtime scope, credential route, egress policy, revisions,
+limits, and rollback. Run catalog validation and regression checks. Do not
+enable production schedules as a side effect of this proof.
+
+Update `GLAS-IN-0002` with the Claude acceptance result. Keep its open-weight
+portion live, or split that remaining work into a separately registered record
+before closing the intake. Synchronize work records and log progress. Finish
+this workplan only when the first profile is proven and residuals remain live.
+
+## Acceptance
+
+One version-pinned local profile runs its actual rein/model task entirely in
+the declared sandbox, produces validated local output, and tears down cleanly.
+Its readiness describes the proven runtime scope. Other profile readiness and
+consumer schedules remain independently governed.