GLAS-WP-0018: assess session-scoped agent identity and tool boundary; propose workplan

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed

workplans/GLAS-WP-0018-session-agent-identity-and-tool-boundary.md

@@ -0,0 +1,101 @@
+---
+id: GLAS-WP-0018
+type: workplan
+title: "Session-scoped agent identity, attribution and tool boundary"
+domain: infotech
+repo: glas-harness
+status: proposed
+flavor: implementation
+owner: claude
+topic_slug: session-agent-identity-tool-boundary
+created: "2026-10-24"
+updated: "2026-10-24"
+---
+
+# Session-scoped agent identity, attribution and tool boundary
+
+Request: net-kingdom message 14ea093a (service-identity-privilege_v0.1 draft-3,
+SI-14, SI-15; SEC-DSM DSM-AGENT-002, -007, -008). Assessment:
+`history/2026-10-24-agent-session-identity-and-tool-boundary-assessment.md`.
+Status is `proposed`: needs founder approval and key-cape / sand-boxer replies
+before T04. T01 to T03 have no external dependency. No harness behavior has been
+changed by drafting this plan.
+
+## Contract fields and evidence
+
+```task
+id: GLAS-WP-0018-T01
+status: todo
+priority: high
+```
+
+Add optional `identity_ref` (subject, act.sub, jti, issuer, expiry; never the
+token), `session_id` and `on_behalf_of` to the request and `ExecutionEvidence`.
+Add hashed evidence-receipt location and sha256. Tests; backwards compatible.
+
+## Boundary declaration and tool-profile echo check
+
+```task
+id: GLAS-WP-0018-T02
+status: todo
+priority: high
+```
+
+Add a profile `boundary` block, record it in evidence, and fail the run when the
+rein reports a tool profile different from the requested one. Catalog validation:
+profiles with credential routes or an identity requirement must name a
+non-default tool profile. Request rein-aharness to export its tool-profile
+manifest.
+
+## Issuer interface and fail-closed path
+
+```task
+id: GLAS-WP-0018-T03
+status: todo
+priority: medium
+```
+
+Define `AgentIdentityIssuer` with a test double. Gateway obtains a per-run token
+(ttl = min(profile, remaining timeout, 3600)), fails closed with a new
+`identity` failure stage, redacts the token pattern, and discards/revokes at
+teardown. Never put the token in argv, task file, evidence or Hub detail.
+
+## KeyCape adapter and token delivery
+
+```task
+id: GLAS-WP-0018-T04
+status: wait
+priority: medium
+```
+
+Blocked on key-cape (agent-token issuance, `act`, revocation) and the sand-boxer
+or credential owner (delivery route). Agree the `actor` (`adm`/`agt`/`atm`) to
+IAM principal_type mapping with net-kingdom. Rein presentation of the token is a
+rein-aharness task.
+
+## Per-action attribution and durable evidence
+
+```task
+id: GLAS-WP-0018-T05
+status: todo
+priority: medium
+```
+
+Emit an ActionRecord per observed commit and streamed tool event, with
+completeness stated. Require and verify `Assistant`, `Assistant-Session`,
+`Assistant-Process` trailers on sandbox commits. Add a durable local outbox for
+Hub reports. Receipt stored outside the sandbox; independent verification
+step defined with net-kingdom (SI-15 verify).
+
+## Interactive-session contract and Codex/Grok feasibility
+
+```task
+id: GLAS-WP-0018-T06
+status: todo
+priority: low
+```
+
+Publish a provider-neutral session identity contract for sessions Glas does not
+launch. Check what hooks Codex and Grok offer; decide whether a rein for either
+is worth building. Record that interactive sessions remain at SI-14 "person's
+reach" until then.