Review sand-boxer metered route and request credential-chain status (GLAS-IN-0002)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 251574@bnt-lap001
Assistant-Session: 7d35c398-3815-44dc-84f1-df369a1594e9

workplans/GLAS-WP-0015-production-dependency-coordination.md

@@ -9,7 +9,7 @@ flavor: implementation
 owner: codex
 topic_slug: production-dependency-coordination
 created: "2026-09-06"
-updated: "2026-09-09"
+updated: "2026-09-21"
 state_hub_workstream_id: "94c02b1f-66ed-588d-bdd7-7158107b85fb"
 ---
 
@@ -78,6 +78,22 @@ The matching rein/Glas code must be rebuilt and admitted in the protected runtim
 this local proof does not close live G1/G2 or authorize a model request. See the
 2026-09-09 runtime-transfer evidence and the owning runtime documentation.
 
+2026-09-21 owner review: sand-boxer bfe0e4c, be42de7 and 7a61383 add a trusted,
+ephemeral owner Messages route. For metered runs the provider key stays in
+rein's MessagesOwner outside bwrap. The workload reaches it only through a mounted
+owner socket, with empty egress and no child credential routes. The commits also
+add frozen-lock owner runtime builds and refuse stale installed packages. Glas
+reran the focused sand-boxer tests (messages route, runtime builder): 20 passed.
+This changes the GLAS-IN-0002 acceptance shape. "Explicit required egress" for
+the metered profile is empty egress plus the owner socket; it is no longer a
+direct-CONNECT allowlist. The Glas candidate profile (GLAS-WP-0012-T03) must
+target the newly reviewed empty-egress owner profile. Owner T04 still waits on
+provider-to-owner bootstrap, protected install, Railiance placement and live
+compatibility. SECRETS-WP-0009-T03 remains wait, so no real run is possible.
+Status requests were sent on the existing threads: secrets-engine
+`6ea00e6d-c074-4564-a0d0-2137fea20ac0`, approval-engine
+`54ae49cc-ece8-4107-9b76-1477e11280eb`.
+
 ## Delivery receipts
 
 | Owner | Root message / reply thread |