From d511f97e0624603546dc8305f9b76c3fa84efac8 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 13 Oct 2026 20:47:21 +0200 Subject: [PATCH] GLAS-WP-0016/0017: plan FI brief profile, assembly-checkpoint route and shared publish grant Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 269924@bnt-lap001 Assistant-Session: 02bbdd77-e96c-4580-8952-f4dc9d8a8508 --- docs/publish-grant-design.md | 58 +++++++++ .../GLAS-WP-0016-fi-research-brief-profile.md | 114 ++++++++++++++++++ ...0017-assembly-checkpoint-governed-route.md | 51 ++++++++ 3 files changed, 223 insertions(+) create mode 100644 docs/publish-grant-design.md create mode 100644 workplans/GLAS-WP-0016-fi-research-brief-profile.md create mode 100644 workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md diff --git a/docs/publish-grant-design.md b/docs/publish-grant-design.md new file mode 100644 index 0000000..d567796 --- /dev/null +++ b/docs/publish-grant-design.md @@ -0,0 +1,58 @@ +# Path-scoped publish grants + +Status: proposed (GLAS-WP-0016-T05, 2026-10-13). One design for every tenant +that publishes a governed run's commit to its own remote. First consumers: +freedom-intelligence daily brief (`briefs/**`) and assembly-economics +checkpoints (`checkpoints/**`). + +## Problem + +Both tenants need the same thing: a run produces commits confined to declared +paths, and those commits reach `origin/main` fast-forward only, with at most one +rebase retry, never merge or force. Today the assembly push lives inside +rein-aharness `assembly_checkpoint.py` (legacy inventory gap 6) and the FI push +is requested as part of a tool profile. Neither is a named, separately granted +capability. + +## Design + +1. **The grant is declared by the tenant, carried by Activity Core.** The + tenant's activity definition holds a `repository_grant` v2 block + (`allowed_paths`, `commit_count`, `publication: {remote, ref, mode, + decision}`). Activity Core validates it and attaches it to the claimed + ops_run. The FI declaration + (`freedom-intelligence/activity-definitions/fi-daily-research-brief.declaration.yaml`) + is the template; assembly-economics copies its shape with + `allowed_paths: [checkpoints/**]` and `commit_count.max` as its run needs. +2. **The session never publishes.** Agent sessions keep a commit-only tool + profile with no push and no Forgejo credential. A Glas profile's tool + profile does not carry publication rights; it only names the paths the + session may write. +3. **Publication is a deterministic step after the run.** The Glas worker + already captures the one-commit result as a Git bundle through the sandbox + owner and imports it under the original baseline, grant and lease + (GLAS-WP-0015, 2026-09-09). A publisher step outside the sandbox then: + - checks every commit touches only `allowed_paths` and the count is within + `commit_count`; + - pushes fast-forward only to `publication.ref`; + - on rejection fetches, rebases once if every unpublished commit is still + inside `allowed_paths`, and pushes again; otherwise it stops and records + the failure; + - never merges or forces; + - records the pushed SHA as run evidence. + It publishes only when the claimed ops_run carries a publication grant. +4. **The push credential belongs to the publisher, not to the run.** It is a + per-tenant, per-repository Forgejo credential under OpenBao custody, found + with `warden route find`. It never enters the sandbox. +5. **Deterministic runs use the same publisher.** A tenant-owned blueprint (no + Glas profile) hands its commits to the same publisher under the same grant + shape. Assembly-checkpoint does not need an agent session for this. + +## Open: who owns the publisher + +The publisher is one capability serving both Glas-profiled and blueprint runs. +Candidates: Activity Core (it already holds the grant and ops_run), rein-aharness +(it runs the worker that imports the bundle), or a separate typed capability. +Recommendation: Activity Core, because it validates and holds the grant, and +both execution paths already pass through it. This is the operator's decision, +tracked as GLAS-WP-0016-T05. diff --git a/workplans/GLAS-WP-0016-fi-research-brief-profile.md b/workplans/GLAS-WP-0016-fi-research-brief-profile.md new file mode 100644 index 0000000..91280fe --- /dev/null +++ b/workplans/GLAS-WP-0016-fi-research-brief-profile.md @@ -0,0 +1,114 @@ +--- +id: GLAS-WP-0016 +type: workplan +title: "Versioned Glas profile for the FI daily research brief" +domain: infotech +repo: glas-harness +status: ready +flavor: implementation +owner: claude +topic_slug: fi-research-brief-profile +created: "2026-10-13" +updated: "2026-10-13" +--- + +# FI daily research brief profile + +Request: freedom-intelligence message `c7f2df46` (FI-WP-0005-T05, 2026-09-22) +asks for `harness.fi-research-brief@1.0.0`. FI's profile-absent routing expires +2026-12-31; FI-WP-0005-T07 wires the canary only after a positive sandboxed +proof run. Owner declaration: +`freedom-intelligence/activity-definitions/fi-daily-research-brief.declaration.yaml`. +Egress list: `freedom-intelligence/docs/sources-egress.yaml` (17 hosts, :443). +Publication design: `docs/publish-grant-design.md`. + +## Add the Glas profile harness.fi-research-brief@1.0.0 + +```task +id: GLAS-WP-0016-T01 +status: todo +priority: high +``` + +Add `profiles/harness.fi-research-brief.yaml`: rein-aharness, session_style +unattended, model_class frontier, model pinned by Glas (same pin as +harness.agent-dev-local 1.1.1 unless the operator chooses otherwise), limits +timeout 1800s / max_turns 60, `max_budget_usd` inside an accepted spend +envelope, sandbox profile from T02, tool profile from T03, documented rollback +pin. `operational_readiness.status: unverified` until T04 passes. Catalog +validation (`glas-harness profiles`) and tests must pass. Depends on T02/T03 +names being agreed, not on their release. + +## Add the sand-boxer egress sandbox profile + +```task +id: GLAS-WP-0016-T02 +status: todo +priority: high +``` + +Owner: sand-boxer. Request a bwrap profile (working name +`profile.bwrap-fi-research`) with `network.default: deny` and `network.egress` +equal to the model route plus exactly the 17 hosts in FI's +`sources-egress.yaml`, per `sand-boxer/docs/bwrap-egress.md` (exact lowercase +DNS names, :443, no wildcards or IP literals). Owner config `allowed_egress` +must be a superset. Glas sends the handoff and records the owner's return. + +## Add the rein-aharness research tool profile + +```task +id: GLAS-WP-0016-T03 +status: todo +priority: high +``` + +Owner: rein-aharness. Request a tool profile (working name +`green-research-commit`): read/edit tools, HTTPS fetch through the sandbox +proxy, git add/commit/status/log/diff limited to granted paths (`briefs/**`), +no push and no arbitrary shell. Publication is not part of the tool profile; +it is the deterministic publisher step in `docs/publish-grant-design.md`. + +## Prove one sandboxed run and mark the profile ready + +```task +id: GLAS-WP-0016-T04 +status: wait +priority: high +blocking_reason: "Depends on T01-T03 and on the publisher owner (T05)." +``` + +Run one bounded brief through the profile inside the sandbox: egress limited +to the declared hosts, exactly one new file under `briefs/`, one commit, no +push from the session. Publish evidence under `docs/evidence/`, then set +`operational_readiness.status: ready` and notify FI for FI-WP-0005-T07. + +## Operator decision: owner of the publish-grant publisher + +```task +id: GLAS-WP-0016-T05 +status: wait +needs_human: true +priority: high +blocking_reason: "Operator decision: which subsystem owns the deterministic publisher (recommendation: Activity Core)." +``` + +`docs/publish-grant-design.md` defines one path-scoped publish grant for FI and +assembly-checkpoint. Open: who owns the publisher step and its push +credentials. Recommendation: Activity Core. Resolve before T04 publishes. + +## Operator decision: is a sandboxed pinned agent a host installation? + +```task +id: GLAS-WP-0016-T06 +status: wait +needs_human: true +priority: high +blocking_reason: "Operator decision on FI's playbook question; FI decides its rhythm on that basis." +``` + +FI's playbook forbids installing Claude Code / Codex on railiance01 for this +rhythm. Question: does a pinned agent executable that runs only inside the Glas +bwrap sandbox count as a host installation? Glas view: no. The binary is a +pinned runtime artifact owned by rein-aharness/sand-boxer, not on the host PATH, +not user-installed, carries no host credentials and runs only under deny-default +egress. Answer FI explicitly once the operator decides. diff --git a/workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md b/workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md new file mode 100644 index 0000000..b6342e5 --- /dev/null +++ b/workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md @@ -0,0 +1,51 @@ +--- +id: GLAS-WP-0017 +type: workplan +title: "Governed route for assembly-checkpoint before legacy routing ends" +domain: infotech +repo: glas-harness +status: ready +flavor: implementation +owner: claude +topic_slug: assembly-checkpoint-governed-route +created: "2026-10-13" +updated: "2026-10-13" +--- + +# Assembly-checkpoint governed route + +Request: assembly-economics messages `713cd2a8` and `d9cc84e6` +(ASSEMBLY-WP-0014-T01). Declaration `checkpoints/EXECUTION_DECLARATION.md` +founder-approved 2026-10-13. Target: December monthly run on the governed +route by 2026-12-15, ahead of the 2026-12-31 compatibility flag. + +## Operator decision: profile shape for assembly-checkpoint + +```task +id: GLAS-WP-0017-T01 +status: wait +needs_human: true +priority: high +blocking_reason: "Operator decision: tenant-owned blueprint only, or blueprint plus a Glas profile for the assessment." +``` + +Options: (a) tenant-owned blueprint for the whole run, with the optional +assessment as one bounded llm-connect call inside it and no Glas profile; +(b) blueprint plus a separate Glas-profiled call for the assessment; (c) one +Glas profile for both. Glas recommendation: (a), matching rein-aharness +`docs/legacy-runtime-inventory.md` step 3. A Glas profile is needed only if the +assessment becomes an agent loop. Publication uses the shared grant in +`docs/publish-grant-design.md` either way. + +## Confirm the grant shape with assembly-economics + +```task +id: GLAS-WP-0017-T02 +status: wait +priority: medium +blocking_reason: "Depends on T01 and GLAS-WP-0016-T05 (publisher owner)." +``` + +Once the decisions land, confirm with assembly-economics a `repository_grant` +v2 block (`allowed_paths: [checkpoints/**]`, fast-forward only, one rebase, +never force) in its activity definition, copied from the FI template.