# First local profile: runtime requirements and acceptance

Work record: [GLAS-WP-0012](../workplans/GLAS-WP-0012-first-local-profile-production-proof.md).
Live residual: `GLAS-IN-0002`. Owner dependency: `SAND-WP-0014-T05`.

Start from `harness.agent-dev-local@1.0.0`: rein-aharness / Claude Code /
`claude-sonnet-4-6` / `green-commit-only`. The future proof candidate is
`harness.agent-dev-local@1.1.0`; it is not yet in the catalog because its runtime,
sandbox profile, and credential route are not resolved.

## Reviewed baseline, 2026-09-05

Glas owner adapter: `63a7f9f`. Sand-boxer:
`b6655d88590e03820675719d6dd574e5f5a9f82e`. Rein-aharness source:
`1429db5ad4c83331b6375349ffde1eb13af9575b`.

Run `.venv/bin/python scripts/inspect-local-runtime.py` to inspect the current
`profile.bwrap-local` from inside owner-mediated execution. This is a
non-secret inventory, not a model call or a readiness bypass. It does not read
credentials or the interactive user's authentication files. Exit zero means
the inventory ran and cleaned up; it does not mean the profile is ready.

Recorded run: sandbox `236f3683`, consumer `agt` / `glas-runtime-baseline`,
run id `glas-wp-0012-baseline`. Inventory completed successfully; final state
was `destroyed` and the workspace was absent.

| Requirement | Current evidence | Required owner deliverable |
|---|---|---|
| Owner execution | Real gateway boundary proof passed in GLAS-WP-0005 | Retain exact identity, argv/stdin, timeout, and teardown semantics |
| Rein runtime | `rein-aharness`, `rein_aharness`, and `llm_connect` absent from sandbox discovery | Read-only, reproducible runtime with all required Python dependencies and working CLI entrypoint |
| Claude runtime | `claude` discoverable; startup/authentication not tested | Pin runtime version; prove startup, model selection, tools, and streaming options under the owner environment |
| Persona preparation | `kaizen-agentic` absent | Explicitly accept the rein's recorded `persona_source=none` for this fixture, or provide the optional runtime |
| Authentication | Selected Glas profile declares no credential route | Claude-compatible value-free route id, owner approval/implementation, delivery and revocation behavior |
| Network | `default: deny`, empty egress, only `lo` | Explicit enforced provider route, required DNS/TLS support, denied-destination proof |
| Writable runtime state | Owner sets `HOME` to the copied worktree | Define private auth/cache/state locations and ensure they cannot enter an agent commit |

The `SANDBOXER_CREDENTIAL_ROUTE_REFS` environment field only carries route
labels. In the reviewed broker it does not acquire or deliver credentials.
Glas must not invent a route id, borrow an interactive login, or use the
OpenRouter credential as a substitute for the selected Claude route.

The bwrap implementation unconditionally creates an isolated network namespace
and does not create an outbound interface. Declaring an egress hostname in YAML
alone cannot make the current runtime reach it. Sand-boxer owns the enforcement
implementation and its negative tests.

The rein uses `llm_connect.claude_code.ClaudeCodeAdapter` and launches Claude
with cwd pinned to the sandbox and a named tool allow-list. Host environment
overrides do not survive the owner's sanitized child environment. The runtime
must work under that actual environment, including Git author configuration,
private writable state, and the applicable tool/streaming CLI options.

## Owner return contract

Record exact non-secret artifact/revision references for:

1. The installed sandbox owner path and host. Glas currently calls the local
   creating `SandboxManager`; if the intended deployment requires authenticated
   HTTP instead, supply that contract and adapt/prove the client before claiming
   equivalence with the local manager proof.
2. The sandbox profile and read-only rein/Claude runtime artifact, Python
   dependencies, trust store, executable paths, and writable state placement.
3. The Claude-compatible credential route, delivering component, consumer scope,
   and cleanup/revocation behavior. Evidence contains route ids and outcomes,
   never values, auth files, or provider responses.
4. The enforced egress destinations and ports, DNS/TLS requirements, and proof
   that an undeclared destination remains denied. Provider connectivity does
   not grant the agent additional network tools.
5. Non-secret startup checks (`rein-aharness --help`, `claude --version` or
   owner-equivalent checks), exact actor/project/run identity, absent source
   checkout, and destroyed/absent workspace under the deployed path.

The current SAND-WP-0014-T05 text mentions an OpenRouter AppRole read. That is
a separate route from the chosen first Claude profile. Resolve this distinction
in owner work before selecting credentials or treating T02 as complete.

## Real acceptance fixture

After owner dependencies pass, review the exact versioned candidate as
`unverified` and run it on a disposable repository with no push remote. Use a
local test Git identity and a small non-secret task: create only `PROOF.md`
with a fixed expected line and make exactly one local commit. Bound the run
within the reviewed profile's token/time limits.

Use the actual Glas gateway, concrete `ReinAharness` adapter, installed
`rein-aharness` CLI, and selected Claude model. The GLAS-WP-0005 deterministic
dispatch cannot substitute for this test.

Before teardown, validate through owner execution:

- The expected file content, exactly one new commit, expected changed paths,
  and a clean working tree.
- Host source path absent from the sandbox; the source sentinel and Git HEAD
  remain unchanged when independently checked on the host.
- Exact actor/project/request id as `consumer.run_id` at create and exec;
  declared credential route and network policy match the reviewed candidate.
- No task/auth/cache artifacts in the accepted commit; generated task removed
  before destroy, followed by destroyed state and absent workspace.

Retain actual commit/content-validation results before gateway teardown
destroys the workspace. A returned commit SHA alone is insufficient artifact
verification. Keep the proof observer in the acceptance fixture unless a
separate product requirement justifies a general artifact API.

Also retain failed-run cleanup evidence for an unavailable runtime, refused
credential route, denied required egress, and timeout. Use owner-controlled
negative fixtures; do not disable host networking or mutate real credentials.

The current Glas adapter supplies `--no-metrics` and has no repository-grant
field. Rein-aharness explicitly refuses repository-grant runs with
`--no-metrics`. This proof therefore validates its disposable output
independently; it must not claim that the repository-grant contract was exercised.
Production grant propagation, if required by the owner return contract, needs
an explicit adapter/state-storage design before the proof candidate can pass.

## Readiness and rollback

Only the proven candidate becomes `ready`, with evidence recording the exact
host/runtime scope and revisions. A ready catalog entry is not a live health
probe for every host. Preserve the blocked `1.0.0` version as the rollback pin;
returning to it must refuse, never invoke another runtime. Do not silently
retarget existing consumers or enable production schedules.

The open-weight profile remains blocked until its own route and real-rein
proof pass. Keep that portion of `GLAS-IN-0002` live after this workplan closes.