# Local provider egress acceptance

Sand-boxer now supports owner allowlisted HTTPS CONNECT egress with isolated
network namespaces. No credentials were read or model calls made.

- Extension smoke sandbox `e290e788`: Anthropic verified TLS, HTTP 404;
  undeclared example.com and direct 1.1.1.1:443 denied; proxy/workspace removed.
- Persisted-manager smoke sandbox `1c64fa89`: the same checks passed after
  reconstructing the manager/store, including proxy teardown from saved state.
- Glas regression: 101 tests passed in its .venv. The system Python lacks the
  sandboxer dependency and could not collect the suite; the configured venv passed.
- Glas deterministic boundary smoke `741a9b87`: source absent/unchanged,
  exact identity, task mode0600/removal, only lo and workspace teardown passed.

Implementation and scope: ../sand-boxer/docs/bwrap-egress.md. The proxy enforces
connection destinations, not HTTP path or TLS SNI on shared hosting; the trusted
host resolver supplies addresses and non-global results refuse. Existing
production profiles remain blocked and opt out of the new egress by default.

Remaining GLAS-WP-0012-T02 / SAND-WP-0015-T04: concrete machine auth binding,
protected credential delivery from confirmed KV version 2, pinned Claude
executable and real authentication/task acceptance. The platform CCR applier
currently supports OIDC/Kubernetes and transitional token auth, not AppRole;
local machine identity must be implemented through its owner before activation.
Do not use the operator UI session as runtime authentication.