glas-harness/workplans/GLAS-WP-0018-session-agent-identity-and-tool-boundary.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	state_hub_workstream_id
GLAS-WP-0018	workplan	Session-scoped agent identity, attribution and tool boundary	infotech	glas-harness	active	implementation	claude	session-agent-identity-tool-boundary	2026-10-24	2026-10-31	4805066a-58f6-51c5-bc99-eabe9cd719d0

Session-scoped agent identity, attribution and tool boundary

Request: net-kingdom message 14ea093a (service-identity-privilege_v0.1 draft-3, SI-14, SI-15; SEC-DSM DSM-AGENT-002, -007, -008). Assessment: history/2026-10-24-agent-session-identity-and-tool-boundary-assessment.md. Status is proposed: needs founder approval and key-cape / sand-boxer replies before T04. T01 to T03 have no external dependency. No harness behavior has been changed by drafting this plan.

Contract fields and evidence

id: GLAS-WP-0018-T01
status: todo
priority: high
state_hub_task_id: "c19c4644-058a-5a85-a840-3e917d86c58e"

Add optional identity_ref (subject, act.sub, jti, issuer, expiry; never the token), session_id and on_behalf_of to the request and ExecutionEvidence. Add hashed evidence-receipt location and sha256. Tests; backwards compatible.

Boundary declaration and tool-profile echo check

id: GLAS-WP-0018-T02
status: todo
priority: high
state_hub_task_id: "b1e1ac59-e03c-5e01-986f-721383888999"

Add a profile boundary block, record it in evidence, and fail the run when the rein reports a tool profile different from the requested one. Catalog validation: profiles with credential routes or an identity requirement must name a non-default tool profile. Request rein-aharness to export its tool-profile manifest.

Issuer interface and fail-closed path

id: GLAS-WP-0018-T03
status: todo
priority: medium
state_hub_task_id: "3e2baf39-0b0e-5dd4-bb72-ebc5b72e3b0b"

Define AgentIdentityIssuer with a test double. Gateway obtains a per-run token (ttl = min(profile, remaining timeout, 3600)), fails closed with a new identity failure stage, redacts the token pattern, and discards/revokes at teardown. Never put the token in argv, task file, evidence or Hub detail.

KeyCape adapter and token delivery

id: GLAS-WP-0018-T04
status: wait
priority: medium
state_hub_task_id: "5dd4ea64-172a-583e-a353-407c0734bf55"

Blocked on key-cape (agent-token issuance, act, revocation) and the sand-boxer or credential owner (delivery route). Agree the actor (adm/agt/atm) to IAM principal_type mapping with net-kingdom. Rein presentation of the token is a rein-aharness task.

Per-action attribution and durable evidence

id: GLAS-WP-0018-T05
status: todo
priority: medium
state_hub_task_id: "66bb42e1-bb6b-5943-8aac-b13425408018"

Emit an ActionRecord per observed commit and streamed tool event, with completeness stated. Require and verify Assistant, Assistant-Session, Assistant-Process trailers on sandbox commits. Add a durable local outbox for Hub reports. Receipt stored outside the sandbox; independent verification step defined with net-kingdom (SI-15 verify).

Interactive-session contract and Codex/Grok feasibility

id: GLAS-WP-0018-T06
status: todo
priority: low
state_hub_task_id: "bd782576-eb37-5f71-90cb-cb29c0e96f61"

Publish a provider-neutral session identity contract for sessions Glas does not launch. Check what hooks Codex and Grok offer; decide whether a rein for either is worth building. Record that interactive sessions remain at SI-14 "person's reach" until then.

Bounded-execution admission binding for agent executors

id: GLAS-WP-0018-T07
status: wait
priority: low
state_hub_task_id: "46ba7aef-7d12-5648-a74c-7516e124f65e"

Answer to net-kingdom NK-WP-0056-T02 (message 8713a17b): docs/bounded-execution-agent-executor.md. Carry admission_ref (admission_id, admission_digest) in the request and evidence, ask the issuer to put the harness-launch, profile, boundary and admission claims into the per-run token, and refuse an admission-bound run that lacks an issuer, an admission reference or a non-default tool profile. Glas does not validate the admission itself. Waits on T01 to T04 and on Bounded Execution Admission v0.1 moving past proposed. The pilot executor is not an agent (founder decision 6d1adce9), so this is not on the pilot path.

Founder decision 2026-10-31

Approved by the founder (proposed -> ready) after the NK-WP-0056-T02 owner answers (hub decision 19afd15e). The founder also confirmed glas-harness as the later owner of the agent-executor path (T07).