glas-harness/docs/intakes/residuals.md

glas-harness residual intakes

GLAS-IN-0001 — Restore open-weight live-profile credential lane

id: GLAS-IN-0001
kind: intake
title: "Restore the rein-openweights OpenRouter lane and close the dual-profile live proof"
lane: blue
status: done
priority: high
owner: ops-mason
repo: glas-harness
origin: residual
origin_ref: GLAS-WP-0004
description: |
  On 2026-08-20, harness.agent-dev-openweights-local@1.0.0 resolved and
  dispatched the same bounded fixture used by the successful rein-aharness
  profile. The existing rein-local credential reached OpenRouter but the
  provider returned HTTP 401 User not found before a model turn. Glas returned
  normalized, redacted failure evidence and tore down sandbox bc9dec6a.

  Route catalog id: rein-openweights-openrouter-approle. Credential values must
  not be placed in this record, State Hub, Git, or chat.

  The owning credential operator should rotate or repair that exact workload
  lane, verify field presence without disclosure, and notify glas-harness.
  Then rerun the bounded acceptance task through
  harness.agent-dev-openweights-local@1.0.0, record a real commit plus cleanup
  evidence, and mark GLAS-WP-0004-T07 done. Do not borrow llm-connect's
  separate OpenRouter credential.

  Completed 2026-08-21. The repaired lane authenticated after removing a stale
  inherited OPENROUTER_API_KEY override and selecting the standard AppRole
  directory. The profile completed in 3 turns, spent 3,497 tokens, produced
  commit b0600b25066731c6e1fc458409429f76a844f959, and sandbox 220482bc was
  verified destroyed. The AppRole directory is now the code default.

GLAS-IN-0002 — Provide executable sandbox runtime reachability

id: GLAS-IN-0002
kind: intake
title: "Make bwrap reachability executable for governed Glas reins"
lane: red
status: todo
priority: high
owner: sand-boxer
repo: glas-harness
origin: residual
origin_ref: GLAS-WP-0005
description: |
  GLAS-WP-0005 corrected the gateway so a rein command must execute through
  the sand-boxer reachability descriptor and can no longer operate on the
  caller's source checkout. The existing profile.bwrap-local environment does
  not yet carry an executable rein runtime: ext.bwrap mounts /usr, /bin, /lib,
  /lib64, and resolv.conf, while rein-aharness/rein-openweights and their
  dependencies live outside those mounts. The open-weight profile also needs a
  governed egress/credential-delivery answer rather than the current empty
  network allow-list.

  A 2026-08-21 managed-agent probe also found direct consumer nsenter denied on
  the reported pid (IPC/UTS setns operation not permitted). Determine whether
  sand-boxer should expose an owner-implemented exec operation instead of
  requiring each consumer to call nsenter, and provide the runtime mount/image,
  identity, and network contract needed by both local profiles. Do not restore
  host-side execution as a workaround.

  Done when a non-secret probe and one real rein command execute inside the
  namespace, the source checkout is not visible/mutable, required egress is
  explicit, and teardown removes the sandbox workspace.