glas-harness/workplans/GLAS-WP-0018-session-agent-identity-and-tool-boundary.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	state_hub_workstream_id
GLAS-WP-0018	workplan	Session-scoped agent identity, attribution and tool boundary	infotech	glas-harness	proposed	implementation	claude	session-agent-identity-tool-boundary	2026-10-24	2026-10-24	4805066a-58f6-51c5-bc99-eabe9cd719d0

Session-scoped agent identity, attribution and tool boundary

Request: net-kingdom message 14ea093a (service-identity-privilege_v0.1 draft-3, SI-14, SI-15; SEC-DSM DSM-AGENT-002, -007, -008). Assessment: history/2026-10-24-agent-session-identity-and-tool-boundary-assessment.md. Status is proposed: needs founder approval and key-cape / sand-boxer replies before T04. T01 to T03 have no external dependency. No harness behavior has been changed by drafting this plan.

Contract fields and evidence

id: GLAS-WP-0018-T01
status: todo
priority: high
state_hub_task_id: "c19c4644-058a-5a85-a840-3e917d86c58e"

Add optional identity_ref (subject, act.sub, jti, issuer, expiry; never the token), session_id and on_behalf_of to the request and ExecutionEvidence. Add hashed evidence-receipt location and sha256. Tests; backwards compatible.

Boundary declaration and tool-profile echo check

id: GLAS-WP-0018-T02
status: todo
priority: high
state_hub_task_id: "b1e1ac59-e03c-5e01-986f-721383888999"

Add a profile boundary block, record it in evidence, and fail the run when the rein reports a tool profile different from the requested one. Catalog validation: profiles with credential routes or an identity requirement must name a non-default tool profile. Request rein-aharness to export its tool-profile manifest.

Issuer interface and fail-closed path

id: GLAS-WP-0018-T03
status: todo
priority: medium
state_hub_task_id: "3e2baf39-0b0e-5dd4-bb72-ebc5b72e3b0b"

Define AgentIdentityIssuer with a test double. Gateway obtains a per-run token (ttl = min(profile, remaining timeout, 3600)), fails closed with a new identity failure stage, redacts the token pattern, and discards/revokes at teardown. Never put the token in argv, task file, evidence or Hub detail.

KeyCape adapter and token delivery

id: GLAS-WP-0018-T04
status: wait
priority: medium
state_hub_task_id: "5dd4ea64-172a-583e-a353-407c0734bf55"

Blocked on key-cape (agent-token issuance, act, revocation) and the sand-boxer or credential owner (delivery route). Agree the actor (adm/agt/atm) to IAM principal_type mapping with net-kingdom. Rein presentation of the token is a rein-aharness task.

Per-action attribution and durable evidence

id: GLAS-WP-0018-T05
status: todo
priority: medium
state_hub_task_id: "66bb42e1-bb6b-5943-8aac-b13425408018"

Emit an ActionRecord per observed commit and streamed tool event, with completeness stated. Require and verify Assistant, Assistant-Session, Assistant-Process trailers on sandbox commits. Add a durable local outbox for Hub reports. Receipt stored outside the sandbox; independent verification step defined with net-kingdom (SI-15 verify).

Interactive-session contract and Codex/Grok feasibility

id: GLAS-WP-0018-T06
status: todo
priority: low
state_hub_task_id: "bd782576-eb37-5f71-90cb-cb29c0e96f61"

Publish a provider-neutral session identity contract for sessions Glas does not launch. Check what hooks Codex and Grok offer; decide whether a rein for either is worth building. Record that interactive sessions remain at SI-14 "person's reach" until then.