glas-harness/docs/local-profile-acceptance.md

First local profile: runtime requirements and acceptance

Work record: GLAS-WP-0012. Live residual: GLAS-IN-0002. Owner dependency: SAND-WP-0014-T05.

Start from harness.agent-dev-local@1.0.0: rein-aharness / Claude Code / claude-sonnet-4-6 / green-commit-only. The future proof candidate is harness.agent-dev-local@1.1.0; it is not yet in the catalog because its runtime, sandbox profile, and credential route are not resolved.

Reviewed baseline, 2026-09-05

Glas owner adapter: 63a7f9f. Sand-boxer: b6655d88590e03820675719d6dd574e5f5a9f82e. Rein-aharness source: 1429db5ad4c83331b6375349ffde1eb13af9575b.

Run .venv/bin/python scripts/inspect-local-runtime.py to inspect the current profile.bwrap-local from inside owner-mediated execution. This is a non-secret inventory, not a model call or a readiness bypass. It does not read credentials or the interactive user's authentication files. Exit zero means the inventory ran and cleaned up; it does not mean the profile is ready.

Recorded run: sandbox 236f3683, consumer agt / glas-runtime-baseline, run id glas-wp-0012-baseline. Inventory completed successfully; final state was destroyed and the workspace was absent.

Requirement	Current evidence	Required owner deliverable
Owner execution	Real gateway boundary proof passed in GLAS-WP-0005	Retain exact identity, argv/stdin, timeout, and teardown semantics
Rein runtime	rein-aharness, rein_aharness, and llm_connect absent from sandbox discovery	Read-only, reproducible runtime with all required Python dependencies and working CLI entrypoint
Claude runtime	claude discoverable; startup/authentication not tested	Pin runtime version; prove startup, model selection, tools, and streaming options under the owner environment
Persona preparation	kaizen-agentic absent	Explicitly accept the rein's recorded persona_source=none for this fixture, or provide the optional runtime
Authentication	Selected Glas profile declares no credential route	Claude-compatible value-free route id, owner approval/implementation, delivery and revocation behavior
Network	default: deny, empty egress, only lo	Explicit enforced provider route, required DNS/TLS support, denied-destination proof
Writable runtime state	Owner sets HOME to the copied worktree	Define private auth/cache/state locations and ensure they cannot enter an agent commit

The SANDBOXER_CREDENTIAL_ROUTE_REFS environment field only carries route labels. In the reviewed broker it does not acquire or deliver credentials. Glas must not invent a route id, borrow an interactive login, or use the OpenRouter credential as a substitute for the selected Claude route.

The bwrap implementation unconditionally creates an isolated network namespace and does not create an outbound interface. Declaring an egress hostname in YAML alone cannot make the current runtime reach it. Sand-boxer owns the enforcement implementation and its negative tests.

The rein uses llm_connect.claude_code.ClaudeCodeAdapter and launches Claude with cwd pinned to the sandbox and a named tool allow-list. Host environment overrides do not survive the owner's sanitized child environment. The runtime must work under that actual environment, including Git author configuration, private writable state, and the applicable tool/streaming CLI options.

Owner return contract

Record exact non-secret artifact/revision references for:

1. The installed sandbox owner path and host. Glas currently calls the local creating SandboxManager; if the intended deployment requires authenticated HTTP instead, supply that contract and adapt/prove the client before claiming equivalence with the local manager proof.
2. The sandbox profile and read-only rein/Claude runtime artifact, Python dependencies, trust store, executable paths, and writable state placement.
3. The Claude-compatible credential route, delivering component, consumer scope, and cleanup/revocation behavior. Evidence contains route ids and outcomes, never values, auth files, or provider responses.
4. The enforced egress destinations and ports, DNS/TLS requirements, and proof that an undeclared destination remains denied. Provider connectivity does not grant the agent additional network tools.
5. Non-secret startup checks (rein-aharness --help, claude --version or owner-equivalent checks), exact actor/project/run identity, absent source checkout, and destroyed/absent workspace under the deployed path.

The current SAND-WP-0014-T05 text mentions an OpenRouter AppRole read. That is a separate route from the chosen first Claude profile. Resolve this distinction in owner work before selecting credentials or treating T02 as complete.

Real acceptance fixture

After owner dependencies pass, review the exact versioned candidate as unverified and run it on a disposable repository with no push remote. Use a local test Git identity and a small non-secret task: create only PROOF.md with a fixed expected line and make exactly one local commit. Bound the run within the reviewed profile's token/time limits.

Use the actual Glas gateway, concrete ReinAharness adapter, installed rein-aharness CLI, and selected Claude model. The GLAS-WP-0005 deterministic dispatch cannot substitute for this test.

Before teardown, validate through owner execution:

• The expected file content, exactly one new commit, expected changed paths, and a clean working tree.
• Host source path absent from the sandbox; the source sentinel and Git HEAD remain unchanged when independently checked on the host.
• Exact actor/project/request id as consumer.run_id at create and exec; declared credential route and network policy match the reviewed candidate.
• No task/auth/cache artifacts in the accepted commit; generated task removed before destroy, followed by destroyed state and absent workspace.

Retain actual commit/content-validation results before gateway teardown destroys the workspace. A returned commit SHA alone is insufficient artifact verification. Keep the proof observer in the acceptance fixture unless a separate product requirement justifies a general artifact API.

Also retain failed-run cleanup evidence for an unavailable runtime, refused credential route, denied required egress, and timeout. Use owner-controlled negative fixtures; do not disable host networking or mutate real credentials.

The current Glas adapter supplies --no-metrics and has no repository-grant field. Rein-aharness explicitly refuses repository-grant runs with --no-metrics. This proof therefore validates its disposable output independently; it must not claim that the repository-grant contract was exercised. Production grant propagation, if required by the owner return contract, needs an explicit adapter/state-storage design before the proof candidate can pass.

Readiness and rollback

Only the proven candidate becomes ready, with evidence recording the exact host/runtime scope and revisions. A ready catalog entry is not a live health probe for every host. Preserve the blocked 1.0.0 version as the rollback pin; returning to it must refuse, never invoke another runtime. Do not silently retarget existing consumers or enable production schedules.

The open-weight profile remains blocked until its own route and real-rein proof pass. Keep that portion of GLAS-IN-0002 live after this workplan closes.