glas-harness/workplans/GLAS-WP-0012-first-local-profile-production-proof.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
GLAS-WP-0012	workplan	Prove the first local rein profile end to end	infotech	glas-harness	blocked	codex	first-local-profile-production-proof	2026-09-05	2026-09-05	170bf1ae-337f-5553-8d1e-03b07100e08f

Prove the first local rein profile end to end

Context and scope

Follow up the Claude-route portion of live residual GLAS-IN-0002, originating in finished GLAS-WP-0005. Boundary hardening is committed at 63a7f9f and proved with a deterministic non-secret dispatch. That proof did not execute the real rein CLI or make a model call.

Start from harness.agent-dev-local@1.0.0 (rein-aharness, claude-sonnet-4-6, claude-code-cli, green-commit-only). Review a new versioned candidate after the owner runtime contract is available. Keep the existing blocked selection as the rollback pin. The open-weight profile and remote profile do not acquire readiness from this workplan.

Glas owns profile selection, its adapter, and acceptance evidence. Sand-boxer owns runtime provisioning, execution environment, isolation, egress enforcement, and teardown. The selected rein and credential owner own authentication and credential acquisition. Use existing owner work SAND-WP-0014-T05; its current OpenRouter dependency must be distinguished from this first Claude-route proof.

Establish the exact local baseline and acceptance requirements

id: GLAS-WP-0012-T01
status: done
priority: high
state_hub_task_id: "711aeb7e-4664-5078-8c65-3fe6f46f7999"

Completed 2026-09-05. Reviewed Glas 63a7f9f, sand-boxer b6655d8, and rein-aharness 1429db5. Added a reproducible non-secret owner-execution runtime inventory and the acceptance contract.

The baseline can discover Python, Git, and a claude command. It cannot discover rein-aharness, its Python module, or llm_connect. Command discovery alone does not prove that Claude can start or authenticate. The namespace has only loopback; declared egress and credential route references are empty. Owner execution and workspace teardown pass. The baseline is therefore insufficient for a real rein run.

Reviewed the plan against current implementation. Local preparation is done; remaining execution waits on the owner inputs in T02.

Resolve and verify the owner runtime, credential, and egress contract

id: GLAS-WP-0012-T02
status: wait
priority: high
state_hub_task_id: "4209f564-a9ee-57f9-9522-3708988801ef"

Dependency: sand-boxer SAND-WP-0014-T05, with rein-aharness and its credential owner. Required deliverables are listed in docs/local-profile-acceptance.md:

• Exact runtime artifact/revision, in-sandbox entrypoints and dependencies, sanitized environment, private writable state, and deployment/host identity.
• A Claude-compatible catalog credential route and owner implementation that delivers it to the selected runtime. An environment label containing route references is not credential delivery.
• An owner-defined sandbox profile with explicit enforced provider egress, DNS/TLS requirements, and negative egress tests. Editing an egress list alone does not provide connectivity in the current loopback-only implementation.
• Non-secret startup, identity, source-absence, and cleanup evidence through the same manager/service path the gateway will use.

Done when these deliverables exist at reviewable revisions and their owner proofs pass. No rein installation in the source checkout, host home mount, credential injection from the interactive shell, or unrestricted network substitution is an acceptance path.

2026-09-05 owner progress: SAND-WP-0015 implemented digest-pinned standalone Python runtime mounting and private namespace state. Real rein CLI startup, read-only runtime, source absence, clean worktree, state persistence across exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132 tests pass. This completes the candidate runtime mechanism, not production selection. Authentication lane, credential delivery/revocation, provider egress, pinning the Claude executable, and deployed profile review remain open. The credential catalog has no matching Anthropic/Claude workload lane; the user's authentication choice is pending. See docs/local-profile-acceptance.md.

Review and validate the versioned Glas proof candidate

id: GLAS-WP-0012-T03
status: wait
priority: high
state_hub_task_id: "c660808a-1724-555c-bc59-7318870d3591"

Depends on T02. Prepare harness.agent-dev-local@1.1.0 only once the real sandbox profile and credential route are known. Keep the rein/model route and tool profile explicit; choose bounded proof limits no greater than the current 900 seconds / 60,000 tokens. Record runtime and sandbox revisions and the validated host scope in evidence. Account for dependency versions that are not represented directly in the Glas profile schema.

Use unverified only after known blockers are resolved, to label the bounded real proof. Validate schema, capabilities, route propagation, timeout behavior, and refusal of the old blocked version. Version coexistence must make an unversioned selection ambiguous rather than silently changing consumers.

Done when the exact candidate resolves, the real runtime starts through its owner, the focused tests and full suite pass, and rollback to the blocked harness.agent-dev-local@1.0.0 pin is documented.

Prove one real bounded rein task inside the sandbox

id: GLAS-WP-0012-T04
status: wait
priority: high
state_hub_task_id: "3e791432-8f37-54bd-a44a-55eeff11ac19"

Depends on T03. Run the actual ReinAharness adapter and installed rein-aharness CLI with Claude through the candidate profile on a disposable Git fixture. Do not substitute deterministic dispatch or change the source checkout to satisfy the task. Verify the acceptance assertions in the contract, including exactly one intended commit, a clean final tree, unchanged/inaccessible host source, exact identity, bounded duration, task cleanup, and destruction.

Collect and validate the sandbox artifact before gateway teardown removes the workspace. Implement the smallest necessary proof observer in the acceptance fixture; direct evidence must distinguish actual content validation from a reported commit SHA. Preserve compact value-free evidence only.

Done when the bounded real run and relevant failure/cleanup checks pass with the exact selected profile/runtime pins and credential route identified.

Publish evidence and mark only the proven profile ready

id: GLAS-WP-0012-T05
status: wait
priority: high
state_hub_task_id: "f7635cf6-e044-52d4-8242-0512e0ccbd7b"

Depends on T04. Update only the proven candidate to ready with evidence that identifies the host/runtime scope, credential route, egress policy, revisions, limits, and rollback. Run catalog validation and regression checks. Do not enable production schedules as a side effect of this proof.

Update GLAS-IN-0002 with the Claude acceptance result. Keep its open-weight portion live, or split that remaining work into a separately registered record before closing the intake. Synchronize work records and log progress. Finish this workplan only when the first profile is proven and residuals remain live.

Prepare the real-rein acceptance runner

id: GLAS-WP-0012-T06
status: done
priority: high
state_hub_task_id: "d0c26709-549f-540a-8250-1fd1b2e4960a"

Independent preparation for T04 while T02 remains blocked. Add a disposable fixture that delegates actual dispatch to the catalog-built ReinAharness, validates the commit and artifact through owner execution before teardown, checks the host source and cleanup, and emits bounded evidence without model output or credential values. Refuse blocked or unpinned profiles before creating a sandbox. Test negative artifact cases and the refusal path. This runner does not itself satisfy T04 or change readiness.

Completed 2026-09-05. scripts/prove-local-profile.py delegates real dispatch and observes content/commit acceptance before teardown. It verifies exactly one new commit, expected paths and committed/worktree content, a clean tree, source absence, exact child identity, private task mode/removal, and host-source integrity plus workspace destruction. It emits bounded evidence and has no readiness override. tests/test_local_profile_proof.py: 20 focused tests pass; full suite: 101 passed; catalog validation passes. A real CLI invocation against harness.agent-dev-local@1.0.0 returned OperationallyBlockedProfileError without creating a sandbox. T02–T05 remain waiting on the owner dependencies; no real model run or readiness promotion is claimed.

Acceptance

One version-pinned local profile runs its actual rein/model task entirely in the declared sandbox, produces validated local output, and tears down cleanly. Its readiness describes the proven runtime scope. Other profile readiness and consumer schedules remain independently governed.