glas-harness/docs/evidence/GLAS-WP-0004-live-proof-2026-08-20.md
tegwick f773b5c101
Some checks failed
ci / validate (push) Has been cancelled
fix: enforce sandbox execution boundary
2026-08-21 10:40:29 +02:00

73 lines
3.6 KiB
Markdown

# GLAS-WP-0004 live profile evidence — 2026-08-20
Acceptance task for both profiles: change one `README.md` status value from
`pending` to `complete`, make no other content change, and commit it. Each run
used a separate temporary initialized repository and `profile.bwrap-local`.
No credential value, prompt transcript, or raw model output is recorded here.
> **Correction recorded 2026-08-21 (GLAS-WP-0005):** these runs proved profile
> resolution, rein dispatch, normalized evidence, commit detection, and
> sand-boxer lifecycle teardown. They did **not** prove that the rein process ran
> inside bwrap. The gateway passed the source checkout to the adapters and the
> adapters launched ordinary host subprocesses instead of entering the reported
> namespace. The commit and model results below remain valid execution facts;
> the earlier isolation implication is withdrawn. GLAS-WP-0005 changes the
> runtime to use only reachability-derived workspaces and transports and requires
> a new boundary proof.
## `harness.agent-dev-local@1.0.0`
- Result: succeeded.
- Contract: `1.0`.
- Rein: `rein-aharness@0.1.0`.
- Model route/resolved model: `claude-code-cli` / `claude-sonnet-4-6`.
- Tool profile: `green-commit-only`.
- Sandbox ID: `e61624cb`; local lifecycle store verified `destroyed`.
- Request ID: `96b2ec85-3823-4088-bcf4-a008c02e2354`.
- Commit: `795f8ef8b414f4470e812005f4103b8c5f126829`.
- Tool-event visibility: complete, 14 events.
- Reported execution time: 29.051 seconds.
The first attempt also proved normalized dependency/startup failure and
sandbox cleanup: the acceptance environment lacked rein-aharness's optional
`llm-connect` install. After installing the documented sibling dependency, the
same profile and task succeeded. Production packaging must install the concrete
rein with its execution dependencies.
## `harness.agent-dev-openweights-local@1.0.0`
- Result: succeeded on the 2026-08-21 local-time recheck after credential repair.
- Contract: `1.0`.
- Rein: `rein-openweights@0.1.0`.
- Model route/resolved model: `rein-openweights-openrouter` /
`qwen/qwen-2.5-72b-instruct`.
- Tool profile: `green-commit-only`.
- Sandbox ID: `220482bc`; local lifecycle store verified `destroyed`.
- Request ID: `b783af7f-e728-4dee-9034-f1c2262aa9ea`.
- Commit: `b0600b25066731c6e1fc458409429f76a844f959`.
- Turns/tokens: 3 / 3,497 of the 60,000-token profile budget.
- Tool-event visibility: unavailable, reported explicitly rather than as an
empty claim of completeness.
- Reported execution time: 300.095 seconds.
The recheck exposed two credential-selection facts without revealing a value:
an inherited `OPENROUTER_API_KEY` still contained the retired key and therefore
masked the repaired workload lane, while the AppRole files existed at the
documented standard directory but code required an environment variable to use
them. The successful run removed the stale ambient override and selected the
approved AppRole directory. `rein-openweights` now defaults to
`~/.local/rein-openweights/approle`; explicit environment credentials retain
development precedence and are documented as needing refresh/removal after
rotation.
## Acceptance status
Both explicit profiles resolved and dispatched distinct rein/model
constellations, completed the same semantic task with a real commit, returned
the common Glas evidence envelope, and destroyed their local sandbox lifecycle
records. Per the correction above, this is not isolation evidence. No
alternative workload credential was borrowed.
Rollback for consumers is to repin to the last approved Glas profile. The old
`--sandbox-profile` governed path and implicit `ReinAharness()` default are not
restored.