glas-harness/docs/evidence/GLAS-WP-0012-egress-2026-09-05.md

Local provider egress acceptance

Sand-boxer now supports owner allowlisted HTTPS CONNECT egress with isolated network namespaces. No credentials were read or model calls made.

• Extension smoke sandbox e290e788: Anthropic verified TLS, HTTP 404; undeclared example.com and direct 1.1.1.1:443 denied; proxy/workspace removed.
• Persisted-manager smoke sandbox 1c64fa89: the same checks passed after reconstructing the manager/store, including proxy teardown from saved state.
• Glas regression: 101 tests passed in its .venv. The system Python lacks the sandboxer dependency and could not collect the suite; the configured venv passed.
• Glas deterministic boundary smoke 741a9b87: source absent/unchanged, exact identity, task mode0600/removal, only lo and workspace teardown passed.

Implementation and scope: ../sand-boxer/docs/bwrap-egress.md. The proxy enforces connection destinations, not HTTP path or TLS SNI on shared hosting; the trusted host resolver supplies addresses and non-global results refuse. Existing production profiles remain blocked and opt out of the new egress by default.

Remaining GLAS-WP-0012-T02 / SAND-WP-0015-T04: concrete machine auth binding, protected credential delivery from confirmed KV version 2, pinned Claude executable and real authentication/task acceptance. The platform CCR applier currently supports OIDC/Kubernetes and transitional token auth, not AppRole; local machine identity must be implemented through its owner before activation. Do not use the operator UI session as runtime authentication.