glas-harness/workplans/GLAS-WP-0012-first-local-profile-production-proof.md

---
id: GLAS-WP-0012
type: workplan
title: "Prove the first local rein profile end to end"
domain: infotech
repo: glas-harness
status: blocked
owner: codex
topic_slug: first-local-profile-production-proof
created: "2026-09-05"
updated: "2026-09-06"
state_hub_workstream_id: "170bf1ae-337f-5553-8d1e-03b07100e08f"
---

# Prove the first local rein profile end to end

## Context and scope

Follow up the Claude-route portion of live residual `GLAS-IN-0002`, originating
in finished `GLAS-WP-0005`. Boundary hardening is committed at `63a7f9f` and
proved with a deterministic non-secret dispatch. That proof did not execute
the real rein CLI or make a model call.

Start from `harness.agent-dev-local@1.0.0` (rein-aharness,
`claude-sonnet-4-6`, `claude-code-cli`, `green-commit-only`). Review a new
versioned candidate after the owner runtime contract is available. Keep the
existing blocked selection as the rollback pin. The open-weight profile and
remote profile do not acquire readiness from this workplan.

Glas owns profile selection, its adapter, and acceptance evidence. Sand-boxer
owns runtime provisioning, execution environment, isolation, egress enforcement,
and teardown. The selected rein and credential owner own authentication and
credential acquisition. Use existing owner work `SAND-WP-0014-T05`; its current
OpenRouter dependency must be distinguished from this first Claude-route proof.

## Establish the exact local baseline and acceptance requirements

```task
id: GLAS-WP-0012-T01
status: done
priority: high
state_hub_task_id: "711aeb7e-4664-5078-8c65-3fe6f46f7999"
```

Completed 2026-09-05. Reviewed Glas `63a7f9f`, sand-boxer `b6655d8`, and
rein-aharness `1429db5`. Added a reproducible non-secret owner-execution runtime
inventory and the [acceptance contract](../docs/local-profile-acceptance.md).

The baseline can discover Python, Git, and a `claude` command. It cannot
discover `rein-aharness`, its Python module, or `llm_connect`. Command discovery
alone does not prove that Claude can start or authenticate. The namespace has
only loopback; declared egress and credential route references are empty.
Owner execution and workspace teardown pass. The baseline is therefore
insufficient for a real rein run.

Reviewed the plan against current implementation. Local preparation is done;
remaining execution waits on the owner inputs in T02.

## Resolve and verify the owner runtime, credential, and egress contract

```task
id: GLAS-WP-0012-T02
status: wait
priority: high
state_hub_task_id: "4209f564-a9ee-57f9-9522-3708988801ef"
```

Dependency: sand-boxer `SAND-WP-0014-T05`, with rein-aharness and its credential
owner. Required deliverables are listed in `docs/local-profile-acceptance.md`:

- Exact runtime artifact/revision, in-sandbox entrypoints and dependencies,
  sanitized environment, private writable state, and deployment/host identity.
- A Claude-compatible catalog credential route and owner implementation that
  delivers it to the selected runtime. An environment label containing route
  references is not credential delivery.
- An owner-defined sandbox profile with explicit enforced provider egress,
  DNS/TLS requirements, and negative egress tests. Editing an egress list alone
  does not provide connectivity in the current loopback-only implementation.
- Non-secret startup, identity, source-absence, and cleanup evidence through
  the same manager/service path the gateway will use.

Done when these deliverables exist at reviewable revisions and their owner
proofs pass. No rein installation in the source checkout, host home mount,
credential injection from the interactive shell, or unrestricted network
substitution is an acceptance path.

2026-09-05 owner progress: SAND-WP-0015 implemented digest-pinned standalone
Python runtime mounting and private namespace state. Real rein CLI startup,
read-only runtime, source absence, clean worktree, state persistence across
exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132
tests pass. This completes the candidate runtime mechanism, not production
selection. Authentication lane, credential delivery/revocation, provider egress,
pinning the Claude executable, and deployed profile review remain open. The
credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See
[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner
CCR-2026-0016 (in flight). Organization/key metadata is supplied and the user saved the key in OpenBao.
A metadata-only owner check confirmed live version 2 on 2026-09-05, without
reading the value. Custody handoff is complete. Verified machine binding,
protected runtime delivery, workspace scope/budget and provider egress remain
outstanding; provider authentication has not been tested.
See docs/local-profile-acceptance.md.

## Review and validate the versioned Glas proof candidate

```task
id: GLAS-WP-0012-T03
status: wait
priority: high
state_hub_task_id: "c660808a-1724-555c-bc59-7318870d3591"
```

Depends on T02. Prepare `harness.agent-dev-local@1.1.0` only once the real
sandbox profile and credential route are known. Keep the rein/model route and
tool profile explicit; choose bounded proof limits no greater than the current
900 seconds / 60,000 tokens. Record runtime and sandbox revisions and the
validated host scope in evidence. Account for dependency versions that are not
represented directly in the Glas profile schema.

Use `unverified` only after known blockers are resolved, to label the bounded
real proof. Validate schema, capabilities, route propagation, timeout behavior,
and refusal of the old blocked version. Version coexistence must make an
unversioned selection ambiguous rather than silently changing consumers.

Done when the exact candidate resolves, the real runtime starts through its
owner, the focused tests and full suite pass, and rollback to the blocked
`harness.agent-dev-local@1.0.0` pin is documented.

## Prove one real bounded rein task inside the sandbox

```task
id: GLAS-WP-0012-T04
status: wait
priority: high
state_hub_task_id: "3e791432-8f37-54bd-a44a-55eeff11ac19"
```

Depends on T03. Run the actual `ReinAharness` adapter and installed
`rein-aharness` CLI with Claude through the candidate profile on a disposable
Git fixture. Do not substitute deterministic dispatch or change the source
checkout to satisfy the task. Verify the acceptance assertions in the contract,
including exactly one intended commit, a clean final tree, unchanged/inaccessible
host source, exact identity, bounded duration, task cleanup, and destruction.

Collect and validate the sandbox artifact before gateway teardown removes the
workspace. Implement the smallest necessary proof observer in the acceptance
fixture; direct evidence must distinguish actual content validation from a
reported commit SHA. Preserve compact value-free evidence only.

Done when the bounded real run and relevant failure/cleanup checks pass with
the exact selected profile/runtime pins and credential route identified.

## Publish evidence and mark only the proven profile ready

```task
id: GLAS-WP-0012-T05
status: wait
priority: high
state_hub_task_id: "f7635cf6-e044-52d4-8242-0512e0ccbd7b"
```

Depends on T04. Update only the proven candidate to `ready` with evidence that
identifies the host/runtime scope, credential route, egress policy, revisions,
limits, and rollback. Run catalog validation and regression checks. Do not
enable production schedules as a side effect of this proof.

Update `GLAS-IN-0002` with the Claude acceptance result. Keep its open-weight
portion live, or split that remaining work into a separately registered record
before closing the intake. Synchronize work records and log progress. Finish
this workplan only when the first profile is proven and residuals remain live.

## Prepare the real-rein acceptance runner

```task
id: GLAS-WP-0012-T06
status: done
priority: high
state_hub_task_id: "d0c26709-549f-540a-8250-1fd1b2e4960a"
```

Independent preparation for T04 while T02 remains blocked. Add a disposable
fixture that delegates actual dispatch to the catalog-built ReinAharness,
validates the commit and artifact through owner execution before teardown,
checks the host source and cleanup, and emits bounded evidence without model
output or credential values. Refuse blocked or unpinned profiles before
creating a sandbox. Test negative artifact cases and the refusal path. This
runner does not itself satisfy T04 or change readiness.

Completed 2026-09-05. `scripts/prove-local-profile.py` delegates real dispatch
and observes content/commit acceptance before teardown. It verifies exactly one
new commit, expected paths and committed/worktree content, a clean tree,
source absence, exact child identity, private task mode/removal, and host-source
integrity plus workspace destruction. It emits bounded evidence and has no
readiness override. `tests/test_local_profile_proof.py`: 20 focused tests pass;
full suite: 101 passed; catalog validation passes. A real CLI invocation against
`harness.agent-dev-local@1.0.0` returned `OperationallyBlockedProfileError`
without creating a sandbox. T02–T05 remain waiting on the owner dependencies;
no real model run or readiness promotion is claimed.

## Acceptance

One version-pinned local profile runs its actual rein/model task entirely in
the declared sandbox, produces validated local output, and tears down cleanly.
Its readiness describes the proven runtime scope. Other profile readiness and
consumer schedules remain independently governed.

## 2026-09-05 egress owner return

Owner-controlled HTTPS egress is implemented and live-tested through both the
extension and a persisted manager: provider TLS/HTTP response, undeclared-host
and direct-IP denial, isolated namespace and proxy/workspace cleanup passed.
See [egress evidence](../docs/evidence/GLAS-WP-0012-egress-2026-09-05.md).
T02 remains waiting on machine auth, protected credential delivery, the pinned
Claude executable and the combined production acceptance. Profiles remain blocked.

## 2026-09-05 credential owner return

Sand-boxer credential transport is implemented and proved with synthetic
provider sandbox 880f749e. Owner config binds exact profile/project/actor and
run id; unknown routes refuse, shell API-key fallback is stripped, only the
workload child receives the value, and output redaction precedes truncation.
Tests: sand-boxer171, secrets-engine226, Glas101 pass. Native data-only read
policy/AppRole proposal and activation now live in SECRETS-WP-0009. Its
production exec refuses before OpenBao because durable access-engine decision
records and scoped service authority remain unavailable. T02 remains waiting
on that activation, pinned Claude startup and real provider/task acceptance.

## 2026-09-06 credential owner update

Reviewed secrets-engine message `3bd23bc9-e863-4f1f-8c76-415812ec0656`.
Owner reports the local authorization join implemented at `627810b`. Remaining
native activation depends on approval-engine serving the durable
ActionAuthorization claim endpoint and access-engine serving Check, followed
by configuration, per-lane approval and positive/negative verification.
State Hub decisions are not a substitute for the durable authorization object.
SECRETS-WP-0009-T03 and this plan's T02 remain waiting; runtime pinning and
combined real proof remain required. No readiness change or real-key read.

## 2026-09-06 authorization contract and policy publication

Reviewed owner commits `7b4b9e3` and `083bee7` and FLEX-WP-0021. Gate-house
GH-DEC-2026-005 resolved the contract: secrets-engine now validates the
approval-claim and decision envelope separately and removed the incorrect
State Hub authority requirement. Flex-auth published
`secrets-engine.catalog-lane.lifecycle` v1; T01/T02 are done.

Remaining owner gates are real decision/digest verification (FLEX-WP-0021-T03),
consumer service deployment and handoff (T04/T05), approval-engine deployment,
production service identity and verified lane activation. Publication is not
deployment. T02 stays waiting, and runtime pinning and combined acceptance
remain required. No new owner inbox message or activation evidence was found
in this review.

## 2026-09-06 digest verification follow-up

Reviewed secrets-engine `6e9c152` and `925d028`: owner corrected correlation
field handling in the flex-auth digest and refreshed fixtures. Its tests also
record an unresolved approval/native action-vocabulary and embedded-claim
digest mismatch for dual-control requests. This is owner integration evidence,
not successful live activation; SECRETS-WP-0009-T03 remains wait. No new
activation receipt was found in the Glas inbox. T02 remains waiting.

## 2026-09-06 authorization-chain owner return

Reviewed secrets-engine `f62d3fe` / `64aeec9`. Owner reports claim → Check →
consume → backend integration against a throwaway OpenBao, including denial,
unreachable service, invalid claim, missing digest, consume conflict and action
mismatch refusal before backend access. Authorization transport is stubbed;
wire shapes use published flex-auth fixtures. Do not describe this as a live
production service or Anthropic delivery proof.

Owner now identifies deployment/configuration as the remaining live gate:
consumer PDP service and approval-engine rollout, production service
credentials, deployed policy pin and per-lane authorization id.
SECRETS-WP-0009-T03 remains wait. Earlier digest-defect notes are historical;
use this latest owner return for the integration status. Native lane positive/
negative access checks, pinned Claude startup, provider scope/budget inputs and
combined Glas acceptance remain outstanding. T02–T05 stay wait.

Review found no pending local changes or new inbox messages. Corrected stale
README wording that still called owner execution missing; the implemented
mechanism and its separate proofs do not change profile readiness.

## 2026-09-06 production deployment action

User authorized production deployment. Dedicated flex-auth-secrets-engine Helm
release is available 1/1 at revision 1; five policy fixtures and allowed/denied
network probes passed. CI image is digest-pinned; existing consumers unchanged.
Caller authentication remains warn pending identity adoption. See
[deployment evidence](../history/2026-09-06-174000-production-deployment.md).
Approval-engine remains undeployed: live KeyCape clients and audit sender are
absent, the tenant contract needs alignment, and a release digest is required.
Corrected its stale issuer/JWKS deployment inputs. No production credential
lane or real Claude run was activated; T02 remains wait.

## Production dependency coordination

GLAS-WP-0015 now tracks exact owner handoffs and return receipts from Glas.
The requests in docs/production-dependency-handoffs.md reuse existing owner
work: tenant agreement and client custody, KeyCape rollout, audit source
onboarding, approval release, native lane activation and pinned combined
runtime. Image/runtime preparation can proceed in parallel. The runner's
project glas-local-proof must be reconciled with the owner route example's
project glas-harness before the exact delivery binding is selected. Owner
handoffs were sent after explicit authorization; GLAS-WP-0015 records all seven
receipt IDs and tracks replies. This plan's T02 remains wait.