coulomb/rein-aharness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(deploy): gate claims on pinned runtime readiness

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9
This commit is contained in:
tegwick 2026-09-04 20:08:37 +02:00
parent d00ffcb402
commit 4310c15eac
17 changed files with 757 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

38
workplans/REINAH-WP-0003-governed-runtime-integrity.md
View file

@ -555,10 +555,40 @@ Deployment is now explicitly labeled `packaging-smoke`; its source comments and
deployment guide state that `sleep infinity` is neither ready to claim nor a
failover worker and must never receive the Activity Core worker credential.
T05 remains `progress`. Reproducible pinned sibling packages, startup readiness,
recovery/outbox controls, and non-skipped cross-package CI still need
implementation; the currently catalogued local Glas profiles are also
operationally `blocked` on `GLAS-IN-0002`.
T05 remains `progress`. Reproducible pinned sibling artifacts, full recovery
drills, and non-skipped cross-package CI still need implementation; the
currently catalogued local Glas profiles are also operationally `blocked` on
`GLAS-IN-0002`.
### Pre-claim readiness and recovery gate — 2026-09-04
Added `rein-aharness preflight` and made it an `ExecStartPre` requirement of
the authoritative host user service. The gate performs a read-only Activity
Core queue probe, verifies configured repository workspaces and private state,
and refuses unresolved close-evidence quarantine without claiming or executing
work. Pending close evidence remains recoverable: the first claim-loop cycle
replays it before attempting any new claim.
Production profile enablement is now declared as exact comma-separated
`AGENT_HARNESS_REQUIRED_PROFILE_REFS`. Each reference must be version-pinned,
resolve through the installed Glas catalog, and declare operational readiness
`ready`. A ready `profile.bwrap-local` must also pass an executable bwrap
namespace probe, covering missing binaries and user-namespace/AppArmor host
refusal. The current example leaves the list empty because the catalogued local
profiles remain blocked on `GLAS-IN-0002`; the gate does not misrepresent them
as ready.
Added a reviewed runtime lock for exact llm-connect, Glas, and sand-boxer source
revisions plus the Glas `1.0` and Activity Core migration `0010` contract pins.
The host installer rejects missing, dirty, or mismatched sibling checkouts and
uses the frozen uv lock with `--no-editable`. `make contract-test` first imports
all three runtime packages and then runs the cross-package contract/claim
suites, making a missing optional dependency a hard release failure.
T05 remains `progress`: the non-skippable gate still needs CI-runner wiring,
the compatible Activity Core artifact and migration need deployment evidence,
and the documented crash/lease/API-close/sandbox cleanup recovery drills remain
to be executed against the pinned host artifact.
## Re-prove one governed profiled run and close residuals