coulomb/rein-aharness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: finish REIN-A-0004

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d
This commit is contained in:
tegwick 2026-08-23 01:50:52 +02:00
parent 7bea0a4ca6
commit 440bc58892
2 changed files with 42 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -13,7 +13,7 @@
| workplan | REIN-A-0001 | finished | — | workplans/REIN-A-0001-statehub-bootstrap.md |
| workplan | REIN-A-0002 | finished | — | workplans/REIN-A-0002-ops-run-claim-loop.md |
| workplan | REIN-A-0003 | finished | — | workplans/REIN-A-0003-binky-weekly-review-approach.md |
| workplan | REIN-A-0004 | blocked | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md |
| workplan | REIN-A-0004 | finished | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md |
| task | HARNESS-WP-0001-T01 | done | — | workplans/HARNESS-WP-0001-harness-foundation.md |
| task | HARNESS-WP-0001-T02 | done | — | workplans/HARNESS-WP-0001-harness-foundation.md |
| task | HARNESS-WP-0001-T03 | done | — | workplans/HARNESS-WP-0001-harness-foundation.md |
@ -40,4 +40,4 @@
| task | REIN-A-0004-T01 | done | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md |
| task | REIN-A-0004-T02 | done | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md |
| task | REIN-A-0004-T03 | done | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md |
| task | REIN-A-0004-T04 | wait | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md |
| task | REIN-A-0004-T04 | done | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md |

42
workplans/REIN-A-0004-glas-profiled-ops-runs.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Profile-driven ops-run execution through Glas"
domain: infotech
repo: rein-aharness
status: active
status: finished
owner: codex
topic_slug: rein-aharness
priority: high
@ -90,7 +90,7 @@ redaction-by-allowlist, bounding, and unusable bodies.
```task
id: REIN-A-0004-T04
status: progress
status: done
priority: high
state_hub_task_id: "b19a4dab-d6d7-537a-8c8f-77217f0d9069"
```
@ -133,3 +133,41 @@ governed actor type (`agt`). Activity Core handoff
`c9a4ae44-f092-424f-9a4d-9b4cf58d65fd` confirms a direct `actor=agt`
create/destroy preflight passed and requests the mapping correction plus real
Glas/sand-boxer model validation before the final pilot.
**Done 2026-08-23:** commit `c633291` separates queue lease ownership from the
governed Glas actor (`agt`), validates the mapping against the real Glas and
sand-boxer models, and is deployed as the active railiance01 claim worker. The
full optional-runtime suite passes 98 tests.
The post-fix bounded production run
`ededc939-266f-473c-8386-ffd3f027f5f0` preserved
`harness.agent-dev-local@1.0.0` and its attribution refs, resolved
rein-aharness `0.1.0`, `claude-sonnet-4-6`, `green-commit-only`, and
`profile.bwrap-local`, and created sandbox `d750cd5c` as actor `agt`. It failed
closed at `session_start` before model dispatch, artifact creation, or commit.
Sand-boxer records the sandbox destroyed at
`2026-08-22T23:35:41.024853Z`, and the workspace is absent.
The proof exposed no remaining rein consumer defect. A no-dispatch
reproduction showed that Glas cannot `nsenter` the managed bwrap namespaces.
Installing and persistently loading Ubuntu's `bwrap-userns-restrict` AppArmor
profile made the bwrap runtime stable with zero effective child capabilities,
but direct consumer namespace entry remains denied. Executable owner-mediated
reachability, a mounted rein runtime, and explicit model egress/credential
delivery already belong to live residual `GLAS-IN-0002`
(`01a02b76-f020-7d60-a3ce-12a34c13ebce`). Evidence and ownership were handed
to Glas in message `3e64f8e0-92a3-496c-99b0-57fbc28e46de`, sand-boxer in
`6bc53d35-5074-4aa9-b6b6-f9b063863439`, and Activity Core in
`64568b0a-f5b4-41f2-8abd-9acc7e10ee38`. No host-execution fallback was added;
the later successful-commit proof remains with `ACTIVITY-WP-0032-T05` after
that residual is delivered.
## Completion
All rein-aharness-owned work is complete: profile selectors and attribution
survive the queue boundary, profiled rows use the authoritative Glas gateway
without legacy fallback, safe provider diagnostics remain allowlisted, claim
errors respect configured backoff, the governance actor is correctly mapped,
and the deployed worker has produced normalized fail-closed production
evidence with verified teardown. The only actionable follow-up is already a
live owner record (`GLAS-IN-0002`) and is not parked in this finished workplan.