From 440bc58892eaa6c998481ba5d97f723379801956 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 23 Aug 2026 01:50:52 +0200 Subject: [PATCH] docs: finish REIN-A-0004 Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d --- WORK-RECORDS.md | 4 +- .../REIN-A-0004-glas-profiled-ops-runs.md | 42 ++++++++++++++++++- 2 files changed, 42 insertions(+), 4 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index bd793cd..b6ef8e7 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -13,7 +13,7 @@ | workplan | REIN-A-0001 | finished | — | workplans/REIN-A-0001-statehub-bootstrap.md | | workplan | REIN-A-0002 | finished | — | workplans/REIN-A-0002-ops-run-claim-loop.md | | workplan | REIN-A-0003 | finished | — | workplans/REIN-A-0003-binky-weekly-review-approach.md | -| workplan | REIN-A-0004 | blocked | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md | +| workplan | REIN-A-0004 | finished | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md | | task | HARNESS-WP-0001-T01 | done | — | workplans/HARNESS-WP-0001-harness-foundation.md | | task | HARNESS-WP-0001-T02 | done | — | workplans/HARNESS-WP-0001-harness-foundation.md | | task | HARNESS-WP-0001-T03 | done | — | workplans/HARNESS-WP-0001-harness-foundation.md | @@ -40,4 +40,4 @@ | task | REIN-A-0004-T01 | done | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md | | task | REIN-A-0004-T02 | done | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md | | task | REIN-A-0004-T03 | done | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md | -| task | REIN-A-0004-T04 | wait | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md | +| task | REIN-A-0004-T04 | done | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md | diff --git a/workplans/REIN-A-0004-glas-profiled-ops-runs.md b/workplans/REIN-A-0004-glas-profiled-ops-runs.md index 106adcc..9f29598 100644 --- a/workplans/REIN-A-0004-glas-profiled-ops-runs.md +++ b/workplans/REIN-A-0004-glas-profiled-ops-runs.md @@ -4,7 +4,7 @@ type: workplan title: "Profile-driven ops-run execution through Glas" domain: infotech repo: rein-aharness -status: active +status: finished owner: codex topic_slug: rein-aharness priority: high @@ -90,7 +90,7 @@ redaction-by-allowlist, bounding, and unusable bodies. ```task id: REIN-A-0004-T04 -status: progress +status: done priority: high state_hub_task_id: "b19a4dab-d6d7-537a-8c8f-77217f0d9069" ``` @@ -133,3 +133,41 @@ governed actor type (`agt`). Activity Core handoff `c9a4ae44-f092-424f-9a4d-9b4cf58d65fd` confirms a direct `actor=agt` create/destroy preflight passed and requests the mapping correction plus real Glas/sand-boxer model validation before the final pilot. + +**Done 2026-08-23:** commit `c633291` separates queue lease ownership from the +governed Glas actor (`agt`), validates the mapping against the real Glas and +sand-boxer models, and is deployed as the active railiance01 claim worker. The +full optional-runtime suite passes 98 tests. + +The post-fix bounded production run +`ededc939-266f-473c-8386-ffd3f027f5f0` preserved +`harness.agent-dev-local@1.0.0` and its attribution refs, resolved +rein-aharness `0.1.0`, `claude-sonnet-4-6`, `green-commit-only`, and +`profile.bwrap-local`, and created sandbox `d750cd5c` as actor `agt`. It failed +closed at `session_start` before model dispatch, artifact creation, or commit. +Sand-boxer records the sandbox destroyed at +`2026-08-22T23:35:41.024853Z`, and the workspace is absent. + +The proof exposed no remaining rein consumer defect. A no-dispatch +reproduction showed that Glas cannot `nsenter` the managed bwrap namespaces. +Installing and persistently loading Ubuntu's `bwrap-userns-restrict` AppArmor +profile made the bwrap runtime stable with zero effective child capabilities, +but direct consumer namespace entry remains denied. Executable owner-mediated +reachability, a mounted rein runtime, and explicit model egress/credential +delivery already belong to live residual `GLAS-IN-0002` +(`01a02b76-f020-7d60-a3ce-12a34c13ebce`). Evidence and ownership were handed +to Glas in message `3e64f8e0-92a3-496c-99b0-57fbc28e46de`, sand-boxer in +`6bc53d35-5074-4aa9-b6b6-f9b063863439`, and Activity Core in +`64568b0a-f5b4-41f2-8abd-9acc7e10ee38`. No host-execution fallback was added; +the later successful-commit proof remains with `ACTIVITY-WP-0032-T05` after +that residual is delivered. + +## Completion + +All rein-aharness-owned work is complete: profile selectors and attribution +survive the queue boundary, profiled rows use the authoritative Glas gateway +without legacy fallback, safe provider diagnostics remain allowlisted, claim +errors respect configured backoff, the governance actor is correctly mapped, +and the deployed worker has produced normalized fail-closed production +evidence with verified teardown. The only actionable follow-up is already a +live owner record (`GLAS-IN-0002`) and is not parked in this finished workplan.