From 9afacdbfbacce4b2454e6abfabe398210dc707b9 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 23 Aug 2026 11:27:32 +0200 Subject: [PATCH] plan: harden governed runtime integrity Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d --- WORK-RECORDS.md | 7 + .../REIN-A-0005-governed-runtime-integrity.md | 266 ++++++++++++++++++ 2 files changed, 273 insertions(+) create mode 100644 workplans/REIN-A-0005-governed-runtime-integrity.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index b6ef8e7..32bf621 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -14,6 +14,7 @@ | workplan | REIN-A-0002 | finished | — | workplans/REIN-A-0002-ops-run-claim-loop.md | | workplan | REIN-A-0003 | finished | — | workplans/REIN-A-0003-binky-weekly-review-approach.md | | workplan | REIN-A-0004 | finished | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md | +| workplan | REIN-A-0005 | ready | — | workplans/REIN-A-0005-governed-runtime-integrity.md | | task | HARNESS-WP-0001-T01 | done | — | workplans/HARNESS-WP-0001-harness-foundation.md | | task | HARNESS-WP-0001-T02 | done | — | workplans/HARNESS-WP-0001-harness-foundation.md | | task | HARNESS-WP-0001-T03 | done | — | workplans/HARNESS-WP-0001-harness-foundation.md | @@ -41,3 +42,9 @@ | task | REIN-A-0004-T02 | done | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md | | task | REIN-A-0004-T03 | done | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md | | task | REIN-A-0004-T04 | done | — | workplans/REIN-A-0004-glas-profiled-ops-runs.md | +| task | REIN-A-0005-T01 | todo | — | workplans/REIN-A-0005-governed-runtime-integrity.md | +| task | REIN-A-0005-T02 | wait | — | workplans/REIN-A-0005-governed-runtime-integrity.md | +| task | REIN-A-0005-T03 | wait | — | workplans/REIN-A-0005-governed-runtime-integrity.md | +| task | REIN-A-0005-T04 | wait | — | workplans/REIN-A-0005-governed-runtime-integrity.md | +| task | REIN-A-0005-T05 | wait | — | workplans/REIN-A-0005-governed-runtime-integrity.md | +| task | REIN-A-0005-T06 | wait | — | workplans/REIN-A-0005-governed-runtime-integrity.md | diff --git a/workplans/REIN-A-0005-governed-runtime-integrity.md b/workplans/REIN-A-0005-governed-runtime-integrity.md new file mode 100644 index 0000000..040b048 --- /dev/null +++ b/workplans/REIN-A-0005-governed-runtime-integrity.md @@ -0,0 +1,266 @@ +--- +id: REIN-A-0005 +type: workplan +title: "Governed runtime integrity and intent convergence" +domain: infotech +repo: rein-aharness +status: ready +owner: codex +topic_slug: rein-aharness +priority: high +created: "2026-08-23" +updated: "2026-08-23" +related: + - REIN-A-0004 + - GLAS-IN-0002 + - ACTIVITY-WP-0032 + - CUST-WP-0065 +--- + +# REIN-A-0005 — Governed runtime integrity and intent convergence + +## Origin + +The 2026-08-23 intent–scope assessment found that the deployed v0.1 worker is +a useful sequential Activity Core consumer, but its strongest production +claims exceed its current enforcement and evidence: + +1. direct runs accept any `HEAD` change without a repository lock, clean-tree + gate, changed-path validation, remote-state check, or lease-loss stop; +2. the strategic profile-driven route currently fails closed before dispatch + on upstream executable sandbox/runtime/egress work in `GLAS-IN-0002`; +3. metrics and best-effort Hub reporting are not an atomic or reconciled part + of run acceptance; +4. FI/Binky-specific approaches remain inside the shared runtime despite the + `INTENT.md` prohibition on tenant logic; +5. the active production topology is a host user service while Kubernetes is + a sleeper placeholder, and optional cross-package contracts can skip in the + default development environment; and +6. credential and policy enforcement ownership is distributed across the + execution chain although `INTENT.md` describes this repo as the only holder + and enforcement point. + +Custodian message `c02a26b9-421c-4373-880a-3a17dd89db65` also requests the +missing authoritative `.repo-classification.yaml`. That concrete governance +gap is included in the baseline task rather than left as an untracked side +request. + +## Priority and sequencing + +- **Critical:** T02–T03 make repository mutation and accepted evidence safe. +- **Critical external gate:** T06 proves the current profiled path only after + `GLAS-IN-0002` supplies executable reachability/runtime/egress. +- **High:** T05 makes the deployed topology and contract test surface truthful + before another tenant or worker is added. +- **High:** T04 removes tenant coupling so reuse does not multiply code paths. +- **Enabling:** T01 fixes classification and records the responsibility model + that all implementation tasks must enforce. + +T02, T04, and T05 may proceed in parallel after T01. T03 follows T02. T06 is +the final integration gate and must not manufacture a host-side fallback while +waiting on the sandbox owner. + +## Establish the governance and enforcement baseline + +```task +id: REIN-A-0005-T01 +status: todo +priority: high +``` + +Review the Custodian classification canon and create the authoritative +`.repo-classification.yaml`, preserving repo identity separately from sector +metadata. Validate it with the fleet tool, commit it, and report the revision +to the Custodian owner request. + +In the same task, record an ADR or decision that distinguishes: + +- the strategic Activity Core → Glas → rein → sandbox route; +- the transitional profile-absent and issue-core compatibility routes; +- ownership of queue identity, actor identity, tool policy, filesystem and + network isolation, model routing, credential acquisition/injection/revocation, + repository acceptance, and durable evidence; and +- which failures must be terminal, retryable, or reconciled. + +Do not edit `INTENT.md` merely to match current shortcuts. Either demonstrate +how its “only credential holder / only policy enforcement point” language is +implemented by the governed chain, or amend it through the explicit decision +with sibling-owner acknowledgement. + +**Done when:** classification validation passes and the Custodian has the +revision; the responsibility matrix has named owners and evidence at every +boundary; direct/legacy paths have an explicit retirement or support posture; +and T02–T06 can cite stable decisions rather than infer ownership from code. + +## Make each repository run a lease-bound transaction + +```task +id: REIN-A-0005-T02 +status: wait +priority: high +``` + +Implement one repository transaction guard shared by direct `TaskSpec` runs +and every legacy approach that mutates a checkout. It must: + +- key a process-safe lock by canonical repository identity and store lock state + outside the target checkout; +- capture branch/detached state, `HEAD`, working-tree/index state, relevant + local remote-tracking refs, and the task/run correlation before mutation; +- refuse unattended production mutation on a dirty or ambiguous baseline, + while preserving all pre-existing operator changes; +- retain the Activity Core lease for the transaction and make heartbeat/lease + loss observable to the executor so work cannot silently finish under an + expired owner; and +- release the repository lock on success, refusal, timeout, signal, adapter + error, and result-close failure without deleting user data. + +Keep production concurrency at one until this guard is proven. Do not add +distributed concurrency merely because a local lock exists. + +**Done when:** tests cover concurrent claims for one checkout, distinct repos, +dirty baselines, detached or moved `HEAD`, heartbeat/lease loss, timeout, +signal cleanup, and close failure; a refused run changes neither repository nor +remote refs; and the result carries a bounded transaction identifier and +baseline evidence. + +## Verify accepted commits and reconcile metrics/reporting + +```task +id: REIN-A-0005-T03 +status: wait +priority: high +``` + +Replace the current `head_after != head_before` success test with explicit +repository acceptance under the T02 transaction. At minimum verify: + +- the accepted workload commit descends exactly from the recorded baseline + according to the declared one-commit or bounded-commit policy; +- changed paths conform to the task/profile grant and Git metadata, hooks, and + remote configuration were not altered; +- the resulting index and working tree match the declared postcondition; +- no local remote-tracking ref moved unexpectedly and any path that is allowed + to push has a separate explicit grant and evidence; and +- evidence identifies the accepted commit(s), changed paths, baseline, policy, + and validation outcome without retaining prompts or provider output. + +Decide and implement metrics atomicity: either include repo-owned kaizen +metrics in a declared harness-authored evidence commit or move them to an +external/durable channel with a defined projection back to the instance. A +successful run must not become dirty after commit verification. Add a bounded +outbox or reconciliation mechanism for required State Hub/Activity Core close +evidence; best-effort telemetry may remain non-blocking only when labelled as +such. + +**Done when:** adversarial tests reject unrelated commits, extra paths, dirty +post-state, metadata/config edits, and ungranted remote movement; success +leaves the checkout in its declared state; metrics and required completion +evidence survive a temporary Hub/API outage without duplicating the workload +commit; and docs no longer claim checks that the code does not perform. + +## Remove tenant logic from the shared runtime + +```task +id: REIN-A-0005-T04 +status: wait +priority: high +``` + +Inventory every profile-absent FI/Binky definition and its current owner, +schedule, input/output files, credential lane, completion event, commit/push +behavior, and rollback path. With Activity Core, kaizen-agentic, and tenant +owners, migrate the behavior into versioned profiles plus tenant-owned +blueprints/manifests or separately owned typed capabilities. + +Replace substring/label routing and tenant-specific code in the core worker +with a generic, versioned selector. Preserve coexistence only behind an +explicitly dated compatibility flag until each live definition has passing +replacement evidence. In particular, eliminate implicit default push behavior +from shared runtime code; publication must be a named, separately granted +capability. + +**Done when:** no new tenant requires editing `approaches.py`; every existing +FI/Binky definition has owner-approved replacement and rollback evidence; +production runs through generic selectors; tenant modules and hard-coded event, +path, and prompt conventions are removed or moved to their owning packages; +and the compatibility flag is disabled before deletion. + +## Align deployment, recovery, and conformance with the supported runtime + +```task +id: REIN-A-0005-T05 +status: wait +priority: high +``` + +Choose and document the supported production topology from T01. If the host +user service remains authoritative, label the Kubernetes sleeper as packaging +smoke or remove it from runtime claims. If Kubernetes becomes authoritative, +provide real workspace, credential, shutdown, lease, sandbox, and recovery +semantics before cutover. + +Make the selected deployment reproducible: + +- install pinned, non-accidental Glas/sand-boxer/llm-connect contracts rather + than relying on mutable sibling editable checkouts; +- preflight bubblewrap/AppArmor and the executable reachability contract when + the local profile is enabled; +- provide status and recovery checks for claim health, lease expiry, an + execution crash, an API-close outage, sandbox teardown, and outbox replay; +- run the real cross-package contract tests in CI without silently skipping + because optional runtime dependencies are absent; and +- define release/version compatibility for the instance manifest, Glas + contract, profile catalog, Activity Core schema, and deployment artifact. + +**Done when:** a clean host or chosen cluster target can reproduce the pinned +worker from documented inputs; readiness fails before claiming if a required +runtime boundary is unavailable; recovery drills leave no held repo lock, +claimed row, orphan sandbox, or lost required evidence; and CI/release gates +exercise the same contract versions as production. + +## Re-prove one governed profiled run and close residuals + +```task +id: REIN-A-0005-T06 +status: wait +priority: high +``` + +After T01–T05 and upstream `GLAS-IN-0002` are complete, coordinate one disabled, +bounded Activity Core definition against a disposable controlled repository. +The run must use an explicit versioned profile and attribution refs, cross the +declared sandbox execution boundary, dispatch the real rein/model route, and +produce only the granted commit/evidence. + +Capture non-secret evidence for claim/lease ownership, actor, profile, rein, +model, tool profile, sandbox, transaction baseline, accepted commit and changed +paths, metrics/reporting reconciliation, completion state, sandbox teardown, +source-checkout immutability, and absence of leftover lock/task/runtime files. +Exercise one fail-closed negative case under the same deployed artifact. Do not +reuse the withdrawn historical isolation implication from the 2026-07-26 +coarse proof. + +Before finishing the workplan, hand every actionable leftover to a live owner +record with `origin: residual` and `origin_ref: REIN-A-0005` (or to an already +live canonical record with an explicit acknowledgement). + +**Done when:** one current profiled run succeeds end to end, the negative case +fails before ungranted mutation, all cleanup and evidence checks pass, Activity +Core and Glas acknowledge the proof, documentation reflects the deployed +truth, and no residual exists only in prose. + +## Overall acceptance + +1. Every mutating run is repository-locked, lease-bound, baseline-aware, and + accepted against explicit commit/path/post-state rules. +2. Required completion and metric evidence is reconciled without dirtying the + checkout after acceptance or duplicating domain commits. +3. The strategic profile-driven path completes through its declared sandbox; + no host fallback is introduced. +4. Shared runtime dispatch is tenant-neutral and publication is an explicit + capability, not an implicit side effect. +5. Credential and enforcement ownership matches a recorded decision and the + repo has an authoritative validated classification. +6. Production deployment, recovery checks, CI, package versions, and docs all + describe and exercise the same supported topology.