rein-aharness/workplans/HARNESS-WP-0003-governed-runtime-integrity.md

id	type	title	domain	repo	status	owner	topic_slug	priority	created	updated	related	state_hub_workstream_id
HARNESS-WP-0003	workplan	Governed runtime integrity and intent convergence	infotech	rein-aharness	active	codex	rein-aharness	high	2026-08-23	2026-08-23	REIN-A-0004 GLAS-IN-0002 ACTIVITY-WP-0032 CUST-WP-0065	db086acf-e774-5a8b-8057-941dcbb12582

HARNESS-WP-0003 — Governed runtime integrity and intent convergence

Origin

The 2026-08-23 intent–scope assessment found that the deployed v0.1 worker is a useful sequential Activity Core consumer, but its strongest production claims exceed its current enforcement and evidence:

1. direct runs accept any HEAD change without a repository lock, clean-tree gate, changed-path validation, remote-state check, or lease-loss stop;
2. the strategic profile-driven route currently fails closed before dispatch on upstream executable sandbox/runtime/egress work in GLAS-IN-0002;
3. metrics and best-effort Hub reporting are not an atomic or reconciled part of run acceptance;
4. FI/Binky-specific approaches remain inside the shared runtime despite the INTENT.md prohibition on tenant logic;
5. the active production topology is a host user service while Kubernetes is a sleeper placeholder, and optional cross-package contracts can skip in the default development environment; and
6. credential and policy enforcement ownership is distributed across the execution chain although INTENT.md describes this repo as the only holder and enforcement point.

Custodian message c02a26b9-421c-4373-880a-3a17dd89db65 also requests the missing authoritative .repo-classification.yaml. That concrete governance gap is included in the baseline task rather than left as an untracked side request.

Priority and sequencing

• Critical: T02–T03 make repository mutation and accepted evidence safe.
• Critical external gate: T06 proves the current profiled path only after GLAS-IN-0002 supplies executable reachability/runtime/egress.
• High: T05 makes the deployed topology and contract test surface truthful before another tenant or worker is added.
• High: T04 removes tenant coupling so reuse does not multiply code paths.
• Enabling: T01 fixes classification and records the responsibility model that all implementation tasks must enforce.

T02, T04, and T05 may proceed in parallel after T01. T03 follows T02. T06 is the final integration gate and must not manufacture a host-side fallback while waiting on the sandbox owner.

Establish the governance and enforcement baseline

id: HARNESS-WP-0003-T01
status: progress
priority: high
state_hub_task_id: "e59d07c8-8976-520d-aee6-d0fe9ef7286b"

Review the Custodian classification canon and create the authoritative .repo-classification.yaml, preserving repo identity separately from sector metadata. Validate it with the fleet tool, commit it, and report the revision to the Custodian owner request.

In the same task, record an ADR or decision that distinguishes:

• the strategic Activity Core → Glas → rein → sandbox route;
• the transitional profile-absent and issue-core compatibility routes;
• ownership of queue identity, actor identity, tool policy, filesystem and network isolation, model routing, credential acquisition/injection/revocation, repository acceptance, and durable evidence; and
• which failures must be terminal, retryable, or reconciled.

Do not edit INTENT.md merely to match current shortcuts. Either demonstrate how its “only credential holder / only policy enforcement point” language is implemented by the governed chain, or amend it through the explicit decision with sibling-owner acknowledgement.

Done when: classification validation passes and the Custodian has the revision; the responsibility matrix has named owners and evidence at every boundary; direct/legacy paths have an explicit retirement or support posture; and T02–T06 can cite stable decisions rather than infer ownership from code.

Progress — 2026-08-23

• Published the canon-valid owner classification at revision 81f9279: tooling, primary sector agents, secondary infotech. Custodian report: message e92be7f9-f51d-4a40-9eec-adf2132d5c2d.
• Proposed docs/adr/ADR-002-governed-execution-responsibility-chain.md with explicit strategic/compatibility routes, responsibility/evidence matrix, and terminal/retry/reconciliation semantics. Pending decision: 4177b0b7-0b32-4f35-861b-28700531e58c.
• Requested explicit owner review from Activity Core (4b92da2c-9809-4bbe-be2e-4b1e53e13e13), Glas (4fe6a048-6ca8-4e52-bb22-e2a82725191c), sand-boxer (7fd35fd4-b0e1-42f0-bb56-a983a3e25c78), and llm-connect (c5d1dc62-3dca-4ac8-b3b5-d570d723ceda). T01 remains progress and downstream tasks remain wait until those reviews are reconciled.
• Glas approved the proposed boundary without edits in message 006fa46f-9419-4f61-90ff-0c3b6bc294c1. Activity Core, sand-boxer, and llm-connect acknowledgements remain pending.
• Activity Core review 428abb02-75dc-450d-a7f6-56fc715409ab confirmed the strategic route and no-fallback posture but correctly rejected an overstated queue-identity guarantee. ADR-002 now distinguishes the current shared caller token from the required principal-to-worker_id binding, requires Activity Core itself to reject heartbeat/close mutations at or after lease expiry, and excludes operator/SSO identity except through an audited break-glass contract. Published revision c230f33 (ADR SHA-256 a821b29e…de90b) and requested exact-revision acknowledgement from Activity Core (4d1f08fa-9857-438e-8629-758bf5420446), sand-boxer (acc210a2-dd9f-4705-bb4a-9e3ac4b0d142), llm-connect (39f69388-0249-4b66-9633-f37b1a0b386a), and Glas confirmation (704aa396-52b7-4c9f-80b7-6cf8a81ce0a1). Glas reconfirmed the exact revision and digest in 9638537b-e3c3-414d-a2d7-8beab61a4e1f; revised Activity Core, sand-boxer, and llm-connect acknowledgements remain pending.
• Activity Core message 900801f4-0641-4e87-90e6-0279b6c892a6 reports the requested boundary deployed under ACTIVITY-WP-0036 at revisions f0a897e and 3cd5250: the worker token is bound to configured rein-aharness@railiance01, mismatched body and operator/SSO identities are rejected, and heartbeat/complete/fail enforce row-locked active leases with equal-to-expiry treated as expired. Its 468-test suite and live spoof refusal passed. ADR-002 now records this as deployed current state; natural heartbeat/late-close production evidence remains pending for the next real claimed row rather than a manufactured run. Published revision 36e1096 (ADR SHA-256 84b47d2e…bb206f) and requested final exact-revision acknowledgement from Activity Core (532c4245-d3fe-408b-b21e-fd0300de5288), sand-boxer (1bf5768c-f77a-4f08-ae02-25caff9f0166), llm-connect (4bd35ce5-9c84-4695-83d5-c9bd16fa1b77), and Glas (52567711-1100-43c0-9f8e-40650738eb04).

Make each repository run a lease-bound transaction

id: HARNESS-WP-0003-T02
status: wait
priority: high
state_hub_task_id: "47816469-b5c0-5252-8b71-041e65d203fd"

Implement one repository transaction guard shared by direct TaskSpec runs and every legacy approach that mutates a checkout. It must:

• key a process-safe lock by canonical repository identity and store lock state outside the target checkout;
• capture branch/detached state, HEAD, working-tree/index state, relevant local remote-tracking refs, and the task/run correlation before mutation;
• refuse unattended production mutation on a dirty or ambiguous baseline, while preserving all pre-existing operator changes;
• retain the Activity Core lease for the transaction and make heartbeat/lease loss observable to the executor so work cannot silently finish under an expired owner; and
• release the repository lock on success, refusal, timeout, signal, adapter error, and result-close failure without deleting user data.

Keep production concurrency at one until this guard is proven. Do not add distributed concurrency merely because a local lock exists.

Done when: tests cover concurrent claims for one checkout, distinct repos, dirty baselines, detached or moved HEAD, heartbeat/lease loss, timeout, signal cleanup, and close failure; a refused run changes neither repository nor remote refs; and the result carries a bounded transaction identifier and baseline evidence.

Preparation — 2026-08-23

Added the production-inert core transaction primitive in rein_aharness/repository_transaction.py. It keys a private external flock by the resolved Git common directory, captures branch/detached HEAD, clean or dirty index/worktree digests, upstream and remote-tracking refs, and exposes a bounded transaction/baseline evidence envelope. Ten focused tests cover cross-process same-repo contention, path aliases, distinct repos, dirty/staged/ untracked baselines, detached HEAD, private lock metadata, exception cleanup, and non-repository refusal.

The primitive is intentionally not wired into runner.py, legacy approaches, or the claim loop while ADR-002 still awaits Activity Core, sand-boxer, and llm-connect acknowledgements. Controlled moved-HEAD acceptance is prepared under T03 below; lease-loss cancellation, timeout/signal integration, and result-close reconciliation remain outstanding. T02 therefore remains wait.

Verify accepted commits and reconcile metrics/reporting

id: HARNESS-WP-0003-T03
status: wait
priority: high
state_hub_task_id: "bb3ecdc7-7a32-5a9c-999c-857cd484738b"

Replace the current head_after != head_before success test with explicit repository acceptance under the T02 transaction. At minimum verify:

• the accepted workload commit descends exactly from the recorded baseline according to the declared one-commit or bounded-commit policy;
• changed paths conform to the task/profile grant and Git metadata, hooks, and remote configuration were not altered;
• the resulting index and working tree match the declared postcondition;
• no local remote-tracking ref moved unexpectedly and any path that is allowed to push has a separate explicit grant and evidence; and
• evidence identifies the accepted commit(s), changed paths, baseline, policy, and validation outcome without retaining prompts or provider output.

Decide and implement metrics atomicity: either include repo-owned kaizen metrics in a declared harness-authored evidence commit or move them to an external/durable channel with a defined projection back to the instance. A successful run must not become dirty after commit verification. Add a bounded outbox or reconciliation mechanism for required State Hub/Activity Core close evidence; best-effort telemetry may remain non-blocking only when labelled as such.

Done when: adversarial tests reject unrelated commits, extra paths, dirty post-state, metadata/config edits, and ungranted remote movement; success leaves the checkout in its declared state; metrics and required completion evidence survive a temporary Hub/API outage without duplicating the workload commit; and docs no longer claim checks that the code does not perform.

Preparation — 2026-08-23

Extended the production-inert transaction core with an explicit RepositoryAcceptancePolicy and read-only post-run validator. It now requires same-branch descendant commits within declared bounds, repository-relative path patterns, a clean index/worktree, unchanged local remote-tracking refs, and an unchanged digest of protected Git config, hooks, and info metadata. Accepted evidence contains bounded commit/path lists plus policy, path-set, baseline, and post-state digests; it retains no prompt or provider output.

Sixteen additional adversarial cases bring the focused transaction suite to 26 tests. They cover a valid one-commit result, unrelated history, excess commits, ungranted paths, glob boundary semantics, dirty post-state, branch movement, unchanged HEAD, remote-ref movement, Git config/hook changes, and bounded path evidence. The full suite passes 123 tests with the existing optional glas_harness contract skip.

No current Activity Core/profile field supplies an authoritative path grant, so the validator remains deliberately unwired. Metrics atomicity and required close-evidence reconciliation also remain outstanding; T03 remains wait.

Repository grant preparation — 2026-08-23

Added a parsed, versioned repository_grant v1 contract for TaskSpec inputs. It requires explicit repository-relative path patterns, bounded positive commit counts, publish: false, exact fields, and version "1"; it rejects unknown fields, ambiguous types, duplicates, traversal/.git paths, and publication. The canonical grant exposes a stable id and bounded path/policy digests and translates directly to RepositoryAcceptancePolicy.

This is fail-closed preparation, not production enablement. A supplied grant causes run_task to refuse before profile resolution or adapter dispatch, and the Activity Core/issue-core adapters do not synthesize it from labels, prose, execution_refs, or repo lookup. Existing grant-absent compatibility behavior is unchanged. docs/repository-grant.md records the contract and the remaining activation gates: authoritative upstream carriage, lease-bound transaction wiring, accepted-result validation, and durable close evidence. Thirty-three focused cases cover canonical identity/evidence, validator translation, schema/type/path/commit/publication refusal, typed task-file parsing, and proof that the runner neither dispatches an adapter nor mutates the checkout. Published at revision 8cb004a with 156 passing tests and requested authoritative-carriage review from Activity Core (28868534-031f-421d-a34a-a92b8429391d) and profile-boundary review from Glas (e149c359-36bf-4867-ac10-f58a8f248666). No execution enablement was requested.

Close-evidence outbox preparation — 2026-08-23

Added a production-inert CloseOutbox core for Activity Core completion and failure intents. It stores private mode-0600 JSON outside target checkouts, keys entries by bounded run/transaction identity, uses a process-safe lock and file/directory fsync around atomic replacement, suppresses identical pending or delivered entries, and rejects conflicting identity reuse. Result evidence is normalized and bounded by type, depth, collection/string/integer limits, and a 64-KiB encoded ceiling.

Replay durably increments the attempt before calling a close-only callback, moves success to delivered state, retains ordinary API failure with a bounded error, and leaves process interrupts pending. Corrupt, oversized, or directory/state-mismatched material is preserved with a reason in quarantine and never delivered. Twenty-five focused cases cover private/atomic storage, duplicate/conflict behavior, successful and failed replay, callback mutation, interrupt persistence, corruption, atomic-write failure, two-process enqueue, replay limits, and payload bounds.

docs/close-evidence-outbox.md records the storage/replay contract and the network-ambiguity residual: a close request may be repeated after a timeout, but replay never calls workload code and therefore cannot duplicate the repository commit. The live claim loop remains unchanged pending transaction wiring, Activity Core repeat-close review, and operator status/replay controls.

Remove tenant logic from the shared runtime

id: HARNESS-WP-0003-T04
status: wait
priority: high
state_hub_task_id: "2eea6721-9379-5904-bf8f-4e794272d74a"

Inventory every profile-absent FI/Binky definition and its current owner, schedule, input/output files, credential lane, completion event, commit/push behavior, and rollback path. With Activity Core, kaizen-agentic, and tenant owners, migrate the behavior into versioned profiles plus tenant-owned blueprints/manifests or separately owned typed capabilities.

Replace substring/label routing and tenant-specific code in the core worker with a generic, versioned selector. Preserve coexistence only behind an explicitly dated compatibility flag until each live definition has passing replacement evidence. In particular, eliminate implicit default push behavior from shared runtime code; publication must be a named, separately granted capability.

Done when: no new tenant requires editing approaches.py; every existing FI/Binky definition has owner-approved replacement and rollback evidence; production runs through generic selectors; tenant modules and hard-coded event, path, and prompt conventions are removed or moved to their owning packages; and the compatibility flag is disabled before deletion.

Preparation — 2026-08-23

docs/legacy-runtime-inventory.md records the four profile-absent scheduled definitions and the direct/issue-core compatibility surfaces from current code and owner files. It identifies inputs, outputs, credentials, completion events, commit/push behavior, retry posture, rollback material, and migration gates. This is read-only preparation; T04 remains wait until T01 accepts ADR-002.

Align deployment, recovery, and conformance with the supported runtime

id: HARNESS-WP-0003-T05
status: wait
priority: high
state_hub_task_id: "4e885492-abf9-586b-a049-d8ddb844ecfc"

Choose and document the supported production topology from T01. If the host user service remains authoritative, label the Kubernetes sleeper as packaging smoke or remove it from runtime claims. If Kubernetes becomes authoritative, provide real workspace, credential, shutdown, lease, sandbox, and recovery semantics before cutover.

Make the selected deployment reproducible:

• install pinned, non-accidental Glas/sand-boxer/llm-connect contracts rather than relying on mutable sibling editable checkouts;
• preflight bubblewrap/AppArmor and the executable reachability contract when the local profile is enabled;
• provide status and recovery checks for claim health, lease expiry, an execution crash, an API-close outage, sandbox teardown, and outbox replay;
• run the real cross-package contract tests in CI without silently skipping because optional runtime dependencies are absent; and
• define release/version compatibility for the instance manifest, Glas contract, profile catalog, Activity Core schema, and deployment artifact.

Done when: a clean host or chosen cluster target can reproduce the pinned worker from documented inputs; readiness fails before claiming if a required runtime boundary is unavailable; recovery drills leave no held repo lock, claimed row, orphan sandbox, or lost required evidence; and CI/release gates exercise the same contract versions as production.

Re-prove one governed profiled run and close residuals

id: HARNESS-WP-0003-T06
status: wait
priority: high
state_hub_task_id: "0ee6c263-6399-521a-b687-c40b5ee80a26"

After T01–T05 and upstream GLAS-IN-0002 are complete, coordinate one disabled, bounded Activity Core definition against a disposable controlled repository. The run must use an explicit versioned profile and attribution refs, cross the declared sandbox execution boundary, dispatch the real rein/model route, and produce only the granted commit/evidence.

Capture non-secret evidence for claim/lease ownership, actor, profile, rein, model, tool profile, sandbox, transaction baseline, accepted commit and changed paths, metrics/reporting reconciliation, completion state, sandbox teardown, source-checkout immutability, and absence of leftover lock/task/runtime files. Exercise one fail-closed negative case under the same deployed artifact. Do not reuse the withdrawn historical isolation implication from the 2026-07-26 coarse proof.

Before finishing the workplan, hand every actionable leftover to a live owner record with origin: residual and origin_ref: HARNESS-WP-0003 (or to an already live canonical record with an explicit acknowledgement).

Done when: one current profiled run succeeds end to end, the negative case fails before ungranted mutation, all cleanup and evidence checks pass, Activity Core and Glas acknowledge the proof, documentation reflects the deployed truth, and no residual exists only in prose.

Overall acceptance

1. Every mutating run is repository-locked, lease-bound, baseline-aware, and accepted against explicit commit/path/post-state rules.
2. Required completion and metric evidence is reconciled without dirtying the checkout after acceptance or duplicating domain commits.
3. The strategic profile-driven path completes through its declared sandbox; no host fallback is introduced.
4. Shared runtime dispatch is tenant-neutral and publication is an explicit capability, not an implicit side effect.
5. Credential and enforcement ownership matches a recorded decision and the repo has an authoritative validated classification.
6. Production deployment, recovery checks, CI, package versions, and docs all describe and exercise the same supported topology.