Package pinned native Claude and prove isolated startup

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/bwrap-runtime.md

@@ -58,9 +58,9 @@ It imports the rein's Claude adapter and llm-connect, runs `rein-aharness
 worktree, verifies source absence and a clean Git tree, checks loopback-only
 networking, and tears down. This is real CLI startup, not a model task.
 
-The Python bundle does not package or pin the separate Claude executable.
-That executable's release, startup behavior, and authentication still require
-review in the eventual production runtime. No committed profile selects a
+The default Python-only build does not package Claude. The optional explicit
+Claude pin and isolated startup proof are documented in the later candidate
+section below; production authentication remains a separate gate. No committed profile selects a
 temporary `/tmp` build as its production runtime.
 
 ## Private writable state
@@ -157,3 +157,40 @@ of CCR-2026-0016), owner machine authentication, the pinned Claude executable
 with its own HTTPS_PROXY startup proof, and the real-model acceptance run.
 Provider workspace scope and spend limit remain operator inputs; a model
 `budget_tokens` setting is not a provider spend limit.
+
+
+## Pinned Claude candidate and isolated startup — 2026-09-06
+
+The builder now accepts `--claude-binary`, `--claude-sha256` and
+`--claude-version` together. It requires a regular native ELF file, verifies the
+exact copied bytes, refuses symlinks/wrappers/mismatches and existing destination
+files, and copies only the executable as bin/claude mode 0755. The expected
+version is metadata until the sandbox smoke checks the actual output. No
+interactive HOME, provider key or login state is copied.
+
+Candidate provenance: the explicitly selected installed native release
+`/home/worsch/.local/share/claude/versions/2.1.263`, SHA-256
+`26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba`.
+This is a digest pin of the selected local artifact, not an upstream signature
+verification claim. Complete runtime candidate:
+`/tmp/sandboxer-claude-runtime-20260906`, SHA-256
+`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`.
+Mount remains `/opt/sandboxer/runtime`; Claude is `/opt/sandboxer/runtime/bin/claude`.
+Rein sources remain 1429db5 / llm-connect 0056094; resolved dependency versions
+are recorded in the evidence. Rebuilding may resolve different dependencies;
+the complete digest pins this artifact, not future builds.
+
+Sandbox f8821ec2 ran real `claude --version` -> `2.1.263 (Claude Code)` plus rein
+CLI/import checks, with owner allowlisted provider egress and HTTPS_PROXY set
+by the broker. Runtime read-only, private 0700 HOME/state persistence, clean Git,
+absent source and loopback-only interfaces passed; workspace and proxy removed.
+`make check`: lint passed, 175 tests passed.
+
+Evidence: docs/evidence/SAND-WP-0015-claude-startup-2026-09-06.json.
+Reproduce with the builder options above and `scripts/smoke-bwrap-runtime.py
+--runtime-path <candidate> --runtime-sha256 <digest> --claude-version 2.1.263`.
+
+Limits: `--version` proves startup with the proxy environment, not that Claude
+has sent a provider request through it. No credential acquisition or model run.
+The /tmp candidate is not production placement; protected artifact installation,
+owner configuration, credential adoption and real-model proof remain T04 gates.

docs/evidence/SAND-WP-0015-claude-startup-2026-09-06.json

@@ -0,0 +1,94 @@
+{
+  "build": {
+    "runtime": {
+      "path": "/tmp/sandboxer-claude-runtime-20260906",
+      "sha256": "5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922"
+    },
+    "build": {
+      "python": "3.12.3",
+      "packages": {
+        "idna": "3.19",
+        "h11": "0.16.0",
+        "httpcore": "1.0.9",
+        "llm-connect": "0.1.0",
+        "certifi": "2026.7.22",
+        "PyYAML": "6.0.3",
+        "toml": "0.10.2",
+        "typing_extensions": "4.16.0",
+        "httpx": "0.28.1",
+        "rein-aharness": "0.1.0",
+        "anyio": "4.15.1"
+      },
+      "claude": {
+        "path": "/opt/sandboxer/runtime/bin/claude",
+        "sha256": "26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba",
+        "expected_version": "2.1.263",
+        "source": "/home/worsch/.local/share/claude/versions/2.1.263"
+      },
+      "source_revisions": {
+        "rein-aharness": "1429db5ad4c83331b6375349ffde1eb13af9575b",
+        "llm-connect": "00560945f81ba6ff1f5cacd9fe99c7fe756cc4b1"
+      }
+    }
+  },
+  "smoke": {
+    "ok": true,
+    "sandbox_id": "f8821ec2",
+    "runtime_sha256": "5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922",
+    "proof": {
+      "rein_cli_started": true,
+      "adapter_imported": true,
+      "runtime_readonly": true,
+      "source_absent": true,
+      "home_outside_workspace": true,
+      "home_mode": "0700",
+      "worktree_clean": true,
+      "interfaces": [
+        "lo"
+      ],
+      "python_prefix": "/opt/sandboxer/runtime",
+      "claude_version": "2.1.263 (Claude Code)",
+      "https_proxy_present": true,
+      "claude_provider_request_proven": false,
+      "credential_refs": []
+    },
+    "workspace_removed": true,
+    "exit_code": 0,
+    "model_run_proven": false,
+    "private_state_persisted": true,
+    "proxy_removed": true
+  },
+  "verification": {
+    "lint": "passed",
+    "tests_passed": 175
+  },
+  "production_deployed": false,
+  "provenance": "Explicitly selected installed native executable; no interactive HOME copied.",
+  "absolute_path_smoke": {
+    "ok": true,
+    "sandbox_id": "979c0208",
+    "runtime_sha256": "5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922",
+    "proof": {
+      "rein_cli_started": true,
+      "adapter_imported": true,
+      "runtime_readonly": true,
+      "source_absent": true,
+      "home_outside_workspace": true,
+      "home_mode": "0700",
+      "worktree_clean": true,
+      "interfaces": [
+        "lo"
+      ],
+      "python_prefix": "/opt/sandboxer/runtime",
+      "claude_version": "2.1.263 (Claude Code)",
+      "https_proxy_present": true,
+      "claude_provider_request_proven": false,
+      "credential_refs": []
+    },
+    "workspace_removed": true,
+    "exit_code": 0,
+    "model_run_proven": false,
+    "private_state_persisted": true,
+    "proxy_removed": true
+  }
+}