sand-boxer/docs/integrations/glas-harness.md

glas-harness integration

glas-harness owns the agent gateway, tools, memory, and channels. sand-boxer delivers an isolated execution environment; the harness executes tools inside it.

Example request

sandboxer create \
  --profile profile.agent-dev \
  --input repo=/path/to/workspace \
  --actor agt \
  --project glas-harness \
  --session-id session-123 \
  --run-id run-456

Response fields (ready state)

Field	Owner	Description
sandbox_id	sand-boxer	Stable instance identifier
reachability.ssh	sand-boxer	SSH target for harness exec channel
reachability.remote_dir	sand-boxer	Workspace root on remote host
state	sand-boxer	Lifecycle state (ready, etc.)

Two execution modes

Not every sandbox has an SSH hop. ext.compose-ssh / ext.vm-packer always run remote and populate reachability.ssh + reachability. remote_dir; glas-harness execs tools over that SSH channel. ext.bwrap (SAND-WP-0013) runs same-host and never populates reachability.ssh — instead it populates reachability.pid (the placeholder process holding the bwrap namespaces) and reachability.workspace_dir as evidence. These fields are not a consumer attach contract. build_reachability_report() returns execution.mode: owner-mediated; glas-harness sends an exec request to the resident sand-boxer owner service. Direct nsenter is unsupported.

The request repeats the exact actor/project/session/run identity used at create, carries an argument vector (never a shell command string), and may carry only value-free credential catalog route references. sand-boxer refuses identity mismatch, non-ready or expired state, concurrent execution, and every extension without an owner execution implementation. It never retries against the host source checkout.

For the local owner transport, retain these values from gateway resolution:

sand-boxer field	Glas source
consumer.actor	ExecutionRequest.actor
consumer.project	ExecutionRequest.project
consumer.run_id	resolved request_id
credential_route_refs	exact selected HarnessProfile.credential_route_refs
timeout_seconds	selected profile limit

Use bounded stdin_text with an in-sandbox writer command to create the private task file under .git; sand-boxer does not echo stdin in the result or lifecycle evidence. Local transport must not write the task file through host Path APIs.

Ownership

Concern	Owner
Sandbox provision / teardown	sand-boxer
In-namespace command broker, workspace cwd, timeout/output bounds	sand-boxer
Tool call parsing and policies	glas-harness
SSH / tunnel reachability setup	glas-harness + ops-bridge
Agent memory and session state	glas-harness

Smoke test

# Requires sandboxer CLI and SANDBOXER_HOST (or profile placement fallback)
SANDBOXER_HOST=coulombcore ./scripts/smoke-agent-dev.sh

Creates profile.agent-dev, prints reachability (tunnel metadata + SSH one-liner), then destroys.

Out of scope for sand-boxer

• Tool schemas and approval flows
• Channel bridges (Slack, email, etc.)
• Subagent orchestration
• Provider credential acquisition or injection (the selected rein owns it)