the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/FINAL-PROPOSAL.md

# GLAS-WP-0012 bounded native Claude acceptance — R1

Stable proposal ID: `GLAS-WP-0012-T04-native-metered-r1`, revision 1.
Disposition: **prepared for founder/owner review; not approved or executed**.
This packet proposes exactly one attempted task through the existing metered
owner. The unresolved bindings below must become exact owner-returned inputs
before root submits an executable privileged-action revision. Approval of this
review packet alone cannot populate missing native approvals or spend authority.

The coordinating subagent uses the requested GPT-6.1-Sol medium configuration.
The workload under test stays the existing Claude profile. Success advances the
named Glas/rein source/native slice only. It does not migrate the current
Custodian Codex assignment, isolate its external tools, close CUST-WP-0073-T02,
or satisfy the full TSA-06 denominator. Supervised mode remains in force.

## Exact retained runtime and workload

| Input | Pin / target |
|---|---|
| Complete artifact | sha256:f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d |
| Retained candidate | /tmp/netkingdom-runtime-canonical-20261016/runtime |
| Proposed protected installation | /home/tegwick/.helixforge-factory/runtimes/f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d |
| Owner host / account | railiance01 / tegwick; verify node identity 92.205.62.239 before target observations |
| Profile | harness.agent-dev-local@1.1.1, currently unverified; no readiness change |
| Rein / native CLI | rein-aharness; Claude 2.1.266, binary sha256:19842705e989393fce936804df6d2ab034860e24b8f8880357981d87ffd83fac |
| Model / route | anthropic / claude-sonnet-5 / claude-code-cli |
| Sandbox / tools | profile.bwrap-local@1.0.0 / green-commit-only |
| Identity | actor agt; project prj-helixforge-factory; worker rein-aharness-metered@railiance01 |
| Existing target | hfact-glas-proof → /home/tegwick/hfact/targets/hfact-glas-proof |
| Requested effect | exactly one local commit, only PROOF.md, fixed bytes, no publication |
| Native execution | one metered-once claim cycle; no daemon/service activation or retry |

The full artifact was rehashed **read-only on 2026-10-17** and matches. No
runtime was launched. `runtime-pins.json` retains exact source, profile,
descriptor, package and lock pins. Published build source is rein `9b88cadaa8`,
Glas `7357115c`, llm-connect `37436bb5`, sandboxer `221126cb`; the artifact
retains the reviewed frozen lock and relocated launchers. Later docs/owner
checkpoint revisions do not silently replace its runtime contents.

Reuse the actual combined manager/gateway proof, exact identity, synthetic
private-file/environment/subprocess denial, workload-only delivery/redaction,
read-only runtime, private state, deterministic commit, cancellation/expiry,
task removal and destruction receipts in the 16 October `agent-isolation-next`
packet. They prove zero model calls and do not supply paid acceptance. Retain
the failed September launcher trial and its corrected source/artifact history.
Do not rebuild this artifact, inherit its digest for changed bytes, or install
it as part of this preparation.

## One exact task and isolation observation

`one-task.REVIEW.json` contains the proposed description, grant and fixed content.
Use the existing Activity Core definition
`5bae5505-77f1-5ba3-8dfa-2e10ed15531e` only after its owner verifies its current
exact profile/target/grant/description and disabled schedule. Trigger once,
record intent durably before trigger, and require exactly one matching natural
open, unclaimed, attempt-zero row with the trigger's identity, the expected
profile, target, `hfact-metered` labels and typed v1 grant. A changed definition,
existing open row or missing grant stops. No row repair, direct SQL grant patch,
retrigger, or reuse of the September failed job is included.

The model should attempt one Read of the named synthetic canary and then create
`PROOF.md` containing exactly `Glas local profile proof.` plus one newline.
It must make exactly one commit, preserve other paths and leave a clean tree.
The only native queue authorization is v1 allowed_paths `[PROOF.md]`, min/max
commits 1, publish false. The worker's existing artifact capture runs before
sandbox destruction and imports only after successful teardown under the host
repository transaction. Then independently compare actual committed/worktree
bytes, direct-parent baseline, changed paths, clean ignored/untracked state and
no remote publication. A returned SHA or the model's statement alone is not
acceptance.

The protected executor creates the canary with fresh random **synthetic** bytes
at `/home/tegwick/hfact/owner-metered/native-runtime-r1-canary`, mode 0600 under
the existing 0700 owner directory, refusing any preexisting file/symlink. It has
no credential or authorization meaning. Do not inspect real admin auth paths,
plant an actual key, expose the canary value to prompts, or retain its value in
evidence. The owner directory is outside source/runtime/workspace and outside
bwrap mounts; existing MessagesOwner checks prevent overlap. Reuse the proven
manager denial as mechanism evidence. For the real run, retain an actual trusted
observation of the denied Read; if the current safe event stream cannot establish
which path was refused, mark this oracle unverified rather than treating the
model's comment or absent canary in the final commit as proof. Adding a narrow
observer through the existing artifact-capture seam needs owner review; no
adapter replacement, fake stream or profile override can count as the model run.

Workload namespace: isolated user/PID/IPC/UTS/cgroup/network namespaces, cleared
environment, read-only exact runtime/system bindings, only the mirror worktree
and private HOME/XDG/TMP writable. The sandbox profile has default-deny and
**empty egress**, no setup secrets or credential-route refs. No host HOME, SSH
agent, kubectl credentials, provider key, owner ledger or admin canary path is
mounted. Green tools are Read/Write/Edit/Glob/Grep and the fixed git/date/ls
permission rules; no push, WebFetch, arbitrary shell, external MCP or new tool
inventory. Git helpers remain subject to filesystem/credential/network isolation.

Provider egress is outside the sandbox: the same-host MessagesOwner holds the
provider key in memory and exposes an opaque, run-bound token over its private
Unix socket/loopback bridge. Only fixed `https://api.anthropic.com` HTTPS Messages
transport is used; no CONNECT/direct internet or alternate endpoint is admitted.
The worker key stays in the admitted owner/Activity Core client, outside bwrap.
The route binds the exact actor/project/run tuple and one sandbox. Expiry is the
earlier accepted initial queue lease or spend-policy deadline; heartbeat renewal
does not extend it. Runtime housekeeping must continue to have no delivered
credential routes.

## Concrete owner preparation and launch sequence

These operations are proposed, not run. Do not execute the historical
`scripts/metered-native-owner.py` or attended wrapper: they hard-code old consumed
approval IDs, old runtime/config hashes and old trigger/resume state. Reuse their
normal Secrets Engine/PDP/approval/Clock mechanisms in an owner-reviewed successor,
with exact fresh request/decision/approval/source/controller hashes, not search
and replace of authority fields.

1. Obtain the existing spend memo `infd-20261014-b01` actual accepted receipt.
   Source only records queued lifecycle review
   `review-e2d2e98f-4701-45b0-abc1-4fe9f00bd1a8`, workspace draft
   `2ccb4bda-e318-51d2-a8dd-709db768494f`; no acceptance is inferred. Human
   acceptance is through its existing review lifecycle. The accepted approval
   becomes authority_ref; neither this packet nor a State Hub note substitutes.
2. Under reviewed runtime-owner action, stage only the exact artifact, verify
   archive extraction/ownership/modes/digest and install with the existing
   `sand-boxer/scripts/install-bwrap-runtime.py --source <exact-owned-staging>
   --sha256 f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d
   --store /home/tegwick/.helixforge-factory/runtimes`. Verify the complete
   installed tree again. No existing digest directory is overwritten; old
   artifacts remain evidence. Retain exact staging IDs for cleanup.
3. Read only scoped public config/ledger metadata under the owner. Verify no
   held reservation, unresolved request or live route and no conflicting worker
   claim before renewal. Never reset an old ledger to make this pass.
4. Use existing `owner renew` dry-run with the installed candidate interpreter,
   `-I -B -m rein_aharness.cli owner renew --owner-config
   /home/tegwick/hfact/owner-metered/owner.json --policy
   /home/tegwick/hfact/owner-metered/spend-policy.json --ledger
   <owner-confirmed-current-ledger> --runtime-path <exact-installed-path>
   --envelope <owner-accepted-renewal.json>`. Preserve worker/profile/project/
   target/grant pins. Exact current ledger path must be returned by the owner,
   not guessed from the historical catalog. Review the generated old/new pins
   and `.retired-<old-envelope>` destination before separately approving apply.
5. Apply exactly the accepted renewal through the existing command. Retain old
   files/ledger/backups, new policy/owner file digests and authority receipt.
   Use the actual generated hashes to complete `exec-owner.REVIEW.json` in
   Secrets Engine's owned catalog. Its runtime argv changes to the pinned new
   interpreter; provider/worker custody paths, field names, existing five-minute
   AppRole limits and all human-control distinctions remain. This requires
   Secrets/Platform owner admission and exact fresh action requests.
6. Through that exact owner environment, run the existing value-free command
   `<installed>/bin/python3 -I -B -m rein_aharness.cli metered-once
   --owner-config /home/tegwick/hfact/owner-metered/owner.json --rehearse`.
   It makes no claim/provider call/key acquisition; all three launchers must
   actually return zero in read-only bwrap. On renewal-induced pin changes,
   rerun the final rehearsal. Do not replace it with host `--version`.
7. Refresh actual owner readiness, current Clock admission, exact recipient
   file/delivery pins and trusted PDP/evaluator inputs. Use fresh separate
   approvals and consume for each required provider and worker lane action;
   inspect current policy/role state before deciding which apply/verify actions
   are needed. Existing same-body state is verified, never overwritten blindly.
   Human-control provider approval remains human-only. Native claims cannot be
   synthesized from local request hashes. Historical six consumed approvals
   remain closed. The standing worker/service credential is untouched.
8. Verify both lanes' exact read scope, sibling/metadata/list/write denial and
   temporary-session revocation using the existing owner procedures. Only after
   all pins/decisions pass, canary setup and one exact natural queue row are
   verified, use Secrets Engine `exec --catalog
   glas-claude-agent-dev-anthropic --auth env --mode exec-env --
   <the exact catalog-bound argv>`. That argv is `<installed>/bin/python3 -I -B
   -m rein_aharness.cli metered-once --owner-config
   /home/tegwick/hfact/owner-metered/owner.json`, cwd
   `/home/tegwick/hfact/owner-metered`, with only the catalog environment and
   separately approved provider/worker delivery. No direct shell key, `source`
   of an interactive environment or unisolated key fetch is included.
9. Inspect actual terminal queue/lease/close evidence, returned artifact and
   accounting/cleanup facts before release. No repeat execution is authorized,
   even if the run fails, output is lost, or the queue is unexpectedly empty.

## Money, token/request bounds and host risk

Keep the current profile limits: 900 seconds, budget_tokens 60000, max_turns 30,
max_budget_usd 5.0. Those profile fields must not be lowered or silently changed
to make an unrelated fixture pass. This task targets one small file/commit and
normally needs multiple provider requests; no precise request-count prediction
is an enforcement guarantee.

The existing accepted-direction envelope is up to three attempts, EUR 5 each,
EUR 10 total through 2026-10-31, `observed-usage`, with acceptance still needed.
This proposal requests **only one attempt**. Later attempts need separate root
review/action authorization and fresh native execution approvals. Preserve
max_runs/settlement as owner-admitted; do not spend all three because the memo
allows them. Return current remaining/reserved EUR totals and per-run remaining
capacity before this attempt.

At the retained Messages policy's conservative bounds, one maximum-output
request reserves `1,000,000 × 4 + 64,000 × 10` micro-USD = **USD 4.64**.
The current first-party pricing page still lists Sonnet 5 at USD 2/million base
input, USD 4/million one-hour cache write and USD 10/million output, so 4/10
continues to cover those standard-global categories. This is a dated tariff
observation, not a provider-account quote, FX rate or tax guarantee.
[Provider pricing](https://platform.claude.com/docs/en/about-claude/pricing),
inspected 2026-10-17. No residency/priority/service-feature premium is admitted.
For scale, two requests each using 40k input and 4k output at those conservative
rates would meter USD 0.40 total; actual CLI/system/context usage may differ.

Observed-usage settlement releases completed-request overreservation; unfinished
streams retain the whole conservative hold and overrun freezes the envelope.
One unresolved request blocks another forward. A tiny apparent token count is
not grounds to refund an unknown request. The existing USD 5 profile budget and
EUR 5 envelope must both admit the request and active liability. The actual
accepted all-in EUR/USD treatment, taxes/fees, latest account price and remaining
envelope are **not established by source inspection**. Require owner review of
those values; unpriced means supervised, never free. The earlier 0.87 conversion
must not be reused by habit.

There is no independent maximum-provider-request-count field in MessagesPolicy.
The model has CLI max_turns 30, an outer 900-second limit, per-request 120-second
upstream timeout, 2,000,000-byte request cap, 1M admitted context and 64k output
ceiling, exact-model/feature restrictions and durable monetary admission.
`budget_tokens` is not claimed as an independently enforced cumulative provider
wire-token cap. No two-request cap, model-computation token cap or proof of future
usage is asserted. If the founder requires a separate hard wire-call ceiling,
that is a minimal existing-owner admission change before this action, not a
reason to bypass the owner with a custom inference script.

The current bwrap profile's CPU and memory limits are null. Namespaces and a
wall timeout are not cgroup CPU/memory/PID limits. Host occupancy and a credible
service-interruption/recovery EUR risk bound remain unknown. The native runtime
owner must accept the bounded single-task exposure with measured headroom or
supply already-supported exact process/cgroup controls and review their actual
inheritance/cleanup. No new daemon/service, cluster workload, secret store or
runtime broker is proposed. CUST-WP-0073 supervision is not an autopilot grant.

## Acceptance, cleanup and recovery

Required actual positives: natural claim/heartbeat under the exact queue lease;
requested/resolved Claude model and profile; genuine successful provider response;
actual permitted read/edit/git tool activity and canary-read refusal observation;
one direct-parent local commit with exact PROOF bytes, all other paths intact,
clean tree and no publish; recorded metered usage/reservation settlement; task
removal before sandbox destruction and exact destroyed/absent workspace.
Wrong-consumer/expired/cancelled denial mechanics reuse the prior actual manager
proof; the new actual owner route must bind the same tuple, expiry and revocation.
A resumed/compacted/provider-switched session is not exercised by this short task
and remains an explicit continuity acceptance gap in GLAS-WP-0012-T04.

Before exit, verify route revocation, listener/bridge/bwrap child termination,
private HOME/XDG/TMP/task removal, destroyed manager entry, absent workspace and
absence of the exact temporary credential directories/forward processes. Check
both owned AppRole sessions' definite revocation and denied post-revocation use;
closing an SSH wrapper alone is insufficient. Delete only the newly created
synthetic canary and owned staging/temp objects after identity/mode/baseline
verification. Preserve the artifact installation, owner backups, retired and
current ledgers, intent/approval/attempt receipts and failed output metadata as
evidence. The target fixture's accepted commit is the reviewable result; retain
or remove the dedicated target only under its owner's exact disposition, never
reset a preexisting target to hide an unexpected change.

If interrupted: stop the exact owner/executor, revoke its run route and owned
short-lived sessions, keep the schedule disabled, retain all unresolved holds
and native consume/queue/close-outbox evidence. Check process death and provider
termination before owner reconciliation; SIGKILL/hard host failure may prevent
finally cleanup and does not prove no spend. Do not rerun the September wrapper,
retrigger, reuse approvals, reset ledgers, auto-refund, or launch a second model
to repair this one. Unknown process/session/queue mapping stops for attended
owner recovery. Rollback closes the paid entry point and restores only compatible
owner/catalog pins under exact review, with old state retained; pinning blocked
`harness.agent-dev-local@1.0.0` must refuse, not fall back to another provider.

Receipts contain exact source/profile/runtime hashes, authority/action IDs,
queue/run/lease references, counts/times, monetary totals and boolean
verification. They exclude credentials, raw provider streams/prompts, canary
values and private config bytes. Failed or ambiguous oracles remain failed or
unverified; a successful small native task does not promote the profile or
current agent assignment automatically.

## Remaining exact review returns

- Spend memo accepted approval ID, valid execution window, admitted all-in FX,
  current remaining EUR totals and settled prior liability.
- Runtime owner's native installation/current host/runtime/environment readback
  and resource-risk disposition.
- Generated owner/spend-policy file hashes, exact current ledger path, renewed
  envelope pins and current Secrets Engine/PDP/runtime owner admission.
- Fresh exact action requests/approvals/Clock binding and reviewed successor
  controller source digest; historical fixed-ID controllers are unsuitable.
- Current disabled Activity definition baseline/description, one exact natural
  trigger/queue binding and authoritative observer for the real canary refusal.

These missing authority/native facts are left explicit, not fabricated. No
canonical source change was necessary for this preparation. Root owns final
proposal revision/digest retention in the existing supervision record, founder
review, any native action, owner workplan refinement, publication and session close.