coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docs: preserve reviewed NetKingdom session artifacts
Some checks are pending
CI Smoke / container-smoke (push) Waiting to run
Details
CI Smoke / host-smoke (push) Waiting to run
Details
Reject generated-only commits / generated-commit-guard (push) Waiting to run
Details

Browse source
This commit is contained in:
codex 2026-11-01 23:24:13 +01:00
parent 4c8f8d8c26
commit daeba9eeab
50 changed files with 4522 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

98
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/README.md Normal file
View file

@ -0,0 +1,98 @@
# Rein metered retry identity binding review
Read-only source/history and public work-record review, 17 October 2026. No
source, ID, row, alias, retirement acknowledgement or authority was changed.
## Finding
The refused receiving transaction is correct under its current identity
contract. Parent `187c2599-84a6-5764-a14f-7e9121975bf2` is the deterministic
HARNESS-WP-0008 UUID. All seven task UUIDs likewise derive from their original
HARNESS IDs. The current file calls the same records REINAH-WP-0008/T01–T07 but
retains the HARNESS UUIDs. Canonical receiving derives UUIDs from canonical IDs;
ordinary embedded UUID fields are not authority to change that identity.
Creation commit `dd588f3e337c5f478653c006905a09a2e12bcdc1` (13 October)
created HARNESS-WP-0008 under then-current AGENTS instructions naming HARNESS-WP
as the prefix. Four minutes later,
`a85de661f04b8331ec66b921d165671f4da77305` changed the file and AGENTS to
REINAH to address C-26. Its stated intent was to keep the Hub IDs and update the
same existing record. The retained source history proves that intent; it is
not a sealed UUID migration approval or a change to receiver semantics.
The existing C-26 implementation is a **non-fixable warning** whose message says
new plans must conform. It does not instruct an existing record to be renamed.
The canon's grandfathering rule says existing IDs are never renamed. ADR-007
permits specifically ruled live-collision migrations, not arbitrary prefix
changes in response to C-26; no such HARNESS0008 collision or migration ruling
was found in the reviewed records. The newer prefix remains appropriate for
future new workplans.
## Existing source/receiver contracts
- `forge_projection.derive_from_checkout` derives ordinary record UUIDs from
canonical IDs. `reset_repository_projection` matches UUID, then canonical
slug; an identifier change is a rekey rather than a title/path rename.
- `ensure_missing_work_record_identifiers` preserves existing UUIDs and assigns
only missing ones. It cannot repair this source/identity contradiction by
overwriting the eight UUIDs.
- Normal task reconciliation can fill a null record_id when an actual task's
UUID equals the desired derived UUID. After a correct source identity repair,
that existing path can bind the seven records without task recreation.
- The existing sealed UUID migration contract requires a source-sealed atomic
plan, independently verified batch, explicit decision bound to its digest,
database/file phases, durable aliases and reversible failure handling. No
reviewed HARNESS0008 sealed plan or approval was identified. The alias model
records old/new **UUIDs**; it is not a free-form canonical string-ID alias
registry. Do not invent or populate one as a cache repair.
The receiver must not be weakened to prefer any embedded UUID over a conflicting
canonical identifier. That would defeat the deliberate rekey and collision
guards. The missing record_ids are a consequence of this identity conflict;
they are not seven independent permissions to patch task rows.
## Recommended minimal source correction for actual owner review
Restore the original canonical HARNESS-WP-0008 parent and T01–T07 IDs while
keeping the current backing filename, all eight UUIDs, statuses, human gates,
decision references, implementation/native history and existing dependency
endpoints. Add HARNESS0008 to AGENTS' explicit preserved historical list and
record the brief erroneous REINAH label as dated provenance. This is restoration
of an existing identity, not minting another workplan. mapping-proposal.json
names the exact records; no transformation was applied.
Do not change the prefix registered for future plans. Do not remove the source
history, rewrite immutable prior receipts, accept retirement, clear blocked or
needs_human fields, or silently apply a UUID migration. An ordinary receiving
attempt after a reviewed, published source correction should derive the existing
parent/seven task UUIDs, update those records and fill the null task record_ids,
with zero retired/created records. Confirm that expectation through the existing
normal derive/diff and receiving path before claiming convergence.
Current cross-owner references to the erroneous REINAH label must receive the
same explicit source correction or a documented provenance clarification. The
identified live driver references are in SAND-WP-0015 and GLAS-WP-0012; exact
source locations/hashes are in current-driver-references.json. Root's pending
native install proposal also uses REINAH-T07 and needs a separately versioned
reference correction if this disposition is accepted. Its original revision
must remain immutable and no revised reference creates native authority.
If the actual owner instead chooses REINAH as a newly rekeyed canonical record,
that is a different identity transition. Use the existing separately authorized
eight-UUID sealed migration and durable alias machinery with complete reference,
wait and history reconciliation. It is not an ordinary receiving fix, and is
not the minimal preservation option recommended here.
## Live preservation requirements
live-seven-bindings.json records exact source/Hub IDs and UUIDs. T01–T04 are
done; T05/T06/T07 remain wait with needs_human=true. Parent remains blocked and
unretired. Existing T07→T01/T03 dependencies use the original task UUIDs. Those
two dependency rows and every human/native gate must survive any authorized
repair. Spend decision a93619a9, image decision e6ca2f07 and approval decision
e8986e40 concern their stated owner choices, not canonical record migration.
The refused transaction receipt has zero updates/creates/retirements and remains
unchanged. No retirement was acknowledged. This review supplies a concrete
owner correction proposal and source basis; it performs no new native action,
spend, installation, approval or human-wait disposition.

39
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/current-driver-references.json Normal file
View file

@ -0,0 +1,39 @@
{
"status": "read_only_current_source_reference_inventory",
"references": [
{
"repo": "glas-harness",
"path": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md",
"sha256": "sha256:881ab0f5ba3bb43f5404c8f4cd23f9628e014992ba88fc13f541f0fa8b7b1eaa",
"current_references": [
{
"line": 442,
"source": "admitted on Railiance. REINAH-WP-0008-T07 retains memo lifecycle acceptance,"
}
]
},
{
"repo": "sand-boxer",
"path": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md",
"sha256": "sha256:230d1ef37aa9c2023335a617492a72678c4671a8bc82d5577e9d7a7cea6e8fe4",
"current_references": [
{
"line": 92,
"source": "blocking_reason: \"Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.\""
},
{
"line": 357,
"source": "opened REINAH-WP-0008 (simpler metered retry, active). No railiance01 install/"
},
{
"line": 362,
"source": "origin/main). Steps 2-4 are REINAH-WP-0008-T07. Budget is now up to three"
},
{
"line": 374,
"source": "then-current corrected runtime for REINAH-WP-0008-T07 and to load the unsigned"
}
]
}
]
}

200
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/initial-creation.source-history.txt Normal file
View file

@ -0,0 +1,200 @@
commit dd588f3e337c5f478653c006905a09a2e12bcdc1
Author: tegwick <bernd.worsch@gmail.com>
AuthorDate: Tue Oct 13 22:52:59 2026 +0200
Commit: tegwick <bernd.worsch@gmail.com>
CommitDate: Tue Oct 13 22:52:59 2026 +0200
Add HARNESS-WP-0008: simpler metered retry
Free host rehearsal, evidence-backed release of unused holds, and a
one-command owner renewal; multi-attempt envelopes, image shipping and
per-envelope approvals recorded as decisions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 269692@bnt-lap001
Assistant-Session: 8077e68a-0985-4b41-898c-2dc602b0d6be
diff --git a/workplans/HARNESS-WP-0008-simpler-metered-retry.md b/workplans/HARNESS-WP-0008-simpler-metered-retry.md
new file mode 100644
index 0000000..bfa06e2
--- /dev/null
+++ b/workplans/HARNESS-WP-0008-simpler-metered-retry.md
@@ -0,0 +1,175 @@
+---
+id: HARNESS-WP-0008
+type: workplan
+title: "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal"
+domain: infotech
+repo: rein-aharness
+status: ready
+owner: claude-code
+topic_slug: rein-aharness
+priority: high
+created: "2026-10-13"
+updated: "2026-10-13"
+related:
+ - REINAH-WP-0003
+---
+
+# HARNESS-WP-0008 — Simpler metered retry
+
+## Origin
+
+On 2026-10-13 the owner reconciled the 2026-09-27 hold for run `6efa9436`
+(`docs/evidence/2026-10-13-held-liability-reconciliation.json`). A corrected
+runtime `ee3d0a53…` was built
+(`docs/evidence/2026-10-13-corrected-owner-runtime-build.json`). The owner
+authorized a new envelope and one retry.
+
+Preparing that retry took too many owner ceremonies:
+
+1. The runtime is built on the workstation and copied to railiance01 by hand.
+2. `owner.json` and the spend policy hold five digests that the owner edits
+ by hand.
+3. A failed attempt keeps its full hold even when no provider request was
+ made, so every failure needs a new envelope, ledger and pins.
+4. Every attempt needs six native approvals.
+5. The launcher bug that failed run `6efa9436` was found only by spending
+ money. A free check on the host would have caught it.
+
+The owner agreed (2026-10-13) to fix items 5, 3 and 2 here, and to record
+the rest as decisions instead of blocking on them.
+
+**Goal:** a retry becomes: install the artifact, rehearse for free, approve
+once, run.
+
+## A. Free rehearsal on the host
+
+```task
+id: HARNESS-WP-0008-T01
+status: todo
+priority: high
+```
+
+Add `rein-aharness owner check --rehearse <owner.json>`. It runs everything
+`metered-once --check` does. It then executes the admitted runtime's
+`rein-aharness` and `glas-harness` launchers inside bwrap, from the mount
+path, with `--unshare-all`, no credentials, no provider route and no ledger
+write. It also checks that the sandbox profile resolves. It prints a single
+pass or fail line with the runtime digest.
+
+Today's launcher check reads only the first line of each launcher. This
+rehearsal runs them, the same way the failing run did.
+
+**Done when:** tests prove the rehearsal fails on a runtime whose launchers
+point at a missing build directory (the `6efa9436` failure) and passes on a
+relocated runtime. It must make no network calls and write nothing. The
+owner procedure in `docs/owner-bootstrap.md` makes the rehearsal a required
+step before any paid attempt.
+
+## B. Release holds that provably cost nothing
+
+```task
+id: HARNESS-WP-0008-T02
+status: todo
+priority: high
+```
+
+`SpendLedger.reconcile` keeps the full hold (`max(held, observed)`). Add an
+evidence-backed release. If the run has zero provider-request reservations
+and its request route is revoked, reconciliation may set the liability to
+the observed amount. Otherwise the current rule stands. The release records
+which evidence allowed it, and the CLI flag says so, for example
+`--release-unused-hold`.
+
+This changes a deliberate safety rule, so it needs owner sign-off on the
+exact rule before merge. That sign-off is recorded in T04's decision note.
+
+**Done when:** tests cover all four cases. A run with no request
+reservations and a revoked route releases. A run with any request
+reservation, or with a live route, refuses the release. A second, identical
+reconcile changes nothing. The envelope is never marked breached by a
+release.
+
+## D. One owner command for renewal
+
+```task
+id: HARNESS-WP-0008-T03
+status: todo
+priority: high
+```
+
+Add `rein-aharness owner renew --owner <owner.json> --runtime <digest>
+--envelope <envelope.json>`. It does three things:
+
+1. It refuses unless every reservation in the current ledger is settled.
+2. It writes the new spend policy, initializes a fresh ledger, and updates
+ the runtime and spend-policy pins in `owner.json` together. Old files are
+ kept as backups. Existing ledgers are never reset.
+3. It prints one summary for the owner to review: old to new runtime, old
+ to new policy digest, envelope cap and attempt limit, and ledger path.
+
+Add a dry-run mode that only prints the summary. Afterwards, run the T01
+rehearsal.
+
+**Done when:** a test renews from the 2026-09-27 layout to a new envelope.
+The owner check passes on the result. A second renew with an unsettled
+reservation refuses. No digest has to be typed by hand.
+
+## C. Envelopes that cover several attempts (decision)
+
+```task
+id: HARNESS-WP-0008-T04
+status: wait
+priority: medium
+```
+
+Owner decision: should future envelopes be admitted as "up to N attempts
+within EUR X" instead of one attempt? The EUR 10 cap already fits two
+USD 4.64 request holds. Record the choice, together with T02's sign-off,
+as a decision note in `docs/`. T03's envelope format then reflects it.
+
+## E. Ship the owner runtime as a container image (decision)
+
+```task
+id: HARNESS-WP-0008-T05
+status: wait
+priority: low
+```
+
+Decision for later, with Platform (railiance) and Sand-boxer: should the
+owner runtime ship through the registry and GitOps, using the existing
+`make image` path, instead of rsync and a manual digest check? Out of scope
+here. If accepted, hand it off as a residual intake to the owning repos.
+
+## F. Approvals per envelope (decision)
+
+```task
+id: HARNESS-WP-0008-T06
+status: wait
+priority: low
+```
+
+Decision for later, with Secrets Engine: should one approval set cover an
+envelope's attempts instead of six native approvals per attempt? The work
+lives outside this repo. If accepted, hand it off as a residual intake.
+
+## Retry on the corrected runtime
+
+```task
+id: HARNESS-WP-0008-T07
+status: wait
+priority: high
+```
+
+Waits on T01 and T03. It does not need T02.
+
+Steps:
+
+1. Rebuild `ee3d0a53…`, or the then-current corrected runtime, from the
+ pinned commits.
+2. Install it on railiance01.
+3. Run the T01 rehearsal.
+4. Renew with T03 to the owner-authorized new envelope (EUR 10, authorized
+ 2026-10-13).
+5. Run exactly one attended attempt, which consumes fresh native approvals.
+
+Record the result in REINAH-WP-0003-T05/T06.

178
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/live-seven-bindings.json Normal file
View file

@ -0,0 +1,178 @@
{
"observed_at": "2026-10-17T06:53:16.338873+00:00",
"read_only": true,
"parent": {
"id": "187c2599-84a6-5764-a14f-7e9121975bf2",
"repo_id": "73be5a8e-8503-447f-87cb-de8c2c8c0b9e",
"slug": "harness-wp-0008",
"title": "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal",
"status": "blocked",
"backing_relative_path": "workplans/REINAH-WP-0008-simpler-metered-retry.md",
"projection_retired_at": null
},
"historical_parent_derived_uuid": "187c2599-84a6-5764-a14f-7e9121975bf2",
"renamed_parent_derived_uuid": "09fc68ec-4274-5669-9936-16e82bb95d76",
"tasks": [
{
"source_id": "REINAH-WP-0008-T01",
"historical_id": "HARNESS-WP-0008-T01",
"source_uuid": "c6536c8d-7862-5de6-ad2b-401077b60c04",
"source_status": "done",
"historical_derived_uuid": "c6536c8d-7862-5de6-ad2b-401077b60c04",
"renamed_derived_uuid": "fc36020b-348a-53f1-9265-fe83a22d75c5",
"hub": {
"id": "c6536c8d-7862-5de6-ad2b-401077b60c04",
"record_id": null,
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2",
"title": "A. Free rehearsal on the host",
"status": "done",
"needs_human": false,
"decision_id": null,
"blocking_reason": null,
"parent_task_id": null
}
},
{
"source_id": "REINAH-WP-0008-T02",
"historical_id": "HARNESS-WP-0008-T02",
"source_uuid": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9",
"source_status": "done",
"historical_derived_uuid": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9",
"renamed_derived_uuid": "a52b493c-c990-51f2-a629-14b361cff34e",
"hub": {
"id": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9",
"record_id": null,
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2",
"title": "B. Release holds that provably cost nothing",
"status": "done",
"needs_human": false,
"decision_id": null,
"blocking_reason": null,
"parent_task_id": null
}
},
{
"source_id": "REINAH-WP-0008-T03",
"historical_id": "HARNESS-WP-0008-T03",
"source_uuid": "87457216-2371-51ca-b3d4-3917e6f180a2",
"source_status": "done",
"historical_derived_uuid": "87457216-2371-51ca-b3d4-3917e6f180a2",
"renamed_derived_uuid": "f4453c99-b937-5716-a665-eccb9c3870d7",
"hub": {
"id": "87457216-2371-51ca-b3d4-3917e6f180a2",
"record_id": null,
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2",
"title": "D. One owner command for renewal",
"status": "done",
"needs_human": false,
"decision_id": null,
"blocking_reason": null,
"parent_task_id": null
}
},
{
"source_id": "REINAH-WP-0008-T04",
"historical_id": "HARNESS-WP-0008-T04",
"source_uuid": "898e02af-51bb-5e8d-93d0-ae908466c612",
"source_status": "done",
"historical_derived_uuid": "898e02af-51bb-5e8d-93d0-ae908466c612",
"renamed_derived_uuid": "45e8d650-57d5-5e40-a911-49577db0dbd6",
"hub": {
"id": "898e02af-51bb-5e8d-93d0-ae908466c612",
"record_id": null,
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2",
"title": "C. Envelopes that cover several attempts (decision)",
"status": "done",
"needs_human": false,
"decision_id": "a93619a9-8a70-40d8-aaf9-c29357d2a043",
"blocking_reason": null,
"parent_task_id": null
}
},
{
"source_id": "REINAH-WP-0008-T05",
"historical_id": "HARNESS-WP-0008-T05",
"source_uuid": "b486e86b-9d0f-501d-a394-771b40f771ee",
"source_status": "wait",
"historical_derived_uuid": "b486e86b-9d0f-501d-a394-771b40f771ee",
"renamed_derived_uuid": "b7d8410a-f9ce-5329-ab83-4bb40ad5dae2",
"hub": {
"id": "b486e86b-9d0f-501d-a394-771b40f771ee",
"record_id": null,
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2",
"title": "E. Ship the owner runtime as a container image (decision)",
"status": "wait",
"needs_human": true,
"decision_id": "e6ca2f07-2708-4013-bfba-bf89fa0f1cb5",
"blocking_reason": null,
"parent_task_id": null
}
},
{
"source_id": "REINAH-WP-0008-T06",
"historical_id": "HARNESS-WP-0008-T06",
"source_uuid": "4cf721e6-724b-5c64-91bb-67b098bb97af",
"source_status": "wait",
"historical_derived_uuid": "4cf721e6-724b-5c64-91bb-67b098bb97af",
"renamed_derived_uuid": "467d0112-89af-5c56-acae-2d421c37f7db",
"hub": {
"id": "4cf721e6-724b-5c64-91bb-67b098bb97af",
"record_id": null,
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2",
"title": "F. Approvals per envelope (decision)",
"status": "wait",
"needs_human": true,
"decision_id": "e8986e40-f6f8-4c87-b704-bff50cc4958b",
"blocking_reason": null,
"parent_task_id": null
}
},
{
"source_id": "REINAH-WP-0008-T07",
"historical_id": "HARNESS-WP-0008-T07",
"source_uuid": "80318842-ccaa-5484-a54a-3d9981eaec8b",
"source_status": "wait",
"historical_derived_uuid": "80318842-ccaa-5484-a54a-3d9981eaec8b",
"renamed_derived_uuid": "4be5997e-2e07-5977-9b5f-a488ddad3030",
"hub": {
"id": "80318842-ccaa-5484-a54a-3d9981eaec8b",
"record_id": null,
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2",
"title": "Retry on the corrected runtime",
"status": "wait",
"needs_human": true,
"decision_id": null,
"blocking_reason": "Owner: accept spend memo infd-20261014-b01, then attended install, rehearsal, renew and approvals on railiance01",
"parent_task_id": null
}
}
],
"dependency_endpoint_result": [
{
"id": "a6dc2ff5-ec61-407c-8fd2-d6a0d6f31547",
"from_workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2",
"from_task_id": "80318842-ccaa-5484-a54a-3d9981eaec8b",
"to_workplan_id": null,
"to_task_id": "c6536c8d-7862-5de6-ad2b-401077b60c04",
"relationship_type": "starts_after",
"description": "REINAH-WP-0008-T07 depends_on REINAH-WP-0008-T01",
"source_owner": null,
"source_commit": null,
"created_at": "2026-10-13T20:58:29.042766Z",
"updated_at": "2026-10-13T20:58:29.042766Z"
},
{
"id": "67498261-4d2a-4db8-b82e-432dbdcbf4ce",
"from_workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2",
"from_task_id": "80318842-ccaa-5484-a54a-3d9981eaec8b",
"to_workplan_id": null,
"to_task_id": "87457216-2371-51ca-b3d4-3917e6f180a2",
"relationship_type": "starts_after",
"description": "REINAH-WP-0008-T07 depends_on REINAH-WP-0008-T03",
"source_owner": null,
"source_commit": null,
"created_at": "2026-10-13T20:58:29.288075Z",
"updated_at": "2026-10-13T20:58:29.288075Z"
}
]
}

14
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/manifest.json Normal file
View file

@ -0,0 +1,14 @@
{
"schema": "custodian.identity-binding-review.v1",
"status": "read_only_initial_review",
"created_at": "2026-10-17T06:54:39.000769+00:00",
"files": {
"README.md": "sha256:ef4b07a3d5a4fa2affae0ca49b5cea3a85312fd127e1e38f067ef0947c321831",
"current-driver-references.json": "sha256:dfe6c5c37e4a1229556befd9fe4c4eed44739637c32c49272c5b0dc28f011488",
"initial-creation.source-history.txt": "sha256:88bcf3b29e688f87e100a08937479b8f1fcc4a1091156aa457306e28dfe4a8eb",
"live-seven-bindings.json": "sha256:45ef5f12cb89f6227c49531639658cbe5b2ea4a01c9b741938c6e7d500196f83",
"mapping-proposal.json": "sha256:4ec2d39cab42f2863a5c816677955db8e9316c307f61c47a936182fb85c7eb72",
"prefix-rename.source-history.txt": "sha256:c8be2645b37fd445a11a0b2ac939156aab3e7235945fdbf4551fca0c509487e8",
"source-references.json": "sha256:f6240e4db737b028cb86978e5e4c357d5b9a262c03b5791938c9d596ee00848c"
}
}

47
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/mapping-proposal.json Normal file
View file

@ -0,0 +1,47 @@
{
"status": "source_identity_restoration_proposed_no_change_performed_in_initial_review",
"parent": {
"current_label": "REINAH-WP-0008",
"restore_canonical_id": "HARNESS-WP-0008",
"preserve_uuid": "187c2599-84a6-5764-a14f-7e9121975bf2"
},
"tasks": [
{
"current_label": "REINAH-WP-0008-T01",
"restore_canonical_id": "HARNESS-WP-0008-T01",
"preserve_uuid": "c6536c8d-7862-5de6-ad2b-401077b60c04"
},
{
"current_label": "REINAH-WP-0008-T02",
"restore_canonical_id": "HARNESS-WP-0008-T02",
"preserve_uuid": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9"
},
{
"current_label": "REINAH-WP-0008-T03",
"restore_canonical_id": "HARNESS-WP-0008-T03",
"preserve_uuid": "87457216-2371-51ca-b3d4-3917e6f180a2"
},
{
"current_label": "REINAH-WP-0008-T04",
"restore_canonical_id": "HARNESS-WP-0008-T04",
"preserve_uuid": "898e02af-51bb-5e8d-93d0-ae908466c612"
},
{
"current_label": "REINAH-WP-0008-T05",
"restore_canonical_id": "HARNESS-WP-0008-T05",
"preserve_uuid": "b486e86b-9d0f-501d-a394-771b40f771ee"
},
{
"current_label": "REINAH-WP-0008-T06",
"restore_canonical_id": "HARNESS-WP-0008-T06",
"preserve_uuid": "4cf721e6-724b-5c64-91bb-67b098bb97af"
},
{
"current_label": "REINAH-WP-0008-T07",
"restore_canonical_id": "HARNESS-WP-0008-T07",
"preserve_uuid": "80318842-ccaa-5484-a54a-3d9981eaec8b"
}
],
"future_prefix": "REINAH-WP-",
"filename_unchanged": "workplans/REINAH-WP-0008-simpler-metered-retry.md"
}

192
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/prefix-rename.source-history.txt Normal file
View file

@ -0,0 +1,192 @@
commit a85de661f04b8331ec66b921d165671f4da77305
Author: tegwick <bernd.worsch@gmail.com>
AuthorDate: Tue Oct 13 22:56:46 2026 +0200
Commit: tegwick <bernd.worsch@gmail.com>
CommitDate: Tue Oct 13 22:56:46 2026 +0200
Use the registered REINAH-WP prefix; rename HARNESS-WP-0008 to REINAH-WP-0008
AGENTS.md named HARNESS-WP- as the prefix, but the hub's canonical prefix
for this repo is REINAH-WP- (fix-consistency C-26). Hub ids are kept so
the existing record is updated, not duplicated. Also fixes the README link
to the renamed REINAH-WP-0002 file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 269692@bnt-lap001
Assistant-Session: 8077e68a-0985-4b41-898c-2dc602b0d6be
diff --git a/AGENTS.md b/AGENTS.md
index 99aa506..e165849 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -7,12 +7,13 @@
**Domain:** infotech
**Repo slug:** rein-aharness
**Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a`
-**Workplan prefix:** `HARNESS-WP-`
+**Workplan prefix:** `REINAH-WP-`
`REIN-A-0001` through `REIN-A-0004` are immutable historical identifiers from
-before the fleet `PREFIX-WP-NNNN` convention. Preserve them in references and
-archives, but use the registered `HARNESS-WP-` prefix for every new workplan
-and task.
+before the fleet `PREFIX-WP-NNNN` convention. `HARNESS-WP-0001` through
+`HARNESS-WP-0003` and `HARNESS-WP-ADHOC-2026-09-04` are older ids from the
+agent-harness name. Preserve all of these in references and archives, but use
+the hub-registered `REINAH-WP-` prefix for every new workplan and task.
---
@@ -196,10 +197,10 @@ get wrong.
Work items originate as files in this repo — not in the hub. The hub is a
read/cache/index layer that rebuilds from files.
-**File location:** `workplans/HARNESS-WP-NNNN-<slug>.md`
+**File location:** `workplans/REINAH-WP-NNNN-<slug>.md`
**Archived location:** finished workplans may move to
-`workplans/archived/YYMMDD-HARNESS-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
+`workplans/archived/YYMMDD-REINAH-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
the completion/archive date; the frontmatter `id` does not change.
**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
@@ -211,7 +212,7 @@ anything needing analysis, design, approval, dependencies, or multiple phases.
```yaml
---
-id: HARNESS-WP-NNNN
+id: REINAH-WP-NNNN
type: workplan
title: "..."
domain: infotech
@@ -239,7 +240,7 @@ API/MCP/frontmatter bridges until `STATE-WP-0069` retires them — see
## Task Title
` ` `task
-id: HARNESS-WP-NNNN-T01
+id: REINAH-WP-NNNN-T01
status: wait | todo | progress | done | cancel
priority: high | medium | low
state_hub_task_id: "<uuid>" # written by fix-consistency — do not edit
@@ -252,7 +253,7 @@ Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blo
**Residuals when finishing:** actionable leftovers become live work records
before `status: finished` — usually an intake (`origin: residual`,
-`origin_ref: HARNESS-WP-NNNN`) or a spawned workplan. Residual is a *role*,
+`origin_ref: REINAH-WP-NNNN`) or a spawned workplan. Residual is a *role*,
not a kind. Fleet list lives on State Hub, not in `SCOPE.md`.
To create a new workplan:
diff --git a/workplans/HARNESS-WP-0008-simpler-metered-retry.md b/workplans/REINAH-WP-0008-simpler-metered-retry.md
similarity index 89%
rename from workplans/HARNESS-WP-0008-simpler-metered-retry.md
rename to workplans/REINAH-WP-0008-simpler-metered-retry.md
index bfa06e2..3fa0aae 100644
--- a/workplans/HARNESS-WP-0008-simpler-metered-retry.md
+++ b/workplans/REINAH-WP-0008-simpler-metered-retry.md
@@ -1,5 +1,5 @@
---
-id: HARNESS-WP-0008
+id: REINAH-WP-0008
type: workplan
title: "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal"
domain: infotech
@@ -12,9 +12,10 @@ created: "2026-10-13"
updated: "2026-10-13"
related:
- REINAH-WP-0003
+state_hub_workstream_id: "187c2599-84a6-5764-a14f-7e9121975bf2"
---
-# HARNESS-WP-0008 — Simpler metered retry
+# REINAH-WP-0008 — Simpler metered retry
## Origin
@@ -44,9 +45,10 @@ once, run.
## A. Free rehearsal on the host
```task
-id: HARNESS-WP-0008-T01
+id: REINAH-WP-0008-T01
status: todo
priority: high
+state_hub_task_id: "c6536c8d-7862-5de6-ad2b-401077b60c04"
```
Add `rein-aharness owner check --rehearse <owner.json>`. It runs everything
@@ -68,9 +70,10 @@ step before any paid attempt.
## B. Release holds that provably cost nothing
```task
-id: HARNESS-WP-0008-T02
+id: REINAH-WP-0008-T02
status: todo
priority: high
+state_hub_task_id: "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9"
```
`SpendLedger.reconcile` keeps the full hold (`max(held, observed)`). Add an
@@ -92,9 +95,10 @@ release.
## D. One owner command for renewal
```task
-id: HARNESS-WP-0008-T03
+id: REINAH-WP-0008-T03
status: todo
priority: high
+state_hub_task_id: "87457216-2371-51ca-b3d4-3917e6f180a2"
```
Add `rein-aharness owner renew --owner <owner.json> --runtime <digest>
@@ -117,9 +121,10 @@ reservation refuses. No digest has to be typed by hand.
## C. Envelopes that cover several attempts (decision)
```task
-id: HARNESS-WP-0008-T04
+id: REINAH-WP-0008-T04
status: wait
priority: medium
+state_hub_task_id: "898e02af-51bb-5e8d-93d0-ae908466c612"
```
Owner decision: should future envelopes be admitted as "up to N attempts
@@ -130,9 +135,10 @@ as a decision note in `docs/`. T03's envelope format then reflects it.
## E. Ship the owner runtime as a container image (decision)
```task
-id: HARNESS-WP-0008-T05
+id: REINAH-WP-0008-T05
status: wait
priority: low
+state_hub_task_id: "b486e86b-9d0f-501d-a394-771b40f771ee"
```
Decision for later, with Platform (railiance) and Sand-boxer: should the
@@ -143,9 +149,10 @@ here. If accepted, hand it off as a residual intake to the owning repos.
## F. Approvals per envelope (decision)
```task
-id: HARNESS-WP-0008-T06
+id: REINAH-WP-0008-T06
status: wait
priority: low
+state_hub_task_id: "4cf721e6-724b-5c64-91bb-67b098bb97af"
```
Decision for later, with Secrets Engine: should one approval set cover an
@@ -155,9 +162,10 @@ lives outside this repo. If accepted, hand it off as a residual intake.
## Retry on the corrected runtime
```task
-id: HARNESS-WP-0008-T07
+id: REINAH-WP-0008-T07
status: wait
priority: high
+state_hub_task_id: "80318842-ccaa-5484-a54a-3d9981eaec8b"
```
Waits on T01 and T03. It does not need T02.

99
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.json Normal file
View file

@ -0,0 +1,99 @@
{
"repo_slug": "glas-harness",
"repo_path": "/home/worsch/glas-harness",
"source_revision": "c8751c97986011284ea4173c9adacc31e1fd9dfc",
"source_revision_reason": null,
"issues": [
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'GLAS-WP-0015-T03' in workplan 'GLAS-WP-0015' \u2014 decision 62aa95e4-3ccc-4867-8806-5e3db005b483 is resolved",
"file_path": "workplans/GLAS-WP-0015-production-dependency-coordination.md#GLAS-WP-0015-T03",
"db_id": "",
"file_value": "62aa95e4-3ccc-4867-8806-5e3db005b483",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-25",
"message": "Owner-return task 'GLAS-WP-0016-T04' waiting on rein-aharness has 1 reply/replies after its last dated note (or unread when undated) \u2014 owner action needed: 6b024762-a03a-47dc-b9cf-7a026d361789",
"file_path": "workplans/GLAS-WP-0016-fi-research-brief-profile.md#GLAS-WP-0016-T04",
"db_id": "",
"file_value": "message-from:rein-aharness",
"db_value": "",
"fixable": false,
"repo_slug": "glas-harness",
"source_revision": "c8751c97986011284ea4173c9adacc31e1fd9dfc",
"source_revision_reason": null,
"owner_return": {
"task_record_id": "GLAS-WP-0016-T04",
"message_ids": [
"6b024762-a03a-47dc-b9cf-7a026d361789"
]
}
},
{
"severity": "WARN",
"check_id": "C-25",
"message": "Owner-return task 'GLAS-WP-0017-T02' waiting on assembly-economics has 1 reply/replies after its last dated note (or unread when undated) \u2014 owner action needed: c4c804d2-f016-4d26-8d4e-5713e98e65a3",
"file_path": "workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md#GLAS-WP-0017-T02",
"db_id": "",
"file_value": "message-from:assembly-economics",
"db_value": "",
"fixable": false,
"repo_slug": "glas-harness",
"source_revision": "c8751c97986011284ea4173c9adacc31e1fd9dfc",
"source_revision_reason": null,
"owner_return": {
"task_record_id": "GLAS-WP-0017-T02",
"message_ids": [
"c4c804d2-f016-4d26-8d4e-5713e98e65a3"
]
}
},
{
"severity": "WARN",
"check_id": "C-28",
"message": "4 unread inbox message(s) older than 3 day(s): rein-aharness:6b024762, assembly-economics:c4c804d2, the-custodian:23172cb2, the-custodian:51e9eace",
"file_path": "",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-28",
"message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace",
"file_path": "",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-29",
"message": "Unread work request from rein-aharness (6b024762) may need a workplan file: Re: Re: Re: GLAS-WP-0016-T03: tool profile green-research-commit for the FI research brief",
"file_path": "",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
}
],
"fixes_applied": [
"bindings: synced 18/18",
"C-17 cleared: pushed 1 backlogged commit(s)",
"brief: .custodian-brief.md updated",
"push: pushed"
],
"summary": {
"fail": 0,
"automation_error": 0,
"warn": 6,
"info": 0
},
"result": "warn"
}

1
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.stderr.txt Normal file
View file

@ -0,0 +1 @@
WARN: git commit failed for writeback: Generated-only commits rejected: staged

BIN
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/index.preimage Normal file
View file

Binary file not shown.

153
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.json Normal file
View file

@ -0,0 +1,153 @@
{
"ok": true,
"status": "applied",
"repo_slug": "glas-harness",
"commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc",
"requests": 2,
"elapsed_ms": 6001.1,
"git": {
"upstream": "origin/main",
"behind": 0,
"ahead": 0
},
"identifiers": {
"schema": "repo-manager.identifier-assignment.v1",
"ok": true,
"executed": true,
"repo": "glas-harness",
"namespace": "helixforge",
"assignments": [],
"historical_invalid_identifiers": [],
"historical_identity_collisions": [],
"files_changed": []
},
"receipt": {
"schema": "state-hub.repository-projection-reconcile.v1",
"instance_role": "primary",
"instance_label": "railiance01",
"expected_commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc",
"derived_commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc",
"outcome": {
"schema": "state-hub.projection-reset.v1",
"repo_slug": "glas-harness",
"commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc",
"status": "applied",
"counts": {
"created": 0,
"updated": 18,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 8,
"cancelled_tasks": 0,
"created_edges": 0,
"removed_edges": 0,
"unresolved_edges": 0,
"external_edges": 6
},
"created": [],
"updated": [
"GLAS-WP-0001",
"GLAS-WP-0002",
"GLAS-WP-0003",
"GLAS-WP-0004",
"GLAS-WP-0005",
"GLAS-WP-0006",
"GLAS-WP-0007",
"GLAS-WP-0008",
"GLAS-WP-0009",
"GLAS-WP-0010",
"GLAS-WP-0011",
"GLAS-WP-0012",
"GLAS-WP-0013",
"GLAS-WP-0014",
"GLAS-WP-0015",
"GLAS-WP-0016",
"GLAS-WP-0017",
"GLAS-WP-ADHOC-2026-09-06"
],
"retired": [],
"released": [],
"created_tasks": [],
"updated_tasks": [
"GLAS-WP-0016-T01",
"GLAS-WP-0016-T02",
"GLAS-WP-0016-T03",
"GLAS-WP-0016-T04",
"GLAS-WP-0016-T05",
"GLAS-WP-0016-T06",
"GLAS-WP-0017-T01",
"GLAS-WP-0017-T02"
],
"cancelled_tasks": [],
"created_edges": [],
"removed_edges": [],
"unresolved_edges": [],
"external_edges": [
{
"workplan": "GLAS-WP-0016",
"from": "GLAS-WP-0016-T04",
"target": "SAND-WP-0015-T04",
"relationship_type": "starts_after",
"from_workplan_id": "1254b220-fd97-5c84-a0e0-ef2de10972c4",
"from_task_id": "6faf1b1c-164d-5d6d-8dad-6cf920a5fd6c",
"to_workplan_id": null,
"to_task_id": "58817ef6-76d9-5e34-908f-c024e6c99f93"
},
{
"workplan": "GLAS-WP-0012",
"from": "GLAS-WP-0012-T04",
"target": "GLAS-WP-0012-T03",
"relationship_type": "starts_after",
"from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f",
"from_task_id": "3e791432-8f37-54bd-a44a-55eeff11ac19",
"to_workplan_id": null,
"to_task_id": "c660808a-1724-555c-bc59-7318870d3591"
},
{
"workplan": "GLAS-WP-0012",
"from": "GLAS-WP-0012-T02",
"target": "SAND-WP-0014-T05",
"relationship_type": "starts_after",
"from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f",
"from_task_id": "4209f564-a9ee-57f9-9522-3708988801ef",
"to_workplan_id": null,
"to_task_id": "c6812fd4-bb7b-5be0-8344-a122496fe5bc"
},
{
"workplan": "GLAS-WP-0012",
"from": "GLAS-WP-0012-T03",
"target": "GLAS-WP-0012-T02",
"relationship_type": "starts_after",
"from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f",
"from_task_id": "c660808a-1724-555c-bc59-7318870d3591",
"to_workplan_id": null,
"to_task_id": "4209f564-a9ee-57f9-9522-3708988801ef"
},
{
"workplan": "GLAS-WP-0012",
"from": "GLAS-WP-0012-T03",
"target": "SECRETS-WP-0009-T03",
"relationship_type": "starts_after",
"from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f",
"from_task_id": "c660808a-1724-555c-bc59-7318870d3591",
"to_workplan_id": null,
"to_task_id": "f8069c8a-ad6b-5d0b-9a36-c2326699437d"
},
{
"workplan": "GLAS-WP-0012",
"from": "GLAS-WP-0012-T05",
"target": "GLAS-WP-0012-T04",
"relationship_type": "starts_after",
"from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f",
"from_task_id": "f7635cf6-e044-52d4-8242-0512e0ccbd7b",
"to_workplan_id": null,
"to_task_id": "3e791432-8f37-54bd-a44a-55eeff11ac19"
}
],
"refused": [],
"notes": []
}
}
}

0
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.stderr.txt Normal file
View file

55
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/.custodian-brief.md.worktree Normal file
View file

@ -0,0 +1,55 @@
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
# Custodian Brief — glas-harness
**Domain:** infotech
**Last synced:** 2026-10-13 20:53 UTC
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
## Active Workstreams
### Versioned Glas profile for the FI daily research brief
Progress: 5/6 done | workplan_id: `1254b220-fd97-5c84-a0e0-ef2de10972c4`
**Open tasks:**
- ! Prove one sandboxed run and mark the profile ready `6faf1b1c`
*(wait: Live activation needs sand-boxer owner credential delivery (SAND-WP-0015-T04); publication needs the rein-aharness publisher (decision c6f23433, request 780c78d1).)*
### Governed route for assembly-checkpoint before legacy routing ends
Progress: 1/2 done | workplan_id: `8039eefd-47b9-580b-a488-fb9c3da93f50`
**Open tasks:**
- ! Confirm the grant shape with assembly-economics `04c50300`
*(wait: Grant-shape confirmation requested 2026-10-13 (reply 2b8b3553); await assembly-economics.)*
### Drive owner returns for the first production Glas profile
Progress: 2/3 done | workplan_id: `94c02b1f-66ed-588d-bdd7-7158107b85fb`
**Open tasks:**
- ! Review owner returns against the acceptance gates `68fcc1b4`
*(wait: Await owner returns: secrets-engine config, holder admission, lane approvals and scoped delivery; operator input on placement and spend bounds.)*
### Prove the first local rein profile end to end
Progress: 2/6 done | workplan_id: `170bf1ae-337f-5553-8d1e-03b07100e08f`
**Open tasks:**
- ! Resolve and verify the owner runtime, credential, and egress contract `4209f564`
*(wait: Dependency: sand-boxer SAND-WP-0014-T05 with rein-aharness and its credential owner.)*
- ! Review and validate the versioned Glas proof candidate `c660808a`
*(wait: Await the rebuilt runtime artifact carrying profile 1.1.1 started through its owner on railiance01 (SECRETS-WP-0009-T03 step B2).)*
- ! Prove one real bounded rein task inside the sandbox `3e791432`
*(wait: Depends on T03.)*
- ! Publish evidence and mark only the proven profile ready `f7635cf6`
*(wait: Depends on T04.)*
## Inbox Hygiene
**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
**Missing thread_id:** 2 unread message(s) lack supersession chains.
---
## MCP Orientation (when available)
If the state-hub MCP server is reachable, call:
`get_domain_summary("infotech")`
This provides richer cross-domain context.
If the MCP call fails, use this file as your orientation source.

97
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/WORK-RECORDS.md.worktree Normal file
View file

@ -0,0 +1,97 @@
# Work Records — glas-harness
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
> stage 3). Do not edit by hand — edit the source file/block listed for
> each record and re-run fix-consistency to refresh this index. Archived
> workplans are omitted; closed decisions/intakes/engagements stay listed
> so recently-resolved work is still visible. [auto]
| Kind | ID | Status | Lane | Source |
| --- | --- | --- | --- | --- |
| workplan | GLAS-WP-ADHOC-2026-09-06 | finished | — | workplans/ADHOC-2026-09-06.md |
| workplan | GLAS-WP-0001 | finished | — | workplans/GLAS-WP-0001-harness-router-foundation.md |
| workplan | GLAS-WP-0002 | finished | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md |
| workplan | GLAS-WP-0003 | finished | — | workplans/GLAS-WP-0003-first-channel-extension.md |
| workplan | GLAS-WP-0004 | finished | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md |
| workplan | GLAS-WP-0005 | finished | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md |
| workplan | GLAS-WP-0006 | finished | — | workplans/GLAS-WP-0006-consumer-actor-validation.md |
| workplan | GLAS-WP-0007 | finished | — | workplans/GLAS-WP-0007-capability-scope-truth.md |
| workplan | GLAS-WP-0008 | finished | — | workplans/GLAS-WP-0008-profile-operational-readiness.md |
| workplan | GLAS-WP-0009 | finished | — | workplans/GLAS-WP-0009-operational-handoff-truth.md |
| workplan | GLAS-WP-0010 | finished | — | workplans/GLAS-WP-0010-transport-and-resolution-hardening.md |
| workplan | GLAS-WP-0011 | finished | — | workplans/GLAS-WP-0011-statehub-bootstrap.md |
| workplan | GLAS-WP-0012 | blocked | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md |
| workplan | GLAS-WP-0013 | finished | — | workplans/GLAS-WP-0013-execution-outcome-evidence.md |
| workplan | GLAS-WP-0014 | finished | — | workplans/GLAS-WP-0014-sandbox-handoff-validation.md |
| workplan | GLAS-WP-0015 | blocked | — | workplans/GLAS-WP-0015-production-dependency-coordination.md |
| workplan | GLAS-WP-0016 | blocked | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md |
| workplan | GLAS-WP-0017 | blocked | — | workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md |
| task | ADHOC-2026-09-06-T01 | done | — | workplans/ADHOC-2026-09-06.md |
| task | ADHOC-2026-09-06-T02 | done | — | workplans/ADHOC-2026-09-06.md |
| task | ADHOC-2026-09-06-T03 | done | — | workplans/ADHOC-2026-09-06.md |
| task | GLAS-WP-0001-T01 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md |
| task | GLAS-WP-0001-T02 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md |
| task | GLAS-WP-0001-T03 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md |
| task | GLAS-WP-0001-T04 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md |
| task | GLAS-WP-0001-T05 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md |
| task | GLAS-WP-0001-T06 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md |
| task | GLAS-WP-0002-T01 | done | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md |
| task | GLAS-WP-0002-T02 | done | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md |
| task | GLAS-WP-0002-T03 | done | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md |
| task | GLAS-WP-0002-T04 | done | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md |
| task | GLAS-WP-0003-T01 | done | — | workplans/GLAS-WP-0003-first-channel-extension.md |
| task | GLAS-WP-0003-T02 | done | — | workplans/GLAS-WP-0003-first-channel-extension.md |
| task | GLAS-WP-0003-T03 | done | — | workplans/GLAS-WP-0003-first-channel-extension.md |
| task | GLAS-WP-0003-T04 | done | — | workplans/GLAS-WP-0003-first-channel-extension.md |
| task | GLAS-WP-0004-T01 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md |
| task | GLAS-WP-0004-T02 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md |
| task | GLAS-WP-0004-T03 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md |
| task | GLAS-WP-0004-T04 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md |
| task | GLAS-WP-0004-T05 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md |
| task | GLAS-WP-0004-T06 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md |
| task | GLAS-WP-0004-T07 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md |
| task | GLAS-WP-0004-T08 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md |
| task | GLAS-WP-0005-T01 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md |
| task | GLAS-WP-0005-T02 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md |
| task | GLAS-WP-0005-T03 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md |
| task | GLAS-WP-0005-T04 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md |
| task | GLAS-WP-0005-T05 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md |
| task | GLAS-WP-0006-T01 | done | — | workplans/GLAS-WP-0006-consumer-actor-validation.md |
| task | GLAS-WP-0007-T01 | done | — | workplans/GLAS-WP-0007-capability-scope-truth.md |
| task | GLAS-WP-0007-T02 | done | — | workplans/GLAS-WP-0007-capability-scope-truth.md |
| task | GLAS-WP-0008-T01 | done | — | workplans/GLAS-WP-0008-profile-operational-readiness.md |
| task | GLAS-WP-0008-T02 | done | — | workplans/GLAS-WP-0008-profile-operational-readiness.md |
| task | GLAS-WP-0008-T03 | done | — | workplans/GLAS-WP-0008-profile-operational-readiness.md |
| task | GLAS-WP-0009-T01 | done | — | workplans/GLAS-WP-0009-operational-handoff-truth.md |
| task | GLAS-WP-0009-T02 | done | — | workplans/GLAS-WP-0009-operational-handoff-truth.md |
| task | GLAS-WP-0010-T01 | done | — | workplans/GLAS-WP-0010-transport-and-resolution-hardening.md |
| task | GLAS-WP-0010-T02 | done | — | workplans/GLAS-WP-0010-transport-and-resolution-hardening.md |
| task | GLAS-WP-0010-T03 | done | — | workplans/GLAS-WP-0010-transport-and-resolution-hardening.md |
| task | GLAS-WP-0011-T01 | done | — | workplans/GLAS-WP-0011-statehub-bootstrap.md |
| task | GLAS-WP-0011-T02 | done | — | workplans/GLAS-WP-0011-statehub-bootstrap.md |
| task | GLAS-WP-0011-T03 | done | — | workplans/GLAS-WP-0011-statehub-bootstrap.md |
| task | GLAS-WP-0012-T01 | done | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md |
| task | GLAS-WP-0012-T02 | wait | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md |
| task | GLAS-WP-0012-T03 | wait | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md |
| task | GLAS-WP-0012-T04 | wait | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md |
| task | GLAS-WP-0012-T05 | wait | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md |
| task | GLAS-WP-0012-T06 | done | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md |
| task | GLAS-WP-0013-T01 | done | — | workplans/GLAS-WP-0013-execution-outcome-evidence.md |
| task | GLAS-WP-0013-T02 | done | — | workplans/GLAS-WP-0013-execution-outcome-evidence.md |
| task | GLAS-WP-0014-T01 | done | — | workplans/GLAS-WP-0014-sandbox-handoff-validation.md |
| task | GLAS-WP-0015-T01 | done | — | workplans/GLAS-WP-0015-production-dependency-coordination.md |
| task | GLAS-WP-0015-T02 | done | — | workplans/GLAS-WP-0015-production-dependency-coordination.md |
| task | GLAS-WP-0015-T03 | wait | — | workplans/GLAS-WP-0015-production-dependency-coordination.md |
| task | GLAS-WP-0016-T01 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md |
| task | GLAS-WP-0016-T02 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md |
| task | GLAS-WP-0016-T03 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md |
| task | GLAS-WP-0016-T04 | wait | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md |
| task | GLAS-WP-0016-T05 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md |
| task | GLAS-WP-0016-T06 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md |
| task | GLAS-WP-0017-T01 | done | — | workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md |
| task | GLAS-WP-0017-T02 | wait | — | workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md |
| intake | GLAS-IN-0001 | done | blue | docs/intakes/residuals.md |
| intake | GLAS-IN-0002 | todo | red | docs/intakes/residuals.md |
| intake | GLAS-IN-0003 | todo | green | docs/intakes/residuals.md |
| intake | GLAS-IN-0004 | todo | green | docs/intakes/residuals.md |
| intake | GLAS-IN-0005 | done | red | docs/intakes/residuals.md |

10
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/originals.json Normal file
View file

@ -0,0 +1,10 @@
[
{
"path": ".custodian-brief.md",
"index": "100644 3ab9cb5489704c7140420e489d2e89c46fd0ce92 0\t.custodian-brief.md"
},
{
"path": "WORK-RECORDS.md",
"index": "100644 5c81da3eaf946e218edc0dc7b3022191de1a82ee 0\tWORK-RECORDS.md"
}
]

13
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-commit.json Normal file
View file

@ -0,0 +1,13 @@
{
"exit_code": 0,
"commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc",
"base": "7357115c8311e55ee3d495f5266f501a17ec3c89",
"files": [
{
"path": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md",
"sha256": "23f97bc183bef2b0f38eb40c64bc0bb010df1c1eb4596ff3b5e0f73da7c2fcfc"
}
],
"stdout": "[main c8751c9] docs(identity): point current metered gate at issued HARNESS task\n 1 file changed, 1 insertion(+), 1 deletion(-)\n",
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 1, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
}

11
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-manifest.json Normal file
View file

@ -0,0 +1,11 @@
{
"owner": "glas-harness",
"base_revision": "7357115c8311e55ee3d495f5266f501a17ec3c89",
"message": "docs(identity): point current metered gate at issued HARNESS task",
"files": [
{
"path": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md",
"sha256": "23f97bc183bef2b0f38eb40c64bc0bb010df1c1eb4596ff3b5e0f73da7c2fcfc"
}
]
}

8
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/source-before.json Normal file
View file

@ -0,0 +1,8 @@
{
"observed_at": "2026-10-17T10:57:25.546281+00:00",
"head": "7357115c8311e55ee3d495f5266f501a17ec3c89",
"status": "M .custodian-brief.md\n M WORK-RECORDS.md\n",
"instructions_sha256": "sha256:f7d33c8d84f31c2a9b62e3ffdc2476da797fa1d0732cff17dc49d12e964f1fc5",
"source_sha256": "sha256:881ab0f5ba3bb43f5404c8f4cd23f9628e014992ba88fc13f541f0fa8b7b1eaa",
"index_sha256": "sha256:be6359bc304b09f0a3479e8c3cab02483c42a11c57aedf222000c153693b9843"
}

54
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/verified-bindings.json Normal file
View file

@ -0,0 +1,54 @@
{
"observed_at": "2026-10-17T11:27:45.427504+00:00",
"status": "source_and_task_bindings_verified",
"source_file": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md",
"source_sha256": "sha256:23f97bc183bef2b0f38eb40c64bc0bb010df1c1eb4596ff3b5e0f73da7c2fcfc",
"all_source_UUIDs_preserved": true,
"all_task_fields_preserved_except_approved_SAND_blocking_label": true,
"tasks": [
{
"record_id": "GLAS-WP-0012-T01",
"id": "711aeb7e-4664-5078-8c65-3fe6f46f7999",
"status": "done",
"needs_human": false,
"workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f"
},
{
"record_id": "GLAS-WP-0012-T02",
"id": "4209f564-a9ee-57f9-9522-3708988801ef",
"status": "wait",
"needs_human": false,
"workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f"
},
{
"record_id": "GLAS-WP-0012-T03",
"id": "c660808a-1724-555c-bc59-7318870d3591",
"status": "wait",
"needs_human": false,
"workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f"
},
{
"record_id": "GLAS-WP-0012-T04",
"id": "3e791432-8f37-54bd-a44a-55eeff11ac19",
"status": "wait",
"needs_human": false,
"workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f"
},
{
"record_id": "GLAS-WP-0012-T05",
"id": "f7635cf6-e044-52d4-8242-0512e0ccbd7b",
"status": "wait",
"needs_human": false,
"workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f"
},
{
"record_id": "GLAS-WP-0012-T06",
"id": "d0c26709-549f-540a-8250-1fd1b2e4960a",
"status": "done",
"needs_human": false,
"workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f"
}
],
"historical_prose_preserved": true,
"native_action_by_this_subtask": false
}

450
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.postimage.md Normal file
View file

@ -0,0 +1,450 @@
---
id: GLAS-WP-0012
type: workplan
title: "Prove the first local rein profile end to end"
domain: infotech
repo: glas-harness
status: blocked
flavor: implementation
owner: codex
topic_slug: first-local-profile-production-proof
created: "2026-09-05"
updated: "2026-09-27"
state_hub_workstream_id: "170bf1ae-337f-5553-8d1e-03b07100e08f"
---
# Prove the first local rein profile end to end
## Context and scope
Follow up the Claude-route portion of live residual `GLAS-IN-0002`, originating
in finished `GLAS-WP-0005`. Boundary hardening is committed at `63a7f9f` and
proved with a deterministic non-secret dispatch. That proof did not execute
the real rein CLI or make a model call.
Start from `harness.agent-dev-local@1.0.0` (rein-aharness,
`claude-sonnet-4-6`, `claude-code-cli`, `green-commit-only`). Review a new
versioned candidate after the owner runtime contract is available. Keep the
existing blocked selection as the rollback pin. The open-weight profile and
remote profile do not acquire readiness from this workplan.
Glas owns profile selection, its adapter, and acceptance evidence. Sand-boxer
owns runtime provisioning, execution environment, isolation, egress enforcement,
and teardown. The selected rein and credential owner own authentication and
credential acquisition. Use existing owner work `SAND-WP-0014-T05`; its current
OpenRouter dependency must be distinguished from this first Claude-route proof.
## Establish the exact local baseline and acceptance requirements
```task
id: GLAS-WP-0012-T01
status: done
priority: high
state_hub_task_id: "711aeb7e-4664-5078-8c65-3fe6f46f7999"
```
Completed 2026-09-05. Reviewed Glas `63a7f9f`, sand-boxer `b6655d8`, and
rein-aharness `1429db5`. Added a reproducible non-secret owner-execution runtime
inventory and the [acceptance contract](../docs/local-profile-acceptance.md).
The baseline can discover Python, Git, and a `claude` command. It cannot
discover `rein-aharness`, its Python module, or `llm_connect`. Command discovery
alone does not prove that Claude can start or authenticate. The namespace has
only loopback; declared egress and credential route references are empty.
Owner execution and workspace teardown pass. The baseline is therefore
insufficient for a real rein run.
Reviewed the plan against current implementation. Local preparation is done;
remaining execution waits on the owner inputs in T02.
## Resolve and verify the owner runtime, credential, and egress contract
```task
id: GLAS-WP-0012-T02
status: wait
depends_on: [SAND-WP-0014-T05]
blocking_reason: "Dependency: sand-boxer SAND-WP-0014-T05 with rein-aharness and its credential owner."
priority: high
state_hub_task_id: "4209f564-a9ee-57f9-9522-3708988801ef"
```
Dependency: sand-boxer `SAND-WP-0014-T05`, with rein-aharness and its credential
owner. Required deliverables are listed in `docs/local-profile-acceptance.md`:
- Exact runtime artifact/revision, in-sandbox entrypoints and dependencies,
sanitized environment, private writable state, and deployment/host identity.
- A Claude-compatible catalog credential route and owner implementation that
delivers it to the selected runtime. An environment label containing route
references is not credential delivery.
- An owner-defined sandbox profile with explicit enforced provider egress,
DNS/TLS requirements, and negative egress tests. Editing an egress list alone
does not provide connectivity in the current loopback-only implementation.
- Non-secret startup, identity, source-absence, and cleanup evidence through
the same manager/service path the gateway will use.
Done when these deliverables exist at reviewable revisions and their owner
proofs pass. No rein installation in the source checkout, host home mount,
credential injection from the interactive shell, or unrestricted network
substitution is an acceptance path.
2026-09-05 owner progress: SAND-WP-0015 implemented digest-pinned standalone
Python runtime mounting and private namespace state. Real rein CLI startup,
read-only runtime, source absence, clean worktree, state persistence across
exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132
tests pass. This completes the candidate runtime mechanism, not production
selection. Authentication lane, credential delivery/revocation, provider egress,
pinning the Claude executable, and deployed profile review remain open. The
credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See
[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner
CCR-2026-0016 (in flight). Organization/key metadata is supplied and the user saved the key in OpenBao.
A metadata-only owner check confirmed live version 2 on 2026-09-05, without
reading the value. Custody handoff is complete. Verified machine binding,
protected runtime delivery, workspace scope/budget and provider egress remain
outstanding; provider authentication has not been tested.
See docs/local-profile-acceptance.md.
## Review and validate the versioned Glas proof candidate
```task
id: GLAS-WP-0012-T03
status: wait
depends_on: [GLAS-WP-0012-T02, SECRETS-WP-0009-T03]
priority: high
blocking_reason: "Await the rebuilt runtime artifact carrying profile 1.1.1 started through its owner on railiance01 (SECRETS-WP-0009-T03 step B2)."
state_hub_task_id: "c660808a-1724-555c-bc59-7318870d3591"
```
Depends on T02. Prepare `harness.agent-dev-local@1.1.0` only once the real
sandbox profile and credential route are known. Keep the rein/model route and
tool profile explicit; choose bounded proof limits no greater than the current
900 seconds / 60,000 tokens. Record runtime and sandbox revisions and the
validated host scope in evidence. Account for dependency versions that are not
represented directly in the Glas profile schema.
Use `unverified` only after known blockers are resolved, to label the bounded
real proof. Validate schema, capabilities, route propagation, timeout behavior,
and refusal of the old blocked version. Version coexistence must make an
unversioned selection ambiguous rather than silently changing consumers.
Done when the exact candidate resolves, the real runtime starts through its
owner, the focused tests and full suite pass, and rollback to the blocked
`harness.agent-dev-local@1.0.0` pin is documented.
2026-09-21 candidate: `profiles/harness.agent-dev-local-1.1.0.yaml`, readiness
`unverified` (evidence_ref GLAS-WP-0012-T03), `profile.bwrap-local`, no
credential route refs, claude-sonnet-4-6, 900 s / 60,000 tokens, max_turns 30,
max_budget_usd 5.0. The provider key stays with rein-aharness MessagesOwner
outside bwrap (metered-once); the owner bootstrap's sandbox, model and
credential-route checks accept it. max_budget_usd matches the operator-accepted
spend envelope hfact-glas-anthropic-2026-09 (Informed Decision
infd-20260921-b01, approval ba5ce2d8). Unpinned selection is now ambiguous and
1.0.0 stays blocked; rollback is pinning 1.0.0. 134 tests pass. Remaining for
done: the rebuilt runtime artifact carrying this profile starts through its
owner on railiance01 (SECRETS-WP-0009-T03 step B2).
2026-09-23 the candidate is now `harness.agent-dev-local@1.1.1` (`claude-sonnet-5`,
otherwise identical). 1.1.0 is blocked, and rollback is still pinning 1.0.0.
Reviewed 2026-09-24: the catalog resolves 1.1.1 as unverified, and 134 tests pass.
The done condition is unchanged. It needs runtime `2cfc7b5f` rebuilt with 1.1.1
and started through its owner.
## Prove one real bounded rein task inside the sandbox
```task
id: GLAS-WP-0012-T04
status: wait
depends_on: [GLAS-WP-0012-T03]
blocking_reason: "Depends on T03."
priority: high
state_hub_task_id: "3e791432-8f37-54bd-a44a-55eeff11ac19"
```
Depends on T03. Run the actual `ReinAharness` adapter and installed
`rein-aharness` CLI with Claude through the candidate profile on a disposable
Git fixture. Do not substitute deterministic dispatch or change the source
checkout to satisfy the task. Verify the acceptance assertions in the contract,
including exactly one intended commit, a clean final tree, unchanged/inaccessible
host source, exact identity, bounded duration, task cleanup, and destruction.
Collect and validate the sandbox artifact before gateway teardown removes the
workspace. Implement the smallest necessary proof observer in the acceptance
fixture; direct evidence must distinguish actual content validation from a
reported commit SHA. Preserve compact value-free evidence only.
Done when the bounded real run and relevant failure/cleanup checks pass with
the exact selected profile/runtime pins and credential route identified.
## Publish evidence and mark only the proven profile ready
```task
id: GLAS-WP-0012-T05
status: wait
depends_on: [GLAS-WP-0012-T04]
blocking_reason: "Depends on T04."
priority: high
state_hub_task_id: "f7635cf6-e044-52d4-8242-0512e0ccbd7b"
```
Depends on T04. Update only the proven candidate to `ready` with evidence that
identifies the host/runtime scope, credential route, egress policy, revisions,
limits, and rollback. Run catalog validation and regression checks. Do not
enable production schedules as a side effect of this proof.
Update `GLAS-IN-0002` with the Claude acceptance result. Keep its open-weight
portion live, or split that remaining work into a separately registered record
before closing the intake. Synchronize work records and log progress. Finish
this workplan only when the first profile is proven and residuals remain live.
## Prepare the real-rein acceptance runner
```task
id: GLAS-WP-0012-T06
status: done
priority: high
state_hub_task_id: "d0c26709-549f-540a-8250-1fd1b2e4960a"
```
Independent preparation for T04 while T02 remains blocked. Add a disposable
fixture that delegates actual dispatch to the catalog-built ReinAharness,
validates the commit and artifact through owner execution before teardown,
checks the host source and cleanup, and emits bounded evidence without model
output or credential values. Refuse blocked or unpinned profiles before
creating a sandbox. Test negative artifact cases and the refusal path. This
runner does not itself satisfy T04 or change readiness.
Completed 2026-09-05. `scripts/prove-local-profile.py` delegates real dispatch
and observes content/commit acceptance before teardown. It verifies exactly one
new commit, expected paths and committed/worktree content, a clean tree,
source absence, exact child identity, private task mode/removal, and host-source
integrity plus workspace destruction. It emits bounded evidence and has no
readiness override. `tests/test_local_profile_proof.py`: 20 focused tests pass;
full suite: 101 passed; catalog validation passes. A real CLI invocation against
`harness.agent-dev-local@1.0.0` returned `OperationallyBlockedProfileError`
without creating a sandbox. T02–T05 remain waiting on the owner dependencies;
no real model run or readiness promotion is claimed.
## Acceptance
One version-pinned local profile runs its actual rein/model task entirely in
the declared sandbox, produces validated local output, and tears down cleanly.
Its readiness describes the proven runtime scope. Other profile readiness and
consumer schedules remain independently governed.
## 2026-09-05 egress owner return
Owner-controlled HTTPS egress is implemented and live-tested through both the
extension and a persisted manager: provider TLS/HTTP response, undeclared-host
and direct-IP denial, isolated namespace and proxy/workspace cleanup passed.
See [egress evidence](../docs/evidence/GLAS-WP-0012-egress-2026-09-05.md).
T02 remains waiting on machine auth, protected credential delivery, the pinned
Claude executable and the combined production acceptance. Profiles remain blocked.
## 2026-09-05 credential owner return
Sand-boxer credential transport is implemented and proved with synthetic
provider sandbox 880f749e. Owner config binds exact profile/project/actor and
run id; unknown routes refuse, shell API-key fallback is stripped, only the
workload child receives the value, and output redaction precedes truncation.
Tests: sand-boxer171, secrets-engine226, Glas101 pass. Native data-only read
policy/AppRole proposal and activation now live in SECRETS-WP-0009. Its
production exec refuses before OpenBao because durable access-engine decision
records and scoped service authority remain unavailable. T02 remains waiting
on that activation, pinned Claude startup and real provider/task acceptance.
## 2026-09-06 credential owner update
Reviewed secrets-engine message `3bd23bc9-e863-4f1f-8c76-415812ec0656`.
Owner reports the local authorization join implemented at `627810b`. Remaining
native activation depends on approval-engine serving the durable
ActionAuthorization claim endpoint and access-engine serving Check, followed
by configuration, per-lane approval and positive/negative verification.
State Hub decisions are not a substitute for the durable authorization object.
SECRETS-WP-0009-T03 and this plan's T02 remain waiting; runtime pinning and
combined real proof remain required. No readiness change or real-key read.
## 2026-09-06 authorization contract and policy publication
Reviewed owner commits `7b4b9e3` and `083bee7` and FLEX-WP-0021. Gate-house
GH-DEC-2026-005 resolved the contract: secrets-engine now validates the
approval-claim and decision envelope separately and removed the incorrect
State Hub authority requirement. Flex-auth published
`secrets-engine.catalog-lane.lifecycle` v1; T01/T02 are done.
Remaining owner gates are real decision/digest verification (FLEX-WP-0021-T03),
consumer service deployment and handoff (T04/T05), approval-engine deployment,
production service identity and verified lane activation. Publication is not
deployment. T02 stays waiting, and runtime pinning and combined acceptance
remain required. No new owner inbox message or activation evidence was found
in this review.
## 2026-09-06 digest verification follow-up
Reviewed secrets-engine `6e9c152` and `925d028`: owner corrected correlation
field handling in the flex-auth digest and refreshed fixtures. Its tests also
record an unresolved approval/native action-vocabulary and embedded-claim
digest mismatch for dual-control requests. This is owner integration evidence,
not successful live activation; SECRETS-WP-0009-T03 remains wait. No new
activation receipt was found in the Glas inbox. T02 remains waiting.
## 2026-09-06 authorization-chain owner return
Reviewed secrets-engine `f62d3fe` / `64aeec9`. Owner reports claim → Check →
consume → backend integration against a throwaway OpenBao, including denial,
unreachable service, invalid claim, missing digest, consume conflict and action
mismatch refusal before backend access. Authorization transport is stubbed;
wire shapes use published flex-auth fixtures. Do not describe this as a live
production service or Anthropic delivery proof.
Owner now identifies deployment/configuration as the remaining live gate:
consumer PDP service and approval-engine rollout, production service
credentials, deployed policy pin and per-lane authorization id.
SECRETS-WP-0009-T03 remains wait. Earlier digest-defect notes are historical;
use this latest owner return for the integration status. Native lane positive/
negative access checks, pinned Claude startup, provider scope/budget inputs and
combined Glas acceptance remain outstanding. T02–T05 stay wait.
Review found no pending local changes or new inbox messages. Corrected stale
README wording that still called owner execution missing; the implemented
mechanism and its separate proofs do not change profile readiness.
## 2026-09-06 production deployment action
User authorized production deployment. Dedicated flex-auth-secrets-engine Helm
release is available 1/1 at revision 1; five policy fixtures and allowed/denied
network probes passed. CI image is digest-pinned; existing consumers unchanged.
Caller authentication remains warn pending identity adoption. See
[deployment evidence](../history/2026-09-06-174000-production-deployment.md).
Approval-engine remains undeployed: live KeyCape clients and audit sender are
absent, the tenant contract needs alignment, and a release digest is required.
Corrected its stale issuer/JWKS deployment inputs. No production credential
lane or real Claude run was activated; T02 remains wait.
## Production dependency coordination
GLAS-WP-0015 now tracks exact owner handoffs and return receipts from Glas.
The requests in docs/production-dependency-handoffs.md reuse existing owner
work: tenant agreement and client custody, KeyCape rollout, audit source
onboarding, approval release, native lane activation and pinned combined
runtime. Image/runtime preparation can proceed in parallel. The runner's
project glas-local-proof must be reconciled with the owner route example's
project glas-harness before the exact delivery binding is selected. Owner
handoffs were sent after explicit authorization; GLAS-WP-0015 records all seven
receipt IDs and tracks replies. This plan's T02 remains wait.
## Verified owner follow-up — 2026-09-06
Glas reviewed six owner acknowledgements in GLAS-WP-0015. Project binding is
resolved to agt/glas-local-proof at sand-boxer 23d0c2b; the combined profile
source is available, but Claude is not pinned. The deployed policy was found
to lack tenant denial at v1; the owner correction v2 is now deployed at Helm
revision 2 and six live Check fixtures pass, including wrong_tenant denial.
Tenant choice, workstation caller access, audit load-bearing schema/admission,
identity/custody and native activation remain gates. T02 remains wait.
Tenant decision update (2026-09-06): operator approved `tenant:platform` for the
approval dependency chain as the platform management/services tenant. See
`docs/platform-tenant-decision.md`. The choice blocker is resolved; exact owner
configuration alignment and verification remain part of T02 before readiness.
Later deployment progress (2026-09-06): KeyCape/approval source tenant alignment
verified, approval release published and pinned, audit T03 complete, dedicated
PDP revision 3 enforces adopted short-lived caller identity. See GLAS-WP-0015
and its evidence receipts. T02 remains wait until remaining owner admission and
runtime gates are verified; no real model run or readiness promotion.
## Pinned Claude startup progress — 2026-09-06
Advanced sand-boxer SAND-WP-0015-T05 independently of custody: runtime builder
now copies only an explicitly digest-pinned native Claude executable. Selected
installed Claude 2.1.263, binary digest
26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba;
complete candidate runtime digest
5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922.
Sandbox f8821ec2 passed actual Claude --version, rein CLI/import, read-only
runtime, private HOME/state persistence, source absence, clean tree and teardown
with owner proxy environment present. Lint and all 175 sand-boxer tests pass.
Evidence: docs/evidence/GLAS-WP-0015-claude-startup-2026-09-06.json.
This resolves candidate binary pin/startup, not protected runtime deployment,
Claude provider-request compatibility, credential delivery or a real model run.
The candidate is in /tmp; no production profile readiness changed. Existing
credential and acceptance tasks remain open. No new owner replies at session start.
## Protected local artifact return — 2026-09-08
SAND-WP-0015-T06 is done. The previously pinned combined artifact is installed
unchanged in owner UID 1000's mode-0700 runtime store on bnt-lap001:
`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`.
Complete artifact digest remains
`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`.
This is the existing owner-controlled local artifact contract, not root-owned
system storage or Railiance placement. Do not rebuild this accepted candidate
merely to move it out of /tmp.
The installed-path sandbox `51b59587` proves actual Claude 2.1.263 and rein
startup, read-only runtime, source absence, clean Git, private state persistence,
loopback-only interfaces, and workspace/proxy removal. No credential references
or model request were used. Sand-boxer `make check`: lint clean, 188 tests pass.
Source return: 3e49a98a0e2c4a64539a5ccd674be8cd67ac9845; receipt in
`sand-boxer/docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`.
T02 remains wait for trusted owner execution configuration, native credentials
and real-provider evidence. T03-T06 retain candidate review, real-model run,
readiness and recovery obligations. No profile readiness or schedule changes.
2026-09-23 candidate superseded before use: operator chose `claude-sonnet-5`.
`harness.agent-dev-local@1.1.1` is identical to 1.1.0 except the model; 1.1.0 is
now `blocked`. Runtime `2cfc7b5f` bundles the earlier 1.1.0 copy (profile sha
`e84b9d0f…`) and must be rebuilt with this revision and placed again
(SECRETS-WP-0009-T03). Claude CLI 2.1.266 in that runtime lists
`claude-sonnet-5` in its model registry (static check). 134 tests pass.
## 2026-09-27 loose-ends review
Reviewed for locally finishable work. No new owner reply advances T02 beyond
the 2026-09-23 secrets-engine status already recorded in GLAS-WP-0015-T03.
T03's remaining done condition (runtime `2cfc7b5f` rebuilt with 1.1.1 and
started through its owner on railiance01, SECRETS-WP-0009-T03 step B2) and
T04/T05 all require that external owner delivery. Nothing in this repo can
advance them today; `status: blocked` stands unchanged. Re-review when the
runtime rebuild/placement or owner authentication lands.
## EMERGENT-WP-0002 proof requirements — 2026-10-03
Scoped review and local observed-model correction:
`docs/evidence/2026-10-03-emergent-session-readiness-review.md`.
T04 retains actual native-provider startup and continuity acceptance, including
reload after real resume/compaction, provider/repository changes and exact
available model/session metadata. The current lifecycle exposes no continuity
event API. Existing owner-delivery blockers and all task/readiness states remain;
local deterministic tests are not governed provider or isolation acceptance.
## 2026-10-16 NetKingdom isolated integration preparation
Prepared, without owner deployment or readiness promotion, a Glas change that
separates credential-free housekeeping commands from explicit rein workload
execution. Both concrete adapters use the workload path; SSH selections with
credential routes refuse because that transport has no owner delivery contract.
Full regression: 141 passed. Real disposable bwrap/Glas transport proof passes
synthetic host-file denial, inherited credential environment and subprocess
denial, workload-only delivery, redaction, subsequent-command absence and
teardown. No provider/model call or real credential read occurred.
Latest owner dependency sources supersede the stale missing-lane account:
September 27 native lanes were activated and revoked; corrected immutable
owner runtime is `818b1b7c…` (October 15 startup proof), not yet installed or
admitted on Railiance. HARNESS-WP-0008-T07 retains memo lifecycle acceptance,
installation, rehearsal, renewal/pin updates, native approvals and bounded
successful model/tool/commit acceptance. Any subsequent build containing this
patch has a different source/artifact pin requiring owner admission.
This is a reviewable patch in Custodian's NetKingdom change bundle; no canonical
source synchronization or workplan task completion is implied. CUST-WP-0073
continues to require admission of the actual interactive assignment, including
its existing host credential and external tool paths, not a disposable fixture.

450
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.preimage.md Normal file
View file

@ -0,0 +1,450 @@
---
id: GLAS-WP-0012
type: workplan
title: "Prove the first local rein profile end to end"
domain: infotech
repo: glas-harness
status: blocked
flavor: implementation
owner: codex
topic_slug: first-local-profile-production-proof
created: "2026-09-05"
updated: "2026-09-27"
state_hub_workstream_id: "170bf1ae-337f-5553-8d1e-03b07100e08f"
---
# Prove the first local rein profile end to end
## Context and scope
Follow up the Claude-route portion of live residual `GLAS-IN-0002`, originating
in finished `GLAS-WP-0005`. Boundary hardening is committed at `63a7f9f` and
proved with a deterministic non-secret dispatch. That proof did not execute
the real rein CLI or make a model call.
Start from `harness.agent-dev-local@1.0.0` (rein-aharness,
`claude-sonnet-4-6`, `claude-code-cli`, `green-commit-only`). Review a new
versioned candidate after the owner runtime contract is available. Keep the
existing blocked selection as the rollback pin. The open-weight profile and
remote profile do not acquire readiness from this workplan.
Glas owns profile selection, its adapter, and acceptance evidence. Sand-boxer
owns runtime provisioning, execution environment, isolation, egress enforcement,
and teardown. The selected rein and credential owner own authentication and
credential acquisition. Use existing owner work `SAND-WP-0014-T05`; its current
OpenRouter dependency must be distinguished from this first Claude-route proof.
## Establish the exact local baseline and acceptance requirements
```task
id: GLAS-WP-0012-T01
status: done
priority: high
state_hub_task_id: "711aeb7e-4664-5078-8c65-3fe6f46f7999"
```
Completed 2026-09-05. Reviewed Glas `63a7f9f`, sand-boxer `b6655d8`, and
rein-aharness `1429db5`. Added a reproducible non-secret owner-execution runtime
inventory and the [acceptance contract](../docs/local-profile-acceptance.md).
The baseline can discover Python, Git, and a `claude` command. It cannot
discover `rein-aharness`, its Python module, or `llm_connect`. Command discovery
alone does not prove that Claude can start or authenticate. The namespace has
only loopback; declared egress and credential route references are empty.
Owner execution and workspace teardown pass. The baseline is therefore
insufficient for a real rein run.
Reviewed the plan against current implementation. Local preparation is done;
remaining execution waits on the owner inputs in T02.
## Resolve and verify the owner runtime, credential, and egress contract
```task
id: GLAS-WP-0012-T02
status: wait
depends_on: [SAND-WP-0014-T05]
blocking_reason: "Dependency: sand-boxer SAND-WP-0014-T05 with rein-aharness and its credential owner."
priority: high
state_hub_task_id: "4209f564-a9ee-57f9-9522-3708988801ef"
```
Dependency: sand-boxer `SAND-WP-0014-T05`, with rein-aharness and its credential
owner. Required deliverables are listed in `docs/local-profile-acceptance.md`:
- Exact runtime artifact/revision, in-sandbox entrypoints and dependencies,
sanitized environment, private writable state, and deployment/host identity.
- A Claude-compatible catalog credential route and owner implementation that
delivers it to the selected runtime. An environment label containing route
references is not credential delivery.
- An owner-defined sandbox profile with explicit enforced provider egress,
DNS/TLS requirements, and negative egress tests. Editing an egress list alone
does not provide connectivity in the current loopback-only implementation.
- Non-secret startup, identity, source-absence, and cleanup evidence through
the same manager/service path the gateway will use.
Done when these deliverables exist at reviewable revisions and their owner
proofs pass. No rein installation in the source checkout, host home mount,
credential injection from the interactive shell, or unrestricted network
substitution is an acceptance path.
2026-09-05 owner progress: SAND-WP-0015 implemented digest-pinned standalone
Python runtime mounting and private namespace state. Real rein CLI startup,
read-only runtime, source absence, clean worktree, state persistence across
exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132
tests pass. This completes the candidate runtime mechanism, not production
selection. Authentication lane, credential delivery/revocation, provider egress,
pinning the Claude executable, and deployed profile review remain open. The
credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See
[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner
CCR-2026-0016 (in flight). Organization/key metadata is supplied and the user saved the key in OpenBao.
A metadata-only owner check confirmed live version 2 on 2026-09-05, without
reading the value. Custody handoff is complete. Verified machine binding,
protected runtime delivery, workspace scope/budget and provider egress remain
outstanding; provider authentication has not been tested.
See docs/local-profile-acceptance.md.
## Review and validate the versioned Glas proof candidate
```task
id: GLAS-WP-0012-T03
status: wait
depends_on: [GLAS-WP-0012-T02, SECRETS-WP-0009-T03]
priority: high
blocking_reason: "Await the rebuilt runtime artifact carrying profile 1.1.1 started through its owner on railiance01 (SECRETS-WP-0009-T03 step B2)."
state_hub_task_id: "c660808a-1724-555c-bc59-7318870d3591"
```
Depends on T02. Prepare `harness.agent-dev-local@1.1.0` only once the real
sandbox profile and credential route are known. Keep the rein/model route and
tool profile explicit; choose bounded proof limits no greater than the current
900 seconds / 60,000 tokens. Record runtime and sandbox revisions and the
validated host scope in evidence. Account for dependency versions that are not
represented directly in the Glas profile schema.
Use `unverified` only after known blockers are resolved, to label the bounded
real proof. Validate schema, capabilities, route propagation, timeout behavior,
and refusal of the old blocked version. Version coexistence must make an
unversioned selection ambiguous rather than silently changing consumers.
Done when the exact candidate resolves, the real runtime starts through its
owner, the focused tests and full suite pass, and rollback to the blocked
`harness.agent-dev-local@1.0.0` pin is documented.
2026-09-21 candidate: `profiles/harness.agent-dev-local-1.1.0.yaml`, readiness
`unverified` (evidence_ref GLAS-WP-0012-T03), `profile.bwrap-local`, no
credential route refs, claude-sonnet-4-6, 900 s / 60,000 tokens, max_turns 30,
max_budget_usd 5.0. The provider key stays with rein-aharness MessagesOwner
outside bwrap (metered-once); the owner bootstrap's sandbox, model and
credential-route checks accept it. max_budget_usd matches the operator-accepted
spend envelope hfact-glas-anthropic-2026-09 (Informed Decision
infd-20260921-b01, approval ba5ce2d8). Unpinned selection is now ambiguous and
1.0.0 stays blocked; rollback is pinning 1.0.0. 134 tests pass. Remaining for
done: the rebuilt runtime artifact carrying this profile starts through its
owner on railiance01 (SECRETS-WP-0009-T03 step B2).
2026-09-23 the candidate is now `harness.agent-dev-local@1.1.1` (`claude-sonnet-5`,
otherwise identical). 1.1.0 is blocked, and rollback is still pinning 1.0.0.
Reviewed 2026-09-24: the catalog resolves 1.1.1 as unverified, and 134 tests pass.
The done condition is unchanged. It needs runtime `2cfc7b5f` rebuilt with 1.1.1
and started through its owner.
## Prove one real bounded rein task inside the sandbox
```task
id: GLAS-WP-0012-T04
status: wait
depends_on: [GLAS-WP-0012-T03]
blocking_reason: "Depends on T03."
priority: high
state_hub_task_id: "3e791432-8f37-54bd-a44a-55eeff11ac19"
```
Depends on T03. Run the actual `ReinAharness` adapter and installed
`rein-aharness` CLI with Claude through the candidate profile on a disposable
Git fixture. Do not substitute deterministic dispatch or change the source
checkout to satisfy the task. Verify the acceptance assertions in the contract,
including exactly one intended commit, a clean final tree, unchanged/inaccessible
host source, exact identity, bounded duration, task cleanup, and destruction.
Collect and validate the sandbox artifact before gateway teardown removes the
workspace. Implement the smallest necessary proof observer in the acceptance
fixture; direct evidence must distinguish actual content validation from a
reported commit SHA. Preserve compact value-free evidence only.
Done when the bounded real run and relevant failure/cleanup checks pass with
the exact selected profile/runtime pins and credential route identified.
## Publish evidence and mark only the proven profile ready
```task
id: GLAS-WP-0012-T05
status: wait
depends_on: [GLAS-WP-0012-T04]
blocking_reason: "Depends on T04."
priority: high
state_hub_task_id: "f7635cf6-e044-52d4-8242-0512e0ccbd7b"
```
Depends on T04. Update only the proven candidate to `ready` with evidence that
identifies the host/runtime scope, credential route, egress policy, revisions,
limits, and rollback. Run catalog validation and regression checks. Do not
enable production schedules as a side effect of this proof.
Update `GLAS-IN-0002` with the Claude acceptance result. Keep its open-weight
portion live, or split that remaining work into a separately registered record
before closing the intake. Synchronize work records and log progress. Finish
this workplan only when the first profile is proven and residuals remain live.
## Prepare the real-rein acceptance runner
```task
id: GLAS-WP-0012-T06
status: done
priority: high
state_hub_task_id: "d0c26709-549f-540a-8250-1fd1b2e4960a"
```
Independent preparation for T04 while T02 remains blocked. Add a disposable
fixture that delegates actual dispatch to the catalog-built ReinAharness,
validates the commit and artifact through owner execution before teardown,
checks the host source and cleanup, and emits bounded evidence without model
output or credential values. Refuse blocked or unpinned profiles before
creating a sandbox. Test negative artifact cases and the refusal path. This
runner does not itself satisfy T04 or change readiness.
Completed 2026-09-05. `scripts/prove-local-profile.py` delegates real dispatch
and observes content/commit acceptance before teardown. It verifies exactly one
new commit, expected paths and committed/worktree content, a clean tree,
source absence, exact child identity, private task mode/removal, and host-source
integrity plus workspace destruction. It emits bounded evidence and has no
readiness override. `tests/test_local_profile_proof.py`: 20 focused tests pass;
full suite: 101 passed; catalog validation passes. A real CLI invocation against
`harness.agent-dev-local@1.0.0` returned `OperationallyBlockedProfileError`
without creating a sandbox. T02–T05 remain waiting on the owner dependencies;
no real model run or readiness promotion is claimed.
## Acceptance
One version-pinned local profile runs its actual rein/model task entirely in
the declared sandbox, produces validated local output, and tears down cleanly.
Its readiness describes the proven runtime scope. Other profile readiness and
consumer schedules remain independently governed.
## 2026-09-05 egress owner return
Owner-controlled HTTPS egress is implemented and live-tested through both the
extension and a persisted manager: provider TLS/HTTP response, undeclared-host
and direct-IP denial, isolated namespace and proxy/workspace cleanup passed.
See [egress evidence](../docs/evidence/GLAS-WP-0012-egress-2026-09-05.md).
T02 remains waiting on machine auth, protected credential delivery, the pinned
Claude executable and the combined production acceptance. Profiles remain blocked.
## 2026-09-05 credential owner return
Sand-boxer credential transport is implemented and proved with synthetic
provider sandbox 880f749e. Owner config binds exact profile/project/actor and
run id; unknown routes refuse, shell API-key fallback is stripped, only the
workload child receives the value, and output redaction precedes truncation.
Tests: sand-boxer171, secrets-engine226, Glas101 pass. Native data-only read
policy/AppRole proposal and activation now live in SECRETS-WP-0009. Its
production exec refuses before OpenBao because durable access-engine decision
records and scoped service authority remain unavailable. T02 remains waiting
on that activation, pinned Claude startup and real provider/task acceptance.
## 2026-09-06 credential owner update
Reviewed secrets-engine message `3bd23bc9-e863-4f1f-8c76-415812ec0656`.
Owner reports the local authorization join implemented at `627810b`. Remaining
native activation depends on approval-engine serving the durable
ActionAuthorization claim endpoint and access-engine serving Check, followed
by configuration, per-lane approval and positive/negative verification.
State Hub decisions are not a substitute for the durable authorization object.
SECRETS-WP-0009-T03 and this plan's T02 remain waiting; runtime pinning and
combined real proof remain required. No readiness change or real-key read.
## 2026-09-06 authorization contract and policy publication
Reviewed owner commits `7b4b9e3` and `083bee7` and FLEX-WP-0021. Gate-house
GH-DEC-2026-005 resolved the contract: secrets-engine now validates the
approval-claim and decision envelope separately and removed the incorrect
State Hub authority requirement. Flex-auth published
`secrets-engine.catalog-lane.lifecycle` v1; T01/T02 are done.
Remaining owner gates are real decision/digest verification (FLEX-WP-0021-T03),
consumer service deployment and handoff (T04/T05), approval-engine deployment,
production service identity and verified lane activation. Publication is not
deployment. T02 stays waiting, and runtime pinning and combined acceptance
remain required. No new owner inbox message or activation evidence was found
in this review.
## 2026-09-06 digest verification follow-up
Reviewed secrets-engine `6e9c152` and `925d028`: owner corrected correlation
field handling in the flex-auth digest and refreshed fixtures. Its tests also
record an unresolved approval/native action-vocabulary and embedded-claim
digest mismatch for dual-control requests. This is owner integration evidence,
not successful live activation; SECRETS-WP-0009-T03 remains wait. No new
activation receipt was found in the Glas inbox. T02 remains waiting.
## 2026-09-06 authorization-chain owner return
Reviewed secrets-engine `f62d3fe` / `64aeec9`. Owner reports claim → Check →
consume → backend integration against a throwaway OpenBao, including denial,
unreachable service, invalid claim, missing digest, consume conflict and action
mismatch refusal before backend access. Authorization transport is stubbed;
wire shapes use published flex-auth fixtures. Do not describe this as a live
production service or Anthropic delivery proof.
Owner now identifies deployment/configuration as the remaining live gate:
consumer PDP service and approval-engine rollout, production service
credentials, deployed policy pin and per-lane authorization id.
SECRETS-WP-0009-T03 remains wait. Earlier digest-defect notes are historical;
use this latest owner return for the integration status. Native lane positive/
negative access checks, pinned Claude startup, provider scope/budget inputs and
combined Glas acceptance remain outstanding. T02–T05 stay wait.
Review found no pending local changes or new inbox messages. Corrected stale
README wording that still called owner execution missing; the implemented
mechanism and its separate proofs do not change profile readiness.
## 2026-09-06 production deployment action
User authorized production deployment. Dedicated flex-auth-secrets-engine Helm
release is available 1/1 at revision 1; five policy fixtures and allowed/denied
network probes passed. CI image is digest-pinned; existing consumers unchanged.
Caller authentication remains warn pending identity adoption. See
[deployment evidence](../history/2026-09-06-174000-production-deployment.md).
Approval-engine remains undeployed: live KeyCape clients and audit sender are
absent, the tenant contract needs alignment, and a release digest is required.
Corrected its stale issuer/JWKS deployment inputs. No production credential
lane or real Claude run was activated; T02 remains wait.
## Production dependency coordination
GLAS-WP-0015 now tracks exact owner handoffs and return receipts from Glas.
The requests in docs/production-dependency-handoffs.md reuse existing owner
work: tenant agreement and client custody, KeyCape rollout, audit source
onboarding, approval release, native lane activation and pinned combined
runtime. Image/runtime preparation can proceed in parallel. The runner's
project glas-local-proof must be reconciled with the owner route example's
project glas-harness before the exact delivery binding is selected. Owner
handoffs were sent after explicit authorization; GLAS-WP-0015 records all seven
receipt IDs and tracks replies. This plan's T02 remains wait.
## Verified owner follow-up — 2026-09-06
Glas reviewed six owner acknowledgements in GLAS-WP-0015. Project binding is
resolved to agt/glas-local-proof at sand-boxer 23d0c2b; the combined profile
source is available, but Claude is not pinned. The deployed policy was found
to lack tenant denial at v1; the owner correction v2 is now deployed at Helm
revision 2 and six live Check fixtures pass, including wrong_tenant denial.
Tenant choice, workstation caller access, audit load-bearing schema/admission,
identity/custody and native activation remain gates. T02 remains wait.
Tenant decision update (2026-09-06): operator approved `tenant:platform` for the
approval dependency chain as the platform management/services tenant. See
`docs/platform-tenant-decision.md`. The choice blocker is resolved; exact owner
configuration alignment and verification remain part of T02 before readiness.
Later deployment progress (2026-09-06): KeyCape/approval source tenant alignment
verified, approval release published and pinned, audit T03 complete, dedicated
PDP revision 3 enforces adopted short-lived caller identity. See GLAS-WP-0015
and its evidence receipts. T02 remains wait until remaining owner admission and
runtime gates are verified; no real model run or readiness promotion.
## Pinned Claude startup progress — 2026-09-06
Advanced sand-boxer SAND-WP-0015-T05 independently of custody: runtime builder
now copies only an explicitly digest-pinned native Claude executable. Selected
installed Claude 2.1.263, binary digest
26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba;
complete candidate runtime digest
5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922.
Sandbox f8821ec2 passed actual Claude --version, rein CLI/import, read-only
runtime, private HOME/state persistence, source absence, clean tree and teardown
with owner proxy environment present. Lint and all 175 sand-boxer tests pass.
Evidence: docs/evidence/GLAS-WP-0015-claude-startup-2026-09-06.json.
This resolves candidate binary pin/startup, not protected runtime deployment,
Claude provider-request compatibility, credential delivery or a real model run.
The candidate is in /tmp; no production profile readiness changed. Existing
credential and acceptance tasks remain open. No new owner replies at session start.
## Protected local artifact return — 2026-09-08
SAND-WP-0015-T06 is done. The previously pinned combined artifact is installed
unchanged in owner UID 1000's mode-0700 runtime store on bnt-lap001:
`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`.
Complete artifact digest remains
`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`.
This is the existing owner-controlled local artifact contract, not root-owned
system storage or Railiance placement. Do not rebuild this accepted candidate
merely to move it out of /tmp.
The installed-path sandbox `51b59587` proves actual Claude 2.1.263 and rein
startup, read-only runtime, source absence, clean Git, private state persistence,
loopback-only interfaces, and workspace/proxy removal. No credential references
or model request were used. Sand-boxer `make check`: lint clean, 188 tests pass.
Source return: 3e49a98a0e2c4a64539a5ccd674be8cd67ac9845; receipt in
`sand-boxer/docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`.
T02 remains wait for trusted owner execution configuration, native credentials
and real-provider evidence. T03-T06 retain candidate review, real-model run,
readiness and recovery obligations. No profile readiness or schedule changes.
2026-09-23 candidate superseded before use: operator chose `claude-sonnet-5`.
`harness.agent-dev-local@1.1.1` is identical to 1.1.0 except the model; 1.1.0 is
now `blocked`. Runtime `2cfc7b5f` bundles the earlier 1.1.0 copy (profile sha
`e84b9d0f…`) and must be rebuilt with this revision and placed again
(SECRETS-WP-0009-T03). Claude CLI 2.1.266 in that runtime lists
`claude-sonnet-5` in its model registry (static check). 134 tests pass.
## 2026-09-27 loose-ends review
Reviewed for locally finishable work. No new owner reply advances T02 beyond
the 2026-09-23 secrets-engine status already recorded in GLAS-WP-0015-T03.
T03's remaining done condition (runtime `2cfc7b5f` rebuilt with 1.1.1 and
started through its owner on railiance01, SECRETS-WP-0009-T03 step B2) and
T04/T05 all require that external owner delivery. Nothing in this repo can
advance them today; `status: blocked` stands unchanged. Re-review when the
runtime rebuild/placement or owner authentication lands.
## EMERGENT-WP-0002 proof requirements — 2026-10-03
Scoped review and local observed-model correction:
`docs/evidence/2026-10-03-emergent-session-readiness-review.md`.
T04 retains actual native-provider startup and continuity acceptance, including
reload after real resume/compaction, provider/repository changes and exact
available model/session metadata. The current lifecycle exposes no continuity
event API. Existing owner-delivery blockers and all task/readiness states remain;
local deterministic tests are not governed provider or isolation acceptance.
## 2026-10-16 NetKingdom isolated integration preparation
Prepared, without owner deployment or readiness promotion, a Glas change that
separates credential-free housekeeping commands from explicit rein workload
execution. Both concrete adapters use the workload path; SSH selections with
credential routes refuse because that transport has no owner delivery contract.
Full regression: 141 passed. Real disposable bwrap/Glas transport proof passes
synthetic host-file denial, inherited credential environment and subprocess
denial, workload-only delivery, redaction, subsequent-command absence and
teardown. No provider/model call or real credential read occurred.
Latest owner dependency sources supersede the stale missing-lane account:
September 27 native lanes were activated and revoked; corrected immutable
owner runtime is `818b1b7c…` (October 15 startup proof), not yet installed or
admitted on Railiance. REINAH-WP-0008-T07 retains memo lifecycle acceptance,
installation, rehearsal, renewal/pin updates, native approvals and bounded
successful model/tool/commit acceptance. Any subsequent build containing this
patch has a different source/artifact pin requiring owner admission.
This is a reviewable patch in Custodian's NetKingdom change bundle; no canonical
source synchronization or workplan task completion is implied. CUST-WP-0073
continues to require admission of the actual interactive assignment, including
its existing host credential and external tool paths, not a disposable fixture.

46
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/manifest.json Normal file
View file

@ -0,0 +1,46 @@
{
"schema": "custodian.identity-binding-publication-artifacts.v1",
"status": "verified",
"files": {
"glas-harness/consistency.json": "sha256:67309a476a94778c13cfcc1cddc1f23caa51bbedae0e324f5a9af4780aba1bed",
"glas-harness/consistency.stderr.txt": "sha256:f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba",
"glas-harness/index.preimage": "sha256:be6359bc304b09f0a3479e8c3cab02483c42a11c57aedf222000c153693b9843",
"glas-harness/projection.json": "sha256:6683a110a420e37724e322b50ff91eb867ae4e6533f5f97b45c145fb14b1a845",
"glas-harness/projection.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"glas-harness/publication-backup/.custodian-brief.md.worktree": "sha256:958a7f356e71829b5115026404f7b9756cd7cf08bf882fad0990a0897ddf8b19",
"glas-harness/publication-backup/WORK-RECORDS.md.worktree": "sha256:ffdc5dc4868a3b5b0b836f875b31bef7f52f699df6779ab06a5b6cb865b3ebf9",
"glas-harness/publication-backup/originals.json": "sha256:73b9f5cbead35abb248e7fe91198728628ad61ad852b4e8125e9a31bf295c574",
"glas-harness/publication-commit.json": "sha256:567b941b59b9dde2a26a00aacd233442b76c46799f10c2873f918e08adf8cba3",
"glas-harness/publication-manifest.json": "sha256:4bc573e2691ba00d1ccdb7da753a1640fbc6b7a8945d9ebcc16fb510c034c4dd",
"glas-harness/source-before.json": "sha256:8ce1f39ff2cdceb5c36bbf6f8ef9442c947366415200ed04f1dda61e56071387",
"glas-harness/verified-bindings.json": "sha256:3c708759395d3ca0fbed312c2dfb458d200c95154e35239d3006bf496c2caafd",
"glas-harness/workplan.postimage.md": "sha256:23f97bc183bef2b0f38eb40c64bc0bb010df1c1eb4596ff3b5e0f73da7c2fcfc",
"glas-harness/workplan.preimage.md": "sha256:881ab0f5ba3bb43f5404c8f4cd23f9628e014992ba88fc13f541f0fa8b7b1eaa",
"rein-aharness/consistency.json": "sha256:92476d31cac32366e7186ecf2e6facb837eeedcb388c138581644c013947b01b",
"rein-aharness/consistency.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"rein-aharness/projection.json": "sha256:1a6ea4eaae65043a7dc81aaac77442714280e20ed8841c7e0df2aea0f7993763",
"rein-aharness/projection.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"rein-aharness/publication-backup/.custodian-brief.md.worktree": "sha256:8835f9bcfc7d5be193cef0b76aea1c896346a6a801f710704b0cb58544d44918",
"rein-aharness/publication-backup/WORK-RECORDS.md.worktree": "sha256:baa1b17a2d69493a6dd3a704543afd75ffae7bae25f582160c98bb2fba4118aa",
"rein-aharness/publication-backup/originals.json": "sha256:72a3bb6c69e2d37225d736e8a3dcb1f67d19d18ed7dc82e5796fb427aa6bedb3",
"rein-aharness/publication-commit.json": "sha256:98a00d07f82b093d6555ff12d9e2ba77bbb05e252aa6dd6301436c0c3945f84e",
"rein-aharness/publication-manifest.json": "sha256:49c712f3b5654ebd3d0169e322af099f0a8f2e0f119e5ea1c86f4d394484a1cb",
"rein-aharness/verified-bindings.json": "sha256:edeb1aafd91c7d97fb455ce7e5972fb803f6f97f5fe3c8623bffcf281b5749f3",
"sand-boxer/consistency.json": "sha256:98727575e0892fb517a7e8eb56d30ebdd70c7af6c2bfe91f24b45cdce192d697",
"sand-boxer/consistency.stderr.txt": "sha256:f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba",
"sand-boxer/index.preimage": "sha256:e9c14c64f7319eed77603103a13f1422726121bd9ee475902f4501a8781bf02d",
"sand-boxer/projection.json": "sha256:b8effe52919d42865a33e4e9f63ed288ee61f201a778877dc294b611c9352b99",
"sand-boxer/projection.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"sand-boxer/publication-backup/.custodian-brief.md.worktree": "sha256:5c1fbfeaeadda850d0c373a110d49143de4ff89fd0d2902add3025807de5fe85",
"sand-boxer/publication-backup/WORK-RECORDS.md.worktree": "sha256:a646f4444c6237c5a5e060bc22fa46c8129e010cdb8dcc5e78e721ad49413425",
"sand-boxer/publication-backup/originals.json": "sha256:f9c22541d53757843e2bf6aeb2eb59455466654a0d861ed4eb37c0434290c5c9",
"sand-boxer/publication-commit.json": "sha256:6e3f1b7c11a6dfe6fbb8c6eb4946858f6e930597c0ca493efcc98ad3dfa44ad4",
"sand-boxer/publication-manifest.json": "sha256:8e1166d27d8f9279a3dbc328e2486405a9a574fdbdd7710cb251f09e3dd0ccea",
"sand-boxer/required-checks.json": "sha256:57875a26b2bb1ed486d206adedce2b9aec8b1d7df83214f6bda70d48957a0031",
"sand-boxer/source-before.json": "sha256:946a90aae4fddeb082e69f21dc876ff8590937f0aeadfb2f445927eb553bb9af",
"sand-boxer/verified-bindings.json": "sha256:3c7f37a6060d7bfdbdbb578ba08354f50ff5c9003a138bd52955d49be1f9bb38",
"sand-boxer/workplan.postimage.md": "sha256:56022703fd4d973f40ddad8eb99cb02783b086549b24ef89f89157de33eafe31",
"sand-boxer/workplan.preimage.md": "sha256:230d1ef37aa9c2023335a617492a72678c4671a8bc82d5577e9d7a7cea6e8fe4",
"verified-publication.json": "sha256:bc58522a93b0e225dec68728d010b846af8413486e17d94bd5d0c393da679dea"
}
}

71
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.json Normal file
View file

@ -0,0 +1,71 @@
{
"repo_slug": "rein-aharness",
"repo_path": "/home/worsch/rein-aharness",
"source_revision": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1",
"source_revision_reason": null,
"issues": [
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['HARNESS-WP', 'REINAH-WP']",
"file_path": "workplans/",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-33",
"message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)",
"file_path": "WORK-RECORDS.md",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": true
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'ACTIVITY-WP-0026' is not linked to State Hub",
"file_path": "workplans/REINAH-WP-0005-ops-run-claim-loop.md",
"db_id": "",
"file_value": "ACTIVITY-WP-0026",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-39",
"message": "Human wait task 'HARNESS-WP-0008-T07' in workplan 'HARNESS-WP-0008' has needs_human: true without decision_id \u2014 unrouted human gate",
"file_path": "workplans/REINAH-WP-0008-simpler-metered-retry.md#HARNESS-WP-0008-T07",
"db_id": "",
"file_value": "needs_human: true",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-26",
"message": "Workplan id 'HARNESS-WP-0008' uses prefix 'HARNESS-WP' but repo canonical prefix is 'REINAH-WP' \u2014 new plans must conform",
"file_path": "workplans/REINAH-WP-0008-simpler-metered-retry.md",
"db_id": "",
"file_value": "HARNESS-WP-0008",
"db_value": "REINAH-WP",
"fixable": false
}
],
"fixes_applied": [
"bindings: synced 9/9",
"C-17 cleared: pushed 1 backlogged commit(s)",
"C-33 fixed: regenerated WORK-RECORDS.md",
"push: pushed"
],
"summary": {
"fail": 0,
"automation_error": 0,
"warn": 5,
"info": 0
},
"result": "warn"
}

0
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.stderr.txt Normal file
View file

124
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.json Normal file
View file

@ -0,0 +1,124 @@
{
"ok": true,
"status": "applied",
"repo_slug": "rein-aharness",
"commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1",
"requests": 2,
"elapsed_ms": 1898.6,
"git": {
"upstream": "origin/main",
"behind": 0,
"ahead": 0
},
"identifiers": {
"schema": "repo-manager.identifier-assignment.v1",
"ok": true,
"executed": true,
"repo": "rein-aharness",
"namespace": "helixforge",
"assignments": [],
"historical_invalid_identifiers": [],
"historical_identity_collisions": [],
"files_changed": []
},
"receipt": {
"schema": "state-hub.repository-projection-reconcile.v1",
"instance_role": "primary",
"instance_label": "railiance01",
"expected_commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1",
"derived_commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1",
"outcome": {
"schema": "state-hub.projection-reset.v1",
"repo_slug": "rein-aharness",
"commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1",
"status": "applied",
"counts": {
"created": 0,
"updated": 9,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 7,
"cancelled_tasks": 0,
"created_edges": 1,
"removed_edges": 0,
"unresolved_edges": 0,
"external_edges": 3
},
"created": [],
"updated": [
"HARNESS-WP-0008",
"HARNESS-WP-ADHOC-2026-09-04",
"REINAH-WP-0001",
"REINAH-WP-0002",
"REINAH-WP-0003",
"REINAH-WP-0004",
"REINAH-WP-0005",
"REINAH-WP-0006",
"REINAH-WP-0007"
],
"retired": [],
"released": [],
"created_tasks": [],
"updated_tasks": [
"HARNESS-WP-0008-T01",
"HARNESS-WP-0008-T02",
"HARNESS-WP-0008-T03",
"HARNESS-WP-0008-T04",
"HARNESS-WP-0008-T05",
"HARNESS-WP-0008-T06",
"HARNESS-WP-0008-T07"
],
"cancelled_tasks": [],
"created_edges": [
{
"workplan": "REINAH-WP-0005",
"from": "REINAH-WP-0005",
"target": "ACTIVITY-WP-0026",
"relationship_type": "blocks",
"from_workplan_id": "7d023961-af5b-59dc-96ec-85d45f67cfa4",
"from_task_id": null,
"to_workplan_id": "d05e49dd-dbc9-59f4-bbc8-8bfced64d4a8",
"to_task_id": null
}
],
"removed_edges": [],
"unresolved_edges": [],
"external_edges": [
{
"workplan": "REINAH-WP-0003",
"from": "REINAH-WP-0003-T06",
"target": "REINAH-WP-0003-T05",
"relationship_type": "starts_after",
"from_workplan_id": "eba2eff1-10a7-50a3-a70b-14e7d398f27f",
"from_task_id": "68a13c4f-0cc7-5d0b-917e-441164da8c84",
"to_workplan_id": null,
"to_task_id": "c4a3f08f-2874-5672-9f29-aecddd697d90"
},
{
"workplan": "REINAH-WP-0003",
"from": "REINAH-WP-0003-T06",
"target": "REINAH-WP-0003-T04",
"relationship_type": "starts_after",
"from_workplan_id": "eba2eff1-10a7-50a3-a70b-14e7d398f27f",
"from_task_id": "68a13c4f-0cc7-5d0b-917e-441164da8c84",
"to_workplan_id": null,
"to_task_id": "f6c7f80c-3807-54ac-b44a-ef582433b927"
},
{
"workplan": "REINAH-WP-0003",
"from": "REINAH-WP-0003-T06",
"target": "GLAS-WP-0012",
"relationship_type": "blocks",
"from_workplan_id": "eba2eff1-10a7-50a3-a70b-14e7d398f27f",
"from_task_id": "68a13c4f-0cc7-5d0b-917e-441164da8c84",
"to_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f",
"to_task_id": null
}
],
"refused": [],
"notes": []
}
}
}

0
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.stderr.txt Normal file
View file

36
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/.custodian-brief.md.worktree Normal file
View file

@ -0,0 +1,36 @@
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
# Custodian Brief — rein-aharness
**Domain:** agents
**Last synced:** 2026-10-14 00:11 UTC
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
## Active Workstreams
### Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal
Progress: 4/7 done | workplan_id: `187c2599-84a6-5764-a14f-7e9121975bf2`
**Open tasks:**
- ! E. Ship the owner runtime as a container image (decision) `b486e86b`
- ! F. Approvals per envelope (decision) `4cf721e6`
- ! Retry on the corrected runtime `80318842`
*(wait: Owner: accept spend memo infd-20261014-b01, then attended install, rehearsal, renew and approvals on railiance01)*
### Governed runtime integrity and intent convergence
Progress: 3/6 done | workplan_id: `eba2eff1-10a7-50a3-a70b-14e7d398f27f`
**Open tasks:**
- ! Remove tenant logic from the shared runtime `f6c7f80c`
*(wait: Migration of profile-absent FI/Binky definitions with Activity Core, kaizen-agentic and tenant owners.)*
- ! Align deployment, recovery, and conformance with the supported runtime `c4a3f08f`
*(wait: Fixture recovery, rate, and queue-injection evidence is local only (2026-10-08). Activity-core has not replied to 27cd4c47: a 409 stays claimed because this worker must not terminal-close a lost lease. Fixture micro-USD rates are not a live tariff. Admission does not deploy or start a paid request.)*
- ! Re-prove one governed profiled run and close residuals `68a13c4f`
*(wait: After T01-T05 and upstream GLAS-IN-0002/GLAS-WP-0012.)*
---
## MCP Orientation (when available)
If the state-hub MCP server is reachable, call:
`get_domain_summary("agents")`
This provides richer cross-domain context.
If the MCP call fails, use this file as your orientation source.

60
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/WORK-RECORDS.md.worktree Normal file
View file

@ -0,0 +1,60 @@
# Work Records — rein-aharness
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
> stage 3). Do not edit by hand — edit the source file/block listed for
> each record and re-run fix-consistency to refresh this index. Archived
> workplans are omitted; closed decisions/intakes/engagements stay listed
> so recently-resolved work is still visible. [auto]
| Kind | ID | Status | Lane | Source |
| --- | --- | --- | --- | --- |
| workplan | HARNESS-WP-ADHOC-2026-09-04 | finished | — | workplans/ADHOC-2026-09-04.md |
| workplan | REINAH-WP-0001 | finished | — | workplans/REINAH-WP-0001-harness-foundation.md |
| workplan | REINAH-WP-0002 | finished | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md |
| workplan | REINAH-WP-0003 | blocked | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md |
| workplan | REINAH-WP-0004 | finished | — | workplans/REINAH-WP-0004-statehub-bootstrap.md |
| workplan | REINAH-WP-0005 | finished | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md |
| workplan | REINAH-WP-0006 | finished | — | workplans/REINAH-WP-0006-binky-weekly-review-approach.md |
| workplan | REINAH-WP-0007 | finished | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md |
| workplan | REINAH-WP-0008 | blocked | — | workplans/REINAH-WP-0008-simpler-metered-retry.md |
| task | HARNESS-WP-ADHOC-2026-09-04-T01 | done | — | workplans/ADHOC-2026-09-04.md |
| task | REINAH-WP-0001-T01 | done | — | workplans/REINAH-WP-0001-harness-foundation.md |
| task | REINAH-WP-0001-T02 | done | — | workplans/REINAH-WP-0001-harness-foundation.md |
| task | REINAH-WP-0001-T03 | done | — | workplans/REINAH-WP-0001-harness-foundation.md |
| task | REINAH-WP-0001-T04 | done | — | workplans/REINAH-WP-0001-harness-foundation.md |
| task | REINAH-WP-0001-T05 | done | — | workplans/REINAH-WP-0001-harness-foundation.md |
| task | REINAH-WP-0001-T06 | done | — | workplans/REINAH-WP-0001-harness-foundation.md |
| task | REINAH-WP-0001-T07 | done | — | workplans/REINAH-WP-0001-harness-foundation.md |
| task | REINAH-WP-0002-T01 | done | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md |
| task | REINAH-WP-0002-T02 | done | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md |
| task | REINAH-WP-0002-T03 | done | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md |
| task | REINAH-WP-0002-T04 | done | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md |
| task | REINAH-WP-0003-T01 | done | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md |
| task | REINAH-WP-0003-T02 | done | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md |
| task | REINAH-WP-0003-T03 | done | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md |
| task | REINAH-WP-0003-T04 | wait | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md |
| task | REINAH-WP-0003-T05 | wait | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md |
| task | REINAH-WP-0003-T06 | wait | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md |
| task | REINAH-WP-0004-T01 | done | — | workplans/REINAH-WP-0004-statehub-bootstrap.md |
| task | REINAH-WP-0004-T02 | done | — | workplans/REINAH-WP-0004-statehub-bootstrap.md |
| task | REINAH-WP-0004-T03 | done | — | workplans/REINAH-WP-0004-statehub-bootstrap.md |
| task | REINAH-WP-0005-T01 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md |
| task | REINAH-WP-0005-T02 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md |
| task | REINAH-WP-0005-T03 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md |
| task | REINAH-WP-0005-T04 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md |
| task | REINAH-WP-0005-T05 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md |
| task | REINAH-WP-0005-T06 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md |
| task | REINAH-WP-0006-T01 | done | — | workplans/REINAH-WP-0006-binky-weekly-review-approach.md |
| task | REINAH-WP-0006-T02 | done | — | workplans/REINAH-WP-0006-binky-weekly-review-approach.md |
| task | REINAH-WP-0006-T03 | done | — | workplans/REINAH-WP-0006-binky-weekly-review-approach.md |
| task | REINAH-WP-0007-T01 | done | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md |
| task | REINAH-WP-0007-T02 | done | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md |
| task | REINAH-WP-0007-T03 | done | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md |
| task | REINAH-WP-0007-T04 | done | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md |
| task | REINAH-WP-0008-T01 | done | — | workplans/REINAH-WP-0008-simpler-metered-retry.md |
| task | REINAH-WP-0008-T02 | done | — | workplans/REINAH-WP-0008-simpler-metered-retry.md |
| task | REINAH-WP-0008-T03 | done | — | workplans/REINAH-WP-0008-simpler-metered-retry.md |
| task | REINAH-WP-0008-T04 | done | — | workplans/REINAH-WP-0008-simpler-metered-retry.md |
| task | REINAH-WP-0008-T05 | wait | — | workplans/REINAH-WP-0008-simpler-metered-retry.md |
| task | REINAH-WP-0008-T06 | wait | — | workplans/REINAH-WP-0008-simpler-metered-retry.md |
| task | REINAH-WP-0008-T07 | wait | — | workplans/REINAH-WP-0008-simpler-metered-retry.md |

10
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/originals.json Normal file
View file

@ -0,0 +1,10 @@
[
{
"path": ".custodian-brief.md",
"index": "100644 0854f3ee6418b8547d97c4f8a0ea119cd35c9c1a 0\t.custodian-brief.md"
},
{
"path": "WORK-RECORDS.md",
"index": "100644 9c23f62f341f77166e543af80f75c55a3763d24a 0\tWORK-RECORDS.md"
}
]

17
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-commit.json Normal file
View file

@ -0,0 +1,17 @@
{
"exit_code": 0,
"commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1",
"base": "9b88cadaa817e5abea7950b4a264d4e2739a5ddb",
"files": [
{
"path": "AGENTS.md",
"sha256": "da71c6e3d76d7c867b2db6e67cd919fba594acc3804d3784dd744438103560c2"
},
{
"path": "workplans/REINAH-WP-0008-simpler-metered-retry.md",
"sha256": "1118924bb159f8a52a37ace8b8663c75274b89928f7a8b957638428af224b054"
}
],
"stdout": "[main 0b7a9cf] docs(identity): restore issued HARNESS metered retry identifiers\n 2 files changed, 25 insertions(+), 12 deletions(-)\n",
"stderr": ""
}

15
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-manifest.json Normal file
View file

@ -0,0 +1,15 @@
{
"owner": "rein-aharness",
"base_revision": "9b88cadaa817e5abea7950b4a264d4e2739a5ddb",
"message": "docs(identity): restore issued HARNESS metered retry identifiers",
"files": [
{
"path": "AGENTS.md",
"sha256": "da71c6e3d76d7c867b2db6e67cd919fba594acc3804d3784dd744438103560c2"
},
{
"path": "workplans/REINAH-WP-0008-simpler-metered-retry.md",
"sha256": "1118924bb159f8a52a37ace8b8663c75274b89928f7a8b957638428af224b054"
}
]
}

84
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/verified-bindings.json Normal file
View file

@ -0,0 +1,84 @@
{
"observed_at": "2026-10-17T10:58:01.748067+00:00",
"status": "verified_published_identity_restoration",
"commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1",
"projection_counts": {
"created": 0,
"updated": 9,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 7,
"cancelled_tasks": 0,
"created_edges": 1,
"removed_edges": 0,
"unresolved_edges": 0,
"external_edges": 3
},
"all7_record_ids_filled": true,
"all8UUIDs_statuses_human_decisions_preserved": true,
"both_original_dependency_rows_retained": true,
"parent_slug": "harness-wp-0008",
"parent_status": "blocked",
"parent_projection_retired_at": null,
"tasks": [
{
"id": "c6536c8d-7862-5de6-ad2b-401077b60c04",
"record_id": "HARNESS-WP-0008-T01",
"status": "done",
"needs_human": false,
"decision_id": null,
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2"
},
{
"id": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9",
"record_id": "HARNESS-WP-0008-T02",
"status": "done",
"needs_human": false,
"decision_id": null,
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2"
},
{
"id": "87457216-2371-51ca-b3d4-3917e6f180a2",
"record_id": "HARNESS-WP-0008-T03",
"status": "done",
"needs_human": false,
"decision_id": null,
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2"
},
{
"id": "898e02af-51bb-5e8d-93d0-ae908466c612",
"record_id": "HARNESS-WP-0008-T04",
"status": "done",
"needs_human": false,
"decision_id": "a93619a9-8a70-40d8-aaf9-c29357d2a043",
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2"
},
{
"id": "b486e86b-9d0f-501d-a394-771b40f771ee",
"record_id": "HARNESS-WP-0008-T05",
"status": "wait",
"needs_human": true,
"decision_id": "e6ca2f07-2708-4013-bfba-bf89fa0f1cb5",
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2"
},
{
"id": "4cf721e6-724b-5c64-91bb-67b098bb97af",
"record_id": "HARNESS-WP-0008-T06",
"status": "wait",
"needs_human": true,
"decision_id": "e8986e40-f6f8-4c87-b704-bff50cc4958b",
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2"
},
{
"id": "80318842-ccaa-5484-a54a-3d9981eaec8b",
"record_id": "HARNESS-WP-0008-T07",
"status": "wait",
"needs_human": true,
"decision_id": null,
"workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2"
}
],
"native_authority_or_proposal_changed": false
}

52
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.json Normal file
View file

@ -0,0 +1,52 @@
{
"repo_slug": "sand-boxer",
"repo_path": "/home/worsch/sand-boxer",
"source_revision": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e",
"source_revision_reason": null,
"issues": [
{
"severity": "WARN",
"check_id": "C-41",
"message": "Task wait-qualifier drift 'SAND-WP-0015-T04': file={'needs_human': False, 'blocking_reason': 'Tracked as HARNESS-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.', 'decision_id': None, 'blocked_on': 'message-from:rein-aharness', 'wait_until': None} db={'needs_human': False, 'blocking_reason': 'Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.', 'decision_id': None, 'blocked_on': 'message-from:rein-aharness', 'wait_until': None} (file wins)",
"file_path": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md#SAND-WP-0015-T04",
"db_id": "58817ef6-76d9-5e34-908f-c024e6c99f93",
"file_value": "{\"blocked_on\": \"message-from:rein-aharness\", \"blocking_reason\": \"Tracked as HARNESS-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.\", \"decision_id\": null, \"needs_human\": false, \"wait_until\": null}",
"db_value": "{\"blocked_on\": \"message-from:rein-aharness\", \"blocking_reason\": \"Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.\", \"decision_id\": null, \"needs_human\": false, \"wait_until\": null}",
"fixable": true
},
{
"severity": "WARN",
"check_id": "C-28",
"message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace",
"file_path": "",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-28",
"message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace",
"file_path": "",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
}
],
"fixes_applied": [
"bindings: synced 15/15",
"C-17 cleared: pushed 1 backlogged commit(s)",
"C-41 fixed: task 58817ef6\u2026 wait qualifiers synced",
"brief: .custodian-brief.md updated",
"push: pushed"
],
"summary": {
"fail": 0,
"automation_error": 0,
"warn": 3,
"info": 0
},
"result": "warn"
}

1
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.stderr.txt Normal file
View file

@ -0,0 +1 @@
WARN: git commit failed for writeback: Generated-only commits rejected: staged

BIN
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/index.preimage Normal file
View file

Binary file not shown.

91
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/projection.json Normal file
View file

@ -0,0 +1,91 @@
{
"ok": true,
"status": "applied",
"repo_slug": "sand-boxer",
"commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e",
"requests": 2,
"elapsed_ms": 3165.2,
"git": {
"upstream": "origin/main",
"behind": 0,
"ahead": 0
},
"identifiers": {
"schema": "repo-manager.identifier-assignment.v1",
"ok": true,
"executed": true,
"repo": "sand-boxer",
"namespace": "helixforge",
"assignments": [],
"historical_invalid_identifiers": [],
"historical_identity_collisions": [],
"files_changed": []
},
"receipt": {
"schema": "state-hub.repository-projection-reconcile.v1",
"instance_role": "primary",
"instance_label": "railiance01",
"expected_commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e",
"derived_commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e",
"outcome": {
"schema": "state-hub.projection-reset.v1",
"repo_slug": "sand-boxer",
"commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e",
"status": "applied",
"counts": {
"created": 0,
"updated": 15,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 0,
"cancelled_tasks": 0,
"created_edges": 0,
"removed_edges": 0,
"unresolved_edges": 0,
"external_edges": 1
},
"created": [],
"updated": [
"SAND-WP-0001",
"SAND-WP-0002",
"SAND-WP-0003",
"SAND-WP-0004",
"SAND-WP-0005",
"SAND-WP-0006",
"SAND-WP-0007",
"SAND-WP-0008",
"SAND-WP-0009",
"SAND-WP-0010",
"SAND-WP-0011",
"SAND-WP-0012",
"SAND-WP-0013",
"SAND-WP-0014",
"SAND-WP-0015"
],
"retired": [],
"released": [],
"created_tasks": [],
"updated_tasks": [],
"cancelled_tasks": [],
"created_edges": [],
"removed_edges": [],
"unresolved_edges": [],
"external_edges": [
{
"workplan": "SAND-WP-0014",
"from": "SAND-WP-0014-T05",
"target": "SAND-WP-0015-T04",
"relationship_type": "starts_after",
"from_workplan_id": "b616d1cd-208f-5ecf-a4a0-a028396422c4",
"from_task_id": "c6812fd4-bb7b-5be0-8344-a122496fe5bc",
"to_workplan_id": null,
"to_task_id": "58817ef6-76d9-5e34-908f-c024e6c99f93"
}
],
"refused": [],
"notes": []
}
}
}

0
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/projection.stderr.txt Normal file
View file

35
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/.custodian-brief.md.worktree Normal file
View file

@ -0,0 +1,35 @@
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
# Custodian Brief — sand-boxer
**Domain:** infotech
**Last synced:** 2026-10-14 00:16 UTC
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
## Active Workstreams
### Owner-mediated governed bwrap execution
Progress: 4/5 done | workplan_id: `b616d1cd-208f-5ecf-a4a0-a028396422c4`
**Open tasks:**
- ! Prove one governed rein and coordinate consumers `c6812fd4`
*(wait: Waits on SAND-WP-0015-T04: corrected runtime ee3d0a53 admission and one successful authorized owner-runtime acceptance before a real rein command runs through the owner API.)*
### Provide a pinned bwrap rein runtime and private state
Progress: 5/6 done | workplan_id: `d3f12387-fd23-58f0-b979-9c811507614d`
**Open tasks:**
- ! Resolve Claude credentials, enforced egress, and production acceptance `58817ef6`
*(wait: Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.)*
## Inbox Hygiene
**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
**Missing thread_id:** 2 unread message(s) lack supersession chains.
---
## MCP Orientation (when available)
If the state-hub MCP server is reachable, call:
`get_domain_summary("infotech")`
This provides richer cross-domain context.
If the MCP call fails, use this file as your orientation source.

126
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/WORK-RECORDS.md.worktree Normal file
View file

@ -0,0 +1,126 @@
# Work Records — sand-boxer
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
> stage 3). Do not edit by hand — edit the source file/block listed for
> each record and re-run fix-consistency to refresh this index. Archived
> workplans are omitted; closed decisions/intakes/engagements stay listed
> so recently-resolved work is still visible. [auto]
| Kind | ID | Status | Lane | Source |
| --- | --- | --- | --- | --- |
| workplan | SAND-WP-0001 | finished | — | workplans/SAND-WP-0001-statehub-bootstrap.md |
| workplan | SAND-WP-0002 | finished | — | workplans/SAND-WP-0002-meta-framework-foundation.md |
| workplan | SAND-WP-0003 | finished | — | workplans/SAND-WP-0003-wise-validator-extraction.md |
| workplan | SAND-WP-0004 | finished | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md |
| workplan | SAND-WP-0005 | finished | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md |
| workplan | SAND-WP-0006 | finished | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md |
| workplan | SAND-WP-0007 | finished | — | workplans/SAND-WP-0007-snapshot-restore.md |
| workplan | SAND-WP-0008 | finished | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md |
| workplan | SAND-WP-0009 | finished | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md |
| workplan | SAND-WP-0010 | finished | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md |
| workplan | SAND-WP-0011 | finished | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md |
| workplan | SAND-WP-0012 | finished | — | workplans/SAND-WP-0012-packer-orchestration.md |
| workplan | SAND-WP-0013 | finished | — | workplans/SAND-WP-0013-bwrap-extension.md |
| workplan | SAND-WP-0014 | blocked | — | workplans/SAND-WP-0014-owner-mediated-execution.md |
| workplan | SAND-WP-0015 | blocked | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md |
| task | SAND-WP-0001-T01 | done | — | workplans/SAND-WP-0001-statehub-bootstrap.md |
| task | SAND-WP-0001-T02 | done | — | workplans/SAND-WP-0001-statehub-bootstrap.md |
| task | SAND-WP-0001-T03 | done | — | workplans/SAND-WP-0001-statehub-bootstrap.md |
| task | SAND-WP-0002-T01 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md |
| task | SAND-WP-0002-T02 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md |
| task | SAND-WP-0002-T03 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md |
| task | SAND-WP-0002-T04 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md |
| task | SAND-WP-0002-T05 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md |
| task | SAND-WP-0002-T06 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md |
| task | SAND-WP-0002-T07 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md |
| task | SAND-WP-0002-T08 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md |
| task | SAND-WP-0002-T09 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md |
| task | SAND-WP-0002-T10 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md |
| task | SAND-WP-0003-T01 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md |
| task | SAND-WP-0003-T02 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md |
| task | SAND-WP-0003-T03 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md |
| task | SAND-WP-0003-T04 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md |
| task | SAND-WP-0003-T05 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md |
| task | SAND-WP-0003-T06 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md |
| task | SAND-WP-0003-T07 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md |
| task | SAND-WP-0003-T08 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md |
| task | SAND-WP-0003-T09 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md |
| task | SAND-WP-0004-T01 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md |
| task | SAND-WP-0004-T02 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md |
| task | SAND-WP-0004-T03 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md |
| task | SAND-WP-0004-T04 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md |
| task | SAND-WP-0004-T05 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md |
| task | SAND-WP-0005-T01 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md |
| task | SAND-WP-0005-T02 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md |
| task | SAND-WP-0005-T03 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md |
| task | SAND-WP-0005-T04 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md |
| task | SAND-WP-0005-T05 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md |
| task | SAND-WP-0005-T06 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md |
| task | SAND-WP-0006-T01 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md |
| task | SAND-WP-0006-T02 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md |
| task | SAND-WP-0006-T03 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md |
| task | SAND-WP-0006-T04 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md |
| task | SAND-WP-0006-T05 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md |
| task | SAND-WP-0006-T06 | cancel | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md |
| task | SAND-WP-0007-T01 | done | — | workplans/SAND-WP-0007-snapshot-restore.md |
| task | SAND-WP-0007-T02 | done | — | workplans/SAND-WP-0007-snapshot-restore.md |
| task | SAND-WP-0007-T03 | done | — | workplans/SAND-WP-0007-snapshot-restore.md |
| task | SAND-WP-0007-T04 | done | — | workplans/SAND-WP-0007-snapshot-restore.md |
| task | SAND-WP-0007-T05 | done | — | workplans/SAND-WP-0007-snapshot-restore.md |
| task | SAND-WP-0007-T06 | done | — | workplans/SAND-WP-0007-snapshot-restore.md |
| task | SAND-WP-0008-T01 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md |
| task | SAND-WP-0008-T02 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md |
| task | SAND-WP-0008-T03 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md |
| task | SAND-WP-0008-T04 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md |
| task | SAND-WP-0008-T05 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md |
| task | SAND-WP-0008-T06 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md |
| task | SAND-WP-0008-T07 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md |
| task | SAND-WP-0008-T08 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md |
| task | SAND-WP-0008-T09 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md |
| task | SAND-WP-0008-T10 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md |
| task | SAND-WP-0009-T01 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md |
| task | SAND-WP-0009-T02 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md |
| task | SAND-WP-0009-T03 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md |
| task | SAND-WP-0009-T04 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md |
| task | SAND-WP-0009-T05 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md |
| task | SAND-WP-0009-T06 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md |
| task | SAND-WP-0009-T07 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md |
| task | SAND-WP-0009-T08 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md |
| task | SAND-WP-0009-T09 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md |
| task | SAND-WP-0010-T01 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md |
| task | SAND-WP-0010-T02 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md |
| task | SAND-WP-0010-T03 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md |
| task | SAND-WP-0010-T04 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md |
| task | SAND-WP-0010-T05 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md |
| task | SAND-WP-0010-T06 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md |
| task | SAND-WP-0010-T07 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md |
| task | SAND-WP-0011-T01 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md |
| task | SAND-WP-0011-T02 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md |
| task | SAND-WP-0011-T03 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md |
| task | SAND-WP-0011-T04 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md |
| task | SAND-WP-0011-T05 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md |
| task | SAND-WP-0011-T06 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md |
| task | SAND-WP-0011-T07 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md |
| task | SAND-WP-0012-T01 | done | — | workplans/SAND-WP-0012-packer-orchestration.md |
| task | SAND-WP-0012-T02 | done | — | workplans/SAND-WP-0012-packer-orchestration.md |
| task | SAND-WP-0012-T03 | done | — | workplans/SAND-WP-0012-packer-orchestration.md |
| task | SAND-WP-0012-T04 | done | — | workplans/SAND-WP-0012-packer-orchestration.md |
| task | SAND-WP-0012-T05 | done | — | workplans/SAND-WP-0012-packer-orchestration.md |
| task | SAND-WP-0012-T06 | done | — | workplans/SAND-WP-0012-packer-orchestration.md |
| task | SAND-WP-0013-T01 | done | — | workplans/SAND-WP-0013-bwrap-extension.md |
| task | SAND-WP-0013-T02 | done | — | workplans/SAND-WP-0013-bwrap-extension.md |
| task | SAND-WP-0013-T03 | done | — | workplans/SAND-WP-0013-bwrap-extension.md |
| task | SAND-WP-0013-T04 | done | — | workplans/SAND-WP-0013-bwrap-extension.md |
| task | SAND-WP-0013-T05 | done | — | workplans/SAND-WP-0013-bwrap-extension.md |
| task | SAND-WP-0013-T06 | done | — | workplans/SAND-WP-0013-bwrap-extension.md |
| task | SAND-WP-0014-T01 | done | — | workplans/SAND-WP-0014-owner-mediated-execution.md |
| task | SAND-WP-0014-T02 | done | — | workplans/SAND-WP-0014-owner-mediated-execution.md |
| task | SAND-WP-0014-T03 | done | — | workplans/SAND-WP-0014-owner-mediated-execution.md |
| task | SAND-WP-0014-T04 | done | — | workplans/SAND-WP-0014-owner-mediated-execution.md |
| task | SAND-WP-0014-T05 | wait | — | workplans/SAND-WP-0014-owner-mediated-execution.md |
| task | SAND-WP-0015-T01 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md |
| task | SAND-WP-0015-T02 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md |
| task | SAND-WP-0015-T03 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md |
| task | SAND-WP-0015-T04 | wait | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md |
| task | SAND-WP-0015-T05 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md |
| task | SAND-WP-0015-T06 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md |

10
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/originals.json Normal file
View file

@ -0,0 +1,10 @@
[
{
"path": ".custodian-brief.md",
"index": "100644 9cc4a0d49cdc0816fd74feb81cdfc5b5154fd849 0\t.custodian-brief.md"
},
{
"path": "WORK-RECORDS.md",
"index": "100644 1f6251402ca5fcc85ef6b832bf2da25aeb0fc9b3 0\tWORK-RECORDS.md"
}
]

13
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-commit.json Normal file
View file

@ -0,0 +1,13 @@
{
"exit_code": 0,
"commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e",
"base": "53f800c4f7a9c91469834d04ef6f58e906b0bd49",
"files": [
{
"path": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md",
"sha256": "56022703fd4d973f40ddad8eb99cb02783b086549b24ef89f89157de33eafe31"
}
],
"stdout": "[main c7c3102] docs(identity): point current metered gate at issued HARNESS task\n 1 file changed, 1 insertion(+), 1 deletion(-)\n",
"stderr": ""
}

11
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-manifest.json Normal file
View file

@ -0,0 +1,11 @@
{
"owner": "sand-boxer",
"base_revision": "53f800c4f7a9c91469834d04ef6f58e906b0bd49",
"message": "docs(identity): point current metered gate at issued HARNESS task",
"files": [
{
"path": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md",
"sha256": "56022703fd4d973f40ddad8eb99cb02783b086549b24ef89f89157de33eafe31"
}
]
}

10
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/required-checks.json Normal file
View file

@ -0,0 +1,10 @@
{
"observed_at": "2026-10-17T10:59:00.290205+00:00",
"command": "make check",
"required_by": "sand-boxer/AGENTS.md and .claude/rules/stack-and-commands.md",
"lint": "passed",
"tests_passed": 220,
"exit_code": 0,
"warning": "existing Starlette testclient deprecation warning; no test failure",
"scope": "existing owner checks, no implementation change or native production acceptance"
}

8
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/source-before.json Normal file
View file

@ -0,0 +1,8 @@
{
"observed_at": "2026-10-17T10:57:25.565702+00:00",
"head": "53f800c4f7a9c91469834d04ef6f58e906b0bd49",
"status": "",
"instructions_sha256": "sha256:979d90f2945656a02c867c724a90966819d6eb6c8624a2c1e07b21f5d32b4449",
"source_sha256": "sha256:230d1ef37aa9c2023335a617492a72678c4671a8bc82d5577e9d7a7cea6e8fe4",
"index_sha256": "sha256:e9c14c64f7319eed77603103a13f1422726121bd9ee475902f4501a8781bf02d"
}

54
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/verified-bindings.json Normal file
View file

@ -0,0 +1,54 @@
{
"observed_at": "2026-10-17T11:27:49.876854+00:00",
"status": "source_and_task_bindings_verified",
"source_file": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md",
"source_sha256": "sha256:56022703fd4d973f40ddad8eb99cb02783b086549b24ef89f89157de33eafe31",
"all_source_UUIDs_preserved": true,
"all_task_fields_preserved_except_approved_SAND_blocking_label": true,
"tasks": [
{
"record_id": "SAND-WP-0015-T01",
"id": "93e4aad8-ba9b-5850-93d4-b5bf78ac8978",
"status": "done",
"needs_human": false,
"workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d"
},
{
"record_id": "SAND-WP-0015-T02",
"id": "c8a689f8-bdf2-57a2-8521-a1c0ca44e750",
"status": "done",
"needs_human": false,
"workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d"
},
{
"record_id": "SAND-WP-0015-T03",
"id": "1a3002f6-c6a8-59d0-9d38-942028419de5",
"status": "done",
"needs_human": false,
"workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d"
},
{
"record_id": "SAND-WP-0015-T04",
"id": "58817ef6-76d9-5e34-908f-c024e6c99f93",
"status": "wait",
"needs_human": false,
"workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d"
},
{
"record_id": "SAND-WP-0015-T05",
"id": "f0163cda-b581-56a0-a0dd-9c8a436f5bbe",
"status": "done",
"needs_human": false,
"workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d"
},
{
"record_id": "SAND-WP-0015-T06",
"id": "f85f54c9-1081-5d0c-95ad-aca20ede8d66",
"status": "done",
"needs_human": false,
"workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d"
}
],
"historical_prose_preserved": true,
"native_action_by_this_subtask": false
}

375
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.postimage.md Normal file
View file

@ -0,0 +1,375 @@
---
id: SAND-WP-0015
type: workplan
title: "Provide a pinned bwrap rein runtime and private state"
domain: infotech
repo: sand-boxer
status: blocked
flavor: implementation
owner: codex
topic_slug: bwrap-runtime-and-private-state
created: "2026-09-05"
updated: "2026-10-04"
state_hub_workstream_id: "d3f12387-fd23-58f0-b979-9c811507614d"
---
# Provide a pinned bwrap rein runtime and private state
Implement the runtime prerequisites returned by Glas in `GLAS-WP-0012` and
`docs/local-profile-acceptance.md`. Continue owner work `SAND-WP-0014-T05` and
live residual `GLAS-IN-0002`. Runtime startup is a separate acceptance gate
from credential delivery, enforced provider egress, and a real model task.
## Mount an owner-selected, digest-pinned Python runtime
```task
id: SAND-WP-0015-T01
status: done
priority: high
state_hub_task_id: "93e4aad8-ba9b-5850-93d4-b5bf78ac8978"
```
Add exact artifact verification to trusted extension configuration and mount
the standalone runtime read-only at a fixed namespace path. Reject altered
content/modes, unexpected files, escaping symlinks, special files, and source
or workspace overlap. A caller cannot choose runtime paths through exec input.
Provide a non-editable rein-aharness/llm-connect bundle builder with recorded
source revisions and resolved dependency versions.
Completed 2026-09-05. `extensions/runtime.py` verifies complete artifact
contents/modes before a read-only mount; the builder installed committed
rein-aharness `1429db5` and llm-connect `0056094` without editable source paths.
Candidate digest and source/package evidence are in `docs/bwrap-runtime.md`.
## Keep writable runtime state outside the repository
```task
id: SAND-WP-0015-T02
status: done
priority: high
state_hub_task_id: "c8a689f8-bdf2-57a2-8521-a1c0ca44e750"
```
Create private mode-0700 HOME/config/cache/state/tmp directories within the
namespace, preserve them across exec requests, and remove them with teardown.
Keep the command environment sanitized and disable Python user-site/bytecode
writes. Fail closed on profile network/setup-credential declarations that the
current bwrap implementation cannot honor.
Completed 2026-09-05. Mode-0700 namespace HOME and XDG/TMP directories sit
outside the copied Git tree. Explicit runtime PATH selection remains owner
controlled. Unsupported egress/default-allow and setup credentials now refuse
before workspace creation; regression tests cover these boundaries.
## Verify the real rein runtime and owner regression paths
```task
id: SAND-WP-0015-T03
status: done
priority: high
state_hub_task_id: "1a3002f6-c6a8-59d0-9d38-942028419de5"
```
Run `make check`, the existing authenticated cross-request owner smoke, and a
real runtime startup smoke. Verify the actual rein CLI and adapter imports,
read-only runtime, private HOME, clean worktree, absent source, loopback-only
network, and teardown. Keep the production Glas profile blocked.
Completed 2026-09-05. `make check`: lint clean, 132 tests passed. Authenticated
owner API smoke `223db65b` returned HTTP 200 and proved exact consumer identity,
stdin delivery, absent source, loopback-only network and complete teardown.
Pinned runtime smoke `d4de9531` ran the actual rein CLI and imported its Claude
adapter, proved read-only runtime/private HOME/clean worktree, retained private
state across a second exec, and removed the workspace. No model call or
credential acquisition occurred; T04 remains waiting.
## Resolve Claude credentials, enforced egress, and production acceptance
```task
id: SAND-WP-0015-T04
status: wait
blocked_on: message-from:rein-aharness
blocking_reason: "Tracked as HARNESS-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt."
priority: high
state_hub_task_id: "58817ef6-76d9-5e34-908f-c024e6c99f93"
```
The 2026-09-05 routing lookup found no concrete Anthropic/Claude workload lane.
The generic OpenBao template is not a delegable lane; the OpenRouter AppRole
belongs to another rein. Credential owner railiance-platform/OpenBao plus
rein-aharness must establish a concrete Claude-compatible route and delivery/
revocation contract before values can be requested or supplied to the runtime.
Sand-boxer must then implement the matching enforced provider egress contract
(including DNS/TLS and denied-destination proof) and pin/deploy the actual
Claude executable. No unrestricted-network or interactive-login substitute is
permitted. Review the deployed runtime/profile with Glas, run its real-rein
acceptance fixture, and update only the proven profile's readiness. No
production schedule is enabled by the runtime-startup smoke.
This task and SAND-WP-0014-T05 remain open until those gates pass. The detailed
return contract and runtime proof are in `docs/bwrap-runtime.md`; the live
cross-repo residual remains `GLAS-IN-0002`.
## 2026-09-05 transport implementation evidence
T04 remains waiting on owner machine authentication, protected credential
delivery, pinned Claude startup and the real model proof. CCR-2026-0016 custody
is confirmed by a metadata-only check of live version 2; no value was read.
HTTPS egress is now implemented as an exact owner/profile allowlisted CONNECT
proxy while retaining an isolated network namespace. Non-secret live smoke
sandbox e290e788 verified provider TLS response, undeclared destination and
direct-IP denial, and proxy/workspace teardown. See docs/bwrap-egress.md.
## 2026-09-05 credential transport owner return
Owner-bound exec-env transport is implemented and proved with a synthetic
provider in real sandbox 0e5fb35a. Exact route/profile/project/actor/run binding,
child-only key injection, pre-truncation redaction, next-exec absence and teardown
pass. No real key read or production profile activation. See docs/bwrap-credentials.md.
SECRETS-WP-0009 now owns native AppRole adoption for CCR-2026-0016, including
a data-only consumer read policy. Its production exec refuses before OpenBao
until SECRETS-WP-0007-T04 and SECRETS-WP-0008-T02/T06 deliver canonical
authorization/consume and service authority. T04 remains waiting on that live
owner path, the pinned Claude executable and real model acceptance.
## 2026-09-06 combined-runtime candidate returned to Glas
Answered the GLAS-WP-0015 handoff. Added candidate profile
`profile.claude-agent-dev-proof` version 1.1.0 (`ext.bwrap`, localhost-only,
`default: deny` with declared `api.anthropic.com:443`) for GLAS-WP-0012 review.
The committed profile grants no egress by itself: `ext.bwrap` refuses it unless
the owner extension config allowlists the destination, and a regression test now
asserts that fail-closed default. `make check`: lint clean, 172 tests passed.
Resolved the differing project examples in favour of the acceptance runner's
`actor: agt` / `project: glas-local-proof`, and bound the documented credential
route to that single project rather than broadening it. The full return contract
— profile id/revision, host scope, consumer tuple, runtime digest and mount
paths, declared egress, and the value-free denial/cleanup receipts — is in
`docs/bwrap-runtime.md`.
T04 stays `wait`: the concrete Claude credential lane and delivery/revocation
contract, owner machine authentication, the pinned Claude executable with its
own proxy startup proof, and the real-model acceptance are still operator and
upstream-owner gated. Provider workspace scope and spend limit remain operator
inputs. `SAND-WP-0014-T05` remains open on the same gates.
## Package and prove the pinned Claude executable independently of custody
```task
id: SAND-WP-0015-T05
status: done
priority: high
state_hub_task_id: "f0163cda-b581-56a0-a0dd-9c8a436f5bbe"
```
Split the independent executable packaging/startup portion from T04 so credential
custody does not hide completed local runtime work. Implement explicit binary
pinning, reject mismatches/host wrappers, and prove actual startup with the
broker proxy environment and complete cleanup. T04 retains protected deployment,
credential adoption and real-provider acceptance.
## Pinned Claude candidate and isolated startup — 2026-09-06
The builder now accepts `--claude-binary`, `--claude-sha256` and
`--claude-version` together. It requires a regular native ELF file, verifies the
exact copied bytes, refuses symlinks/wrappers/mismatches and existing destination
files, and copies only the executable as bin/claude mode 0755. The expected
version is metadata until the sandbox smoke checks the actual output. No
interactive HOME, provider key or login state is copied.
Candidate provenance: the explicitly selected installed native release
`/home/worsch/.local/share/claude/versions/2.1.263`, SHA-256
`26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba`.
This is a digest pin of the selected local artifact, not an upstream signature
verification claim. Complete runtime candidate:
`/tmp/sandboxer-claude-runtime-20260906`, SHA-256
`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`.
Mount remains `/opt/sandboxer/runtime`; Claude is `/opt/sandboxer/runtime/bin/claude`.
Rein sources remain 1429db5 / llm-connect 0056094; resolved dependency versions
are recorded in the evidence. Rebuilding may resolve different dependencies;
the complete digest pins this artifact, not future builds.
Sandbox f8821ec2 ran real `claude --version` -> `2.1.263 (Claude Code)` plus rein
CLI/import checks, with owner allowlisted provider egress and HTTPS_PROXY set
by the broker. Runtime read-only, private 0700 HOME/state persistence, clean Git,
absent source and loopback-only interfaces passed; workspace and proxy removed.
`make check`: lint passed, 175 tests passed.
Evidence: docs/evidence/SAND-WP-0015-claude-startup-2026-09-06.json.
Reproduce with the builder options above and `scripts/smoke-bwrap-runtime.py
--runtime-path <candidate> --runtime-sha256 <digest> --claude-version 2.1.263`.
Limits: `--version` proves startup with the proxy environment, not that Claude
has sent a provider request through it. No credential acquisition or model run.
The /tmp candidate is not production placement; protected artifact installation,
owner configuration, credential adoption and real-model proof remain T04 gates.
## Install the pinned runtime in the local owner's protected store
```task
id: SAND-WP-0015-T06
status: done
priority: high
assignee: the-custodian
state_hub_task_id: "f85f54c9-1081-5d0c-95ad-aca20ede8d66"
```
HFACT-WP-0001-T04 consumes this independent installation return. Reuse the
already verified combined candidate with digest
`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`;
do not rebuild resolved dependencies. Publish it under the local owner's
private artifact store, verify exact copied content/modes and refusal of unsafe
or corrupted destinations, and prove startup/read-only access/teardown through
the installed path. The owner remains trusted; this is not root-owned storage.
T04 retains real credential adoption, owner configuration, model acceptance
and production placement. No credential route or profile is activated here.
`scripts/install-bwrap-runtime.py` installs below the owner's home into a
mode-0700 store, verifies before and after copying, preserves artifact modes
and internal symlinks, serializes publishers and never overwrites a published
artifact. Existing modified artifacts are refused rather than repaired silently.
Group/other-writable ancestors, unsafe permission bits and store aliases refuse.
Unit tests cover integrity, idempotence, copy-time corruption and access modes.
T06 completed 2026-09-08 on bnt-lap001, local owner UID 1000. Installed the
unchanged 358-entry / 245176062-byte candidate at
`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`.
The private store is mode 0700; the installing owner remains trusted. A root-owned
system installation was not claimed or required for this local owner contract.
The installed-path sandbox smoke `51b59587` passed real Claude 2.1.263 and rein
startup, read-only mount, private state persistence, clean worktree, absent source,
loopback-only interfaces and complete workspace/proxy teardown. No model call
or credential acquisition occurred. `make check`: lint clean, 188 tests passed.
Two existing tests require the checkout directory name `sand-boxer`; the final
full check used that canonical basename. Evidence:
`docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`.
T04 retains owner execution configuration, native credential/egress and real-model
acceptance; Railiance installation needs its own target-specific return.
## 2026-09-09 factory metered route source return
Implemented the trusted, ephemeral Messages route described in
[docs/bwrap-messages-route.md](../docs/bwrap-messages-route.md). Actual local
bwrap owner transport proves provider key/ledger separation, direct-route denial,
revocation and teardown; rein also proves metered request plus commit import and
close replay. `make check`: lint clean, 199 passed. T04 remains waiting for the
admitted provider-to-owner bootstrap, updated protected runtime/profile, Railiance
placement, live compatibility and G0. Existing child-provider-key/direct-CONNECT
proofs do not admit this different credential holder or metered profile. No CCR,
secret read, deployment or paid request was performed.
## 2026-09-09 standalone owner packaging and runtime selection
Added frozen-lock owner build mode for the matched rein/llm/Glas/sandboxer set,
with non-editable installation and recorded lock/source/package pins. Sand-boxer
wheels now carry their profile and extension definitions, fixing a bwrap owner
failure that source-checkout tests could hide. The trusted Messages binding can
select the digest-pinned runtime without adding an API or profile override.
`make check`: lint clean, 205 passed. Existing standalone workload builds remain
supported. See docs/bwrap-runtime.md and rein's docs/owner-bootstrap.md.
The project's `evidence/2026-09-09-owner-bootstrap.json` records the actual candidate
build and isolated installed-interpreter/CLI proof. T04 remains wait for accepted
credential-to-owner delivery, current protected installation and Railiance placement,
provider compatibility and G0. Source packaging does not reopen completed T01-T03,
T05-T06, broaden the old CCRs or activate the previously installed 2.1.263 artifact.
The first standalone candidate exposed a stale cached local wheel despite current
Git metadata. Owner builds now refresh all local distributions and compare every
installed package source/definition file with its tracked source; stale, missing or
extra files refuse the build. Four content-conformance regressions cover that gap.
## 2026-09-27 installed launcher defect and guarded correction
REINAH-WP-0003's single admitted attempt completed native provider/companion
apply, verify and exec, including scoped-token revocation. The claimed job
`6efa9436-6a91-47c0-94e5-b31b5a0e7e3a` failed before any provider request
reservation. The sandbox was destroyed and the source repository is unchanged.
The parent EUR 10 liability remains held for explicit reconciliation; no retry
or replacement authority is inferred.
Installed artifact `b6e4e8a4` contains uv-generated three-line shell launchers
that still reference a vanished temporary build interpreter. The builder had
only rewritten direct Python shebangs. Fixed both generated forms and added
actual relocation/execution tests for direct, long and space-containing build
paths, plus refusal of unknown governed launchers. Builder tests: 12 passed;
focused lint passes. Rein's real installed bwrap probe reproduces both broken
entrypoints at exit 127 with zero provider forwards; its new bootstrap checks
refuse the malformed artifact before claiming.
T04 remains `wait` and this plan stays `blocked`: replacement artifact build/
admission and a separately authorized successful model/tool/commit proof remain.
The existing SAND-WP-0015 / REINAH-WP-0003 / SECRETS-WP-0009 records retain the
work. No new task or workplan. Detailed non-secret receipts are in rein-aharness
`docs/evidence/2026-09-27-metered-*.json`.
## 2026-10-04 offline owner startup proof preparation
The existing no-credential smoke command now supports
`--require-owner-entrypoints`: the admitted digest-pinned runtime must start both
`rein-aharness --help` and `glas-harness --help`, and imported rein, llm-connect,
Glas and sandboxer modules must originate inside the mounted artifact. Broken or
missing launchers, failed help, timeout and external package origins cannot be
recorded as startup success. The default standalone mode remains supported.
Launcher diagnostics are not copied into the receipt. Focused tests exercise
real subprocesses, including the vanished-build-interpreter failure.
This is preparation for a corrected immutable candidate's independent native
startup proof; it is not that candidate's receipt or owner acceptance. T04 stays
`wait`, the plan stays `blocked`, and the Sept27 artifact/liability evidence
remains intact. Replacement artifact admission and pins, explicit retained
EUR 10 reconciliation, and a separately authorized successful model/tool/commit
attempt remain with the existing owners. No credentials, provider request,
queue claim, policy activation or retry authorization is supplied here.
2026-10-04 current blocker reconciliation: September 27 native provider/companion
apply/verify/exec and successful revocation supersede the original missing
platform route. The remaining owner return is rein-aharness corrected artifact/
profile admission, retained EUR10 reconciliation and fresh retry authority.
T04 stays wait; no renewed trial is authorized. Full owner check: lint clean,
219 tests passed (one existing Starlette deprecation warning).
## 2026-10-13 owner returns: reconciliation and corrected build
rein-aharness `d897a83` records owner reconciliation of the Sept 27 held
liability: run `6efa9436` failed at launcher exit 127 before any provider
reservation; liability stays at the full hold, exhausting that one-attempt
envelope, and the owner authorized a new retry envelope on 2026-10-13.
rein-aharness `9a4469d` records corrected runtime `ee3d0a53…` (replaces
`b6e4e8a4…`; only rein moved, adding pre-claim launcher rejection), built with
the sand-boxer builder fix; both launchers exit 0 inside bwrap. Receipts:
rein-aharness `docs/evidence/2026-10-13-*.json`.
Remaining before T04 closes: install `ee3d0a53` on railiance01, pin its digest
in owner config, pass `--require-owner-entrypoints` offline startup proof, then
run the single authorized attempt to a successful model/tool/commit receipt.
T04 stays `wait`; the plan stays `blocked`.
2026-10-14 check: rein-aharness pushed `9a4469d` (corrected build record) and
opened REINAH-WP-0008 (simpler metered retry, active). No railiance01 install/
admission of `ee3d0a53` or successful acceptance receipt yet; request sent on
hub message `82faf25c`. T04 stays `wait`; plan stays `blocked`.
2026-10-14 rein-aharness reply (thread `82faf25c`): step 1 done (`9a4469d` on
origin/main). Steps 2-4 are REINAH-WP-0008-T07. Budget is now up to three
attempts within EUR 10 under memo `infd-20261014-b01` (observed-usage
settlement); order: memo acceptance in the attended informed-decision sitting,
rebuild and install `ee3d0a53` on railiance01, `metered-once --rehearse`,
`owner renew`, first attempt. Railiance01 still pins `b6e4e8a4`. T04 stays `wait`.
2026-10-15 owner-approved rebuild: the pinned inputs of the `ee3d0a53` receipt
(same four commits, uv.lock `8775904b…`, Claude 2.1.266 `19842705…`) rebuilt
to `818b1b7c8292…f359`. The digest differs only because the builder embeds
absolute source paths (`direct_url.json`, `build-info.json`). Owner-entrypoint
startup smoke passed in sandbox `28df7a1d`; no credentials or model calls.
Sent to rein-aharness (message `8a7962f7`, thread `82faf25c`) to record as the
then-current corrected runtime for REINAH-WP-0008-T07 and to load the unsigned
memo sitting. Nothing installed on railiance01. T04 stays `wait`.

375
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.preimage.md Normal file
View file

@ -0,0 +1,375 @@
---
id: SAND-WP-0015
type: workplan
title: "Provide a pinned bwrap rein runtime and private state"
domain: infotech
repo: sand-boxer
status: blocked
flavor: implementation
owner: codex
topic_slug: bwrap-runtime-and-private-state
created: "2026-09-05"
updated: "2026-10-04"
state_hub_workstream_id: "d3f12387-fd23-58f0-b979-9c811507614d"
---
# Provide a pinned bwrap rein runtime and private state
Implement the runtime prerequisites returned by Glas in `GLAS-WP-0012` and
`docs/local-profile-acceptance.md`. Continue owner work `SAND-WP-0014-T05` and
live residual `GLAS-IN-0002`. Runtime startup is a separate acceptance gate
from credential delivery, enforced provider egress, and a real model task.
## Mount an owner-selected, digest-pinned Python runtime
```task
id: SAND-WP-0015-T01
status: done
priority: high
state_hub_task_id: "93e4aad8-ba9b-5850-93d4-b5bf78ac8978"
```
Add exact artifact verification to trusted extension configuration and mount
the standalone runtime read-only at a fixed namespace path. Reject altered
content/modes, unexpected files, escaping symlinks, special files, and source
or workspace overlap. A caller cannot choose runtime paths through exec input.
Provide a non-editable rein-aharness/llm-connect bundle builder with recorded
source revisions and resolved dependency versions.
Completed 2026-09-05. `extensions/runtime.py` verifies complete artifact
contents/modes before a read-only mount; the builder installed committed
rein-aharness `1429db5` and llm-connect `0056094` without editable source paths.
Candidate digest and source/package evidence are in `docs/bwrap-runtime.md`.
## Keep writable runtime state outside the repository
```task
id: SAND-WP-0015-T02
status: done
priority: high
state_hub_task_id: "c8a689f8-bdf2-57a2-8521-a1c0ca44e750"
```
Create private mode-0700 HOME/config/cache/state/tmp directories within the
namespace, preserve them across exec requests, and remove them with teardown.
Keep the command environment sanitized and disable Python user-site/bytecode
writes. Fail closed on profile network/setup-credential declarations that the
current bwrap implementation cannot honor.
Completed 2026-09-05. Mode-0700 namespace HOME and XDG/TMP directories sit
outside the copied Git tree. Explicit runtime PATH selection remains owner
controlled. Unsupported egress/default-allow and setup credentials now refuse
before workspace creation; regression tests cover these boundaries.
## Verify the real rein runtime and owner regression paths
```task
id: SAND-WP-0015-T03
status: done
priority: high
state_hub_task_id: "1a3002f6-c6a8-59d0-9d38-942028419de5"
```
Run `make check`, the existing authenticated cross-request owner smoke, and a
real runtime startup smoke. Verify the actual rein CLI and adapter imports,
read-only runtime, private HOME, clean worktree, absent source, loopback-only
network, and teardown. Keep the production Glas profile blocked.
Completed 2026-09-05. `make check`: lint clean, 132 tests passed. Authenticated
owner API smoke `223db65b` returned HTTP 200 and proved exact consumer identity,
stdin delivery, absent source, loopback-only network and complete teardown.
Pinned runtime smoke `d4de9531` ran the actual rein CLI and imported its Claude
adapter, proved read-only runtime/private HOME/clean worktree, retained private
state across a second exec, and removed the workspace. No model call or
credential acquisition occurred; T04 remains waiting.
## Resolve Claude credentials, enforced egress, and production acceptance
```task
id: SAND-WP-0015-T04
status: wait
blocked_on: message-from:rein-aharness
blocking_reason: "Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt."
priority: high
state_hub_task_id: "58817ef6-76d9-5e34-908f-c024e6c99f93"
```
The 2026-09-05 routing lookup found no concrete Anthropic/Claude workload lane.
The generic OpenBao template is not a delegable lane; the OpenRouter AppRole
belongs to another rein. Credential owner railiance-platform/OpenBao plus
rein-aharness must establish a concrete Claude-compatible route and delivery/
revocation contract before values can be requested or supplied to the runtime.
Sand-boxer must then implement the matching enforced provider egress contract
(including DNS/TLS and denied-destination proof) and pin/deploy the actual
Claude executable. No unrestricted-network or interactive-login substitute is
permitted. Review the deployed runtime/profile with Glas, run its real-rein
acceptance fixture, and update only the proven profile's readiness. No
production schedule is enabled by the runtime-startup smoke.
This task and SAND-WP-0014-T05 remain open until those gates pass. The detailed
return contract and runtime proof are in `docs/bwrap-runtime.md`; the live
cross-repo residual remains `GLAS-IN-0002`.
## 2026-09-05 transport implementation evidence
T04 remains waiting on owner machine authentication, protected credential
delivery, pinned Claude startup and the real model proof. CCR-2026-0016 custody
is confirmed by a metadata-only check of live version 2; no value was read.
HTTPS egress is now implemented as an exact owner/profile allowlisted CONNECT
proxy while retaining an isolated network namespace. Non-secret live smoke
sandbox e290e788 verified provider TLS response, undeclared destination and
direct-IP denial, and proxy/workspace teardown. See docs/bwrap-egress.md.
## 2026-09-05 credential transport owner return
Owner-bound exec-env transport is implemented and proved with a synthetic
provider in real sandbox 0e5fb35a. Exact route/profile/project/actor/run binding,
child-only key injection, pre-truncation redaction, next-exec absence and teardown
pass. No real key read or production profile activation. See docs/bwrap-credentials.md.
SECRETS-WP-0009 now owns native AppRole adoption for CCR-2026-0016, including
a data-only consumer read policy. Its production exec refuses before OpenBao
until SECRETS-WP-0007-T04 and SECRETS-WP-0008-T02/T06 deliver canonical
authorization/consume and service authority. T04 remains waiting on that live
owner path, the pinned Claude executable and real model acceptance.
## 2026-09-06 combined-runtime candidate returned to Glas
Answered the GLAS-WP-0015 handoff. Added candidate profile
`profile.claude-agent-dev-proof` version 1.1.0 (`ext.bwrap`, localhost-only,
`default: deny` with declared `api.anthropic.com:443`) for GLAS-WP-0012 review.
The committed profile grants no egress by itself: `ext.bwrap` refuses it unless
the owner extension config allowlists the destination, and a regression test now
asserts that fail-closed default. `make check`: lint clean, 172 tests passed.
Resolved the differing project examples in favour of the acceptance runner's
`actor: agt` / `project: glas-local-proof`, and bound the documented credential
route to that single project rather than broadening it. The full return contract
— profile id/revision, host scope, consumer tuple, runtime digest and mount
paths, declared egress, and the value-free denial/cleanup receipts — is in
`docs/bwrap-runtime.md`.
T04 stays `wait`: the concrete Claude credential lane and delivery/revocation
contract, owner machine authentication, the pinned Claude executable with its
own proxy startup proof, and the real-model acceptance are still operator and
upstream-owner gated. Provider workspace scope and spend limit remain operator
inputs. `SAND-WP-0014-T05` remains open on the same gates.
## Package and prove the pinned Claude executable independently of custody
```task
id: SAND-WP-0015-T05
status: done
priority: high
state_hub_task_id: "f0163cda-b581-56a0-a0dd-9c8a436f5bbe"
```
Split the independent executable packaging/startup portion from T04 so credential
custody does not hide completed local runtime work. Implement explicit binary
pinning, reject mismatches/host wrappers, and prove actual startup with the
broker proxy environment and complete cleanup. T04 retains protected deployment,
credential adoption and real-provider acceptance.
## Pinned Claude candidate and isolated startup — 2026-09-06
The builder now accepts `--claude-binary`, `--claude-sha256` and
`--claude-version` together. It requires a regular native ELF file, verifies the
exact copied bytes, refuses symlinks/wrappers/mismatches and existing destination
files, and copies only the executable as bin/claude mode 0755. The expected
version is metadata until the sandbox smoke checks the actual output. No
interactive HOME, provider key or login state is copied.
Candidate provenance: the explicitly selected installed native release
`/home/worsch/.local/share/claude/versions/2.1.263`, SHA-256
`26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba`.
This is a digest pin of the selected local artifact, not an upstream signature
verification claim. Complete runtime candidate:
`/tmp/sandboxer-claude-runtime-20260906`, SHA-256
`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`.
Mount remains `/opt/sandboxer/runtime`; Claude is `/opt/sandboxer/runtime/bin/claude`.
Rein sources remain 1429db5 / llm-connect 0056094; resolved dependency versions
are recorded in the evidence. Rebuilding may resolve different dependencies;
the complete digest pins this artifact, not future builds.
Sandbox f8821ec2 ran real `claude --version` -> `2.1.263 (Claude Code)` plus rein
CLI/import checks, with owner allowlisted provider egress and HTTPS_PROXY set
by the broker. Runtime read-only, private 0700 HOME/state persistence, clean Git,
absent source and loopback-only interfaces passed; workspace and proxy removed.
`make check`: lint passed, 175 tests passed.
Evidence: docs/evidence/SAND-WP-0015-claude-startup-2026-09-06.json.
Reproduce with the builder options above and `scripts/smoke-bwrap-runtime.py
--runtime-path <candidate> --runtime-sha256 <digest> --claude-version 2.1.263`.
Limits: `--version` proves startup with the proxy environment, not that Claude
has sent a provider request through it. No credential acquisition or model run.
The /tmp candidate is not production placement; protected artifact installation,
owner configuration, credential adoption and real-model proof remain T04 gates.
## Install the pinned runtime in the local owner's protected store
```task
id: SAND-WP-0015-T06
status: done
priority: high
assignee: the-custodian
state_hub_task_id: "f85f54c9-1081-5d0c-95ad-aca20ede8d66"
```
HFACT-WP-0001-T04 consumes this independent installation return. Reuse the
already verified combined candidate with digest
`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`;
do not rebuild resolved dependencies. Publish it under the local owner's
private artifact store, verify exact copied content/modes and refusal of unsafe
or corrupted destinations, and prove startup/read-only access/teardown through
the installed path. The owner remains trusted; this is not root-owned storage.
T04 retains real credential adoption, owner configuration, model acceptance
and production placement. No credential route or profile is activated here.
`scripts/install-bwrap-runtime.py` installs below the owner's home into a
mode-0700 store, verifies before and after copying, preserves artifact modes
and internal symlinks, serializes publishers and never overwrites a published
artifact. Existing modified artifacts are refused rather than repaired silently.
Group/other-writable ancestors, unsafe permission bits and store aliases refuse.
Unit tests cover integrity, idempotence, copy-time corruption and access modes.
T06 completed 2026-09-08 on bnt-lap001, local owner UID 1000. Installed the
unchanged 358-entry / 245176062-byte candidate at
`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`.
The private store is mode 0700; the installing owner remains trusted. A root-owned
system installation was not claimed or required for this local owner contract.
The installed-path sandbox smoke `51b59587` passed real Claude 2.1.263 and rein
startup, read-only mount, private state persistence, clean worktree, absent source,
loopback-only interfaces and complete workspace/proxy teardown. No model call
or credential acquisition occurred. `make check`: lint clean, 188 tests passed.
Two existing tests require the checkout directory name `sand-boxer`; the final
full check used that canonical basename. Evidence:
`docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`.
T04 retains owner execution configuration, native credential/egress and real-model
acceptance; Railiance installation needs its own target-specific return.
## 2026-09-09 factory metered route source return
Implemented the trusted, ephemeral Messages route described in
[docs/bwrap-messages-route.md](../docs/bwrap-messages-route.md). Actual local
bwrap owner transport proves provider key/ledger separation, direct-route denial,
revocation and teardown; rein also proves metered request plus commit import and
close replay. `make check`: lint clean, 199 passed. T04 remains waiting for the
admitted provider-to-owner bootstrap, updated protected runtime/profile, Railiance
placement, live compatibility and G0. Existing child-provider-key/direct-CONNECT
proofs do not admit this different credential holder or metered profile. No CCR,
secret read, deployment or paid request was performed.
## 2026-09-09 standalone owner packaging and runtime selection
Added frozen-lock owner build mode for the matched rein/llm/Glas/sandboxer set,
with non-editable installation and recorded lock/source/package pins. Sand-boxer
wheels now carry their profile and extension definitions, fixing a bwrap owner
failure that source-checkout tests could hide. The trusted Messages binding can
select the digest-pinned runtime without adding an API or profile override.
`make check`: lint clean, 205 passed. Existing standalone workload builds remain
supported. See docs/bwrap-runtime.md and rein's docs/owner-bootstrap.md.
The project's `evidence/2026-09-09-owner-bootstrap.json` records the actual candidate
build and isolated installed-interpreter/CLI proof. T04 remains wait for accepted
credential-to-owner delivery, current protected installation and Railiance placement,
provider compatibility and G0. Source packaging does not reopen completed T01-T03,
T05-T06, broaden the old CCRs or activate the previously installed 2.1.263 artifact.
The first standalone candidate exposed a stale cached local wheel despite current
Git metadata. Owner builds now refresh all local distributions and compare every
installed package source/definition file with its tracked source; stale, missing or
extra files refuse the build. Four content-conformance regressions cover that gap.
## 2026-09-27 installed launcher defect and guarded correction
REINAH-WP-0003's single admitted attempt completed native provider/companion
apply, verify and exec, including scoped-token revocation. The claimed job
`6efa9436-6a91-47c0-94e5-b31b5a0e7e3a` failed before any provider request
reservation. The sandbox was destroyed and the source repository is unchanged.
The parent EUR 10 liability remains held for explicit reconciliation; no retry
or replacement authority is inferred.
Installed artifact `b6e4e8a4` contains uv-generated three-line shell launchers
that still reference a vanished temporary build interpreter. The builder had
only rewritten direct Python shebangs. Fixed both generated forms and added
actual relocation/execution tests for direct, long and space-containing build
paths, plus refusal of unknown governed launchers. Builder tests: 12 passed;
focused lint passes. Rein's real installed bwrap probe reproduces both broken
entrypoints at exit 127 with zero provider forwards; its new bootstrap checks
refuse the malformed artifact before claiming.
T04 remains `wait` and this plan stays `blocked`: replacement artifact build/
admission and a separately authorized successful model/tool/commit proof remain.
The existing SAND-WP-0015 / REINAH-WP-0003 / SECRETS-WP-0009 records retain the
work. No new task or workplan. Detailed non-secret receipts are in rein-aharness
`docs/evidence/2026-09-27-metered-*.json`.
## 2026-10-04 offline owner startup proof preparation
The existing no-credential smoke command now supports
`--require-owner-entrypoints`: the admitted digest-pinned runtime must start both
`rein-aharness --help` and `glas-harness --help`, and imported rein, llm-connect,
Glas and sandboxer modules must originate inside the mounted artifact. Broken or
missing launchers, failed help, timeout and external package origins cannot be
recorded as startup success. The default standalone mode remains supported.
Launcher diagnostics are not copied into the receipt. Focused tests exercise
real subprocesses, including the vanished-build-interpreter failure.
This is preparation for a corrected immutable candidate's independent native
startup proof; it is not that candidate's receipt or owner acceptance. T04 stays
`wait`, the plan stays `blocked`, and the Sept27 artifact/liability evidence
remains intact. Replacement artifact admission and pins, explicit retained
EUR 10 reconciliation, and a separately authorized successful model/tool/commit
attempt remain with the existing owners. No credentials, provider request,
queue claim, policy activation or retry authorization is supplied here.
2026-10-04 current blocker reconciliation: September 27 native provider/companion
apply/verify/exec and successful revocation supersede the original missing
platform route. The remaining owner return is rein-aharness corrected artifact/
profile admission, retained EUR10 reconciliation and fresh retry authority.
T04 stays wait; no renewed trial is authorized. Full owner check: lint clean,
219 tests passed (one existing Starlette deprecation warning).
## 2026-10-13 owner returns: reconciliation and corrected build
rein-aharness `d897a83` records owner reconciliation of the Sept 27 held
liability: run `6efa9436` failed at launcher exit 127 before any provider
reservation; liability stays at the full hold, exhausting that one-attempt
envelope, and the owner authorized a new retry envelope on 2026-10-13.
rein-aharness `9a4469d` records corrected runtime `ee3d0a53…` (replaces
`b6e4e8a4…`; only rein moved, adding pre-claim launcher rejection), built with
the sand-boxer builder fix; both launchers exit 0 inside bwrap. Receipts:
rein-aharness `docs/evidence/2026-10-13-*.json`.
Remaining before T04 closes: install `ee3d0a53` on railiance01, pin its digest
in owner config, pass `--require-owner-entrypoints` offline startup proof, then
run the single authorized attempt to a successful model/tool/commit receipt.
T04 stays `wait`; the plan stays `blocked`.
2026-10-14 check: rein-aharness pushed `9a4469d` (corrected build record) and
opened REINAH-WP-0008 (simpler metered retry, active). No railiance01 install/
admission of `ee3d0a53` or successful acceptance receipt yet; request sent on
hub message `82faf25c`. T04 stays `wait`; plan stays `blocked`.
2026-10-14 rein-aharness reply (thread `82faf25c`): step 1 done (`9a4469d` on
origin/main). Steps 2-4 are REINAH-WP-0008-T07. Budget is now up to three
attempts within EUR 10 under memo `infd-20261014-b01` (observed-usage
settlement); order: memo acceptance in the attended informed-decision sitting,
rebuild and install `ee3d0a53` on railiance01, `metered-once --rehearse`,
`owner renew`, first attempt. Railiance01 still pins `b6e4e8a4`. T04 stays `wait`.
2026-10-15 owner-approved rebuild: the pinned inputs of the `ee3d0a53` receipt
(same four commits, uv.lock `8775904b…`, Claude 2.1.266 `19842705…`) rebuilt
to `818b1b7c8292…f359`. The digest differs only because the builder embeds
absolute source paths (`direct_url.json`, `build-info.json`). Owner-entrypoint
startup smoke passed in sandbox `28df7a1d`; no credentials or model calls.
Sent to rein-aharness (message `8a7962f7`, thread `82faf25c`) to record as the
then-current corrected runtime for REINAH-WP-0008-T07 and to load the unsigned
memo sitting. Nothing installed on railiance01. T04 stays `wait`.

113
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/verified-publication.json Normal file
View file

@ -0,0 +1,113 @@
{
"schema": "custodian.identity-binding-source-publication.v1",
"observed_at": "2026-10-17T11:28:15.925389+00:00",
"status": "all_three_authorized_source_publications_verified",
"rows": [
{
"owner": "rein-aharness",
"commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1",
"remote_verified": true,
"explicit_commit_paths": [
"AGENTS.md",
"workplans/REINAH-WP-0008-simpler-metered-retry.md"
],
"primary_projection_verified": true,
"counts": {
"created": 0,
"updated": 9,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 7,
"cancelled_tasks": 0,
"created_edges": 1,
"removed_edges": 0,
"unresolved_edges": 0,
"external_edges": 3
},
"consistency_summary": {
"fail": 0,
"automation_error": 0,
"warn": 5,
"info": 0
},
"unrelated_generated_worktree_and_index_preserved": true,
"final_status": ""
},
{
"owner": "glas-harness",
"commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc",
"remote_verified": true,
"explicit_commit_paths": [
"workplans/GLAS-WP-0012-first-local-profile-production-proof.md"
],
"primary_projection_verified": true,
"counts": {
"created": 0,
"updated": 18,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 8,
"cancelled_tasks": 0,
"created_edges": 0,
"removed_edges": 0,
"unresolved_edges": 0,
"external_edges": 6
},
"consistency_summary": {
"fail": 0,
"automation_error": 0,
"warn": 6,
"info": 0
},
"unrelated_generated_worktree_and_index_preserved": true,
"final_status": "M .custodian-brief.md\n M WORK-RECORDS.md\n"
},
{
"owner": "sand-boxer",
"commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e",
"remote_verified": true,
"explicit_commit_paths": [
"workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md"
],
"primary_projection_verified": true,
"counts": {
"created": 0,
"updated": 15,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 0,
"cancelled_tasks": 0,
"created_edges": 0,
"removed_edges": 0,
"unresolved_edges": 0,
"external_edges": 1
},
"consistency_summary": {
"fail": 0,
"automation_error": 0,
"warn": 3,
"info": 0
},
"unrelated_generated_worktree_and_index_preserved": true,
"final_status": ""
}
],
"rein_original_8_UUIDs_and_3_human_waits_preserved": true,
"rein_7_null_record_ids_filled": true,
"rein_two_original_dependency_rows_retained": true,
"glas_sand_12_exact_task_bindings_verified": true,
"sand_required_check": {
"lint": "pass",
"tests": 220,
"result": "pass"
},
"old_broad_sand_patch_not_applied": true,
"native_runtime_or_proposal_or_supervision_changed_by_this_subtask": false,
"note": "Normal whole-repository receiving restored existing source-derived projection fields; rein also restored one existing-source WP0005\u2192ACTIVITYWP0026 edge. No new source work, retirement or task creation."
}

262
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/AGENTS.md Normal file
View file

@ -0,0 +1,262 @@
# rein-aharness — Agent Instructions
## Repo Identity
**Purpose:** Claude-Code-CLI-driven rein: governed, unattended/scheduled agent runtime
**Domain:** infotech
**Repo slug:** rein-aharness
**Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a`
**Workplan prefix:** `REINAH-WP-`
`REIN-A-0001` through `REIN-A-0004` are immutable historical identifiers from
before the fleet `PREFIX-WP-NNNN` convention. `HARNESS-WP-0001` through
`HARNESS-WP-0003` and `HARNESS-WP-ADHOC-2026-09-04` are older ids from the
agent-harness name. Preserve all of these in references and archives, but use
the hub-registered `REINAH-WP-` prefix for every new workplan and task.
---
## Developer Workflow
```bash
# Install (editable, including the governed profile-execution siblings)
python3 -m venv .venv && source .venv/bin/activate
pip install -e . -e ../llm-connect -e ../sand-boxer -e ../glas-harness pytest
# Test
PYTHONPATH=".:$HOME/llm-connect" python3 -m pytest tests/ -q
# Run — bounded agentic session against a real target repo (real Claude Code
# CLI call, real commit if successful)
rein-aharness run --task-file examples/task-hello-sandbox.json --no-hub --no-metrics
# Build the Railiance deploy image
make image
```
## State Hub Integration
The Custodian State Hub tracks work across all domains. Interact via HTTP REST —
there is no MCP server for Codex agents.
| Context | URL |
|---------|-----|
| Local workstation | `http://127.0.0.1:8000` |
| Remote (railiance01, in-cluster) | `http://10.43.68.154:8000` |
| Optional local edge relay | http://127.0.0.1:18080 |
When an operator has enabled the edge relay, set API_BASE to the relay URL.
Queueable writes return an explicit queued receipt if the central hub is
unreachable. Treat that as pending local evidence, then ask the operator to run
statehub outbox status/replay after connectivity returns.
### Orient at session start
```bash
# Offline brief — works without hub connection
cat .custodian-brief.md
# Active workplans for this domain
curl -s "http://127.0.0.1:8000/workplans/?topic_id=cee7bedf-2b48-46ef-8601-006474f2ad7a&status=active" \
| python3 -m json.tool
# Check inbox
curl -s "http://127.0.0.1:8000/messages/?to_agent=rein-aharness&unread_only=true" \
| python3 -m json.tool
```
Mark a message read:
```bash
curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
-H "Content-Type: application/json" -d '{}'
```
### Log progress (required at session close)
```bash
curl -s -X POST http://127.0.0.1:8000/progress/ \
-H "Content-Type: application/json" \
-d '{
"summary": "what was done",
"event_type": "note",
"author": "codex",
"workplan_id": "<uuid>",
"task_id": "<uuid>"
}'
```
Omit `workplan_id` / `task_id` when not applicable.
### Update task status
```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
-H "Content-Type: application/json" \
-d '{"status": "progress"}'
# values: wait | todo | progress | done | cancel
```
### Flag a task for human review
```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
-H "Content-Type: application/json" \
-d '{"needs_human": true, "intervention_note": "reason"}'
```
---
## Session Protocol
**Start:**
1. `cat .custodian-brief.md` — domain goal and open workplans (offline-safe)
2. Check inbox: `GET /messages/?to_agent=rein-aharness&unread_only=true`; mark read
3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks
4. Check human-needed tasks: `GET /tasks/?needs_human=true`
**During work:**
- Update task statuses in workplan files as tasks progress
- Record significant decisions via `POST /decisions/`
**Close:**
1. Update workplan file task statuses to reflect progress
2. If finishing a workplan: hand off **residuals** as live work records first
(intake with `origin: residual` + `origin_ref: <WP-id>`, or a next workplan /
decision / engagement). Do not park leftovers only in prose or `SCOPE.md`.
Canon: `the-custodian/canon/standards/work-record-types_v0.1.md` § Residuals.
3. Log: `POST /progress/` with a summary of what changed (name handoff ids)
4. After workplan file changes, run:
```bash
statehub fix-consistency
```
Coding agents should run this directly; ask the operator only if the CLI or
State Hub API is unavailable. This syncs task status from files into the hub DB.
---
## Credential and access routing
**Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect**
for inference. Run this check **before** requesting secrets, API keys, SSH access,
login tokens, or database passwords — in any repo, not only `ops-warden`.
ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Every
other credential need belongs to another subsystem. **Do not** message
`ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key.
### Lookup (do this first)
```bash
warden route find "<describe your need>" --json
warden route show <catalog-id> --json
```
Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`).
| Agent runtime | How to orient |
| --- | --- |
| **Codex / Grok** (shell, HTTP State Hub) | `warden route` commands above; inbox `to_agent=rein-aharness` is for coordination, not secret vending |
| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workplans; **still** use `warden route` for credential ownership |
| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden route` |
### Quick routing table
| I need… | Owner | ops-warden executes? |
| --- | --- | --- |
| SSH cert (`adm`/`agt`/`atm`) | ops-warden | **Yes** — `warden sign` |
| API key, DB password, provider token | OpenBao (`railiance-platform`) | No — route only |
| Login / OIDC / MFA | key-cape / Keycloak | No — route only |
| Authorization decision | flex-auth | No — route only |
| activity-core → issue-core emission | activity-core + issue-core | No — `warden route show activity-core-issue-sink` |
| SSH tunnel | ops-bridge (+ `cert_command` from warden) | No — route only |
### Anti-patterns (do not do these)
- `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc.
- Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist
- Pasting secrets into Git, State Hub, workplans, logs, or chat
### Other capabilities (reuse-surface)
Non-credential capabilities are usually discovered through **reuse-surface** federation
(`reuse-surface` registry / `capability.*` indexes). Credential routing is inlined in
every repo's agent instructions because it is high-frequency, high-risk, and easy to
get wrong.
**Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`
<!-- REPO-AGENTS-EXTENSIONS -->
<!-- Append repo-specific agent instructions below this marker.
The state-hub template sync preserves content after this line. -->
---
## Workplan Convention (ADR-001)
Work items originate as files in this repo — not in the hub. The hub is a
read/cache/index layer that rebuilds from files.
**File location:** `workplans/REINAH-WP-NNNN-<slug>.md`
**Archived location:** finished workplans may move to
`workplans/archived/YYMMDD-REINAH-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
the completion/archive date; the frontmatter `id` does not change.
**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
`workplans/ADHOC-YYYY-MM-DD.md` with task ids `ADHOC-YYYY-MM-DD-T01`, etc. Use
this only for low-risk work completed directly; create a normal workplan for
anything needing analysis, design, approval, dependencies, or multiple phases.
**Frontmatter:**
```yaml
---
id: REINAH-WP-NNNN
type: workplan
title: "..."
domain: infotech
repo: rein-aharness
status: proposed | ready | active | blocked | backlog | finished | archived
owner: codex
topic_slug: ...
created: "YYYY-MM-DD"
updated: "YYYY-MM-DD"
state_hub_workstream_id: "<uuid>" # fix-consistency — do not edit (legacy field name; workplan UUID)
---
```
Use `proposed` for a new draft, `ready` after review against current repo
state, and `finished` after implementation. `stalled` and `needs_review` are
derived health labels, not frontmatter statuses.
**Terminology:** workplan is the fleet term; `workstream` appears only in legacy
API/MCP/frontmatter bridges until `STATE-WP-0069` retires them — see
`the-custodian/canon/standards/workplan-terminology-fleet_v0.1.md`.
**Task block format** (one per `##` section):
```
## Task Title
` ` `task
id: REINAH-WP-NNNN-T01
status: wait | todo | progress | done | cancel
priority: high | medium | low
state_hub_task_id: "<uuid>" # written by fix-consistency — do not edit
` ` `
Task description text.
```
Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blocked work and `cancel` for stopped work.
**Residuals when finishing:** actionable leftovers become live work records
before `status: finished` — usually an intake (`origin: residual`,
`origin_ref: REINAH-WP-NNNN`) or a spawned workplan. Residual is a *role*,
not a kind. Fleet list lives on State Hub, not in `SCOPE.md`.
To create a new workplan:
1. Write the file following the format above
2. Run `statehub fix-consistency` locally; ask the operator only if the CLI or
State Hub API is unavailable.

354
docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/workplans/REINAH-WP-0008-simpler-metered-retry.md Normal file
View file

@ -0,0 +1,354 @@
---
id: REINAH-WP-0008
type: workplan
title: "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal"
domain: infotech
repo: rein-aharness
status: blocked
owner: claude-code
topic_slug: rein-aharness
priority: high
created: "2026-10-13"
updated: "2026-10-16"
related:
- REINAH-WP-0003
state_hub_workstream_id: "187c2599-84a6-5764-a14f-7e9121975bf2"
---
# REINAH-WP-0008 — Simpler metered retry
## Origin
On 2026-10-13 the owner reconciled the 2026-09-27 hold for run `6efa9436`
(`docs/evidence/2026-10-13-held-liability-reconciliation.json`). A corrected
runtime `ee3d0a53…` was built
(`docs/evidence/2026-10-13-corrected-owner-runtime-build.json`). The owner
authorized a new envelope and one retry.
Preparing that retry took too many owner ceremonies:
1. The runtime is built on the workstation and copied to railiance01 by hand.
2. `owner.json` and the spend policy hold five digests that the owner edits
by hand.
3. A failed attempt keeps its full hold even when no provider request was
made, so every failure needs a new envelope, ledger and pins.
4. Every attempt needs six native approvals.
5. The launcher bug that failed run `6efa9436` was found only by spending
money. A free check on the host would have caught it.
The owner agreed (2026-10-13) to fix items 5, 3 and 2 here, and to record
the rest as decisions instead of blocking on them.
**Goal:** a retry becomes: install the artifact, rehearse for free, approve
once, run.
## A. Free rehearsal on the host
```task
id: REINAH-WP-0008-T01
status: done
priority: high
state_hub_task_id: "c6536c8d-7862-5de6-ad2b-401077b60c04"
```
Add a free rehearsal to the owner check. It runs everything
`metered-once --check` does, then executes the admitted runtime's
`rein-aharness` and `glas-harness` launchers inside bwrap from the mount
path, with no network, credentials, provider route or ledger write. The
sandbox profile is already resolved by `--check`. It prints one receipt with
the runtime digest and each launcher's exit code.
Today's launcher check reads only the first line of each launcher. This
rehearsal runs them, the same way the failing run did.
**Done when:** tests prove the rehearsal fails on a runtime whose launchers
point at a missing build directory (the `6efa9436` failure) and passes on a
relocated runtime. It must make no network calls and write nothing. The
owner procedure in `docs/owner-bootstrap.md` makes the rehearsal a required
step before any paid attempt.
### Implemented — 2026-10-13
`rein-aharness metered-once --owner-config <owner.json> --rehearse` (the flag
implies `--check`, so it never reads a provider key or claims). The code is in
`rein_aharness/owner_rehearsal.py`. It uses sand-boxer's isolation flags and
read-only system binds, with the runtime read-only at `/opt/sandboxer/runtime`,
`--unshare-net` and `--clearenv`. It runs each Python launcher with `--help`,
plus `claude --version` when `build-info.json` declares Claude. A missing
bwrap fails closed.
Tests (`tests/test_owner_rehearsal.py`, `tests/test_owner_bootstrap.py`):
- With real bwrap, a relocated runtime passes. The uv trampoline that
re-executes a deleted build interpreter fails with 127, as run `6efa9436`
did.
- The rehearsal never claims and never reads the key.
- The command line has no writable bind and no credential.
The corrected runtime `ee3d0a53…` rehearses clean: rein-aharness 0,
glas-harness 0, claude 0.
## B. Release holds that provably cost nothing
```task
id: REINAH-WP-0008-T02
status: done
priority: high
state_hub_task_id: "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9"
```
`SpendLedger.reconcile` keeps the full hold (`max(held, observed)`). Add an
evidence-backed release. If the run has zero provider-request reservations
and its request route is revoked, reconciliation may set the liability to
the observed amount. Otherwise the current rule stands. The release records
which evidence allowed it, and the CLI flag says so, for example
`--release-unused-hold`.
This changes a deliberate safety rule, so it needs owner sign-off on the
exact rule before merge. That sign-off is recorded in T04's decision note.
**Done when:** tests cover all four cases. A run with no request
reservations and a revoked route releases. A run with any request
reservation, or with a live route, refuses the release. A second, identical
reconcile changes nothing. The envelope is never marked breached by a
release.
### Widened to observed-usage settlement — 2026-10-14
On 2026-10-13 the owner asked for three attempts within EUR 10 and chose
option B: settle to actual usage instead of releasing only unused holds.
Under full-hold accounting each request holds USD 4.64 (1M context plus
64k output), so EUR 10 cannot fit three attempts.
Implemented as an opt-in envelope term (`settlement: observed-usage`) plus
`max_runs`; see `docs/owner-bootstrap.md`. Under it:
- a completed request is charged its gateway-metered cost;
- runs and reconciliations are charged
`max(metered requests, reported or attested cost)`;
- unfinished requests keep their full hold, and overruns still freeze the
envelope.
The run 6efa9436 shape (failure before any request) now reconciles to its
attested cost. Defaults and existing digests are unchanged. Tests:
`tests/test_spend_settlement.py`, plus renewal cases in
`tests/test_owner_renew.py`.
Merge-ready, but the rule still needs the owner's acceptance in decision
`a93619a9`.
## D. One owner command for renewal
```task
id: REINAH-WP-0008-T03
status: done
priority: high
state_hub_task_id: "87457216-2371-51ca-b3d4-3917e6f180a2"
```
Add `rein-aharness owner renew --owner <owner.json> --runtime <digest>
--envelope <envelope.json>`. It does three things:
1. It refuses unless every reservation in the current ledger is settled.
2. It writes the new spend policy, initializes a fresh ledger, and updates
the runtime and spend-policy pins in `owner.json` together. Old files are
kept as backups. Existing ledgers are never reset.
3. It prints one summary for the owner to review: old to new runtime, old
to new policy digest, envelope cap and attempt limit, and ledger path.
Add a dry-run mode that only prints the summary. Afterwards, run the T01
rehearsal.
**Done when:** a test renews from the 2026-09-27 layout to a new envelope.
The owner check passes on the result. A second renew with an unsettled
reservation refuses. No digest has to be typed by hand.
### Implemented — 2026-10-13
The command is `rein-aharness owner renew --owner-config --policy --ledger
--runtime-path --envelope [--apply]`, in `rein_aharness/owner_renew.py`.
Without `--apply` it is a dry run. Choices:
- **Envelope file:** only the envelope fields may change. Worker, target,
profile and grant pins carry over, and `SpendPolicy` validation runs on
the result.
- **Paths stay the same:** the old ledger is renamed to
`.retired-<old envelope>`, never reset, and the old policy and owner.json
are kept as `.bak`. Secrets Engine pins the `exec_owner` files by sha256
and the ledger path through its fixed environment, so keeping the paths
means the catalog needs only new file hashes. The command prints them.
- **Refusals:** a held reservation, an open request route, an open SQLite
transaction, an owner.json that doesn't match the policy, a reused
envelope id, a disallowed field, or leftovers from an earlier renewal.
Tests (`tests/test_owner_renew.py`):
- A dry run changes nothing.
- An applied renewal passes the real owner check (`prepare`) at the
unchanged paths.
- A charged reservation, the railiance01 state after the 2026-10-13
reconciliation, renews, and the row survives in the retired ledger.
- Bad envelopes and a second apply both refuse.
Finding for T06: renewal still changes the pinned file hashes, so each
renewal needs a Secrets Engine catalog update and fresh approvals.
## C. Envelopes that cover several attempts (decision)
```task
id: REINAH-WP-0008-T04
status: done
decision_id: "a93619a9-8a70-40d8-aaf9-c29357d2a043"
priority: medium
state_hub_task_id: "898e02af-51bb-5e8d-93d0-ae908466c612"
```
Owner decision: should future envelopes be admitted as "up to N attempts
within EUR X" instead of one attempt? The EUR 10 cap already fits two
USD 4.64 request holds. Record the choice, together with T02's sign-off,
as a decision note in `docs/`. T03's envelope format then reflects it.
### Decided — 2026-10-14
The owner chose up to three attempts within EUR 10 (EUR 5 per attempt) and
observed-usage settlement, and resolved hub decision `a93619a9` with that
choice. Record: `docs/decisions/2026-10-14-spend-envelope-settlement.md`.
The terms are in spend memo `infd-20261014-b01`.
## E. Ship the owner runtime as a container image (decision)
```task
id: REINAH-WP-0008-T05
status: wait
needs_human: true
decision_id: "e6ca2f07-2708-4013-bfba-bf89fa0f1cb5"
priority: low
state_hub_task_id: "b486e86b-9d0f-501d-a394-771b40f771ee"
```
Decision for later, with Platform (railiance) and Sand-boxer: should the
owner runtime ship through the registry and GitOps, using the existing
`make image` path, instead of rsync and a manual digest check? Out of scope
here. If accepted, hand it off as a residual intake to the owning repos.
## F. Approvals per envelope (decision)
```task
id: REINAH-WP-0008-T06
status: wait
needs_human: true
decision_id: "e8986e40-f6f8-4c87-b704-bff50cc4958b"
priority: low
state_hub_task_id: "4cf721e6-724b-5c64-91bb-67b098bb97af"
```
Decision for later, with Secrets Engine: should one approval set cover an
envelope's attempts instead of six native approvals per attempt? The work
lives outside this repo. If accepted, hand it off as a residual intake.
## Retry on the corrected runtime
```task
id: REINAH-WP-0008-T07
status: wait
needs_human: true
blocking_reason: "Owner: accept spend memo infd-20261014-b01, then attended install, rehearsal, renew and approvals on railiance01"
priority: high
state_hub_task_id: "80318842-ccaa-5484-a54a-3d9981eaec8b"
```
Waits on T01 and T03. It does not need T02.
Steps:
1. Rebuild `ee3d0a53…`, or the then-current corrected runtime, from the
pinned commits.
2. Install it on railiance01.
3. Run the T01 rehearsal.
4. Renew with T03 to the owner-authorized new envelope (EUR 10, authorized
2026-10-13).
5. Run exactly one attended attempt, which consumes fresh native approvals.
Record the result in REINAH-WP-0003-T05/T06.
### Waiting on the owner — 2026-10-14
Everything this repo can do is done: the rehearsal (T01), the settlement rule
(T02, T04) and renewal (T03) are in place. Draft memo `infd-20261014-b01` is
in informed-decision `ee6a65b`. What remains needs the owner, in order:
1. Accept the memo in the attended sitting.
2. ~~Rebuild `ee3d0a53` from the pinned commits~~ (done 2026-10-15 as
`818b1b7c…`, see below) and install it on railiance01.
3. Run `metered-once --rehearse`.
4. Run `owner renew` with the memo's terms, then update the Secrets Engine
file pins.
5. Approve the native actions and run the first attempt.
Sand-boxer's steps 2–4 in message `82faf25c` are this same sequence.
### Runtime rebuilt — 2026-10-15
Step 1 is done. The owner approved a rebuild because `ee3d0a53…` was not kept
on the workstation. Sand-boxer built `818b1b7c…` from the same pinned inputs
and builder. The digest differs only because the build-source paths are
embedded in the artifact. The bwrap startup smoke passed (sandbox `28df7a1d`)
with no credentials and no model run. `818b1b7c…` is now the install
candidate. It is not installed on railiance01 (still `b6e4e8a4…`) or admitted.
Receipt: `docs/evidence/2026-10-15-rebuilt-owner-runtime.json`. The memo still
still has to be created, admitted, loaded and accepted first. The owner steps
are in informed-decision `docs/batches/2026-10-14-three-attempts/OPERATOR.md`.
### Memo queued — 2026-10-15
Owner step 1 is in progress via the lifecycle intake path (owner's choice; the
review-record approval counts as spend authority). Workspace draft
`2ccb4bda-e318-51d2-a8dd-709db768494f`, review
`review-e2d2e98f-4701-45b0-abc1-4fe9f00bd1a8`, queued by the owner in the State
Hub memo dispatcher; approval intent `accept` by `helixforge-factory`. Record:
informed-decision `d5f1021` (sitting.json, OPERATOR.md). The accepted approval id
becomes `authority_ref` for `owner renew`. Install candidate remains `818b1b7c`.
### Workload-only Glas source integration — 2026-10-16
Reviewed and integrated the one-line runtime-contract lock advance from Glas
`30be81808140a3a3d137e731d1fe9aed59ad8581` to published workload-only credential
delivery `7357115c8311e55ee3d495f5266f501a17ec3c89`. llm-connect `37436bb5` and
sandboxer `221126cb` remain pinned. This is source integration under T07, not
native artifact installation or admission. T07 remains waiting with its existing
owner gates.
Prior preparation used rein base `be5ef400` plus isolated lock-only commit
`c811fc43` to build candidate
`634e65fee5517ebee0d1080805fd84c81bd46af26a2b38ec1ab14bd2be17bf8f`. The
candidate's installed packages passed actual SandboxManager/Glas gateway proof
with unchanged `harness.agent-dev-local@1.1.1` (still unverified): real rein/Glas
CLI and Claude 2.1.266 startup, read-only runtime, synthetic host-file and
inherited environment/child-process denial, exact task identity/private state,
deterministic workspace Git effect, task removal and destruction. A separately
labelled synthetic route fixture passed workload-only delivery, output redaction
and clean subsequent housekeeping through the same actual manager. Wrong
actor/project/run, expired execution, expiry cleanup, cancellation and
post-cancellation refusal passed. All 141 Glas tests and seven rein lock/rehearsal
tests passed; whole artifact digest remained unchanged after proof.
The first proof runner correctly encountered the manager's PermissionError for
wrong consumer but expected ValueError/RuntimeError. Its finally cleanup ran;
the runner catch was refined and the failure retained. This does not earn an
unchanged execution success. No model/provider request, real credential read,
queue access or spend occurred.
The preparation artifact is not the artifact of this integrated owner revision.
Rebuild from the exact committed owner source and verify its new digest and
actual-manager proof before considering installation. Source inputs, receipts,
reproducible proof and attempt history are retained in the
[Custodian evidence directory](../../the-custodian/docs/changes/netkingdom-target-2026-10-16/agent-isolation-next/README.md).
The same directory records the integrated-source rebuild separately.
Retain `818b1b7c`, `ee3d0a53`, installed `b6e4e8a4` and their outcomes as historical
evidence. Native acceptance still requires the queued spend memo lifecycle,
owner artifact installation/rehearsal, renewal and Secrets Engine file-pin
updates, required native approvals and bounded real-model/tool proof. Actual
interactive assignment migration and external tool-path denial remain Custodian
acceptance obligations; no profile readiness or supervision authority changed.