diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/README.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/README.md new file mode 100644 index 00000000..52d94cb7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/README.md @@ -0,0 +1,98 @@ +# Rein metered retry identity binding review + +Read-only source/history and public work-record review, 17 October 2026. No +source, ID, row, alias, retirement acknowledgement or authority was changed. + +## Finding + +The refused receiving transaction is correct under its current identity +contract. Parent `187c2599-84a6-5764-a14f-7e9121975bf2` is the deterministic +HARNESS-WP-0008 UUID. All seven task UUIDs likewise derive from their original +HARNESS IDs. The current file calls the same records REINAH-WP-0008/T01–T07 but +retains the HARNESS UUIDs. Canonical receiving derives UUIDs from canonical IDs; +ordinary embedded UUID fields are not authority to change that identity. + +Creation commit `dd588f3e337c5f478653c006905a09a2e12bcdc1` (13 October) +created HARNESS-WP-0008 under then-current AGENTS instructions naming HARNESS-WP +as the prefix. Four minutes later, +`a85de661f04b8331ec66b921d165671f4da77305` changed the file and AGENTS to +REINAH to address C-26. Its stated intent was to keep the Hub IDs and update the +same existing record. The retained source history proves that intent; it is +not a sealed UUID migration approval or a change to receiver semantics. + +The existing C-26 implementation is a **non-fixable warning** whose message says +new plans must conform. It does not instruct an existing record to be renamed. +The canon's grandfathering rule says existing IDs are never renamed. ADR-007 +permits specifically ruled live-collision migrations, not arbitrary prefix +changes in response to C-26; no such HARNESS0008 collision or migration ruling +was found in the reviewed records. The newer prefix remains appropriate for +future new workplans. + +## Existing source/receiver contracts + +- `forge_projection.derive_from_checkout` derives ordinary record UUIDs from + canonical IDs. `reset_repository_projection` matches UUID, then canonical + slug; an identifier change is a rekey rather than a title/path rename. +- `ensure_missing_work_record_identifiers` preserves existing UUIDs and assigns + only missing ones. It cannot repair this source/identity contradiction by + overwriting the eight UUIDs. +- Normal task reconciliation can fill a null record_id when an actual task's + UUID equals the desired derived UUID. After a correct source identity repair, + that existing path can bind the seven records without task recreation. +- The existing sealed UUID migration contract requires a source-sealed atomic + plan, independently verified batch, explicit decision bound to its digest, + database/file phases, durable aliases and reversible failure handling. No + reviewed HARNESS0008 sealed plan or approval was identified. The alias model + records old/new **UUIDs**; it is not a free-form canonical string-ID alias + registry. Do not invent or populate one as a cache repair. + +The receiver must not be weakened to prefer any embedded UUID over a conflicting +canonical identifier. That would defeat the deliberate rekey and collision +guards. The missing record_ids are a consequence of this identity conflict; +they are not seven independent permissions to patch task rows. + +## Recommended minimal source correction for actual owner review + +Restore the original canonical HARNESS-WP-0008 parent and T01–T07 IDs while +keeping the current backing filename, all eight UUIDs, statuses, human gates, +decision references, implementation/native history and existing dependency +endpoints. Add HARNESS0008 to AGENTS' explicit preserved historical list and +record the brief erroneous REINAH label as dated provenance. This is restoration +of an existing identity, not minting another workplan. mapping-proposal.json +names the exact records; no transformation was applied. + +Do not change the prefix registered for future plans. Do not remove the source +history, rewrite immutable prior receipts, accept retirement, clear blocked or +needs_human fields, or silently apply a UUID migration. An ordinary receiving +attempt after a reviewed, published source correction should derive the existing +parent/seven task UUIDs, update those records and fill the null task record_ids, +with zero retired/created records. Confirm that expectation through the existing +normal derive/diff and receiving path before claiming convergence. + +Current cross-owner references to the erroneous REINAH label must receive the +same explicit source correction or a documented provenance clarification. The +identified live driver references are in SAND-WP-0015 and GLAS-WP-0012; exact +source locations/hashes are in current-driver-references.json. Root's pending +native install proposal also uses REINAH-T07 and needs a separately versioned +reference correction if this disposition is accepted. Its original revision +must remain immutable and no revised reference creates native authority. + +If the actual owner instead chooses REINAH as a newly rekeyed canonical record, +that is a different identity transition. Use the existing separately authorized +eight-UUID sealed migration and durable alias machinery with complete reference, +wait and history reconciliation. It is not an ordinary receiving fix, and is +not the minimal preservation option recommended here. + +## Live preservation requirements + +live-seven-bindings.json records exact source/Hub IDs and UUIDs. T01–T04 are +done; T05/T06/T07 remain wait with needs_human=true. Parent remains blocked and +unretired. Existing T07→T01/T03 dependencies use the original task UUIDs. Those +two dependency rows and every human/native gate must survive any authorized +repair. Spend decision a93619a9, image decision e6ca2f07 and approval decision +e8986e40 concern their stated owner choices, not canonical record migration. + +The refused transaction receipt has zero updates/creates/retirements and remains +unchanged. No retirement was acknowledged. This review supplies a concrete +owner correction proposal and source basis; it performs no new native action, +spend, installation, approval or human-wait disposition. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/current-driver-references.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/current-driver-references.json new file mode 100644 index 00000000..4d36ed90 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/current-driver-references.json @@ -0,0 +1,39 @@ +{ + "status": "read_only_current_source_reference_inventory", + "references": [ + { + "repo": "glas-harness", + "path": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md", + "sha256": "sha256:881ab0f5ba3bb43f5404c8f4cd23f9628e014992ba88fc13f541f0fa8b7b1eaa", + "current_references": [ + { + "line": 442, + "source": "admitted on Railiance. REINAH-WP-0008-T07 retains memo lifecycle acceptance," + } + ] + }, + { + "repo": "sand-boxer", + "path": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md", + "sha256": "sha256:230d1ef37aa9c2023335a617492a72678c4671a8bc82d5577e9d7a7cea6e8fe4", + "current_references": [ + { + "line": 92, + "source": "blocking_reason: \"Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.\"" + }, + { + "line": 357, + "source": "opened REINAH-WP-0008 (simpler metered retry, active). No railiance01 install/" + }, + { + "line": 362, + "source": "origin/main). Steps 2-4 are REINAH-WP-0008-T07. Budget is now up to three" + }, + { + "line": 374, + "source": "then-current corrected runtime for REINAH-WP-0008-T07 and to load the unsigned" + } + ] + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/initial-creation.source-history.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/initial-creation.source-history.txt new file mode 100644 index 00000000..2adf2823 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/initial-creation.source-history.txt @@ -0,0 +1,200 @@ +commit dd588f3e337c5f478653c006905a09a2e12bcdc1 +Author: tegwick +AuthorDate: Tue Oct 13 22:52:59 2026 +0200 +Commit: tegwick +CommitDate: Tue Oct 13 22:52:59 2026 +0200 + + Add HARNESS-WP-0008: simpler metered retry + + Free host rehearsal, evidence-backed release of unused holds, and a + one-command owner renewal; multi-attempt envelopes, image shipping and + per-envelope approvals recorded as decisions. + + Co-Authored-By: Claude Opus 5.5 + + Assistant: claude-code + Assistant-Model: opus + Assistant-Process: 269692@bnt-lap001 + Assistant-Session: 8077e68a-0985-4b41-898c-2dc602b0d6be + +diff --git a/workplans/HARNESS-WP-0008-simpler-metered-retry.md b/workplans/HARNESS-WP-0008-simpler-metered-retry.md +new file mode 100644 +index 0000000..bfa06e2 +--- /dev/null ++++ b/workplans/HARNESS-WP-0008-simpler-metered-retry.md +@@ -0,0 +1,175 @@ ++--- ++id: HARNESS-WP-0008 ++type: workplan ++title: "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal" ++domain: infotech ++repo: rein-aharness ++status: ready ++owner: claude-code ++topic_slug: rein-aharness ++priority: high ++created: "2026-10-13" ++updated: "2026-10-13" ++related: ++ - REINAH-WP-0003 ++--- ++ ++# HARNESS-WP-0008 — Simpler metered retry ++ ++## Origin ++ ++On 2026-10-13 the owner reconciled the 2026-09-27 hold for run `6efa9436` ++(`docs/evidence/2026-10-13-held-liability-reconciliation.json`). A corrected ++runtime `ee3d0a53…` was built ++(`docs/evidence/2026-10-13-corrected-owner-runtime-build.json`). The owner ++authorized a new envelope and one retry. ++ ++Preparing that retry took too many owner ceremonies: ++ ++1. The runtime is built on the workstation and copied to railiance01 by hand. ++2. `owner.json` and the spend policy hold five digests that the owner edits ++ by hand. ++3. A failed attempt keeps its full hold even when no provider request was ++ made, so every failure needs a new envelope, ledger and pins. ++4. Every attempt needs six native approvals. ++5. The launcher bug that failed run `6efa9436` was found only by spending ++ money. A free check on the host would have caught it. ++ ++The owner agreed (2026-10-13) to fix items 5, 3 and 2 here, and to record ++the rest as decisions instead of blocking on them. ++ ++**Goal:** a retry becomes: install the artifact, rehearse for free, approve ++once, run. ++ ++## A. Free rehearsal on the host ++ ++```task ++id: HARNESS-WP-0008-T01 ++status: todo ++priority: high ++``` ++ ++Add `rein-aharness owner check --rehearse `. It runs everything ++`metered-once --check` does. It then executes the admitted runtime's ++`rein-aharness` and `glas-harness` launchers inside bwrap, from the mount ++path, with `--unshare-all`, no credentials, no provider route and no ledger ++write. It also checks that the sandbox profile resolves. It prints a single ++pass or fail line with the runtime digest. ++ ++Today's launcher check reads only the first line of each launcher. This ++rehearsal runs them, the same way the failing run did. ++ ++**Done when:** tests prove the rehearsal fails on a runtime whose launchers ++point at a missing build directory (the `6efa9436` failure) and passes on a ++relocated runtime. It must make no network calls and write nothing. The ++owner procedure in `docs/owner-bootstrap.md` makes the rehearsal a required ++step before any paid attempt. ++ ++## B. Release holds that provably cost nothing ++ ++```task ++id: HARNESS-WP-0008-T02 ++status: todo ++priority: high ++``` ++ ++`SpendLedger.reconcile` keeps the full hold (`max(held, observed)`). Add an ++evidence-backed release. If the run has zero provider-request reservations ++and its request route is revoked, reconciliation may set the liability to ++the observed amount. Otherwise the current rule stands. The release records ++which evidence allowed it, and the CLI flag says so, for example ++`--release-unused-hold`. ++ ++This changes a deliberate safety rule, so it needs owner sign-off on the ++exact rule before merge. That sign-off is recorded in T04's decision note. ++ ++**Done when:** tests cover all four cases. A run with no request ++reservations and a revoked route releases. A run with any request ++reservation, or with a live route, refuses the release. A second, identical ++reconcile changes nothing. The envelope is never marked breached by a ++release. ++ ++## D. One owner command for renewal ++ ++```task ++id: HARNESS-WP-0008-T03 ++status: todo ++priority: high ++``` ++ ++Add `rein-aharness owner renew --owner --runtime ++--envelope `. It does three things: ++ ++1. It refuses unless every reservation in the current ledger is settled. ++2. It writes the new spend policy, initializes a fresh ledger, and updates ++ the runtime and spend-policy pins in `owner.json` together. Old files are ++ kept as backups. Existing ledgers are never reset. ++3. It prints one summary for the owner to review: old to new runtime, old ++ to new policy digest, envelope cap and attempt limit, and ledger path. ++ ++Add a dry-run mode that only prints the summary. Afterwards, run the T01 ++rehearsal. ++ ++**Done when:** a test renews from the 2026-09-27 layout to a new envelope. ++The owner check passes on the result. A second renew with an unsettled ++reservation refuses. No digest has to be typed by hand. ++ ++## C. Envelopes that cover several attempts (decision) ++ ++```task ++id: HARNESS-WP-0008-T04 ++status: wait ++priority: medium ++``` ++ ++Owner decision: should future envelopes be admitted as "up to N attempts ++within EUR X" instead of one attempt? The EUR 10 cap already fits two ++USD 4.64 request holds. Record the choice, together with T02's sign-off, ++as a decision note in `docs/`. T03's envelope format then reflects it. ++ ++## E. Ship the owner runtime as a container image (decision) ++ ++```task ++id: HARNESS-WP-0008-T05 ++status: wait ++priority: low ++``` ++ ++Decision for later, with Platform (railiance) and Sand-boxer: should the ++owner runtime ship through the registry and GitOps, using the existing ++`make image` path, instead of rsync and a manual digest check? Out of scope ++here. If accepted, hand it off as a residual intake to the owning repos. ++ ++## F. Approvals per envelope (decision) ++ ++```task ++id: HARNESS-WP-0008-T06 ++status: wait ++priority: low ++``` ++ ++Decision for later, with Secrets Engine: should one approval set cover an ++envelope's attempts instead of six native approvals per attempt? The work ++lives outside this repo. If accepted, hand it off as a residual intake. ++ ++## Retry on the corrected runtime ++ ++```task ++id: HARNESS-WP-0008-T07 ++status: wait ++priority: high ++``` ++ ++Waits on T01 and T03. It does not need T02. ++ ++Steps: ++ ++1. Rebuild `ee3d0a53…`, or the then-current corrected runtime, from the ++ pinned commits. ++2. Install it on railiance01. ++3. Run the T01 rehearsal. ++4. Renew with T03 to the owner-authorized new envelope (EUR 10, authorized ++ 2026-10-13). ++5. Run exactly one attended attempt, which consumes fresh native approvals. ++ ++Record the result in REINAH-WP-0003-T05/T06. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/live-seven-bindings.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/live-seven-bindings.json new file mode 100644 index 00000000..3d6051b2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/live-seven-bindings.json @@ -0,0 +1,178 @@ +{ + "observed_at": "2026-10-17T06:53:16.338873+00:00", + "read_only": true, + "parent": { + "id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "repo_id": "73be5a8e-8503-447f-87cb-de8c2c8c0b9e", + "slug": "harness-wp-0008", + "title": "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal", + "status": "blocked", + "backing_relative_path": "workplans/REINAH-WP-0008-simpler-metered-retry.md", + "projection_retired_at": null + }, + "historical_parent_derived_uuid": "187c2599-84a6-5764-a14f-7e9121975bf2", + "renamed_parent_derived_uuid": "09fc68ec-4274-5669-9936-16e82bb95d76", + "tasks": [ + { + "source_id": "REINAH-WP-0008-T01", + "historical_id": "HARNESS-WP-0008-T01", + "source_uuid": "c6536c8d-7862-5de6-ad2b-401077b60c04", + "source_status": "done", + "historical_derived_uuid": "c6536c8d-7862-5de6-ad2b-401077b60c04", + "renamed_derived_uuid": "fc36020b-348a-53f1-9265-fe83a22d75c5", + "hub": { + "id": "c6536c8d-7862-5de6-ad2b-401077b60c04", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "A. Free rehearsal on the host", + "status": "done", + "needs_human": false, + "decision_id": null, + "blocking_reason": null, + "parent_task_id": null + } + }, + { + "source_id": "REINAH-WP-0008-T02", + "historical_id": "HARNESS-WP-0008-T02", + "source_uuid": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9", + "source_status": "done", + "historical_derived_uuid": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9", + "renamed_derived_uuid": "a52b493c-c990-51f2-a629-14b361cff34e", + "hub": { + "id": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "B. Release holds that provably cost nothing", + "status": "done", + "needs_human": false, + "decision_id": null, + "blocking_reason": null, + "parent_task_id": null + } + }, + { + "source_id": "REINAH-WP-0008-T03", + "historical_id": "HARNESS-WP-0008-T03", + "source_uuid": "87457216-2371-51ca-b3d4-3917e6f180a2", + "source_status": "done", + "historical_derived_uuid": "87457216-2371-51ca-b3d4-3917e6f180a2", + "renamed_derived_uuid": "f4453c99-b937-5716-a665-eccb9c3870d7", + "hub": { + "id": "87457216-2371-51ca-b3d4-3917e6f180a2", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "D. One owner command for renewal", + "status": "done", + "needs_human": false, + "decision_id": null, + "blocking_reason": null, + "parent_task_id": null + } + }, + { + "source_id": "REINAH-WP-0008-T04", + "historical_id": "HARNESS-WP-0008-T04", + "source_uuid": "898e02af-51bb-5e8d-93d0-ae908466c612", + "source_status": "done", + "historical_derived_uuid": "898e02af-51bb-5e8d-93d0-ae908466c612", + "renamed_derived_uuid": "45e8d650-57d5-5e40-a911-49577db0dbd6", + "hub": { + "id": "898e02af-51bb-5e8d-93d0-ae908466c612", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "C. Envelopes that cover several attempts (decision)", + "status": "done", + "needs_human": false, + "decision_id": "a93619a9-8a70-40d8-aaf9-c29357d2a043", + "blocking_reason": null, + "parent_task_id": null + } + }, + { + "source_id": "REINAH-WP-0008-T05", + "historical_id": "HARNESS-WP-0008-T05", + "source_uuid": "b486e86b-9d0f-501d-a394-771b40f771ee", + "source_status": "wait", + "historical_derived_uuid": "b486e86b-9d0f-501d-a394-771b40f771ee", + "renamed_derived_uuid": "b7d8410a-f9ce-5329-ab83-4bb40ad5dae2", + "hub": { + "id": "b486e86b-9d0f-501d-a394-771b40f771ee", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "E. Ship the owner runtime as a container image (decision)", + "status": "wait", + "needs_human": true, + "decision_id": "e6ca2f07-2708-4013-bfba-bf89fa0f1cb5", + "blocking_reason": null, + "parent_task_id": null + } + }, + { + "source_id": "REINAH-WP-0008-T06", + "historical_id": "HARNESS-WP-0008-T06", + "source_uuid": "4cf721e6-724b-5c64-91bb-67b098bb97af", + "source_status": "wait", + "historical_derived_uuid": "4cf721e6-724b-5c64-91bb-67b098bb97af", + "renamed_derived_uuid": "467d0112-89af-5c56-acae-2d421c37f7db", + "hub": { + "id": "4cf721e6-724b-5c64-91bb-67b098bb97af", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "F. Approvals per envelope (decision)", + "status": "wait", + "needs_human": true, + "decision_id": "e8986e40-f6f8-4c87-b704-bff50cc4958b", + "blocking_reason": null, + "parent_task_id": null + } + }, + { + "source_id": "REINAH-WP-0008-T07", + "historical_id": "HARNESS-WP-0008-T07", + "source_uuid": "80318842-ccaa-5484-a54a-3d9981eaec8b", + "source_status": "wait", + "historical_derived_uuid": "80318842-ccaa-5484-a54a-3d9981eaec8b", + "renamed_derived_uuid": "4be5997e-2e07-5977-9b5f-a488ddad3030", + "hub": { + "id": "80318842-ccaa-5484-a54a-3d9981eaec8b", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "Retry on the corrected runtime", + "status": "wait", + "needs_human": true, + "decision_id": null, + "blocking_reason": "Owner: accept spend memo infd-20261014-b01, then attended install, rehearsal, renew and approvals on railiance01", + "parent_task_id": null + } + } + ], + "dependency_endpoint_result": [ + { + "id": "a6dc2ff5-ec61-407c-8fd2-d6a0d6f31547", + "from_workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "from_task_id": "80318842-ccaa-5484-a54a-3d9981eaec8b", + "to_workplan_id": null, + "to_task_id": "c6536c8d-7862-5de6-ad2b-401077b60c04", + "relationship_type": "starts_after", + "description": "REINAH-WP-0008-T07 depends_on REINAH-WP-0008-T01", + "source_owner": null, + "source_commit": null, + "created_at": "2026-10-13T20:58:29.042766Z", + "updated_at": "2026-10-13T20:58:29.042766Z" + }, + { + "id": "67498261-4d2a-4db8-b82e-432dbdcbf4ce", + "from_workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "from_task_id": "80318842-ccaa-5484-a54a-3d9981eaec8b", + "to_workplan_id": null, + "to_task_id": "87457216-2371-51ca-b3d4-3917e6f180a2", + "relationship_type": "starts_after", + "description": "REINAH-WP-0008-T07 depends_on REINAH-WP-0008-T03", + "source_owner": null, + "source_commit": null, + "created_at": "2026-10-13T20:58:29.288075Z", + "updated_at": "2026-10-13T20:58:29.288075Z" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/manifest.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/manifest.json new file mode 100644 index 00000000..0e64c552 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/manifest.json @@ -0,0 +1,14 @@ +{ + "schema": "custodian.identity-binding-review.v1", + "status": "read_only_initial_review", + "created_at": "2026-10-17T06:54:39.000769+00:00", + "files": { + "README.md": "sha256:ef4b07a3d5a4fa2affae0ca49b5cea3a85312fd127e1e38f067ef0947c321831", + "current-driver-references.json": "sha256:dfe6c5c37e4a1229556befd9fe4c4eed44739637c32c49272c5b0dc28f011488", + "initial-creation.source-history.txt": "sha256:88bcf3b29e688f87e100a08937479b8f1fcc4a1091156aa457306e28dfe4a8eb", + "live-seven-bindings.json": "sha256:45ef5f12cb89f6227c49531639658cbe5b2ea4a01c9b741938c6e7d500196f83", + "mapping-proposal.json": "sha256:4ec2d39cab42f2863a5c816677955db8e9316c307f61c47a936182fb85c7eb72", + "prefix-rename.source-history.txt": "sha256:c8be2645b37fd445a11a0b2ac939156aab3e7235945fdbf4551fca0c509487e8", + "source-references.json": "sha256:f6240e4db737b028cb86978e5e4c357d5b9a262c03b5791938c9d596ee00848c" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/mapping-proposal.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/mapping-proposal.json new file mode 100644 index 00000000..ed34f60c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/mapping-proposal.json @@ -0,0 +1,47 @@ +{ + "status": "source_identity_restoration_proposed_no_change_performed_in_initial_review", + "parent": { + "current_label": "REINAH-WP-0008", + "restore_canonical_id": "HARNESS-WP-0008", + "preserve_uuid": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + "tasks": [ + { + "current_label": "REINAH-WP-0008-T01", + "restore_canonical_id": "HARNESS-WP-0008-T01", + "preserve_uuid": "c6536c8d-7862-5de6-ad2b-401077b60c04" + }, + { + "current_label": "REINAH-WP-0008-T02", + "restore_canonical_id": "HARNESS-WP-0008-T02", + "preserve_uuid": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9" + }, + { + "current_label": "REINAH-WP-0008-T03", + "restore_canonical_id": "HARNESS-WP-0008-T03", + "preserve_uuid": "87457216-2371-51ca-b3d4-3917e6f180a2" + }, + { + "current_label": "REINAH-WP-0008-T04", + "restore_canonical_id": "HARNESS-WP-0008-T04", + "preserve_uuid": "898e02af-51bb-5e8d-93d0-ae908466c612" + }, + { + "current_label": "REINAH-WP-0008-T05", + "restore_canonical_id": "HARNESS-WP-0008-T05", + "preserve_uuid": "b486e86b-9d0f-501d-a394-771b40f771ee" + }, + { + "current_label": "REINAH-WP-0008-T06", + "restore_canonical_id": "HARNESS-WP-0008-T06", + "preserve_uuid": "4cf721e6-724b-5c64-91bb-67b098bb97af" + }, + { + "current_label": "REINAH-WP-0008-T07", + "restore_canonical_id": "HARNESS-WP-0008-T07", + "preserve_uuid": "80318842-ccaa-5484-a54a-3d9981eaec8b" + } + ], + "future_prefix": "REINAH-WP-", + "filename_unchanged": "workplans/REINAH-WP-0008-simpler-metered-retry.md" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/prefix-rename.source-history.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/prefix-rename.source-history.txt new file mode 100644 index 00000000..4a063ac1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/prefix-rename.source-history.txt @@ -0,0 +1,192 @@ +commit a85de661f04b8331ec66b921d165671f4da77305 +Author: tegwick +AuthorDate: Tue Oct 13 22:56:46 2026 +0200 +Commit: tegwick +CommitDate: Tue Oct 13 22:56:46 2026 +0200 + + Use the registered REINAH-WP prefix; rename HARNESS-WP-0008 to REINAH-WP-0008 + + AGENTS.md named HARNESS-WP- as the prefix, but the hub's canonical prefix + for this repo is REINAH-WP- (fix-consistency C-26). Hub ids are kept so + the existing record is updated, not duplicated. Also fixes the README link + to the renamed REINAH-WP-0002 file. + + Co-Authored-By: Claude Opus 5.5 + + Assistant: claude-code + Assistant-Model: opus + Assistant-Process: 269692@bnt-lap001 + Assistant-Session: 8077e68a-0985-4b41-898c-2dc602b0d6be + +diff --git a/AGENTS.md b/AGENTS.md +index 99aa506..e165849 100644 +--- a/AGENTS.md ++++ b/AGENTS.md +@@ -7,12 +7,13 @@ + **Domain:** infotech + **Repo slug:** rein-aharness + **Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a` +-**Workplan prefix:** `HARNESS-WP-` ++**Workplan prefix:** `REINAH-WP-` + + `REIN-A-0001` through `REIN-A-0004` are immutable historical identifiers from +-before the fleet `PREFIX-WP-NNNN` convention. Preserve them in references and +-archives, but use the registered `HARNESS-WP-` prefix for every new workplan +-and task. ++before the fleet `PREFIX-WP-NNNN` convention. `HARNESS-WP-0001` through ++`HARNESS-WP-0003` and `HARNESS-WP-ADHOC-2026-09-04` are older ids from the ++agent-harness name. Preserve all of these in references and archives, but use ++the hub-registered `REINAH-WP-` prefix for every new workplan and task. + + --- + +@@ -196,10 +197,10 @@ get wrong. + Work items originate as files in this repo — not in the hub. The hub is a + read/cache/index layer that rebuilds from files. + +-**File location:** `workplans/HARNESS-WP-NNNN-.md` ++**File location:** `workplans/REINAH-WP-NNNN-.md` + + **Archived location:** finished workplans may move to +-`workplans/archived/YYMMDD-HARNESS-WP-NNNN-.md`. The `YYMMDD` prefix is ++`workplans/archived/YYMMDD-REINAH-WP-NNNN-.md`. The `YYMMDD` prefix is + the completion/archive date; the frontmatter `id` does not change. + + **Ad Hoc Tasks:** small opportunistic fixes discovered during a session use +@@ -211,7 +212,7 @@ anything needing analysis, design, approval, dependencies, or multiple phases. + + ```yaml + --- +-id: HARNESS-WP-NNNN ++id: REINAH-WP-NNNN + type: workplan + title: "..." + domain: infotech +@@ -239,7 +240,7 @@ API/MCP/frontmatter bridges until `STATE-WP-0069` retires them — see + ## Task Title + + ` ` `task +-id: HARNESS-WP-NNNN-T01 ++id: REINAH-WP-NNNN-T01 + status: wait | todo | progress | done | cancel + priority: high | medium | low + state_hub_task_id: "" # written by fix-consistency — do not edit +@@ -252,7 +253,7 @@ Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blo + + **Residuals when finishing:** actionable leftovers become live work records + before `status: finished` — usually an intake (`origin: residual`, +-`origin_ref: HARNESS-WP-NNNN`) or a spawned workplan. Residual is a *role*, ++`origin_ref: REINAH-WP-NNNN`) or a spawned workplan. Residual is a *role*, + not a kind. Fleet list lives on State Hub, not in `SCOPE.md`. + + To create a new workplan: +diff --git a/workplans/HARNESS-WP-0008-simpler-metered-retry.md b/workplans/REINAH-WP-0008-simpler-metered-retry.md +similarity index 89% +rename from workplans/HARNESS-WP-0008-simpler-metered-retry.md +rename to workplans/REINAH-WP-0008-simpler-metered-retry.md +index bfa06e2..3fa0aae 100644 +--- a/workplans/HARNESS-WP-0008-simpler-metered-retry.md ++++ b/workplans/REINAH-WP-0008-simpler-metered-retry.md +@@ -1,5 +1,5 @@ + --- +-id: HARNESS-WP-0008 ++id: REINAH-WP-0008 + type: workplan + title: "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal" + domain: infotech +@@ -12,9 +12,10 @@ created: "2026-10-13" + updated: "2026-10-13" + related: + - REINAH-WP-0003 ++state_hub_workstream_id: "187c2599-84a6-5764-a14f-7e9121975bf2" + --- + +-# HARNESS-WP-0008 — Simpler metered retry ++# REINAH-WP-0008 — Simpler metered retry + + ## Origin + +@@ -44,9 +45,10 @@ once, run. + ## A. Free rehearsal on the host + + ```task +-id: HARNESS-WP-0008-T01 ++id: REINAH-WP-0008-T01 + status: todo + priority: high ++state_hub_task_id: "c6536c8d-7862-5de6-ad2b-401077b60c04" + ``` + + Add `rein-aharness owner check --rehearse `. It runs everything +@@ -68,9 +70,10 @@ step before any paid attempt. + ## B. Release holds that provably cost nothing + + ```task +-id: HARNESS-WP-0008-T02 ++id: REINAH-WP-0008-T02 + status: todo + priority: high ++state_hub_task_id: "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9" + ``` + + `SpendLedger.reconcile` keeps the full hold (`max(held, observed)`). Add an +@@ -92,9 +95,10 @@ release. + ## D. One owner command for renewal + + ```task +-id: HARNESS-WP-0008-T03 ++id: REINAH-WP-0008-T03 + status: todo + priority: high ++state_hub_task_id: "87457216-2371-51ca-b3d4-3917e6f180a2" + ``` + + Add `rein-aharness owner renew --owner --runtime +@@ -117,9 +121,10 @@ reservation refuses. No digest has to be typed by hand. + ## C. Envelopes that cover several attempts (decision) + + ```task +-id: HARNESS-WP-0008-T04 ++id: REINAH-WP-0008-T04 + status: wait + priority: medium ++state_hub_task_id: "898e02af-51bb-5e8d-93d0-ae908466c612" + ``` + + Owner decision: should future envelopes be admitted as "up to N attempts +@@ -130,9 +135,10 @@ as a decision note in `docs/`. T03's envelope format then reflects it. + ## E. Ship the owner runtime as a container image (decision) + + ```task +-id: HARNESS-WP-0008-T05 ++id: REINAH-WP-0008-T05 + status: wait + priority: low ++state_hub_task_id: "b486e86b-9d0f-501d-a394-771b40f771ee" + ``` + + Decision for later, with Platform (railiance) and Sand-boxer: should the +@@ -143,9 +149,10 @@ here. If accepted, hand it off as a residual intake to the owning repos. + ## F. Approvals per envelope (decision) + + ```task +-id: HARNESS-WP-0008-T06 ++id: REINAH-WP-0008-T06 + status: wait + priority: low ++state_hub_task_id: "4cf721e6-724b-5c64-91bb-67b098bb97af" + ``` + + Decision for later, with Secrets Engine: should one approval set cover an +@@ -155,9 +162,10 @@ lives outside this repo. If accepted, hand it off as a residual intake. + ## Retry on the corrected runtime + + ```task +-id: HARNESS-WP-0008-T07 ++id: REINAH-WP-0008-T07 + status: wait + priority: high ++state_hub_task_id: "80318842-ccaa-5484-a54a-3d9981eaec8b" + ``` + + Waits on T01 and T03. It does not need T02. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.json new file mode 100644 index 00000000..ae472711 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.json @@ -0,0 +1,99 @@ +{ + "repo_slug": "glas-harness", + "repo_path": "/home/worsch/glas-harness", + "source_revision": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'GLAS-WP-0015-T03' in workplan 'GLAS-WP-0015' \u2014 decision 62aa95e4-3ccc-4867-8806-5e3db005b483 is resolved", + "file_path": "workplans/GLAS-WP-0015-production-dependency-coordination.md#GLAS-WP-0015-T03", + "db_id": "", + "file_value": "62aa95e4-3ccc-4867-8806-5e3db005b483", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-25", + "message": "Owner-return task 'GLAS-WP-0016-T04' waiting on rein-aharness has 1 reply/replies after its last dated note (or unread when undated) \u2014 owner action needed: 6b024762-a03a-47dc-b9cf-7a026d361789", + "file_path": "workplans/GLAS-WP-0016-fi-research-brief-profile.md#GLAS-WP-0016-T04", + "db_id": "", + "file_value": "message-from:rein-aharness", + "db_value": "", + "fixable": false, + "repo_slug": "glas-harness", + "source_revision": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "source_revision_reason": null, + "owner_return": { + "task_record_id": "GLAS-WP-0016-T04", + "message_ids": [ + "6b024762-a03a-47dc-b9cf-7a026d361789" + ] + } + }, + { + "severity": "WARN", + "check_id": "C-25", + "message": "Owner-return task 'GLAS-WP-0017-T02' waiting on assembly-economics has 1 reply/replies after its last dated note (or unread when undated) \u2014 owner action needed: c4c804d2-f016-4d26-8d4e-5713e98e65a3", + "file_path": "workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md#GLAS-WP-0017-T02", + "db_id": "", + "file_value": "message-from:assembly-economics", + "db_value": "", + "fixable": false, + "repo_slug": "glas-harness", + "source_revision": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "source_revision_reason": null, + "owner_return": { + "task_record_id": "GLAS-WP-0017-T02", + "message_ids": [ + "c4c804d2-f016-4d26-8d4e-5713e98e65a3" + ] + } + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "4 unread inbox message(s) older than 3 day(s): rein-aharness:6b024762, assembly-economics:c4c804d2, the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-29", + "message": "Unread work request from rein-aharness (6b024762) may need a workplan file: Re: Re: Re: GLAS-WP-0016-T03: tool profile green-research-commit for the FI research brief", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 18/18", + "C-17 cleared: pushed 1 backlogged commit(s)", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 6, + "info": 0 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.stderr.txt new file mode 100644 index 00000000..3345563f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.stderr.txt @@ -0,0 +1 @@ +WARN: git commit failed for writeback: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/index.preimage b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/index.preimage new file mode 100644 index 00000000..7fce06d0 Binary files /dev/null and b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/index.preimage differ diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.json new file mode 100644 index 00000000..f2dc4e26 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.json @@ -0,0 +1,153 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "glas-harness", + "commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "requests": 2, + "elapsed_ms": 6001.1, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "glas-harness", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "derived_commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "glas-harness", + "commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "status": "applied", + "counts": { + "created": 0, + "updated": 18, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 8, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 6 + }, + "created": [], + "updated": [ + "GLAS-WP-0001", + "GLAS-WP-0002", + "GLAS-WP-0003", + "GLAS-WP-0004", + "GLAS-WP-0005", + "GLAS-WP-0006", + "GLAS-WP-0007", + "GLAS-WP-0008", + "GLAS-WP-0009", + "GLAS-WP-0010", + "GLAS-WP-0011", + "GLAS-WP-0012", + "GLAS-WP-0013", + "GLAS-WP-0014", + "GLAS-WP-0015", + "GLAS-WP-0016", + "GLAS-WP-0017", + "GLAS-WP-ADHOC-2026-09-06" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [ + "GLAS-WP-0016-T01", + "GLAS-WP-0016-T02", + "GLAS-WP-0016-T03", + "GLAS-WP-0016-T04", + "GLAS-WP-0016-T05", + "GLAS-WP-0016-T06", + "GLAS-WP-0017-T01", + "GLAS-WP-0017-T02" + ], + "cancelled_tasks": [], + "created_edges": [], + "removed_edges": [], + "unresolved_edges": [], + "external_edges": [ + { + "workplan": "GLAS-WP-0016", + "from": "GLAS-WP-0016-T04", + "target": "SAND-WP-0015-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1254b220-fd97-5c84-a0e0-ef2de10972c4", + "from_task_id": "6faf1b1c-164d-5d6d-8dad-6cf920a5fd6c", + "to_workplan_id": null, + "to_task_id": "58817ef6-76d9-5e34-908f-c024e6c99f93" + }, + { + "workplan": "GLAS-WP-0012", + "from": "GLAS-WP-0012-T04", + "target": "GLAS-WP-0012-T03", + "relationship_type": "starts_after", + "from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "from_task_id": "3e791432-8f37-54bd-a44a-55eeff11ac19", + "to_workplan_id": null, + "to_task_id": "c660808a-1724-555c-bc59-7318870d3591" + }, + { + "workplan": "GLAS-WP-0012", + "from": "GLAS-WP-0012-T02", + "target": "SAND-WP-0014-T05", + "relationship_type": "starts_after", + "from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "from_task_id": "4209f564-a9ee-57f9-9522-3708988801ef", + "to_workplan_id": null, + "to_task_id": "c6812fd4-bb7b-5be0-8344-a122496fe5bc" + }, + { + "workplan": "GLAS-WP-0012", + "from": "GLAS-WP-0012-T03", + "target": "GLAS-WP-0012-T02", + "relationship_type": "starts_after", + "from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "from_task_id": "c660808a-1724-555c-bc59-7318870d3591", + "to_workplan_id": null, + "to_task_id": "4209f564-a9ee-57f9-9522-3708988801ef" + }, + { + "workplan": "GLAS-WP-0012", + "from": "GLAS-WP-0012-T03", + "target": "SECRETS-WP-0009-T03", + "relationship_type": "starts_after", + "from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "from_task_id": "c660808a-1724-555c-bc59-7318870d3591", + "to_workplan_id": null, + "to_task_id": "f8069c8a-ad6b-5d0b-9a36-c2326699437d" + }, + { + "workplan": "GLAS-WP-0012", + "from": "GLAS-WP-0012-T05", + "target": "GLAS-WP-0012-T04", + "relationship_type": "starts_after", + "from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "from_task_id": "f7635cf6-e044-52d4-8242-0512e0ccbd7b", + "to_workplan_id": null, + "to_task_id": "3e791432-8f37-54bd-a44a-55eeff11ac19" + } + ], + "refused": [], + "notes": [] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/.custodian-brief.md.worktree new file mode 100644 index 00000000..3ab9cb54 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/.custodian-brief.md.worktree @@ -0,0 +1,55 @@ + +# Custodian Brief — glas-harness + +**Domain:** infotech +**Last synced:** 2026-10-13 20:53 UTC +**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + +## Active Workstreams + +### Versioned Glas profile for the FI daily research brief +Progress: 5/6 done | workplan_id: `1254b220-fd97-5c84-a0e0-ef2de10972c4` + +**Open tasks:** +- ! Prove one sandboxed run and mark the profile ready `6faf1b1c` + *(wait: Live activation needs sand-boxer owner credential delivery (SAND-WP-0015-T04); publication needs the rein-aharness publisher (decision c6f23433, request 780c78d1).)* + +### Governed route for assembly-checkpoint before legacy routing ends +Progress: 1/2 done | workplan_id: `8039eefd-47b9-580b-a488-fb9c3da93f50` + +**Open tasks:** +- ! Confirm the grant shape with assembly-economics `04c50300` + *(wait: Grant-shape confirmation requested 2026-10-13 (reply 2b8b3553); await assembly-economics.)* + +### Drive owner returns for the first production Glas profile +Progress: 2/3 done | workplan_id: `94c02b1f-66ed-588d-bdd7-7158107b85fb` + +**Open tasks:** +- ! Review owner returns against the acceptance gates `68fcc1b4` + *(wait: Await owner returns: secrets-engine config, holder admission, lane approvals and scoped delivery; operator input on placement and spend bounds.)* + +### Prove the first local rein profile end to end +Progress: 2/6 done | workplan_id: `170bf1ae-337f-5553-8d1e-03b07100e08f` + +**Open tasks:** +- ! Resolve and verify the owner runtime, credential, and egress contract `4209f564` + *(wait: Dependency: sand-boxer SAND-WP-0014-T05 with rein-aharness and its credential owner.)* +- ! Review and validate the versioned Glas proof candidate `c660808a` + *(wait: Await the rebuilt runtime artifact carrying profile 1.1.1 started through its owner on railiance01 (SECRETS-WP-0009-T03 step B2).)* +- ! Prove one real bounded rein task inside the sandbox `3e791432` + *(wait: Depends on T03.)* +- ! Publish evidence and mark only the proven profile ready `f7635cf6` + *(wait: Depends on T04.)* + +## Inbox Hygiene + +**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. +**Missing thread_id:** 2 unread message(s) lack supersession chains. + +--- +## MCP Orientation (when available) + +If the state-hub MCP server is reachable, call: +`get_domain_summary("infotech")` +This provides richer cross-domain context. +If the MCP call fails, use this file as your orientation source. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/WORK-RECORDS.md.worktree new file mode 100644 index 00000000..ffe8d74d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/WORK-RECORDS.md.worktree @@ -0,0 +1,97 @@ +# Work Records — glas-harness + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | GLAS-WP-ADHOC-2026-09-06 | finished | — | workplans/ADHOC-2026-09-06.md | +| workplan | GLAS-WP-0001 | finished | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| workplan | GLAS-WP-0002 | finished | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md | +| workplan | GLAS-WP-0003 | finished | — | workplans/GLAS-WP-0003-first-channel-extension.md | +| workplan | GLAS-WP-0004 | finished | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| workplan | GLAS-WP-0005 | finished | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| workplan | GLAS-WP-0006 | finished | — | workplans/GLAS-WP-0006-consumer-actor-validation.md | +| workplan | GLAS-WP-0007 | finished | — | workplans/GLAS-WP-0007-capability-scope-truth.md | +| workplan | GLAS-WP-0008 | finished | — | workplans/GLAS-WP-0008-profile-operational-readiness.md | +| workplan | GLAS-WP-0009 | finished | — | workplans/GLAS-WP-0009-operational-handoff-truth.md | +| workplan | GLAS-WP-0010 | finished | — | workplans/GLAS-WP-0010-transport-and-resolution-hardening.md | +| workplan | GLAS-WP-0011 | finished | — | workplans/GLAS-WP-0011-statehub-bootstrap.md | +| workplan | GLAS-WP-0012 | blocked | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| workplan | GLAS-WP-0013 | finished | — | workplans/GLAS-WP-0013-execution-outcome-evidence.md | +| workplan | GLAS-WP-0014 | finished | — | workplans/GLAS-WP-0014-sandbox-handoff-validation.md | +| workplan | GLAS-WP-0015 | blocked | — | workplans/GLAS-WP-0015-production-dependency-coordination.md | +| workplan | GLAS-WP-0016 | blocked | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| workplan | GLAS-WP-0017 | blocked | — | workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md | +| task | ADHOC-2026-09-06-T01 | done | — | workplans/ADHOC-2026-09-06.md | +| task | ADHOC-2026-09-06-T02 | done | — | workplans/ADHOC-2026-09-06.md | +| task | ADHOC-2026-09-06-T03 | done | — | workplans/ADHOC-2026-09-06.md | +| task | GLAS-WP-0001-T01 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| task | GLAS-WP-0001-T02 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| task | GLAS-WP-0001-T03 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| task | GLAS-WP-0001-T04 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| task | GLAS-WP-0001-T05 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| task | GLAS-WP-0001-T06 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| task | GLAS-WP-0002-T01 | done | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md | +| task | GLAS-WP-0002-T02 | done | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md | +| task | GLAS-WP-0002-T03 | done | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md | +| task | GLAS-WP-0002-T04 | done | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md | +| task | GLAS-WP-0003-T01 | done | — | workplans/GLAS-WP-0003-first-channel-extension.md | +| task | GLAS-WP-0003-T02 | done | — | workplans/GLAS-WP-0003-first-channel-extension.md | +| task | GLAS-WP-0003-T03 | done | — | workplans/GLAS-WP-0003-first-channel-extension.md | +| task | GLAS-WP-0003-T04 | done | — | workplans/GLAS-WP-0003-first-channel-extension.md | +| task | GLAS-WP-0004-T01 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T02 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T03 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T04 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T05 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T06 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T07 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T08 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0005-T01 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| task | GLAS-WP-0005-T02 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| task | GLAS-WP-0005-T03 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| task | GLAS-WP-0005-T04 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| task | GLAS-WP-0005-T05 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| task | GLAS-WP-0006-T01 | done | — | workplans/GLAS-WP-0006-consumer-actor-validation.md | +| task | GLAS-WP-0007-T01 | done | — | workplans/GLAS-WP-0007-capability-scope-truth.md | +| task | GLAS-WP-0007-T02 | done | — | workplans/GLAS-WP-0007-capability-scope-truth.md | +| task | GLAS-WP-0008-T01 | done | — | workplans/GLAS-WP-0008-profile-operational-readiness.md | +| task | GLAS-WP-0008-T02 | done | — | workplans/GLAS-WP-0008-profile-operational-readiness.md | +| task | GLAS-WP-0008-T03 | done | — | workplans/GLAS-WP-0008-profile-operational-readiness.md | +| task | GLAS-WP-0009-T01 | done | — | workplans/GLAS-WP-0009-operational-handoff-truth.md | +| task | GLAS-WP-0009-T02 | done | — | workplans/GLAS-WP-0009-operational-handoff-truth.md | +| task | GLAS-WP-0010-T01 | done | — | workplans/GLAS-WP-0010-transport-and-resolution-hardening.md | +| task | GLAS-WP-0010-T02 | done | — | workplans/GLAS-WP-0010-transport-and-resolution-hardening.md | +| task | GLAS-WP-0010-T03 | done | — | workplans/GLAS-WP-0010-transport-and-resolution-hardening.md | +| task | GLAS-WP-0011-T01 | done | — | workplans/GLAS-WP-0011-statehub-bootstrap.md | +| task | GLAS-WP-0011-T02 | done | — | workplans/GLAS-WP-0011-statehub-bootstrap.md | +| task | GLAS-WP-0011-T03 | done | — | workplans/GLAS-WP-0011-statehub-bootstrap.md | +| task | GLAS-WP-0012-T01 | done | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| task | GLAS-WP-0012-T02 | wait | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| task | GLAS-WP-0012-T03 | wait | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| task | GLAS-WP-0012-T04 | wait | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| task | GLAS-WP-0012-T05 | wait | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| task | GLAS-WP-0012-T06 | done | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| task | GLAS-WP-0013-T01 | done | — | workplans/GLAS-WP-0013-execution-outcome-evidence.md | +| task | GLAS-WP-0013-T02 | done | — | workplans/GLAS-WP-0013-execution-outcome-evidence.md | +| task | GLAS-WP-0014-T01 | done | — | workplans/GLAS-WP-0014-sandbox-handoff-validation.md | +| task | GLAS-WP-0015-T01 | done | — | workplans/GLAS-WP-0015-production-dependency-coordination.md | +| task | GLAS-WP-0015-T02 | done | — | workplans/GLAS-WP-0015-production-dependency-coordination.md | +| task | GLAS-WP-0015-T03 | wait | — | workplans/GLAS-WP-0015-production-dependency-coordination.md | +| task | GLAS-WP-0016-T01 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| task | GLAS-WP-0016-T02 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| task | GLAS-WP-0016-T03 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| task | GLAS-WP-0016-T04 | wait | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| task | GLAS-WP-0016-T05 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| task | GLAS-WP-0016-T06 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| task | GLAS-WP-0017-T01 | done | — | workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md | +| task | GLAS-WP-0017-T02 | wait | — | workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md | +| intake | GLAS-IN-0001 | done | blue | docs/intakes/residuals.md | +| intake | GLAS-IN-0002 | todo | red | docs/intakes/residuals.md | +| intake | GLAS-IN-0003 | todo | green | docs/intakes/residuals.md | +| intake | GLAS-IN-0004 | todo | green | docs/intakes/residuals.md | +| intake | GLAS-IN-0005 | done | red | docs/intakes/residuals.md | diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/originals.json new file mode 100644 index 00000000..dff7c522 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/originals.json @@ -0,0 +1,10 @@ +[ + { + "path": ".custodian-brief.md", + "index": "100644 3ab9cb5489704c7140420e489d2e89c46fd0ce92 0\t.custodian-brief.md" + }, + { + "path": "WORK-RECORDS.md", + "index": "100644 5c81da3eaf946e218edc0dc7b3022191de1a82ee 0\tWORK-RECORDS.md" + } +] diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-commit.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-commit.json new file mode 100644 index 00000000..8770ccd1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-commit.json @@ -0,0 +1,13 @@ +{ + "exit_code": 0, + "commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "base": "7357115c8311e55ee3d495f5266f501a17ec3c89", + "files": [ + { + "path": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md", + "sha256": "23f97bc183bef2b0f38eb40c64bc0bb010df1c1eb4596ff3b5e0f73da7c2fcfc" + } + ], + "stdout": "[main c8751c9] docs(identity): point current metered gate at issued HARNESS task\n 1 file changed, 1 insertion(+), 1 deletion(-)\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 1, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-manifest.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-manifest.json new file mode 100644 index 00000000..b3b02136 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-manifest.json @@ -0,0 +1,11 @@ +{ + "owner": "glas-harness", + "base_revision": "7357115c8311e55ee3d495f5266f501a17ec3c89", + "message": "docs(identity): point current metered gate at issued HARNESS task", + "files": [ + { + "path": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md", + "sha256": "23f97bc183bef2b0f38eb40c64bc0bb010df1c1eb4596ff3b5e0f73da7c2fcfc" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/source-before.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/source-before.json new file mode 100644 index 00000000..a7e8e8b9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/source-before.json @@ -0,0 +1,8 @@ +{ + "observed_at": "2026-10-17T10:57:25.546281+00:00", + "head": "7357115c8311e55ee3d495f5266f501a17ec3c89", + "status": "M .custodian-brief.md\n M WORK-RECORDS.md\n", + "instructions_sha256": "sha256:f7d33c8d84f31c2a9b62e3ffdc2476da797fa1d0732cff17dc49d12e964f1fc5", + "source_sha256": "sha256:881ab0f5ba3bb43f5404c8f4cd23f9628e014992ba88fc13f541f0fa8b7b1eaa", + "index_sha256": "sha256:be6359bc304b09f0a3479e8c3cab02483c42a11c57aedf222000c153693b9843" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/verified-bindings.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/verified-bindings.json new file mode 100644 index 00000000..0914eaa8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/verified-bindings.json @@ -0,0 +1,54 @@ +{ + "observed_at": "2026-10-17T11:27:45.427504+00:00", + "status": "source_and_task_bindings_verified", + "source_file": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md", + "source_sha256": "sha256:23f97bc183bef2b0f38eb40c64bc0bb010df1c1eb4596ff3b5e0f73da7c2fcfc", + "all_source_UUIDs_preserved": true, + "all_task_fields_preserved_except_approved_SAND_blocking_label": true, + "tasks": [ + { + "record_id": "GLAS-WP-0012-T01", + "id": "711aeb7e-4664-5078-8c65-3fe6f46f7999", + "status": "done", + "needs_human": false, + "workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f" + }, + { + "record_id": "GLAS-WP-0012-T02", + "id": "4209f564-a9ee-57f9-9522-3708988801ef", + "status": "wait", + "needs_human": false, + "workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f" + }, + { + "record_id": "GLAS-WP-0012-T03", + "id": "c660808a-1724-555c-bc59-7318870d3591", + "status": "wait", + "needs_human": false, + "workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f" + }, + { + "record_id": "GLAS-WP-0012-T04", + "id": "3e791432-8f37-54bd-a44a-55eeff11ac19", + "status": "wait", + "needs_human": false, + "workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f" + }, + { + "record_id": "GLAS-WP-0012-T05", + "id": "f7635cf6-e044-52d4-8242-0512e0ccbd7b", + "status": "wait", + "needs_human": false, + "workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f" + }, + { + "record_id": "GLAS-WP-0012-T06", + "id": "d0c26709-549f-540a-8250-1fd1b2e4960a", + "status": "done", + "needs_human": false, + "workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f" + } + ], + "historical_prose_preserved": true, + "native_action_by_this_subtask": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.postimage.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.postimage.md new file mode 100644 index 00000000..221e6c3a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.postimage.md @@ -0,0 +1,450 @@ +--- +id: GLAS-WP-0012 +type: workplan +title: "Prove the first local rein profile end to end" +domain: infotech +repo: glas-harness +status: blocked +flavor: implementation +owner: codex +topic_slug: first-local-profile-production-proof +created: "2026-09-05" +updated: "2026-09-27" +state_hub_workstream_id: "170bf1ae-337f-5553-8d1e-03b07100e08f" +--- + +# Prove the first local rein profile end to end + +## Context and scope + +Follow up the Claude-route portion of live residual `GLAS-IN-0002`, originating +in finished `GLAS-WP-0005`. Boundary hardening is committed at `63a7f9f` and +proved with a deterministic non-secret dispatch. That proof did not execute +the real rein CLI or make a model call. + +Start from `harness.agent-dev-local@1.0.0` (rein-aharness, +`claude-sonnet-4-6`, `claude-code-cli`, `green-commit-only`). Review a new +versioned candidate after the owner runtime contract is available. Keep the +existing blocked selection as the rollback pin. The open-weight profile and +remote profile do not acquire readiness from this workplan. + +Glas owns profile selection, its adapter, and acceptance evidence. Sand-boxer +owns runtime provisioning, execution environment, isolation, egress enforcement, +and teardown. The selected rein and credential owner own authentication and +credential acquisition. Use existing owner work `SAND-WP-0014-T05`; its current +OpenRouter dependency must be distinguished from this first Claude-route proof. + +## Establish the exact local baseline and acceptance requirements + +```task +id: GLAS-WP-0012-T01 +status: done +priority: high +state_hub_task_id: "711aeb7e-4664-5078-8c65-3fe6f46f7999" +``` + +Completed 2026-09-05. Reviewed Glas `63a7f9f`, sand-boxer `b6655d8`, and +rein-aharness `1429db5`. Added a reproducible non-secret owner-execution runtime +inventory and the [acceptance contract](../docs/local-profile-acceptance.md). + +The baseline can discover Python, Git, and a `claude` command. It cannot +discover `rein-aharness`, its Python module, or `llm_connect`. Command discovery +alone does not prove that Claude can start or authenticate. The namespace has +only loopback; declared egress and credential route references are empty. +Owner execution and workspace teardown pass. The baseline is therefore +insufficient for a real rein run. + +Reviewed the plan against current implementation. Local preparation is done; +remaining execution waits on the owner inputs in T02. + +## Resolve and verify the owner runtime, credential, and egress contract + +```task +id: GLAS-WP-0012-T02 +status: wait +depends_on: [SAND-WP-0014-T05] +blocking_reason: "Dependency: sand-boxer SAND-WP-0014-T05 with rein-aharness and its credential owner." +priority: high +state_hub_task_id: "4209f564-a9ee-57f9-9522-3708988801ef" +``` + +Dependency: sand-boxer `SAND-WP-0014-T05`, with rein-aharness and its credential +owner. Required deliverables are listed in `docs/local-profile-acceptance.md`: + +- Exact runtime artifact/revision, in-sandbox entrypoints and dependencies, + sanitized environment, private writable state, and deployment/host identity. +- A Claude-compatible catalog credential route and owner implementation that + delivers it to the selected runtime. An environment label containing route + references is not credential delivery. +- An owner-defined sandbox profile with explicit enforced provider egress, + DNS/TLS requirements, and negative egress tests. Editing an egress list alone + does not provide connectivity in the current loopback-only implementation. +- Non-secret startup, identity, source-absence, and cleanup evidence through + the same manager/service path the gateway will use. + +Done when these deliverables exist at reviewable revisions and their owner +proofs pass. No rein installation in the source checkout, host home mount, +credential injection from the interactive shell, or unrestricted network +substitution is an acceptance path. + +2026-09-05 owner progress: SAND-WP-0015 implemented digest-pinned standalone +Python runtime mounting and private namespace state. Real rein CLI startup, +read-only runtime, source absence, clean worktree, state persistence across +exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132 +tests pass. This completes the candidate runtime mechanism, not production +selection. Authentication lane, credential delivery/revocation, provider egress, +pinning the Claude executable, and deployed profile review remain open. The +credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See +[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner +CCR-2026-0016 (in flight). Organization/key metadata is supplied and the user saved the key in OpenBao. +A metadata-only owner check confirmed live version 2 on 2026-09-05, without +reading the value. Custody handoff is complete. Verified machine binding, +protected runtime delivery, workspace scope/budget and provider egress remain +outstanding; provider authentication has not been tested. +See docs/local-profile-acceptance.md. + +## Review and validate the versioned Glas proof candidate + +```task +id: GLAS-WP-0012-T03 +status: wait +depends_on: [GLAS-WP-0012-T02, SECRETS-WP-0009-T03] +priority: high +blocking_reason: "Await the rebuilt runtime artifact carrying profile 1.1.1 started through its owner on railiance01 (SECRETS-WP-0009-T03 step B2)." +state_hub_task_id: "c660808a-1724-555c-bc59-7318870d3591" +``` + +Depends on T02. Prepare `harness.agent-dev-local@1.1.0` only once the real +sandbox profile and credential route are known. Keep the rein/model route and +tool profile explicit; choose bounded proof limits no greater than the current +900 seconds / 60,000 tokens. Record runtime and sandbox revisions and the +validated host scope in evidence. Account for dependency versions that are not +represented directly in the Glas profile schema. + +Use `unverified` only after known blockers are resolved, to label the bounded +real proof. Validate schema, capabilities, route propagation, timeout behavior, +and refusal of the old blocked version. Version coexistence must make an +unversioned selection ambiguous rather than silently changing consumers. + +Done when the exact candidate resolves, the real runtime starts through its +owner, the focused tests and full suite pass, and rollback to the blocked +`harness.agent-dev-local@1.0.0` pin is documented. + +2026-09-21 candidate: `profiles/harness.agent-dev-local-1.1.0.yaml`, readiness +`unverified` (evidence_ref GLAS-WP-0012-T03), `profile.bwrap-local`, no +credential route refs, claude-sonnet-4-6, 900 s / 60,000 tokens, max_turns 30, +max_budget_usd 5.0. The provider key stays with rein-aharness MessagesOwner +outside bwrap (metered-once); the owner bootstrap's sandbox, model and +credential-route checks accept it. max_budget_usd matches the operator-accepted +spend envelope hfact-glas-anthropic-2026-09 (Informed Decision +infd-20260921-b01, approval ba5ce2d8). Unpinned selection is now ambiguous and +1.0.0 stays blocked; rollback is pinning 1.0.0. 134 tests pass. Remaining for +done: the rebuilt runtime artifact carrying this profile starts through its +owner on railiance01 (SECRETS-WP-0009-T03 step B2). + +2026-09-23 the candidate is now `harness.agent-dev-local@1.1.1` (`claude-sonnet-5`, +otherwise identical). 1.1.0 is blocked, and rollback is still pinning 1.0.0. +Reviewed 2026-09-24: the catalog resolves 1.1.1 as unverified, and 134 tests pass. +The done condition is unchanged. It needs runtime `2cfc7b5f` rebuilt with 1.1.1 +and started through its owner. + +## Prove one real bounded rein task inside the sandbox + +```task +id: GLAS-WP-0012-T04 +status: wait +depends_on: [GLAS-WP-0012-T03] +blocking_reason: "Depends on T03." +priority: high +state_hub_task_id: "3e791432-8f37-54bd-a44a-55eeff11ac19" +``` + +Depends on T03. Run the actual `ReinAharness` adapter and installed +`rein-aharness` CLI with Claude through the candidate profile on a disposable +Git fixture. Do not substitute deterministic dispatch or change the source +checkout to satisfy the task. Verify the acceptance assertions in the contract, +including exactly one intended commit, a clean final tree, unchanged/inaccessible +host source, exact identity, bounded duration, task cleanup, and destruction. + +Collect and validate the sandbox artifact before gateway teardown removes the +workspace. Implement the smallest necessary proof observer in the acceptance +fixture; direct evidence must distinguish actual content validation from a +reported commit SHA. Preserve compact value-free evidence only. + +Done when the bounded real run and relevant failure/cleanup checks pass with +the exact selected profile/runtime pins and credential route identified. + +## Publish evidence and mark only the proven profile ready + +```task +id: GLAS-WP-0012-T05 +status: wait +depends_on: [GLAS-WP-0012-T04] +blocking_reason: "Depends on T04." +priority: high +state_hub_task_id: "f7635cf6-e044-52d4-8242-0512e0ccbd7b" +``` + +Depends on T04. Update only the proven candidate to `ready` with evidence that +identifies the host/runtime scope, credential route, egress policy, revisions, +limits, and rollback. Run catalog validation and regression checks. Do not +enable production schedules as a side effect of this proof. + +Update `GLAS-IN-0002` with the Claude acceptance result. Keep its open-weight +portion live, or split that remaining work into a separately registered record +before closing the intake. Synchronize work records and log progress. Finish +this workplan only when the first profile is proven and residuals remain live. + +## Prepare the real-rein acceptance runner + +```task +id: GLAS-WP-0012-T06 +status: done +priority: high +state_hub_task_id: "d0c26709-549f-540a-8250-1fd1b2e4960a" +``` + +Independent preparation for T04 while T02 remains blocked. Add a disposable +fixture that delegates actual dispatch to the catalog-built ReinAharness, +validates the commit and artifact through owner execution before teardown, +checks the host source and cleanup, and emits bounded evidence without model +output or credential values. Refuse blocked or unpinned profiles before +creating a sandbox. Test negative artifact cases and the refusal path. This +runner does not itself satisfy T04 or change readiness. + +Completed 2026-09-05. `scripts/prove-local-profile.py` delegates real dispatch +and observes content/commit acceptance before teardown. It verifies exactly one +new commit, expected paths and committed/worktree content, a clean tree, +source absence, exact child identity, private task mode/removal, and host-source +integrity plus workspace destruction. It emits bounded evidence and has no +readiness override. `tests/test_local_profile_proof.py`: 20 focused tests pass; +full suite: 101 passed; catalog validation passes. A real CLI invocation against +`harness.agent-dev-local@1.0.0` returned `OperationallyBlockedProfileError` +without creating a sandbox. T02–T05 remain waiting on the owner dependencies; +no real model run or readiness promotion is claimed. + +## Acceptance + +One version-pinned local profile runs its actual rein/model task entirely in +the declared sandbox, produces validated local output, and tears down cleanly. +Its readiness describes the proven runtime scope. Other profile readiness and +consumer schedules remain independently governed. + +## 2026-09-05 egress owner return + +Owner-controlled HTTPS egress is implemented and live-tested through both the +extension and a persisted manager: provider TLS/HTTP response, undeclared-host +and direct-IP denial, isolated namespace and proxy/workspace cleanup passed. +See [egress evidence](../docs/evidence/GLAS-WP-0012-egress-2026-09-05.md). +T02 remains waiting on machine auth, protected credential delivery, the pinned +Claude executable and the combined production acceptance. Profiles remain blocked. + +## 2026-09-05 credential owner return + +Sand-boxer credential transport is implemented and proved with synthetic +provider sandbox 880f749e. Owner config binds exact profile/project/actor and +run id; unknown routes refuse, shell API-key fallback is stripped, only the +workload child receives the value, and output redaction precedes truncation. +Tests: sand-boxer171, secrets-engine226, Glas101 pass. Native data-only read +policy/AppRole proposal and activation now live in SECRETS-WP-0009. Its +production exec refuses before OpenBao because durable access-engine decision +records and scoped service authority remain unavailable. T02 remains waiting +on that activation, pinned Claude startup and real provider/task acceptance. + +## 2026-09-06 credential owner update + +Reviewed secrets-engine message `3bd23bc9-e863-4f1f-8c76-415812ec0656`. +Owner reports the local authorization join implemented at `627810b`. Remaining +native activation depends on approval-engine serving the durable +ActionAuthorization claim endpoint and access-engine serving Check, followed +by configuration, per-lane approval and positive/negative verification. +State Hub decisions are not a substitute for the durable authorization object. +SECRETS-WP-0009-T03 and this plan's T02 remain waiting; runtime pinning and +combined real proof remain required. No readiness change or real-key read. + +## 2026-09-06 authorization contract and policy publication + +Reviewed owner commits `7b4b9e3` and `083bee7` and FLEX-WP-0021. Gate-house +GH-DEC-2026-005 resolved the contract: secrets-engine now validates the +approval-claim and decision envelope separately and removed the incorrect +State Hub authority requirement. Flex-auth published +`secrets-engine.catalog-lane.lifecycle` v1; T01/T02 are done. + +Remaining owner gates are real decision/digest verification (FLEX-WP-0021-T03), +consumer service deployment and handoff (T04/T05), approval-engine deployment, +production service identity and verified lane activation. Publication is not +deployment. T02 stays waiting, and runtime pinning and combined acceptance +remain required. No new owner inbox message or activation evidence was found +in this review. + +## 2026-09-06 digest verification follow-up + +Reviewed secrets-engine `6e9c152` and `925d028`: owner corrected correlation +field handling in the flex-auth digest and refreshed fixtures. Its tests also +record an unresolved approval/native action-vocabulary and embedded-claim +digest mismatch for dual-control requests. This is owner integration evidence, +not successful live activation; SECRETS-WP-0009-T03 remains wait. No new +activation receipt was found in the Glas inbox. T02 remains waiting. + +## 2026-09-06 authorization-chain owner return + +Reviewed secrets-engine `f62d3fe` / `64aeec9`. Owner reports claim → Check → +consume → backend integration against a throwaway OpenBao, including denial, +unreachable service, invalid claim, missing digest, consume conflict and action +mismatch refusal before backend access. Authorization transport is stubbed; +wire shapes use published flex-auth fixtures. Do not describe this as a live +production service or Anthropic delivery proof. + +Owner now identifies deployment/configuration as the remaining live gate: +consumer PDP service and approval-engine rollout, production service +credentials, deployed policy pin and per-lane authorization id. +SECRETS-WP-0009-T03 remains wait. Earlier digest-defect notes are historical; +use this latest owner return for the integration status. Native lane positive/ +negative access checks, pinned Claude startup, provider scope/budget inputs and +combined Glas acceptance remain outstanding. T02–T05 stay wait. + +Review found no pending local changes or new inbox messages. Corrected stale +README wording that still called owner execution missing; the implemented +mechanism and its separate proofs do not change profile readiness. + +## 2026-09-06 production deployment action + +User authorized production deployment. Dedicated flex-auth-secrets-engine Helm +release is available 1/1 at revision 1; five policy fixtures and allowed/denied +network probes passed. CI image is digest-pinned; existing consumers unchanged. +Caller authentication remains warn pending identity adoption. See +[deployment evidence](../history/2026-09-06-174000-production-deployment.md). +Approval-engine remains undeployed: live KeyCape clients and audit sender are +absent, the tenant contract needs alignment, and a release digest is required. +Corrected its stale issuer/JWKS deployment inputs. No production credential +lane or real Claude run was activated; T02 remains wait. + +## Production dependency coordination + +GLAS-WP-0015 now tracks exact owner handoffs and return receipts from Glas. +The requests in docs/production-dependency-handoffs.md reuse existing owner +work: tenant agreement and client custody, KeyCape rollout, audit source +onboarding, approval release, native lane activation and pinned combined +runtime. Image/runtime preparation can proceed in parallel. The runner's +project glas-local-proof must be reconciled with the owner route example's +project glas-harness before the exact delivery binding is selected. Owner +handoffs were sent after explicit authorization; GLAS-WP-0015 records all seven +receipt IDs and tracks replies. This plan's T02 remains wait. + +## Verified owner follow-up — 2026-09-06 + +Glas reviewed six owner acknowledgements in GLAS-WP-0015. Project binding is +resolved to agt/glas-local-proof at sand-boxer 23d0c2b; the combined profile +source is available, but Claude is not pinned. The deployed policy was found +to lack tenant denial at v1; the owner correction v2 is now deployed at Helm +revision 2 and six live Check fixtures pass, including wrong_tenant denial. +Tenant choice, workstation caller access, audit load-bearing schema/admission, +identity/custody and native activation remain gates. T02 remains wait. + + +Tenant decision update (2026-09-06): operator approved `tenant:platform` for the +approval dependency chain as the platform management/services tenant. See +`docs/platform-tenant-decision.md`. The choice blocker is resolved; exact owner +configuration alignment and verification remain part of T02 before readiness. + + +Later deployment progress (2026-09-06): KeyCape/approval source tenant alignment +verified, approval release published and pinned, audit T03 complete, dedicated +PDP revision 3 enforces adopted short-lived caller identity. See GLAS-WP-0015 +and its evidence receipts. T02 remains wait until remaining owner admission and +runtime gates are verified; no real model run or readiness promotion. + + +## Pinned Claude startup progress — 2026-09-06 + +Advanced sand-boxer SAND-WP-0015-T05 independently of custody: runtime builder +now copies only an explicitly digest-pinned native Claude executable. Selected +installed Claude 2.1.263, binary digest +26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba; +complete candidate runtime digest +5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922. +Sandbox f8821ec2 passed actual Claude --version, rein CLI/import, read-only +runtime, private HOME/state persistence, source absence, clean tree and teardown +with owner proxy environment present. Lint and all 175 sand-boxer tests pass. +Evidence: docs/evidence/GLAS-WP-0015-claude-startup-2026-09-06.json. + +This resolves candidate binary pin/startup, not protected runtime deployment, +Claude provider-request compatibility, credential delivery or a real model run. +The candidate is in /tmp; no production profile readiness changed. Existing +credential and acceptance tasks remain open. No new owner replies at session start. + + +## Protected local artifact return — 2026-09-08 + +SAND-WP-0015-T06 is done. The previously pinned combined artifact is installed +unchanged in owner UID 1000's mode-0700 runtime store on bnt-lap001: +`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +Complete artifact digest remains +`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +This is the existing owner-controlled local artifact contract, not root-owned +system storage or Railiance placement. Do not rebuild this accepted candidate +merely to move it out of /tmp. + +The installed-path sandbox `51b59587` proves actual Claude 2.1.263 and rein +startup, read-only runtime, source absence, clean Git, private state persistence, +loopback-only interfaces, and workspace/proxy removal. No credential references +or model request were used. Sand-boxer `make check`: lint clean, 188 tests pass. +Source return: 3e49a98a0e2c4a64539a5ccd674be8cd67ac9845; receipt in +`sand-boxer/docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`. + +T02 remains wait for trusted owner execution configuration, native credentials +and real-provider evidence. T03-T06 retain candidate review, real-model run, +readiness and recovery obligations. No profile readiness or schedule changes. + +2026-09-23 candidate superseded before use: operator chose `claude-sonnet-5`. +`harness.agent-dev-local@1.1.1` is identical to 1.1.0 except the model; 1.1.0 is +now `blocked`. Runtime `2cfc7b5f` bundles the earlier 1.1.0 copy (profile sha +`e84b9d0f…`) and must be rebuilt with this revision and placed again +(SECRETS-WP-0009-T03). Claude CLI 2.1.266 in that runtime lists +`claude-sonnet-5` in its model registry (static check). 134 tests pass. + +## 2026-09-27 loose-ends review + +Reviewed for locally finishable work. No new owner reply advances T02 beyond +the 2026-09-23 secrets-engine status already recorded in GLAS-WP-0015-T03. +T03's remaining done condition (runtime `2cfc7b5f` rebuilt with 1.1.1 and +started through its owner on railiance01, SECRETS-WP-0009-T03 step B2) and +T04/T05 all require that external owner delivery. Nothing in this repo can +advance them today; `status: blocked` stands unchanged. Re-review when the +runtime rebuild/placement or owner authentication lands. + + +## EMERGENT-WP-0002 proof requirements — 2026-10-03 + +Scoped review and local observed-model correction: +`docs/evidence/2026-10-03-emergent-session-readiness-review.md`. +T04 retains actual native-provider startup and continuity acceptance, including +reload after real resume/compaction, provider/repository changes and exact +available model/session metadata. The current lifecycle exposes no continuity +event API. Existing owner-delivery blockers and all task/readiness states remain; +local deterministic tests are not governed provider or isolation acceptance. + + +## 2026-10-16 NetKingdom isolated integration preparation + +Prepared, without owner deployment or readiness promotion, a Glas change that +separates credential-free housekeeping commands from explicit rein workload +execution. Both concrete adapters use the workload path; SSH selections with +credential routes refuse because that transport has no owner delivery contract. +Full regression: 141 passed. Real disposable bwrap/Glas transport proof passes +synthetic host-file denial, inherited credential environment and subprocess +denial, workload-only delivery, redaction, subsequent-command absence and +teardown. No provider/model call or real credential read occurred. + +Latest owner dependency sources supersede the stale missing-lane account: +September 27 native lanes were activated and revoked; corrected immutable +owner runtime is `818b1b7c…` (October 15 startup proof), not yet installed or +admitted on Railiance. HARNESS-WP-0008-T07 retains memo lifecycle acceptance, +installation, rehearsal, renewal/pin updates, native approvals and bounded +successful model/tool/commit acceptance. Any subsequent build containing this +patch has a different source/artifact pin requiring owner admission. + +This is a reviewable patch in Custodian's NetKingdom change bundle; no canonical +source synchronization or workplan task completion is implied. CUST-WP-0073 +continues to require admission of the actual interactive assignment, including +its existing host credential and external tool paths, not a disposable fixture. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.preimage.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.preimage.md new file mode 100644 index 00000000..4383544a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.preimage.md @@ -0,0 +1,450 @@ +--- +id: GLAS-WP-0012 +type: workplan +title: "Prove the first local rein profile end to end" +domain: infotech +repo: glas-harness +status: blocked +flavor: implementation +owner: codex +topic_slug: first-local-profile-production-proof +created: "2026-09-05" +updated: "2026-09-27" +state_hub_workstream_id: "170bf1ae-337f-5553-8d1e-03b07100e08f" +--- + +# Prove the first local rein profile end to end + +## Context and scope + +Follow up the Claude-route portion of live residual `GLAS-IN-0002`, originating +in finished `GLAS-WP-0005`. Boundary hardening is committed at `63a7f9f` and +proved with a deterministic non-secret dispatch. That proof did not execute +the real rein CLI or make a model call. + +Start from `harness.agent-dev-local@1.0.0` (rein-aharness, +`claude-sonnet-4-6`, `claude-code-cli`, `green-commit-only`). Review a new +versioned candidate after the owner runtime contract is available. Keep the +existing blocked selection as the rollback pin. The open-weight profile and +remote profile do not acquire readiness from this workplan. + +Glas owns profile selection, its adapter, and acceptance evidence. Sand-boxer +owns runtime provisioning, execution environment, isolation, egress enforcement, +and teardown. The selected rein and credential owner own authentication and +credential acquisition. Use existing owner work `SAND-WP-0014-T05`; its current +OpenRouter dependency must be distinguished from this first Claude-route proof. + +## Establish the exact local baseline and acceptance requirements + +```task +id: GLAS-WP-0012-T01 +status: done +priority: high +state_hub_task_id: "711aeb7e-4664-5078-8c65-3fe6f46f7999" +``` + +Completed 2026-09-05. Reviewed Glas `63a7f9f`, sand-boxer `b6655d8`, and +rein-aharness `1429db5`. Added a reproducible non-secret owner-execution runtime +inventory and the [acceptance contract](../docs/local-profile-acceptance.md). + +The baseline can discover Python, Git, and a `claude` command. It cannot +discover `rein-aharness`, its Python module, or `llm_connect`. Command discovery +alone does not prove that Claude can start or authenticate. The namespace has +only loopback; declared egress and credential route references are empty. +Owner execution and workspace teardown pass. The baseline is therefore +insufficient for a real rein run. + +Reviewed the plan against current implementation. Local preparation is done; +remaining execution waits on the owner inputs in T02. + +## Resolve and verify the owner runtime, credential, and egress contract + +```task +id: GLAS-WP-0012-T02 +status: wait +depends_on: [SAND-WP-0014-T05] +blocking_reason: "Dependency: sand-boxer SAND-WP-0014-T05 with rein-aharness and its credential owner." +priority: high +state_hub_task_id: "4209f564-a9ee-57f9-9522-3708988801ef" +``` + +Dependency: sand-boxer `SAND-WP-0014-T05`, with rein-aharness and its credential +owner. Required deliverables are listed in `docs/local-profile-acceptance.md`: + +- Exact runtime artifact/revision, in-sandbox entrypoints and dependencies, + sanitized environment, private writable state, and deployment/host identity. +- A Claude-compatible catalog credential route and owner implementation that + delivers it to the selected runtime. An environment label containing route + references is not credential delivery. +- An owner-defined sandbox profile with explicit enforced provider egress, + DNS/TLS requirements, and negative egress tests. Editing an egress list alone + does not provide connectivity in the current loopback-only implementation. +- Non-secret startup, identity, source-absence, and cleanup evidence through + the same manager/service path the gateway will use. + +Done when these deliverables exist at reviewable revisions and their owner +proofs pass. No rein installation in the source checkout, host home mount, +credential injection from the interactive shell, or unrestricted network +substitution is an acceptance path. + +2026-09-05 owner progress: SAND-WP-0015 implemented digest-pinned standalone +Python runtime mounting and private namespace state. Real rein CLI startup, +read-only runtime, source absence, clean worktree, state persistence across +exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132 +tests pass. This completes the candidate runtime mechanism, not production +selection. Authentication lane, credential delivery/revocation, provider egress, +pinning the Claude executable, and deployed profile review remain open. The +credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See +[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner +CCR-2026-0016 (in flight). Organization/key metadata is supplied and the user saved the key in OpenBao. +A metadata-only owner check confirmed live version 2 on 2026-09-05, without +reading the value. Custody handoff is complete. Verified machine binding, +protected runtime delivery, workspace scope/budget and provider egress remain +outstanding; provider authentication has not been tested. +See docs/local-profile-acceptance.md. + +## Review and validate the versioned Glas proof candidate + +```task +id: GLAS-WP-0012-T03 +status: wait +depends_on: [GLAS-WP-0012-T02, SECRETS-WP-0009-T03] +priority: high +blocking_reason: "Await the rebuilt runtime artifact carrying profile 1.1.1 started through its owner on railiance01 (SECRETS-WP-0009-T03 step B2)." +state_hub_task_id: "c660808a-1724-555c-bc59-7318870d3591" +``` + +Depends on T02. Prepare `harness.agent-dev-local@1.1.0` only once the real +sandbox profile and credential route are known. Keep the rein/model route and +tool profile explicit; choose bounded proof limits no greater than the current +900 seconds / 60,000 tokens. Record runtime and sandbox revisions and the +validated host scope in evidence. Account for dependency versions that are not +represented directly in the Glas profile schema. + +Use `unverified` only after known blockers are resolved, to label the bounded +real proof. Validate schema, capabilities, route propagation, timeout behavior, +and refusal of the old blocked version. Version coexistence must make an +unversioned selection ambiguous rather than silently changing consumers. + +Done when the exact candidate resolves, the real runtime starts through its +owner, the focused tests and full suite pass, and rollback to the blocked +`harness.agent-dev-local@1.0.0` pin is documented. + +2026-09-21 candidate: `profiles/harness.agent-dev-local-1.1.0.yaml`, readiness +`unverified` (evidence_ref GLAS-WP-0012-T03), `profile.bwrap-local`, no +credential route refs, claude-sonnet-4-6, 900 s / 60,000 tokens, max_turns 30, +max_budget_usd 5.0. The provider key stays with rein-aharness MessagesOwner +outside bwrap (metered-once); the owner bootstrap's sandbox, model and +credential-route checks accept it. max_budget_usd matches the operator-accepted +spend envelope hfact-glas-anthropic-2026-09 (Informed Decision +infd-20260921-b01, approval ba5ce2d8). Unpinned selection is now ambiguous and +1.0.0 stays blocked; rollback is pinning 1.0.0. 134 tests pass. Remaining for +done: the rebuilt runtime artifact carrying this profile starts through its +owner on railiance01 (SECRETS-WP-0009-T03 step B2). + +2026-09-23 the candidate is now `harness.agent-dev-local@1.1.1` (`claude-sonnet-5`, +otherwise identical). 1.1.0 is blocked, and rollback is still pinning 1.0.0. +Reviewed 2026-09-24: the catalog resolves 1.1.1 as unverified, and 134 tests pass. +The done condition is unchanged. It needs runtime `2cfc7b5f` rebuilt with 1.1.1 +and started through its owner. + +## Prove one real bounded rein task inside the sandbox + +```task +id: GLAS-WP-0012-T04 +status: wait +depends_on: [GLAS-WP-0012-T03] +blocking_reason: "Depends on T03." +priority: high +state_hub_task_id: "3e791432-8f37-54bd-a44a-55eeff11ac19" +``` + +Depends on T03. Run the actual `ReinAharness` adapter and installed +`rein-aharness` CLI with Claude through the candidate profile on a disposable +Git fixture. Do not substitute deterministic dispatch or change the source +checkout to satisfy the task. Verify the acceptance assertions in the contract, +including exactly one intended commit, a clean final tree, unchanged/inaccessible +host source, exact identity, bounded duration, task cleanup, and destruction. + +Collect and validate the sandbox artifact before gateway teardown removes the +workspace. Implement the smallest necessary proof observer in the acceptance +fixture; direct evidence must distinguish actual content validation from a +reported commit SHA. Preserve compact value-free evidence only. + +Done when the bounded real run and relevant failure/cleanup checks pass with +the exact selected profile/runtime pins and credential route identified. + +## Publish evidence and mark only the proven profile ready + +```task +id: GLAS-WP-0012-T05 +status: wait +depends_on: [GLAS-WP-0012-T04] +blocking_reason: "Depends on T04." +priority: high +state_hub_task_id: "f7635cf6-e044-52d4-8242-0512e0ccbd7b" +``` + +Depends on T04. Update only the proven candidate to `ready` with evidence that +identifies the host/runtime scope, credential route, egress policy, revisions, +limits, and rollback. Run catalog validation and regression checks. Do not +enable production schedules as a side effect of this proof. + +Update `GLAS-IN-0002` with the Claude acceptance result. Keep its open-weight +portion live, or split that remaining work into a separately registered record +before closing the intake. Synchronize work records and log progress. Finish +this workplan only when the first profile is proven and residuals remain live. + +## Prepare the real-rein acceptance runner + +```task +id: GLAS-WP-0012-T06 +status: done +priority: high +state_hub_task_id: "d0c26709-549f-540a-8250-1fd1b2e4960a" +``` + +Independent preparation for T04 while T02 remains blocked. Add a disposable +fixture that delegates actual dispatch to the catalog-built ReinAharness, +validates the commit and artifact through owner execution before teardown, +checks the host source and cleanup, and emits bounded evidence without model +output or credential values. Refuse blocked or unpinned profiles before +creating a sandbox. Test negative artifact cases and the refusal path. This +runner does not itself satisfy T04 or change readiness. + +Completed 2026-09-05. `scripts/prove-local-profile.py` delegates real dispatch +and observes content/commit acceptance before teardown. It verifies exactly one +new commit, expected paths and committed/worktree content, a clean tree, +source absence, exact child identity, private task mode/removal, and host-source +integrity plus workspace destruction. It emits bounded evidence and has no +readiness override. `tests/test_local_profile_proof.py`: 20 focused tests pass; +full suite: 101 passed; catalog validation passes. A real CLI invocation against +`harness.agent-dev-local@1.0.0` returned `OperationallyBlockedProfileError` +without creating a sandbox. T02–T05 remain waiting on the owner dependencies; +no real model run or readiness promotion is claimed. + +## Acceptance + +One version-pinned local profile runs its actual rein/model task entirely in +the declared sandbox, produces validated local output, and tears down cleanly. +Its readiness describes the proven runtime scope. Other profile readiness and +consumer schedules remain independently governed. + +## 2026-09-05 egress owner return + +Owner-controlled HTTPS egress is implemented and live-tested through both the +extension and a persisted manager: provider TLS/HTTP response, undeclared-host +and direct-IP denial, isolated namespace and proxy/workspace cleanup passed. +See [egress evidence](../docs/evidence/GLAS-WP-0012-egress-2026-09-05.md). +T02 remains waiting on machine auth, protected credential delivery, the pinned +Claude executable and the combined production acceptance. Profiles remain blocked. + +## 2026-09-05 credential owner return + +Sand-boxer credential transport is implemented and proved with synthetic +provider sandbox 880f749e. Owner config binds exact profile/project/actor and +run id; unknown routes refuse, shell API-key fallback is stripped, only the +workload child receives the value, and output redaction precedes truncation. +Tests: sand-boxer171, secrets-engine226, Glas101 pass. Native data-only read +policy/AppRole proposal and activation now live in SECRETS-WP-0009. Its +production exec refuses before OpenBao because durable access-engine decision +records and scoped service authority remain unavailable. T02 remains waiting +on that activation, pinned Claude startup and real provider/task acceptance. + +## 2026-09-06 credential owner update + +Reviewed secrets-engine message `3bd23bc9-e863-4f1f-8c76-415812ec0656`. +Owner reports the local authorization join implemented at `627810b`. Remaining +native activation depends on approval-engine serving the durable +ActionAuthorization claim endpoint and access-engine serving Check, followed +by configuration, per-lane approval and positive/negative verification. +State Hub decisions are not a substitute for the durable authorization object. +SECRETS-WP-0009-T03 and this plan's T02 remain waiting; runtime pinning and +combined real proof remain required. No readiness change or real-key read. + +## 2026-09-06 authorization contract and policy publication + +Reviewed owner commits `7b4b9e3` and `083bee7` and FLEX-WP-0021. Gate-house +GH-DEC-2026-005 resolved the contract: secrets-engine now validates the +approval-claim and decision envelope separately and removed the incorrect +State Hub authority requirement. Flex-auth published +`secrets-engine.catalog-lane.lifecycle` v1; T01/T02 are done. + +Remaining owner gates are real decision/digest verification (FLEX-WP-0021-T03), +consumer service deployment and handoff (T04/T05), approval-engine deployment, +production service identity and verified lane activation. Publication is not +deployment. T02 stays waiting, and runtime pinning and combined acceptance +remain required. No new owner inbox message or activation evidence was found +in this review. + +## 2026-09-06 digest verification follow-up + +Reviewed secrets-engine `6e9c152` and `925d028`: owner corrected correlation +field handling in the flex-auth digest and refreshed fixtures. Its tests also +record an unresolved approval/native action-vocabulary and embedded-claim +digest mismatch for dual-control requests. This is owner integration evidence, +not successful live activation; SECRETS-WP-0009-T03 remains wait. No new +activation receipt was found in the Glas inbox. T02 remains waiting. + +## 2026-09-06 authorization-chain owner return + +Reviewed secrets-engine `f62d3fe` / `64aeec9`. Owner reports claim → Check → +consume → backend integration against a throwaway OpenBao, including denial, +unreachable service, invalid claim, missing digest, consume conflict and action +mismatch refusal before backend access. Authorization transport is stubbed; +wire shapes use published flex-auth fixtures. Do not describe this as a live +production service or Anthropic delivery proof. + +Owner now identifies deployment/configuration as the remaining live gate: +consumer PDP service and approval-engine rollout, production service +credentials, deployed policy pin and per-lane authorization id. +SECRETS-WP-0009-T03 remains wait. Earlier digest-defect notes are historical; +use this latest owner return for the integration status. Native lane positive/ +negative access checks, pinned Claude startup, provider scope/budget inputs and +combined Glas acceptance remain outstanding. T02–T05 stay wait. + +Review found no pending local changes or new inbox messages. Corrected stale +README wording that still called owner execution missing; the implemented +mechanism and its separate proofs do not change profile readiness. + +## 2026-09-06 production deployment action + +User authorized production deployment. Dedicated flex-auth-secrets-engine Helm +release is available 1/1 at revision 1; five policy fixtures and allowed/denied +network probes passed. CI image is digest-pinned; existing consumers unchanged. +Caller authentication remains warn pending identity adoption. See +[deployment evidence](../history/2026-09-06-174000-production-deployment.md). +Approval-engine remains undeployed: live KeyCape clients and audit sender are +absent, the tenant contract needs alignment, and a release digest is required. +Corrected its stale issuer/JWKS deployment inputs. No production credential +lane or real Claude run was activated; T02 remains wait. + +## Production dependency coordination + +GLAS-WP-0015 now tracks exact owner handoffs and return receipts from Glas. +The requests in docs/production-dependency-handoffs.md reuse existing owner +work: tenant agreement and client custody, KeyCape rollout, audit source +onboarding, approval release, native lane activation and pinned combined +runtime. Image/runtime preparation can proceed in parallel. The runner's +project glas-local-proof must be reconciled with the owner route example's +project glas-harness before the exact delivery binding is selected. Owner +handoffs were sent after explicit authorization; GLAS-WP-0015 records all seven +receipt IDs and tracks replies. This plan's T02 remains wait. + +## Verified owner follow-up — 2026-09-06 + +Glas reviewed six owner acknowledgements in GLAS-WP-0015. Project binding is +resolved to agt/glas-local-proof at sand-boxer 23d0c2b; the combined profile +source is available, but Claude is not pinned. The deployed policy was found +to lack tenant denial at v1; the owner correction v2 is now deployed at Helm +revision 2 and six live Check fixtures pass, including wrong_tenant denial. +Tenant choice, workstation caller access, audit load-bearing schema/admission, +identity/custody and native activation remain gates. T02 remains wait. + + +Tenant decision update (2026-09-06): operator approved `tenant:platform` for the +approval dependency chain as the platform management/services tenant. See +`docs/platform-tenant-decision.md`. The choice blocker is resolved; exact owner +configuration alignment and verification remain part of T02 before readiness. + + +Later deployment progress (2026-09-06): KeyCape/approval source tenant alignment +verified, approval release published and pinned, audit T03 complete, dedicated +PDP revision 3 enforces adopted short-lived caller identity. See GLAS-WP-0015 +and its evidence receipts. T02 remains wait until remaining owner admission and +runtime gates are verified; no real model run or readiness promotion. + + +## Pinned Claude startup progress — 2026-09-06 + +Advanced sand-boxer SAND-WP-0015-T05 independently of custody: runtime builder +now copies only an explicitly digest-pinned native Claude executable. Selected +installed Claude 2.1.263, binary digest +26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba; +complete candidate runtime digest +5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922. +Sandbox f8821ec2 passed actual Claude --version, rein CLI/import, read-only +runtime, private HOME/state persistence, source absence, clean tree and teardown +with owner proxy environment present. Lint and all 175 sand-boxer tests pass. +Evidence: docs/evidence/GLAS-WP-0015-claude-startup-2026-09-06.json. + +This resolves candidate binary pin/startup, not protected runtime deployment, +Claude provider-request compatibility, credential delivery or a real model run. +The candidate is in /tmp; no production profile readiness changed. Existing +credential and acceptance tasks remain open. No new owner replies at session start. + + +## Protected local artifact return — 2026-09-08 + +SAND-WP-0015-T06 is done. The previously pinned combined artifact is installed +unchanged in owner UID 1000's mode-0700 runtime store on bnt-lap001: +`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +Complete artifact digest remains +`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +This is the existing owner-controlled local artifact contract, not root-owned +system storage or Railiance placement. Do not rebuild this accepted candidate +merely to move it out of /tmp. + +The installed-path sandbox `51b59587` proves actual Claude 2.1.263 and rein +startup, read-only runtime, source absence, clean Git, private state persistence, +loopback-only interfaces, and workspace/proxy removal. No credential references +or model request were used. Sand-boxer `make check`: lint clean, 188 tests pass. +Source return: 3e49a98a0e2c4a64539a5ccd674be8cd67ac9845; receipt in +`sand-boxer/docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`. + +T02 remains wait for trusted owner execution configuration, native credentials +and real-provider evidence. T03-T06 retain candidate review, real-model run, +readiness and recovery obligations. No profile readiness or schedule changes. + +2026-09-23 candidate superseded before use: operator chose `claude-sonnet-5`. +`harness.agent-dev-local@1.1.1` is identical to 1.1.0 except the model; 1.1.0 is +now `blocked`. Runtime `2cfc7b5f` bundles the earlier 1.1.0 copy (profile sha +`e84b9d0f…`) and must be rebuilt with this revision and placed again +(SECRETS-WP-0009-T03). Claude CLI 2.1.266 in that runtime lists +`claude-sonnet-5` in its model registry (static check). 134 tests pass. + +## 2026-09-27 loose-ends review + +Reviewed for locally finishable work. No new owner reply advances T02 beyond +the 2026-09-23 secrets-engine status already recorded in GLAS-WP-0015-T03. +T03's remaining done condition (runtime `2cfc7b5f` rebuilt with 1.1.1 and +started through its owner on railiance01, SECRETS-WP-0009-T03 step B2) and +T04/T05 all require that external owner delivery. Nothing in this repo can +advance them today; `status: blocked` stands unchanged. Re-review when the +runtime rebuild/placement or owner authentication lands. + + +## EMERGENT-WP-0002 proof requirements — 2026-10-03 + +Scoped review and local observed-model correction: +`docs/evidence/2026-10-03-emergent-session-readiness-review.md`. +T04 retains actual native-provider startup and continuity acceptance, including +reload after real resume/compaction, provider/repository changes and exact +available model/session metadata. The current lifecycle exposes no continuity +event API. Existing owner-delivery blockers and all task/readiness states remain; +local deterministic tests are not governed provider or isolation acceptance. + + +## 2026-10-16 NetKingdom isolated integration preparation + +Prepared, without owner deployment or readiness promotion, a Glas change that +separates credential-free housekeeping commands from explicit rein workload +execution. Both concrete adapters use the workload path; SSH selections with +credential routes refuse because that transport has no owner delivery contract. +Full regression: 141 passed. Real disposable bwrap/Glas transport proof passes +synthetic host-file denial, inherited credential environment and subprocess +denial, workload-only delivery, redaction, subsequent-command absence and +teardown. No provider/model call or real credential read occurred. + +Latest owner dependency sources supersede the stale missing-lane account: +September 27 native lanes were activated and revoked; corrected immutable +owner runtime is `818b1b7c…` (October 15 startup proof), not yet installed or +admitted on Railiance. REINAH-WP-0008-T07 retains memo lifecycle acceptance, +installation, rehearsal, renewal/pin updates, native approvals and bounded +successful model/tool/commit acceptance. Any subsequent build containing this +patch has a different source/artifact pin requiring owner admission. + +This is a reviewable patch in Custodian's NetKingdom change bundle; no canonical +source synchronization or workplan task completion is implied. CUST-WP-0073 +continues to require admission of the actual interactive assignment, including +its existing host credential and external tool paths, not a disposable fixture. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/manifest.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/manifest.json new file mode 100644 index 00000000..9df34a85 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/manifest.json @@ -0,0 +1,46 @@ +{ + "schema": "custodian.identity-binding-publication-artifacts.v1", + "status": "verified", + "files": { + "glas-harness/consistency.json": "sha256:67309a476a94778c13cfcc1cddc1f23caa51bbedae0e324f5a9af4780aba1bed", + "glas-harness/consistency.stderr.txt": "sha256:f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba", + "glas-harness/index.preimage": "sha256:be6359bc304b09f0a3479e8c3cab02483c42a11c57aedf222000c153693b9843", + "glas-harness/projection.json": "sha256:6683a110a420e37724e322b50ff91eb867ae4e6533f5f97b45c145fb14b1a845", + "glas-harness/projection.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "glas-harness/publication-backup/.custodian-brief.md.worktree": "sha256:958a7f356e71829b5115026404f7b9756cd7cf08bf882fad0990a0897ddf8b19", + "glas-harness/publication-backup/WORK-RECORDS.md.worktree": "sha256:ffdc5dc4868a3b5b0b836f875b31bef7f52f699df6779ab06a5b6cb865b3ebf9", + "glas-harness/publication-backup/originals.json": "sha256:73b9f5cbead35abb248e7fe91198728628ad61ad852b4e8125e9a31bf295c574", + "glas-harness/publication-commit.json": "sha256:567b941b59b9dde2a26a00aacd233442b76c46799f10c2873f918e08adf8cba3", + "glas-harness/publication-manifest.json": "sha256:4bc573e2691ba00d1ccdb7da753a1640fbc6b7a8945d9ebcc16fb510c034c4dd", + "glas-harness/source-before.json": "sha256:8ce1f39ff2cdceb5c36bbf6f8ef9442c947366415200ed04f1dda61e56071387", + "glas-harness/verified-bindings.json": "sha256:3c708759395d3ca0fbed312c2dfb458d200c95154e35239d3006bf496c2caafd", + "glas-harness/workplan.postimage.md": "sha256:23f97bc183bef2b0f38eb40c64bc0bb010df1c1eb4596ff3b5e0f73da7c2fcfc", + "glas-harness/workplan.preimage.md": "sha256:881ab0f5ba3bb43f5404c8f4cd23f9628e014992ba88fc13f541f0fa8b7b1eaa", + "rein-aharness/consistency.json": "sha256:92476d31cac32366e7186ecf2e6facb837eeedcb388c138581644c013947b01b", + "rein-aharness/consistency.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "rein-aharness/projection.json": "sha256:1a6ea4eaae65043a7dc81aaac77442714280e20ed8841c7e0df2aea0f7993763", + "rein-aharness/projection.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "rein-aharness/publication-backup/.custodian-brief.md.worktree": "sha256:8835f9bcfc7d5be193cef0b76aea1c896346a6a801f710704b0cb58544d44918", + "rein-aharness/publication-backup/WORK-RECORDS.md.worktree": "sha256:baa1b17a2d69493a6dd3a704543afd75ffae7bae25f582160c98bb2fba4118aa", + "rein-aharness/publication-backup/originals.json": "sha256:72a3bb6c69e2d37225d736e8a3dcb1f67d19d18ed7dc82e5796fb427aa6bedb3", + "rein-aharness/publication-commit.json": "sha256:98a00d07f82b093d6555ff12d9e2ba77bbb05e252aa6dd6301436c0c3945f84e", + "rein-aharness/publication-manifest.json": "sha256:49c712f3b5654ebd3d0169e322af099f0a8f2e0f119e5ea1c86f4d394484a1cb", + "rein-aharness/verified-bindings.json": "sha256:edeb1aafd91c7d97fb455ce7e5972fb803f6f97f5fe3c8623bffcf281b5749f3", + "sand-boxer/consistency.json": "sha256:98727575e0892fb517a7e8eb56d30ebdd70c7af6c2bfe91f24b45cdce192d697", + "sand-boxer/consistency.stderr.txt": "sha256:f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba", + "sand-boxer/index.preimage": "sha256:e9c14c64f7319eed77603103a13f1422726121bd9ee475902f4501a8781bf02d", + "sand-boxer/projection.json": "sha256:b8effe52919d42865a33e4e9f63ed288ee61f201a778877dc294b611c9352b99", + "sand-boxer/projection.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "sand-boxer/publication-backup/.custodian-brief.md.worktree": "sha256:5c1fbfeaeadda850d0c373a110d49143de4ff89fd0d2902add3025807de5fe85", + "sand-boxer/publication-backup/WORK-RECORDS.md.worktree": "sha256:a646f4444c6237c5a5e060bc22fa46c8129e010cdb8dcc5e78e721ad49413425", + "sand-boxer/publication-backup/originals.json": "sha256:f9c22541d53757843e2bf6aeb2eb59455466654a0d861ed4eb37c0434290c5c9", + "sand-boxer/publication-commit.json": "sha256:6e3f1b7c11a6dfe6fbb8c6eb4946858f6e930597c0ca493efcc98ad3dfa44ad4", + "sand-boxer/publication-manifest.json": "sha256:8e1166d27d8f9279a3dbc328e2486405a9a574fdbdd7710cb251f09e3dd0ccea", + "sand-boxer/required-checks.json": "sha256:57875a26b2bb1ed486d206adedce2b9aec8b1d7df83214f6bda70d48957a0031", + "sand-boxer/source-before.json": "sha256:946a90aae4fddeb082e69f21dc876ff8590937f0aeadfb2f445927eb553bb9af", + "sand-boxer/verified-bindings.json": "sha256:3c7f37a6060d7bfdbdbb578ba08354f50ff5c9003a138bd52955d49be1f9bb38", + "sand-boxer/workplan.postimage.md": "sha256:56022703fd4d973f40ddad8eb99cb02783b086549b24ef89f89157de33eafe31", + "sand-boxer/workplan.preimage.md": "sha256:230d1ef37aa9c2023335a617492a72678c4671a8bc82d5577e9d7a7cea6e8fe4", + "verified-publication.json": "sha256:bc58522a93b0e225dec68728d010b846af8413486e17d94bd5d0c393da679dea" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.json new file mode 100644 index 00000000..69a031fb --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.json @@ -0,0 +1,71 @@ +{ + "repo_slug": "rein-aharness", + "repo_path": "/home/worsch/rein-aharness", + "source_revision": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['HARNESS-WP', 'REINAH-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'ACTIVITY-WP-0026' is not linked to State Hub", + "file_path": "workplans/REINAH-WP-0005-ops-run-claim-loop.md", + "db_id": "", + "file_value": "ACTIVITY-WP-0026", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Human wait task 'HARNESS-WP-0008-T07' in workplan 'HARNESS-WP-0008' has needs_human: true without decision_id \u2014 unrouted human gate", + "file_path": "workplans/REINAH-WP-0008-simpler-metered-retry.md#HARNESS-WP-0008-T07", + "db_id": "", + "file_value": "needs_human: true", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'HARNESS-WP-0008' uses prefix 'HARNESS-WP' but repo canonical prefix is 'REINAH-WP' \u2014 new plans must conform", + "file_path": "workplans/REINAH-WP-0008-simpler-metered-retry.md", + "db_id": "", + "file_value": "HARNESS-WP-0008", + "db_value": "REINAH-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 9/9", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-33 fixed: regenerated WORK-RECORDS.md", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 5, + "info": 0 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.json new file mode 100644 index 00000000..65013e1b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.json @@ -0,0 +1,124 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "rein-aharness", + "commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "requests": 2, + "elapsed_ms": 1898.6, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "rein-aharness", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "derived_commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "rein-aharness", + "commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "status": "applied", + "counts": { + "created": 0, + "updated": 9, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 7, + "cancelled_tasks": 0, + "created_edges": 1, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 3 + }, + "created": [], + "updated": [ + "HARNESS-WP-0008", + "HARNESS-WP-ADHOC-2026-09-04", + "REINAH-WP-0001", + "REINAH-WP-0002", + "REINAH-WP-0003", + "REINAH-WP-0004", + "REINAH-WP-0005", + "REINAH-WP-0006", + "REINAH-WP-0007" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [ + "HARNESS-WP-0008-T01", + "HARNESS-WP-0008-T02", + "HARNESS-WP-0008-T03", + "HARNESS-WP-0008-T04", + "HARNESS-WP-0008-T05", + "HARNESS-WP-0008-T06", + "HARNESS-WP-0008-T07" + ], + "cancelled_tasks": [], + "created_edges": [ + { + "workplan": "REINAH-WP-0005", + "from": "REINAH-WP-0005", + "target": "ACTIVITY-WP-0026", + "relationship_type": "blocks", + "from_workplan_id": "7d023961-af5b-59dc-96ec-85d45f67cfa4", + "from_task_id": null, + "to_workplan_id": "d05e49dd-dbc9-59f4-bbc8-8bfced64d4a8", + "to_task_id": null + } + ], + "removed_edges": [], + "unresolved_edges": [], + "external_edges": [ + { + "workplan": "REINAH-WP-0003", + "from": "REINAH-WP-0003-T06", + "target": "REINAH-WP-0003-T05", + "relationship_type": "starts_after", + "from_workplan_id": "eba2eff1-10a7-50a3-a70b-14e7d398f27f", + "from_task_id": "68a13c4f-0cc7-5d0b-917e-441164da8c84", + "to_workplan_id": null, + "to_task_id": "c4a3f08f-2874-5672-9f29-aecddd697d90" + }, + { + "workplan": "REINAH-WP-0003", + "from": "REINAH-WP-0003-T06", + "target": "REINAH-WP-0003-T04", + "relationship_type": "starts_after", + "from_workplan_id": "eba2eff1-10a7-50a3-a70b-14e7d398f27f", + "from_task_id": "68a13c4f-0cc7-5d0b-917e-441164da8c84", + "to_workplan_id": null, + "to_task_id": "f6c7f80c-3807-54ac-b44a-ef582433b927" + }, + { + "workplan": "REINAH-WP-0003", + "from": "REINAH-WP-0003-T06", + "target": "GLAS-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "eba2eff1-10a7-50a3-a70b-14e7d398f27f", + "from_task_id": "68a13c4f-0cc7-5d0b-917e-441164da8c84", + "to_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "to_task_id": null + } + ], + "refused": [], + "notes": [] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/.custodian-brief.md.worktree new file mode 100644 index 00000000..0854f3ee --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/.custodian-brief.md.worktree @@ -0,0 +1,36 @@ + +# Custodian Brief — rein-aharness + +**Domain:** agents +**Last synced:** 2026-10-14 00:11 UTC +**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + +## Active Workstreams + +### Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal +Progress: 4/7 done | workplan_id: `187c2599-84a6-5764-a14f-7e9121975bf2` + +**Open tasks:** +- ! E. Ship the owner runtime as a container image (decision) `b486e86b` +- ! F. Approvals per envelope (decision) `4cf721e6` +- ! Retry on the corrected runtime `80318842` + *(wait: Owner: accept spend memo infd-20261014-b01, then attended install, rehearsal, renew and approvals on railiance01)* + +### Governed runtime integrity and intent convergence +Progress: 3/6 done | workplan_id: `eba2eff1-10a7-50a3-a70b-14e7d398f27f` + +**Open tasks:** +- ! Remove tenant logic from the shared runtime `f6c7f80c` + *(wait: Migration of profile-absent FI/Binky definitions with Activity Core, kaizen-agentic and tenant owners.)* +- ! Align deployment, recovery, and conformance with the supported runtime `c4a3f08f` + *(wait: Fixture recovery, rate, and queue-injection evidence is local only (2026-10-08). Activity-core has not replied to 27cd4c47: a 409 stays claimed because this worker must not terminal-close a lost lease. Fixture micro-USD rates are not a live tariff. Admission does not deploy or start a paid request.)* +- ! Re-prove one governed profiled run and close residuals `68a13c4f` + *(wait: After T01-T05 and upstream GLAS-IN-0002/GLAS-WP-0012.)* + +--- +## MCP Orientation (when available) + +If the state-hub MCP server is reachable, call: +`get_domain_summary("agents")` +This provides richer cross-domain context. +If the MCP call fails, use this file as your orientation source. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/WORK-RECORDS.md.worktree new file mode 100644 index 00000000..9c23f62f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/WORK-RECORDS.md.worktree @@ -0,0 +1,60 @@ +# Work Records — rein-aharness + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | HARNESS-WP-ADHOC-2026-09-04 | finished | — | workplans/ADHOC-2026-09-04.md | +| workplan | REINAH-WP-0001 | finished | — | workplans/REINAH-WP-0001-harness-foundation.md | +| workplan | REINAH-WP-0002 | finished | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md | +| workplan | REINAH-WP-0003 | blocked | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| workplan | REINAH-WP-0004 | finished | — | workplans/REINAH-WP-0004-statehub-bootstrap.md | +| workplan | REINAH-WP-0005 | finished | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| workplan | REINAH-WP-0006 | finished | — | workplans/REINAH-WP-0006-binky-weekly-review-approach.md | +| workplan | REINAH-WP-0007 | finished | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md | +| workplan | REINAH-WP-0008 | blocked | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | HARNESS-WP-ADHOC-2026-09-04-T01 | done | — | workplans/ADHOC-2026-09-04.md | +| task | REINAH-WP-0001-T01 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0001-T02 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0001-T03 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0001-T04 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0001-T05 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0001-T06 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0001-T07 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0002-T01 | done | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md | +| task | REINAH-WP-0002-T02 | done | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md | +| task | REINAH-WP-0002-T03 | done | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md | +| task | REINAH-WP-0002-T04 | done | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md | +| task | REINAH-WP-0003-T01 | done | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| task | REINAH-WP-0003-T02 | done | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| task | REINAH-WP-0003-T03 | done | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| task | REINAH-WP-0003-T04 | wait | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| task | REINAH-WP-0003-T05 | wait | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| task | REINAH-WP-0003-T06 | wait | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| task | REINAH-WP-0004-T01 | done | — | workplans/REINAH-WP-0004-statehub-bootstrap.md | +| task | REINAH-WP-0004-T02 | done | — | workplans/REINAH-WP-0004-statehub-bootstrap.md | +| task | REINAH-WP-0004-T03 | done | — | workplans/REINAH-WP-0004-statehub-bootstrap.md | +| task | REINAH-WP-0005-T01 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| task | REINAH-WP-0005-T02 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| task | REINAH-WP-0005-T03 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| task | REINAH-WP-0005-T04 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| task | REINAH-WP-0005-T05 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| task | REINAH-WP-0005-T06 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| task | REINAH-WP-0006-T01 | done | — | workplans/REINAH-WP-0006-binky-weekly-review-approach.md | +| task | REINAH-WP-0006-T02 | done | — | workplans/REINAH-WP-0006-binky-weekly-review-approach.md | +| task | REINAH-WP-0006-T03 | done | — | workplans/REINAH-WP-0006-binky-weekly-review-approach.md | +| task | REINAH-WP-0007-T01 | done | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md | +| task | REINAH-WP-0007-T02 | done | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md | +| task | REINAH-WP-0007-T03 | done | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md | +| task | REINAH-WP-0007-T04 | done | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md | +| task | REINAH-WP-0008-T01 | done | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | REINAH-WP-0008-T02 | done | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | REINAH-WP-0008-T03 | done | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | REINAH-WP-0008-T04 | done | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | REINAH-WP-0008-T05 | wait | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | REINAH-WP-0008-T06 | wait | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | REINAH-WP-0008-T07 | wait | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/originals.json new file mode 100644 index 00000000..e9087729 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/originals.json @@ -0,0 +1,10 @@ +[ + { + "path": ".custodian-brief.md", + "index": "100644 0854f3ee6418b8547d97c4f8a0ea119cd35c9c1a 0\t.custodian-brief.md" + }, + { + "path": "WORK-RECORDS.md", + "index": "100644 9c23f62f341f77166e543af80f75c55a3763d24a 0\tWORK-RECORDS.md" + } +] diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-commit.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-commit.json new file mode 100644 index 00000000..2bbd1216 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-commit.json @@ -0,0 +1,17 @@ +{ + "exit_code": 0, + "commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "base": "9b88cadaa817e5abea7950b4a264d4e2739a5ddb", + "files": [ + { + "path": "AGENTS.md", + "sha256": "da71c6e3d76d7c867b2db6e67cd919fba594acc3804d3784dd744438103560c2" + }, + { + "path": "workplans/REINAH-WP-0008-simpler-metered-retry.md", + "sha256": "1118924bb159f8a52a37ace8b8663c75274b89928f7a8b957638428af224b054" + } + ], + "stdout": "[main 0b7a9cf] docs(identity): restore issued HARNESS metered retry identifiers\n 2 files changed, 25 insertions(+), 12 deletions(-)\n", + "stderr": "" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-manifest.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-manifest.json new file mode 100644 index 00000000..6aab2460 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-manifest.json @@ -0,0 +1,15 @@ +{ + "owner": "rein-aharness", + "base_revision": "9b88cadaa817e5abea7950b4a264d4e2739a5ddb", + "message": "docs(identity): restore issued HARNESS metered retry identifiers", + "files": [ + { + "path": "AGENTS.md", + "sha256": "da71c6e3d76d7c867b2db6e67cd919fba594acc3804d3784dd744438103560c2" + }, + { + "path": "workplans/REINAH-WP-0008-simpler-metered-retry.md", + "sha256": "1118924bb159f8a52a37ace8b8663c75274b89928f7a8b957638428af224b054" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/verified-bindings.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/verified-bindings.json new file mode 100644 index 00000000..432d52ed --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/verified-bindings.json @@ -0,0 +1,84 @@ +{ + "observed_at": "2026-10-17T10:58:01.748067+00:00", + "status": "verified_published_identity_restoration", + "commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "projection_counts": { + "created": 0, + "updated": 9, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 7, + "cancelled_tasks": 0, + "created_edges": 1, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 3 + }, + "all7_record_ids_filled": true, + "all8UUIDs_statuses_human_decisions_preserved": true, + "both_original_dependency_rows_retained": true, + "parent_slug": "harness-wp-0008", + "parent_status": "blocked", + "parent_projection_retired_at": null, + "tasks": [ + { + "id": "c6536c8d-7862-5de6-ad2b-401077b60c04", + "record_id": "HARNESS-WP-0008-T01", + "status": "done", + "needs_human": false, + "decision_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + { + "id": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9", + "record_id": "HARNESS-WP-0008-T02", + "status": "done", + "needs_human": false, + "decision_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + { + "id": "87457216-2371-51ca-b3d4-3917e6f180a2", + "record_id": "HARNESS-WP-0008-T03", + "status": "done", + "needs_human": false, + "decision_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + { + "id": "898e02af-51bb-5e8d-93d0-ae908466c612", + "record_id": "HARNESS-WP-0008-T04", + "status": "done", + "needs_human": false, + "decision_id": "a93619a9-8a70-40d8-aaf9-c29357d2a043", + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + { + "id": "b486e86b-9d0f-501d-a394-771b40f771ee", + "record_id": "HARNESS-WP-0008-T05", + "status": "wait", + "needs_human": true, + "decision_id": "e6ca2f07-2708-4013-bfba-bf89fa0f1cb5", + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + { + "id": "4cf721e6-724b-5c64-91bb-67b098bb97af", + "record_id": "HARNESS-WP-0008-T06", + "status": "wait", + "needs_human": true, + "decision_id": "e8986e40-f6f8-4c87-b704-bff50cc4958b", + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + { + "id": "80318842-ccaa-5484-a54a-3d9981eaec8b", + "record_id": "HARNESS-WP-0008-T07", + "status": "wait", + "needs_human": true, + "decision_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + } + ], + "native_authority_or_proposal_changed": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.json new file mode 100644 index 00000000..4f688516 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.json @@ -0,0 +1,52 @@ +{ + "repo_slug": "sand-boxer", + "repo_path": "/home/worsch/sand-boxer", + "source_revision": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-41", + "message": "Task wait-qualifier drift 'SAND-WP-0015-T04': file={'needs_human': False, 'blocking_reason': 'Tracked as HARNESS-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.', 'decision_id': None, 'blocked_on': 'message-from:rein-aharness', 'wait_until': None} db={'needs_human': False, 'blocking_reason': 'Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.', 'decision_id': None, 'blocked_on': 'message-from:rein-aharness', 'wait_until': None} (file wins)", + "file_path": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md#SAND-WP-0015-T04", + "db_id": "58817ef6-76d9-5e34-908f-c024e6c99f93", + "file_value": "{\"blocked_on\": \"message-from:rein-aharness\", \"blocking_reason\": \"Tracked as HARNESS-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.\", \"decision_id\": null, \"needs_human\": false, \"wait_until\": null}", + "db_value": "{\"blocked_on\": \"message-from:rein-aharness\", \"blocking_reason\": \"Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.\", \"decision_id\": null, \"needs_human\": false, \"wait_until\": null}", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 15/15", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-41 fixed: task 58817ef6\u2026 wait qualifiers synced", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 3, + "info": 0 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.stderr.txt new file mode 100644 index 00000000..3345563f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.stderr.txt @@ -0,0 +1 @@ +WARN: git commit failed for writeback: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/index.preimage b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/index.preimage new file mode 100644 index 00000000..bc101224 Binary files /dev/null and b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/index.preimage differ diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/projection.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/projection.json new file mode 100644 index 00000000..43dea6a0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/projection.json @@ -0,0 +1,91 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "sand-boxer", + "commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e", + "requests": 2, + "elapsed_ms": 3165.2, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "sand-boxer", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e", + "derived_commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "sand-boxer", + "commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e", + "status": "applied", + "counts": { + "created": 0, + "updated": 15, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 0, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 1 + }, + "created": [], + "updated": [ + "SAND-WP-0001", + "SAND-WP-0002", + "SAND-WP-0003", + "SAND-WP-0004", + "SAND-WP-0005", + "SAND-WP-0006", + "SAND-WP-0007", + "SAND-WP-0008", + "SAND-WP-0009", + "SAND-WP-0010", + "SAND-WP-0011", + "SAND-WP-0012", + "SAND-WP-0013", + "SAND-WP-0014", + "SAND-WP-0015" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [], + "cancelled_tasks": [], + "created_edges": [], + "removed_edges": [], + "unresolved_edges": [], + "external_edges": [ + { + "workplan": "SAND-WP-0014", + "from": "SAND-WP-0014-T05", + "target": "SAND-WP-0015-T04", + "relationship_type": "starts_after", + "from_workplan_id": "b616d1cd-208f-5ecf-a4a0-a028396422c4", + "from_task_id": "c6812fd4-bb7b-5be0-8344-a122496fe5bc", + "to_workplan_id": null, + "to_task_id": "58817ef6-76d9-5e34-908f-c024e6c99f93" + } + ], + "refused": [], + "notes": [] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/.custodian-brief.md.worktree new file mode 100644 index 00000000..9cc4a0d4 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/.custodian-brief.md.worktree @@ -0,0 +1,35 @@ + +# Custodian Brief — sand-boxer + +**Domain:** infotech +**Last synced:** 2026-10-14 00:16 UTC +**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + +## Active Workstreams + +### Owner-mediated governed bwrap execution +Progress: 4/5 done | workplan_id: `b616d1cd-208f-5ecf-a4a0-a028396422c4` + +**Open tasks:** +- ! Prove one governed rein and coordinate consumers `c6812fd4` + *(wait: Waits on SAND-WP-0015-T04: corrected runtime ee3d0a53 admission and one successful authorized owner-runtime acceptance before a real rein command runs through the owner API.)* + +### Provide a pinned bwrap rein runtime and private state +Progress: 5/6 done | workplan_id: `d3f12387-fd23-58f0-b979-9c811507614d` + +**Open tasks:** +- ! Resolve Claude credentials, enforced egress, and production acceptance `58817ef6` + *(wait: Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.)* + +## Inbox Hygiene + +**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. +**Missing thread_id:** 2 unread message(s) lack supersession chains. + +--- +## MCP Orientation (when available) + +If the state-hub MCP server is reachable, call: +`get_domain_summary("infotech")` +This provides richer cross-domain context. +If the MCP call fails, use this file as your orientation source. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/WORK-RECORDS.md.worktree new file mode 100644 index 00000000..1f625140 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/WORK-RECORDS.md.worktree @@ -0,0 +1,126 @@ +# Work Records — sand-boxer + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | SAND-WP-0001 | finished | — | workplans/SAND-WP-0001-statehub-bootstrap.md | +| workplan | SAND-WP-0002 | finished | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| workplan | SAND-WP-0003 | finished | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| workplan | SAND-WP-0004 | finished | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md | +| workplan | SAND-WP-0005 | finished | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| workplan | SAND-WP-0006 | finished | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| workplan | SAND-WP-0007 | finished | — | workplans/SAND-WP-0007-snapshot-restore.md | +| workplan | SAND-WP-0008 | finished | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| workplan | SAND-WP-0009 | finished | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| workplan | SAND-WP-0010 | finished | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| workplan | SAND-WP-0011 | finished | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| workplan | SAND-WP-0012 | finished | — | workplans/SAND-WP-0012-packer-orchestration.md | +| workplan | SAND-WP-0013 | finished | — | workplans/SAND-WP-0013-bwrap-extension.md | +| workplan | SAND-WP-0014 | blocked | — | workplans/SAND-WP-0014-owner-mediated-execution.md | +| workplan | SAND-WP-0015 | blocked | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | +| task | SAND-WP-0001-T01 | done | — | workplans/SAND-WP-0001-statehub-bootstrap.md | +| task | SAND-WP-0001-T02 | done | — | workplans/SAND-WP-0001-statehub-bootstrap.md | +| task | SAND-WP-0001-T03 | done | — | workplans/SAND-WP-0001-statehub-bootstrap.md | +| task | SAND-WP-0002-T01 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T02 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T03 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T04 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T05 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T06 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T07 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T08 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T09 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T10 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0003-T01 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T02 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T03 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T04 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T05 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T06 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T07 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T08 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T09 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0004-T01 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md | +| task | SAND-WP-0004-T02 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md | +| task | SAND-WP-0004-T03 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md | +| task | SAND-WP-0004-T04 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md | +| task | SAND-WP-0004-T05 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md | +| task | SAND-WP-0005-T01 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| task | SAND-WP-0005-T02 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| task | SAND-WP-0005-T03 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| task | SAND-WP-0005-T04 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| task | SAND-WP-0005-T05 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| task | SAND-WP-0005-T06 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| task | SAND-WP-0006-T01 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| task | SAND-WP-0006-T02 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| task | SAND-WP-0006-T03 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| task | SAND-WP-0006-T04 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| task | SAND-WP-0006-T05 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| task | SAND-WP-0006-T06 | cancel | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| task | SAND-WP-0007-T01 | done | — | workplans/SAND-WP-0007-snapshot-restore.md | +| task | SAND-WP-0007-T02 | done | — | workplans/SAND-WP-0007-snapshot-restore.md | +| task | SAND-WP-0007-T03 | done | — | workplans/SAND-WP-0007-snapshot-restore.md | +| task | SAND-WP-0007-T04 | done | — | workplans/SAND-WP-0007-snapshot-restore.md | +| task | SAND-WP-0007-T05 | done | — | workplans/SAND-WP-0007-snapshot-restore.md | +| task | SAND-WP-0007-T06 | done | — | workplans/SAND-WP-0007-snapshot-restore.md | +| task | SAND-WP-0008-T01 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T02 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T03 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T04 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T05 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T06 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T07 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T08 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T09 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T10 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0009-T01 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T02 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T03 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T04 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T05 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T06 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T07 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T08 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T09 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0010-T01 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0010-T02 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0010-T03 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0010-T04 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0010-T05 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0010-T06 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0010-T07 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0011-T01 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0011-T02 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0011-T03 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0011-T04 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0011-T05 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0011-T06 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0011-T07 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0012-T01 | done | — | workplans/SAND-WP-0012-packer-orchestration.md | +| task | SAND-WP-0012-T02 | done | — | workplans/SAND-WP-0012-packer-orchestration.md | +| task | SAND-WP-0012-T03 | done | — | workplans/SAND-WP-0012-packer-orchestration.md | +| task | SAND-WP-0012-T04 | done | — | workplans/SAND-WP-0012-packer-orchestration.md | +| task | SAND-WP-0012-T05 | done | — | workplans/SAND-WP-0012-packer-orchestration.md | +| task | SAND-WP-0012-T06 | done | — | workplans/SAND-WP-0012-packer-orchestration.md | +| task | SAND-WP-0013-T01 | done | — | workplans/SAND-WP-0013-bwrap-extension.md | +| task | SAND-WP-0013-T02 | done | — | workplans/SAND-WP-0013-bwrap-extension.md | +| task | SAND-WP-0013-T03 | done | — | workplans/SAND-WP-0013-bwrap-extension.md | +| task | SAND-WP-0013-T04 | done | — | workplans/SAND-WP-0013-bwrap-extension.md | +| task | SAND-WP-0013-T05 | done | — | workplans/SAND-WP-0013-bwrap-extension.md | +| task | SAND-WP-0013-T06 | done | — | workplans/SAND-WP-0013-bwrap-extension.md | +| task | SAND-WP-0014-T01 | done | — | workplans/SAND-WP-0014-owner-mediated-execution.md | +| task | SAND-WP-0014-T02 | done | — | workplans/SAND-WP-0014-owner-mediated-execution.md | +| task | SAND-WP-0014-T03 | done | — | workplans/SAND-WP-0014-owner-mediated-execution.md | +| task | SAND-WP-0014-T04 | done | — | workplans/SAND-WP-0014-owner-mediated-execution.md | +| task | SAND-WP-0014-T05 | wait | — | workplans/SAND-WP-0014-owner-mediated-execution.md | +| task | SAND-WP-0015-T01 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | +| task | SAND-WP-0015-T02 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | +| task | SAND-WP-0015-T03 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | +| task | SAND-WP-0015-T04 | wait | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | +| task | SAND-WP-0015-T05 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | +| task | SAND-WP-0015-T06 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/originals.json new file mode 100644 index 00000000..693ae837 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/originals.json @@ -0,0 +1,10 @@ +[ + { + "path": ".custodian-brief.md", + "index": "100644 9cc4a0d49cdc0816fd74feb81cdfc5b5154fd849 0\t.custodian-brief.md" + }, + { + "path": "WORK-RECORDS.md", + "index": "100644 1f6251402ca5fcc85ef6b832bf2da25aeb0fc9b3 0\tWORK-RECORDS.md" + } +] diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-commit.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-commit.json new file mode 100644 index 00000000..cefb5790 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-commit.json @@ -0,0 +1,13 @@ +{ + "exit_code": 0, + "commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e", + "base": "53f800c4f7a9c91469834d04ef6f58e906b0bd49", + "files": [ + { + "path": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md", + "sha256": "56022703fd4d973f40ddad8eb99cb02783b086549b24ef89f89157de33eafe31" + } + ], + "stdout": "[main c7c3102] docs(identity): point current metered gate at issued HARNESS task\n 1 file changed, 1 insertion(+), 1 deletion(-)\n", + "stderr": "" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-manifest.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-manifest.json new file mode 100644 index 00000000..225f5f27 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-manifest.json @@ -0,0 +1,11 @@ +{ + "owner": "sand-boxer", + "base_revision": "53f800c4f7a9c91469834d04ef6f58e906b0bd49", + "message": "docs(identity): point current metered gate at issued HARNESS task", + "files": [ + { + "path": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md", + "sha256": "56022703fd4d973f40ddad8eb99cb02783b086549b24ef89f89157de33eafe31" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/required-checks.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/required-checks.json new file mode 100644 index 00000000..04b1c552 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/required-checks.json @@ -0,0 +1,10 @@ +{ + "observed_at": "2026-10-17T10:59:00.290205+00:00", + "command": "make check", + "required_by": "sand-boxer/AGENTS.md and .claude/rules/stack-and-commands.md", + "lint": "passed", + "tests_passed": 220, + "exit_code": 0, + "warning": "existing Starlette testclient deprecation warning; no test failure", + "scope": "existing owner checks, no implementation change or native production acceptance" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/source-before.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/source-before.json new file mode 100644 index 00000000..b57c4415 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/source-before.json @@ -0,0 +1,8 @@ +{ + "observed_at": "2026-10-17T10:57:25.565702+00:00", + "head": "53f800c4f7a9c91469834d04ef6f58e906b0bd49", + "status": "", + "instructions_sha256": "sha256:979d90f2945656a02c867c724a90966819d6eb6c8624a2c1e07b21f5d32b4449", + "source_sha256": "sha256:230d1ef37aa9c2023335a617492a72678c4671a8bc82d5577e9d7a7cea6e8fe4", + "index_sha256": "sha256:e9c14c64f7319eed77603103a13f1422726121bd9ee475902f4501a8781bf02d" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/verified-bindings.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/verified-bindings.json new file mode 100644 index 00000000..37de4715 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/verified-bindings.json @@ -0,0 +1,54 @@ +{ + "observed_at": "2026-10-17T11:27:49.876854+00:00", + "status": "source_and_task_bindings_verified", + "source_file": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md", + "source_sha256": "sha256:56022703fd4d973f40ddad8eb99cb02783b086549b24ef89f89157de33eafe31", + "all_source_UUIDs_preserved": true, + "all_task_fields_preserved_except_approved_SAND_blocking_label": true, + "tasks": [ + { + "record_id": "SAND-WP-0015-T01", + "id": "93e4aad8-ba9b-5850-93d4-b5bf78ac8978", + "status": "done", + "needs_human": false, + "workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d" + }, + { + "record_id": "SAND-WP-0015-T02", + "id": "c8a689f8-bdf2-57a2-8521-a1c0ca44e750", + "status": "done", + "needs_human": false, + "workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d" + }, + { + "record_id": "SAND-WP-0015-T03", + "id": "1a3002f6-c6a8-59d0-9d38-942028419de5", + "status": "done", + "needs_human": false, + "workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d" + }, + { + "record_id": "SAND-WP-0015-T04", + "id": "58817ef6-76d9-5e34-908f-c024e6c99f93", + "status": "wait", + "needs_human": false, + "workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d" + }, + { + "record_id": "SAND-WP-0015-T05", + "id": "f0163cda-b581-56a0-a0dd-9c8a436f5bbe", + "status": "done", + "needs_human": false, + "workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d" + }, + { + "record_id": "SAND-WP-0015-T06", + "id": "f85f54c9-1081-5d0c-95ad-aca20ede8d66", + "status": "done", + "needs_human": false, + "workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d" + } + ], + "historical_prose_preserved": true, + "native_action_by_this_subtask": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.postimage.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.postimage.md new file mode 100644 index 00000000..34c6aeba --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.postimage.md @@ -0,0 +1,375 @@ +--- +id: SAND-WP-0015 +type: workplan +title: "Provide a pinned bwrap rein runtime and private state" +domain: infotech +repo: sand-boxer +status: blocked +flavor: implementation +owner: codex +topic_slug: bwrap-runtime-and-private-state +created: "2026-09-05" +updated: "2026-10-04" +state_hub_workstream_id: "d3f12387-fd23-58f0-b979-9c811507614d" +--- + +# Provide a pinned bwrap rein runtime and private state + +Implement the runtime prerequisites returned by Glas in `GLAS-WP-0012` and +`docs/local-profile-acceptance.md`. Continue owner work `SAND-WP-0014-T05` and +live residual `GLAS-IN-0002`. Runtime startup is a separate acceptance gate +from credential delivery, enforced provider egress, and a real model task. + +## Mount an owner-selected, digest-pinned Python runtime + +```task +id: SAND-WP-0015-T01 +status: done +priority: high +state_hub_task_id: "93e4aad8-ba9b-5850-93d4-b5bf78ac8978" +``` + +Add exact artifact verification to trusted extension configuration and mount +the standalone runtime read-only at a fixed namespace path. Reject altered +content/modes, unexpected files, escaping symlinks, special files, and source +or workspace overlap. A caller cannot choose runtime paths through exec input. +Provide a non-editable rein-aharness/llm-connect bundle builder with recorded +source revisions and resolved dependency versions. + +Completed 2026-09-05. `extensions/runtime.py` verifies complete artifact +contents/modes before a read-only mount; the builder installed committed +rein-aharness `1429db5` and llm-connect `0056094` without editable source paths. +Candidate digest and source/package evidence are in `docs/bwrap-runtime.md`. + +## Keep writable runtime state outside the repository + +```task +id: SAND-WP-0015-T02 +status: done +priority: high +state_hub_task_id: "c8a689f8-bdf2-57a2-8521-a1c0ca44e750" +``` + +Create private mode-0700 HOME/config/cache/state/tmp directories within the +namespace, preserve them across exec requests, and remove them with teardown. +Keep the command environment sanitized and disable Python user-site/bytecode +writes. Fail closed on profile network/setup-credential declarations that the +current bwrap implementation cannot honor. + +Completed 2026-09-05. Mode-0700 namespace HOME and XDG/TMP directories sit +outside the copied Git tree. Explicit runtime PATH selection remains owner +controlled. Unsupported egress/default-allow and setup credentials now refuse +before workspace creation; regression tests cover these boundaries. + +## Verify the real rein runtime and owner regression paths + +```task +id: SAND-WP-0015-T03 +status: done +priority: high +state_hub_task_id: "1a3002f6-c6a8-59d0-9d38-942028419de5" +``` + +Run `make check`, the existing authenticated cross-request owner smoke, and a +real runtime startup smoke. Verify the actual rein CLI and adapter imports, +read-only runtime, private HOME, clean worktree, absent source, loopback-only +network, and teardown. Keep the production Glas profile blocked. + +Completed 2026-09-05. `make check`: lint clean, 132 tests passed. Authenticated +owner API smoke `223db65b` returned HTTP 200 and proved exact consumer identity, +stdin delivery, absent source, loopback-only network and complete teardown. +Pinned runtime smoke `d4de9531` ran the actual rein CLI and imported its Claude +adapter, proved read-only runtime/private HOME/clean worktree, retained private +state across a second exec, and removed the workspace. No model call or +credential acquisition occurred; T04 remains waiting. + +## Resolve Claude credentials, enforced egress, and production acceptance + +```task +id: SAND-WP-0015-T04 +status: wait +blocked_on: message-from:rein-aharness +blocking_reason: "Tracked as HARNESS-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt." +priority: high +state_hub_task_id: "58817ef6-76d9-5e34-908f-c024e6c99f93" +``` + +The 2026-09-05 routing lookup found no concrete Anthropic/Claude workload lane. +The generic OpenBao template is not a delegable lane; the OpenRouter AppRole +belongs to another rein. Credential owner railiance-platform/OpenBao plus +rein-aharness must establish a concrete Claude-compatible route and delivery/ +revocation contract before values can be requested or supplied to the runtime. + +Sand-boxer must then implement the matching enforced provider egress contract +(including DNS/TLS and denied-destination proof) and pin/deploy the actual +Claude executable. No unrestricted-network or interactive-login substitute is +permitted. Review the deployed runtime/profile with Glas, run its real-rein +acceptance fixture, and update only the proven profile's readiness. No +production schedule is enabled by the runtime-startup smoke. + +This task and SAND-WP-0014-T05 remain open until those gates pass. The detailed +return contract and runtime proof are in `docs/bwrap-runtime.md`; the live +cross-repo residual remains `GLAS-IN-0002`. + +## 2026-09-05 transport implementation evidence + +T04 remains waiting on owner machine authentication, protected credential +delivery, pinned Claude startup and the real model proof. CCR-2026-0016 custody +is confirmed by a metadata-only check of live version 2; no value was read. +HTTPS egress is now implemented as an exact owner/profile allowlisted CONNECT +proxy while retaining an isolated network namespace. Non-secret live smoke +sandbox e290e788 verified provider TLS response, undeclared destination and +direct-IP denial, and proxy/workspace teardown. See docs/bwrap-egress.md. + +## 2026-09-05 credential transport owner return + +Owner-bound exec-env transport is implemented and proved with a synthetic +provider in real sandbox 0e5fb35a. Exact route/profile/project/actor/run binding, +child-only key injection, pre-truncation redaction, next-exec absence and teardown +pass. No real key read or production profile activation. See docs/bwrap-credentials.md. +SECRETS-WP-0009 now owns native AppRole adoption for CCR-2026-0016, including +a data-only consumer read policy. Its production exec refuses before OpenBao +until SECRETS-WP-0007-T04 and SECRETS-WP-0008-T02/T06 deliver canonical +authorization/consume and service authority. T04 remains waiting on that live +owner path, the pinned Claude executable and real model acceptance. + +## 2026-09-06 combined-runtime candidate returned to Glas + +Answered the GLAS-WP-0015 handoff. Added candidate profile +`profile.claude-agent-dev-proof` version 1.1.0 (`ext.bwrap`, localhost-only, +`default: deny` with declared `api.anthropic.com:443`) for GLAS-WP-0012 review. +The committed profile grants no egress by itself: `ext.bwrap` refuses it unless +the owner extension config allowlists the destination, and a regression test now +asserts that fail-closed default. `make check`: lint clean, 172 tests passed. + +Resolved the differing project examples in favour of the acceptance runner's +`actor: agt` / `project: glas-local-proof`, and bound the documented credential +route to that single project rather than broadening it. The full return contract +— profile id/revision, host scope, consumer tuple, runtime digest and mount +paths, declared egress, and the value-free denial/cleanup receipts — is in +`docs/bwrap-runtime.md`. + +T04 stays `wait`: the concrete Claude credential lane and delivery/revocation +contract, owner machine authentication, the pinned Claude executable with its +own proxy startup proof, and the real-model acceptance are still operator and +upstream-owner gated. Provider workspace scope and spend limit remain operator +inputs. `SAND-WP-0014-T05` remains open on the same gates. + + +## Package and prove the pinned Claude executable independently of custody + +```task +id: SAND-WP-0015-T05 +status: done +priority: high +state_hub_task_id: "f0163cda-b581-56a0-a0dd-9c8a436f5bbe" +``` + +Split the independent executable packaging/startup portion from T04 so credential +custody does not hide completed local runtime work. Implement explicit binary +pinning, reject mismatches/host wrappers, and prove actual startup with the +broker proxy environment and complete cleanup. T04 retains protected deployment, +credential adoption and real-provider acceptance. + + +## Pinned Claude candidate and isolated startup — 2026-09-06 + +The builder now accepts `--claude-binary`, `--claude-sha256` and +`--claude-version` together. It requires a regular native ELF file, verifies the +exact copied bytes, refuses symlinks/wrappers/mismatches and existing destination +files, and copies only the executable as bin/claude mode 0755. The expected +version is metadata until the sandbox smoke checks the actual output. No +interactive HOME, provider key or login state is copied. + +Candidate provenance: the explicitly selected installed native release +`/home/worsch/.local/share/claude/versions/2.1.263`, SHA-256 +`26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba`. +This is a digest pin of the selected local artifact, not an upstream signature +verification claim. Complete runtime candidate: +`/tmp/sandboxer-claude-runtime-20260906`, SHA-256 +`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +Mount remains `/opt/sandboxer/runtime`; Claude is `/opt/sandboxer/runtime/bin/claude`. +Rein sources remain 1429db5 / llm-connect 0056094; resolved dependency versions +are recorded in the evidence. Rebuilding may resolve different dependencies; +the complete digest pins this artifact, not future builds. + +Sandbox f8821ec2 ran real `claude --version` -> `2.1.263 (Claude Code)` plus rein +CLI/import checks, with owner allowlisted provider egress and HTTPS_PROXY set +by the broker. Runtime read-only, private 0700 HOME/state persistence, clean Git, +absent source and loopback-only interfaces passed; workspace and proxy removed. +`make check`: lint passed, 175 tests passed. + +Evidence: docs/evidence/SAND-WP-0015-claude-startup-2026-09-06.json. +Reproduce with the builder options above and `scripts/smoke-bwrap-runtime.py +--runtime-path --runtime-sha256 --claude-version 2.1.263`. + +Limits: `--version` proves startup with the proxy environment, not that Claude +has sent a provider request through it. No credential acquisition or model run. +The /tmp candidate is not production placement; protected artifact installation, +owner configuration, credential adoption and real-model proof remain T04 gates. + + +## Install the pinned runtime in the local owner's protected store + +```task +id: SAND-WP-0015-T06 +status: done +priority: high +assignee: the-custodian +state_hub_task_id: "f85f54c9-1081-5d0c-95ad-aca20ede8d66" +``` + +HFACT-WP-0001-T04 consumes this independent installation return. Reuse the +already verified combined candidate with digest +`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`; +do not rebuild resolved dependencies. Publish it under the local owner's +private artifact store, verify exact copied content/modes and refusal of unsafe +or corrupted destinations, and prove startup/read-only access/teardown through +the installed path. The owner remains trusted; this is not root-owned storage. +T04 retains real credential adoption, owner configuration, model acceptance +and production placement. No credential route or profile is activated here. + +`scripts/install-bwrap-runtime.py` installs below the owner's home into a +mode-0700 store, verifies before and after copying, preserves artifact modes +and internal symlinks, serializes publishers and never overwrites a published +artifact. Existing modified artifacts are refused rather than repaired silently. +Group/other-writable ancestors, unsafe permission bits and store aliases refuse. +Unit tests cover integrity, idempotence, copy-time corruption and access modes. + + +T06 completed 2026-09-08 on bnt-lap001, local owner UID 1000. Installed the +unchanged 358-entry / 245176062-byte candidate at +`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +The private store is mode 0700; the installing owner remains trusted. A root-owned +system installation was not claimed or required for this local owner contract. +The installed-path sandbox smoke `51b59587` passed real Claude 2.1.263 and rein +startup, read-only mount, private state persistence, clean worktree, absent source, +loopback-only interfaces and complete workspace/proxy teardown. No model call +or credential acquisition occurred. `make check`: lint clean, 188 tests passed. +Two existing tests require the checkout directory name `sand-boxer`; the final +full check used that canonical basename. Evidence: +`docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`. +T04 retains owner execution configuration, native credential/egress and real-model +acceptance; Railiance installation needs its own target-specific return. + +## 2026-09-09 factory metered route source return + +Implemented the trusted, ephemeral Messages route described in +[docs/bwrap-messages-route.md](../docs/bwrap-messages-route.md). Actual local +bwrap owner transport proves provider key/ledger separation, direct-route denial, +revocation and teardown; rein also proves metered request plus commit import and +close replay. `make check`: lint clean, 199 passed. T04 remains waiting for the +admitted provider-to-owner bootstrap, updated protected runtime/profile, Railiance +placement, live compatibility and G0. Existing child-provider-key/direct-CONNECT +proofs do not admit this different credential holder or metered profile. No CCR, +secret read, deployment or paid request was performed. + +## 2026-09-09 standalone owner packaging and runtime selection + +Added frozen-lock owner build mode for the matched rein/llm/Glas/sandboxer set, +with non-editable installation and recorded lock/source/package pins. Sand-boxer +wheels now carry their profile and extension definitions, fixing a bwrap owner +failure that source-checkout tests could hide. The trusted Messages binding can +select the digest-pinned runtime without adding an API or profile override. +`make check`: lint clean, 205 passed. Existing standalone workload builds remain +supported. See docs/bwrap-runtime.md and rein's docs/owner-bootstrap.md. + +The project's `evidence/2026-09-09-owner-bootstrap.json` records the actual candidate +build and isolated installed-interpreter/CLI proof. T04 remains wait for accepted +credential-to-owner delivery, current protected installation and Railiance placement, +provider compatibility and G0. Source packaging does not reopen completed T01-T03, +T05-T06, broaden the old CCRs or activate the previously installed 2.1.263 artifact. + +The first standalone candidate exposed a stale cached local wheel despite current +Git metadata. Owner builds now refresh all local distributions and compare every +installed package source/definition file with its tracked source; stale, missing or +extra files refuse the build. Four content-conformance regressions cover that gap. + + +## 2026-09-27 installed launcher defect and guarded correction + +REINAH-WP-0003's single admitted attempt completed native provider/companion +apply, verify and exec, including scoped-token revocation. The claimed job +`6efa9436-6a91-47c0-94e5-b31b5a0e7e3a` failed before any provider request +reservation. The sandbox was destroyed and the source repository is unchanged. +The parent EUR 10 liability remains held for explicit reconciliation; no retry +or replacement authority is inferred. + +Installed artifact `b6e4e8a4` contains uv-generated three-line shell launchers +that still reference a vanished temporary build interpreter. The builder had +only rewritten direct Python shebangs. Fixed both generated forms and added +actual relocation/execution tests for direct, long and space-containing build +paths, plus refusal of unknown governed launchers. Builder tests: 12 passed; +focused lint passes. Rein's real installed bwrap probe reproduces both broken +entrypoints at exit 127 with zero provider forwards; its new bootstrap checks +refuse the malformed artifact before claiming. + +T04 remains `wait` and this plan stays `blocked`: replacement artifact build/ +admission and a separately authorized successful model/tool/commit proof remain. +The existing SAND-WP-0015 / REINAH-WP-0003 / SECRETS-WP-0009 records retain the +work. No new task or workplan. Detailed non-secret receipts are in rein-aharness +`docs/evidence/2026-09-27-metered-*.json`. + + +## 2026-10-04 offline owner startup proof preparation + +The existing no-credential smoke command now supports +`--require-owner-entrypoints`: the admitted digest-pinned runtime must start both +`rein-aharness --help` and `glas-harness --help`, and imported rein, llm-connect, +Glas and sandboxer modules must originate inside the mounted artifact. Broken or +missing launchers, failed help, timeout and external package origins cannot be +recorded as startup success. The default standalone mode remains supported. +Launcher diagnostics are not copied into the receipt. Focused tests exercise +real subprocesses, including the vanished-build-interpreter failure. + +This is preparation for a corrected immutable candidate's independent native +startup proof; it is not that candidate's receipt or owner acceptance. T04 stays +`wait`, the plan stays `blocked`, and the Sept27 artifact/liability evidence +remains intact. Replacement artifact admission and pins, explicit retained +EUR 10 reconciliation, and a separately authorized successful model/tool/commit +attempt remain with the existing owners. No credentials, provider request, +queue claim, policy activation or retry authorization is supplied here. + +2026-10-04 current blocker reconciliation: September 27 native provider/companion +apply/verify/exec and successful revocation supersede the original missing +platform route. The remaining owner return is rein-aharness corrected artifact/ +profile admission, retained EUR10 reconciliation and fresh retry authority. +T04 stays wait; no renewed trial is authorized. Full owner check: lint clean, +219 tests passed (one existing Starlette deprecation warning). + +## 2026-10-13 owner returns: reconciliation and corrected build + +rein-aharness `d897a83` records owner reconciliation of the Sept 27 held +liability: run `6efa9436` failed at launcher exit 127 before any provider +reservation; liability stays at the full hold, exhausting that one-attempt +envelope, and the owner authorized a new retry envelope on 2026-10-13. +rein-aharness `9a4469d` records corrected runtime `ee3d0a53…` (replaces +`b6e4e8a4…`; only rein moved, adding pre-claim launcher rejection), built with +the sand-boxer builder fix; both launchers exit 0 inside bwrap. Receipts: +rein-aharness `docs/evidence/2026-10-13-*.json`. + +Remaining before T04 closes: install `ee3d0a53` on railiance01, pin its digest +in owner config, pass `--require-owner-entrypoints` offline startup proof, then +run the single authorized attempt to a successful model/tool/commit receipt. +T04 stays `wait`; the plan stays `blocked`. + +2026-10-14 check: rein-aharness pushed `9a4469d` (corrected build record) and +opened REINAH-WP-0008 (simpler metered retry, active). No railiance01 install/ +admission of `ee3d0a53` or successful acceptance receipt yet; request sent on +hub message `82faf25c`. T04 stays `wait`; plan stays `blocked`. + +2026-10-14 rein-aharness reply (thread `82faf25c`): step 1 done (`9a4469d` on +origin/main). Steps 2-4 are REINAH-WP-0008-T07. Budget is now up to three +attempts within EUR 10 under memo `infd-20261014-b01` (observed-usage +settlement); order: memo acceptance in the attended informed-decision sitting, +rebuild and install `ee3d0a53` on railiance01, `metered-once --rehearse`, +`owner renew`, first attempt. Railiance01 still pins `b6e4e8a4`. T04 stays `wait`. + +2026-10-15 owner-approved rebuild: the pinned inputs of the `ee3d0a53` receipt +(same four commits, uv.lock `8775904b…`, Claude 2.1.266 `19842705…`) rebuilt +to `818b1b7c8292…f359`. The digest differs only because the builder embeds +absolute source paths (`direct_url.json`, `build-info.json`). Owner-entrypoint +startup smoke passed in sandbox `28df7a1d`; no credentials or model calls. +Sent to rein-aharness (message `8a7962f7`, thread `82faf25c`) to record as the +then-current corrected runtime for REINAH-WP-0008-T07 and to load the unsigned +memo sitting. Nothing installed on railiance01. T04 stays `wait`. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.preimage.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.preimage.md new file mode 100644 index 00000000..4d924a15 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.preimage.md @@ -0,0 +1,375 @@ +--- +id: SAND-WP-0015 +type: workplan +title: "Provide a pinned bwrap rein runtime and private state" +domain: infotech +repo: sand-boxer +status: blocked +flavor: implementation +owner: codex +topic_slug: bwrap-runtime-and-private-state +created: "2026-09-05" +updated: "2026-10-04" +state_hub_workstream_id: "d3f12387-fd23-58f0-b979-9c811507614d" +--- + +# Provide a pinned bwrap rein runtime and private state + +Implement the runtime prerequisites returned by Glas in `GLAS-WP-0012` and +`docs/local-profile-acceptance.md`. Continue owner work `SAND-WP-0014-T05` and +live residual `GLAS-IN-0002`. Runtime startup is a separate acceptance gate +from credential delivery, enforced provider egress, and a real model task. + +## Mount an owner-selected, digest-pinned Python runtime + +```task +id: SAND-WP-0015-T01 +status: done +priority: high +state_hub_task_id: "93e4aad8-ba9b-5850-93d4-b5bf78ac8978" +``` + +Add exact artifact verification to trusted extension configuration and mount +the standalone runtime read-only at a fixed namespace path. Reject altered +content/modes, unexpected files, escaping symlinks, special files, and source +or workspace overlap. A caller cannot choose runtime paths through exec input. +Provide a non-editable rein-aharness/llm-connect bundle builder with recorded +source revisions and resolved dependency versions. + +Completed 2026-09-05. `extensions/runtime.py` verifies complete artifact +contents/modes before a read-only mount; the builder installed committed +rein-aharness `1429db5` and llm-connect `0056094` without editable source paths. +Candidate digest and source/package evidence are in `docs/bwrap-runtime.md`. + +## Keep writable runtime state outside the repository + +```task +id: SAND-WP-0015-T02 +status: done +priority: high +state_hub_task_id: "c8a689f8-bdf2-57a2-8521-a1c0ca44e750" +``` + +Create private mode-0700 HOME/config/cache/state/tmp directories within the +namespace, preserve them across exec requests, and remove them with teardown. +Keep the command environment sanitized and disable Python user-site/bytecode +writes. Fail closed on profile network/setup-credential declarations that the +current bwrap implementation cannot honor. + +Completed 2026-09-05. Mode-0700 namespace HOME and XDG/TMP directories sit +outside the copied Git tree. Explicit runtime PATH selection remains owner +controlled. Unsupported egress/default-allow and setup credentials now refuse +before workspace creation; regression tests cover these boundaries. + +## Verify the real rein runtime and owner regression paths + +```task +id: SAND-WP-0015-T03 +status: done +priority: high +state_hub_task_id: "1a3002f6-c6a8-59d0-9d38-942028419de5" +``` + +Run `make check`, the existing authenticated cross-request owner smoke, and a +real runtime startup smoke. Verify the actual rein CLI and adapter imports, +read-only runtime, private HOME, clean worktree, absent source, loopback-only +network, and teardown. Keep the production Glas profile blocked. + +Completed 2026-09-05. `make check`: lint clean, 132 tests passed. Authenticated +owner API smoke `223db65b` returned HTTP 200 and proved exact consumer identity, +stdin delivery, absent source, loopback-only network and complete teardown. +Pinned runtime smoke `d4de9531` ran the actual rein CLI and imported its Claude +adapter, proved read-only runtime/private HOME/clean worktree, retained private +state across a second exec, and removed the workspace. No model call or +credential acquisition occurred; T04 remains waiting. + +## Resolve Claude credentials, enforced egress, and production acceptance + +```task +id: SAND-WP-0015-T04 +status: wait +blocked_on: message-from:rein-aharness +blocking_reason: "Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt." +priority: high +state_hub_task_id: "58817ef6-76d9-5e34-908f-c024e6c99f93" +``` + +The 2026-09-05 routing lookup found no concrete Anthropic/Claude workload lane. +The generic OpenBao template is not a delegable lane; the OpenRouter AppRole +belongs to another rein. Credential owner railiance-platform/OpenBao plus +rein-aharness must establish a concrete Claude-compatible route and delivery/ +revocation contract before values can be requested or supplied to the runtime. + +Sand-boxer must then implement the matching enforced provider egress contract +(including DNS/TLS and denied-destination proof) and pin/deploy the actual +Claude executable. No unrestricted-network or interactive-login substitute is +permitted. Review the deployed runtime/profile with Glas, run its real-rein +acceptance fixture, and update only the proven profile's readiness. No +production schedule is enabled by the runtime-startup smoke. + +This task and SAND-WP-0014-T05 remain open until those gates pass. The detailed +return contract and runtime proof are in `docs/bwrap-runtime.md`; the live +cross-repo residual remains `GLAS-IN-0002`. + +## 2026-09-05 transport implementation evidence + +T04 remains waiting on owner machine authentication, protected credential +delivery, pinned Claude startup and the real model proof. CCR-2026-0016 custody +is confirmed by a metadata-only check of live version 2; no value was read. +HTTPS egress is now implemented as an exact owner/profile allowlisted CONNECT +proxy while retaining an isolated network namespace. Non-secret live smoke +sandbox e290e788 verified provider TLS response, undeclared destination and +direct-IP denial, and proxy/workspace teardown. See docs/bwrap-egress.md. + +## 2026-09-05 credential transport owner return + +Owner-bound exec-env transport is implemented and proved with a synthetic +provider in real sandbox 0e5fb35a. Exact route/profile/project/actor/run binding, +child-only key injection, pre-truncation redaction, next-exec absence and teardown +pass. No real key read or production profile activation. See docs/bwrap-credentials.md. +SECRETS-WP-0009 now owns native AppRole adoption for CCR-2026-0016, including +a data-only consumer read policy. Its production exec refuses before OpenBao +until SECRETS-WP-0007-T04 and SECRETS-WP-0008-T02/T06 deliver canonical +authorization/consume and service authority. T04 remains waiting on that live +owner path, the pinned Claude executable and real model acceptance. + +## 2026-09-06 combined-runtime candidate returned to Glas + +Answered the GLAS-WP-0015 handoff. Added candidate profile +`profile.claude-agent-dev-proof` version 1.1.0 (`ext.bwrap`, localhost-only, +`default: deny` with declared `api.anthropic.com:443`) for GLAS-WP-0012 review. +The committed profile grants no egress by itself: `ext.bwrap` refuses it unless +the owner extension config allowlists the destination, and a regression test now +asserts that fail-closed default. `make check`: lint clean, 172 tests passed. + +Resolved the differing project examples in favour of the acceptance runner's +`actor: agt` / `project: glas-local-proof`, and bound the documented credential +route to that single project rather than broadening it. The full return contract +— profile id/revision, host scope, consumer tuple, runtime digest and mount +paths, declared egress, and the value-free denial/cleanup receipts — is in +`docs/bwrap-runtime.md`. + +T04 stays `wait`: the concrete Claude credential lane and delivery/revocation +contract, owner machine authentication, the pinned Claude executable with its +own proxy startup proof, and the real-model acceptance are still operator and +upstream-owner gated. Provider workspace scope and spend limit remain operator +inputs. `SAND-WP-0014-T05` remains open on the same gates. + + +## Package and prove the pinned Claude executable independently of custody + +```task +id: SAND-WP-0015-T05 +status: done +priority: high +state_hub_task_id: "f0163cda-b581-56a0-a0dd-9c8a436f5bbe" +``` + +Split the independent executable packaging/startup portion from T04 so credential +custody does not hide completed local runtime work. Implement explicit binary +pinning, reject mismatches/host wrappers, and prove actual startup with the +broker proxy environment and complete cleanup. T04 retains protected deployment, +credential adoption and real-provider acceptance. + + +## Pinned Claude candidate and isolated startup — 2026-09-06 + +The builder now accepts `--claude-binary`, `--claude-sha256` and +`--claude-version` together. It requires a regular native ELF file, verifies the +exact copied bytes, refuses symlinks/wrappers/mismatches and existing destination +files, and copies only the executable as bin/claude mode 0755. The expected +version is metadata until the sandbox smoke checks the actual output. No +interactive HOME, provider key or login state is copied. + +Candidate provenance: the explicitly selected installed native release +`/home/worsch/.local/share/claude/versions/2.1.263`, SHA-256 +`26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba`. +This is a digest pin of the selected local artifact, not an upstream signature +verification claim. Complete runtime candidate: +`/tmp/sandboxer-claude-runtime-20260906`, SHA-256 +`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +Mount remains `/opt/sandboxer/runtime`; Claude is `/opt/sandboxer/runtime/bin/claude`. +Rein sources remain 1429db5 / llm-connect 0056094; resolved dependency versions +are recorded in the evidence. Rebuilding may resolve different dependencies; +the complete digest pins this artifact, not future builds. + +Sandbox f8821ec2 ran real `claude --version` -> `2.1.263 (Claude Code)` plus rein +CLI/import checks, with owner allowlisted provider egress and HTTPS_PROXY set +by the broker. Runtime read-only, private 0700 HOME/state persistence, clean Git, +absent source and loopback-only interfaces passed; workspace and proxy removed. +`make check`: lint passed, 175 tests passed. + +Evidence: docs/evidence/SAND-WP-0015-claude-startup-2026-09-06.json. +Reproduce with the builder options above and `scripts/smoke-bwrap-runtime.py +--runtime-path --runtime-sha256 --claude-version 2.1.263`. + +Limits: `--version` proves startup with the proxy environment, not that Claude +has sent a provider request through it. No credential acquisition or model run. +The /tmp candidate is not production placement; protected artifact installation, +owner configuration, credential adoption and real-model proof remain T04 gates. + + +## Install the pinned runtime in the local owner's protected store + +```task +id: SAND-WP-0015-T06 +status: done +priority: high +assignee: the-custodian +state_hub_task_id: "f85f54c9-1081-5d0c-95ad-aca20ede8d66" +``` + +HFACT-WP-0001-T04 consumes this independent installation return. Reuse the +already verified combined candidate with digest +`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`; +do not rebuild resolved dependencies. Publish it under the local owner's +private artifact store, verify exact copied content/modes and refusal of unsafe +or corrupted destinations, and prove startup/read-only access/teardown through +the installed path. The owner remains trusted; this is not root-owned storage. +T04 retains real credential adoption, owner configuration, model acceptance +and production placement. No credential route or profile is activated here. + +`scripts/install-bwrap-runtime.py` installs below the owner's home into a +mode-0700 store, verifies before and after copying, preserves artifact modes +and internal symlinks, serializes publishers and never overwrites a published +artifact. Existing modified artifacts are refused rather than repaired silently. +Group/other-writable ancestors, unsafe permission bits and store aliases refuse. +Unit tests cover integrity, idempotence, copy-time corruption and access modes. + + +T06 completed 2026-09-08 on bnt-lap001, local owner UID 1000. Installed the +unchanged 358-entry / 245176062-byte candidate at +`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +The private store is mode 0700; the installing owner remains trusted. A root-owned +system installation was not claimed or required for this local owner contract. +The installed-path sandbox smoke `51b59587` passed real Claude 2.1.263 and rein +startup, read-only mount, private state persistence, clean worktree, absent source, +loopback-only interfaces and complete workspace/proxy teardown. No model call +or credential acquisition occurred. `make check`: lint clean, 188 tests passed. +Two existing tests require the checkout directory name `sand-boxer`; the final +full check used that canonical basename. Evidence: +`docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`. +T04 retains owner execution configuration, native credential/egress and real-model +acceptance; Railiance installation needs its own target-specific return. + +## 2026-09-09 factory metered route source return + +Implemented the trusted, ephemeral Messages route described in +[docs/bwrap-messages-route.md](../docs/bwrap-messages-route.md). Actual local +bwrap owner transport proves provider key/ledger separation, direct-route denial, +revocation and teardown; rein also proves metered request plus commit import and +close replay. `make check`: lint clean, 199 passed. T04 remains waiting for the +admitted provider-to-owner bootstrap, updated protected runtime/profile, Railiance +placement, live compatibility and G0. Existing child-provider-key/direct-CONNECT +proofs do not admit this different credential holder or metered profile. No CCR, +secret read, deployment or paid request was performed. + +## 2026-09-09 standalone owner packaging and runtime selection + +Added frozen-lock owner build mode for the matched rein/llm/Glas/sandboxer set, +with non-editable installation and recorded lock/source/package pins. Sand-boxer +wheels now carry their profile and extension definitions, fixing a bwrap owner +failure that source-checkout tests could hide. The trusted Messages binding can +select the digest-pinned runtime without adding an API or profile override. +`make check`: lint clean, 205 passed. Existing standalone workload builds remain +supported. See docs/bwrap-runtime.md and rein's docs/owner-bootstrap.md. + +The project's `evidence/2026-09-09-owner-bootstrap.json` records the actual candidate +build and isolated installed-interpreter/CLI proof. T04 remains wait for accepted +credential-to-owner delivery, current protected installation and Railiance placement, +provider compatibility and G0. Source packaging does not reopen completed T01-T03, +T05-T06, broaden the old CCRs or activate the previously installed 2.1.263 artifact. + +The first standalone candidate exposed a stale cached local wheel despite current +Git metadata. Owner builds now refresh all local distributions and compare every +installed package source/definition file with its tracked source; stale, missing or +extra files refuse the build. Four content-conformance regressions cover that gap. + + +## 2026-09-27 installed launcher defect and guarded correction + +REINAH-WP-0003's single admitted attempt completed native provider/companion +apply, verify and exec, including scoped-token revocation. The claimed job +`6efa9436-6a91-47c0-94e5-b31b5a0e7e3a` failed before any provider request +reservation. The sandbox was destroyed and the source repository is unchanged. +The parent EUR 10 liability remains held for explicit reconciliation; no retry +or replacement authority is inferred. + +Installed artifact `b6e4e8a4` contains uv-generated three-line shell launchers +that still reference a vanished temporary build interpreter. The builder had +only rewritten direct Python shebangs. Fixed both generated forms and added +actual relocation/execution tests for direct, long and space-containing build +paths, plus refusal of unknown governed launchers. Builder tests: 12 passed; +focused lint passes. Rein's real installed bwrap probe reproduces both broken +entrypoints at exit 127 with zero provider forwards; its new bootstrap checks +refuse the malformed artifact before claiming. + +T04 remains `wait` and this plan stays `blocked`: replacement artifact build/ +admission and a separately authorized successful model/tool/commit proof remain. +The existing SAND-WP-0015 / REINAH-WP-0003 / SECRETS-WP-0009 records retain the +work. No new task or workplan. Detailed non-secret receipts are in rein-aharness +`docs/evidence/2026-09-27-metered-*.json`. + + +## 2026-10-04 offline owner startup proof preparation + +The existing no-credential smoke command now supports +`--require-owner-entrypoints`: the admitted digest-pinned runtime must start both +`rein-aharness --help` and `glas-harness --help`, and imported rein, llm-connect, +Glas and sandboxer modules must originate inside the mounted artifact. Broken or +missing launchers, failed help, timeout and external package origins cannot be +recorded as startup success. The default standalone mode remains supported. +Launcher diagnostics are not copied into the receipt. Focused tests exercise +real subprocesses, including the vanished-build-interpreter failure. + +This is preparation for a corrected immutable candidate's independent native +startup proof; it is not that candidate's receipt or owner acceptance. T04 stays +`wait`, the plan stays `blocked`, and the Sept27 artifact/liability evidence +remains intact. Replacement artifact admission and pins, explicit retained +EUR 10 reconciliation, and a separately authorized successful model/tool/commit +attempt remain with the existing owners. No credentials, provider request, +queue claim, policy activation or retry authorization is supplied here. + +2026-10-04 current blocker reconciliation: September 27 native provider/companion +apply/verify/exec and successful revocation supersede the original missing +platform route. The remaining owner return is rein-aharness corrected artifact/ +profile admission, retained EUR10 reconciliation and fresh retry authority. +T04 stays wait; no renewed trial is authorized. Full owner check: lint clean, +219 tests passed (one existing Starlette deprecation warning). + +## 2026-10-13 owner returns: reconciliation and corrected build + +rein-aharness `d897a83` records owner reconciliation of the Sept 27 held +liability: run `6efa9436` failed at launcher exit 127 before any provider +reservation; liability stays at the full hold, exhausting that one-attempt +envelope, and the owner authorized a new retry envelope on 2026-10-13. +rein-aharness `9a4469d` records corrected runtime `ee3d0a53…` (replaces +`b6e4e8a4…`; only rein moved, adding pre-claim launcher rejection), built with +the sand-boxer builder fix; both launchers exit 0 inside bwrap. Receipts: +rein-aharness `docs/evidence/2026-10-13-*.json`. + +Remaining before T04 closes: install `ee3d0a53` on railiance01, pin its digest +in owner config, pass `--require-owner-entrypoints` offline startup proof, then +run the single authorized attempt to a successful model/tool/commit receipt. +T04 stays `wait`; the plan stays `blocked`. + +2026-10-14 check: rein-aharness pushed `9a4469d` (corrected build record) and +opened REINAH-WP-0008 (simpler metered retry, active). No railiance01 install/ +admission of `ee3d0a53` or successful acceptance receipt yet; request sent on +hub message `82faf25c`. T04 stays `wait`; plan stays `blocked`. + +2026-10-14 rein-aharness reply (thread `82faf25c`): step 1 done (`9a4469d` on +origin/main). Steps 2-4 are REINAH-WP-0008-T07. Budget is now up to three +attempts within EUR 10 under memo `infd-20261014-b01` (observed-usage +settlement); order: memo acceptance in the attended informed-decision sitting, +rebuild and install `ee3d0a53` on railiance01, `metered-once --rehearse`, +`owner renew`, first attempt. Railiance01 still pins `b6e4e8a4`. T04 stays `wait`. + +2026-10-15 owner-approved rebuild: the pinned inputs of the `ee3d0a53` receipt +(same four commits, uv.lock `8775904b…`, Claude 2.1.266 `19842705…`) rebuilt +to `818b1b7c8292…f359`. The digest differs only because the builder embeds +absolute source paths (`direct_url.json`, `build-info.json`). Owner-entrypoint +startup smoke passed in sandbox `28df7a1d`; no credentials or model calls. +Sent to rein-aharness (message `8a7962f7`, thread `82faf25c`) to record as the +then-current corrected runtime for REINAH-WP-0008-T07 and to load the unsigned +memo sitting. Nothing installed on railiance01. T04 stays `wait`. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/verified-publication.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/verified-publication.json new file mode 100644 index 00000000..b54113e4 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/verified-publication.json @@ -0,0 +1,113 @@ +{ + "schema": "custodian.identity-binding-source-publication.v1", + "observed_at": "2026-10-17T11:28:15.925389+00:00", + "status": "all_three_authorized_source_publications_verified", + "rows": [ + { + "owner": "rein-aharness", + "commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "remote_verified": true, + "explicit_commit_paths": [ + "AGENTS.md", + "workplans/REINAH-WP-0008-simpler-metered-retry.md" + ], + "primary_projection_verified": true, + "counts": { + "created": 0, + "updated": 9, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 7, + "cancelled_tasks": 0, + "created_edges": 1, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 3 + }, + "consistency_summary": { + "fail": 0, + "automation_error": 0, + "warn": 5, + "info": 0 + }, + "unrelated_generated_worktree_and_index_preserved": true, + "final_status": "" + }, + { + "owner": "glas-harness", + "commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "remote_verified": true, + "explicit_commit_paths": [ + "workplans/GLAS-WP-0012-first-local-profile-production-proof.md" + ], + "primary_projection_verified": true, + "counts": { + "created": 0, + "updated": 18, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 8, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 6 + }, + "consistency_summary": { + "fail": 0, + "automation_error": 0, + "warn": 6, + "info": 0 + }, + "unrelated_generated_worktree_and_index_preserved": true, + "final_status": "M .custodian-brief.md\n M WORK-RECORDS.md\n" + }, + { + "owner": "sand-boxer", + "commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e", + "remote_verified": true, + "explicit_commit_paths": [ + "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md" + ], + "primary_projection_verified": true, + "counts": { + "created": 0, + "updated": 15, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 0, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 1 + }, + "consistency_summary": { + "fail": 0, + "automation_error": 0, + "warn": 3, + "info": 0 + }, + "unrelated_generated_worktree_and_index_preserved": true, + "final_status": "" + } + ], + "rein_original_8_UUIDs_and_3_human_waits_preserved": true, + "rein_7_null_record_ids_filled": true, + "rein_two_original_dependency_rows_retained": true, + "glas_sand_12_exact_task_bindings_verified": true, + "sand_required_check": { + "lint": "pass", + "tests": 220, + "result": "pass" + }, + "old_broad_sand_patch_not_applied": true, + "native_runtime_or_proposal_or_supervision_changed_by_this_subtask": false, + "note": "Normal whole-repository receiving restored existing source-derived projection fields; rein also restored one existing-source WP0005\u2192ACTIVITYWP0026 edge. No new source work, retirement or task creation." +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/AGENTS.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/AGENTS.md new file mode 100644 index 00000000..e165849c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/AGENTS.md @@ -0,0 +1,262 @@ +# rein-aharness — Agent Instructions + +## Repo Identity + +**Purpose:** Claude-Code-CLI-driven rein: governed, unattended/scheduled agent runtime + +**Domain:** infotech +**Repo slug:** rein-aharness +**Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a` +**Workplan prefix:** `REINAH-WP-` + +`REIN-A-0001` through `REIN-A-0004` are immutable historical identifiers from +before the fleet `PREFIX-WP-NNNN` convention. `HARNESS-WP-0001` through +`HARNESS-WP-0003` and `HARNESS-WP-ADHOC-2026-09-04` are older ids from the +agent-harness name. Preserve all of these in references and archives, but use +the hub-registered `REINAH-WP-` prefix for every new workplan and task. + +--- + +## Developer Workflow + +```bash +# Install (editable, including the governed profile-execution siblings) +python3 -m venv .venv && source .venv/bin/activate +pip install -e . -e ../llm-connect -e ../sand-boxer -e ../glas-harness pytest + +# Test +PYTHONPATH=".:$HOME/llm-connect" python3 -m pytest tests/ -q + +# Run — bounded agentic session against a real target repo (real Claude Code +# CLI call, real commit if successful) +rein-aharness run --task-file examples/task-hello-sandbox.json --no-hub --no-metrics + +# Build the Railiance deploy image +make image +``` + +## State Hub Integration + +The Custodian State Hub tracks work across all domains. Interact via HTTP REST — +there is no MCP server for Codex agents. + +| Context | URL | +|---------|-----| +| Local workstation | `http://127.0.0.1:8000` | +| Remote (railiance01, in-cluster) | `http://10.43.68.154:8000` | +| Optional local edge relay | http://127.0.0.1:18080 | + +When an operator has enabled the edge relay, set API_BASE to the relay URL. +Queueable writes return an explicit queued receipt if the central hub is +unreachable. Treat that as pending local evidence, then ask the operator to run +statehub outbox status/replay after connectivity returns. + +### Orient at session start + +```bash +# Offline brief — works without hub connection +cat .custodian-brief.md + +# Active workplans for this domain +curl -s "http://127.0.0.1:8000/workplans/?topic_id=cee7bedf-2b48-46ef-8601-006474f2ad7a&status=active" \ + | python3 -m json.tool + +# Check inbox +curl -s "http://127.0.0.1:8000/messages/?to_agent=rein-aharness&unread_only=true" \ + | python3 -m json.tool +``` + +Mark a message read: +```bash +curl -s -X PATCH "http://127.0.0.1:8000/messages//read" \ + -H "Content-Type: application/json" -d '{}' +``` + +### Log progress (required at session close) + +```bash +curl -s -X POST http://127.0.0.1:8000/progress/ \ + -H "Content-Type: application/json" \ + -d '{ + "summary": "what was done", + "event_type": "note", + "author": "codex", + "workplan_id": "", + "task_id": "" + }' +``` + +Omit `workplan_id` / `task_id` when not applicable. + +### Update task status + +```bash +curl -s -X PATCH "http://127.0.0.1:8000/tasks/" \ + -H "Content-Type: application/json" \ + -d '{"status": "progress"}' +# values: wait | todo | progress | done | cancel +``` + +### Flag a task for human review + +```bash +curl -s -X PATCH "http://127.0.0.1:8000/tasks/" \ + -H "Content-Type: application/json" \ + -d '{"needs_human": true, "intervention_note": "reason"}' +``` + +--- + +## Session Protocol + +**Start:** +1. `cat .custodian-brief.md` — domain goal and open workplans (offline-safe) +2. Check inbox: `GET /messages/?to_agent=rein-aharness&unread_only=true`; mark read +3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks +4. Check human-needed tasks: `GET /tasks/?needs_human=true` + +**During work:** +- Update task statuses in workplan files as tasks progress +- Record significant decisions via `POST /decisions/` + +**Close:** +1. Update workplan file task statuses to reflect progress +2. If finishing a workplan: hand off **residuals** as live work records first + (intake with `origin: residual` + `origin_ref: `, or a next workplan / + decision / engagement). Do not park leftovers only in prose or `SCOPE.md`. + Canon: `the-custodian/canon/standards/work-record-types_v0.1.md` § Residuals. +3. Log: `POST /progress/` with a summary of what changed (name handoff ids) +4. After workplan file changes, run: + ```bash + statehub fix-consistency + ``` + Coding agents should run this directly; ask the operator only if the CLI or + State Hub API is unavailable. This syncs task status from files into the hub DB. + +--- + +## Credential and access routing + +**Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect** +for inference. Run this check **before** requesting secrets, API keys, SSH access, +login tokens, or database passwords — in any repo, not only `ops-warden`. + +ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Every +other credential need belongs to another subsystem. **Do not** message +`ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key. + +### Lookup (do this first) + +```bash +warden route find "" --json +warden route show --json +``` + +Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`). + +| Agent runtime | How to orient | +| --- | --- | +| **Codex / Grok** (shell, HTTP State Hub) | `warden route` commands above; inbox `to_agent=rein-aharness` is for coordination, not secret vending | +| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workplans; **still** use `warden route` for credential ownership | +| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden route` | + +### Quick routing table + +| I need… | Owner | ops-warden executes? | +| --- | --- | --- | +| SSH cert (`adm`/`agt`/`atm`) | ops-warden | **Yes** — `warden sign` | +| API key, DB password, provider token | OpenBao (`railiance-platform`) | No — route only | +| Login / OIDC / MFA | key-cape / Keycloak | No — route only | +| Authorization decision | flex-auth | No — route only | +| activity-core → issue-core emission | activity-core + issue-core | No — `warden route show activity-core-issue-sink` | +| SSH tunnel | ops-bridge (+ `cert_command` from warden) | No — route only | + +### Anti-patterns (do not do these) + +- `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc. +- Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist +- Pasting secrets into Git, State Hub, workplans, logs, or chat + +### Other capabilities (reuse-surface) + +Non-credential capabilities are usually discovered through **reuse-surface** federation +(`reuse-surface` registry / `capability.*` indexes). Credential routing is inlined in +every repo's agent instructions because it is high-frequency, high-risk, and easy to +get wrong. + +**Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml` + + + + +--- + +## Workplan Convention (ADR-001) + +Work items originate as files in this repo — not in the hub. The hub is a +read/cache/index layer that rebuilds from files. + +**File location:** `workplans/REINAH-WP-NNNN-.md` + +**Archived location:** finished workplans may move to +`workplans/archived/YYMMDD-REINAH-WP-NNNN-.md`. The `YYMMDD` prefix is +the completion/archive date; the frontmatter `id` does not change. + +**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use +`workplans/ADHOC-YYYY-MM-DD.md` with task ids `ADHOC-YYYY-MM-DD-T01`, etc. Use +this only for low-risk work completed directly; create a normal workplan for +anything needing analysis, design, approval, dependencies, or multiple phases. + +**Frontmatter:** + +```yaml +--- +id: REINAH-WP-NNNN +type: workplan +title: "..." +domain: infotech +repo: rein-aharness +status: proposed | ready | active | blocked | backlog | finished | archived +owner: codex +topic_slug: ... +created: "YYYY-MM-DD" +updated: "YYYY-MM-DD" +state_hub_workstream_id: "" # fix-consistency — do not edit (legacy field name; workplan UUID) +--- +``` + +Use `proposed` for a new draft, `ready` after review against current repo +state, and `finished` after implementation. `stalled` and `needs_review` are +derived health labels, not frontmatter statuses. + +**Terminology:** workplan is the fleet term; `workstream` appears only in legacy +API/MCP/frontmatter bridges until `STATE-WP-0069` retires them — see +`the-custodian/canon/standards/workplan-terminology-fleet_v0.1.md`. + +**Task block format** (one per `##` section): + +``` +## Task Title + +` ` `task +id: REINAH-WP-NNNN-T01 +status: wait | todo | progress | done | cancel +priority: high | medium | low +state_hub_task_id: "" # written by fix-consistency — do not edit +` ` ` + +Task description text. +``` + +Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blocked work and `cancel` for stopped work. + +**Residuals when finishing:** actionable leftovers become live work records +before `status: finished` — usually an intake (`origin: residual`, +`origin_ref: REINAH-WP-NNNN`) or a spawned workplan. Residual is a *role*, +not a kind. Fleet list lives on State Hub, not in `SCOPE.md`. + +To create a new workplan: +1. Write the file following the format above +2. Run `statehub fix-consistency` locally; ask the operator only if the CLI or + State Hub API is unavailable. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/workplans/REINAH-WP-0008-simpler-metered-retry.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/workplans/REINAH-WP-0008-simpler-metered-retry.md new file mode 100644 index 00000000..3603ca51 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/workplans/REINAH-WP-0008-simpler-metered-retry.md @@ -0,0 +1,354 @@ +--- +id: REINAH-WP-0008 +type: workplan +title: "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal" +domain: infotech +repo: rein-aharness +status: blocked +owner: claude-code +topic_slug: rein-aharness +priority: high +created: "2026-10-13" +updated: "2026-10-16" +related: + - REINAH-WP-0003 +state_hub_workstream_id: "187c2599-84a6-5764-a14f-7e9121975bf2" +--- + +# REINAH-WP-0008 — Simpler metered retry + +## Origin + +On 2026-10-13 the owner reconciled the 2026-09-27 hold for run `6efa9436` +(`docs/evidence/2026-10-13-held-liability-reconciliation.json`). A corrected +runtime `ee3d0a53…` was built +(`docs/evidence/2026-10-13-corrected-owner-runtime-build.json`). The owner +authorized a new envelope and one retry. + +Preparing that retry took too many owner ceremonies: + +1. The runtime is built on the workstation and copied to railiance01 by hand. +2. `owner.json` and the spend policy hold five digests that the owner edits + by hand. +3. A failed attempt keeps its full hold even when no provider request was + made, so every failure needs a new envelope, ledger and pins. +4. Every attempt needs six native approvals. +5. The launcher bug that failed run `6efa9436` was found only by spending + money. A free check on the host would have caught it. + +The owner agreed (2026-10-13) to fix items 5, 3 and 2 here, and to record +the rest as decisions instead of blocking on them. + +**Goal:** a retry becomes: install the artifact, rehearse for free, approve +once, run. + +## A. Free rehearsal on the host + +```task +id: REINAH-WP-0008-T01 +status: done +priority: high +state_hub_task_id: "c6536c8d-7862-5de6-ad2b-401077b60c04" +``` + +Add a free rehearsal to the owner check. It runs everything +`metered-once --check` does, then executes the admitted runtime's +`rein-aharness` and `glas-harness` launchers inside bwrap from the mount +path, with no network, credentials, provider route or ledger write. The +sandbox profile is already resolved by `--check`. It prints one receipt with +the runtime digest and each launcher's exit code. + +Today's launcher check reads only the first line of each launcher. This +rehearsal runs them, the same way the failing run did. + +**Done when:** tests prove the rehearsal fails on a runtime whose launchers +point at a missing build directory (the `6efa9436` failure) and passes on a +relocated runtime. It must make no network calls and write nothing. The +owner procedure in `docs/owner-bootstrap.md` makes the rehearsal a required +step before any paid attempt. + +### Implemented — 2026-10-13 + +`rein-aharness metered-once --owner-config --rehearse` (the flag +implies `--check`, so it never reads a provider key or claims). The code is in +`rein_aharness/owner_rehearsal.py`. It uses sand-boxer's isolation flags and +read-only system binds, with the runtime read-only at `/opt/sandboxer/runtime`, +`--unshare-net` and `--clearenv`. It runs each Python launcher with `--help`, +plus `claude --version` when `build-info.json` declares Claude. A missing +bwrap fails closed. + +Tests (`tests/test_owner_rehearsal.py`, `tests/test_owner_bootstrap.py`): + +- With real bwrap, a relocated runtime passes. The uv trampoline that + re-executes a deleted build interpreter fails with 127, as run `6efa9436` + did. +- The rehearsal never claims and never reads the key. +- The command line has no writable bind and no credential. + +The corrected runtime `ee3d0a53…` rehearses clean: rein-aharness 0, +glas-harness 0, claude 0. + +## B. Release holds that provably cost nothing + +```task +id: REINAH-WP-0008-T02 +status: done +priority: high +state_hub_task_id: "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9" +``` + +`SpendLedger.reconcile` keeps the full hold (`max(held, observed)`). Add an +evidence-backed release. If the run has zero provider-request reservations +and its request route is revoked, reconciliation may set the liability to +the observed amount. Otherwise the current rule stands. The release records +which evidence allowed it, and the CLI flag says so, for example +`--release-unused-hold`. + +This changes a deliberate safety rule, so it needs owner sign-off on the +exact rule before merge. That sign-off is recorded in T04's decision note. + +**Done when:** tests cover all four cases. A run with no request +reservations and a revoked route releases. A run with any request +reservation, or with a live route, refuses the release. A second, identical +reconcile changes nothing. The envelope is never marked breached by a +release. + +### Widened to observed-usage settlement — 2026-10-14 + +On 2026-10-13 the owner asked for three attempts within EUR 10 and chose +option B: settle to actual usage instead of releasing only unused holds. +Under full-hold accounting each request holds USD 4.64 (1M context plus +64k output), so EUR 10 cannot fit three attempts. + +Implemented as an opt-in envelope term (`settlement: observed-usage`) plus +`max_runs`; see `docs/owner-bootstrap.md`. Under it: + +- a completed request is charged its gateway-metered cost; +- runs and reconciliations are charged + `max(metered requests, reported or attested cost)`; +- unfinished requests keep their full hold, and overruns still freeze the + envelope. + +The run 6efa9436 shape (failure before any request) now reconciles to its +attested cost. Defaults and existing digests are unchanged. Tests: +`tests/test_spend_settlement.py`, plus renewal cases in +`tests/test_owner_renew.py`. + +Merge-ready, but the rule still needs the owner's acceptance in decision +`a93619a9`. + +## D. One owner command for renewal + +```task +id: REINAH-WP-0008-T03 +status: done +priority: high +state_hub_task_id: "87457216-2371-51ca-b3d4-3917e6f180a2" +``` + +Add `rein-aharness owner renew --owner --runtime +--envelope `. It does three things: + +1. It refuses unless every reservation in the current ledger is settled. +2. It writes the new spend policy, initializes a fresh ledger, and updates + the runtime and spend-policy pins in `owner.json` together. Old files are + kept as backups. Existing ledgers are never reset. +3. It prints one summary for the owner to review: old to new runtime, old + to new policy digest, envelope cap and attempt limit, and ledger path. + +Add a dry-run mode that only prints the summary. Afterwards, run the T01 +rehearsal. + +**Done when:** a test renews from the 2026-09-27 layout to a new envelope. +The owner check passes on the result. A second renew with an unsettled +reservation refuses. No digest has to be typed by hand. + +### Implemented — 2026-10-13 + +The command is `rein-aharness owner renew --owner-config --policy --ledger +--runtime-path --envelope [--apply]`, in `rein_aharness/owner_renew.py`. +Without `--apply` it is a dry run. Choices: + +- **Envelope file:** only the envelope fields may change. Worker, target, + profile and grant pins carry over, and `SpendPolicy` validation runs on + the result. +- **Paths stay the same:** the old ledger is renamed to + `.retired-`, never reset, and the old policy and owner.json + are kept as `.bak`. Secrets Engine pins the `exec_owner` files by sha256 + and the ledger path through its fixed environment, so keeping the paths + means the catalog needs only new file hashes. The command prints them. +- **Refusals:** a held reservation, an open request route, an open SQLite + transaction, an owner.json that doesn't match the policy, a reused + envelope id, a disallowed field, or leftovers from an earlier renewal. + +Tests (`tests/test_owner_renew.py`): + +- A dry run changes nothing. +- An applied renewal passes the real owner check (`prepare`) at the + unchanged paths. +- A charged reservation, the railiance01 state after the 2026-10-13 + reconciliation, renews, and the row survives in the retired ledger. +- Bad envelopes and a second apply both refuse. + +Finding for T06: renewal still changes the pinned file hashes, so each +renewal needs a Secrets Engine catalog update and fresh approvals. + +## C. Envelopes that cover several attempts (decision) + +```task +id: REINAH-WP-0008-T04 +status: done +decision_id: "a93619a9-8a70-40d8-aaf9-c29357d2a043" +priority: medium +state_hub_task_id: "898e02af-51bb-5e8d-93d0-ae908466c612" +``` + +Owner decision: should future envelopes be admitted as "up to N attempts +within EUR X" instead of one attempt? The EUR 10 cap already fits two +USD 4.64 request holds. Record the choice, together with T02's sign-off, +as a decision note in `docs/`. T03's envelope format then reflects it. + +### Decided — 2026-10-14 + +The owner chose up to three attempts within EUR 10 (EUR 5 per attempt) and +observed-usage settlement, and resolved hub decision `a93619a9` with that +choice. Record: `docs/decisions/2026-10-14-spend-envelope-settlement.md`. +The terms are in spend memo `infd-20261014-b01`. + +## E. Ship the owner runtime as a container image (decision) + +```task +id: REINAH-WP-0008-T05 +status: wait +needs_human: true +decision_id: "e6ca2f07-2708-4013-bfba-bf89fa0f1cb5" +priority: low +state_hub_task_id: "b486e86b-9d0f-501d-a394-771b40f771ee" +``` + +Decision for later, with Platform (railiance) and Sand-boxer: should the +owner runtime ship through the registry and GitOps, using the existing +`make image` path, instead of rsync and a manual digest check? Out of scope +here. If accepted, hand it off as a residual intake to the owning repos. + +## F. Approvals per envelope (decision) + +```task +id: REINAH-WP-0008-T06 +status: wait +needs_human: true +decision_id: "e8986e40-f6f8-4c87-b704-bff50cc4958b" +priority: low +state_hub_task_id: "4cf721e6-724b-5c64-91bb-67b098bb97af" +``` + +Decision for later, with Secrets Engine: should one approval set cover an +envelope's attempts instead of six native approvals per attempt? The work +lives outside this repo. If accepted, hand it off as a residual intake. + +## Retry on the corrected runtime + +```task +id: REINAH-WP-0008-T07 +status: wait +needs_human: true +blocking_reason: "Owner: accept spend memo infd-20261014-b01, then attended install, rehearsal, renew and approvals on railiance01" +priority: high +state_hub_task_id: "80318842-ccaa-5484-a54a-3d9981eaec8b" +``` + +Waits on T01 and T03. It does not need T02. + +Steps: + +1. Rebuild `ee3d0a53…`, or the then-current corrected runtime, from the + pinned commits. +2. Install it on railiance01. +3. Run the T01 rehearsal. +4. Renew with T03 to the owner-authorized new envelope (EUR 10, authorized + 2026-10-13). +5. Run exactly one attended attempt, which consumes fresh native approvals. + +Record the result in REINAH-WP-0003-T05/T06. + +### Waiting on the owner — 2026-10-14 + +Everything this repo can do is done: the rehearsal (T01), the settlement rule +(T02, T04) and renewal (T03) are in place. Draft memo `infd-20261014-b01` is +in informed-decision `ee6a65b`. What remains needs the owner, in order: + +1. Accept the memo in the attended sitting. +2. ~~Rebuild `ee3d0a53` from the pinned commits~~ (done 2026-10-15 as + `818b1b7c…`, see below) and install it on railiance01. +3. Run `metered-once --rehearse`. +4. Run `owner renew` with the memo's terms, then update the Secrets Engine + file pins. +5. Approve the native actions and run the first attempt. + +Sand-boxer's steps 2–4 in message `82faf25c` are this same sequence. + +### Runtime rebuilt — 2026-10-15 + +Step 1 is done. The owner approved a rebuild because `ee3d0a53…` was not kept +on the workstation. Sand-boxer built `818b1b7c…` from the same pinned inputs +and builder. The digest differs only because the build-source paths are +embedded in the artifact. The bwrap startup smoke passed (sandbox `28df7a1d`) +with no credentials and no model run. `818b1b7c…` is now the install +candidate. It is not installed on railiance01 (still `b6e4e8a4…`) or admitted. +Receipt: `docs/evidence/2026-10-15-rebuilt-owner-runtime.json`. The memo still +still has to be created, admitted, loaded and accepted first. The owner steps +are in informed-decision `docs/batches/2026-10-14-three-attempts/OPERATOR.md`. + +### Memo queued — 2026-10-15 + +Owner step 1 is in progress via the lifecycle intake path (owner's choice; the +review-record approval counts as spend authority). Workspace draft +`2ccb4bda-e318-51d2-a8dd-709db768494f`, review +`review-e2d2e98f-4701-45b0-abc1-4fe9f00bd1a8`, queued by the owner in the State +Hub memo dispatcher; approval intent `accept` by `helixforge-factory`. Record: +informed-decision `d5f1021` (sitting.json, OPERATOR.md). The accepted approval id +becomes `authority_ref` for `owner renew`. Install candidate remains `818b1b7c`. + + +### Workload-only Glas source integration — 2026-10-16 + +Reviewed and integrated the one-line runtime-contract lock advance from Glas +`30be81808140a3a3d137e731d1fe9aed59ad8581` to published workload-only credential +delivery `7357115c8311e55ee3d495f5266f501a17ec3c89`. llm-connect `37436bb5` and +sandboxer `221126cb` remain pinned. This is source integration under T07, not +native artifact installation or admission. T07 remains waiting with its existing +owner gates. + +Prior preparation used rein base `be5ef400` plus isolated lock-only commit +`c811fc43` to build candidate +`634e65fee5517ebee0d1080805fd84c81bd46af26a2b38ec1ab14bd2be17bf8f`. The +candidate's installed packages passed actual SandboxManager/Glas gateway proof +with unchanged `harness.agent-dev-local@1.1.1` (still unverified): real rein/Glas +CLI and Claude 2.1.266 startup, read-only runtime, synthetic host-file and +inherited environment/child-process denial, exact task identity/private state, +deterministic workspace Git effect, task removal and destruction. A separately +labelled synthetic route fixture passed workload-only delivery, output redaction +and clean subsequent housekeeping through the same actual manager. Wrong +actor/project/run, expired execution, expiry cleanup, cancellation and +post-cancellation refusal passed. All 141 Glas tests and seven rein lock/rehearsal +tests passed; whole artifact digest remained unchanged after proof. + +The first proof runner correctly encountered the manager's PermissionError for +wrong consumer but expected ValueError/RuntimeError. Its finally cleanup ran; +the runner catch was refined and the failure retained. This does not earn an +unchanged execution success. No model/provider request, real credential read, +queue access or spend occurred. + +The preparation artifact is not the artifact of this integrated owner revision. +Rebuild from the exact committed owner source and verify its new digest and +actual-manager proof before considering installation. Source inputs, receipts, +reproducible proof and attempt history are retained in the +[Custodian evidence directory](../../the-custodian/docs/changes/netkingdom-target-2026-10-16/agent-isolation-next/README.md). +The same directory records the integrated-source rebuild separately. + +Retain `818b1b7c`, `ee3d0a53`, installed `b6e4e8a4` and their outcomes as historical +evidence. Native acceptance still requires the queued spend memo lifecycle, +owner artifact installation/rehearsal, renewal and Secrets Engine file-pin +updates, required native approvals and bounded real-model/tool proof. Actual +interactive assignment migration and external tool-path denial remain Custodian +acceptance obligations; no profile readiness or supervision authority changed.