From daeba9eeab7855689b9be07c0df76ed4cb50c604 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 1 Nov 2026 23:24:13 +0100 Subject: [PATCH] docs: preserve reviewed NetKingdom session artifacts --- .../identity-binding-review-r1/README.md | 98 ++++ .../current-driver-references.json | 39 ++ .../initial-creation.source-history.txt | 200 ++++++++ .../live-seven-bindings.json | 178 +++++++ .../identity-binding-review-r1/manifest.json | 14 + .../mapping-proposal.json | 47 ++ .../prefix-rename.source-history.txt | 192 ++++++++ .../glas-harness/consistency.json | 99 ++++ .../glas-harness/consistency.stderr.txt | 1 + .../glas-harness/index.preimage | Bin 0 -> 11549 bytes .../glas-harness/projection.json | 153 ++++++ .../glas-harness/projection.stderr.txt | 0 .../.custodian-brief.md.worktree | 55 +++ .../WORK-RECORDS.md.worktree | 97 ++++ .../publication-backup/originals.json | 10 + .../glas-harness/publication-commit.json | 13 + .../glas-harness/publication-manifest.json | 11 + .../glas-harness/source-before.json | 8 + .../glas-harness/verified-bindings.json | 54 +++ .../glas-harness/workplan.postimage.md | 450 ++++++++++++++++++ .../glas-harness/workplan.preimage.md | 450 ++++++++++++++++++ .../publication-r1/manifest.json | 46 ++ .../rein-aharness/consistency.json | 71 +++ .../rein-aharness/consistency.stderr.txt | 0 .../rein-aharness/projection.json | 124 +++++ .../rein-aharness/projection.stderr.txt | 0 .../.custodian-brief.md.worktree | 36 ++ .../WORK-RECORDS.md.worktree | 60 +++ .../publication-backup/originals.json | 10 + .../rein-aharness/publication-commit.json | 17 + .../rein-aharness/publication-manifest.json | 15 + .../rein-aharness/verified-bindings.json | 84 ++++ .../sand-boxer/consistency.json | 52 ++ .../sand-boxer/consistency.stderr.txt | 1 + .../publication-r1/sand-boxer/index.preimage | Bin 0 -> 19864 bytes .../publication-r1/sand-boxer/projection.json | 91 ++++ .../sand-boxer/projection.stderr.txt | 0 .../.custodian-brief.md.worktree | 35 ++ .../WORK-RECORDS.md.worktree | 126 +++++ .../publication-backup/originals.json | 10 + .../sand-boxer/publication-commit.json | 13 + .../sand-boxer/publication-manifest.json | 11 + .../sand-boxer/required-checks.json | 10 + .../sand-boxer/source-before.json | 8 + .../sand-boxer/verified-bindings.json | 54 +++ .../sand-boxer/workplan.postimage.md | 375 +++++++++++++++ .../sand-boxer/workplan.preimage.md | 375 +++++++++++++++ .../publication-r1/verified-publication.json | 113 +++++ .../HEAD-source/AGENTS.md | 262 ++++++++++ .../REINAH-WP-0008-simpler-metered-retry.md | 354 ++++++++++++++ 50 files changed, 4522 insertions(+) create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/README.md create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/current-driver-references.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/initial-creation.source-history.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/live-seven-bindings.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/manifest.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/mapping-proposal.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/prefix-rename.source-history.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/index.preimage create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/.custodian-brief.md.worktree create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/WORK-RECORDS.md.worktree create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/originals.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-commit.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-manifest.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/source-before.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/verified-bindings.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.postimage.md create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.preimage.md create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/manifest.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/.custodian-brief.md.worktree create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/WORK-RECORDS.md.worktree create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/originals.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-commit.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-manifest.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/verified-bindings.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/index.preimage create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/projection.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/projection.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/.custodian-brief.md.worktree create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/WORK-RECORDS.md.worktree create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/originals.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-commit.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-manifest.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/required-checks.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/source-before.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/verified-bindings.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.postimage.md create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.preimage.md create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/verified-publication.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/AGENTS.md create mode 100644 docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/workplans/REINAH-WP-0008-simpler-metered-retry.md diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/README.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/README.md new file mode 100644 index 00000000..52d94cb7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/README.md @@ -0,0 +1,98 @@ +# Rein metered retry identity binding review + +Read-only source/history and public work-record review, 17 October 2026. No +source, ID, row, alias, retirement acknowledgement or authority was changed. + +## Finding + +The refused receiving transaction is correct under its current identity +contract. Parent `187c2599-84a6-5764-a14f-7e9121975bf2` is the deterministic +HARNESS-WP-0008 UUID. All seven task UUIDs likewise derive from their original +HARNESS IDs. The current file calls the same records REINAH-WP-0008/T01–T07 but +retains the HARNESS UUIDs. Canonical receiving derives UUIDs from canonical IDs; +ordinary embedded UUID fields are not authority to change that identity. + +Creation commit `dd588f3e337c5f478653c006905a09a2e12bcdc1` (13 October) +created HARNESS-WP-0008 under then-current AGENTS instructions naming HARNESS-WP +as the prefix. Four minutes later, +`a85de661f04b8331ec66b921d165671f4da77305` changed the file and AGENTS to +REINAH to address C-26. Its stated intent was to keep the Hub IDs and update the +same existing record. The retained source history proves that intent; it is +not a sealed UUID migration approval or a change to receiver semantics. + +The existing C-26 implementation is a **non-fixable warning** whose message says +new plans must conform. It does not instruct an existing record to be renamed. +The canon's grandfathering rule says existing IDs are never renamed. ADR-007 +permits specifically ruled live-collision migrations, not arbitrary prefix +changes in response to C-26; no such HARNESS0008 collision or migration ruling +was found in the reviewed records. The newer prefix remains appropriate for +future new workplans. + +## Existing source/receiver contracts + +- `forge_projection.derive_from_checkout` derives ordinary record UUIDs from + canonical IDs. `reset_repository_projection` matches UUID, then canonical + slug; an identifier change is a rekey rather than a title/path rename. +- `ensure_missing_work_record_identifiers` preserves existing UUIDs and assigns + only missing ones. It cannot repair this source/identity contradiction by + overwriting the eight UUIDs. +- Normal task reconciliation can fill a null record_id when an actual task's + UUID equals the desired derived UUID. After a correct source identity repair, + that existing path can bind the seven records without task recreation. +- The existing sealed UUID migration contract requires a source-sealed atomic + plan, independently verified batch, explicit decision bound to its digest, + database/file phases, durable aliases and reversible failure handling. No + reviewed HARNESS0008 sealed plan or approval was identified. The alias model + records old/new **UUIDs**; it is not a free-form canonical string-ID alias + registry. Do not invent or populate one as a cache repair. + +The receiver must not be weakened to prefer any embedded UUID over a conflicting +canonical identifier. That would defeat the deliberate rekey and collision +guards. The missing record_ids are a consequence of this identity conflict; +they are not seven independent permissions to patch task rows. + +## Recommended minimal source correction for actual owner review + +Restore the original canonical HARNESS-WP-0008 parent and T01–T07 IDs while +keeping the current backing filename, all eight UUIDs, statuses, human gates, +decision references, implementation/native history and existing dependency +endpoints. Add HARNESS0008 to AGENTS' explicit preserved historical list and +record the brief erroneous REINAH label as dated provenance. This is restoration +of an existing identity, not minting another workplan. mapping-proposal.json +names the exact records; no transformation was applied. + +Do not change the prefix registered for future plans. Do not remove the source +history, rewrite immutable prior receipts, accept retirement, clear blocked or +needs_human fields, or silently apply a UUID migration. An ordinary receiving +attempt after a reviewed, published source correction should derive the existing +parent/seven task UUIDs, update those records and fill the null task record_ids, +with zero retired/created records. Confirm that expectation through the existing +normal derive/diff and receiving path before claiming convergence. + +Current cross-owner references to the erroneous REINAH label must receive the +same explicit source correction or a documented provenance clarification. The +identified live driver references are in SAND-WP-0015 and GLAS-WP-0012; exact +source locations/hashes are in current-driver-references.json. Root's pending +native install proposal also uses REINAH-T07 and needs a separately versioned +reference correction if this disposition is accepted. Its original revision +must remain immutable and no revised reference creates native authority. + +If the actual owner instead chooses REINAH as a newly rekeyed canonical record, +that is a different identity transition. Use the existing separately authorized +eight-UUID sealed migration and durable alias machinery with complete reference, +wait and history reconciliation. It is not an ordinary receiving fix, and is +not the minimal preservation option recommended here. + +## Live preservation requirements + +live-seven-bindings.json records exact source/Hub IDs and UUIDs. T01–T04 are +done; T05/T06/T07 remain wait with needs_human=true. Parent remains blocked and +unretired. Existing T07→T01/T03 dependencies use the original task UUIDs. Those +two dependency rows and every human/native gate must survive any authorized +repair. Spend decision a93619a9, image decision e6ca2f07 and approval decision +e8986e40 concern their stated owner choices, not canonical record migration. + +The refused transaction receipt has zero updates/creates/retirements and remains +unchanged. No retirement was acknowledged. This review supplies a concrete +owner correction proposal and source basis; it performs no new native action, +spend, installation, approval or human-wait disposition. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/current-driver-references.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/current-driver-references.json new file mode 100644 index 00000000..4d36ed90 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/current-driver-references.json @@ -0,0 +1,39 @@ +{ + "status": "read_only_current_source_reference_inventory", + "references": [ + { + "repo": "glas-harness", + "path": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md", + "sha256": "sha256:881ab0f5ba3bb43f5404c8f4cd23f9628e014992ba88fc13f541f0fa8b7b1eaa", + "current_references": [ + { + "line": 442, + "source": "admitted on Railiance. REINAH-WP-0008-T07 retains memo lifecycle acceptance," + } + ] + }, + { + "repo": "sand-boxer", + "path": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md", + "sha256": "sha256:230d1ef37aa9c2023335a617492a72678c4671a8bc82d5577e9d7a7cea6e8fe4", + "current_references": [ + { + "line": 92, + "source": "blocking_reason: \"Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.\"" + }, + { + "line": 357, + "source": "opened REINAH-WP-0008 (simpler metered retry, active). No railiance01 install/" + }, + { + "line": 362, + "source": "origin/main). Steps 2-4 are REINAH-WP-0008-T07. Budget is now up to three" + }, + { + "line": 374, + "source": "then-current corrected runtime for REINAH-WP-0008-T07 and to load the unsigned" + } + ] + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/initial-creation.source-history.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/initial-creation.source-history.txt new file mode 100644 index 00000000..2adf2823 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/initial-creation.source-history.txt @@ -0,0 +1,200 @@ +commit dd588f3e337c5f478653c006905a09a2e12bcdc1 +Author: tegwick +AuthorDate: Tue Oct 13 22:52:59 2026 +0200 +Commit: tegwick +CommitDate: Tue Oct 13 22:52:59 2026 +0200 + + Add HARNESS-WP-0008: simpler metered retry + + Free host rehearsal, evidence-backed release of unused holds, and a + one-command owner renewal; multi-attempt envelopes, image shipping and + per-envelope approvals recorded as decisions. + + Co-Authored-By: Claude Opus 5.5 + + Assistant: claude-code + Assistant-Model: opus + Assistant-Process: 269692@bnt-lap001 + Assistant-Session: 8077e68a-0985-4b41-898c-2dc602b0d6be + +diff --git a/workplans/HARNESS-WP-0008-simpler-metered-retry.md b/workplans/HARNESS-WP-0008-simpler-metered-retry.md +new file mode 100644 +index 0000000..bfa06e2 +--- /dev/null ++++ b/workplans/HARNESS-WP-0008-simpler-metered-retry.md +@@ -0,0 +1,175 @@ ++--- ++id: HARNESS-WP-0008 ++type: workplan ++title: "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal" ++domain: infotech ++repo: rein-aharness ++status: ready ++owner: claude-code ++topic_slug: rein-aharness ++priority: high ++created: "2026-10-13" ++updated: "2026-10-13" ++related: ++ - REINAH-WP-0003 ++--- ++ ++# HARNESS-WP-0008 — Simpler metered retry ++ ++## Origin ++ ++On 2026-10-13 the owner reconciled the 2026-09-27 hold for run `6efa9436` ++(`docs/evidence/2026-10-13-held-liability-reconciliation.json`). A corrected ++runtime `ee3d0a53…` was built ++(`docs/evidence/2026-10-13-corrected-owner-runtime-build.json`). The owner ++authorized a new envelope and one retry. ++ ++Preparing that retry took too many owner ceremonies: ++ ++1. The runtime is built on the workstation and copied to railiance01 by hand. ++2. `owner.json` and the spend policy hold five digests that the owner edits ++ by hand. ++3. A failed attempt keeps its full hold even when no provider request was ++ made, so every failure needs a new envelope, ledger and pins. ++4. Every attempt needs six native approvals. ++5. The launcher bug that failed run `6efa9436` was found only by spending ++ money. A free check on the host would have caught it. ++ ++The owner agreed (2026-10-13) to fix items 5, 3 and 2 here, and to record ++the rest as decisions instead of blocking on them. ++ ++**Goal:** a retry becomes: install the artifact, rehearse for free, approve ++once, run. ++ ++## A. Free rehearsal on the host ++ ++```task ++id: HARNESS-WP-0008-T01 ++status: todo ++priority: high ++``` ++ ++Add `rein-aharness owner check --rehearse `. It runs everything ++`metered-once --check` does. It then executes the admitted runtime's ++`rein-aharness` and `glas-harness` launchers inside bwrap, from the mount ++path, with `--unshare-all`, no credentials, no provider route and no ledger ++write. It also checks that the sandbox profile resolves. It prints a single ++pass or fail line with the runtime digest. ++ ++Today's launcher check reads only the first line of each launcher. This ++rehearsal runs them, the same way the failing run did. ++ ++**Done when:** tests prove the rehearsal fails on a runtime whose launchers ++point at a missing build directory (the `6efa9436` failure) and passes on a ++relocated runtime. It must make no network calls and write nothing. The ++owner procedure in `docs/owner-bootstrap.md` makes the rehearsal a required ++step before any paid attempt. ++ ++## B. Release holds that provably cost nothing ++ ++```task ++id: HARNESS-WP-0008-T02 ++status: todo ++priority: high ++``` ++ ++`SpendLedger.reconcile` keeps the full hold (`max(held, observed)`). Add an ++evidence-backed release. If the run has zero provider-request reservations ++and its request route is revoked, reconciliation may set the liability to ++the observed amount. Otherwise the current rule stands. The release records ++which evidence allowed it, and the CLI flag says so, for example ++`--release-unused-hold`. ++ ++This changes a deliberate safety rule, so it needs owner sign-off on the ++exact rule before merge. That sign-off is recorded in T04's decision note. ++ ++**Done when:** tests cover all four cases. A run with no request ++reservations and a revoked route releases. A run with any request ++reservation, or with a live route, refuses the release. A second, identical ++reconcile changes nothing. The envelope is never marked breached by a ++release. ++ ++## D. One owner command for renewal ++ ++```task ++id: HARNESS-WP-0008-T03 ++status: todo ++priority: high ++``` ++ ++Add `rein-aharness owner renew --owner --runtime ++--envelope `. It does three things: ++ ++1. It refuses unless every reservation in the current ledger is settled. ++2. It writes the new spend policy, initializes a fresh ledger, and updates ++ the runtime and spend-policy pins in `owner.json` together. Old files are ++ kept as backups. Existing ledgers are never reset. ++3. It prints one summary for the owner to review: old to new runtime, old ++ to new policy digest, envelope cap and attempt limit, and ledger path. ++ ++Add a dry-run mode that only prints the summary. Afterwards, run the T01 ++rehearsal. ++ ++**Done when:** a test renews from the 2026-09-27 layout to a new envelope. ++The owner check passes on the result. A second renew with an unsettled ++reservation refuses. No digest has to be typed by hand. ++ ++## C. Envelopes that cover several attempts (decision) ++ ++```task ++id: HARNESS-WP-0008-T04 ++status: wait ++priority: medium ++``` ++ ++Owner decision: should future envelopes be admitted as "up to N attempts ++within EUR X" instead of one attempt? The EUR 10 cap already fits two ++USD 4.64 request holds. Record the choice, together with T02's sign-off, ++as a decision note in `docs/`. T03's envelope format then reflects it. ++ ++## E. Ship the owner runtime as a container image (decision) ++ ++```task ++id: HARNESS-WP-0008-T05 ++status: wait ++priority: low ++``` ++ ++Decision for later, with Platform (railiance) and Sand-boxer: should the ++owner runtime ship through the registry and GitOps, using the existing ++`make image` path, instead of rsync and a manual digest check? Out of scope ++here. If accepted, hand it off as a residual intake to the owning repos. ++ ++## F. Approvals per envelope (decision) ++ ++```task ++id: HARNESS-WP-0008-T06 ++status: wait ++priority: low ++``` ++ ++Decision for later, with Secrets Engine: should one approval set cover an ++envelope's attempts instead of six native approvals per attempt? The work ++lives outside this repo. If accepted, hand it off as a residual intake. ++ ++## Retry on the corrected runtime ++ ++```task ++id: HARNESS-WP-0008-T07 ++status: wait ++priority: high ++``` ++ ++Waits on T01 and T03. It does not need T02. ++ ++Steps: ++ ++1. Rebuild `ee3d0a53…`, or the then-current corrected runtime, from the ++ pinned commits. ++2. Install it on railiance01. ++3. Run the T01 rehearsal. ++4. Renew with T03 to the owner-authorized new envelope (EUR 10, authorized ++ 2026-10-13). ++5. Run exactly one attended attempt, which consumes fresh native approvals. ++ ++Record the result in REINAH-WP-0003-T05/T06. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/live-seven-bindings.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/live-seven-bindings.json new file mode 100644 index 00000000..3d6051b2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/live-seven-bindings.json @@ -0,0 +1,178 @@ +{ + "observed_at": "2026-10-17T06:53:16.338873+00:00", + "read_only": true, + "parent": { + "id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "repo_id": "73be5a8e-8503-447f-87cb-de8c2c8c0b9e", + "slug": "harness-wp-0008", + "title": "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal", + "status": "blocked", + "backing_relative_path": "workplans/REINAH-WP-0008-simpler-metered-retry.md", + "projection_retired_at": null + }, + "historical_parent_derived_uuid": "187c2599-84a6-5764-a14f-7e9121975bf2", + "renamed_parent_derived_uuid": "09fc68ec-4274-5669-9936-16e82bb95d76", + "tasks": [ + { + "source_id": "REINAH-WP-0008-T01", + "historical_id": "HARNESS-WP-0008-T01", + "source_uuid": "c6536c8d-7862-5de6-ad2b-401077b60c04", + "source_status": "done", + "historical_derived_uuid": "c6536c8d-7862-5de6-ad2b-401077b60c04", + "renamed_derived_uuid": "fc36020b-348a-53f1-9265-fe83a22d75c5", + "hub": { + "id": "c6536c8d-7862-5de6-ad2b-401077b60c04", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "A. Free rehearsal on the host", + "status": "done", + "needs_human": false, + "decision_id": null, + "blocking_reason": null, + "parent_task_id": null + } + }, + { + "source_id": "REINAH-WP-0008-T02", + "historical_id": "HARNESS-WP-0008-T02", + "source_uuid": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9", + "source_status": "done", + "historical_derived_uuid": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9", + "renamed_derived_uuid": "a52b493c-c990-51f2-a629-14b361cff34e", + "hub": { + "id": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "B. Release holds that provably cost nothing", + "status": "done", + "needs_human": false, + "decision_id": null, + "blocking_reason": null, + "parent_task_id": null + } + }, + { + "source_id": "REINAH-WP-0008-T03", + "historical_id": "HARNESS-WP-0008-T03", + "source_uuid": "87457216-2371-51ca-b3d4-3917e6f180a2", + "source_status": "done", + "historical_derived_uuid": "87457216-2371-51ca-b3d4-3917e6f180a2", + "renamed_derived_uuid": "f4453c99-b937-5716-a665-eccb9c3870d7", + "hub": { + "id": "87457216-2371-51ca-b3d4-3917e6f180a2", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "D. One owner command for renewal", + "status": "done", + "needs_human": false, + "decision_id": null, + "blocking_reason": null, + "parent_task_id": null + } + }, + { + "source_id": "REINAH-WP-0008-T04", + "historical_id": "HARNESS-WP-0008-T04", + "source_uuid": "898e02af-51bb-5e8d-93d0-ae908466c612", + "source_status": "done", + "historical_derived_uuid": "898e02af-51bb-5e8d-93d0-ae908466c612", + "renamed_derived_uuid": "45e8d650-57d5-5e40-a911-49577db0dbd6", + "hub": { + "id": "898e02af-51bb-5e8d-93d0-ae908466c612", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "C. Envelopes that cover several attempts (decision)", + "status": "done", + "needs_human": false, + "decision_id": "a93619a9-8a70-40d8-aaf9-c29357d2a043", + "blocking_reason": null, + "parent_task_id": null + } + }, + { + "source_id": "REINAH-WP-0008-T05", + "historical_id": "HARNESS-WP-0008-T05", + "source_uuid": "b486e86b-9d0f-501d-a394-771b40f771ee", + "source_status": "wait", + "historical_derived_uuid": "b486e86b-9d0f-501d-a394-771b40f771ee", + "renamed_derived_uuid": "b7d8410a-f9ce-5329-ab83-4bb40ad5dae2", + "hub": { + "id": "b486e86b-9d0f-501d-a394-771b40f771ee", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "E. Ship the owner runtime as a container image (decision)", + "status": "wait", + "needs_human": true, + "decision_id": "e6ca2f07-2708-4013-bfba-bf89fa0f1cb5", + "blocking_reason": null, + "parent_task_id": null + } + }, + { + "source_id": "REINAH-WP-0008-T06", + "historical_id": "HARNESS-WP-0008-T06", + "source_uuid": "4cf721e6-724b-5c64-91bb-67b098bb97af", + "source_status": "wait", + "historical_derived_uuid": "4cf721e6-724b-5c64-91bb-67b098bb97af", + "renamed_derived_uuid": "467d0112-89af-5c56-acae-2d421c37f7db", + "hub": { + "id": "4cf721e6-724b-5c64-91bb-67b098bb97af", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "F. Approvals per envelope (decision)", + "status": "wait", + "needs_human": true, + "decision_id": "e8986e40-f6f8-4c87-b704-bff50cc4958b", + "blocking_reason": null, + "parent_task_id": null + } + }, + { + "source_id": "REINAH-WP-0008-T07", + "historical_id": "HARNESS-WP-0008-T07", + "source_uuid": "80318842-ccaa-5484-a54a-3d9981eaec8b", + "source_status": "wait", + "historical_derived_uuid": "80318842-ccaa-5484-a54a-3d9981eaec8b", + "renamed_derived_uuid": "4be5997e-2e07-5977-9b5f-a488ddad3030", + "hub": { + "id": "80318842-ccaa-5484-a54a-3d9981eaec8b", + "record_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "title": "Retry on the corrected runtime", + "status": "wait", + "needs_human": true, + "decision_id": null, + "blocking_reason": "Owner: accept spend memo infd-20261014-b01, then attended install, rehearsal, renew and approvals on railiance01", + "parent_task_id": null + } + } + ], + "dependency_endpoint_result": [ + { + "id": "a6dc2ff5-ec61-407c-8fd2-d6a0d6f31547", + "from_workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "from_task_id": "80318842-ccaa-5484-a54a-3d9981eaec8b", + "to_workplan_id": null, + "to_task_id": "c6536c8d-7862-5de6-ad2b-401077b60c04", + "relationship_type": "starts_after", + "description": "REINAH-WP-0008-T07 depends_on REINAH-WP-0008-T01", + "source_owner": null, + "source_commit": null, + "created_at": "2026-10-13T20:58:29.042766Z", + "updated_at": "2026-10-13T20:58:29.042766Z" + }, + { + "id": "67498261-4d2a-4db8-b82e-432dbdcbf4ce", + "from_workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2", + "from_task_id": "80318842-ccaa-5484-a54a-3d9981eaec8b", + "to_workplan_id": null, + "to_task_id": "87457216-2371-51ca-b3d4-3917e6f180a2", + "relationship_type": "starts_after", + "description": "REINAH-WP-0008-T07 depends_on REINAH-WP-0008-T03", + "source_owner": null, + "source_commit": null, + "created_at": "2026-10-13T20:58:29.288075Z", + "updated_at": "2026-10-13T20:58:29.288075Z" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/manifest.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/manifest.json new file mode 100644 index 00000000..0e64c552 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/manifest.json @@ -0,0 +1,14 @@ +{ + "schema": "custodian.identity-binding-review.v1", + "status": "read_only_initial_review", + "created_at": "2026-10-17T06:54:39.000769+00:00", + "files": { + "README.md": "sha256:ef4b07a3d5a4fa2affae0ca49b5cea3a85312fd127e1e38f067ef0947c321831", + "current-driver-references.json": "sha256:dfe6c5c37e4a1229556befd9fe4c4eed44739637c32c49272c5b0dc28f011488", + "initial-creation.source-history.txt": "sha256:88bcf3b29e688f87e100a08937479b8f1fcc4a1091156aa457306e28dfe4a8eb", + "live-seven-bindings.json": "sha256:45ef5f12cb89f6227c49531639658cbe5b2ea4a01c9b741938c6e7d500196f83", + "mapping-proposal.json": "sha256:4ec2d39cab42f2863a5c816677955db8e9316c307f61c47a936182fb85c7eb72", + "prefix-rename.source-history.txt": "sha256:c8be2645b37fd445a11a0b2ac939156aab3e7235945fdbf4551fca0c509487e8", + "source-references.json": "sha256:f6240e4db737b028cb86978e5e4c357d5b9a262c03b5791938c9d596ee00848c" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/mapping-proposal.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/mapping-proposal.json new file mode 100644 index 00000000..ed34f60c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/mapping-proposal.json @@ -0,0 +1,47 @@ +{ + "status": "source_identity_restoration_proposed_no_change_performed_in_initial_review", + "parent": { + "current_label": "REINAH-WP-0008", + "restore_canonical_id": "HARNESS-WP-0008", + "preserve_uuid": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + "tasks": [ + { + "current_label": "REINAH-WP-0008-T01", + "restore_canonical_id": "HARNESS-WP-0008-T01", + "preserve_uuid": "c6536c8d-7862-5de6-ad2b-401077b60c04" + }, + { + "current_label": "REINAH-WP-0008-T02", + "restore_canonical_id": "HARNESS-WP-0008-T02", + "preserve_uuid": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9" + }, + { + "current_label": "REINAH-WP-0008-T03", + "restore_canonical_id": "HARNESS-WP-0008-T03", + "preserve_uuid": "87457216-2371-51ca-b3d4-3917e6f180a2" + }, + { + "current_label": "REINAH-WP-0008-T04", + "restore_canonical_id": "HARNESS-WP-0008-T04", + "preserve_uuid": "898e02af-51bb-5e8d-93d0-ae908466c612" + }, + { + "current_label": "REINAH-WP-0008-T05", + "restore_canonical_id": "HARNESS-WP-0008-T05", + "preserve_uuid": "b486e86b-9d0f-501d-a394-771b40f771ee" + }, + { + "current_label": "REINAH-WP-0008-T06", + "restore_canonical_id": "HARNESS-WP-0008-T06", + "preserve_uuid": "4cf721e6-724b-5c64-91bb-67b098bb97af" + }, + { + "current_label": "REINAH-WP-0008-T07", + "restore_canonical_id": "HARNESS-WP-0008-T07", + "preserve_uuid": "80318842-ccaa-5484-a54a-3d9981eaec8b" + } + ], + "future_prefix": "REINAH-WP-", + "filename_unchanged": "workplans/REINAH-WP-0008-simpler-metered-retry.md" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/prefix-rename.source-history.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/prefix-rename.source-history.txt new file mode 100644 index 00000000..4a063ac1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/prefix-rename.source-history.txt @@ -0,0 +1,192 @@ +commit a85de661f04b8331ec66b921d165671f4da77305 +Author: tegwick +AuthorDate: Tue Oct 13 22:56:46 2026 +0200 +Commit: tegwick +CommitDate: Tue Oct 13 22:56:46 2026 +0200 + + Use the registered REINAH-WP prefix; rename HARNESS-WP-0008 to REINAH-WP-0008 + + AGENTS.md named HARNESS-WP- as the prefix, but the hub's canonical prefix + for this repo is REINAH-WP- (fix-consistency C-26). Hub ids are kept so + the existing record is updated, not duplicated. Also fixes the README link + to the renamed REINAH-WP-0002 file. + + Co-Authored-By: Claude Opus 5.5 + + Assistant: claude-code + Assistant-Model: opus + Assistant-Process: 269692@bnt-lap001 + Assistant-Session: 8077e68a-0985-4b41-898c-2dc602b0d6be + +diff --git a/AGENTS.md b/AGENTS.md +index 99aa506..e165849 100644 +--- a/AGENTS.md ++++ b/AGENTS.md +@@ -7,12 +7,13 @@ + **Domain:** infotech + **Repo slug:** rein-aharness + **Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a` +-**Workplan prefix:** `HARNESS-WP-` ++**Workplan prefix:** `REINAH-WP-` + + `REIN-A-0001` through `REIN-A-0004` are immutable historical identifiers from +-before the fleet `PREFIX-WP-NNNN` convention. Preserve them in references and +-archives, but use the registered `HARNESS-WP-` prefix for every new workplan +-and task. ++before the fleet `PREFIX-WP-NNNN` convention. `HARNESS-WP-0001` through ++`HARNESS-WP-0003` and `HARNESS-WP-ADHOC-2026-09-04` are older ids from the ++agent-harness name. Preserve all of these in references and archives, but use ++the hub-registered `REINAH-WP-` prefix for every new workplan and task. + + --- + +@@ -196,10 +197,10 @@ get wrong. + Work items originate as files in this repo — not in the hub. The hub is a + read/cache/index layer that rebuilds from files. + +-**File location:** `workplans/HARNESS-WP-NNNN-.md` ++**File location:** `workplans/REINAH-WP-NNNN-.md` + + **Archived location:** finished workplans may move to +-`workplans/archived/YYMMDD-HARNESS-WP-NNNN-.md`. The `YYMMDD` prefix is ++`workplans/archived/YYMMDD-REINAH-WP-NNNN-.md`. The `YYMMDD` prefix is + the completion/archive date; the frontmatter `id` does not change. + + **Ad Hoc Tasks:** small opportunistic fixes discovered during a session use +@@ -211,7 +212,7 @@ anything needing analysis, design, approval, dependencies, or multiple phases. + + ```yaml + --- +-id: HARNESS-WP-NNNN ++id: REINAH-WP-NNNN + type: workplan + title: "..." + domain: infotech +@@ -239,7 +240,7 @@ API/MCP/frontmatter bridges until `STATE-WP-0069` retires them — see + ## Task Title + + ` ` `task +-id: HARNESS-WP-NNNN-T01 ++id: REINAH-WP-NNNN-T01 + status: wait | todo | progress | done | cancel + priority: high | medium | low + state_hub_task_id: "" # written by fix-consistency — do not edit +@@ -252,7 +253,7 @@ Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blo + + **Residuals when finishing:** actionable leftovers become live work records + before `status: finished` — usually an intake (`origin: residual`, +-`origin_ref: HARNESS-WP-NNNN`) or a spawned workplan. Residual is a *role*, ++`origin_ref: REINAH-WP-NNNN`) or a spawned workplan. Residual is a *role*, + not a kind. Fleet list lives on State Hub, not in `SCOPE.md`. + + To create a new workplan: +diff --git a/workplans/HARNESS-WP-0008-simpler-metered-retry.md b/workplans/REINAH-WP-0008-simpler-metered-retry.md +similarity index 89% +rename from workplans/HARNESS-WP-0008-simpler-metered-retry.md +rename to workplans/REINAH-WP-0008-simpler-metered-retry.md +index bfa06e2..3fa0aae 100644 +--- a/workplans/HARNESS-WP-0008-simpler-metered-retry.md ++++ b/workplans/REINAH-WP-0008-simpler-metered-retry.md +@@ -1,5 +1,5 @@ + --- +-id: HARNESS-WP-0008 ++id: REINAH-WP-0008 + type: workplan + title: "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal" + domain: infotech +@@ -12,9 +12,10 @@ created: "2026-10-13" + updated: "2026-10-13" + related: + - REINAH-WP-0003 ++state_hub_workstream_id: "187c2599-84a6-5764-a14f-7e9121975bf2" + --- + +-# HARNESS-WP-0008 — Simpler metered retry ++# REINAH-WP-0008 — Simpler metered retry + + ## Origin + +@@ -44,9 +45,10 @@ once, run. + ## A. Free rehearsal on the host + + ```task +-id: HARNESS-WP-0008-T01 ++id: REINAH-WP-0008-T01 + status: todo + priority: high ++state_hub_task_id: "c6536c8d-7862-5de6-ad2b-401077b60c04" + ``` + + Add `rein-aharness owner check --rehearse `. It runs everything +@@ -68,9 +70,10 @@ step before any paid attempt. + ## B. Release holds that provably cost nothing + + ```task +-id: HARNESS-WP-0008-T02 ++id: REINAH-WP-0008-T02 + status: todo + priority: high ++state_hub_task_id: "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9" + ``` + + `SpendLedger.reconcile` keeps the full hold (`max(held, observed)`). Add an +@@ -92,9 +95,10 @@ release. + ## D. One owner command for renewal + + ```task +-id: HARNESS-WP-0008-T03 ++id: REINAH-WP-0008-T03 + status: todo + priority: high ++state_hub_task_id: "87457216-2371-51ca-b3d4-3917e6f180a2" + ``` + + Add `rein-aharness owner renew --owner --runtime +@@ -117,9 +121,10 @@ reservation refuses. No digest has to be typed by hand. + ## C. Envelopes that cover several attempts (decision) + + ```task +-id: HARNESS-WP-0008-T04 ++id: REINAH-WP-0008-T04 + status: wait + priority: medium ++state_hub_task_id: "898e02af-51bb-5e8d-93d0-ae908466c612" + ``` + + Owner decision: should future envelopes be admitted as "up to N attempts +@@ -130,9 +135,10 @@ as a decision note in `docs/`. T03's envelope format then reflects it. + ## E. Ship the owner runtime as a container image (decision) + + ```task +-id: HARNESS-WP-0008-T05 ++id: REINAH-WP-0008-T05 + status: wait + priority: low ++state_hub_task_id: "b486e86b-9d0f-501d-a394-771b40f771ee" + ``` + + Decision for later, with Platform (railiance) and Sand-boxer: should the +@@ -143,9 +149,10 @@ here. If accepted, hand it off as a residual intake to the owning repos. + ## F. Approvals per envelope (decision) + + ```task +-id: HARNESS-WP-0008-T06 ++id: REINAH-WP-0008-T06 + status: wait + priority: low ++state_hub_task_id: "4cf721e6-724b-5c64-91bb-67b098bb97af" + ``` + + Decision for later, with Secrets Engine: should one approval set cover an +@@ -155,9 +162,10 @@ lives outside this repo. If accepted, hand it off as a residual intake. + ## Retry on the corrected runtime + + ```task +-id: HARNESS-WP-0008-T07 ++id: REINAH-WP-0008-T07 + status: wait + priority: high ++state_hub_task_id: "80318842-ccaa-5484-a54a-3d9981eaec8b" + ``` + + Waits on T01 and T03. It does not need T02. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.json new file mode 100644 index 00000000..ae472711 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.json @@ -0,0 +1,99 @@ +{ + "repo_slug": "glas-harness", + "repo_path": "/home/worsch/glas-harness", + "source_revision": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'GLAS-WP-0015-T03' in workplan 'GLAS-WP-0015' \u2014 decision 62aa95e4-3ccc-4867-8806-5e3db005b483 is resolved", + "file_path": "workplans/GLAS-WP-0015-production-dependency-coordination.md#GLAS-WP-0015-T03", + "db_id": "", + "file_value": "62aa95e4-3ccc-4867-8806-5e3db005b483", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-25", + "message": "Owner-return task 'GLAS-WP-0016-T04' waiting on rein-aharness has 1 reply/replies after its last dated note (or unread when undated) \u2014 owner action needed: 6b024762-a03a-47dc-b9cf-7a026d361789", + "file_path": "workplans/GLAS-WP-0016-fi-research-brief-profile.md#GLAS-WP-0016-T04", + "db_id": "", + "file_value": "message-from:rein-aharness", + "db_value": "", + "fixable": false, + "repo_slug": "glas-harness", + "source_revision": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "source_revision_reason": null, + "owner_return": { + "task_record_id": "GLAS-WP-0016-T04", + "message_ids": [ + "6b024762-a03a-47dc-b9cf-7a026d361789" + ] + } + }, + { + "severity": "WARN", + "check_id": "C-25", + "message": "Owner-return task 'GLAS-WP-0017-T02' waiting on assembly-economics has 1 reply/replies after its last dated note (or unread when undated) \u2014 owner action needed: c4c804d2-f016-4d26-8d4e-5713e98e65a3", + "file_path": "workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md#GLAS-WP-0017-T02", + "db_id": "", + "file_value": "message-from:assembly-economics", + "db_value": "", + "fixable": false, + "repo_slug": "glas-harness", + "source_revision": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "source_revision_reason": null, + "owner_return": { + "task_record_id": "GLAS-WP-0017-T02", + "message_ids": [ + "c4c804d2-f016-4d26-8d4e-5713e98e65a3" + ] + } + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "4 unread inbox message(s) older than 3 day(s): rein-aharness:6b024762, assembly-economics:c4c804d2, the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-29", + "message": "Unread work request from rein-aharness (6b024762) may need a workplan file: Re: Re: Re: GLAS-WP-0016-T03: tool profile green-research-commit for the FI research brief", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 18/18", + "C-17 cleared: pushed 1 backlogged commit(s)", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 6, + "info": 0 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.stderr.txt new file mode 100644 index 00000000..3345563f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/consistency.stderr.txt @@ -0,0 +1 @@ +WARN: git commit failed for writeback: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/index.preimage b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/index.preimage new file mode 100644 index 0000000000000000000000000000000000000000..7fce06d0a1ac811827c0f5b6fbcfd59273a6871e GIT binary patch literal 11549 zcma)C2Ut``*B*KaP3a)8G$F{{LKg)^KtvP~u@_vH3+!dtU3M3QPerUK7OW@=CUyfT zb^<{~#q!w@dk~F+iW*~&C5ZlWXYU2>0{MO)&6_8|_nmX*oHJ+6+_1>lPym2B{F6*v z-5hE9Mf`+D0Cc&)q$UG^`8xs7c&7ZLcQdf+Qrt4>sPv)3j7F5Om(@wGU0n-I*@6tY zLXs%ti?IZm5Km&KB|=j27qQeZyuZKSAsP{{#n2;6ULEhZjh1U_e879o>pi7^$akCO z>=au77CT8IOU4NaXO={knk16Ul5+$?Or9o5#o5{XG!f*-pGR7_?43*_weCesej~T< z>MMS~I(Af{ntS{|>y9{E&pcc{2k5htg$iM^SR%uftA%_6m+!EV{-&Uj;#*o*KD{lr}R-Yux86}sRR><_;R^0Nhshegc7lGp~N8vPaoStI~ox$ z%jN`=*Cl3qL~3i1+8{+0F*Y_yJ~ut~=s|a&7ZMR39XF2jDskj?o4z2UfJWu|PV8aw z_#OHf^H`_-yVXLYl>zsx-)CCSYWY+L^dh6d!|}1L zrW1f$qC_C)@DpX6kg!;c%jID*Tqwp;_%bmrmt#r%G@&S4nJYw6%tWK)a4CuUYc?H1 zIxOpxOda!}?YxsgL6s}Y&sXQo|8~F1*hW@61q7++cwqt=o`{PTLcRzlB+M3>P@IhM z#fg|ek|veN`3WK%twpX>hju2ZU-a1!K9oe>5{@m>H{Tl1)Hk~Pn76Un+B9px!FdCU zZ`Zc`{OQP{HW03&?~Ta?DR^Rrh*nJyW#Ce{1_dUUWXJ^Mf0irw*-CeaBm%yua~&}w zonlXzLO+aTMcIr(>#(qz#9W8L;vI|6SLX*@XYaCT$<*E^)3qOZl?%L7*5T95T%~Lx zo`lPwhiFkcj#+oxQ5-`=x;}>&Fm)Z?7g}8qq^+{)CwKo{E9ck=J*|tooq@elSFA{p zNu)vnMpi44grA6|;?(v6BHzo)c~I?f8WF!!X*H8y+rsMJ$*(5M-ItZ*#Mo?If46Ld zfyV=2h4=+2e6bi8L7T)18DF44t0%VkO|`#Oy@*ETx{s`9@@jt1+Mjq*a@W2a>;K88CR#a108G<lqaOg+5=cHeY~0U9$JIR1g9MiTSB;hbxes5oWn@wgb*8^hCZSm??4fQbQ% zCX5Vzq7Y??4E{Vmi{2_?sZm(}_U(^oMEV}X;ThKToHCLGR2uv+bQo)u?Wkj+S5_2N zCkAm>0&k|h5u-xJVH0CuVsd>jkuVd-q%w&l2~+wZ03xjl?JkZO8^EgQK&9^WpP9Ob zFWb4keTVDzUuAEQtzXr0vSR4#vx|X$ue!dNWR@70VF{89aUx%qO=-hD@KtIP#YCXC z?+FhYmHT_lnW?Kb;rH=*TOO`W@O;?kA~AmSf)8UN-xYmf9d0CQbjffH=k*~ zat%ar4p8sEekF}c{i7jFea*F=d7rdDa~(FXemadx{p#UNeQjGyk2_a1`koX`sQF~F=#?P7Fy47S;QWjIc(RN< z13Ge!-tUs8g$Ap@1cE}O=k-P<&UC@Dl%!RccIN#W{GVpAy6(#xpQ{XZ0l!}Ld@)#K zMKI9#8H$unQNPZ-E_s+~@@V)+frF&%fwOB_g398_V?SCP|htfa>LMYlJi+U8ho&e#|;|gI(%C%lR{ZN|5qr7EOL| zv83gbF|bkUX5oSivcn_GMv_p3cO0f9e?yhT-k+UGBjPuyGiBQ4ZsK$kL>x{1apLat zT<12+%%T@*J9bm`o^BJE_5Pr*w)g(rV+4hW*JJoL6<+nnmOD80YU=$=X0K=(m3^9h zU32PJV2#!dk70f)F6Y4b6DDTxMQGW?ku-bnS?beiM7&<@R!m-xEWc;3zaDA!sn{@H zUrr>7x$T=@9R)1Ji_US{7Z_h4z@-X4JXe(GRLPl{_L=Sd2nrFu&;994e$B-3LvMcP zhijX1!Zh+@FIf*SGdMI63_$!+5nloC18JB77sKj>CE@}hbyf&)p;RI72xij%C1>2( zJ~4f1r1YjS^|XYwwgY$mGRWBB@NY?*?z%UYa%2|jls&!aQT8=5x;NY zH737W{-9g${VreJlN0tD8{4KxTO9IM)Jo+kjGDv@0SX{GIib&BO_1SAdwPmoqT~-R zolQ}zX;j*E6W-Cfo_`*-CtkluR)5ue|5-*OP}gybcye$-FzB!JW2bH+F2%*<;hzng zQgNarDT$6@n2%$fjAr=Lh;+F2H<>ybMvcRKW)%HaH`2iIzWC2uL7MZ<76byGst!et zB}qi^5|<(EQunA5M3hvdxfM)(MI&WbIa5#9|3bj6$~jF1JO37b9=Yu1bO-+L>&5}s z-t=fsc18wKa!ni`*Ej4O(>}H3HYaWG6lBFO8)o^H_3fVdt>GZI8X zc?y;cdqFbm$eW2oies5_43cK9~594vYe7*mtEUZ_%5BMzI z!lM!C`rL45>gvBd{PfHc^+mrn>|FH&PrX*8`akmd`xcraf$cr_=^?%vd zsf73ksxPAv={S`aspw#X<~{f{r7m|>SyI2@3kyEZ9J0XO2k`zy2S%%S7A{OqQOK1( zrRGWbHSwmECrk(mDZ6H?=tb=umS6bAX~;C8L7%#U0%}lwDZs(*J-I1oh0{ zA(qYVsIP2lYv>^qUC5E{lyRGBr0iSC)K~ldkNt?idG1S2H5{CM^srHjYh1N+E^zA5 z7s75L3!2s;4eg{u3VD*qOPS%a$>27PNXNl5TSezS7P;H-b(xjD;ii1z$d)!NO@8pRPS9qDbC>mn?s#5%IH3$20lWM~o}5cIW8ki9T>13^4dd`b)H_ zeHw7-iN8w%cCm!WGt=&0;5ZhcVD>4bW9FOB)Y0MQANpm~+Wak; z4Xo*0;J|}bfx(eODjbO^`|#p1{w^QKErxXjA>#Ep(1*$U!)1%OkM3vkmVX|jTVWOb zJ@s*J{f}b+OD>R+jW7o~M+&ooD#BE^z?MQU)Atb?5x+?t%)74nW*l?)b^*)rV~Sh- z`?C{M~zcR!k$ui|BMEg^1$Vd4@N%Vck_CWrxZfw*SlT zj`GJQg`ruWBW~&Nb*E)(v9F8(_Dmhd#R6FY?I<2zYHB#_IE_mF3OJ+cYKK+w`pWCW zW!Wpgyf4-bIsHsScz1}46>wnkGedlz2tj8xlF)G zhOYqeRBUqM>Xs zoU!F0jg*c`oNBK1%cv?@_IYwRes0Mni;shkEzfG61sr?VN#M(Iw9k3MG3<&L1q6i@ zze-)yI3;x5{Arri^f!yNCDCjDcX*$G?{+NHu}pr=vcT0| ze+1@Dunsrn_ttCD9B_$()@(VdvUNq_vG!6IXfQ%WP!F;BnGv_rk9;8UZ2iF@{)vWS=OIGUqaag$@MdWe5YM-KBEJ|B>E zj@(~PEk+~aH>p#ZhucMuI(Fr0oy8`jG&WHijP2Uxkvhc{xb+fGW zVe&HMUF=dTu0mtJV|C))ZNRRZUdM=)4gm7LXmw5m`&T6*dpt(IW%6qmT{p}*KBI2j z_8}$_=Qfl-SyVvu^&twhM0$G2T%x{iaVu z{17RA6DGgCg|*q>l!}p+78~QAF0|i#z&>}+(U-tpmA`vzBi`O00kDw zk7%D^$}?YkdMcm5f1U`uJNY}`THvcU)dgWPNrnQxK_sEaF66Gx??gylub=@)7b4PC zd-I&BYxlrx?&0)d(;VGGGt}SZc&GD@WmGK(p*`w)VUh$nF3VJ2xUw0~-{ci6yK`bk z--2M>BiAul*Mmm14*Mo=<~mGvzSI(0oSnIRh~Ix)&8EfN8SR@LlmvJ^uEQHk63Sqk zPru*dS#a<~4z5X6BHw0)Yn#n!8j+sUzAUDmzsvikl6?hFq+r?o@Jf&%$?AOF?3`Q5;M5u3c{&_V2Ae?j9Xs^*I$~Xp5IH{`5~J#;L9?6jDTZ6ER!!1CMwgk zGw$*aKjpCp*Ao;f?dJZ()YT2;g}Pk7ayZYxF#MU$ru$3&(Xia50k}Qd?GNADs9SzE zHEvYM;IkXDmB>Fa&mi#G2pW+dcaF;ZOYcy9OZI5dm*6S)5-zYy-x{2#{Bl1G`1hz6 zK<_37%bg6_2S5AhctBUWn8>e-^2m}K(WumoW;5;7ez>XDS$4KaFZk^3vhj8m0goFe z92559-+>H0dKBGhDp}59d^e0T>AT8_My2lhD5kESwZ`tC;EUrHNcj*43yo@At!%&U!~=^6h>pwLE+BoDX9ZJVi|@83K+F%> z>-^d9^Xfd}#EWm|b8iCAp8U<@k&l@Q9Jb0Zuq6sOFXBr(%{K^0-vv;@zdu!IJ}inh1P))Q4YZbWG=A0f$$89HYPC=(M{eA;#|F#wi4a zNZ04KjH#=A+xJXnWnUPkyo-5Jvp3wg)3aW_q8DACj`~5zRu2hG)J|#}koEo(jY{1c z=b5_PqUf9Zwc7>HETZp~CmzlmN^tU?J?4rSFW$NmAvW~BAykkCc^0B$r4Ic&<4_{>b=1DJh`=hszv;-5#= zz6E?(Tz%`1cc+bhvfFNVC(q%(W)^>F-9Dm5Pd$J)`~j~u7MHIM`*TK-&8~HiVryz$ zJwkBu{R((F2I_M7)*?`31#N+)e=)48dAMq)b$ewc@-0~RztdaOV9)j{7(E6gAu zWo78x1Jolq;6diIKH)oDpFMBfqiLL8w0xg4Z`ubvIspKW{E4v}gLNM7PfHgL+qzAG zjhK*o;9?`{;lM!ne;XRY-+I`LJG$ZN`Spvx&6f0W+Eq!t*r1h%KiS+;>u>R9+D5l{ z-)q&1T=h(UYC?t9*XU>)b>3<9rCg7rk`vCt9P^=7f6`yZ!Ugj5Zy2Nx)@}CJx$$a) zow?KAsSElXJx!)E`eGKDkgrzwDT*J3M@J4FRTfwL^tEor0{Za{{eb=Vi(9W0gp9!F z@31(YzGBdU8|zNdtv~RCM%Y^J`?v^y?!a?RN!)m&?40~)rkoy^!XNO~U%n+e=*n3= zZ&CHjB{@+89JPNk_Em157yRq2$|Wh)%k3HiYx-ygpGb?jy!~1@H7rK@YdI4>th_s{ zJl}t@6Dwte?`vKE@{VH^4v_&#(()g@oYP_d(NgpF!-LP6n|;td0Y~e~X9dJ^zV_#F zZ=cF>vPJ!CgO`Aj4 RzLrh3&()uWX$S1G`9D!uo#y}m literal 0 HcmV?d00001 diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.json new file mode 100644 index 00000000..f2dc4e26 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.json @@ -0,0 +1,153 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "glas-harness", + "commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "requests": 2, + "elapsed_ms": 6001.1, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "glas-harness", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "derived_commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "glas-harness", + "commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "status": "applied", + "counts": { + "created": 0, + "updated": 18, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 8, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 6 + }, + "created": [], + "updated": [ + "GLAS-WP-0001", + "GLAS-WP-0002", + "GLAS-WP-0003", + "GLAS-WP-0004", + "GLAS-WP-0005", + "GLAS-WP-0006", + "GLAS-WP-0007", + "GLAS-WP-0008", + "GLAS-WP-0009", + "GLAS-WP-0010", + "GLAS-WP-0011", + "GLAS-WP-0012", + "GLAS-WP-0013", + "GLAS-WP-0014", + "GLAS-WP-0015", + "GLAS-WP-0016", + "GLAS-WP-0017", + "GLAS-WP-ADHOC-2026-09-06" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [ + "GLAS-WP-0016-T01", + "GLAS-WP-0016-T02", + "GLAS-WP-0016-T03", + "GLAS-WP-0016-T04", + "GLAS-WP-0016-T05", + "GLAS-WP-0016-T06", + "GLAS-WP-0017-T01", + "GLAS-WP-0017-T02" + ], + "cancelled_tasks": [], + "created_edges": [], + "removed_edges": [], + "unresolved_edges": [], + "external_edges": [ + { + "workplan": "GLAS-WP-0016", + "from": "GLAS-WP-0016-T04", + "target": "SAND-WP-0015-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1254b220-fd97-5c84-a0e0-ef2de10972c4", + "from_task_id": "6faf1b1c-164d-5d6d-8dad-6cf920a5fd6c", + "to_workplan_id": null, + "to_task_id": "58817ef6-76d9-5e34-908f-c024e6c99f93" + }, + { + "workplan": "GLAS-WP-0012", + "from": "GLAS-WP-0012-T04", + "target": "GLAS-WP-0012-T03", + "relationship_type": "starts_after", + "from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "from_task_id": "3e791432-8f37-54bd-a44a-55eeff11ac19", + "to_workplan_id": null, + "to_task_id": "c660808a-1724-555c-bc59-7318870d3591" + }, + { + "workplan": "GLAS-WP-0012", + "from": "GLAS-WP-0012-T02", + "target": "SAND-WP-0014-T05", + "relationship_type": "starts_after", + "from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "from_task_id": "4209f564-a9ee-57f9-9522-3708988801ef", + "to_workplan_id": null, + "to_task_id": "c6812fd4-bb7b-5be0-8344-a122496fe5bc" + }, + { + "workplan": "GLAS-WP-0012", + "from": "GLAS-WP-0012-T03", + "target": "GLAS-WP-0012-T02", + "relationship_type": "starts_after", + "from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "from_task_id": "c660808a-1724-555c-bc59-7318870d3591", + "to_workplan_id": null, + "to_task_id": "4209f564-a9ee-57f9-9522-3708988801ef" + }, + { + "workplan": "GLAS-WP-0012", + "from": "GLAS-WP-0012-T03", + "target": "SECRETS-WP-0009-T03", + "relationship_type": "starts_after", + "from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "from_task_id": "c660808a-1724-555c-bc59-7318870d3591", + "to_workplan_id": null, + "to_task_id": "f8069c8a-ad6b-5d0b-9a36-c2326699437d" + }, + { + "workplan": "GLAS-WP-0012", + "from": "GLAS-WP-0012-T05", + "target": "GLAS-WP-0012-T04", + "relationship_type": "starts_after", + "from_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "from_task_id": "f7635cf6-e044-52d4-8242-0512e0ccbd7b", + "to_workplan_id": null, + "to_task_id": "3e791432-8f37-54bd-a44a-55eeff11ac19" + } + ], + "refused": [], + "notes": [] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/.custodian-brief.md.worktree new file mode 100644 index 00000000..3ab9cb54 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/.custodian-brief.md.worktree @@ -0,0 +1,55 @@ + +# Custodian Brief — glas-harness + +**Domain:** infotech +**Last synced:** 2026-10-13 20:53 UTC +**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + +## Active Workstreams + +### Versioned Glas profile for the FI daily research brief +Progress: 5/6 done | workplan_id: `1254b220-fd97-5c84-a0e0-ef2de10972c4` + +**Open tasks:** +- ! Prove one sandboxed run and mark the profile ready `6faf1b1c` + *(wait: Live activation needs sand-boxer owner credential delivery (SAND-WP-0015-T04); publication needs the rein-aharness publisher (decision c6f23433, request 780c78d1).)* + +### Governed route for assembly-checkpoint before legacy routing ends +Progress: 1/2 done | workplan_id: `8039eefd-47b9-580b-a488-fb9c3da93f50` + +**Open tasks:** +- ! Confirm the grant shape with assembly-economics `04c50300` + *(wait: Grant-shape confirmation requested 2026-10-13 (reply 2b8b3553); await assembly-economics.)* + +### Drive owner returns for the first production Glas profile +Progress: 2/3 done | workplan_id: `94c02b1f-66ed-588d-bdd7-7158107b85fb` + +**Open tasks:** +- ! Review owner returns against the acceptance gates `68fcc1b4` + *(wait: Await owner returns: secrets-engine config, holder admission, lane approvals and scoped delivery; operator input on placement and spend bounds.)* + +### Prove the first local rein profile end to end +Progress: 2/6 done | workplan_id: `170bf1ae-337f-5553-8d1e-03b07100e08f` + +**Open tasks:** +- ! Resolve and verify the owner runtime, credential, and egress contract `4209f564` + *(wait: Dependency: sand-boxer SAND-WP-0014-T05 with rein-aharness and its credential owner.)* +- ! Review and validate the versioned Glas proof candidate `c660808a` + *(wait: Await the rebuilt runtime artifact carrying profile 1.1.1 started through its owner on railiance01 (SECRETS-WP-0009-T03 step B2).)* +- ! Prove one real bounded rein task inside the sandbox `3e791432` + *(wait: Depends on T03.)* +- ! Publish evidence and mark only the proven profile ready `f7635cf6` + *(wait: Depends on T04.)* + +## Inbox Hygiene + +**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. +**Missing thread_id:** 2 unread message(s) lack supersession chains. + +--- +## MCP Orientation (when available) + +If the state-hub MCP server is reachable, call: +`get_domain_summary("infotech")` +This provides richer cross-domain context. +If the MCP call fails, use this file as your orientation source. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/WORK-RECORDS.md.worktree new file mode 100644 index 00000000..ffe8d74d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/WORK-RECORDS.md.worktree @@ -0,0 +1,97 @@ +# Work Records — glas-harness + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | GLAS-WP-ADHOC-2026-09-06 | finished | — | workplans/ADHOC-2026-09-06.md | +| workplan | GLAS-WP-0001 | finished | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| workplan | GLAS-WP-0002 | finished | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md | +| workplan | GLAS-WP-0003 | finished | — | workplans/GLAS-WP-0003-first-channel-extension.md | +| workplan | GLAS-WP-0004 | finished | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| workplan | GLAS-WP-0005 | finished | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| workplan | GLAS-WP-0006 | finished | — | workplans/GLAS-WP-0006-consumer-actor-validation.md | +| workplan | GLAS-WP-0007 | finished | — | workplans/GLAS-WP-0007-capability-scope-truth.md | +| workplan | GLAS-WP-0008 | finished | — | workplans/GLAS-WP-0008-profile-operational-readiness.md | +| workplan | GLAS-WP-0009 | finished | — | workplans/GLAS-WP-0009-operational-handoff-truth.md | +| workplan | GLAS-WP-0010 | finished | — | workplans/GLAS-WP-0010-transport-and-resolution-hardening.md | +| workplan | GLAS-WP-0011 | finished | — | workplans/GLAS-WP-0011-statehub-bootstrap.md | +| workplan | GLAS-WP-0012 | blocked | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| workplan | GLAS-WP-0013 | finished | — | workplans/GLAS-WP-0013-execution-outcome-evidence.md | +| workplan | GLAS-WP-0014 | finished | — | workplans/GLAS-WP-0014-sandbox-handoff-validation.md | +| workplan | GLAS-WP-0015 | blocked | — | workplans/GLAS-WP-0015-production-dependency-coordination.md | +| workplan | GLAS-WP-0016 | blocked | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| workplan | GLAS-WP-0017 | blocked | — | workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md | +| task | ADHOC-2026-09-06-T01 | done | — | workplans/ADHOC-2026-09-06.md | +| task | ADHOC-2026-09-06-T02 | done | — | workplans/ADHOC-2026-09-06.md | +| task | ADHOC-2026-09-06-T03 | done | — | workplans/ADHOC-2026-09-06.md | +| task | GLAS-WP-0001-T01 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| task | GLAS-WP-0001-T02 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| task | GLAS-WP-0001-T03 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| task | GLAS-WP-0001-T04 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| task | GLAS-WP-0001-T05 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| task | GLAS-WP-0001-T06 | done | — | workplans/GLAS-WP-0001-harness-router-foundation.md | +| task | GLAS-WP-0002-T01 | done | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md | +| task | GLAS-WP-0002-T02 | done | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md | +| task | GLAS-WP-0002-T03 | done | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md | +| task | GLAS-WP-0002-T04 | done | — | workplans/GLAS-WP-0002-observability-and-composability-followups.md | +| task | GLAS-WP-0003-T01 | done | — | workplans/GLAS-WP-0003-first-channel-extension.md | +| task | GLAS-WP-0003-T02 | done | — | workplans/GLAS-WP-0003-first-channel-extension.md | +| task | GLAS-WP-0003-T03 | done | — | workplans/GLAS-WP-0003-first-channel-extension.md | +| task | GLAS-WP-0003-T04 | done | — | workplans/GLAS-WP-0003-first-channel-extension.md | +| task | GLAS-WP-0004-T01 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T02 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T03 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T04 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T05 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T06 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T07 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0004-T08 | done | — | workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md | +| task | GLAS-WP-0005-T01 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| task | GLAS-WP-0005-T02 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| task | GLAS-WP-0005-T03 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| task | GLAS-WP-0005-T04 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| task | GLAS-WP-0005-T05 | done | — | workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md | +| task | GLAS-WP-0006-T01 | done | — | workplans/GLAS-WP-0006-consumer-actor-validation.md | +| task | GLAS-WP-0007-T01 | done | — | workplans/GLAS-WP-0007-capability-scope-truth.md | +| task | GLAS-WP-0007-T02 | done | — | workplans/GLAS-WP-0007-capability-scope-truth.md | +| task | GLAS-WP-0008-T01 | done | — | workplans/GLAS-WP-0008-profile-operational-readiness.md | +| task | GLAS-WP-0008-T02 | done | — | workplans/GLAS-WP-0008-profile-operational-readiness.md | +| task | GLAS-WP-0008-T03 | done | — | workplans/GLAS-WP-0008-profile-operational-readiness.md | +| task | GLAS-WP-0009-T01 | done | — | workplans/GLAS-WP-0009-operational-handoff-truth.md | +| task | GLAS-WP-0009-T02 | done | — | workplans/GLAS-WP-0009-operational-handoff-truth.md | +| task | GLAS-WP-0010-T01 | done | — | workplans/GLAS-WP-0010-transport-and-resolution-hardening.md | +| task | GLAS-WP-0010-T02 | done | — | workplans/GLAS-WP-0010-transport-and-resolution-hardening.md | +| task | GLAS-WP-0010-T03 | done | — | workplans/GLAS-WP-0010-transport-and-resolution-hardening.md | +| task | GLAS-WP-0011-T01 | done | — | workplans/GLAS-WP-0011-statehub-bootstrap.md | +| task | GLAS-WP-0011-T02 | done | — | workplans/GLAS-WP-0011-statehub-bootstrap.md | +| task | GLAS-WP-0011-T03 | done | — | workplans/GLAS-WP-0011-statehub-bootstrap.md | +| task | GLAS-WP-0012-T01 | done | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| task | GLAS-WP-0012-T02 | wait | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| task | GLAS-WP-0012-T03 | wait | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| task | GLAS-WP-0012-T04 | wait | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| task | GLAS-WP-0012-T05 | wait | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| task | GLAS-WP-0012-T06 | done | — | workplans/GLAS-WP-0012-first-local-profile-production-proof.md | +| task | GLAS-WP-0013-T01 | done | — | workplans/GLAS-WP-0013-execution-outcome-evidence.md | +| task | GLAS-WP-0013-T02 | done | — | workplans/GLAS-WP-0013-execution-outcome-evidence.md | +| task | GLAS-WP-0014-T01 | done | — | workplans/GLAS-WP-0014-sandbox-handoff-validation.md | +| task | GLAS-WP-0015-T01 | done | — | workplans/GLAS-WP-0015-production-dependency-coordination.md | +| task | GLAS-WP-0015-T02 | done | — | workplans/GLAS-WP-0015-production-dependency-coordination.md | +| task | GLAS-WP-0015-T03 | wait | — | workplans/GLAS-WP-0015-production-dependency-coordination.md | +| task | GLAS-WP-0016-T01 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| task | GLAS-WP-0016-T02 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| task | GLAS-WP-0016-T03 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| task | GLAS-WP-0016-T04 | wait | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| task | GLAS-WP-0016-T05 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| task | GLAS-WP-0016-T06 | done | — | workplans/GLAS-WP-0016-fi-research-brief-profile.md | +| task | GLAS-WP-0017-T01 | done | — | workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md | +| task | GLAS-WP-0017-T02 | wait | — | workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md | +| intake | GLAS-IN-0001 | done | blue | docs/intakes/residuals.md | +| intake | GLAS-IN-0002 | todo | red | docs/intakes/residuals.md | +| intake | GLAS-IN-0003 | todo | green | docs/intakes/residuals.md | +| intake | GLAS-IN-0004 | todo | green | docs/intakes/residuals.md | +| intake | GLAS-IN-0005 | done | red | docs/intakes/residuals.md | diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/originals.json new file mode 100644 index 00000000..dff7c522 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-backup/originals.json @@ -0,0 +1,10 @@ +[ + { + "path": ".custodian-brief.md", + "index": "100644 3ab9cb5489704c7140420e489d2e89c46fd0ce92 0\t.custodian-brief.md" + }, + { + "path": "WORK-RECORDS.md", + "index": "100644 5c81da3eaf946e218edc0dc7b3022191de1a82ee 0\tWORK-RECORDS.md" + } +] diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-commit.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-commit.json new file mode 100644 index 00000000..8770ccd1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-commit.json @@ -0,0 +1,13 @@ +{ + "exit_code": 0, + "commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "base": "7357115c8311e55ee3d495f5266f501a17ec3c89", + "files": [ + { + "path": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md", + "sha256": "23f97bc183bef2b0f38eb40c64bc0bb010df1c1eb4596ff3b5e0f73da7c2fcfc" + } + ], + "stdout": "[main c8751c9] docs(identity): point current metered gate at issued HARNESS task\n 1 file changed, 1 insertion(+), 1 deletion(-)\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 1, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-manifest.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-manifest.json new file mode 100644 index 00000000..b3b02136 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/publication-manifest.json @@ -0,0 +1,11 @@ +{ + "owner": "glas-harness", + "base_revision": "7357115c8311e55ee3d495f5266f501a17ec3c89", + "message": "docs(identity): point current metered gate at issued HARNESS task", + "files": [ + { + "path": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md", + "sha256": "23f97bc183bef2b0f38eb40c64bc0bb010df1c1eb4596ff3b5e0f73da7c2fcfc" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/source-before.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/source-before.json new file mode 100644 index 00000000..a7e8e8b9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/source-before.json @@ -0,0 +1,8 @@ +{ + "observed_at": "2026-10-17T10:57:25.546281+00:00", + "head": "7357115c8311e55ee3d495f5266f501a17ec3c89", + "status": "M .custodian-brief.md\n M WORK-RECORDS.md\n", + "instructions_sha256": "sha256:f7d33c8d84f31c2a9b62e3ffdc2476da797fa1d0732cff17dc49d12e964f1fc5", + "source_sha256": "sha256:881ab0f5ba3bb43f5404c8f4cd23f9628e014992ba88fc13f541f0fa8b7b1eaa", + "index_sha256": "sha256:be6359bc304b09f0a3479e8c3cab02483c42a11c57aedf222000c153693b9843" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/verified-bindings.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/verified-bindings.json new file mode 100644 index 00000000..0914eaa8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/verified-bindings.json @@ -0,0 +1,54 @@ +{ + "observed_at": "2026-10-17T11:27:45.427504+00:00", + "status": "source_and_task_bindings_verified", + "source_file": "workplans/GLAS-WP-0012-first-local-profile-production-proof.md", + "source_sha256": "sha256:23f97bc183bef2b0f38eb40c64bc0bb010df1c1eb4596ff3b5e0f73da7c2fcfc", + "all_source_UUIDs_preserved": true, + "all_task_fields_preserved_except_approved_SAND_blocking_label": true, + "tasks": [ + { + "record_id": "GLAS-WP-0012-T01", + "id": "711aeb7e-4664-5078-8c65-3fe6f46f7999", + "status": "done", + "needs_human": false, + "workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f" + }, + { + "record_id": "GLAS-WP-0012-T02", + "id": "4209f564-a9ee-57f9-9522-3708988801ef", + "status": "wait", + "needs_human": false, + "workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f" + }, + { + "record_id": "GLAS-WP-0012-T03", + "id": "c660808a-1724-555c-bc59-7318870d3591", + "status": "wait", + "needs_human": false, + "workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f" + }, + { + "record_id": "GLAS-WP-0012-T04", + "id": "3e791432-8f37-54bd-a44a-55eeff11ac19", + "status": "wait", + "needs_human": false, + "workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f" + }, + { + "record_id": "GLAS-WP-0012-T05", + "id": "f7635cf6-e044-52d4-8242-0512e0ccbd7b", + "status": "wait", + "needs_human": false, + "workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f" + }, + { + "record_id": "GLAS-WP-0012-T06", + "id": "d0c26709-549f-540a-8250-1fd1b2e4960a", + "status": "done", + "needs_human": false, + "workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f" + } + ], + "historical_prose_preserved": true, + "native_action_by_this_subtask": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.postimage.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.postimage.md new file mode 100644 index 00000000..221e6c3a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.postimage.md @@ -0,0 +1,450 @@ +--- +id: GLAS-WP-0012 +type: workplan +title: "Prove the first local rein profile end to end" +domain: infotech +repo: glas-harness +status: blocked +flavor: implementation +owner: codex +topic_slug: first-local-profile-production-proof +created: "2026-09-05" +updated: "2026-09-27" +state_hub_workstream_id: "170bf1ae-337f-5553-8d1e-03b07100e08f" +--- + +# Prove the first local rein profile end to end + +## Context and scope + +Follow up the Claude-route portion of live residual `GLAS-IN-0002`, originating +in finished `GLAS-WP-0005`. Boundary hardening is committed at `63a7f9f` and +proved with a deterministic non-secret dispatch. That proof did not execute +the real rein CLI or make a model call. + +Start from `harness.agent-dev-local@1.0.0` (rein-aharness, +`claude-sonnet-4-6`, `claude-code-cli`, `green-commit-only`). Review a new +versioned candidate after the owner runtime contract is available. Keep the +existing blocked selection as the rollback pin. The open-weight profile and +remote profile do not acquire readiness from this workplan. + +Glas owns profile selection, its adapter, and acceptance evidence. Sand-boxer +owns runtime provisioning, execution environment, isolation, egress enforcement, +and teardown. The selected rein and credential owner own authentication and +credential acquisition. Use existing owner work `SAND-WP-0014-T05`; its current +OpenRouter dependency must be distinguished from this first Claude-route proof. + +## Establish the exact local baseline and acceptance requirements + +```task +id: GLAS-WP-0012-T01 +status: done +priority: high +state_hub_task_id: "711aeb7e-4664-5078-8c65-3fe6f46f7999" +``` + +Completed 2026-09-05. Reviewed Glas `63a7f9f`, sand-boxer `b6655d8`, and +rein-aharness `1429db5`. Added a reproducible non-secret owner-execution runtime +inventory and the [acceptance contract](../docs/local-profile-acceptance.md). + +The baseline can discover Python, Git, and a `claude` command. It cannot +discover `rein-aharness`, its Python module, or `llm_connect`. Command discovery +alone does not prove that Claude can start or authenticate. The namespace has +only loopback; declared egress and credential route references are empty. +Owner execution and workspace teardown pass. The baseline is therefore +insufficient for a real rein run. + +Reviewed the plan against current implementation. Local preparation is done; +remaining execution waits on the owner inputs in T02. + +## Resolve and verify the owner runtime, credential, and egress contract + +```task +id: GLAS-WP-0012-T02 +status: wait +depends_on: [SAND-WP-0014-T05] +blocking_reason: "Dependency: sand-boxer SAND-WP-0014-T05 with rein-aharness and its credential owner." +priority: high +state_hub_task_id: "4209f564-a9ee-57f9-9522-3708988801ef" +``` + +Dependency: sand-boxer `SAND-WP-0014-T05`, with rein-aharness and its credential +owner. Required deliverables are listed in `docs/local-profile-acceptance.md`: + +- Exact runtime artifact/revision, in-sandbox entrypoints and dependencies, + sanitized environment, private writable state, and deployment/host identity. +- A Claude-compatible catalog credential route and owner implementation that + delivers it to the selected runtime. An environment label containing route + references is not credential delivery. +- An owner-defined sandbox profile with explicit enforced provider egress, + DNS/TLS requirements, and negative egress tests. Editing an egress list alone + does not provide connectivity in the current loopback-only implementation. +- Non-secret startup, identity, source-absence, and cleanup evidence through + the same manager/service path the gateway will use. + +Done when these deliverables exist at reviewable revisions and their owner +proofs pass. No rein installation in the source checkout, host home mount, +credential injection from the interactive shell, or unrestricted network +substitution is an acceptance path. + +2026-09-05 owner progress: SAND-WP-0015 implemented digest-pinned standalone +Python runtime mounting and private namespace state. Real rein CLI startup, +read-only runtime, source absence, clean worktree, state persistence across +exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132 +tests pass. This completes the candidate runtime mechanism, not production +selection. Authentication lane, credential delivery/revocation, provider egress, +pinning the Claude executable, and deployed profile review remain open. The +credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See +[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner +CCR-2026-0016 (in flight). Organization/key metadata is supplied and the user saved the key in OpenBao. +A metadata-only owner check confirmed live version 2 on 2026-09-05, without +reading the value. Custody handoff is complete. Verified machine binding, +protected runtime delivery, workspace scope/budget and provider egress remain +outstanding; provider authentication has not been tested. +See docs/local-profile-acceptance.md. + +## Review and validate the versioned Glas proof candidate + +```task +id: GLAS-WP-0012-T03 +status: wait +depends_on: [GLAS-WP-0012-T02, SECRETS-WP-0009-T03] +priority: high +blocking_reason: "Await the rebuilt runtime artifact carrying profile 1.1.1 started through its owner on railiance01 (SECRETS-WP-0009-T03 step B2)." +state_hub_task_id: "c660808a-1724-555c-bc59-7318870d3591" +``` + +Depends on T02. Prepare `harness.agent-dev-local@1.1.0` only once the real +sandbox profile and credential route are known. Keep the rein/model route and +tool profile explicit; choose bounded proof limits no greater than the current +900 seconds / 60,000 tokens. Record runtime and sandbox revisions and the +validated host scope in evidence. Account for dependency versions that are not +represented directly in the Glas profile schema. + +Use `unverified` only after known blockers are resolved, to label the bounded +real proof. Validate schema, capabilities, route propagation, timeout behavior, +and refusal of the old blocked version. Version coexistence must make an +unversioned selection ambiguous rather than silently changing consumers. + +Done when the exact candidate resolves, the real runtime starts through its +owner, the focused tests and full suite pass, and rollback to the blocked +`harness.agent-dev-local@1.0.0` pin is documented. + +2026-09-21 candidate: `profiles/harness.agent-dev-local-1.1.0.yaml`, readiness +`unverified` (evidence_ref GLAS-WP-0012-T03), `profile.bwrap-local`, no +credential route refs, claude-sonnet-4-6, 900 s / 60,000 tokens, max_turns 30, +max_budget_usd 5.0. The provider key stays with rein-aharness MessagesOwner +outside bwrap (metered-once); the owner bootstrap's sandbox, model and +credential-route checks accept it. max_budget_usd matches the operator-accepted +spend envelope hfact-glas-anthropic-2026-09 (Informed Decision +infd-20260921-b01, approval ba5ce2d8). Unpinned selection is now ambiguous and +1.0.0 stays blocked; rollback is pinning 1.0.0. 134 tests pass. Remaining for +done: the rebuilt runtime artifact carrying this profile starts through its +owner on railiance01 (SECRETS-WP-0009-T03 step B2). + +2026-09-23 the candidate is now `harness.agent-dev-local@1.1.1` (`claude-sonnet-5`, +otherwise identical). 1.1.0 is blocked, and rollback is still pinning 1.0.0. +Reviewed 2026-09-24: the catalog resolves 1.1.1 as unverified, and 134 tests pass. +The done condition is unchanged. It needs runtime `2cfc7b5f` rebuilt with 1.1.1 +and started through its owner. + +## Prove one real bounded rein task inside the sandbox + +```task +id: GLAS-WP-0012-T04 +status: wait +depends_on: [GLAS-WP-0012-T03] +blocking_reason: "Depends on T03." +priority: high +state_hub_task_id: "3e791432-8f37-54bd-a44a-55eeff11ac19" +``` + +Depends on T03. Run the actual `ReinAharness` adapter and installed +`rein-aharness` CLI with Claude through the candidate profile on a disposable +Git fixture. Do not substitute deterministic dispatch or change the source +checkout to satisfy the task. Verify the acceptance assertions in the contract, +including exactly one intended commit, a clean final tree, unchanged/inaccessible +host source, exact identity, bounded duration, task cleanup, and destruction. + +Collect and validate the sandbox artifact before gateway teardown removes the +workspace. Implement the smallest necessary proof observer in the acceptance +fixture; direct evidence must distinguish actual content validation from a +reported commit SHA. Preserve compact value-free evidence only. + +Done when the bounded real run and relevant failure/cleanup checks pass with +the exact selected profile/runtime pins and credential route identified. + +## Publish evidence and mark only the proven profile ready + +```task +id: GLAS-WP-0012-T05 +status: wait +depends_on: [GLAS-WP-0012-T04] +blocking_reason: "Depends on T04." +priority: high +state_hub_task_id: "f7635cf6-e044-52d4-8242-0512e0ccbd7b" +``` + +Depends on T04. Update only the proven candidate to `ready` with evidence that +identifies the host/runtime scope, credential route, egress policy, revisions, +limits, and rollback. Run catalog validation and regression checks. Do not +enable production schedules as a side effect of this proof. + +Update `GLAS-IN-0002` with the Claude acceptance result. Keep its open-weight +portion live, or split that remaining work into a separately registered record +before closing the intake. Synchronize work records and log progress. Finish +this workplan only when the first profile is proven and residuals remain live. + +## Prepare the real-rein acceptance runner + +```task +id: GLAS-WP-0012-T06 +status: done +priority: high +state_hub_task_id: "d0c26709-549f-540a-8250-1fd1b2e4960a" +``` + +Independent preparation for T04 while T02 remains blocked. Add a disposable +fixture that delegates actual dispatch to the catalog-built ReinAharness, +validates the commit and artifact through owner execution before teardown, +checks the host source and cleanup, and emits bounded evidence without model +output or credential values. Refuse blocked or unpinned profiles before +creating a sandbox. Test negative artifact cases and the refusal path. This +runner does not itself satisfy T04 or change readiness. + +Completed 2026-09-05. `scripts/prove-local-profile.py` delegates real dispatch +and observes content/commit acceptance before teardown. It verifies exactly one +new commit, expected paths and committed/worktree content, a clean tree, +source absence, exact child identity, private task mode/removal, and host-source +integrity plus workspace destruction. It emits bounded evidence and has no +readiness override. `tests/test_local_profile_proof.py`: 20 focused tests pass; +full suite: 101 passed; catalog validation passes. A real CLI invocation against +`harness.agent-dev-local@1.0.0` returned `OperationallyBlockedProfileError` +without creating a sandbox. T02–T05 remain waiting on the owner dependencies; +no real model run or readiness promotion is claimed. + +## Acceptance + +One version-pinned local profile runs its actual rein/model task entirely in +the declared sandbox, produces validated local output, and tears down cleanly. +Its readiness describes the proven runtime scope. Other profile readiness and +consumer schedules remain independently governed. + +## 2026-09-05 egress owner return + +Owner-controlled HTTPS egress is implemented and live-tested through both the +extension and a persisted manager: provider TLS/HTTP response, undeclared-host +and direct-IP denial, isolated namespace and proxy/workspace cleanup passed. +See [egress evidence](../docs/evidence/GLAS-WP-0012-egress-2026-09-05.md). +T02 remains waiting on machine auth, protected credential delivery, the pinned +Claude executable and the combined production acceptance. Profiles remain blocked. + +## 2026-09-05 credential owner return + +Sand-boxer credential transport is implemented and proved with synthetic +provider sandbox 880f749e. Owner config binds exact profile/project/actor and +run id; unknown routes refuse, shell API-key fallback is stripped, only the +workload child receives the value, and output redaction precedes truncation. +Tests: sand-boxer171, secrets-engine226, Glas101 pass. Native data-only read +policy/AppRole proposal and activation now live in SECRETS-WP-0009. Its +production exec refuses before OpenBao because durable access-engine decision +records and scoped service authority remain unavailable. T02 remains waiting +on that activation, pinned Claude startup and real provider/task acceptance. + +## 2026-09-06 credential owner update + +Reviewed secrets-engine message `3bd23bc9-e863-4f1f-8c76-415812ec0656`. +Owner reports the local authorization join implemented at `627810b`. Remaining +native activation depends on approval-engine serving the durable +ActionAuthorization claim endpoint and access-engine serving Check, followed +by configuration, per-lane approval and positive/negative verification. +State Hub decisions are not a substitute for the durable authorization object. +SECRETS-WP-0009-T03 and this plan's T02 remain waiting; runtime pinning and +combined real proof remain required. No readiness change or real-key read. + +## 2026-09-06 authorization contract and policy publication + +Reviewed owner commits `7b4b9e3` and `083bee7` and FLEX-WP-0021. Gate-house +GH-DEC-2026-005 resolved the contract: secrets-engine now validates the +approval-claim and decision envelope separately and removed the incorrect +State Hub authority requirement. Flex-auth published +`secrets-engine.catalog-lane.lifecycle` v1; T01/T02 are done. + +Remaining owner gates are real decision/digest verification (FLEX-WP-0021-T03), +consumer service deployment and handoff (T04/T05), approval-engine deployment, +production service identity and verified lane activation. Publication is not +deployment. T02 stays waiting, and runtime pinning and combined acceptance +remain required. No new owner inbox message or activation evidence was found +in this review. + +## 2026-09-06 digest verification follow-up + +Reviewed secrets-engine `6e9c152` and `925d028`: owner corrected correlation +field handling in the flex-auth digest and refreshed fixtures. Its tests also +record an unresolved approval/native action-vocabulary and embedded-claim +digest mismatch for dual-control requests. This is owner integration evidence, +not successful live activation; SECRETS-WP-0009-T03 remains wait. No new +activation receipt was found in the Glas inbox. T02 remains waiting. + +## 2026-09-06 authorization-chain owner return + +Reviewed secrets-engine `f62d3fe` / `64aeec9`. Owner reports claim → Check → +consume → backend integration against a throwaway OpenBao, including denial, +unreachable service, invalid claim, missing digest, consume conflict and action +mismatch refusal before backend access. Authorization transport is stubbed; +wire shapes use published flex-auth fixtures. Do not describe this as a live +production service or Anthropic delivery proof. + +Owner now identifies deployment/configuration as the remaining live gate: +consumer PDP service and approval-engine rollout, production service +credentials, deployed policy pin and per-lane authorization id. +SECRETS-WP-0009-T03 remains wait. Earlier digest-defect notes are historical; +use this latest owner return for the integration status. Native lane positive/ +negative access checks, pinned Claude startup, provider scope/budget inputs and +combined Glas acceptance remain outstanding. T02–T05 stay wait. + +Review found no pending local changes or new inbox messages. Corrected stale +README wording that still called owner execution missing; the implemented +mechanism and its separate proofs do not change profile readiness. + +## 2026-09-06 production deployment action + +User authorized production deployment. Dedicated flex-auth-secrets-engine Helm +release is available 1/1 at revision 1; five policy fixtures and allowed/denied +network probes passed. CI image is digest-pinned; existing consumers unchanged. +Caller authentication remains warn pending identity adoption. See +[deployment evidence](../history/2026-09-06-174000-production-deployment.md). +Approval-engine remains undeployed: live KeyCape clients and audit sender are +absent, the tenant contract needs alignment, and a release digest is required. +Corrected its stale issuer/JWKS deployment inputs. No production credential +lane or real Claude run was activated; T02 remains wait. + +## Production dependency coordination + +GLAS-WP-0015 now tracks exact owner handoffs and return receipts from Glas. +The requests in docs/production-dependency-handoffs.md reuse existing owner +work: tenant agreement and client custody, KeyCape rollout, audit source +onboarding, approval release, native lane activation and pinned combined +runtime. Image/runtime preparation can proceed in parallel. The runner's +project glas-local-proof must be reconciled with the owner route example's +project glas-harness before the exact delivery binding is selected. Owner +handoffs were sent after explicit authorization; GLAS-WP-0015 records all seven +receipt IDs and tracks replies. This plan's T02 remains wait. + +## Verified owner follow-up — 2026-09-06 + +Glas reviewed six owner acknowledgements in GLAS-WP-0015. Project binding is +resolved to agt/glas-local-proof at sand-boxer 23d0c2b; the combined profile +source is available, but Claude is not pinned. The deployed policy was found +to lack tenant denial at v1; the owner correction v2 is now deployed at Helm +revision 2 and six live Check fixtures pass, including wrong_tenant denial. +Tenant choice, workstation caller access, audit load-bearing schema/admission, +identity/custody and native activation remain gates. T02 remains wait. + + +Tenant decision update (2026-09-06): operator approved `tenant:platform` for the +approval dependency chain as the platform management/services tenant. See +`docs/platform-tenant-decision.md`. The choice blocker is resolved; exact owner +configuration alignment and verification remain part of T02 before readiness. + + +Later deployment progress (2026-09-06): KeyCape/approval source tenant alignment +verified, approval release published and pinned, audit T03 complete, dedicated +PDP revision 3 enforces adopted short-lived caller identity. See GLAS-WP-0015 +and its evidence receipts. T02 remains wait until remaining owner admission and +runtime gates are verified; no real model run or readiness promotion. + + +## Pinned Claude startup progress — 2026-09-06 + +Advanced sand-boxer SAND-WP-0015-T05 independently of custody: runtime builder +now copies only an explicitly digest-pinned native Claude executable. Selected +installed Claude 2.1.263, binary digest +26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba; +complete candidate runtime digest +5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922. +Sandbox f8821ec2 passed actual Claude --version, rein CLI/import, read-only +runtime, private HOME/state persistence, source absence, clean tree and teardown +with owner proxy environment present. Lint and all 175 sand-boxer tests pass. +Evidence: docs/evidence/GLAS-WP-0015-claude-startup-2026-09-06.json. + +This resolves candidate binary pin/startup, not protected runtime deployment, +Claude provider-request compatibility, credential delivery or a real model run. +The candidate is in /tmp; no production profile readiness changed. Existing +credential and acceptance tasks remain open. No new owner replies at session start. + + +## Protected local artifact return — 2026-09-08 + +SAND-WP-0015-T06 is done. The previously pinned combined artifact is installed +unchanged in owner UID 1000's mode-0700 runtime store on bnt-lap001: +`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +Complete artifact digest remains +`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +This is the existing owner-controlled local artifact contract, not root-owned +system storage or Railiance placement. Do not rebuild this accepted candidate +merely to move it out of /tmp. + +The installed-path sandbox `51b59587` proves actual Claude 2.1.263 and rein +startup, read-only runtime, source absence, clean Git, private state persistence, +loopback-only interfaces, and workspace/proxy removal. No credential references +or model request were used. Sand-boxer `make check`: lint clean, 188 tests pass. +Source return: 3e49a98a0e2c4a64539a5ccd674be8cd67ac9845; receipt in +`sand-boxer/docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`. + +T02 remains wait for trusted owner execution configuration, native credentials +and real-provider evidence. T03-T06 retain candidate review, real-model run, +readiness and recovery obligations. No profile readiness or schedule changes. + +2026-09-23 candidate superseded before use: operator chose `claude-sonnet-5`. +`harness.agent-dev-local@1.1.1` is identical to 1.1.0 except the model; 1.1.0 is +now `blocked`. Runtime `2cfc7b5f` bundles the earlier 1.1.0 copy (profile sha +`e84b9d0f…`) and must be rebuilt with this revision and placed again +(SECRETS-WP-0009-T03). Claude CLI 2.1.266 in that runtime lists +`claude-sonnet-5` in its model registry (static check). 134 tests pass. + +## 2026-09-27 loose-ends review + +Reviewed for locally finishable work. No new owner reply advances T02 beyond +the 2026-09-23 secrets-engine status already recorded in GLAS-WP-0015-T03. +T03's remaining done condition (runtime `2cfc7b5f` rebuilt with 1.1.1 and +started through its owner on railiance01, SECRETS-WP-0009-T03 step B2) and +T04/T05 all require that external owner delivery. Nothing in this repo can +advance them today; `status: blocked` stands unchanged. Re-review when the +runtime rebuild/placement or owner authentication lands. + + +## EMERGENT-WP-0002 proof requirements — 2026-10-03 + +Scoped review and local observed-model correction: +`docs/evidence/2026-10-03-emergent-session-readiness-review.md`. +T04 retains actual native-provider startup and continuity acceptance, including +reload after real resume/compaction, provider/repository changes and exact +available model/session metadata. The current lifecycle exposes no continuity +event API. Existing owner-delivery blockers and all task/readiness states remain; +local deterministic tests are not governed provider or isolation acceptance. + + +## 2026-10-16 NetKingdom isolated integration preparation + +Prepared, without owner deployment or readiness promotion, a Glas change that +separates credential-free housekeeping commands from explicit rein workload +execution. Both concrete adapters use the workload path; SSH selections with +credential routes refuse because that transport has no owner delivery contract. +Full regression: 141 passed. Real disposable bwrap/Glas transport proof passes +synthetic host-file denial, inherited credential environment and subprocess +denial, workload-only delivery, redaction, subsequent-command absence and +teardown. No provider/model call or real credential read occurred. + +Latest owner dependency sources supersede the stale missing-lane account: +September 27 native lanes were activated and revoked; corrected immutable +owner runtime is `818b1b7c…` (October 15 startup proof), not yet installed or +admitted on Railiance. HARNESS-WP-0008-T07 retains memo lifecycle acceptance, +installation, rehearsal, renewal/pin updates, native approvals and bounded +successful model/tool/commit acceptance. Any subsequent build containing this +patch has a different source/artifact pin requiring owner admission. + +This is a reviewable patch in Custodian's NetKingdom change bundle; no canonical +source synchronization or workplan task completion is implied. CUST-WP-0073 +continues to require admission of the actual interactive assignment, including +its existing host credential and external tool paths, not a disposable fixture. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.preimage.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.preimage.md new file mode 100644 index 00000000..4383544a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/glas-harness/workplan.preimage.md @@ -0,0 +1,450 @@ +--- +id: GLAS-WP-0012 +type: workplan +title: "Prove the first local rein profile end to end" +domain: infotech +repo: glas-harness +status: blocked +flavor: implementation +owner: codex +topic_slug: first-local-profile-production-proof +created: "2026-09-05" +updated: "2026-09-27" +state_hub_workstream_id: "170bf1ae-337f-5553-8d1e-03b07100e08f" +--- + +# Prove the first local rein profile end to end + +## Context and scope + +Follow up the Claude-route portion of live residual `GLAS-IN-0002`, originating +in finished `GLAS-WP-0005`. Boundary hardening is committed at `63a7f9f` and +proved with a deterministic non-secret dispatch. That proof did not execute +the real rein CLI or make a model call. + +Start from `harness.agent-dev-local@1.0.0` (rein-aharness, +`claude-sonnet-4-6`, `claude-code-cli`, `green-commit-only`). Review a new +versioned candidate after the owner runtime contract is available. Keep the +existing blocked selection as the rollback pin. The open-weight profile and +remote profile do not acquire readiness from this workplan. + +Glas owns profile selection, its adapter, and acceptance evidence. Sand-boxer +owns runtime provisioning, execution environment, isolation, egress enforcement, +and teardown. The selected rein and credential owner own authentication and +credential acquisition. Use existing owner work `SAND-WP-0014-T05`; its current +OpenRouter dependency must be distinguished from this first Claude-route proof. + +## Establish the exact local baseline and acceptance requirements + +```task +id: GLAS-WP-0012-T01 +status: done +priority: high +state_hub_task_id: "711aeb7e-4664-5078-8c65-3fe6f46f7999" +``` + +Completed 2026-09-05. Reviewed Glas `63a7f9f`, sand-boxer `b6655d8`, and +rein-aharness `1429db5`. Added a reproducible non-secret owner-execution runtime +inventory and the [acceptance contract](../docs/local-profile-acceptance.md). + +The baseline can discover Python, Git, and a `claude` command. It cannot +discover `rein-aharness`, its Python module, or `llm_connect`. Command discovery +alone does not prove that Claude can start or authenticate. The namespace has +only loopback; declared egress and credential route references are empty. +Owner execution and workspace teardown pass. The baseline is therefore +insufficient for a real rein run. + +Reviewed the plan against current implementation. Local preparation is done; +remaining execution waits on the owner inputs in T02. + +## Resolve and verify the owner runtime, credential, and egress contract + +```task +id: GLAS-WP-0012-T02 +status: wait +depends_on: [SAND-WP-0014-T05] +blocking_reason: "Dependency: sand-boxer SAND-WP-0014-T05 with rein-aharness and its credential owner." +priority: high +state_hub_task_id: "4209f564-a9ee-57f9-9522-3708988801ef" +``` + +Dependency: sand-boxer `SAND-WP-0014-T05`, with rein-aharness and its credential +owner. Required deliverables are listed in `docs/local-profile-acceptance.md`: + +- Exact runtime artifact/revision, in-sandbox entrypoints and dependencies, + sanitized environment, private writable state, and deployment/host identity. +- A Claude-compatible catalog credential route and owner implementation that + delivers it to the selected runtime. An environment label containing route + references is not credential delivery. +- An owner-defined sandbox profile with explicit enforced provider egress, + DNS/TLS requirements, and negative egress tests. Editing an egress list alone + does not provide connectivity in the current loopback-only implementation. +- Non-secret startup, identity, source-absence, and cleanup evidence through + the same manager/service path the gateway will use. + +Done when these deliverables exist at reviewable revisions and their owner +proofs pass. No rein installation in the source checkout, host home mount, +credential injection from the interactive shell, or unrestricted network +substitution is an acceptance path. + +2026-09-05 owner progress: SAND-WP-0015 implemented digest-pinned standalone +Python runtime mounting and private namespace state. Real rein CLI startup, +read-only runtime, source absence, clean worktree, state persistence across +exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132 +tests pass. This completes the candidate runtime mechanism, not production +selection. Authentication lane, credential delivery/revocation, provider egress, +pinning the Claude executable, and deployed profile review remain open. The +credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See +[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner +CCR-2026-0016 (in flight). Organization/key metadata is supplied and the user saved the key in OpenBao. +A metadata-only owner check confirmed live version 2 on 2026-09-05, without +reading the value. Custody handoff is complete. Verified machine binding, +protected runtime delivery, workspace scope/budget and provider egress remain +outstanding; provider authentication has not been tested. +See docs/local-profile-acceptance.md. + +## Review and validate the versioned Glas proof candidate + +```task +id: GLAS-WP-0012-T03 +status: wait +depends_on: [GLAS-WP-0012-T02, SECRETS-WP-0009-T03] +priority: high +blocking_reason: "Await the rebuilt runtime artifact carrying profile 1.1.1 started through its owner on railiance01 (SECRETS-WP-0009-T03 step B2)." +state_hub_task_id: "c660808a-1724-555c-bc59-7318870d3591" +``` + +Depends on T02. Prepare `harness.agent-dev-local@1.1.0` only once the real +sandbox profile and credential route are known. Keep the rein/model route and +tool profile explicit; choose bounded proof limits no greater than the current +900 seconds / 60,000 tokens. Record runtime and sandbox revisions and the +validated host scope in evidence. Account for dependency versions that are not +represented directly in the Glas profile schema. + +Use `unverified` only after known blockers are resolved, to label the bounded +real proof. Validate schema, capabilities, route propagation, timeout behavior, +and refusal of the old blocked version. Version coexistence must make an +unversioned selection ambiguous rather than silently changing consumers. + +Done when the exact candidate resolves, the real runtime starts through its +owner, the focused tests and full suite pass, and rollback to the blocked +`harness.agent-dev-local@1.0.0` pin is documented. + +2026-09-21 candidate: `profiles/harness.agent-dev-local-1.1.0.yaml`, readiness +`unverified` (evidence_ref GLAS-WP-0012-T03), `profile.bwrap-local`, no +credential route refs, claude-sonnet-4-6, 900 s / 60,000 tokens, max_turns 30, +max_budget_usd 5.0. The provider key stays with rein-aharness MessagesOwner +outside bwrap (metered-once); the owner bootstrap's sandbox, model and +credential-route checks accept it. max_budget_usd matches the operator-accepted +spend envelope hfact-glas-anthropic-2026-09 (Informed Decision +infd-20260921-b01, approval ba5ce2d8). Unpinned selection is now ambiguous and +1.0.0 stays blocked; rollback is pinning 1.0.0. 134 tests pass. Remaining for +done: the rebuilt runtime artifact carrying this profile starts through its +owner on railiance01 (SECRETS-WP-0009-T03 step B2). + +2026-09-23 the candidate is now `harness.agent-dev-local@1.1.1` (`claude-sonnet-5`, +otherwise identical). 1.1.0 is blocked, and rollback is still pinning 1.0.0. +Reviewed 2026-09-24: the catalog resolves 1.1.1 as unverified, and 134 tests pass. +The done condition is unchanged. It needs runtime `2cfc7b5f` rebuilt with 1.1.1 +and started through its owner. + +## Prove one real bounded rein task inside the sandbox + +```task +id: GLAS-WP-0012-T04 +status: wait +depends_on: [GLAS-WP-0012-T03] +blocking_reason: "Depends on T03." +priority: high +state_hub_task_id: "3e791432-8f37-54bd-a44a-55eeff11ac19" +``` + +Depends on T03. Run the actual `ReinAharness` adapter and installed +`rein-aharness` CLI with Claude through the candidate profile on a disposable +Git fixture. Do not substitute deterministic dispatch or change the source +checkout to satisfy the task. Verify the acceptance assertions in the contract, +including exactly one intended commit, a clean final tree, unchanged/inaccessible +host source, exact identity, bounded duration, task cleanup, and destruction. + +Collect and validate the sandbox artifact before gateway teardown removes the +workspace. Implement the smallest necessary proof observer in the acceptance +fixture; direct evidence must distinguish actual content validation from a +reported commit SHA. Preserve compact value-free evidence only. + +Done when the bounded real run and relevant failure/cleanup checks pass with +the exact selected profile/runtime pins and credential route identified. + +## Publish evidence and mark only the proven profile ready + +```task +id: GLAS-WP-0012-T05 +status: wait +depends_on: [GLAS-WP-0012-T04] +blocking_reason: "Depends on T04." +priority: high +state_hub_task_id: "f7635cf6-e044-52d4-8242-0512e0ccbd7b" +``` + +Depends on T04. Update only the proven candidate to `ready` with evidence that +identifies the host/runtime scope, credential route, egress policy, revisions, +limits, and rollback. Run catalog validation and regression checks. Do not +enable production schedules as a side effect of this proof. + +Update `GLAS-IN-0002` with the Claude acceptance result. Keep its open-weight +portion live, or split that remaining work into a separately registered record +before closing the intake. Synchronize work records and log progress. Finish +this workplan only when the first profile is proven and residuals remain live. + +## Prepare the real-rein acceptance runner + +```task +id: GLAS-WP-0012-T06 +status: done +priority: high +state_hub_task_id: "d0c26709-549f-540a-8250-1fd1b2e4960a" +``` + +Independent preparation for T04 while T02 remains blocked. Add a disposable +fixture that delegates actual dispatch to the catalog-built ReinAharness, +validates the commit and artifact through owner execution before teardown, +checks the host source and cleanup, and emits bounded evidence without model +output or credential values. Refuse blocked or unpinned profiles before +creating a sandbox. Test negative artifact cases and the refusal path. This +runner does not itself satisfy T04 or change readiness. + +Completed 2026-09-05. `scripts/prove-local-profile.py` delegates real dispatch +and observes content/commit acceptance before teardown. It verifies exactly one +new commit, expected paths and committed/worktree content, a clean tree, +source absence, exact child identity, private task mode/removal, and host-source +integrity plus workspace destruction. It emits bounded evidence and has no +readiness override. `tests/test_local_profile_proof.py`: 20 focused tests pass; +full suite: 101 passed; catalog validation passes. A real CLI invocation against +`harness.agent-dev-local@1.0.0` returned `OperationallyBlockedProfileError` +without creating a sandbox. T02–T05 remain waiting on the owner dependencies; +no real model run or readiness promotion is claimed. + +## Acceptance + +One version-pinned local profile runs its actual rein/model task entirely in +the declared sandbox, produces validated local output, and tears down cleanly. +Its readiness describes the proven runtime scope. Other profile readiness and +consumer schedules remain independently governed. + +## 2026-09-05 egress owner return + +Owner-controlled HTTPS egress is implemented and live-tested through both the +extension and a persisted manager: provider TLS/HTTP response, undeclared-host +and direct-IP denial, isolated namespace and proxy/workspace cleanup passed. +See [egress evidence](../docs/evidence/GLAS-WP-0012-egress-2026-09-05.md). +T02 remains waiting on machine auth, protected credential delivery, the pinned +Claude executable and the combined production acceptance. Profiles remain blocked. + +## 2026-09-05 credential owner return + +Sand-boxer credential transport is implemented and proved with synthetic +provider sandbox 880f749e. Owner config binds exact profile/project/actor and +run id; unknown routes refuse, shell API-key fallback is stripped, only the +workload child receives the value, and output redaction precedes truncation. +Tests: sand-boxer171, secrets-engine226, Glas101 pass. Native data-only read +policy/AppRole proposal and activation now live in SECRETS-WP-0009. Its +production exec refuses before OpenBao because durable access-engine decision +records and scoped service authority remain unavailable. T02 remains waiting +on that activation, pinned Claude startup and real provider/task acceptance. + +## 2026-09-06 credential owner update + +Reviewed secrets-engine message `3bd23bc9-e863-4f1f-8c76-415812ec0656`. +Owner reports the local authorization join implemented at `627810b`. Remaining +native activation depends on approval-engine serving the durable +ActionAuthorization claim endpoint and access-engine serving Check, followed +by configuration, per-lane approval and positive/negative verification. +State Hub decisions are not a substitute for the durable authorization object. +SECRETS-WP-0009-T03 and this plan's T02 remain waiting; runtime pinning and +combined real proof remain required. No readiness change or real-key read. + +## 2026-09-06 authorization contract and policy publication + +Reviewed owner commits `7b4b9e3` and `083bee7` and FLEX-WP-0021. Gate-house +GH-DEC-2026-005 resolved the contract: secrets-engine now validates the +approval-claim and decision envelope separately and removed the incorrect +State Hub authority requirement. Flex-auth published +`secrets-engine.catalog-lane.lifecycle` v1; T01/T02 are done. + +Remaining owner gates are real decision/digest verification (FLEX-WP-0021-T03), +consumer service deployment and handoff (T04/T05), approval-engine deployment, +production service identity and verified lane activation. Publication is not +deployment. T02 stays waiting, and runtime pinning and combined acceptance +remain required. No new owner inbox message or activation evidence was found +in this review. + +## 2026-09-06 digest verification follow-up + +Reviewed secrets-engine `6e9c152` and `925d028`: owner corrected correlation +field handling in the flex-auth digest and refreshed fixtures. Its tests also +record an unresolved approval/native action-vocabulary and embedded-claim +digest mismatch for dual-control requests. This is owner integration evidence, +not successful live activation; SECRETS-WP-0009-T03 remains wait. No new +activation receipt was found in the Glas inbox. T02 remains waiting. + +## 2026-09-06 authorization-chain owner return + +Reviewed secrets-engine `f62d3fe` / `64aeec9`. Owner reports claim → Check → +consume → backend integration against a throwaway OpenBao, including denial, +unreachable service, invalid claim, missing digest, consume conflict and action +mismatch refusal before backend access. Authorization transport is stubbed; +wire shapes use published flex-auth fixtures. Do not describe this as a live +production service or Anthropic delivery proof. + +Owner now identifies deployment/configuration as the remaining live gate: +consumer PDP service and approval-engine rollout, production service +credentials, deployed policy pin and per-lane authorization id. +SECRETS-WP-0009-T03 remains wait. Earlier digest-defect notes are historical; +use this latest owner return for the integration status. Native lane positive/ +negative access checks, pinned Claude startup, provider scope/budget inputs and +combined Glas acceptance remain outstanding. T02–T05 stay wait. + +Review found no pending local changes or new inbox messages. Corrected stale +README wording that still called owner execution missing; the implemented +mechanism and its separate proofs do not change profile readiness. + +## 2026-09-06 production deployment action + +User authorized production deployment. Dedicated flex-auth-secrets-engine Helm +release is available 1/1 at revision 1; five policy fixtures and allowed/denied +network probes passed. CI image is digest-pinned; existing consumers unchanged. +Caller authentication remains warn pending identity adoption. See +[deployment evidence](../history/2026-09-06-174000-production-deployment.md). +Approval-engine remains undeployed: live KeyCape clients and audit sender are +absent, the tenant contract needs alignment, and a release digest is required. +Corrected its stale issuer/JWKS deployment inputs. No production credential +lane or real Claude run was activated; T02 remains wait. + +## Production dependency coordination + +GLAS-WP-0015 now tracks exact owner handoffs and return receipts from Glas. +The requests in docs/production-dependency-handoffs.md reuse existing owner +work: tenant agreement and client custody, KeyCape rollout, audit source +onboarding, approval release, native lane activation and pinned combined +runtime. Image/runtime preparation can proceed in parallel. The runner's +project glas-local-proof must be reconciled with the owner route example's +project glas-harness before the exact delivery binding is selected. Owner +handoffs were sent after explicit authorization; GLAS-WP-0015 records all seven +receipt IDs and tracks replies. This plan's T02 remains wait. + +## Verified owner follow-up — 2026-09-06 + +Glas reviewed six owner acknowledgements in GLAS-WP-0015. Project binding is +resolved to agt/glas-local-proof at sand-boxer 23d0c2b; the combined profile +source is available, but Claude is not pinned. The deployed policy was found +to lack tenant denial at v1; the owner correction v2 is now deployed at Helm +revision 2 and six live Check fixtures pass, including wrong_tenant denial. +Tenant choice, workstation caller access, audit load-bearing schema/admission, +identity/custody and native activation remain gates. T02 remains wait. + + +Tenant decision update (2026-09-06): operator approved `tenant:platform` for the +approval dependency chain as the platform management/services tenant. See +`docs/platform-tenant-decision.md`. The choice blocker is resolved; exact owner +configuration alignment and verification remain part of T02 before readiness. + + +Later deployment progress (2026-09-06): KeyCape/approval source tenant alignment +verified, approval release published and pinned, audit T03 complete, dedicated +PDP revision 3 enforces adopted short-lived caller identity. See GLAS-WP-0015 +and its evidence receipts. T02 remains wait until remaining owner admission and +runtime gates are verified; no real model run or readiness promotion. + + +## Pinned Claude startup progress — 2026-09-06 + +Advanced sand-boxer SAND-WP-0015-T05 independently of custody: runtime builder +now copies only an explicitly digest-pinned native Claude executable. Selected +installed Claude 2.1.263, binary digest +26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba; +complete candidate runtime digest +5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922. +Sandbox f8821ec2 passed actual Claude --version, rein CLI/import, read-only +runtime, private HOME/state persistence, source absence, clean tree and teardown +with owner proxy environment present. Lint and all 175 sand-boxer tests pass. +Evidence: docs/evidence/GLAS-WP-0015-claude-startup-2026-09-06.json. + +This resolves candidate binary pin/startup, not protected runtime deployment, +Claude provider-request compatibility, credential delivery or a real model run. +The candidate is in /tmp; no production profile readiness changed. Existing +credential and acceptance tasks remain open. No new owner replies at session start. + + +## Protected local artifact return — 2026-09-08 + +SAND-WP-0015-T06 is done. The previously pinned combined artifact is installed +unchanged in owner UID 1000's mode-0700 runtime store on bnt-lap001: +`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +Complete artifact digest remains +`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +This is the existing owner-controlled local artifact contract, not root-owned +system storage or Railiance placement. Do not rebuild this accepted candidate +merely to move it out of /tmp. + +The installed-path sandbox `51b59587` proves actual Claude 2.1.263 and rein +startup, read-only runtime, source absence, clean Git, private state persistence, +loopback-only interfaces, and workspace/proxy removal. No credential references +or model request were used. Sand-boxer `make check`: lint clean, 188 tests pass. +Source return: 3e49a98a0e2c4a64539a5ccd674be8cd67ac9845; receipt in +`sand-boxer/docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`. + +T02 remains wait for trusted owner execution configuration, native credentials +and real-provider evidence. T03-T06 retain candidate review, real-model run, +readiness and recovery obligations. No profile readiness or schedule changes. + +2026-09-23 candidate superseded before use: operator chose `claude-sonnet-5`. +`harness.agent-dev-local@1.1.1` is identical to 1.1.0 except the model; 1.1.0 is +now `blocked`. Runtime `2cfc7b5f` bundles the earlier 1.1.0 copy (profile sha +`e84b9d0f…`) and must be rebuilt with this revision and placed again +(SECRETS-WP-0009-T03). Claude CLI 2.1.266 in that runtime lists +`claude-sonnet-5` in its model registry (static check). 134 tests pass. + +## 2026-09-27 loose-ends review + +Reviewed for locally finishable work. No new owner reply advances T02 beyond +the 2026-09-23 secrets-engine status already recorded in GLAS-WP-0015-T03. +T03's remaining done condition (runtime `2cfc7b5f` rebuilt with 1.1.1 and +started through its owner on railiance01, SECRETS-WP-0009-T03 step B2) and +T04/T05 all require that external owner delivery. Nothing in this repo can +advance them today; `status: blocked` stands unchanged. Re-review when the +runtime rebuild/placement or owner authentication lands. + + +## EMERGENT-WP-0002 proof requirements — 2026-10-03 + +Scoped review and local observed-model correction: +`docs/evidence/2026-10-03-emergent-session-readiness-review.md`. +T04 retains actual native-provider startup and continuity acceptance, including +reload after real resume/compaction, provider/repository changes and exact +available model/session metadata. The current lifecycle exposes no continuity +event API. Existing owner-delivery blockers and all task/readiness states remain; +local deterministic tests are not governed provider or isolation acceptance. + + +## 2026-10-16 NetKingdom isolated integration preparation + +Prepared, without owner deployment or readiness promotion, a Glas change that +separates credential-free housekeeping commands from explicit rein workload +execution. Both concrete adapters use the workload path; SSH selections with +credential routes refuse because that transport has no owner delivery contract. +Full regression: 141 passed. Real disposable bwrap/Glas transport proof passes +synthetic host-file denial, inherited credential environment and subprocess +denial, workload-only delivery, redaction, subsequent-command absence and +teardown. No provider/model call or real credential read occurred. + +Latest owner dependency sources supersede the stale missing-lane account: +September 27 native lanes were activated and revoked; corrected immutable +owner runtime is `818b1b7c…` (October 15 startup proof), not yet installed or +admitted on Railiance. REINAH-WP-0008-T07 retains memo lifecycle acceptance, +installation, rehearsal, renewal/pin updates, native approvals and bounded +successful model/tool/commit acceptance. Any subsequent build containing this +patch has a different source/artifact pin requiring owner admission. + +This is a reviewable patch in Custodian's NetKingdom change bundle; no canonical +source synchronization or workplan task completion is implied. CUST-WP-0073 +continues to require admission of the actual interactive assignment, including +its existing host credential and external tool paths, not a disposable fixture. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/manifest.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/manifest.json new file mode 100644 index 00000000..9df34a85 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/manifest.json @@ -0,0 +1,46 @@ +{ + "schema": "custodian.identity-binding-publication-artifacts.v1", + "status": "verified", + "files": { + "glas-harness/consistency.json": "sha256:67309a476a94778c13cfcc1cddc1f23caa51bbedae0e324f5a9af4780aba1bed", + "glas-harness/consistency.stderr.txt": "sha256:f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba", + "glas-harness/index.preimage": "sha256:be6359bc304b09f0a3479e8c3cab02483c42a11c57aedf222000c153693b9843", + "glas-harness/projection.json": "sha256:6683a110a420e37724e322b50ff91eb867ae4e6533f5f97b45c145fb14b1a845", + "glas-harness/projection.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "glas-harness/publication-backup/.custodian-brief.md.worktree": "sha256:958a7f356e71829b5115026404f7b9756cd7cf08bf882fad0990a0897ddf8b19", + "glas-harness/publication-backup/WORK-RECORDS.md.worktree": "sha256:ffdc5dc4868a3b5b0b836f875b31bef7f52f699df6779ab06a5b6cb865b3ebf9", + "glas-harness/publication-backup/originals.json": "sha256:73b9f5cbead35abb248e7fe91198728628ad61ad852b4e8125e9a31bf295c574", + "glas-harness/publication-commit.json": "sha256:567b941b59b9dde2a26a00aacd233442b76c46799f10c2873f918e08adf8cba3", + "glas-harness/publication-manifest.json": "sha256:4bc573e2691ba00d1ccdb7da753a1640fbc6b7a8945d9ebcc16fb510c034c4dd", + "glas-harness/source-before.json": "sha256:8ce1f39ff2cdceb5c36bbf6f8ef9442c947366415200ed04f1dda61e56071387", + "glas-harness/verified-bindings.json": "sha256:3c708759395d3ca0fbed312c2dfb458d200c95154e35239d3006bf496c2caafd", + "glas-harness/workplan.postimage.md": "sha256:23f97bc183bef2b0f38eb40c64bc0bb010df1c1eb4596ff3b5e0f73da7c2fcfc", + "glas-harness/workplan.preimage.md": "sha256:881ab0f5ba3bb43f5404c8f4cd23f9628e014992ba88fc13f541f0fa8b7b1eaa", + "rein-aharness/consistency.json": "sha256:92476d31cac32366e7186ecf2e6facb837eeedcb388c138581644c013947b01b", + "rein-aharness/consistency.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "rein-aharness/projection.json": "sha256:1a6ea4eaae65043a7dc81aaac77442714280e20ed8841c7e0df2aea0f7993763", + "rein-aharness/projection.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "rein-aharness/publication-backup/.custodian-brief.md.worktree": "sha256:8835f9bcfc7d5be193cef0b76aea1c896346a6a801f710704b0cb58544d44918", + "rein-aharness/publication-backup/WORK-RECORDS.md.worktree": "sha256:baa1b17a2d69493a6dd3a704543afd75ffae7bae25f582160c98bb2fba4118aa", + "rein-aharness/publication-backup/originals.json": "sha256:72a3bb6c69e2d37225d736e8a3dcb1f67d19d18ed7dc82e5796fb427aa6bedb3", + "rein-aharness/publication-commit.json": "sha256:98a00d07f82b093d6555ff12d9e2ba77bbb05e252aa6dd6301436c0c3945f84e", + "rein-aharness/publication-manifest.json": "sha256:49c712f3b5654ebd3d0169e322af099f0a8f2e0f119e5ea1c86f4d394484a1cb", + "rein-aharness/verified-bindings.json": "sha256:edeb1aafd91c7d97fb455ce7e5972fb803f6f97f5fe3c8623bffcf281b5749f3", + "sand-boxer/consistency.json": "sha256:98727575e0892fb517a7e8eb56d30ebdd70c7af6c2bfe91f24b45cdce192d697", + "sand-boxer/consistency.stderr.txt": "sha256:f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba", + "sand-boxer/index.preimage": "sha256:e9c14c64f7319eed77603103a13f1422726121bd9ee475902f4501a8781bf02d", + "sand-boxer/projection.json": "sha256:b8effe52919d42865a33e4e9f63ed288ee61f201a778877dc294b611c9352b99", + "sand-boxer/projection.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "sand-boxer/publication-backup/.custodian-brief.md.worktree": "sha256:5c1fbfeaeadda850d0c373a110d49143de4ff89fd0d2902add3025807de5fe85", + "sand-boxer/publication-backup/WORK-RECORDS.md.worktree": "sha256:a646f4444c6237c5a5e060bc22fa46c8129e010cdb8dcc5e78e721ad49413425", + "sand-boxer/publication-backup/originals.json": "sha256:f9c22541d53757843e2bf6aeb2eb59455466654a0d861ed4eb37c0434290c5c9", + "sand-boxer/publication-commit.json": "sha256:6e3f1b7c11a6dfe6fbb8c6eb4946858f6e930597c0ca493efcc98ad3dfa44ad4", + "sand-boxer/publication-manifest.json": "sha256:8e1166d27d8f9279a3dbc328e2486405a9a574fdbdd7710cb251f09e3dd0ccea", + "sand-boxer/required-checks.json": "sha256:57875a26b2bb1ed486d206adedce2b9aec8b1d7df83214f6bda70d48957a0031", + "sand-boxer/source-before.json": "sha256:946a90aae4fddeb082e69f21dc876ff8590937f0aeadfb2f445927eb553bb9af", + "sand-boxer/verified-bindings.json": "sha256:3c7f37a6060d7bfdbdbb578ba08354f50ff5c9003a138bd52955d49be1f9bb38", + "sand-boxer/workplan.postimage.md": "sha256:56022703fd4d973f40ddad8eb99cb02783b086549b24ef89f89157de33eafe31", + "sand-boxer/workplan.preimage.md": "sha256:230d1ef37aa9c2023335a617492a72678c4671a8bc82d5577e9d7a7cea6e8fe4", + "verified-publication.json": "sha256:bc58522a93b0e225dec68728d010b846af8413486e17d94bd5d0c393da679dea" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.json new file mode 100644 index 00000000..69a031fb --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.json @@ -0,0 +1,71 @@ +{ + "repo_slug": "rein-aharness", + "repo_path": "/home/worsch/rein-aharness", + "source_revision": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['HARNESS-WP', 'REINAH-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'ACTIVITY-WP-0026' is not linked to State Hub", + "file_path": "workplans/REINAH-WP-0005-ops-run-claim-loop.md", + "db_id": "", + "file_value": "ACTIVITY-WP-0026", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Human wait task 'HARNESS-WP-0008-T07' in workplan 'HARNESS-WP-0008' has needs_human: true without decision_id \u2014 unrouted human gate", + "file_path": "workplans/REINAH-WP-0008-simpler-metered-retry.md#HARNESS-WP-0008-T07", + "db_id": "", + "file_value": "needs_human: true", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'HARNESS-WP-0008' uses prefix 'HARNESS-WP' but repo canonical prefix is 'REINAH-WP' \u2014 new plans must conform", + "file_path": "workplans/REINAH-WP-0008-simpler-metered-retry.md", + "db_id": "", + "file_value": "HARNESS-WP-0008", + "db_value": "REINAH-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 9/9", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-33 fixed: regenerated WORK-RECORDS.md", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 5, + "info": 0 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/consistency.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.json new file mode 100644 index 00000000..65013e1b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.json @@ -0,0 +1,124 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "rein-aharness", + "commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "requests": 2, + "elapsed_ms": 1898.6, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "rein-aharness", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "derived_commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "rein-aharness", + "commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "status": "applied", + "counts": { + "created": 0, + "updated": 9, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 7, + "cancelled_tasks": 0, + "created_edges": 1, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 3 + }, + "created": [], + "updated": [ + "HARNESS-WP-0008", + "HARNESS-WP-ADHOC-2026-09-04", + "REINAH-WP-0001", + "REINAH-WP-0002", + "REINAH-WP-0003", + "REINAH-WP-0004", + "REINAH-WP-0005", + "REINAH-WP-0006", + "REINAH-WP-0007" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [ + "HARNESS-WP-0008-T01", + "HARNESS-WP-0008-T02", + "HARNESS-WP-0008-T03", + "HARNESS-WP-0008-T04", + "HARNESS-WP-0008-T05", + "HARNESS-WP-0008-T06", + "HARNESS-WP-0008-T07" + ], + "cancelled_tasks": [], + "created_edges": [ + { + "workplan": "REINAH-WP-0005", + "from": "REINAH-WP-0005", + "target": "ACTIVITY-WP-0026", + "relationship_type": "blocks", + "from_workplan_id": "7d023961-af5b-59dc-96ec-85d45f67cfa4", + "from_task_id": null, + "to_workplan_id": "d05e49dd-dbc9-59f4-bbc8-8bfced64d4a8", + "to_task_id": null + } + ], + "removed_edges": [], + "unresolved_edges": [], + "external_edges": [ + { + "workplan": "REINAH-WP-0003", + "from": "REINAH-WP-0003-T06", + "target": "REINAH-WP-0003-T05", + "relationship_type": "starts_after", + "from_workplan_id": "eba2eff1-10a7-50a3-a70b-14e7d398f27f", + "from_task_id": "68a13c4f-0cc7-5d0b-917e-441164da8c84", + "to_workplan_id": null, + "to_task_id": "c4a3f08f-2874-5672-9f29-aecddd697d90" + }, + { + "workplan": "REINAH-WP-0003", + "from": "REINAH-WP-0003-T06", + "target": "REINAH-WP-0003-T04", + "relationship_type": "starts_after", + "from_workplan_id": "eba2eff1-10a7-50a3-a70b-14e7d398f27f", + "from_task_id": "68a13c4f-0cc7-5d0b-917e-441164da8c84", + "to_workplan_id": null, + "to_task_id": "f6c7f80c-3807-54ac-b44a-ef582433b927" + }, + { + "workplan": "REINAH-WP-0003", + "from": "REINAH-WP-0003-T06", + "target": "GLAS-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "eba2eff1-10a7-50a3-a70b-14e7d398f27f", + "from_task_id": "68a13c4f-0cc7-5d0b-917e-441164da8c84", + "to_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "to_task_id": null + } + ], + "refused": [], + "notes": [] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/.custodian-brief.md.worktree new file mode 100644 index 00000000..0854f3ee --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/.custodian-brief.md.worktree @@ -0,0 +1,36 @@ + +# Custodian Brief — rein-aharness + +**Domain:** agents +**Last synced:** 2026-10-14 00:11 UTC +**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + +## Active Workstreams + +### Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal +Progress: 4/7 done | workplan_id: `187c2599-84a6-5764-a14f-7e9121975bf2` + +**Open tasks:** +- ! E. Ship the owner runtime as a container image (decision) `b486e86b` +- ! F. Approvals per envelope (decision) `4cf721e6` +- ! Retry on the corrected runtime `80318842` + *(wait: Owner: accept spend memo infd-20261014-b01, then attended install, rehearsal, renew and approvals on railiance01)* + +### Governed runtime integrity and intent convergence +Progress: 3/6 done | workplan_id: `eba2eff1-10a7-50a3-a70b-14e7d398f27f` + +**Open tasks:** +- ! Remove tenant logic from the shared runtime `f6c7f80c` + *(wait: Migration of profile-absent FI/Binky definitions with Activity Core, kaizen-agentic and tenant owners.)* +- ! Align deployment, recovery, and conformance with the supported runtime `c4a3f08f` + *(wait: Fixture recovery, rate, and queue-injection evidence is local only (2026-10-08). Activity-core has not replied to 27cd4c47: a 409 stays claimed because this worker must not terminal-close a lost lease. Fixture micro-USD rates are not a live tariff. Admission does not deploy or start a paid request.)* +- ! Re-prove one governed profiled run and close residuals `68a13c4f` + *(wait: After T01-T05 and upstream GLAS-IN-0002/GLAS-WP-0012.)* + +--- +## MCP Orientation (when available) + +If the state-hub MCP server is reachable, call: +`get_domain_summary("agents")` +This provides richer cross-domain context. +If the MCP call fails, use this file as your orientation source. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/WORK-RECORDS.md.worktree new file mode 100644 index 00000000..9c23f62f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/WORK-RECORDS.md.worktree @@ -0,0 +1,60 @@ +# Work Records — rein-aharness + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | HARNESS-WP-ADHOC-2026-09-04 | finished | — | workplans/ADHOC-2026-09-04.md | +| workplan | REINAH-WP-0001 | finished | — | workplans/REINAH-WP-0001-harness-foundation.md | +| workplan | REINAH-WP-0002 | finished | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md | +| workplan | REINAH-WP-0003 | blocked | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| workplan | REINAH-WP-0004 | finished | — | workplans/REINAH-WP-0004-statehub-bootstrap.md | +| workplan | REINAH-WP-0005 | finished | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| workplan | REINAH-WP-0006 | finished | — | workplans/REINAH-WP-0006-binky-weekly-review-approach.md | +| workplan | REINAH-WP-0007 | finished | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md | +| workplan | REINAH-WP-0008 | blocked | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | HARNESS-WP-ADHOC-2026-09-04-T01 | done | — | workplans/ADHOC-2026-09-04.md | +| task | REINAH-WP-0001-T01 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0001-T02 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0001-T03 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0001-T04 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0001-T05 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0001-T06 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0001-T07 | done | — | workplans/REINAH-WP-0001-harness-foundation.md | +| task | REINAH-WP-0002-T01 | done | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md | +| task | REINAH-WP-0002-T02 | done | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md | +| task | REINAH-WP-0002-T03 | done | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md | +| task | REINAH-WP-0002-T04 | done | — | workplans/REINAH-WP-0002-rename-and-glas-harness-alignment.md | +| task | REINAH-WP-0003-T01 | done | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| task | REINAH-WP-0003-T02 | done | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| task | REINAH-WP-0003-T03 | done | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| task | REINAH-WP-0003-T04 | wait | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| task | REINAH-WP-0003-T05 | wait | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| task | REINAH-WP-0003-T06 | wait | — | workplans/REINAH-WP-0003-governed-runtime-integrity.md | +| task | REINAH-WP-0004-T01 | done | — | workplans/REINAH-WP-0004-statehub-bootstrap.md | +| task | REINAH-WP-0004-T02 | done | — | workplans/REINAH-WP-0004-statehub-bootstrap.md | +| task | REINAH-WP-0004-T03 | done | — | workplans/REINAH-WP-0004-statehub-bootstrap.md | +| task | REINAH-WP-0005-T01 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| task | REINAH-WP-0005-T02 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| task | REINAH-WP-0005-T03 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| task | REINAH-WP-0005-T04 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| task | REINAH-WP-0005-T05 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| task | REINAH-WP-0005-T06 | done | — | workplans/REINAH-WP-0005-ops-run-claim-loop.md | +| task | REINAH-WP-0006-T01 | done | — | workplans/REINAH-WP-0006-binky-weekly-review-approach.md | +| task | REINAH-WP-0006-T02 | done | — | workplans/REINAH-WP-0006-binky-weekly-review-approach.md | +| task | REINAH-WP-0006-T03 | done | — | workplans/REINAH-WP-0006-binky-weekly-review-approach.md | +| task | REINAH-WP-0007-T01 | done | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md | +| task | REINAH-WP-0007-T02 | done | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md | +| task | REINAH-WP-0007-T03 | done | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md | +| task | REINAH-WP-0007-T04 | done | — | workplans/REINAH-WP-0007-glas-profiled-ops-runs.md | +| task | REINAH-WP-0008-T01 | done | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | REINAH-WP-0008-T02 | done | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | REINAH-WP-0008-T03 | done | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | REINAH-WP-0008-T04 | done | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | REINAH-WP-0008-T05 | wait | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | REINAH-WP-0008-T06 | wait | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | +| task | REINAH-WP-0008-T07 | wait | — | workplans/REINAH-WP-0008-simpler-metered-retry.md | diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/originals.json new file mode 100644 index 00000000..e9087729 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-backup/originals.json @@ -0,0 +1,10 @@ +[ + { + "path": ".custodian-brief.md", + "index": "100644 0854f3ee6418b8547d97c4f8a0ea119cd35c9c1a 0\t.custodian-brief.md" + }, + { + "path": "WORK-RECORDS.md", + "index": "100644 9c23f62f341f77166e543af80f75c55a3763d24a 0\tWORK-RECORDS.md" + } +] diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-commit.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-commit.json new file mode 100644 index 00000000..2bbd1216 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-commit.json @@ -0,0 +1,17 @@ +{ + "exit_code": 0, + "commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "base": "9b88cadaa817e5abea7950b4a264d4e2739a5ddb", + "files": [ + { + "path": "AGENTS.md", + "sha256": "da71c6e3d76d7c867b2db6e67cd919fba594acc3804d3784dd744438103560c2" + }, + { + "path": "workplans/REINAH-WP-0008-simpler-metered-retry.md", + "sha256": "1118924bb159f8a52a37ace8b8663c75274b89928f7a8b957638428af224b054" + } + ], + "stdout": "[main 0b7a9cf] docs(identity): restore issued HARNESS metered retry identifiers\n 2 files changed, 25 insertions(+), 12 deletions(-)\n", + "stderr": "" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-manifest.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-manifest.json new file mode 100644 index 00000000..6aab2460 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/publication-manifest.json @@ -0,0 +1,15 @@ +{ + "owner": "rein-aharness", + "base_revision": "9b88cadaa817e5abea7950b4a264d4e2739a5ddb", + "message": "docs(identity): restore issued HARNESS metered retry identifiers", + "files": [ + { + "path": "AGENTS.md", + "sha256": "da71c6e3d76d7c867b2db6e67cd919fba594acc3804d3784dd744438103560c2" + }, + { + "path": "workplans/REINAH-WP-0008-simpler-metered-retry.md", + "sha256": "1118924bb159f8a52a37ace8b8663c75274b89928f7a8b957638428af224b054" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/verified-bindings.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/verified-bindings.json new file mode 100644 index 00000000..432d52ed --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/rein-aharness/verified-bindings.json @@ -0,0 +1,84 @@ +{ + "observed_at": "2026-10-17T10:58:01.748067+00:00", + "status": "verified_published_identity_restoration", + "commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "projection_counts": { + "created": 0, + "updated": 9, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 7, + "cancelled_tasks": 0, + "created_edges": 1, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 3 + }, + "all7_record_ids_filled": true, + "all8UUIDs_statuses_human_decisions_preserved": true, + "both_original_dependency_rows_retained": true, + "parent_slug": "harness-wp-0008", + "parent_status": "blocked", + "parent_projection_retired_at": null, + "tasks": [ + { + "id": "c6536c8d-7862-5de6-ad2b-401077b60c04", + "record_id": "HARNESS-WP-0008-T01", + "status": "done", + "needs_human": false, + "decision_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + { + "id": "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9", + "record_id": "HARNESS-WP-0008-T02", + "status": "done", + "needs_human": false, + "decision_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + { + "id": "87457216-2371-51ca-b3d4-3917e6f180a2", + "record_id": "HARNESS-WP-0008-T03", + "status": "done", + "needs_human": false, + "decision_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + { + "id": "898e02af-51bb-5e8d-93d0-ae908466c612", + "record_id": "HARNESS-WP-0008-T04", + "status": "done", + "needs_human": false, + "decision_id": "a93619a9-8a70-40d8-aaf9-c29357d2a043", + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + { + "id": "b486e86b-9d0f-501d-a394-771b40f771ee", + "record_id": "HARNESS-WP-0008-T05", + "status": "wait", + "needs_human": true, + "decision_id": "e6ca2f07-2708-4013-bfba-bf89fa0f1cb5", + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + { + "id": "4cf721e6-724b-5c64-91bb-67b098bb97af", + "record_id": "HARNESS-WP-0008-T06", + "status": "wait", + "needs_human": true, + "decision_id": "e8986e40-f6f8-4c87-b704-bff50cc4958b", + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + }, + { + "id": "80318842-ccaa-5484-a54a-3d9981eaec8b", + "record_id": "HARNESS-WP-0008-T07", + "status": "wait", + "needs_human": true, + "decision_id": null, + "workplan_id": "187c2599-84a6-5764-a14f-7e9121975bf2" + } + ], + "native_authority_or_proposal_changed": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.json new file mode 100644 index 00000000..4f688516 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.json @@ -0,0 +1,52 @@ +{ + "repo_slug": "sand-boxer", + "repo_path": "/home/worsch/sand-boxer", + "source_revision": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-41", + "message": "Task wait-qualifier drift 'SAND-WP-0015-T04': file={'needs_human': False, 'blocking_reason': 'Tracked as HARNESS-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.', 'decision_id': None, 'blocked_on': 'message-from:rein-aharness', 'wait_until': None} db={'needs_human': False, 'blocking_reason': 'Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.', 'decision_id': None, 'blocked_on': 'message-from:rein-aharness', 'wait_until': None} (file wins)", + "file_path": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md#SAND-WP-0015-T04", + "db_id": "58817ef6-76d9-5e34-908f-c024e6c99f93", + "file_value": "{\"blocked_on\": \"message-from:rein-aharness\", \"blocking_reason\": \"Tracked as HARNESS-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.\", \"decision_id\": null, \"needs_human\": false, \"wait_until\": null}", + "db_value": "{\"blocked_on\": \"message-from:rein-aharness\", \"blocking_reason\": \"Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.\", \"decision_id\": null, \"needs_human\": false, \"wait_until\": null}", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 15/15", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-41 fixed: task 58817ef6\u2026 wait qualifiers synced", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 3, + "info": 0 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.stderr.txt new file mode 100644 index 00000000..3345563f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/consistency.stderr.txt @@ -0,0 +1 @@ +WARN: git commit failed for writeback: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/index.preimage b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/index.preimage new file mode 100644 index 0000000000000000000000000000000000000000..bc1012240c111dad739cde8cf4454fab8991340f GIT binary patch literal 19864 zcma)E2{@Ep`+w|P_I+QnGxl8(kwkN+P9b zPep0fqWa|JQZB-|xGw-uL%A_kHejpZmGbIpgIUJQac}?4LTR^$WM3?1=h#^r$EKfRL=*Pop6fNZBHaPEL-dShAAo z6t*QfmcmG4TO>pSVuVj>K|PKbuOpEc`jlxJ9VTvhVj*Sqli5Rw_xYwuA98~MPrWwDb;YzmuAWil`cWc((EWE?SmCn7&|dsugM^>*LUEfbg3-wl&}xoll~bp!*wV8IKR}G%mdG!ee&bV})se$<9y=SVtuDW>sB%9|&KA-o`Umq2DUroYVn#9P zun9ER#I3eTqC+@h{0>BZ5#x*jtD@%NgvDzf zCL{pFVikldh}Xpey6^2j;)vV?9PxJ4{Ai5kmbvM8{x;Xkw*yRXVr{W&25EL|3KjFF3?|e(&{0p{6rS%{&4O;)OY<9k4oN1!w}(t+D(Z(?%O7{ zI!QToYb#v2t8;p)yI*nxi&P4U`3B4e144LctNR^i59HD?MEym5K;-e#$QFH?A7OLu zjZ3*k?)rh@r<&ytUO^)MzEiyeLcC$Wml#$=_S< z1$%pV%|!ikt0Ym*y8RFhLxg9lW+Rcu_{BNvNBLLU4+^H9*>_^()3fyz7V@7U(U7Tu zvk)4vuF3;7t$HkQMD1d8z`n9tHC;cYOdJtDyAxdVCN&@+0Cm^=s4aY6_U1C1Wt?mte%%LBjb=u%EhAG| z>u<3ngOqeq`|?P09e6B z&PKMvvF#S3?YS0Bs@&gFhhLqk^4+q2b%Rcm?}4k6r66a7 zmy!bSbx{<{5RU*aQs^v_m6f$U39WcYU@u`MB`1<>tZW=eR?Z|V2MZdT$$)6P7wRj$ zvN?$(qU%&sOVkxol^K~3vFSp*i}J|vOxXv|yUO3}4S_uWLl@o@K?y{OCefKupi-eS zz!2#4@c}rY1Avn&_(Ll(xopwB-3dq3uijgTY-+8~{4SUFFZG)) zVDm*uOQJB~Qia5hj>iLy=5l3?sQ=@`IHJ5N2Z+4lmC4TMmn=B%u{zJVFl=~>q4^it z2e#OJ#W6t@ltiIZ5-3UIb&6~KEvFf=CNvBYUd6a1BClX+yOZY);hBuueLb@)*-rBJ z?zXO|g7gr-Q5i{KQ6PH(s70fas43K>bg&1H7mb)-bZq%0V86hK=xCdZ5p^aE_n*4$ zdslPX{%PJNb<^UzCtrDQ`vKDZTPGImL8Le`i-9dhJkR5Z`X}f*kzXkAXM*Eyi%geY zt6ycrI{Vk3{=9~s4H^8+&t@dY#?mQZy5UNK$r_sn=c>bwot39)7-BlDL><9_V96uf zCi%6^@hUilAb@bzI zT5p|~r+)Tr)x}Yr7zOL@OX&&j*nER&CX-@V#Tu+_R`noO#N0isQl*lV# z?WDuE)9ZUtoxA4oRqOfHT+3S6=8z6D{sbyE+oZ^3Dm|K%Kn9-)U>*J$_ms#dRID>w!GPT> z8mP!`S=N2%y;$gmS-Frj!bkXK0dd{R_heBFjtHNfQ3H{0!o-g9zMdDohnTx`XUXTN z=cc`T7-t9RqkPGXNG3C$Z3$8iyxEh`jSNXUc=$mym$DsvTUEMnMEx5yOwZnu`b%ghJXTNAj z%}IS>mfY`gQ*WiK86zPdGU9Cy8)%!g(n44ZyeUI+7}I(@YYF50GWXuPXSpPiBQ;iNW7olk&Pp&Ga-+tBNX{| z(QE(v8?NvbCo;At-=?`vJK|FZ8UIr!5q#NDSmQE42jtTgW@0!ZI*M_bL>+;f$zR+S zJUj8lRKd%$H)ekO$4Tp>`>{A>Q=*btAcbP^MnLHr4B` zr&PnH)GLRt2yQrf=Jqv678y620hUo56YUV-c^*e>d>LGPe%dRcqGi*a3h3STkIxlm zRNG#YlZ7M@zN94N3lZ7w;CS35SjN8)M|6CK@kBm8xBkOP{4ZA}D(U8yZYxPY^JKPM zVJD;kBF++U!Y;&u&;tATfxms=KQxzq5BuP-8XPfx@VA`x1mB`$=+GI{zDqA#7nqet ze~>Sc`{QW~Nx=MYRHx%~|M;#AxhOBlRQTu(Laq+Uc737=>m<|`Dw)aRp+w)@UH}4h?NSlinU+8Rh z9QJt${BhFCtnu6q98vxm$B6uVKeOf(nCx(wyL_IQ%&DjE_pF?9`PTrX%*9W!iTrO~ zeuMMhvRvLEE-?Z*8e!A?pZ8#RbG*Hg86(u@im5q`*; zP2}en$`c?iDzmpSUU=cd^3};TP}UN#vgx z(_gx2-|xP+LGQ(#Mdm{1e|5}rNP%4AsGtqOO1DI-Uk8$nEeT}qBvNXkm6eq(C{{q_ z2s&L+%tQ(aY@VR!LZ+v)srV)euP4_NRa)Va-*80d+wTWaUoW+)!2o-oolC4}CiheaHVz|CEkajHe3lFM^1^gs>J-UtrSv$zS#y%DJu0G~CgCZ|DHq zr)*Uyq>b&2V_T#J()uJtQ&Mmb-4*iK`&e=knTTp(2@o13zgN3N_;+CLBkN?w|g*?Xoo=V8UC4q+r{Q?)zjZT%k5i3 z#FpM4&XDOFYACA}JPJtFUZqv?gum#`E#=pIJou3eO^QuS9_LS7 zBy&FREXdOcqWo^{T>i14PP?5P;YU(bskLYJKYRd9eHI|cga5Bg4eHX(l2BDLjwruM zB^Uq1O?P)SC`td+`#!?_P;#^0v)=8e6r}%`|G7%j@dZx{Fs)Wswp@%Os^iU-uLX2X ze@XRpJ-*``GT@^-Uv}YxbzVhxAj7|O{whszC49fZ5!FdML9|C8x@I_TSo`7HMb)c1 zLVx@**VptN*#a5x(jkEY)V1tl90fWgz~~NV8(; z!6)e^kQ|E=3wAWHp>b7HApgOA?+B?j95LQLA}<8JEPGl~d#7uv-v*PTsq^kPKhF!< z3~7z=Mv)WAkyJY9f`fB1xEmf%p(G;twOwe`fwV}Th9T;QpbtcT>Bwa{r_OgAv;3{6 z-S_C_q8&TL8Tl5F9dCY08mQcnmN*_xz*{L)j#DRK7p&)QJ{?EQt|vrY{;BW&+_~x_ zVK~8L?z@dCuL9+pa<(Z$dSkj&Ml?_Zrv)7L;Y$xT52875SZG}Rm=8xpN9JrGQAgv_ zH;E=bAMvX49m{52h;M3FJt?KJ4Kl=c2}>($5}Ipqi@@HPku44msrWgtf?)#1REI8{HUOEELt`Kz$ zrwqNkwa3zD;u?neF|+MOHzK!`*KLA~#&v8-#I^{Doz6&#qm0!^h`+YHevBh#PY_W@ zpka8u{IGv#-lfrPG3m$Wz1@|0-RU+Q&*<*TBc2;pmB|YGmC!Imc}=t?%|0r9R*0eC9}v|LW5PLCfC-D9vt$w21tum$00OY0yfutc87d+Te)#|AYzAKT_T0 zN&AGA5p^W4 zuRAzBFZErpMZp3snb#FxOJ{Cc*fJhZ=zO5FjU8;@{3Uwn0{l16&@e>!ZReE``6W}r zO*QZ7)JW~h&Fk^nCE47XC~)U1q|Vb0kR9>S13#6R+_L@F_6kRoKZ5H!OLlTE)g*k| z$|K;Qlr0rp;_8=w)RH|Oubks&rZPYqft*N1L}<-&oqR&CLvTdr;rJ=y_%-U%AB~oO zn{9OMb!2w#O!anFO0!+eU-5*@H|J^q<99t7rZhaM3?Oojg78Z;odNuu@j5*yLa!!x zp!!zz^8yuP@`1)9TkXQQ`3VOpc)WtXipVd$LAb91Bf_s_m_XzgX??P#>_<rA|hbN!+a`AW`Q_jyqa9Rmewvmy>lD~f1mbV zT=Ho#jNab&Sa$+JHFD0g~`h0h%(J;iutxg=bQ)+igoB4^Wn>L+)AlYOs{_EyM zxw~?Z0+Bb0j>aG|UgxS(lXeeJ@ST7l${PgkYjEae$VhLJHov-C!Rwo~iNa7p)#-DJ znld0x2>yVNRJa`ipF7I+(C9c~{KZ86gv=lvv$|4uNAqrDuj{ROYi^m$8&2f*H^R@I zXLz4GRS@|F7T&dvbUBJdrl*F-wDV|IH7l9K=sxew8g;SHbfOBRYOBu0EQYMY8{w<~_gc zSbvTkT9QFGmac!L+zc82H-7|3X&`5!cDSB2l2IGX0r?C;R0r+{aQaF7_UDZDtew00 z_)Yul7Jh%Qar^wIqI!_wKXs7Q7BS{6IBzZ~6&|kF!x7b)!F3NpUp?AnxxV+7>j~X= z`4fM3MD(otmJs!Xy&o5AHf99{ zPV;%a{(#bxbXo|-uop7>U-aOw3seh-IQ7XE1$*a5TX@}MsJ*ZL$DGjJZ*b7iBP zd&_$q5gn@oLqt2IG=Ci{mpR^Z=;@SK^P^8YY~4H(=ve`o{!<6PwGjay2BH}Oo*l$* zMlxZhhmrLJ5YbbTc}>)lcpEHqahBv0UmImV;b)msy`%5!^Jx8#ynuGX;rt2gQMx>u zjU&oGjjN9;QBc|Bt8Flazu+5xQH%4^$cG_GAEN&wf8rmQV}V91U6gLO?WZk{sE*q# zq8*~&Cu*NEAAH>S^2CoRQ~J7R=RLY|*$bNZPrnh1DcE1&`$bvXU>A;vj#EuNQAgUu z>&C!ms)5$_^UwGA56IB^16a8#kjek269Ko)k?Fzn4vvTpKNL^Ync%!}WzSa69WTg+ z!v}0db;W<*)193F>hpia8{D4)BH$zeiE4QM)f%+=v)|%~`fY|JQAb>5Kv~N%tnl>X z=eq`SVsE6Z`t!0?{y)~ucz$y|byeq>L<0C8LlEIt%(Nx)8-6G-&ny$~Xy{VzC%--{ z8Gh`2k7>?-*pZSDft^_3cJQv}xZ(`5y%^?YNb8pJGxj{Tq(Asb;G3xA6z=(_Q)4Jm z=~48*iWp?Q)c1%y0Jm9V;$NAwSU39{cb>4NO z6-R{MHuN2lU)^_8#_Fm+gENJC*9;~soK<#Yq%&a>q)c2NAX!o9WBW*=w~9LHGUx{* zi2B71oS$&|9~x2_s`YGI#X9-3dC%~1EwY}|~6nUK-N@9Yi{~ogM+giOEVrJcZby5;BS- zX3rj?jxfzg|DZ?yoMyA{>i)*+FH$#jsgRy<$Lp95d}oo0)yJ5hxcqg4$S*3Oxa(zb z>k|I74Sxx;sIui0aZ8(w#Cyv{9mz!9~>%YdjOuwE{E;q|?z zPr4tP`Fo?ouM5|Dg}bsqUx$zn!QJa9aJdYek#O?!{2tUG@ZM?$c=h%MSEj44db?gZ)sl?9LK+KZFsrW10?8M=*P(Zu1G}#+hz|K2z`Ryk6at zJYh!*_qrSFrqh|^XuLiy(XLfwbb{|g6jA;(FCstGqEsqk?7>=G79YC5PDHJ+t08x2 zB6oevqJSGyXj?j++ZLE#gx^j8M?^>4T$HFIzV-V7shVb|0)vWsGUY7$<7(n7FFxeX zQv@9fgGB|$e)!Dbaf>5rj~l2{2=f8Ca-TVr>9kUM^{i%ju=1OAK`f4BHtN6p0xY)WA}B#Nhe>Qmg|3|wKe|dzxY9Sl}QIBH*5sR zjt;>ewDD_$;}Tg+^{I1yUO|Ti1Xrz z@pJ7Lf|qGUTGevMzf(39kgzFF=;newnJdmq%KLBg&aie3UZ2Ca zLX6vvvAe0f?BIRgcZ8@TLQd3Zm?`n5^7C*)dQo}XciDY`Rdw9+F|IS7(82i6nvw!Z zIAV5G5&32E^M&37aVX{y~s}`EtF7wSJ~;1>ZjYksnOrINFN%>feD>NyvPl#+ z$Q$tgMqrI+IN#}LeJH{a<@5I>@`>n8tNC+I-KRv{Uh(NA>eshVJ%VPhgETn!c+?!o zdak+oMp8C?2Iw~-i16DT=Q=00^A0Du%o=2d`|DZx?i!sC_~>_!Zw(~R$&YuKU{)}X zyw4LT#Bs}u{$87%F84^};O6;$ZG?9yMgmiz09BY5jdiL zap3AxPLPoJ(!q4w*)Zo%cfOy>^li^~zw=0kR5|#uW;WjGLGH(dT-lBz%9|EI9Jk<- z1&W{eUPp#I&NEzQ-{=&1;CEVtHl$79Ww4VID69y4_eZx%{JaQ9)Zg{PM1C35`k_tT zX-V-J!5^8kFWi1tEcx_i7o^L{Kh{|xbdEq=AGapYmB$eszY5p69p5T<2S?Af2L{8} zPy3d9$&JR&2^|WClsNb~o2&4A@{Ge7T=l7#-WO$B~h26>7r~8K*IctFJHjdbmc?;a$bYBcxowr}2mUVpLyN1t@4(GV>R~Zq69tr3x7m#H5FXD*u2XUQCYkhVL zRCk9+BDZ!3yG@f_{MptjRp&OO$idIucL(=09MyzeKs}2f!fSQlEzvJh8qK?X^QO$F zcWk>WYCnZ~wO@7Xw-JJ0{?Vbr>oOeCar;jp@{1f{*lHDZX|VQO-l9fxE%iS3p6aYc z$RlGNDL9J&fAc=?;L4{W6_@U~nAku5b+~2vJ^A8i^WPA(2czK>zsS?Kv z9o;$dX46D}_JWBk5`3TdwiS))%H|UM47WGHK`Oesk@(2x^Z0xb#0P??AKbY5o06Yv zB(*-g+sP-8Ec>zAcyknB@(J zhWDj#8yB7vTUZu_)x483dM}A~&&d{kY?aFmkl6>|F z(&QXBx&uTYhw&We*6_Kkl+t$OToxe0?{tRiy`cCly94jlE*1#)&6C=jozhuk*J#}w zN!Vww9VP<3FFwA{@a`jW?T<2>TQ<=TKboZH9YmFB(GEAkHE7VmCI)B&OD`kH%ss;Gj(-+z>J&gA!QE#aCHp9cZQWp-g#3Tv3TLSuOm$E zvfQ<_XU+@zxTBBKr#+nTc$ZkvX~KMBA2WEUfIiW4f%qXRjtH-UKkz%}cbMXl#%Hx_ zGwg~+U(9(nKYwD5K>w@UY~pywUJ)R^27S#oIfIQ;aYT4!n!1R*{NB60t5Pn#>t!hZ zIu?QWf5AGMVE=n$(b#5#BWl0OF(RKt6Ma{L%Ul8XhfCI$#L2v^!fq2S-eA3Q}WlDOm7( zMvk8m0QNo^RG02C!V%F`T*4sQEA`4KWNW`G^=eh#eSQtbZQAn5lb<(2Ry^&sBY_KO zr14)E0M|4~>^N!y`u+#D^QY5l#7=;So|5-QqMq1|9Os;x7pDUrO*$xOF>vqbt@l;x z#~^#2diJnk<1b9XBY|kr_)7(BV!^(`;~k${Cs9{4L`kI3L82~F1p4Nh`J*K)xb3CL zJIH~jt^*0V#XBa>MwG|)O;niXTIZu#{kaxL%w7vF-PsN+L(RQOb1wuo3Qgya9gI1A zX|f+=%2U^ognxm31@jEzan;79789 z$TxZUq`i<6Pdz6R@ue+dCYwT!;e7Z8zrWCY^Y9mrsGWYlh`Msc&mO2+F424XQL5{h z?6ML8@r}$49*`qXU1t)=QHU6L{(-*71@D!?8(Hw0dhEAVka->S@xc+%RgAky)D<^b z6SZvGQfszbTZY4z#V_{F^k30o0@?A>wYCCpvpHXaBSXMGU&r$VxId^LUR)0HCxV!6 zGf`K{eA#5_WkAL#JFWAwT;WWiJ427BB?VuJS+Ah1xE zV;0j&(_hF;nW2g!qNf~kfT$;3dvRE*regjid!dd-VabOkMKbTckRTJDdbZeu(6I#s zOVMuaECUxRn{h;ROrp;bb(Gydr4=rozIpDTY}hReaT8ifPtT?2kPS~AI}&=8E&&`y zfa9%bkS_3h%^d6IHlKv_BF6_b3=v(s2W~{&K#iGOW+;~E>?x5 zGf!Q6%s#BLLnbtlMNI)?KzAV6-r2$4-Vh|{1X(-V>R8)~TQuKOGT9XoCc;$sJ+Cb- z`_M`19*{sG8yze0Yi%jU?x04ElZy`7G=xUyTyuaNoGlzo~O z@0-2iM0WLdCyrfdL;e+O@!z+rS7a3?`y6d^ZZcNczpC{1nzNwKgOJaQw$+Un57O5* zBdva_XSv;GN+k=vK!yCJ$r8tH7HLhMu?qBzx7T(n3sQnNV1+jF_vb(EPleXSZtS)j zmG}_wM|KV4VjotxA%FkV;_{<2vLq8mg5OpVC!K+oYdQDvLB9aKA9rU8s(9kR5`p~Z zudbMV*tFctM)aol{znxGr`@HxrhqU)o>L>nE-Jk}t#gmr_llT>0n4&FUNx#cYvlah z0>r7IiBUh(XS5F9Ox4e=N;{EJKV{b>q+*9`t$-ox>sE+E>ojCCa-UoieNd6D$Y^N8 zet-ya1`+kSa?R6(eZBHY3A6InmddjLwLOWu9JSys+KX zV^xI}_M8tf!KUJ6f&2Q-(hd*juKfdd+GYj+?!~TgLe_9J3vL)ySNqcO6S`3hZM;z4 z`O|dnO#JtQAZwss;XUuUA1kQu*vZ2c*HrFB^tR>AgBKd|yF%dKuoABmB8eWqxBdzL zAX~4YUNB_yj_D`xObJ=Tadqw_`_ub07hTy8MVU*7l{`xt6J+sz2k?=NxNni2?5mwR ztjL?}ex;tn)^Xb(OJR=@5Q(fW53@FPtUn~t +# Custodian Brief — sand-boxer + +**Domain:** infotech +**Last synced:** 2026-10-14 00:16 UTC +**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + +## Active Workstreams + +### Owner-mediated governed bwrap execution +Progress: 4/5 done | workplan_id: `b616d1cd-208f-5ecf-a4a0-a028396422c4` + +**Open tasks:** +- ! Prove one governed rein and coordinate consumers `c6812fd4` + *(wait: Waits on SAND-WP-0015-T04: corrected runtime ee3d0a53 admission and one successful authorized owner-runtime acceptance before a real rein command runs through the owner API.)* + +### Provide a pinned bwrap rein runtime and private state +Progress: 5/6 done | workplan_id: `d3f12387-fd23-58f0-b979-9c811507614d` + +**Open tasks:** +- ! Resolve Claude credentials, enforced egress, and production acceptance `58817ef6` + *(wait: Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt.)* + +## Inbox Hygiene + +**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. +**Missing thread_id:** 2 unread message(s) lack supersession chains. + +--- +## MCP Orientation (when available) + +If the state-hub MCP server is reachable, call: +`get_domain_summary("infotech")` +This provides richer cross-domain context. +If the MCP call fails, use this file as your orientation source. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/WORK-RECORDS.md.worktree new file mode 100644 index 00000000..1f625140 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/WORK-RECORDS.md.worktree @@ -0,0 +1,126 @@ +# Work Records — sand-boxer + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | SAND-WP-0001 | finished | — | workplans/SAND-WP-0001-statehub-bootstrap.md | +| workplan | SAND-WP-0002 | finished | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| workplan | SAND-WP-0003 | finished | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| workplan | SAND-WP-0004 | finished | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md | +| workplan | SAND-WP-0005 | finished | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| workplan | SAND-WP-0006 | finished | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| workplan | SAND-WP-0007 | finished | — | workplans/SAND-WP-0007-snapshot-restore.md | +| workplan | SAND-WP-0008 | finished | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| workplan | SAND-WP-0009 | finished | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| workplan | SAND-WP-0010 | finished | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| workplan | SAND-WP-0011 | finished | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| workplan | SAND-WP-0012 | finished | — | workplans/SAND-WP-0012-packer-orchestration.md | +| workplan | SAND-WP-0013 | finished | — | workplans/SAND-WP-0013-bwrap-extension.md | +| workplan | SAND-WP-0014 | blocked | — | workplans/SAND-WP-0014-owner-mediated-execution.md | +| workplan | SAND-WP-0015 | blocked | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | +| task | SAND-WP-0001-T01 | done | — | workplans/SAND-WP-0001-statehub-bootstrap.md | +| task | SAND-WP-0001-T02 | done | — | workplans/SAND-WP-0001-statehub-bootstrap.md | +| task | SAND-WP-0001-T03 | done | — | workplans/SAND-WP-0001-statehub-bootstrap.md | +| task | SAND-WP-0002-T01 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T02 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T03 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T04 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T05 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T06 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T07 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T08 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T09 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0002-T10 | done | — | workplans/SAND-WP-0002-meta-framework-foundation.md | +| task | SAND-WP-0003-T01 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T02 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T03 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T04 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T05 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T06 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T07 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T08 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0003-T09 | done | — | workplans/SAND-WP-0003-wise-validator-extraction.md | +| task | SAND-WP-0004-T01 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md | +| task | SAND-WP-0004-T02 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md | +| task | SAND-WP-0004-T03 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md | +| task | SAND-WP-0004-T04 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md | +| task | SAND-WP-0004-T05 | done | — | workplans/SAND-WP-0004-the-custodian-e2e-shim.md | +| task | SAND-WP-0005-T01 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| task | SAND-WP-0005-T02 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| task | SAND-WP-0005-T03 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| task | SAND-WP-0005-T04 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| task | SAND-WP-0005-T05 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| task | SAND-WP-0005-T06 | done | — | workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md | +| task | SAND-WP-0006-T01 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| task | SAND-WP-0006-T02 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| task | SAND-WP-0006-T03 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| task | SAND-WP-0006-T04 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| task | SAND-WP-0006-T05 | done | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| task | SAND-WP-0006-T06 | cancel | — | workplans/SAND-WP-0006-saas-extensions-and-payments.md | +| task | SAND-WP-0007-T01 | done | — | workplans/SAND-WP-0007-snapshot-restore.md | +| task | SAND-WP-0007-T02 | done | — | workplans/SAND-WP-0007-snapshot-restore.md | +| task | SAND-WP-0007-T03 | done | — | workplans/SAND-WP-0007-snapshot-restore.md | +| task | SAND-WP-0007-T04 | done | — | workplans/SAND-WP-0007-snapshot-restore.md | +| task | SAND-WP-0007-T05 | done | — | workplans/SAND-WP-0007-snapshot-restore.md | +| task | SAND-WP-0007-T06 | done | — | workplans/SAND-WP-0007-snapshot-restore.md | +| task | SAND-WP-0008-T01 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T02 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T03 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T04 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T05 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T06 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T07 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T08 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T09 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0008-T10 | done | — | workplans/SAND-WP-0008-host-telemetry-and-self-canary.md | +| task | SAND-WP-0009-T01 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T02 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T03 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T04 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T05 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T06 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T07 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T08 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0009-T09 | done | — | workplans/SAND-WP-0009-ttl-and-operational-hardening.md | +| task | SAND-WP-0010-T01 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0010-T02 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0010-T03 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0010-T04 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0010-T05 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0010-T06 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0010-T07 | done | — | workplans/SAND-WP-0010-cloud-adapters-and-billing.md | +| task | SAND-WP-0011-T01 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0011-T02 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0011-T03 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0011-T04 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0011-T05 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0011-T06 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0011-T07 | done | — | workplans/SAND-WP-0011-reachability-and-consumer-profiles.md | +| task | SAND-WP-0012-T01 | done | — | workplans/SAND-WP-0012-packer-orchestration.md | +| task | SAND-WP-0012-T02 | done | — | workplans/SAND-WP-0012-packer-orchestration.md | +| task | SAND-WP-0012-T03 | done | — | workplans/SAND-WP-0012-packer-orchestration.md | +| task | SAND-WP-0012-T04 | done | — | workplans/SAND-WP-0012-packer-orchestration.md | +| task | SAND-WP-0012-T05 | done | — | workplans/SAND-WP-0012-packer-orchestration.md | +| task | SAND-WP-0012-T06 | done | — | workplans/SAND-WP-0012-packer-orchestration.md | +| task | SAND-WP-0013-T01 | done | — | workplans/SAND-WP-0013-bwrap-extension.md | +| task | SAND-WP-0013-T02 | done | — | workplans/SAND-WP-0013-bwrap-extension.md | +| task | SAND-WP-0013-T03 | done | — | workplans/SAND-WP-0013-bwrap-extension.md | +| task | SAND-WP-0013-T04 | done | — | workplans/SAND-WP-0013-bwrap-extension.md | +| task | SAND-WP-0013-T05 | done | — | workplans/SAND-WP-0013-bwrap-extension.md | +| task | SAND-WP-0013-T06 | done | — | workplans/SAND-WP-0013-bwrap-extension.md | +| task | SAND-WP-0014-T01 | done | — | workplans/SAND-WP-0014-owner-mediated-execution.md | +| task | SAND-WP-0014-T02 | done | — | workplans/SAND-WP-0014-owner-mediated-execution.md | +| task | SAND-WP-0014-T03 | done | — | workplans/SAND-WP-0014-owner-mediated-execution.md | +| task | SAND-WP-0014-T04 | done | — | workplans/SAND-WP-0014-owner-mediated-execution.md | +| task | SAND-WP-0014-T05 | wait | — | workplans/SAND-WP-0014-owner-mediated-execution.md | +| task | SAND-WP-0015-T01 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | +| task | SAND-WP-0015-T02 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | +| task | SAND-WP-0015-T03 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | +| task | SAND-WP-0015-T04 | wait | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | +| task | SAND-WP-0015-T05 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | +| task | SAND-WP-0015-T06 | done | — | workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md | diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/originals.json new file mode 100644 index 00000000..693ae837 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-backup/originals.json @@ -0,0 +1,10 @@ +[ + { + "path": ".custodian-brief.md", + "index": "100644 9cc4a0d49cdc0816fd74feb81cdfc5b5154fd849 0\t.custodian-brief.md" + }, + { + "path": "WORK-RECORDS.md", + "index": "100644 1f6251402ca5fcc85ef6b832bf2da25aeb0fc9b3 0\tWORK-RECORDS.md" + } +] diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-commit.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-commit.json new file mode 100644 index 00000000..cefb5790 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-commit.json @@ -0,0 +1,13 @@ +{ + "exit_code": 0, + "commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e", + "base": "53f800c4f7a9c91469834d04ef6f58e906b0bd49", + "files": [ + { + "path": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md", + "sha256": "56022703fd4d973f40ddad8eb99cb02783b086549b24ef89f89157de33eafe31" + } + ], + "stdout": "[main c7c3102] docs(identity): point current metered gate at issued HARNESS task\n 1 file changed, 1 insertion(+), 1 deletion(-)\n", + "stderr": "" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-manifest.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-manifest.json new file mode 100644 index 00000000..225f5f27 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/publication-manifest.json @@ -0,0 +1,11 @@ +{ + "owner": "sand-boxer", + "base_revision": "53f800c4f7a9c91469834d04ef6f58e906b0bd49", + "message": "docs(identity): point current metered gate at issued HARNESS task", + "files": [ + { + "path": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md", + "sha256": "56022703fd4d973f40ddad8eb99cb02783b086549b24ef89f89157de33eafe31" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/required-checks.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/required-checks.json new file mode 100644 index 00000000..04b1c552 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/required-checks.json @@ -0,0 +1,10 @@ +{ + "observed_at": "2026-10-17T10:59:00.290205+00:00", + "command": "make check", + "required_by": "sand-boxer/AGENTS.md and .claude/rules/stack-and-commands.md", + "lint": "passed", + "tests_passed": 220, + "exit_code": 0, + "warning": "existing Starlette testclient deprecation warning; no test failure", + "scope": "existing owner checks, no implementation change or native production acceptance" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/source-before.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/source-before.json new file mode 100644 index 00000000..b57c4415 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/source-before.json @@ -0,0 +1,8 @@ +{ + "observed_at": "2026-10-17T10:57:25.565702+00:00", + "head": "53f800c4f7a9c91469834d04ef6f58e906b0bd49", + "status": "", + "instructions_sha256": "sha256:979d90f2945656a02c867c724a90966819d6eb6c8624a2c1e07b21f5d32b4449", + "source_sha256": "sha256:230d1ef37aa9c2023335a617492a72678c4671a8bc82d5577e9d7a7cea6e8fe4", + "index_sha256": "sha256:e9c14c64f7319eed77603103a13f1422726121bd9ee475902f4501a8781bf02d" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/verified-bindings.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/verified-bindings.json new file mode 100644 index 00000000..37de4715 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/verified-bindings.json @@ -0,0 +1,54 @@ +{ + "observed_at": "2026-10-17T11:27:49.876854+00:00", + "status": "source_and_task_bindings_verified", + "source_file": "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md", + "source_sha256": "sha256:56022703fd4d973f40ddad8eb99cb02783b086549b24ef89f89157de33eafe31", + "all_source_UUIDs_preserved": true, + "all_task_fields_preserved_except_approved_SAND_blocking_label": true, + "tasks": [ + { + "record_id": "SAND-WP-0015-T01", + "id": "93e4aad8-ba9b-5850-93d4-b5bf78ac8978", + "status": "done", + "needs_human": false, + "workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d" + }, + { + "record_id": "SAND-WP-0015-T02", + "id": "c8a689f8-bdf2-57a2-8521-a1c0ca44e750", + "status": "done", + "needs_human": false, + "workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d" + }, + { + "record_id": "SAND-WP-0015-T03", + "id": "1a3002f6-c6a8-59d0-9d38-942028419de5", + "status": "done", + "needs_human": false, + "workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d" + }, + { + "record_id": "SAND-WP-0015-T04", + "id": "58817ef6-76d9-5e34-908f-c024e6c99f93", + "status": "wait", + "needs_human": false, + "workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d" + }, + { + "record_id": "SAND-WP-0015-T05", + "id": "f0163cda-b581-56a0-a0dd-9c8a436f5bbe", + "status": "done", + "needs_human": false, + "workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d" + }, + { + "record_id": "SAND-WP-0015-T06", + "id": "f85f54c9-1081-5d0c-95ad-aca20ede8d66", + "status": "done", + "needs_human": false, + "workplan_id": "d3f12387-fd23-58f0-b979-9c811507614d" + } + ], + "historical_prose_preserved": true, + "native_action_by_this_subtask": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.postimage.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.postimage.md new file mode 100644 index 00000000..34c6aeba --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.postimage.md @@ -0,0 +1,375 @@ +--- +id: SAND-WP-0015 +type: workplan +title: "Provide a pinned bwrap rein runtime and private state" +domain: infotech +repo: sand-boxer +status: blocked +flavor: implementation +owner: codex +topic_slug: bwrap-runtime-and-private-state +created: "2026-09-05" +updated: "2026-10-04" +state_hub_workstream_id: "d3f12387-fd23-58f0-b979-9c811507614d" +--- + +# Provide a pinned bwrap rein runtime and private state + +Implement the runtime prerequisites returned by Glas in `GLAS-WP-0012` and +`docs/local-profile-acceptance.md`. Continue owner work `SAND-WP-0014-T05` and +live residual `GLAS-IN-0002`. Runtime startup is a separate acceptance gate +from credential delivery, enforced provider egress, and a real model task. + +## Mount an owner-selected, digest-pinned Python runtime + +```task +id: SAND-WP-0015-T01 +status: done +priority: high +state_hub_task_id: "93e4aad8-ba9b-5850-93d4-b5bf78ac8978" +``` + +Add exact artifact verification to trusted extension configuration and mount +the standalone runtime read-only at a fixed namespace path. Reject altered +content/modes, unexpected files, escaping symlinks, special files, and source +or workspace overlap. A caller cannot choose runtime paths through exec input. +Provide a non-editable rein-aharness/llm-connect bundle builder with recorded +source revisions and resolved dependency versions. + +Completed 2026-09-05. `extensions/runtime.py` verifies complete artifact +contents/modes before a read-only mount; the builder installed committed +rein-aharness `1429db5` and llm-connect `0056094` without editable source paths. +Candidate digest and source/package evidence are in `docs/bwrap-runtime.md`. + +## Keep writable runtime state outside the repository + +```task +id: SAND-WP-0015-T02 +status: done +priority: high +state_hub_task_id: "c8a689f8-bdf2-57a2-8521-a1c0ca44e750" +``` + +Create private mode-0700 HOME/config/cache/state/tmp directories within the +namespace, preserve them across exec requests, and remove them with teardown. +Keep the command environment sanitized and disable Python user-site/bytecode +writes. Fail closed on profile network/setup-credential declarations that the +current bwrap implementation cannot honor. + +Completed 2026-09-05. Mode-0700 namespace HOME and XDG/TMP directories sit +outside the copied Git tree. Explicit runtime PATH selection remains owner +controlled. Unsupported egress/default-allow and setup credentials now refuse +before workspace creation; regression tests cover these boundaries. + +## Verify the real rein runtime and owner regression paths + +```task +id: SAND-WP-0015-T03 +status: done +priority: high +state_hub_task_id: "1a3002f6-c6a8-59d0-9d38-942028419de5" +``` + +Run `make check`, the existing authenticated cross-request owner smoke, and a +real runtime startup smoke. Verify the actual rein CLI and adapter imports, +read-only runtime, private HOME, clean worktree, absent source, loopback-only +network, and teardown. Keep the production Glas profile blocked. + +Completed 2026-09-05. `make check`: lint clean, 132 tests passed. Authenticated +owner API smoke `223db65b` returned HTTP 200 and proved exact consumer identity, +stdin delivery, absent source, loopback-only network and complete teardown. +Pinned runtime smoke `d4de9531` ran the actual rein CLI and imported its Claude +adapter, proved read-only runtime/private HOME/clean worktree, retained private +state across a second exec, and removed the workspace. No model call or +credential acquisition occurred; T04 remains waiting. + +## Resolve Claude credentials, enforced egress, and production acceptance + +```task +id: SAND-WP-0015-T04 +status: wait +blocked_on: message-from:rein-aharness +blocking_reason: "Tracked as HARNESS-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt." +priority: high +state_hub_task_id: "58817ef6-76d9-5e34-908f-c024e6c99f93" +``` + +The 2026-09-05 routing lookup found no concrete Anthropic/Claude workload lane. +The generic OpenBao template is not a delegable lane; the OpenRouter AppRole +belongs to another rein. Credential owner railiance-platform/OpenBao plus +rein-aharness must establish a concrete Claude-compatible route and delivery/ +revocation contract before values can be requested or supplied to the runtime. + +Sand-boxer must then implement the matching enforced provider egress contract +(including DNS/TLS and denied-destination proof) and pin/deploy the actual +Claude executable. No unrestricted-network or interactive-login substitute is +permitted. Review the deployed runtime/profile with Glas, run its real-rein +acceptance fixture, and update only the proven profile's readiness. No +production schedule is enabled by the runtime-startup smoke. + +This task and SAND-WP-0014-T05 remain open until those gates pass. The detailed +return contract and runtime proof are in `docs/bwrap-runtime.md`; the live +cross-repo residual remains `GLAS-IN-0002`. + +## 2026-09-05 transport implementation evidence + +T04 remains waiting on owner machine authentication, protected credential +delivery, pinned Claude startup and the real model proof. CCR-2026-0016 custody +is confirmed by a metadata-only check of live version 2; no value was read. +HTTPS egress is now implemented as an exact owner/profile allowlisted CONNECT +proxy while retaining an isolated network namespace. Non-secret live smoke +sandbox e290e788 verified provider TLS response, undeclared destination and +direct-IP denial, and proxy/workspace teardown. See docs/bwrap-egress.md. + +## 2026-09-05 credential transport owner return + +Owner-bound exec-env transport is implemented and proved with a synthetic +provider in real sandbox 0e5fb35a. Exact route/profile/project/actor/run binding, +child-only key injection, pre-truncation redaction, next-exec absence and teardown +pass. No real key read or production profile activation. See docs/bwrap-credentials.md. +SECRETS-WP-0009 now owns native AppRole adoption for CCR-2026-0016, including +a data-only consumer read policy. Its production exec refuses before OpenBao +until SECRETS-WP-0007-T04 and SECRETS-WP-0008-T02/T06 deliver canonical +authorization/consume and service authority. T04 remains waiting on that live +owner path, the pinned Claude executable and real model acceptance. + +## 2026-09-06 combined-runtime candidate returned to Glas + +Answered the GLAS-WP-0015 handoff. Added candidate profile +`profile.claude-agent-dev-proof` version 1.1.0 (`ext.bwrap`, localhost-only, +`default: deny` with declared `api.anthropic.com:443`) for GLAS-WP-0012 review. +The committed profile grants no egress by itself: `ext.bwrap` refuses it unless +the owner extension config allowlists the destination, and a regression test now +asserts that fail-closed default. `make check`: lint clean, 172 tests passed. + +Resolved the differing project examples in favour of the acceptance runner's +`actor: agt` / `project: glas-local-proof`, and bound the documented credential +route to that single project rather than broadening it. The full return contract +— profile id/revision, host scope, consumer tuple, runtime digest and mount +paths, declared egress, and the value-free denial/cleanup receipts — is in +`docs/bwrap-runtime.md`. + +T04 stays `wait`: the concrete Claude credential lane and delivery/revocation +contract, owner machine authentication, the pinned Claude executable with its +own proxy startup proof, and the real-model acceptance are still operator and +upstream-owner gated. Provider workspace scope and spend limit remain operator +inputs. `SAND-WP-0014-T05` remains open on the same gates. + + +## Package and prove the pinned Claude executable independently of custody + +```task +id: SAND-WP-0015-T05 +status: done +priority: high +state_hub_task_id: "f0163cda-b581-56a0-a0dd-9c8a436f5bbe" +``` + +Split the independent executable packaging/startup portion from T04 so credential +custody does not hide completed local runtime work. Implement explicit binary +pinning, reject mismatches/host wrappers, and prove actual startup with the +broker proxy environment and complete cleanup. T04 retains protected deployment, +credential adoption and real-provider acceptance. + + +## Pinned Claude candidate and isolated startup — 2026-09-06 + +The builder now accepts `--claude-binary`, `--claude-sha256` and +`--claude-version` together. It requires a regular native ELF file, verifies the +exact copied bytes, refuses symlinks/wrappers/mismatches and existing destination +files, and copies only the executable as bin/claude mode 0755. The expected +version is metadata until the sandbox smoke checks the actual output. No +interactive HOME, provider key or login state is copied. + +Candidate provenance: the explicitly selected installed native release +`/home/worsch/.local/share/claude/versions/2.1.263`, SHA-256 +`26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba`. +This is a digest pin of the selected local artifact, not an upstream signature +verification claim. Complete runtime candidate: +`/tmp/sandboxer-claude-runtime-20260906`, SHA-256 +`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +Mount remains `/opt/sandboxer/runtime`; Claude is `/opt/sandboxer/runtime/bin/claude`. +Rein sources remain 1429db5 / llm-connect 0056094; resolved dependency versions +are recorded in the evidence. Rebuilding may resolve different dependencies; +the complete digest pins this artifact, not future builds. + +Sandbox f8821ec2 ran real `claude --version` -> `2.1.263 (Claude Code)` plus rein +CLI/import checks, with owner allowlisted provider egress and HTTPS_PROXY set +by the broker. Runtime read-only, private 0700 HOME/state persistence, clean Git, +absent source and loopback-only interfaces passed; workspace and proxy removed. +`make check`: lint passed, 175 tests passed. + +Evidence: docs/evidence/SAND-WP-0015-claude-startup-2026-09-06.json. +Reproduce with the builder options above and `scripts/smoke-bwrap-runtime.py +--runtime-path --runtime-sha256 --claude-version 2.1.263`. + +Limits: `--version` proves startup with the proxy environment, not that Claude +has sent a provider request through it. No credential acquisition or model run. +The /tmp candidate is not production placement; protected artifact installation, +owner configuration, credential adoption and real-model proof remain T04 gates. + + +## Install the pinned runtime in the local owner's protected store + +```task +id: SAND-WP-0015-T06 +status: done +priority: high +assignee: the-custodian +state_hub_task_id: "f85f54c9-1081-5d0c-95ad-aca20ede8d66" +``` + +HFACT-WP-0001-T04 consumes this independent installation return. Reuse the +already verified combined candidate with digest +`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`; +do not rebuild resolved dependencies. Publish it under the local owner's +private artifact store, verify exact copied content/modes and refusal of unsafe +or corrupted destinations, and prove startup/read-only access/teardown through +the installed path. The owner remains trusted; this is not root-owned storage. +T04 retains real credential adoption, owner configuration, model acceptance +and production placement. No credential route or profile is activated here. + +`scripts/install-bwrap-runtime.py` installs below the owner's home into a +mode-0700 store, verifies before and after copying, preserves artifact modes +and internal symlinks, serializes publishers and never overwrites a published +artifact. Existing modified artifacts are refused rather than repaired silently. +Group/other-writable ancestors, unsafe permission bits and store aliases refuse. +Unit tests cover integrity, idempotence, copy-time corruption and access modes. + + +T06 completed 2026-09-08 on bnt-lap001, local owner UID 1000. Installed the +unchanged 358-entry / 245176062-byte candidate at +`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +The private store is mode 0700; the installing owner remains trusted. A root-owned +system installation was not claimed or required for this local owner contract. +The installed-path sandbox smoke `51b59587` passed real Claude 2.1.263 and rein +startup, read-only mount, private state persistence, clean worktree, absent source, +loopback-only interfaces and complete workspace/proxy teardown. No model call +or credential acquisition occurred. `make check`: lint clean, 188 tests passed. +Two existing tests require the checkout directory name `sand-boxer`; the final +full check used that canonical basename. Evidence: +`docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`. +T04 retains owner execution configuration, native credential/egress and real-model +acceptance; Railiance installation needs its own target-specific return. + +## 2026-09-09 factory metered route source return + +Implemented the trusted, ephemeral Messages route described in +[docs/bwrap-messages-route.md](../docs/bwrap-messages-route.md). Actual local +bwrap owner transport proves provider key/ledger separation, direct-route denial, +revocation and teardown; rein also proves metered request plus commit import and +close replay. `make check`: lint clean, 199 passed. T04 remains waiting for the +admitted provider-to-owner bootstrap, updated protected runtime/profile, Railiance +placement, live compatibility and G0. Existing child-provider-key/direct-CONNECT +proofs do not admit this different credential holder or metered profile. No CCR, +secret read, deployment or paid request was performed. + +## 2026-09-09 standalone owner packaging and runtime selection + +Added frozen-lock owner build mode for the matched rein/llm/Glas/sandboxer set, +with non-editable installation and recorded lock/source/package pins. Sand-boxer +wheels now carry their profile and extension definitions, fixing a bwrap owner +failure that source-checkout tests could hide. The trusted Messages binding can +select the digest-pinned runtime without adding an API or profile override. +`make check`: lint clean, 205 passed. Existing standalone workload builds remain +supported. See docs/bwrap-runtime.md and rein's docs/owner-bootstrap.md. + +The project's `evidence/2026-09-09-owner-bootstrap.json` records the actual candidate +build and isolated installed-interpreter/CLI proof. T04 remains wait for accepted +credential-to-owner delivery, current protected installation and Railiance placement, +provider compatibility and G0. Source packaging does not reopen completed T01-T03, +T05-T06, broaden the old CCRs or activate the previously installed 2.1.263 artifact. + +The first standalone candidate exposed a stale cached local wheel despite current +Git metadata. Owner builds now refresh all local distributions and compare every +installed package source/definition file with its tracked source; stale, missing or +extra files refuse the build. Four content-conformance regressions cover that gap. + + +## 2026-09-27 installed launcher defect and guarded correction + +REINAH-WP-0003's single admitted attempt completed native provider/companion +apply, verify and exec, including scoped-token revocation. The claimed job +`6efa9436-6a91-47c0-94e5-b31b5a0e7e3a` failed before any provider request +reservation. The sandbox was destroyed and the source repository is unchanged. +The parent EUR 10 liability remains held for explicit reconciliation; no retry +or replacement authority is inferred. + +Installed artifact `b6e4e8a4` contains uv-generated three-line shell launchers +that still reference a vanished temporary build interpreter. The builder had +only rewritten direct Python shebangs. Fixed both generated forms and added +actual relocation/execution tests for direct, long and space-containing build +paths, plus refusal of unknown governed launchers. Builder tests: 12 passed; +focused lint passes. Rein's real installed bwrap probe reproduces both broken +entrypoints at exit 127 with zero provider forwards; its new bootstrap checks +refuse the malformed artifact before claiming. + +T04 remains `wait` and this plan stays `blocked`: replacement artifact build/ +admission and a separately authorized successful model/tool/commit proof remain. +The existing SAND-WP-0015 / REINAH-WP-0003 / SECRETS-WP-0009 records retain the +work. No new task or workplan. Detailed non-secret receipts are in rein-aharness +`docs/evidence/2026-09-27-metered-*.json`. + + +## 2026-10-04 offline owner startup proof preparation + +The existing no-credential smoke command now supports +`--require-owner-entrypoints`: the admitted digest-pinned runtime must start both +`rein-aharness --help` and `glas-harness --help`, and imported rein, llm-connect, +Glas and sandboxer modules must originate inside the mounted artifact. Broken or +missing launchers, failed help, timeout and external package origins cannot be +recorded as startup success. The default standalone mode remains supported. +Launcher diagnostics are not copied into the receipt. Focused tests exercise +real subprocesses, including the vanished-build-interpreter failure. + +This is preparation for a corrected immutable candidate's independent native +startup proof; it is not that candidate's receipt or owner acceptance. T04 stays +`wait`, the plan stays `blocked`, and the Sept27 artifact/liability evidence +remains intact. Replacement artifact admission and pins, explicit retained +EUR 10 reconciliation, and a separately authorized successful model/tool/commit +attempt remain with the existing owners. No credentials, provider request, +queue claim, policy activation or retry authorization is supplied here. + +2026-10-04 current blocker reconciliation: September 27 native provider/companion +apply/verify/exec and successful revocation supersede the original missing +platform route. The remaining owner return is rein-aharness corrected artifact/ +profile admission, retained EUR10 reconciliation and fresh retry authority. +T04 stays wait; no renewed trial is authorized. Full owner check: lint clean, +219 tests passed (one existing Starlette deprecation warning). + +## 2026-10-13 owner returns: reconciliation and corrected build + +rein-aharness `d897a83` records owner reconciliation of the Sept 27 held +liability: run `6efa9436` failed at launcher exit 127 before any provider +reservation; liability stays at the full hold, exhausting that one-attempt +envelope, and the owner authorized a new retry envelope on 2026-10-13. +rein-aharness `9a4469d` records corrected runtime `ee3d0a53…` (replaces +`b6e4e8a4…`; only rein moved, adding pre-claim launcher rejection), built with +the sand-boxer builder fix; both launchers exit 0 inside bwrap. Receipts: +rein-aharness `docs/evidence/2026-10-13-*.json`. + +Remaining before T04 closes: install `ee3d0a53` on railiance01, pin its digest +in owner config, pass `--require-owner-entrypoints` offline startup proof, then +run the single authorized attempt to a successful model/tool/commit receipt. +T04 stays `wait`; the plan stays `blocked`. + +2026-10-14 check: rein-aharness pushed `9a4469d` (corrected build record) and +opened REINAH-WP-0008 (simpler metered retry, active). No railiance01 install/ +admission of `ee3d0a53` or successful acceptance receipt yet; request sent on +hub message `82faf25c`. T04 stays `wait`; plan stays `blocked`. + +2026-10-14 rein-aharness reply (thread `82faf25c`): step 1 done (`9a4469d` on +origin/main). Steps 2-4 are REINAH-WP-0008-T07. Budget is now up to three +attempts within EUR 10 under memo `infd-20261014-b01` (observed-usage +settlement); order: memo acceptance in the attended informed-decision sitting, +rebuild and install `ee3d0a53` on railiance01, `metered-once --rehearse`, +`owner renew`, first attempt. Railiance01 still pins `b6e4e8a4`. T04 stays `wait`. + +2026-10-15 owner-approved rebuild: the pinned inputs of the `ee3d0a53` receipt +(same four commits, uv.lock `8775904b…`, Claude 2.1.266 `19842705…`) rebuilt +to `818b1b7c8292…f359`. The digest differs only because the builder embeds +absolute source paths (`direct_url.json`, `build-info.json`). Owner-entrypoint +startup smoke passed in sandbox `28df7a1d`; no credentials or model calls. +Sent to rein-aharness (message `8a7962f7`, thread `82faf25c`) to record as the +then-current corrected runtime for REINAH-WP-0008-T07 and to load the unsigned +memo sitting. Nothing installed on railiance01. T04 stays `wait`. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.preimage.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.preimage.md new file mode 100644 index 00000000..4d924a15 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/sand-boxer/workplan.preimage.md @@ -0,0 +1,375 @@ +--- +id: SAND-WP-0015 +type: workplan +title: "Provide a pinned bwrap rein runtime and private state" +domain: infotech +repo: sand-boxer +status: blocked +flavor: implementation +owner: codex +topic_slug: bwrap-runtime-and-private-state +created: "2026-09-05" +updated: "2026-10-04" +state_hub_workstream_id: "d3f12387-fd23-58f0-b979-9c811507614d" +--- + +# Provide a pinned bwrap rein runtime and private state + +Implement the runtime prerequisites returned by Glas in `GLAS-WP-0012` and +`docs/local-profile-acceptance.md`. Continue owner work `SAND-WP-0014-T05` and +live residual `GLAS-IN-0002`. Runtime startup is a separate acceptance gate +from credential delivery, enforced provider egress, and a real model task. + +## Mount an owner-selected, digest-pinned Python runtime + +```task +id: SAND-WP-0015-T01 +status: done +priority: high +state_hub_task_id: "93e4aad8-ba9b-5850-93d4-b5bf78ac8978" +``` + +Add exact artifact verification to trusted extension configuration and mount +the standalone runtime read-only at a fixed namespace path. Reject altered +content/modes, unexpected files, escaping symlinks, special files, and source +or workspace overlap. A caller cannot choose runtime paths through exec input. +Provide a non-editable rein-aharness/llm-connect bundle builder with recorded +source revisions and resolved dependency versions. + +Completed 2026-09-05. `extensions/runtime.py` verifies complete artifact +contents/modes before a read-only mount; the builder installed committed +rein-aharness `1429db5` and llm-connect `0056094` without editable source paths. +Candidate digest and source/package evidence are in `docs/bwrap-runtime.md`. + +## Keep writable runtime state outside the repository + +```task +id: SAND-WP-0015-T02 +status: done +priority: high +state_hub_task_id: "c8a689f8-bdf2-57a2-8521-a1c0ca44e750" +``` + +Create private mode-0700 HOME/config/cache/state/tmp directories within the +namespace, preserve them across exec requests, and remove them with teardown. +Keep the command environment sanitized and disable Python user-site/bytecode +writes. Fail closed on profile network/setup-credential declarations that the +current bwrap implementation cannot honor. + +Completed 2026-09-05. Mode-0700 namespace HOME and XDG/TMP directories sit +outside the copied Git tree. Explicit runtime PATH selection remains owner +controlled. Unsupported egress/default-allow and setup credentials now refuse +before workspace creation; regression tests cover these boundaries. + +## Verify the real rein runtime and owner regression paths + +```task +id: SAND-WP-0015-T03 +status: done +priority: high +state_hub_task_id: "1a3002f6-c6a8-59d0-9d38-942028419de5" +``` + +Run `make check`, the existing authenticated cross-request owner smoke, and a +real runtime startup smoke. Verify the actual rein CLI and adapter imports, +read-only runtime, private HOME, clean worktree, absent source, loopback-only +network, and teardown. Keep the production Glas profile blocked. + +Completed 2026-09-05. `make check`: lint clean, 132 tests passed. Authenticated +owner API smoke `223db65b` returned HTTP 200 and proved exact consumer identity, +stdin delivery, absent source, loopback-only network and complete teardown. +Pinned runtime smoke `d4de9531` ran the actual rein CLI and imported its Claude +adapter, proved read-only runtime/private HOME/clean worktree, retained private +state across a second exec, and removed the workspace. No model call or +credential acquisition occurred; T04 remains waiting. + +## Resolve Claude credentials, enforced egress, and production acceptance + +```task +id: SAND-WP-0015-T04 +status: wait +blocked_on: message-from:rein-aharness +blocking_reason: "Tracked as REINAH-WP-0008-T07 (owner, attended): accept spend memo infd-20261014-b01 (up to three attempts within EUR 10, observed-usage settlement), rebuild/install ee3d0a53 on railiance01, rehearse, renew, then a successful attempt." +priority: high +state_hub_task_id: "58817ef6-76d9-5e34-908f-c024e6c99f93" +``` + +The 2026-09-05 routing lookup found no concrete Anthropic/Claude workload lane. +The generic OpenBao template is not a delegable lane; the OpenRouter AppRole +belongs to another rein. Credential owner railiance-platform/OpenBao plus +rein-aharness must establish a concrete Claude-compatible route and delivery/ +revocation contract before values can be requested or supplied to the runtime. + +Sand-boxer must then implement the matching enforced provider egress contract +(including DNS/TLS and denied-destination proof) and pin/deploy the actual +Claude executable. No unrestricted-network or interactive-login substitute is +permitted. Review the deployed runtime/profile with Glas, run its real-rein +acceptance fixture, and update only the proven profile's readiness. No +production schedule is enabled by the runtime-startup smoke. + +This task and SAND-WP-0014-T05 remain open until those gates pass. The detailed +return contract and runtime proof are in `docs/bwrap-runtime.md`; the live +cross-repo residual remains `GLAS-IN-0002`. + +## 2026-09-05 transport implementation evidence + +T04 remains waiting on owner machine authentication, protected credential +delivery, pinned Claude startup and the real model proof. CCR-2026-0016 custody +is confirmed by a metadata-only check of live version 2; no value was read. +HTTPS egress is now implemented as an exact owner/profile allowlisted CONNECT +proxy while retaining an isolated network namespace. Non-secret live smoke +sandbox e290e788 verified provider TLS response, undeclared destination and +direct-IP denial, and proxy/workspace teardown. See docs/bwrap-egress.md. + +## 2026-09-05 credential transport owner return + +Owner-bound exec-env transport is implemented and proved with a synthetic +provider in real sandbox 0e5fb35a. Exact route/profile/project/actor/run binding, +child-only key injection, pre-truncation redaction, next-exec absence and teardown +pass. No real key read or production profile activation. See docs/bwrap-credentials.md. +SECRETS-WP-0009 now owns native AppRole adoption for CCR-2026-0016, including +a data-only consumer read policy. Its production exec refuses before OpenBao +until SECRETS-WP-0007-T04 and SECRETS-WP-0008-T02/T06 deliver canonical +authorization/consume and service authority. T04 remains waiting on that live +owner path, the pinned Claude executable and real model acceptance. + +## 2026-09-06 combined-runtime candidate returned to Glas + +Answered the GLAS-WP-0015 handoff. Added candidate profile +`profile.claude-agent-dev-proof` version 1.1.0 (`ext.bwrap`, localhost-only, +`default: deny` with declared `api.anthropic.com:443`) for GLAS-WP-0012 review. +The committed profile grants no egress by itself: `ext.bwrap` refuses it unless +the owner extension config allowlists the destination, and a regression test now +asserts that fail-closed default. `make check`: lint clean, 172 tests passed. + +Resolved the differing project examples in favour of the acceptance runner's +`actor: agt` / `project: glas-local-proof`, and bound the documented credential +route to that single project rather than broadening it. The full return contract +— profile id/revision, host scope, consumer tuple, runtime digest and mount +paths, declared egress, and the value-free denial/cleanup receipts — is in +`docs/bwrap-runtime.md`. + +T04 stays `wait`: the concrete Claude credential lane and delivery/revocation +contract, owner machine authentication, the pinned Claude executable with its +own proxy startup proof, and the real-model acceptance are still operator and +upstream-owner gated. Provider workspace scope and spend limit remain operator +inputs. `SAND-WP-0014-T05` remains open on the same gates. + + +## Package and prove the pinned Claude executable independently of custody + +```task +id: SAND-WP-0015-T05 +status: done +priority: high +state_hub_task_id: "f0163cda-b581-56a0-a0dd-9c8a436f5bbe" +``` + +Split the independent executable packaging/startup portion from T04 so credential +custody does not hide completed local runtime work. Implement explicit binary +pinning, reject mismatches/host wrappers, and prove actual startup with the +broker proxy environment and complete cleanup. T04 retains protected deployment, +credential adoption and real-provider acceptance. + + +## Pinned Claude candidate and isolated startup — 2026-09-06 + +The builder now accepts `--claude-binary`, `--claude-sha256` and +`--claude-version` together. It requires a regular native ELF file, verifies the +exact copied bytes, refuses symlinks/wrappers/mismatches and existing destination +files, and copies only the executable as bin/claude mode 0755. The expected +version is metadata until the sandbox smoke checks the actual output. No +interactive HOME, provider key or login state is copied. + +Candidate provenance: the explicitly selected installed native release +`/home/worsch/.local/share/claude/versions/2.1.263`, SHA-256 +`26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba`. +This is a digest pin of the selected local artifact, not an upstream signature +verification claim. Complete runtime candidate: +`/tmp/sandboxer-claude-runtime-20260906`, SHA-256 +`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +Mount remains `/opt/sandboxer/runtime`; Claude is `/opt/sandboxer/runtime/bin/claude`. +Rein sources remain 1429db5 / llm-connect 0056094; resolved dependency versions +are recorded in the evidence. Rebuilding may resolve different dependencies; +the complete digest pins this artifact, not future builds. + +Sandbox f8821ec2 ran real `claude --version` -> `2.1.263 (Claude Code)` plus rein +CLI/import checks, with owner allowlisted provider egress and HTTPS_PROXY set +by the broker. Runtime read-only, private 0700 HOME/state persistence, clean Git, +absent source and loopback-only interfaces passed; workspace and proxy removed. +`make check`: lint passed, 175 tests passed. + +Evidence: docs/evidence/SAND-WP-0015-claude-startup-2026-09-06.json. +Reproduce with the builder options above and `scripts/smoke-bwrap-runtime.py +--runtime-path --runtime-sha256 --claude-version 2.1.263`. + +Limits: `--version` proves startup with the proxy environment, not that Claude +has sent a provider request through it. No credential acquisition or model run. +The /tmp candidate is not production placement; protected artifact installation, +owner configuration, credential adoption and real-model proof remain T04 gates. + + +## Install the pinned runtime in the local owner's protected store + +```task +id: SAND-WP-0015-T06 +status: done +priority: high +assignee: the-custodian +state_hub_task_id: "f85f54c9-1081-5d0c-95ad-aca20ede8d66" +``` + +HFACT-WP-0001-T04 consumes this independent installation return. Reuse the +already verified combined candidate with digest +`5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`; +do not rebuild resolved dependencies. Publish it under the local owner's +private artifact store, verify exact copied content/modes and refusal of unsafe +or corrupted destinations, and prove startup/read-only access/teardown through +the installed path. The owner remains trusted; this is not root-owned storage. +T04 retains real credential adoption, owner configuration, model acceptance +and production placement. No credential route or profile is activated here. + +`scripts/install-bwrap-runtime.py` installs below the owner's home into a +mode-0700 store, verifies before and after copying, preserves artifact modes +and internal symlinks, serializes publishers and never overwrites a published +artifact. Existing modified artifacts are refused rather than repaired silently. +Group/other-writable ancestors, unsafe permission bits and store aliases refuse. +Unit tests cover integrity, idempotence, copy-time corruption and access modes. + + +T06 completed 2026-09-08 on bnt-lap001, local owner UID 1000. Installed the +unchanged 358-entry / 245176062-byte candidate at +`/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922`. +The private store is mode 0700; the installing owner remains trusted. A root-owned +system installation was not claimed or required for this local owner contract. +The installed-path sandbox smoke `51b59587` passed real Claude 2.1.263 and rein +startup, read-only mount, private state persistence, clean worktree, absent source, +loopback-only interfaces and complete workspace/proxy teardown. No model call +or credential acquisition occurred. `make check`: lint clean, 188 tests passed. +Two existing tests require the checkout directory name `sand-boxer`; the final +full check used that canonical basename. Evidence: +`docs/evidence/SAND-WP-0015-protected-local-install-2026-09-08.json`. +T04 retains owner execution configuration, native credential/egress and real-model +acceptance; Railiance installation needs its own target-specific return. + +## 2026-09-09 factory metered route source return + +Implemented the trusted, ephemeral Messages route described in +[docs/bwrap-messages-route.md](../docs/bwrap-messages-route.md). Actual local +bwrap owner transport proves provider key/ledger separation, direct-route denial, +revocation and teardown; rein also proves metered request plus commit import and +close replay. `make check`: lint clean, 199 passed. T04 remains waiting for the +admitted provider-to-owner bootstrap, updated protected runtime/profile, Railiance +placement, live compatibility and G0. Existing child-provider-key/direct-CONNECT +proofs do not admit this different credential holder or metered profile. No CCR, +secret read, deployment or paid request was performed. + +## 2026-09-09 standalone owner packaging and runtime selection + +Added frozen-lock owner build mode for the matched rein/llm/Glas/sandboxer set, +with non-editable installation and recorded lock/source/package pins. Sand-boxer +wheels now carry their profile and extension definitions, fixing a bwrap owner +failure that source-checkout tests could hide. The trusted Messages binding can +select the digest-pinned runtime without adding an API or profile override. +`make check`: lint clean, 205 passed. Existing standalone workload builds remain +supported. See docs/bwrap-runtime.md and rein's docs/owner-bootstrap.md. + +The project's `evidence/2026-09-09-owner-bootstrap.json` records the actual candidate +build and isolated installed-interpreter/CLI proof. T04 remains wait for accepted +credential-to-owner delivery, current protected installation and Railiance placement, +provider compatibility and G0. Source packaging does not reopen completed T01-T03, +T05-T06, broaden the old CCRs or activate the previously installed 2.1.263 artifact. + +The first standalone candidate exposed a stale cached local wheel despite current +Git metadata. Owner builds now refresh all local distributions and compare every +installed package source/definition file with its tracked source; stale, missing or +extra files refuse the build. Four content-conformance regressions cover that gap. + + +## 2026-09-27 installed launcher defect and guarded correction + +REINAH-WP-0003's single admitted attempt completed native provider/companion +apply, verify and exec, including scoped-token revocation. The claimed job +`6efa9436-6a91-47c0-94e5-b31b5a0e7e3a` failed before any provider request +reservation. The sandbox was destroyed and the source repository is unchanged. +The parent EUR 10 liability remains held for explicit reconciliation; no retry +or replacement authority is inferred. + +Installed artifact `b6e4e8a4` contains uv-generated three-line shell launchers +that still reference a vanished temporary build interpreter. The builder had +only rewritten direct Python shebangs. Fixed both generated forms and added +actual relocation/execution tests for direct, long and space-containing build +paths, plus refusal of unknown governed launchers. Builder tests: 12 passed; +focused lint passes. Rein's real installed bwrap probe reproduces both broken +entrypoints at exit 127 with zero provider forwards; its new bootstrap checks +refuse the malformed artifact before claiming. + +T04 remains `wait` and this plan stays `blocked`: replacement artifact build/ +admission and a separately authorized successful model/tool/commit proof remain. +The existing SAND-WP-0015 / REINAH-WP-0003 / SECRETS-WP-0009 records retain the +work. No new task or workplan. Detailed non-secret receipts are in rein-aharness +`docs/evidence/2026-09-27-metered-*.json`. + + +## 2026-10-04 offline owner startup proof preparation + +The existing no-credential smoke command now supports +`--require-owner-entrypoints`: the admitted digest-pinned runtime must start both +`rein-aharness --help` and `glas-harness --help`, and imported rein, llm-connect, +Glas and sandboxer modules must originate inside the mounted artifact. Broken or +missing launchers, failed help, timeout and external package origins cannot be +recorded as startup success. The default standalone mode remains supported. +Launcher diagnostics are not copied into the receipt. Focused tests exercise +real subprocesses, including the vanished-build-interpreter failure. + +This is preparation for a corrected immutable candidate's independent native +startup proof; it is not that candidate's receipt or owner acceptance. T04 stays +`wait`, the plan stays `blocked`, and the Sept27 artifact/liability evidence +remains intact. Replacement artifact admission and pins, explicit retained +EUR 10 reconciliation, and a separately authorized successful model/tool/commit +attempt remain with the existing owners. No credentials, provider request, +queue claim, policy activation or retry authorization is supplied here. + +2026-10-04 current blocker reconciliation: September 27 native provider/companion +apply/verify/exec and successful revocation supersede the original missing +platform route. The remaining owner return is rein-aharness corrected artifact/ +profile admission, retained EUR10 reconciliation and fresh retry authority. +T04 stays wait; no renewed trial is authorized. Full owner check: lint clean, +219 tests passed (one existing Starlette deprecation warning). + +## 2026-10-13 owner returns: reconciliation and corrected build + +rein-aharness `d897a83` records owner reconciliation of the Sept 27 held +liability: run `6efa9436` failed at launcher exit 127 before any provider +reservation; liability stays at the full hold, exhausting that one-attempt +envelope, and the owner authorized a new retry envelope on 2026-10-13. +rein-aharness `9a4469d` records corrected runtime `ee3d0a53…` (replaces +`b6e4e8a4…`; only rein moved, adding pre-claim launcher rejection), built with +the sand-boxer builder fix; both launchers exit 0 inside bwrap. Receipts: +rein-aharness `docs/evidence/2026-10-13-*.json`. + +Remaining before T04 closes: install `ee3d0a53` on railiance01, pin its digest +in owner config, pass `--require-owner-entrypoints` offline startup proof, then +run the single authorized attempt to a successful model/tool/commit receipt. +T04 stays `wait`; the plan stays `blocked`. + +2026-10-14 check: rein-aharness pushed `9a4469d` (corrected build record) and +opened REINAH-WP-0008 (simpler metered retry, active). No railiance01 install/ +admission of `ee3d0a53` or successful acceptance receipt yet; request sent on +hub message `82faf25c`. T04 stays `wait`; plan stays `blocked`. + +2026-10-14 rein-aharness reply (thread `82faf25c`): step 1 done (`9a4469d` on +origin/main). Steps 2-4 are REINAH-WP-0008-T07. Budget is now up to three +attempts within EUR 10 under memo `infd-20261014-b01` (observed-usage +settlement); order: memo acceptance in the attended informed-decision sitting, +rebuild and install `ee3d0a53` on railiance01, `metered-once --rehearse`, +`owner renew`, first attempt. Railiance01 still pins `b6e4e8a4`. T04 stays `wait`. + +2026-10-15 owner-approved rebuild: the pinned inputs of the `ee3d0a53` receipt +(same four commits, uv.lock `8775904b…`, Claude 2.1.266 `19842705…`) rebuilt +to `818b1b7c8292…f359`. The digest differs only because the builder embeds +absolute source paths (`direct_url.json`, `build-info.json`). Owner-entrypoint +startup smoke passed in sandbox `28df7a1d`; no credentials or model calls. +Sent to rein-aharness (message `8a7962f7`, thread `82faf25c`) to record as the +then-current corrected runtime for REINAH-WP-0008-T07 and to load the unsigned +memo sitting. Nothing installed on railiance01. T04 stays `wait`. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/verified-publication.json b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/verified-publication.json new file mode 100644 index 00000000..b54113e4 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/publication-r1/verified-publication.json @@ -0,0 +1,113 @@ +{ + "schema": "custodian.identity-binding-source-publication.v1", + "observed_at": "2026-10-17T11:28:15.925389+00:00", + "status": "all_three_authorized_source_publications_verified", + "rows": [ + { + "owner": "rein-aharness", + "commit": "0b7a9cfdc801d9eccef316852b53fd51ba8daef1", + "remote_verified": true, + "explicit_commit_paths": [ + "AGENTS.md", + "workplans/REINAH-WP-0008-simpler-metered-retry.md" + ], + "primary_projection_verified": true, + "counts": { + "created": 0, + "updated": 9, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 7, + "cancelled_tasks": 0, + "created_edges": 1, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 3 + }, + "consistency_summary": { + "fail": 0, + "automation_error": 0, + "warn": 5, + "info": 0 + }, + "unrelated_generated_worktree_and_index_preserved": true, + "final_status": "" + }, + { + "owner": "glas-harness", + "commit": "c8751c97986011284ea4173c9adacc31e1fd9dfc", + "remote_verified": true, + "explicit_commit_paths": [ + "workplans/GLAS-WP-0012-first-local-profile-production-proof.md" + ], + "primary_projection_verified": true, + "counts": { + "created": 0, + "updated": 18, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 8, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 6 + }, + "consistency_summary": { + "fail": 0, + "automation_error": 0, + "warn": 6, + "info": 0 + }, + "unrelated_generated_worktree_and_index_preserved": true, + "final_status": "M .custodian-brief.md\n M WORK-RECORDS.md\n" + }, + { + "owner": "sand-boxer", + "commit": "c7c310266aba96ab7dd03cd8bfcaa65f22a3b66e", + "remote_verified": true, + "explicit_commit_paths": [ + "workplans/SAND-WP-0015-bwrap-runtime-and-private-state.md" + ], + "primary_projection_verified": true, + "counts": { + "created": 0, + "updated": 15, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 0, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 1 + }, + "consistency_summary": { + "fail": 0, + "automation_error": 0, + "warn": 3, + "info": 0 + }, + "unrelated_generated_worktree_and_index_preserved": true, + "final_status": "" + } + ], + "rein_original_8_UUIDs_and_3_human_waits_preserved": true, + "rein_7_null_record_ids_filled": true, + "rein_two_original_dependency_rows_retained": true, + "glas_sand_12_exact_task_bindings_verified": true, + "sand_required_check": { + "lint": "pass", + "tests": 220, + "result": "pass" + }, + "old_broad_sand_patch_not_applied": true, + "native_runtime_or_proposal_or_supervision_changed_by_this_subtask": false, + "note": "Normal whole-repository receiving restored existing source-derived projection fields; rein also restored one existing-source WP0005\u2192ACTIVITYWP0026 edge. No new source work, retirement or task creation." +} diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/AGENTS.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/AGENTS.md new file mode 100644 index 00000000..e165849c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/AGENTS.md @@ -0,0 +1,262 @@ +# rein-aharness — Agent Instructions + +## Repo Identity + +**Purpose:** Claude-Code-CLI-driven rein: governed, unattended/scheduled agent runtime + +**Domain:** infotech +**Repo slug:** rein-aharness +**Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a` +**Workplan prefix:** `REINAH-WP-` + +`REIN-A-0001` through `REIN-A-0004` are immutable historical identifiers from +before the fleet `PREFIX-WP-NNNN` convention. `HARNESS-WP-0001` through +`HARNESS-WP-0003` and `HARNESS-WP-ADHOC-2026-09-04` are older ids from the +agent-harness name. Preserve all of these in references and archives, but use +the hub-registered `REINAH-WP-` prefix for every new workplan and task. + +--- + +## Developer Workflow + +```bash +# Install (editable, including the governed profile-execution siblings) +python3 -m venv .venv && source .venv/bin/activate +pip install -e . -e ../llm-connect -e ../sand-boxer -e ../glas-harness pytest + +# Test +PYTHONPATH=".:$HOME/llm-connect" python3 -m pytest tests/ -q + +# Run — bounded agentic session against a real target repo (real Claude Code +# CLI call, real commit if successful) +rein-aharness run --task-file examples/task-hello-sandbox.json --no-hub --no-metrics + +# Build the Railiance deploy image +make image +``` + +## State Hub Integration + +The Custodian State Hub tracks work across all domains. Interact via HTTP REST — +there is no MCP server for Codex agents. + +| Context | URL | +|---------|-----| +| Local workstation | `http://127.0.0.1:8000` | +| Remote (railiance01, in-cluster) | `http://10.43.68.154:8000` | +| Optional local edge relay | http://127.0.0.1:18080 | + +When an operator has enabled the edge relay, set API_BASE to the relay URL. +Queueable writes return an explicit queued receipt if the central hub is +unreachable. Treat that as pending local evidence, then ask the operator to run +statehub outbox status/replay after connectivity returns. + +### Orient at session start + +```bash +# Offline brief — works without hub connection +cat .custodian-brief.md + +# Active workplans for this domain +curl -s "http://127.0.0.1:8000/workplans/?topic_id=cee7bedf-2b48-46ef-8601-006474f2ad7a&status=active" \ + | python3 -m json.tool + +# Check inbox +curl -s "http://127.0.0.1:8000/messages/?to_agent=rein-aharness&unread_only=true" \ + | python3 -m json.tool +``` + +Mark a message read: +```bash +curl -s -X PATCH "http://127.0.0.1:8000/messages//read" \ + -H "Content-Type: application/json" -d '{}' +``` + +### Log progress (required at session close) + +```bash +curl -s -X POST http://127.0.0.1:8000/progress/ \ + -H "Content-Type: application/json" \ + -d '{ + "summary": "what was done", + "event_type": "note", + "author": "codex", + "workplan_id": "", + "task_id": "" + }' +``` + +Omit `workplan_id` / `task_id` when not applicable. + +### Update task status + +```bash +curl -s -X PATCH "http://127.0.0.1:8000/tasks/" \ + -H "Content-Type: application/json" \ + -d '{"status": "progress"}' +# values: wait | todo | progress | done | cancel +``` + +### Flag a task for human review + +```bash +curl -s -X PATCH "http://127.0.0.1:8000/tasks/" \ + -H "Content-Type: application/json" \ + -d '{"needs_human": true, "intervention_note": "reason"}' +``` + +--- + +## Session Protocol + +**Start:** +1. `cat .custodian-brief.md` — domain goal and open workplans (offline-safe) +2. Check inbox: `GET /messages/?to_agent=rein-aharness&unread_only=true`; mark read +3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks +4. Check human-needed tasks: `GET /tasks/?needs_human=true` + +**During work:** +- Update task statuses in workplan files as tasks progress +- Record significant decisions via `POST /decisions/` + +**Close:** +1. Update workplan file task statuses to reflect progress +2. If finishing a workplan: hand off **residuals** as live work records first + (intake with `origin: residual` + `origin_ref: `, or a next workplan / + decision / engagement). Do not park leftovers only in prose or `SCOPE.md`. + Canon: `the-custodian/canon/standards/work-record-types_v0.1.md` § Residuals. +3. Log: `POST /progress/` with a summary of what changed (name handoff ids) +4. After workplan file changes, run: + ```bash + statehub fix-consistency + ``` + Coding agents should run this directly; ask the operator only if the CLI or + State Hub API is unavailable. This syncs task status from files into the hub DB. + +--- + +## Credential and access routing + +**Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect** +for inference. Run this check **before** requesting secrets, API keys, SSH access, +login tokens, or database passwords — in any repo, not only `ops-warden`. + +ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Every +other credential need belongs to another subsystem. **Do not** message +`ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key. + +### Lookup (do this first) + +```bash +warden route find "" --json +warden route show --json +``` + +Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`). + +| Agent runtime | How to orient | +| --- | --- | +| **Codex / Grok** (shell, HTTP State Hub) | `warden route` commands above; inbox `to_agent=rein-aharness` is for coordination, not secret vending | +| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workplans; **still** use `warden route` for credential ownership | +| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden route` | + +### Quick routing table + +| I need… | Owner | ops-warden executes? | +| --- | --- | --- | +| SSH cert (`adm`/`agt`/`atm`) | ops-warden | **Yes** — `warden sign` | +| API key, DB password, provider token | OpenBao (`railiance-platform`) | No — route only | +| Login / OIDC / MFA | key-cape / Keycloak | No — route only | +| Authorization decision | flex-auth | No — route only | +| activity-core → issue-core emission | activity-core + issue-core | No — `warden route show activity-core-issue-sink` | +| SSH tunnel | ops-bridge (+ `cert_command` from warden) | No — route only | + +### Anti-patterns (do not do these) + +- `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc. +- Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist +- Pasting secrets into Git, State Hub, workplans, logs, or chat + +### Other capabilities (reuse-surface) + +Non-credential capabilities are usually discovered through **reuse-surface** federation +(`reuse-surface` registry / `capability.*` indexes). Credential routing is inlined in +every repo's agent instructions because it is high-frequency, high-risk, and easy to +get wrong. + +**Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml` + + + + +--- + +## Workplan Convention (ADR-001) + +Work items originate as files in this repo — not in the hub. The hub is a +read/cache/index layer that rebuilds from files. + +**File location:** `workplans/REINAH-WP-NNNN-.md` + +**Archived location:** finished workplans may move to +`workplans/archived/YYMMDD-REINAH-WP-NNNN-.md`. The `YYMMDD` prefix is +the completion/archive date; the frontmatter `id` does not change. + +**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use +`workplans/ADHOC-YYYY-MM-DD.md` with task ids `ADHOC-YYYY-MM-DD-T01`, etc. Use +this only for low-risk work completed directly; create a normal workplan for +anything needing analysis, design, approval, dependencies, or multiple phases. + +**Frontmatter:** + +```yaml +--- +id: REINAH-WP-NNNN +type: workplan +title: "..." +domain: infotech +repo: rein-aharness +status: proposed | ready | active | blocked | backlog | finished | archived +owner: codex +topic_slug: ... +created: "YYYY-MM-DD" +updated: "YYYY-MM-DD" +state_hub_workstream_id: "" # fix-consistency — do not edit (legacy field name; workplan UUID) +--- +``` + +Use `proposed` for a new draft, `ready` after review against current repo +state, and `finished` after implementation. `stalled` and `needs_review` are +derived health labels, not frontmatter statuses. + +**Terminology:** workplan is the fleet term; `workstream` appears only in legacy +API/MCP/frontmatter bridges until `STATE-WP-0069` retires them — see +`the-custodian/canon/standards/workplan-terminology-fleet_v0.1.md`. + +**Task block format** (one per `##` section): + +``` +## Task Title + +` ` `task +id: REINAH-WP-NNNN-T01 +status: wait | todo | progress | done | cancel +priority: high | medium | low +state_hub_task_id: "" # written by fix-consistency — do not edit +` ` ` + +Task description text. +``` + +Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blocked work and `cancel` for stopped work. + +**Residuals when finishing:** actionable leftovers become live work records +before `status: finished` — usually an intake (`origin: residual`, +`origin_ref: REINAH-WP-NNNN`) or a spawned workplan. Residual is a *role*, +not a kind. Fleet list lives on State Hub, not in `SCOPE.md`. + +To create a new workplan: +1. Write the file following the format above +2. Run `statehub fix-consistency` locally; ask the operator only if the CLI or + State Hub API is unavailable. diff --git a/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/workplans/REINAH-WP-0008-simpler-metered-retry.md b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/workplans/REINAH-WP-0008-simpler-metered-retry.md new file mode 100644 index 00000000..3603ca51 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/identity-binding-review-r1/source-followthrough-r1/HEAD-source/workplans/REINAH-WP-0008-simpler-metered-retry.md @@ -0,0 +1,354 @@ +--- +id: REINAH-WP-0008 +type: workplan +title: "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal" +domain: infotech +repo: rein-aharness +status: blocked +owner: claude-code +topic_slug: rein-aharness +priority: high +created: "2026-10-13" +updated: "2026-10-16" +related: + - REINAH-WP-0003 +state_hub_workstream_id: "187c2599-84a6-5764-a14f-7e9121975bf2" +--- + +# REINAH-WP-0008 — Simpler metered retry + +## Origin + +On 2026-10-13 the owner reconciled the 2026-09-27 hold for run `6efa9436` +(`docs/evidence/2026-10-13-held-liability-reconciliation.json`). A corrected +runtime `ee3d0a53…` was built +(`docs/evidence/2026-10-13-corrected-owner-runtime-build.json`). The owner +authorized a new envelope and one retry. + +Preparing that retry took too many owner ceremonies: + +1. The runtime is built on the workstation and copied to railiance01 by hand. +2. `owner.json` and the spend policy hold five digests that the owner edits + by hand. +3. A failed attempt keeps its full hold even when no provider request was + made, so every failure needs a new envelope, ledger and pins. +4. Every attempt needs six native approvals. +5. The launcher bug that failed run `6efa9436` was found only by spending + money. A free check on the host would have caught it. + +The owner agreed (2026-10-13) to fix items 5, 3 and 2 here, and to record +the rest as decisions instead of blocking on them. + +**Goal:** a retry becomes: install the artifact, rehearse for free, approve +once, run. + +## A. Free rehearsal on the host + +```task +id: REINAH-WP-0008-T01 +status: done +priority: high +state_hub_task_id: "c6536c8d-7862-5de6-ad2b-401077b60c04" +``` + +Add a free rehearsal to the owner check. It runs everything +`metered-once --check` does, then executes the admitted runtime's +`rein-aharness` and `glas-harness` launchers inside bwrap from the mount +path, with no network, credentials, provider route or ledger write. The +sandbox profile is already resolved by `--check`. It prints one receipt with +the runtime digest and each launcher's exit code. + +Today's launcher check reads only the first line of each launcher. This +rehearsal runs them, the same way the failing run did. + +**Done when:** tests prove the rehearsal fails on a runtime whose launchers +point at a missing build directory (the `6efa9436` failure) and passes on a +relocated runtime. It must make no network calls and write nothing. The +owner procedure in `docs/owner-bootstrap.md` makes the rehearsal a required +step before any paid attempt. + +### Implemented — 2026-10-13 + +`rein-aharness metered-once --owner-config --rehearse` (the flag +implies `--check`, so it never reads a provider key or claims). The code is in +`rein_aharness/owner_rehearsal.py`. It uses sand-boxer's isolation flags and +read-only system binds, with the runtime read-only at `/opt/sandboxer/runtime`, +`--unshare-net` and `--clearenv`. It runs each Python launcher with `--help`, +plus `claude --version` when `build-info.json` declares Claude. A missing +bwrap fails closed. + +Tests (`tests/test_owner_rehearsal.py`, `tests/test_owner_bootstrap.py`): + +- With real bwrap, a relocated runtime passes. The uv trampoline that + re-executes a deleted build interpreter fails with 127, as run `6efa9436` + did. +- The rehearsal never claims and never reads the key. +- The command line has no writable bind and no credential. + +The corrected runtime `ee3d0a53…` rehearses clean: rein-aharness 0, +glas-harness 0, claude 0. + +## B. Release holds that provably cost nothing + +```task +id: REINAH-WP-0008-T02 +status: done +priority: high +state_hub_task_id: "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9" +``` + +`SpendLedger.reconcile` keeps the full hold (`max(held, observed)`). Add an +evidence-backed release. If the run has zero provider-request reservations +and its request route is revoked, reconciliation may set the liability to +the observed amount. Otherwise the current rule stands. The release records +which evidence allowed it, and the CLI flag says so, for example +`--release-unused-hold`. + +This changes a deliberate safety rule, so it needs owner sign-off on the +exact rule before merge. That sign-off is recorded in T04's decision note. + +**Done when:** tests cover all four cases. A run with no request +reservations and a revoked route releases. A run with any request +reservation, or with a live route, refuses the release. A second, identical +reconcile changes nothing. The envelope is never marked breached by a +release. + +### Widened to observed-usage settlement — 2026-10-14 + +On 2026-10-13 the owner asked for three attempts within EUR 10 and chose +option B: settle to actual usage instead of releasing only unused holds. +Under full-hold accounting each request holds USD 4.64 (1M context plus +64k output), so EUR 10 cannot fit three attempts. + +Implemented as an opt-in envelope term (`settlement: observed-usage`) plus +`max_runs`; see `docs/owner-bootstrap.md`. Under it: + +- a completed request is charged its gateway-metered cost; +- runs and reconciliations are charged + `max(metered requests, reported or attested cost)`; +- unfinished requests keep their full hold, and overruns still freeze the + envelope. + +The run 6efa9436 shape (failure before any request) now reconciles to its +attested cost. Defaults and existing digests are unchanged. Tests: +`tests/test_spend_settlement.py`, plus renewal cases in +`tests/test_owner_renew.py`. + +Merge-ready, but the rule still needs the owner's acceptance in decision +`a93619a9`. + +## D. One owner command for renewal + +```task +id: REINAH-WP-0008-T03 +status: done +priority: high +state_hub_task_id: "87457216-2371-51ca-b3d4-3917e6f180a2" +``` + +Add `rein-aharness owner renew --owner --runtime +--envelope `. It does three things: + +1. It refuses unless every reservation in the current ledger is settled. +2. It writes the new spend policy, initializes a fresh ledger, and updates + the runtime and spend-policy pins in `owner.json` together. Old files are + kept as backups. Existing ledgers are never reset. +3. It prints one summary for the owner to review: old to new runtime, old + to new policy digest, envelope cap and attempt limit, and ledger path. + +Add a dry-run mode that only prints the summary. Afterwards, run the T01 +rehearsal. + +**Done when:** a test renews from the 2026-09-27 layout to a new envelope. +The owner check passes on the result. A second renew with an unsettled +reservation refuses. No digest has to be typed by hand. + +### Implemented — 2026-10-13 + +The command is `rein-aharness owner renew --owner-config --policy --ledger +--runtime-path --envelope [--apply]`, in `rein_aharness/owner_renew.py`. +Without `--apply` it is a dry run. Choices: + +- **Envelope file:** only the envelope fields may change. Worker, target, + profile and grant pins carry over, and `SpendPolicy` validation runs on + the result. +- **Paths stay the same:** the old ledger is renamed to + `.retired-`, never reset, and the old policy and owner.json + are kept as `.bak`. Secrets Engine pins the `exec_owner` files by sha256 + and the ledger path through its fixed environment, so keeping the paths + means the catalog needs only new file hashes. The command prints them. +- **Refusals:** a held reservation, an open request route, an open SQLite + transaction, an owner.json that doesn't match the policy, a reused + envelope id, a disallowed field, or leftovers from an earlier renewal. + +Tests (`tests/test_owner_renew.py`): + +- A dry run changes nothing. +- An applied renewal passes the real owner check (`prepare`) at the + unchanged paths. +- A charged reservation, the railiance01 state after the 2026-10-13 + reconciliation, renews, and the row survives in the retired ledger. +- Bad envelopes and a second apply both refuse. + +Finding for T06: renewal still changes the pinned file hashes, so each +renewal needs a Secrets Engine catalog update and fresh approvals. + +## C. Envelopes that cover several attempts (decision) + +```task +id: REINAH-WP-0008-T04 +status: done +decision_id: "a93619a9-8a70-40d8-aaf9-c29357d2a043" +priority: medium +state_hub_task_id: "898e02af-51bb-5e8d-93d0-ae908466c612" +``` + +Owner decision: should future envelopes be admitted as "up to N attempts +within EUR X" instead of one attempt? The EUR 10 cap already fits two +USD 4.64 request holds. Record the choice, together with T02's sign-off, +as a decision note in `docs/`. T03's envelope format then reflects it. + +### Decided — 2026-10-14 + +The owner chose up to three attempts within EUR 10 (EUR 5 per attempt) and +observed-usage settlement, and resolved hub decision `a93619a9` with that +choice. Record: `docs/decisions/2026-10-14-spend-envelope-settlement.md`. +The terms are in spend memo `infd-20261014-b01`. + +## E. Ship the owner runtime as a container image (decision) + +```task +id: REINAH-WP-0008-T05 +status: wait +needs_human: true +decision_id: "e6ca2f07-2708-4013-bfba-bf89fa0f1cb5" +priority: low +state_hub_task_id: "b486e86b-9d0f-501d-a394-771b40f771ee" +``` + +Decision for later, with Platform (railiance) and Sand-boxer: should the +owner runtime ship through the registry and GitOps, using the existing +`make image` path, instead of rsync and a manual digest check? Out of scope +here. If accepted, hand it off as a residual intake to the owning repos. + +## F. Approvals per envelope (decision) + +```task +id: REINAH-WP-0008-T06 +status: wait +needs_human: true +decision_id: "e8986e40-f6f8-4c87-b704-bff50cc4958b" +priority: low +state_hub_task_id: "4cf721e6-724b-5c64-91bb-67b098bb97af" +``` + +Decision for later, with Secrets Engine: should one approval set cover an +envelope's attempts instead of six native approvals per attempt? The work +lives outside this repo. If accepted, hand it off as a residual intake. + +## Retry on the corrected runtime + +```task +id: REINAH-WP-0008-T07 +status: wait +needs_human: true +blocking_reason: "Owner: accept spend memo infd-20261014-b01, then attended install, rehearsal, renew and approvals on railiance01" +priority: high +state_hub_task_id: "80318842-ccaa-5484-a54a-3d9981eaec8b" +``` + +Waits on T01 and T03. It does not need T02. + +Steps: + +1. Rebuild `ee3d0a53…`, or the then-current corrected runtime, from the + pinned commits. +2. Install it on railiance01. +3. Run the T01 rehearsal. +4. Renew with T03 to the owner-authorized new envelope (EUR 10, authorized + 2026-10-13). +5. Run exactly one attended attempt, which consumes fresh native approvals. + +Record the result in REINAH-WP-0003-T05/T06. + +### Waiting on the owner — 2026-10-14 + +Everything this repo can do is done: the rehearsal (T01), the settlement rule +(T02, T04) and renewal (T03) are in place. Draft memo `infd-20261014-b01` is +in informed-decision `ee6a65b`. What remains needs the owner, in order: + +1. Accept the memo in the attended sitting. +2. ~~Rebuild `ee3d0a53` from the pinned commits~~ (done 2026-10-15 as + `818b1b7c…`, see below) and install it on railiance01. +3. Run `metered-once --rehearse`. +4. Run `owner renew` with the memo's terms, then update the Secrets Engine + file pins. +5. Approve the native actions and run the first attempt. + +Sand-boxer's steps 2–4 in message `82faf25c` are this same sequence. + +### Runtime rebuilt — 2026-10-15 + +Step 1 is done. The owner approved a rebuild because `ee3d0a53…` was not kept +on the workstation. Sand-boxer built `818b1b7c…` from the same pinned inputs +and builder. The digest differs only because the build-source paths are +embedded in the artifact. The bwrap startup smoke passed (sandbox `28df7a1d`) +with no credentials and no model run. `818b1b7c…` is now the install +candidate. It is not installed on railiance01 (still `b6e4e8a4…`) or admitted. +Receipt: `docs/evidence/2026-10-15-rebuilt-owner-runtime.json`. The memo still +still has to be created, admitted, loaded and accepted first. The owner steps +are in informed-decision `docs/batches/2026-10-14-three-attempts/OPERATOR.md`. + +### Memo queued — 2026-10-15 + +Owner step 1 is in progress via the lifecycle intake path (owner's choice; the +review-record approval counts as spend authority). Workspace draft +`2ccb4bda-e318-51d2-a8dd-709db768494f`, review +`review-e2d2e98f-4701-45b0-abc1-4fe9f00bd1a8`, queued by the owner in the State +Hub memo dispatcher; approval intent `accept` by `helixforge-factory`. Record: +informed-decision `d5f1021` (sitting.json, OPERATOR.md). The accepted approval id +becomes `authority_ref` for `owner renew`. Install candidate remains `818b1b7c`. + + +### Workload-only Glas source integration — 2026-10-16 + +Reviewed and integrated the one-line runtime-contract lock advance from Glas +`30be81808140a3a3d137e731d1fe9aed59ad8581` to published workload-only credential +delivery `7357115c8311e55ee3d495f5266f501a17ec3c89`. llm-connect `37436bb5` and +sandboxer `221126cb` remain pinned. This is source integration under T07, not +native artifact installation or admission. T07 remains waiting with its existing +owner gates. + +Prior preparation used rein base `be5ef400` plus isolated lock-only commit +`c811fc43` to build candidate +`634e65fee5517ebee0d1080805fd84c81bd46af26a2b38ec1ab14bd2be17bf8f`. The +candidate's installed packages passed actual SandboxManager/Glas gateway proof +with unchanged `harness.agent-dev-local@1.1.1` (still unverified): real rein/Glas +CLI and Claude 2.1.266 startup, read-only runtime, synthetic host-file and +inherited environment/child-process denial, exact task identity/private state, +deterministic workspace Git effect, task removal and destruction. A separately +labelled synthetic route fixture passed workload-only delivery, output redaction +and clean subsequent housekeeping through the same actual manager. Wrong +actor/project/run, expired execution, expiry cleanup, cancellation and +post-cancellation refusal passed. All 141 Glas tests and seven rein lock/rehearsal +tests passed; whole artifact digest remained unchanged after proof. + +The first proof runner correctly encountered the manager's PermissionError for +wrong consumer but expected ValueError/RuntimeError. Its finally cleanup ran; +the runner catch was refined and the failure retained. This does not earn an +unchanged execution success. No model/provider request, real credential read, +queue access or spend occurred. + +The preparation artifact is not the artifact of this integrated owner revision. +Rebuild from the exact committed owner source and verify its new digest and +actual-manager proof before considering installation. Source inputs, receipts, +reproducible proof and attempt history are retained in the +[Custodian evidence directory](../../the-custodian/docs/changes/netkingdom-target-2026-10-16/agent-isolation-next/README.md). +The same directory records the integrated-source rebuild separately. + +Retain `818b1b7c`, `ee3d0a53`, installed `b6e4e8a4` and their outcomes as historical +evidence. Native acceptance still requires the queued spend memo lifecycle, +owner artifact installation/rehearsal, renewal and Secrets Engine file-pin +updates, required native approvals and bounded real-model/tool proof. Actual +interactive assignment migration and external tool-path denial remain Custodian +acceptance obligations; no profile readiness or supervision authority changed.