the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/FINAL-PROPOSAL.md

Install and verify the immutable Glas/rein runtime on railiance01

Proposal ID: REINAH-WP-0008-T07-install-f599-r1, revision 1. Status: pending root review and exact founder approval; no native mutation. This is a separately reviewable installation step under existing T07. It does not require completing the paid-attempt envelope because it uses no provider, worker credential, owner/spend configuration, catalog change or queue action. It does not activate the artifact or complete T07, GLAS-WP-0012-T03/T04, the current Custodian assignment migration or TSA-06.

Exact action and target

After root retains this exact revision and the supervisor's disposition, run:

python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/execute-install.py --apply

The same file's default/--dry-run is read-only. --apply refuses any existing local execution receipt, so a failed/uncertain attempt cannot be rerun blindly. There is no scheduling, continuous claim loop, profile readiness override, credential acquisition, provider request, owner renewal or service restart.

Input	Exact value
Host	existing SSH alias railiance01; Kubernetes node must be Ready at 92.205.62.239
Account	tegwick, UID/GID 1000, home /home/tegwick
Existing protected store	/home/tegwick/.helixforge-factory/runtimes, mode 0700, device 2049, inode 4751222
New destination	/home/tegwick/.helixforge-factory/runtimes/f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d
Complete runtime digest	sha256:f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d
Retained source artifact	/tmp/netkingdom-runtime-canonical-20261016/runtime
Exact new owned staging	/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017
Transfer archive	deterministic gzip/PAX tar, 109,931,109 bytes, 1,448 members
Transfer SHA-256	sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7
Logical regular-file bytes	260,668,241; one retained internal relative symlink, lib64 → lib

action-inputs.json freezes every executable/helper hash and archive input. artifact-manifest.json binds this proposal and all retained review evidence. Only the three named payload files go into remote staging: runtime.tar.gz, runtime.py and install-verified.py. The workstation archive is regenerated privately from the exact source only at execution, checked against the frozen archive hash, transferred, and removed from its local temporary directory. No large runtime archive or new source build is committed to this repository.

Existing owner contract and actual observations

Sand-boxer docs/bwrap-runtime.md explicitly separates protected artifact installation from profile selection, credentials, network activation and schedules. The existing runtime_store.install_runtime verifies source, checks the owned store and lock, copies symlinks/modes into its own private staging, verifies the copy and atomically publishes under its digest. It never replaces an existing artifact. This proposal uses that exact implementation already in f599; it does not introduce another store or installer service. Remote owner source checkouts are absent, so the pinned public digest reader/driver travel with the artifact.

Exact installed component hashes:

• sandboxer runtime.py: sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412
• sandboxer runtime_store.py: sha256:c3d6ec09d08881611d3d02b8f55d68deed6ecfedaa1a809b6b11c57cc4ca97cf
• rein owner_rehearsal.py: sha256:192f654cad4a5f065c7faa5e35b03493297a472e8d7fe641be2c42c5fb00dcc3

Runtime/store components match both the artifact's sandboxer 221126cb and current owner source 53f800c4; the rehearsal matches artifact rein 9b88cadaa8. The complete build includes Glas 7357115c and llm-connect 37436bb5 from the previously reviewed immutable build. Reuse its actual manager/gateway proof for isolation/workload-delivery mechanics; no deterministic proof is relabelled a real model call. The new action proves native installation and free launch only.

Read-only target evidence verifies the expected account/node, safe home/factory/ store/lock modes and absent destination/staging. Four older digest directories remain in the store, including b6e4e8a4; this action does not select, overwrite, remove or execute them. Pinned native executables are /usr/bin/python3 (3.12.3), /usr/local/bin/kubectl for the node read and /usr/bin/bwrap. No private owner/config/auth files were opened by these observations.

The final read-only dry-run at 2026-10-17 02:35:19 UTC passed all guards: about 124.21GB free disk, 7.65GB available memory, one-second CPU busy fraction 0.5852 and one-minute load 5.06 across four CPUs. Earlier observations found 99.5% busy CPU and a dry-run refusal at load 12.60; those remain retained. A passing snapshot is not a reservation or a promise of future headroom.

Exact execution and refusal behavior

1. Verify every local helper hash and the complete source artifact digest. Read target metadata only; require the exact existing store device/inode, expected UID/GID/modes and Ready node/IP. Require both new paths absent, at least 2GiB free disk and 1GiB available memory, one-minute load ≤8 on four CPUs, and CPU busy ≤85% in one bounded one-second sample. Refuse on drift; no polling or mutation follows a failed gate.
2. Write the local attempt intent before native staging. Recreate and verify the exact deterministic archive locally. Recheck CPU and exact store metadata before exclusive creation of the named 0700 remote staging directory. Record its actual device/inode in the local receipt before uploading anything.
3. SCP only the archive and two public helpers. The fixed SSH bootstrap verifies the exact directory identity, complete three-file inventory, regular-file owner and all three payload hashes; it sets those owned public payload files to 0600. Then it execs the hashed install helper with a cleared application environment. Existing SSH authentication is transport only; no key is fetched, copied into the workload or exposed in evidence.
4. The helper rechecks identity/headroom, lowers its scheduling priority to nice 19, verifies archive hash/size and every member name/type/mode/count/size, rejects hardlinks/special/escaping members, extracts directories/files before internal relative symlinks and checks the complete extracted digest. It does not restore archive owners or execute a tar-supplied command. All created files belong to tegwick. A local temporary roundtrip independently passed that extraction and the exact final runtime digest, with modes/symlink intact.
5. The staged candidate interpreter with -I -B imports and hash-checks its existing owner runtime/store modules, then calls existing install_runtime under a 180-second alarm. No new package resolution/download occurs. The existing helper holds its normal lock and cleans its own temporary copy on ordinary exception, then atomically appends the verified new digest. Refuse if the destination appeared, even if somebody installed identical bytes; no existing install is silently adopted as this action's success.
6. Rehash the complete native destination. Execute only the installed artifact's existing owner_rehearsal.rehearse directly, independent of owner.json, SpendPolicy or ledger state. It launches rein-aharness --help, glas-harness --help and Claude --version inside empty-egress bwrap, each with a 60-second timeout and discarded command output; the phase has a 240-second alarm. Require exactly those three zero exits. No model/task command or credential route is constructed. Child environment is cleared; host HOME and credentials are not mounted. These ephemeral namespaces create no SandboxManager record, persistent worker, model session or provider lease.
7. Rehash the entire installed tree after rehearsal and remove only the exact owned staging directory after device/inode/owner/mode and known-inventory checks. Capture the final structured result in this packet's execution-receipt.json. SSH closes when the foreground helper exits.

The rehearsal is the existing credential-free source API, not metered-once --rehearse against a private old owner configuration. This avoids changing pins or reading a ledger merely to validate an inactive artifact. It neither changes nor bypasses the normal future runtime/profile/spend/credential admission path.

Expected result, cost and risk

Success is installed_and_offline_rehearsal_verified, with actual install result, owner UID/store mode, extracted/installed/post-rehearsal full digest equality, three explicit launcher exit codes and staging absence. Destination remains a dormant append. Profile and credential flags stay false; provider calls are zero. No current owner/catalog/queue/definition/profile bytes are read or changed by the installation action. T07's spend acceptance, owner renewal and real-model/native approvals remain separate.

Persistent addition is about 261MB of logical file data plus filesystem metadata. Transfer is about 110MB. Extraction/copy temporarily add two artifact-sized trees plus the archive; the 2GiB free-disk requirement includes operating margin. Hashing and copy are sequential and lower priority, but a snapshot gate cannot guarantee that shared-host CPU/IO remains idle throughout execution.

Requested provider spend is USD 0: no provider API exists in this action. No new paid resource or recurring service is committed. Incremental infrastructure, energy and human recovery time in EUR are unknown, not zero. Credible EUR loss from unexpected shared single-node IO/resource interruption is also unknown. Approval must explicitly cover this small supervised append/rehearsal exposure; this proposal grants no autonomous budget or autopilot authority. Root may defer execution until the fresh headroom gate passes without weakening its thresholds.

Cleanup, rollback and uncertainty

Normal success/failure after verified stage identity removes only the owned staging tree. Unexpected directory identity or top-level objects stop cleanup; they are not swept. The local attempt intent retains remote staging device/inode before transfer. A transfer/bootstrap failure before remote helper execution may leave that exact staging: root can review the recorded identity and remove only its known upload files after confirming no execution started. The exact conditional command is python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/cleanup-upload-staging.py --apply; it requires the local receipt phase before_transfer, matching remote inode/device/owner/mode, only named regular upload files and no extracted runtime. It refuses every later phase. An SSH timeout or lost final reply after remote_execution_started is an uncertain outcome; do not replay --apply or delete staging while the helper may still be running. First confirm exact process quiescence, then inspect destination digest/stage identity read-only and reconcile under the same proposal. The 600-second outer SSH timeout is not proof that a disconnected remote process stopped.

The existing installer cleans its private .install-* copy on ordinary Python failure. Hard host/process loss may leave it; do not glob-delete store staging or infer ownership from the prefix. Preserve exact baseline/new-object metadata and request attended owner recovery for anything not tied to this attempt.

Rollback does not restore owner/catalog configuration because this action never changes it. Keep every older artifact and the newly installed immutable artifact as dormant evidence; removal of a published digest is not part of existing installer rollback and is not authorized here. If installation succeeds but rehearsal fails, record that partial outcome, retain the inactive artifact and staging cleanup facts, and stop. No automatic profile selection, in-place repair, artifact deletion, credential/provider retry or follow-up service action follows.

Review evidence

• action-inputs.json: fixed argv/paths/helper hashes/archive/components/guards.
• target-readonly-observation.json and target-readonly-addendum.json: actual target/account/store/node/absence and Python/bwrap observations.
• cpu-readonly-observation.json and retained-headroom-refusal.json: earlier saturation/refusal, retained separately from the later passing snapshot.
• final-readonly-dry-run.json: actual final helper's read-only result, zero writes.
• local-transfer-verification.json: deterministic archive and complete local extraction digest/mode/symlink roundtrip, removed local temporary tree.

Root must review/freeze the proposal/manifest digest, retain it in the existing supervision trial, obtain the exact founder disposition and only then invoke the --apply command. No native staging, install, launcher execution, owner change or paid call has happened during this preparation.