the-custodian/docs/changes/netkingdom-target-2026-10-16/agent-isolation

Glas owner implementation — 16 October 2026

Prepared a concrete source patch in an isolated copy of current tracked Glas files, retaining working-tree contents. Canonical Glas/Sand-boxer/rein sources, profiles, native policies, installed artifacts and supervision authority were not modified. Dirty Glas .custodian-brief.md and WORK-RECORDS.md are preserved.

The gateway previously requested profile credential routes for every owner command, including executable lookup, task writers/removers, Git helpers and artifact probes. The patch gives housekeeping an empty-route binding and gives only explicit rein workload execution the profile routes. Both concrete adapters use the explicit path. Missing workload binding refuses; an SSH selection with credential routes refuses instead of silently bypassing owner delivery. This narrows trusted gateway behavior, not arbitrary caller authorization.

Selected harness.agent-dev-local@1.1.1 already has empty credential refs and uses the rein's task-scoped MessagesOwner route outside bwrap. This patch does not revoke that route or claim its scoped capability is an admin credential. It prevents future/raw provider route selections from granting housekeeping provider values. No generic shell broker or supervisor service was added.

Validation:

• All 141 Glas tests pass; regression checks cover exact create-time identity, timeout and stdin, empty housekeeping routes, explicit workload routes, missing binding refusal and remote credential refusal.
• Actual disposable bwrap through Glas transport proves a synthetic host credential file absent, inherited BAO/VAULT/AWS/SSH variables denied including a child subprocess, provider value only in the explicit workload, output redaction, no subsequent-command value, and workspace destruction.
• git apply --check passes against canonical Glas. No provider/model call, real credential read, remote live execution or spend occurred.

Artifacts: patch, source hashes, test result, actual bwrap proof, patch check. Patch SHA-256: 83eeeb0017603aabae0ff49a23f96248f677f6c9f3e2c01b22f6d0416fca69c7. The reproducible proof source is included in the patch. The isolated source remains /tmp/netkingdom-agent-isolation-20261016/glas-harness.

Exact native gates retained

1. Review/apply this owner patch and reconcile its resulting runtime/source pins. Do not reuse an admitted artifact digest for changed contents. The patch adds a dated preparation note to GLAS-WP-0012 without completing a native task.
2. Latest dependency sources supersede historical missing-key/lane accounts: September 27 native lanes were applied, verified and revoked. The corrected owner runtime 818b1b7c… was rebuilt October 15 and passes no-credential startup; it is not installed/admitted on Railiance (still b6e4e8a4…).
3. REINAH-WP-0008-T07 retains queued spend memo lifecycle acceptance (workspace 2ccb4bda-e318-51d2-a8dd-709db768494f, review review-e2d2e98f-4701-45b0-abc1-4fe9f00bd1a8), owner artifact installation, metered-once --rehearse, owner renewal and Secrets Engine file-pin updates, required native approvals, then successful bounded model/tool/commit proof. Previously consumed approvals are historical evidence, not reusable authority.
4. GLAS-WP-0012-T02–T05 remain subject to accepted runtime/profile and combined actual rein/model/task cleanup proof. The standalone bwrap proof establishes none of those model/provider outcomes.
5. CUST-WP-0073-T02/T04 and TSA-06 additionally require admission of this actual interactive agent assignment: its host files/mounts/env/subprocesses and external tool paths must lose admin authority, with scoped distinguishable task identity, revocation/expiry/cancellation and bounded delegation evidence. The current interactive runtime has not moved into this disposable sandbox. The assignment supervision record remains supervised, authority_granted false; this owner worker does not approve a privileged path or promote the agent.

No task status, profile readiness, CUST-WP-0073 completion or TSA-06 acceptance is inferred from the patch or synthetic proof. The stated owner/native gates remain live in existing workplans; source delivery is separate from admission.