the-custodian/docs/changes/netkingdom-target-2026-10-16/agent-isolation-next

Combined runtime source integration — 16 October 2026

The next source blocker is the rein runtime lock: it still pins Glas before the published workload-only transport patch. The lock patch updates only Glas 30be8180 → 7357115c, against rein be5ef400. Exact source inputs retain llm-connect 37436bb5 and sandboxer 221126cb; lock verification passes. The owner work-record note is prepared for integration under REINAH-WP-0008-T07 and GLAS-WP-0012. The initial preparation preserved canonical sources; the reviewed lock and T07 note were subsequently integrated and published as described below.

Published owner source and rebuilt artifact

Rein source 9b88cadaa817e5abea7950b4a264d4e2739a5ddb is published on origin/main through normal State Hub consistency sync, with a clean canonical checkout. Publication receipt retains the existing C-20 unlinked dependency and C-39 T07 missing decision-id warnings; no check failed. Only the reviewed lock and existing T07 workplan note were committed. T07 remains waiting; its native gates are unchanged.

Canonical source inputs and lock check identify the clean detached sources used by the existing owner builder. Canonical build metadata records complete runtime SHA-256 f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d, at /tmp/netkingdom-runtime-canonical-20261016/runtime. The artifact is retained only as a candidate; it is not installed or admitted.

Actual manager/gateway proof passes against this new artifact with the unchanged, unverified harness.agent-dev-local@1.1.1. It repeats installed rein/Glas/Claude startup, synthetic file/environment/child read-denial, read-only runtime, exact identity, private state, deterministic workspace commit, task removal and teardown. The separate synthetic route fixture proves delivery only to the explicit workload, output redaction, empty routes for housekeeping and clean following execution. Actual manager wrong-consumer, expiry and cancellation refusals/cleanup pass. No model/provider call, real credential read or spend occurred. Digest after proof is unchanged. Seven canonical rein lock/rehearsal tests pass; Glas inputs remain exactly those whose 141 tests passed above.

Progress receipt records the source delivery under existing T07. Native installation/admission, required spend/approval gates, real model acceptance and current interactive assignment migration remain open.

Preserved initial preparation

The existing owner builder produced /tmp/netkingdom-runtime-next-20261016/runtime with complete SHA-256 634e65fee5517ebee0d1080805fd84c81bd46af26a2b38ec1ab14bd2be17bf8f. Build metadata records all package versions, exact source commits, native Claude 2.1.266 binary hash, frozen uv.lock hash and source-content manifest. This includes isolated preparation commit c811fc43, not an owner publication. An owner-integrated revision must produce a newly identified artifact; it cannot inherit this digest.

Actual manager/gateway proof uses the candidate interpreter and installed packages. Exact harness.agent-dev-local@1.1.1 remains unverified; no profile override is used for its startup/denial/cleanup proof. A separate, explicitly labelled synthetic credential-route fixture exercises workload-only delivery through the actual manager. Proof source is reproducible with the candidate interpreter:

env -i PATH=/usr/bin:/bin HOME=/tmp SANDBOXER_NO_STATE_HUB=1 \
  /tmp/netkingdom-runtime-next-20261016/runtime/bin/python3 -I -B \
  docs/changes/netkingdom-target-2026-10-16/agent-isolation-next/prove-candidate-manager.py \
  634e65fee5517ebee0d1080805fd84c81bd46af26a2b38ec1ab14bd2be17bf8f

All 141 Glas tests and seven rein lock/rehearsal tests pass. Digest after proofs matches the built artifact. Proof attempts retain the first runner failure: the manager correctly raised PermissionError, while the runner expected a different refusal exception; finally cleanup succeeded, and the runner catch was corrected.

Native installation/admission, real-model acceptance, current interactive assignment migration, denial through its external tool paths and runner scope acceptance remain open. No real credentials, provider request, model spend, queue access, native pin changes, readiness promotion or supervision grant were used. Existing failed artifacts and owner gates remain authoritative.