3 KiB
2026-10-16 workload-only candidate lock and actual-manager preparation
Prepared under existing REINAH-WP-0008-T07 / GLAS-WP-0012 acceptance work.
The combined-runtime lock still selects Glas 30be8180, so the rebuilt
818b1b7c artifact cannot include published workload-only delivery 7357115c.
The prepared lock-only patch advances that dependency; llm-connect 37436bb5
and sandboxer 221126cb remain pinned to the prior admitted source set. Rein
source is be5ef400; an isolated preparation commit c811fc43 contains the
patch. This isolated commit is not an owner publication.
The existing owner builder produced candidate runtime
634e65fee5517ebee0d1080805fd84c81bd46af26a2b38ec1ab14bd2be17bf8f, using the
same native Claude 2.1.266 binary (19842705…), frozen uv.lock and source-content
verification. The runtime is only in /tmp/netkingdom-runtime-next-20261016/runtime.
Canonical owner repositories, retained artifact pins and native owner
configuration were not changed by this preparation.
All 141 Glas tests and seven rein runtime-lock/rehearsal tests pass. The complete
runtime digest recomputed after all proofs remains 634e65fee5517…. Using the candidate's installed packages, the actual
SandboxManager and Glas gateway execute the unchanged
harness.agent-dev-local@1.1.1 profile (still unverified): real rein/Glas CLI
startup, Claude --version, read-only artifact, absent synthetic host file,
inherited environment and child-process denial, exact task identity/private
state, deterministic Git effect in the disposable workspace, task removal and
manager destruction pass. A separately labelled synthetic route fixture proves
only the explicit workload receives its synthetic provider value, output is
redacted, every housekeeping command has empty routes and the following command
is clean. Real manager refusals for wrong actor/project/run, expired execution,
expiry cleanup, explicit cancellation and post-cancellation execution also pass.
No model, provider request, real credential read or spend occurred.
First proof attempt correctly encountered PermissionError on wrong consumer but the proof runner expected only ValueError/RuntimeError. Its finally cleanup ran; the runner was amended, with the failed attempt preserved in proof-attempts.json. The artifact was unchanged. This is a refined test attempt, not a new unchanged execution success.
Owner review/integration of the lock patch must produce an owner source revision
and a rebuilt artifact whose complete digest is verified again. Candidate
preparation does not authorize native installation or admission. T07's queued
spend memo, native artifact installation/rehearsal, renewal and file-pin updates,
required approvals and bounded real-model/tool proof remain open. GLAS native
acceptance and actual interactive assignment migration, denied external tool
paths, bounded delegation and revocation remain open; no readiness or supervision
promotion is inferred. Older 818b1b7c, ee3d0a53, installed b6e4e8a4 and their
failed/unknown outcomes remain historical evidence.