69 lines
4.3 KiB
Markdown
69 lines
4.3 KiB
Markdown
# Glas owner implementation — 16 October 2026
|
||
|
||
Prepared a concrete source patch in an isolated copy of current tracked Glas
|
||
files, retaining working-tree contents. Canonical Glas/Sand-boxer/rein sources,
|
||
profiles, native policies, installed artifacts and supervision authority were
|
||
not modified. Dirty Glas `.custodian-brief.md` and `WORK-RECORDS.md` are preserved.
|
||
|
||
The gateway previously requested profile credential routes for every owner
|
||
command, including executable lookup, task writers/removers, Git helpers and
|
||
artifact probes. The patch gives housekeeping an empty-route binding and gives
|
||
only explicit rein workload execution the profile routes. Both concrete adapters
|
||
use the explicit path. Missing workload binding refuses; an SSH selection with
|
||
credential routes refuses instead of silently bypassing owner delivery. This
|
||
narrows trusted gateway behavior, not arbitrary caller authorization.
|
||
|
||
Selected `harness.agent-dev-local@1.1.1` already has empty credential refs and
|
||
uses the rein's task-scoped MessagesOwner route outside bwrap. This patch does
|
||
not revoke that route or claim its scoped capability is an admin credential.
|
||
It prevents future/raw provider route selections from granting housekeeping
|
||
provider values. No generic shell broker or supervisor service was added.
|
||
|
||
Validation:
|
||
|
||
- All 141 Glas tests pass; regression checks cover exact create-time identity,
|
||
timeout and stdin, empty housekeeping routes, explicit workload routes,
|
||
missing binding refusal and remote credential refusal.
|
||
- Actual disposable bwrap through Glas transport proves a synthetic host
|
||
credential file absent, inherited BAO/VAULT/AWS/SSH variables denied including
|
||
a child subprocess, provider value only in the explicit workload, output
|
||
redaction, no subsequent-command value, and workspace destruction.
|
||
- `git apply --check` passes against canonical Glas. No provider/model call,
|
||
real credential read, remote live execution or spend occurred.
|
||
|
||
Artifacts: [patch](glas-harness.patch), [source hashes](source-manifest.json),
|
||
[test result](tests.json), [actual bwrap proof](bwrap-proof.json),
|
||
[patch check](patch-check.json). Patch SHA-256:
|
||
`83eeeb0017603aabae0ff49a23f96248f677f6c9f3e2c01b22f6d0416fca69c7`.
|
||
The reproducible proof source is included in the patch. The isolated source
|
||
remains `/tmp/netkingdom-agent-isolation-20261016/glas-harness`.
|
||
|
||
## Exact native gates retained
|
||
|
||
1. Review/apply this owner patch and reconcile its resulting runtime/source pins.
|
||
Do not reuse an admitted artifact digest for changed contents. The patch adds
|
||
a dated preparation note to GLAS-WP-0012 without completing a native task.
|
||
2. Latest dependency sources supersede historical missing-key/lane accounts:
|
||
September 27 native lanes were applied, verified and revoked. The corrected
|
||
owner runtime `818b1b7c…` was rebuilt October 15 and passes no-credential
|
||
startup; it is not installed/admitted on Railiance (still `b6e4e8a4…`).
|
||
3. REINAH-WP-0008-T07 retains queued spend memo lifecycle acceptance (workspace
|
||
`2ccb4bda-e318-51d2-a8dd-709db768494f`, review
|
||
`review-e2d2e98f-4701-45b0-abc1-4fe9f00bd1a8`), owner artifact installation,
|
||
`metered-once --rehearse`, owner renewal and Secrets Engine file-pin updates,
|
||
required native approvals, then successful bounded model/tool/commit proof.
|
||
Previously consumed approvals are historical evidence, not reusable authority.
|
||
4. GLAS-WP-0012-T02–T05 remain subject to accepted runtime/profile and combined
|
||
actual rein/model/task cleanup proof. The standalone bwrap proof establishes
|
||
none of those model/provider outcomes.
|
||
5. CUST-WP-0073-T02/T04 and TSA-06 additionally require admission of this actual
|
||
interactive agent assignment: its host files/mounts/env/subprocesses and
|
||
external tool paths must lose admin authority, with scoped distinguishable
|
||
task identity, revocation/expiry/cancellation and bounded delegation evidence.
|
||
The current interactive runtime has not moved into this disposable sandbox.
|
||
The assignment supervision record remains supervised, authority_granted false;
|
||
this owner worker does not approve a privileged path or promote the agent.
|
||
|
||
No task status, profile readiness, CUST-WP-0073 completion or TSA-06 acceptance
|
||
is inferred from the patch or synthetic proof. The stated owner/native gates
|
||
remain live in existing workplans; source delivery is separate from admission.
|