docs: add workplans SAND-WP-0010–0012 for remaining gaps

Cloud adapters (E2B/Modal/BYOK/fin-hub), reachability and consumer
profiles, Packer orchestration; update gap analysis and SCOPE.

workplans/SAND-WP-0011-reachability-and-consumer-profiles.md

@@ -0,0 +1,129 @@
+---
+id: SAND-WP-0011
+type: workplan
+title: "Reachability and consumer profiles"
+domain: infotech
+repo: sand-boxer
+status: ready
+owner: codex
+topic_slug: custodian
+created: "2026-06-24"
+updated: "2026-06-24"
+---
+
+# Reachability and consumer profiles
+
+Formalize ops-bridge tunnel attachment in reachability descriptors and ship
+first-class profiles for glas-harness and snuggle-inventor consumers.
+
+Gap analysis P6/P7: `history/2026-06-24-post-wp0007-intent-scope-gap-analysis.md`
+
+**Predecessor:** SAND-WP-0010 (cloud adapters — proposed)  
+**Follow-on:** SAND-WP-0012 (Packer orchestration)
+
+Note: Can proceed in parallel with SAND-WP-0010 where profiles are self-hosted.
+
+---
+
+## Reachability descriptor enrichment
+
+```task
+id: SAND-WP-0011-T01
+status: todo
+priority: high
+```
+
+Extend `Reachability` model: optional `tunnel` (local port / alias), `tunnel_via`
+(ops-bridge route id), `identity` (warden actor hint). Populate from profile
+`reachability` spec + `SANDBOXER_TUNNEL_*` env on compose-ssh / vm-packer.
+Document contract in `docs/meta-framework.md`; sand-boxer does not own tunnels.
+
+## ops-bridge integration helper
+
+```task
+id: SAND-WP-0011-T02
+status: todo
+priority: medium
+```
+
+Optional `sandboxer reachability show <id>` (or enrich `get` output) surfacing
+SSH one-liner and tunnel status pointer (`ops-bridge` MCP / CLI doc link). No
+tunnel bring-up in sand-boxer — pointer only.
+
+## profile.agent-dev
+
+```task
+id: SAND-WP-0011-T03
+status: todo
+priority: high
+```
+
+Profile for glas-harness: longer TTL defaults, `actor: agt` examples, route
+`prefer-self-hosted`. Extension `ext.compose-ssh` or vm-packer attach variant.
+Update `docs/integrations/glas-harness.md` with real profile id.
+
+## profile.build (snuggle-inventor)
+
+```task
+id: SAND-WP-0011-T04
+status: todo
+priority: high
+```
+
+Build sandbox profile binding `profile.vm-haskell-build` or compose path;
+`setup.instructions` placeholder; `secret_refs` list on profile (resolution v0:
+validate refs exist via `warden route`, inject at provision boundary only).
+Update `docs/integrations/snuggle-inventor.md`.
+
+## Secret boundary v0
+
+```task
+id: SAND-WP-0011-T05
+status: todo
+priority: medium
+```
+
+`SetupSpec.secret_refs` resolution in manager pre-provision hook: fetch via
+operator-documented OpenBao path; pass to extension handle; never store on
+`SandboxStatus` or emit to State Hub. Tests with mocked resolver.
+
+## Consumer smoke scripts
+
+```task
+id: SAND-WP-0011-T06
+status: todo
+priority: medium
+```
+
+`scripts/smoke-agent-dev.sh`, `scripts/smoke-build-profile.sh` (dry-run or
+CoulombCore gated). Integration section in each consumer doc.
+
+## Tests and docs
+
+```task
+id: SAND-WP-0011-T07
+status: todo
+priority: high
+```
+
+Model tests for reachability fields; profile loader tests; update `SCOPE.md`
+profile catalog. `make check` green.
+
+---
+
+## Out of scope
+
+| Item | Track |
+|------|-------|
+| glas-harness tool execution | glas-harness repo |
+| snuggle code generation | snuggle-inventor repo |
+| ops-bridge tunnel automation | ops-bridge repo |
+
+---
+
+## Acceptance criteria
+
+- `profile.agent-dev` and `profile.build` load and create via CLI
+- Reachability JSON includes tunnel metadata when profile declares ops-bridge
+- secret_refs resolved at boundary; absent from agent-visible status payload
+- Consumer integration docs reference real profile ids