---
id: SAND-WP-0011
type: workplan
title: "Reachability and consumer profiles"
domain: infotech
repo: sand-boxer
status: ready
owner: codex
topic_slug: custodian
created: "2026-06-24"
updated: "2026-06-24"
---

# Reachability and consumer profiles

Formalize ops-bridge tunnel attachment in reachability descriptors and ship
first-class profiles for glas-harness and snuggle-inventor consumers.

Gap analysis P6/P7: `history/2026-06-24-post-wp0007-intent-scope-gap-analysis.md`

**Predecessor:** SAND-WP-0010 (cloud adapters — proposed)  
**Follow-on:** SAND-WP-0012 (Packer orchestration)

Note: Can proceed in parallel with SAND-WP-0010 where profiles are self-hosted.

---

## Reachability descriptor enrichment

```task
id: SAND-WP-0011-T01
status: todo
priority: high
```

Extend `Reachability` model: optional `tunnel` (local port / alias), `tunnel_via`
(ops-bridge route id), `identity` (warden actor hint). Populate from profile
`reachability` spec + `SANDBOXER_TUNNEL_*` env on compose-ssh / vm-packer.
Document contract in `docs/meta-framework.md`; sand-boxer does not own tunnels.

## ops-bridge integration helper

```task
id: SAND-WP-0011-T02
status: todo
priority: medium
```

Optional `sandboxer reachability show <id>` (or enrich `get` output) surfacing
SSH one-liner and tunnel status pointer (`ops-bridge` MCP / CLI doc link). No
tunnel bring-up in sand-boxer — pointer only.

## profile.agent-dev

```task
id: SAND-WP-0011-T03
status: todo
priority: high
```

Profile for glas-harness: longer TTL defaults, `actor: agt` examples, route
`prefer-self-hosted`. Extension `ext.compose-ssh` or vm-packer attach variant.
Update `docs/integrations/glas-harness.md` with real profile id.

## profile.build (snuggle-inventor)

```task
id: SAND-WP-0011-T04
status: todo
priority: high
```

Build sandbox profile binding `profile.vm-haskell-build` or compose path;
`setup.instructions` placeholder; `secret_refs` list on profile (resolution v0:
validate refs exist via `warden route`, inject at provision boundary only).
Update `docs/integrations/snuggle-inventor.md`.

## Secret boundary v0

```task
id: SAND-WP-0011-T05
status: todo
priority: medium
```

`SetupSpec.secret_refs` resolution in manager pre-provision hook: fetch via
operator-documented OpenBao path; pass to extension handle; never store on
`SandboxStatus` or emit to State Hub. Tests with mocked resolver.

## Consumer smoke scripts

```task
id: SAND-WP-0011-T06
status: todo
priority: medium
```

`scripts/smoke-agent-dev.sh`, `scripts/smoke-build-profile.sh` (dry-run or
CoulombCore gated). Integration section in each consumer doc.

## Tests and docs

```task
id: SAND-WP-0011-T07
status: todo
priority: high
```

Model tests for reachability fields; profile loader tests; update `SCOPE.md`
profile catalog. `make check` green.

---

## Out of scope

| Item | Track |
|------|-------|
| glas-harness tool execution | glas-harness repo |
| snuggle code generation | snuggle-inventor repo |
| ops-bridge tunnel automation | ops-bridge repo |

---

## Acceptance criteria

- `profile.agent-dev` and `profile.build` load and create via CLI
- Reachability JSON includes tunnel metadata when profile declares ops-bridge
- secret_refs resolved at boundary; absent from agent-visible status payload
- Consumer integration docs reference real profile ids