| Original-checkout isolation | Enforced by code: it is never a post-create execution fallback |
| SSH transport construction | Implemented and unit-tested; no current positive post-hardening live proof |
| Same-host bwrap execution | Fail-closed, not operational: consumer `nsenter` is denied and the rein runtime is absent inside the sandbox |
| `rein-aharness` adapter | Implemented; current local profile reaches sandbox creation and fails at session start on the bwrap owner boundary |
| `rein-openweights` adapter | Implemented; provider credential repair was proven, but current local sandbox execution has the same unresolved owner boundary |
| CLI channel | Implemented |
| State Hub evidence | Implemented as compact progress evidence, not a complete session/tool audit service |
An `enabled` profile currently means that catalog policy permits selection. It
does not prove that its rein executable, credential delivery, network egress,
and sandbox transport are operational on a particular host. That semantics is
an open governance gap tracked in `GLAS-IN-0005`.
## In scope
- The versioned Glas execution contract and profile/rein catalogs.
- Exact profile selection and refusal; no implicit governed rein or model.
- Outer execution lifecycle and teardown coordination with sand-boxer.
- Reachability-derived command transport and workspace selection.
- Rein adapters that translate the stable outer contract to backend CLIs.
- Actor attribution and organizational reference propagation without assuming
workforce authority.
- Direct-caller results and compact, value-safe execution evidence.
- Channel interfaces that translate invocations into the same execution
request; only the CLI implementation exists today.
## Out of scope
- Sandbox profiles, placement, provisioning, owner-mediated execution, and
teardown implementation — `sand-boxer`.
- A rein's internal agent loop, provider client, tool enforcement, and
credential acquisition — the selected rein.
- Scheduling, claiming, retries, and task sourcing — `activity-core` or another
channel owner.
- Roles, duties, assignments, goals, resource envelopes, and authorization —
their workforce/leadership systems.
- Model-provider authority and inference routing — providers and `llm-connect`.
- Secret storage or credential brokering.
- End-to-end validation and product code generation — `wise-validator` and
`snuggle-inventor`.
- State Hub work-record authority.
## Intended but not implemented
The broader vision in `INTENT.md` includes long-lived/resumable sessions,
gateway-owned tool catalogs and policy checks, memory and skills services,
