docs: reconcile scope with verified capability

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

SCOPE.md

@@ -2,74 +2,113 @@
 
 ## One-liner
 
-Primary, profile-driven execution layer routing governed work between concrete
-agent-harness backends ("reins") while consuming sand-boxer for isolation. See
-`docs/adr/ADR-001-rein-harness-family.md`.
+`glas-harness` is a profile-driven control-plane library and CLI that resolves
+one governed execution request to a concrete rein/model/sandbox constellation,
+coordinates the outer lifecycle, and returns normalized evidence. It consumes
+`sand-boxer`; it does not provide a sandbox runtime itself.
 
-## Core Idea
+## Verified capabilities
 
-glas-harness owns the harness contract (`docs/harness-contract.md`:
-`start_session`/`dispatch_tool`/`end_session`) and the outer loop — profile
-resolution, rein/model/tool-policy selection, sandbox request/teardown via
-sand-boxer, actor attribution, and normalized evidence. A rein owns its own
-inner agentic loop and is invoked through that contract.
+The repository currently implements:
 
-Workforce and leadership systems decide *who is responsible for what* and pass
-assignment, role, duty, goal, and resource-envelope references. Glas decides
-*how that already-authorized assignment executes*. It does not assign workers,
-elect leaders, decompose organizational goals, or schedule work.
+- strict Pydantic models for execution requests, profiles, rein descriptors,
+  lifecycle results, and compact evidence (`src/glas_harness/contract.py`);
+- deterministic, fail-closed profile and rein-registry resolution, including
+  compatibility, duplicate, status, capability, and inline-secret checks
+  (`src/glas_harness/profiles.py`);
+- one bounded outer gateway lifecycle: resolve, create sandbox, derive the
+  returned transport, start and dispatch one rein session, summarize, clean up,
+  destroy the sandbox, and report normalized evidence
+  (`src/glas_harness/gateway.py`);
+- two CLI-backed rein adapters, for `rein-aharness` and `rein-openweights`;
+- transport enforcement for SSH workspaces and same-host namespace descriptors.
+  Unsupported, incomplete, ambiguous, unavailable, or unauthorized transports
+  fail closed without falling back to the caller checkout;
+- explicit governed actor validation (`adm`, `agt`, or `atm`) before sandbox
+  creation, keeping queue `worker_id` values outside the actor field;
+- one invocation channel: the local `glas-harness run` CLI;
+- a packaged, versioned profile/rein catalog and `glas-harness profiles`
+  validation command; and
+- compact State Hub progress evidence that excludes prompts, model/tool output,
+  provider bodies, and credentials.
 
-## In Scope
+The unit and boundary suite exercises these contracts and the Forgejo workflow
+installs the package, runs the suite, and validates the packaged catalog.
 
-- Versioned strict execution request, profile, lifecycle, result, and evidence
-  models plus the `Rein` ABC
-  (`src/glas_harness/contract.py`)
-- Deterministic harness-profile and rein-registry validation/resolution
-  (`src/glas_harness/profiles.py`)
-- The gateway that resolves an explicit harness profile, requests a sandbox,
-  runs one task through a rein, verifies, tears down
-  (`src/glas_harness/gateway.py`)
-- Rein adapters that shell out to each rein's own CLI
-  (`src/glas_harness/reins/`) — currently `rein_aharness.py`,
-  `rein_openweights.py`
-- The rein registry (`registry/reins/`) and harness profile catalog
-  (`profiles/`)
-- Compact, non-secret execution evidence and attribution references for State
-  Hub and other audit consumers
+## Operational capability status
 
-## Out of Scope
+| Surface | Current verified status |
+|---|---|
+| Profile/catalog resolution | Implemented and CI-validated |
+| Unknown or invalid profile refusal | Implemented before sandbox creation |
+| Sandbox create/destroy lifecycle | Implemented; live failure paths prove teardown |
+| Original-checkout isolation | Enforced by code: it is never a post-create execution fallback |
+| SSH transport construction | Implemented and unit-tested; no current positive post-hardening live proof |
+| Same-host bwrap execution | Fail-closed, not operational: consumer `nsenter` is denied and the rein runtime is absent inside the sandbox |
+| `rein-aharness` adapter | Implemented; current local profile reaches sandbox creation and fails at session start on the bwrap owner boundary |
+| `rein-openweights` adapter | Implemented; provider credential repair was proven, but current local sandbox execution has the same unresolved owner boundary |
+| CLI channel | Implemented |
+| State Hub evidence | Implemented as compact progress evidence, not a complete session/tool audit service |
 
-- Sandbox provisioning, profiles, placement — owned by `sand-boxer`
-- A rein's own agentic loop, tool execution, credential acquisition —
-  owned by the rein itself (`rein-aharness`, `rein-openweights`, ...)
-- Leadership, workforce allocation, role/duty/goal definitions, assignment
-  authority, scheduling, and task sourcing — owned by their domain systems and
-  passed to Glas as references
-- Scheduling/blueprint sourcing inside the execution layer — stays rein-local
-  (`docs/adr/ADR-003-scheduling-and-blueprint-sourcing-stay-rein-local.md`)
-- Provider/model catalog authority and inference APIs — owned by providers and
-  `llm-connect`; Glas carries the approved route and resolved identifier
-- Secrets and credential brokering — credentials remain rein-local and profiles
-  contain route references only
-- e2e validation, code generation — owned by `wise-validator`,
-  `snuggle-inventor`
+An `enabled` profile currently means that catalog policy permits selection. It
+does not prove that its rein executable, credential delivery, network egress,
+and sandbox transport are operational on a particular host. That semantics is
+an open governance gap tracked in `GLAS-IN-0005`.
 
-## Current State
+## In scope
 
-The contract and first two reins are implemented. Profiles are executable,
-versioned runtime inputs; CLI and gateway invocation require an explicit
-profile; and both rein/model constellations are live-proven with real commits,
-sandbox cleanup, and the same evidence shape.
-The CLI channel and Glas-owned State Hub gateway reporting are implemented.
+- The versioned Glas execution contract and profile/rein catalogs.
+- Exact profile selection and refusal; no implicit governed rein or model.
+- Outer execution lifecycle and teardown coordination with sand-boxer.
+- Reachability-derived command transport and workspace selection.
+- Rein adapters that translate the stable outer contract to backend CLIs.
+- Actor attribution and organizational reference propagation without assuming
+  workforce authority.
+- Direct-caller results and compact, value-safe execution evidence.
+- Channel interfaces that translate invocations into the same execution
+  request; only the CLI implementation exists today.
 
-Still outside the current prototype: additional real channel extensions,
-memory/skills services, subagent delegation, requirements-based profile
-selection, and workforce-management APIs. Those are not implicit capabilities
-of the profile router.
+## Out of scope
 
-## Getting Oriented
+- Sandbox profiles, placement, provisioning, owner-mediated execution, and
+  teardown implementation — `sand-boxer`.
+- A rein's internal agent loop, provider client, tool enforcement, and
+  credential acquisition — the selected rein.
+- Scheduling, claiming, retries, and task sourcing — `activity-core` or another
+  channel owner.
+- Roles, duties, assignments, goals, resource envelopes, and authorization —
+  their workforce/leadership systems.
+- Model-provider authority and inference routing — providers and `llm-connect`.
+- Secret storage or credential brokering.
+- End-to-end validation and product code generation — `wise-validator` and
+  `snuggle-inventor`.
+- State Hub work-record authority.
 
-- Start with: `INTENT.md`, `docs/adr/ADR-001-rein-harness-family.md`
+## Intended but not implemented
+
+The broader vision in `INTENT.md` includes long-lived/resumable sessions,
+gateway-owned tool catalogs and policy checks, memory and skills services,
+additional chat/email/MCP channels, cron surfaces, bounded subagent delegation,
+and richer session/tool audit streams. None is a current repository capability.
+The present implementation is a bounded execution router over two reins, not
+yet Coulomb's general-purpose agent harness service.
+
+## Active gaps
+
+- `GLAS-WP-0005-T05` / `GLAS-IN-0002`: sand-boxer-owned executable bwrap
+  reachability, rein runtime availability, explicit egress, and credential
+  delivery are required for a positive in-sandbox rein proof.
+- `GLAS-IN-0003`: grandfather the pre-canon `GLAS-0001` identifiers.
+- `GLAS-IN-0004`: align the documented ad hoc workplan convention with the
+  identifier canon.
+- `GLAS-IN-0005`: make profile `enabled` status and operational readiness
+  truthful and testable.
+
+## Getting oriented
+
+- Intent and gap assessment: `INTENT.md`,
+  `history/2026-08-23-scope-vs-intent-assessment.md`
 - Contract: `docs/harness-contract.md`, `docs/execution-profiles.md`
-- Agent instructions: `AGENTS.md`
-- Workplans: `workplans/`
+- Architecture: `docs/adr/ADR-001-rein-harness-family.md`
+- Live work: `workplans/`, `docs/intakes/residuals.md`
+- Agent workflow: `AGENTS.md`