feat: add versioned execution profiles

docs/evidence/GLAS-WP-0004-live-proof-2026-08-20.md

@@ -0,0 +1,62 @@
+# GLAS-WP-0004 live profile evidence — 2026-08-20
+
+Acceptance task for both profiles: change one `README.md` status value from
+`pending` to `complete`, make no other content change, and commit it. Each run
+used a separate temporary initialized repository and `profile.bwrap-local`.
+No credential value, prompt transcript, or raw model output is recorded here.
+
+## `harness.agent-dev-local@1.0.0`
+
+- Result: succeeded.
+- Contract: `1.0`.
+- Rein: `rein-aharness@0.1.0`.
+- Model route/resolved model: `claude-code-cli` / `claude-sonnet-4-6`.
+- Tool profile: `green-commit-only`.
+- Sandbox ID: `e61624cb`; local lifecycle store verified `destroyed`.
+- Request ID: `96b2ec85-3823-4088-bcf4-a008c02e2354`.
+- Commit: `795f8ef8b414f4470e812005f4103b8c5f126829`.
+- Tool-event visibility: complete, 14 events.
+- Reported execution time: 29.051 seconds.
+
+The first attempt also proved normalized dependency/startup failure and
+sandbox cleanup: the acceptance environment lacked rein-aharness's optional
+`llm-connect` install. After installing the documented sibling dependency, the
+same profile and task succeeded. Production packaging must install the concrete
+rein with its execution dependencies.
+
+## `harness.agent-dev-openweights-local@1.0.0`
+
+- Result: succeeded on the 2026-08-21 local-time recheck after credential repair.
+- Contract: `1.0`.
+- Rein: `rein-openweights@0.1.0`.
+- Model route/resolved model: `rein-openweights-openrouter` /
+  `qwen/qwen-2.5-72b-instruct`.
+- Tool profile: `green-commit-only`.
+- Sandbox ID: `220482bc`; local lifecycle store verified `destroyed`.
+- Request ID: `b783af7f-e728-4dee-9034-f1c2262aa9ea`.
+- Commit: `b0600b25066731c6e1fc458409429f76a844f959`.
+- Turns/tokens: 3 / 3,497 of the 60,000-token profile budget.
+- Tool-event visibility: unavailable, reported explicitly rather than as an
+  empty claim of completeness.
+- Reported execution time: 300.095 seconds.
+
+The recheck exposed two credential-selection facts without revealing a value:
+an inherited `OPENROUTER_API_KEY` still contained the retired key and therefore
+masked the repaired workload lane, while the AppRole files existed at the
+documented standard directory but code required an environment variable to use
+them. The successful run removed the stale ambient override and selected the
+approved AppRole directory. `rein-openweights` now defaults to
+`~/.local/rein-openweights/approle`; explicit environment credentials retain
+development precedence and are documented as needing refresh/removal after
+rotation.
+
+## Acceptance status
+
+Both explicit profiles resolved and dispatched distinct rein/model
+constellations, completed the same semantic task with a real commit, returned
+the common Glas evidence envelope, and destroyed their local sandboxes. No
+alternative workload credential was borrowed.
+
+Rollback for consumers is to repin to the last approved Glas profile. The old
+`--sandbox-profile` governed path and implicit `ReinAharness()` default are not
+restored.