feat: add versioned execution profiles

docs/intakes/residuals.md

@@ -0,0 +1,38 @@
+# glas-harness residual intakes
+
+## GLAS-IN-0001 — Restore open-weight live-profile credential lane
+
+```yaml
+id: GLAS-IN-0001
+kind: intake
+title: "Restore the rein-openweights OpenRouter lane and close the dual-profile live proof"
+lane: blue
+status: done
+priority: high
+owner: ops-mason
+repo: glas-harness
+origin: residual
+origin_ref: GLAS-WP-0004
+description: |
+  On 2026-08-20, harness.agent-dev-openweights-local@1.0.0 resolved and
+  dispatched the same bounded fixture used by the successful rein-aharness
+  profile. The existing rein-local credential reached OpenRouter but the
+  provider returned HTTP 401 User not found before a model turn. Glas returned
+  normalized, redacted failure evidence and tore down sandbox bc9dec6a.
+
+  Route catalog id: rein-openweights-openrouter-approle. Credential values must
+  not be placed in this record, State Hub, Git, or chat.
+
+  The owning credential operator should rotate or repair that exact workload
+  lane, verify field presence without disclosure, and notify glas-harness.
+  Then rerun the bounded acceptance task through
+  harness.agent-dev-openweights-local@1.0.0, record a real commit plus cleanup
+  evidence, and mark GLAS-WP-0004-T07 done. Do not borrow llm-connect's
+  separate OpenRouter credential.
+
+  Completed 2026-08-21. The repaired lane authenticated after removing a stale
+  inherited OPENROUTER_API_KEY override and selecting the standard AppRole
+  directory. The profile completed in 3 turns, spent 3,497 tokens, produced
+  commit b0600b25066731c6e1fc458409429f76a844f959, and sandbox 220482bc was
+  verified destroyed. The AppRole directory is now the code default.
+```