fix: execute local reins through the sandbox owner

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/intakes/residuals.md

@@ -77,6 +77,22 @@ description: |
   consumer namespace-entry authority. This strengthens the owner-exec need; it
   does not justify widening host execution.
 
+  2026-09-05 handoff refresh: sand-boxer b6655d8 now supplies owner-mediated
+  execution and bounded stdin. Glas replaced direct nsenter and host task-file
+  writes with that operation, preserving exact actor/project/request run_id,
+  profile credential_route_refs, and timeout. The non-secret gateway proof
+  passed in sandbox e3907e55: source absent and mutation refused, sandbox-only
+  commit, loopback-only network, mode-0600 task removed before teardown, and
+  destroyed workspace. Evidence: docs/evidence/GLAS-WP-0005-owner-boundary-2026-09-05.md.
+
+  Remaining owner work: supply the declared rein runtimes and dependencies,
+  governed credential delivery and explicit required egress, then prove a real
+  rein command through the Glas adapter before changing either local profile
+  from blocked. Glas owns the final profile review and acceptance run once the
+  sand-boxer runtime contract is available. The deterministic non-secret proof
+  does not satisfy this production acceptance. GLAS-WP-0005 can close its
+  boundary-hardening scope with this registered live residual still open.
+
   Done when a non-secret probe and one real rein command execute inside the
   namespace, the source checkout is not visible/mutable, required egress is
   explicit, and teardown removes the sandbox workspace.