Harden SSH and profile resolution boundaries

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

docs/execution-profiles.md

@@ -34,7 +34,9 @@ Each YAML document under `profiles/` declares:
 The catalog discovers files deterministically, forbids unknown schema fields,
 rejects duplicate revisions, and checks the selected profile against
 `registry/reins/*.yaml`. Unpinned lookup is accepted only when exactly one
-enabled revision exists. Inline secrets and token-looking values are refused.
+revision exists; disabled revisions still make a multi-revision selector
+ambiguous so callers must pin deliberately. A pinned disabled revision is
+refused. Inline secrets and token-looking values are refused.
 
 Use `glas-harness profiles` as the catalog/packaging validation command.
 

docs/harness-contract.md

@@ -79,6 +79,11 @@ subprocess with the profile timeout. A host must make the selected rein command
 and its dependencies available inside that transport; host-only installation is
 not treated as sandbox availability.
 
+SSH reachability accepts only one non-option host or `user@host` target whose
+components begin with an alphanumeric character. Glas also terminates SSH
+option parsing with `--`; a reachability descriptor cannot reinterpret its
+target as an SSH flag.
+
 There is no production default rein. Direct `Rein` injection remains a narrow
 library/test seam but still requires a valid profile so profile, sandbox,
 model, tool policy, and evidence are explicit.