plan: define first local profile acceptance and runtime blockers

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

SCOPE.md

@@ -43,11 +43,11 @@ installs the package, runs the suite, and validates the packaged catalog.
 | Profile/catalog resolution | Implemented and CI-validated |
 | Unknown, invalid, or known-blocked profile refusal | Implemented before sandbox creation |
 | Sandbox create/destroy lifecycle | Implemented; live failure paths prove teardown |
-| Original-checkout isolation | Enforced by code: it is never a post-create execution fallback |
+| Original-checkout isolation | Non-secret owner-execution proof passed: source absent, mutation refused, sandbox-only commit and complete cleanup |
 | SSH transport construction | Implemented and unit-tested; no current positive post-hardening live proof |
-| Same-host bwrap execution | Fail-closed, not operational: both local profiles are declared `blocked` and refused before creation; the underlying proof found consumer `nsenter` denied and no in-sandbox rein runtime |
+| Same-host bwrap execution | Owner-mediated boundary and stdin task cleanup are live-proven; both local profiles remain `blocked` pending runtime, credential delivery, and explicit egress acceptance |
 | `rein-aharness` adapter | Implemented; local selection is blocked before creation, while the remote profile remains an explicitly labeled unverified proof path |
-| `rein-openweights` adapter | Implemented; provider credential repair was proven, but current local sandbox execution has the same unresolved owner boundary |
+| `rein-openweights` adapter | Implemented; provider credential repair was proven, but current local selection remains blocked pending its runtime, credential, and egress acceptance |
 | CLI channel | Implemented |
 | State Hub evidence | Implemented as compact progress evidence, not a complete session/tool audit service |
 
@@ -97,9 +97,10 @@ yet Coulomb's general-purpose agent harness service.
 
 ## Active gaps
 
-- `GLAS-WP-0005-T05` / `GLAS-IN-0002`: sand-boxer-owned executable bwrap
-  reachability, rein runtime availability, explicit egress, and credential
-  delivery are required for a positive in-sandbox rein proof.
+- `GLAS-WP-0012` / `GLAS-IN-0002`: prove the first local rein runtime,
+  governed credential delivery, and explicit egress through the completed
+  owner-execution adapter. The open-weight portion remains a separate live
+  requirement in `GLAS-IN-0002`. See `docs/local-profile-acceptance.md`.
 - `GLAS-IN-0003`: grandfather the pre-canon `GLAS-0001` identifiers.
 - `GLAS-IN-0004`: align the documented ad hoc workplan convention with the
   identifier canon.