docs: record sandbox runtime implementation and remaining auth gates

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/intakes/residuals.md

@@ -100,6 +100,15 @@ description: |
   establish the Claude route. Keep this intake open for the open-weight
   profile even after the first Claude profile is proven.
 
+  2026-09-05 owner implementation: SAND-WP-0015 now provides digest-pinned
+  standalone Python runtime mounts and private HOME/XDG/TMP state. Real rein
+  CLI startup proof d4de9531 passed with read-only runtime, absent source,
+  clean worktree, cross-exec private-state persistence and workspace removal;
+  owner API smoke and 132 tests pass. No production profile selects the
+  temporary artifact, and no model call occurred. Claude workload auth mode/
+  concrete lane, credential delivery, enforced egress, pinned Claude runtime,
+  and deployment/Glas acceptance remain open in SAND-WP-0015-T04.
+
   Done when a non-secret probe and one real rein command execute inside the
   namespace, the source checkout is not visible/mutable, required egress is
   explicit, and teardown removes the sandbox workspace.

docs/local-profile-acceptance.md

@@ -159,3 +159,25 @@ repositories and mocked adapter boundaries, covering extra commits, extra
 paths, bad content, untracked/ignored artifacts, source visibility, file mode,
 strict boolean inspection results, redacted failures, and profile refusal.
 These tests do not count as the pending real-rein acceptance run.
+
+## Owner runtime return, 2026-09-05
+
+Sand-boxer commit `d69827a` (`SAND-WP-0015`) implemented owner-configured, digest-pinned Python
+runtime mounts and mode-0700 private HOME/XDG/TMP state outside the worktree.
+Its runtime smoke `d4de9531` ran the actual rein CLI and imported the Claude
+adapter, proved read-only runtime/source absence/clean Git state, preserved
+private state across two exec calls, and removed the workspace. Sand-boxer
+validation passed lint and 132 tests; authenticated owner API smoke `223db65b`
+passed. Details: `../sand-boxer/docs/bwrap-runtime.md` from the Glas repo root.
+
+The candidate artifact digest is
+`4c316737ec2715936a12c4f49621a5e4be3d1f4fe4739130393f28cdda66fbd9`.
+This is a temporary standalone Python bundle, not a deployed production
+profile or pinned Claude executable. The default profile inventory `ce15f4cb`
+now reports HOME outside the worktree but still has no selected rein bundle.
+
+T02 remains waiting on a concrete Claude workload authentication lane,
+credential delivery/revocation, the matching enforced provider egress, a pinned
+Claude executable, and deployment/profile review. Both credential searches
+(`anthropic`, `claude-code`) returned no catalog match. Runtime-startup proof
+does not authorize promotion of the local Glas profile.

workplans/GLAS-WP-0012-first-local-profile-production-proof.md

@@ -84,6 +84,16 @@ proofs pass. No rein installation in the source checkout, host home mount,
 credential injection from the interactive shell, or unrestricted network
 substitution is an acceptance path.
 
+2026-09-05 owner progress: SAND-WP-0015 implemented digest-pinned standalone
+Python runtime mounting and private namespace state. Real rein CLI startup,
+read-only runtime, source absence, clean worktree, state persistence across
+exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132
+tests pass. This completes the candidate runtime mechanism, not production
+selection. Authentication lane, credential delivery/revocation, provider egress,
+pinning the Claude executable, and deployed profile review remain open. The
+credential catalog has no matching Anthropic/Claude workload lane; the user's
+authentication choice is pending. See docs/local-profile-acceptance.md.
+
 ## Review and validate the versioned Glas proof candidate
 
 ```task