fix: enforce sandbox execution boundary

docs/evidence/GLAS-WP-0004-live-proof-2026-08-20.md

@@ -5,6 +5,16 @@ Acceptance task for both profiles: change one `README.md` status value from
 used a separate temporary initialized repository and `profile.bwrap-local`.
 No credential value, prompt transcript, or raw model output is recorded here.
 
+> **Correction recorded 2026-08-21 (GLAS-WP-0005):** these runs proved profile
+> resolution, rein dispatch, normalized evidence, commit detection, and
+> sand-boxer lifecycle teardown. They did **not** prove that the rein process ran
+> inside bwrap. The gateway passed the source checkout to the adapters and the
+> adapters launched ordinary host subprocesses instead of entering the reported
+> namespace. The commit and model results below remain valid execution facts;
+> the earlier isolation implication is withdrawn. GLAS-WP-0005 changes the
+> runtime to use only reachability-derived workspaces and transports and requires
+> a new boundary proof.
+
 ## `harness.agent-dev-local@1.0.0`
 
 - Result: succeeded.
@@ -54,7 +64,8 @@ rotation.
 
 Both explicit profiles resolved and dispatched distinct rein/model
 constellations, completed the same semantic task with a real commit, returned
-the common Glas evidence envelope, and destroyed their local sandboxes. No
+the common Glas evidence envelope, and destroyed their local sandbox lifecycle
+records. Per the correction above, this is not isolation evidence. No
 alternative workload credential was borrowed.
 
 Rollback for consumers is to repin to the last approved Glas profile. The old