fix: enforce sandbox execution boundary

docs/intakes/residuals.md

@@ -36,3 +36,38 @@ description: |
   commit b0600b25066731c6e1fc458409429f76a844f959, and sandbox 220482bc was
   verified destroyed. The AppRole directory is now the code default.
 ```
+
+## GLAS-IN-0002 — Provide executable sandbox runtime reachability
+
+```yaml
+id: GLAS-IN-0002
+kind: intake
+title: "Make bwrap reachability executable for governed Glas reins"
+lane: red
+status: todo
+priority: high
+owner: sand-boxer
+repo: glas-harness
+origin: residual
+origin_ref: GLAS-WP-0005
+description: |
+  GLAS-WP-0005 corrected the gateway so a rein command must execute through
+  the sand-boxer reachability descriptor and can no longer operate on the
+  caller's source checkout. The existing profile.bwrap-local environment does
+  not yet carry an executable rein runtime: ext.bwrap mounts /usr, /bin, /lib,
+  /lib64, and resolv.conf, while rein-aharness/rein-openweights and their
+  dependencies live outside those mounts. The open-weight profile also needs a
+  governed egress/credential-delivery answer rather than the current empty
+  network allow-list.
+
+  A 2026-08-21 managed-agent probe also found direct consumer nsenter denied on
+  the reported pid (IPC/UTS setns operation not permitted). Determine whether
+  sand-boxer should expose an owner-implemented exec operation instead of
+  requiring each consumer to call nsenter, and provide the runtime mount/image,
+  identity, and network contract needed by both local profiles. Do not restore
+  host-side execution as a workaround.
+
+  Done when a non-secret probe and one real rein command execute inside the
+  namespace, the source checkout is not visible/mutable, required egress is
+  explicit, and teardown removes the sandbox workspace.
+```