feat: capture worker artifacts before teardown and carry native limits

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/evidence/2026-09-09-runtime-transfer.json

@@ -0,0 +1,40 @@
+{
+  "schema": "hfact.runtime-transfer-verification.v1",
+  "date": "2026-09-09",
+  "rein_tests": 290,
+  "glas_tests": 133,
+  "actual_bwrap_owner_execution": true,
+  "task_authoring": "deterministic fixture",
+  "queue": "fixture client; heartbeat/close/replay exercised",
+  "artifact_tests": [
+    "exact commit retained after sandbox destruction",
+    "granted path acceptance",
+    "one commit ancestry",
+    "corrupt and truncated bundle",
+    "symlink refusal",
+    "expanded object limit",
+    "wrong head",
+    "missing capture",
+    "teardown failure",
+    "lease loss",
+    "source changed externally",
+    "ignored cache excluded"
+  ],
+  "native_controls": [
+    "profile USD and turn limits reach Claude CLI",
+    "version preflight",
+    "strict terminal cost/token/turn accounting",
+    "limit exhaustion refuses success"
+  ],
+  "provider_requests": 0,
+  "paid_factory_attempts": 0,
+  "profile_promoted": false,
+  "protected_runtime_rebuilt": false,
+  "remaining": [
+    "durable daily/total budget reservations and uncertain outcome recovery",
+    "provider cap semantics and conservative EUR treatment",
+    "matching protected runtime pins and exact factory identity/placement",
+    "G0 operating admission",
+    "real model G1 and natural Railiance queue G2"
+  ]
+}

docs/execution-profiles.md

@@ -113,3 +113,24 @@ price, or provider behavior.
 
 Rollback is selection-based: repin a caller to its last approved Glas profile.
 Do not bypass Glas with `--sandbox-profile` or add a hidden default rein.
+
+## Worker artifact return and native limits (2026-09-09)
+
+A trusted worker may supply `run_execution(..., artifact_capture=callback)`.
+This callback is process-local and cannot be supplied in an ExecutionRequest.
+It runs after successful session cleanup and before sandbox destruction. Capture
+failure is recorded as `artifact_capture`; destruction is still attempted. The
+worker imports only after both cleanup and destruction succeeded. The callback
+must retain bounded bytes privately; GatewayResult/Hub evidence carries no Git
+bundle. Rein-aharness owns baseline/grant validation, source import and durable
+acceptance under its repository transaction.
+
+`ExecutionLimits.max_budget_usd` is an optional positive finite USD amount for
+rein-aharness; unsupported reins refuse it. The existing positive integer
+`max_turns` is now propagated to that rein. Glas generates the controlled task
+file from profile limits and rejects a supplied task file when native limits
+are set. Bounded `cost_usd` accounting is carried through tool, summary and
+execution evidence. These changes require matching rein/Glas runtime pins.
+No catalog profile is promoted or enabled by these fields. Factory admission
+still requires provider cap semantics, daily/total reservations, currency policy,
+credentials, placement and operating-owner acceptance.