feat: capture worker artifacts before teardown and carry native limits

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/execution-profiles.md

@@ -113,3 +113,24 @@ price, or provider behavior.
 
 Rollback is selection-based: repin a caller to its last approved Glas profile.
 Do not bypass Glas with `--sandbox-profile` or add a hidden default rein.
+
+## Worker artifact return and native limits (2026-09-09)
+
+A trusted worker may supply `run_execution(..., artifact_capture=callback)`.
+This callback is process-local and cannot be supplied in an ExecutionRequest.
+It runs after successful session cleanup and before sandbox destruction. Capture
+failure is recorded as `artifact_capture`; destruction is still attempted. The
+worker imports only after both cleanup and destruction succeeded. The callback
+must retain bounded bytes privately; GatewayResult/Hub evidence carries no Git
+bundle. Rein-aharness owns baseline/grant validation, source import and durable
+acceptance under its repository transaction.
+
+`ExecutionLimits.max_budget_usd` is an optional positive finite USD amount for
+rein-aharness; unsupported reins refuse it. The existing positive integer
+`max_turns` is now propagated to that rein. Glas generates the controlled task
+file from profile limits and rejects a supplied task file when native limits
+are set. Bounded `cost_usd` accounting is carried through tool, summary and
+execution evidence. These changes require matching rein/Glas runtime pins.
+No catalog profile is promoted or enabled by these fields. Factory admission
+still requires provider cap semantics, daily/total reservations, currency policy,
+credentials, placement and operating-owner acceptance.