Constrain controlled CLI sessions and prove native budget overshoot

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/sandbox-artifact-return.md

@@ -26,7 +26,7 @@ still requires the existing recovery process to classify the resulting commit.
 Glas profile limits `max_budget_usd` and `max_turns` are carried in its generated
 TaskSpec into the agentic Claude adapter. A supplied task file cannot bypass
 these profile controls. Positive finite USD amounts and positive integer turn
-limits are required. A controlled run verifies Claude Code >= 2.1.217, supplies
+limits are required. A controlled run verifies Claude Code >= 2.1.266, supplies
 `--max-budget-usd` / `--max-turns`, and requires one successful terminal JSON
 result with valid cost, turn and token accounting. Limit exhaustion, missing
 accounting and reported overruns cannot produce a successful run. Bounded USD
@@ -56,3 +56,9 @@ invalid/exhausted results and refusal of older CLI versions without inference.
 The subsequent [durable spend admission](spend-admission.md) return implements
 private daily/total reservation and unknown-outcome recovery in the worker.
 Provider liability/FX proof and final operating admission remain open.
+
+The [installed CLI boundary proof](native-cli-boundary-proof.md) reproduces native
+budget overshoot and verifies controlled configuration/tool confinement. Native
+USD/turn-controlled runs now use bare mode and dontAsk with an explicit inventory;
+applicable repository instructions must be read as task context. The first paid
+factory run still requires a provider-facing request admission guard.