Pin workload-only Glas runtime for metered acceptance preparation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

deploy/runtime-contract-lock.json

@@ -13,7 +13,7 @@
       "version": "0.1.0"
     },
     {
-      "commit": "30be81808140a3a3d137e731d1fe9aed59ad8581",
+      "commit": "7357115c8311e55ee3d495f5266f501a17ec3c89",
       "distribution": "glas-harness",
       "source": "../glas-harness",
       "version": "0.1.0"

workplans/REINAH-WP-0008-simpler-metered-retry.md

@@ -9,7 +9,7 @@ owner: claude-code
 topic_slug: rein-aharness
 priority: high
 created: "2026-10-13"
-updated: "2026-10-14"
+updated: "2026-10-16"
 related:
   - REINAH-WP-0003
 state_hub_workstream_id: "187c2599-84a6-5764-a14f-7e9121975bf2"
@@ -308,3 +308,47 @@ review-record approval counts as spend authority). Workspace draft
 Hub memo dispatcher; approval intent `accept` by `helixforge-factory`. Record:
 informed-decision `d5f1021` (sitting.json, OPERATOR.md). The accepted approval id
 becomes `authority_ref` for `owner renew`. Install candidate remains `818b1b7c`.
+
+
+### Workload-only Glas source integration — 2026-10-16
+
+Reviewed and integrated the one-line runtime-contract lock advance from Glas
+`30be81808140a3a3d137e731d1fe9aed59ad8581` to published workload-only credential
+delivery `7357115c8311e55ee3d495f5266f501a17ec3c89`. llm-connect `37436bb5` and
+sandboxer `221126cb` remain pinned. This is source integration under T07, not
+native artifact installation or admission. T07 remains waiting with its existing
+owner gates.
+
+Prior preparation used rein base `be5ef400` plus isolated lock-only commit
+`c811fc43` to build candidate
+`634e65fee5517ebee0d1080805fd84c81bd46af26a2b38ec1ab14bd2be17bf8f`. The
+candidate's installed packages passed actual SandboxManager/Glas gateway proof
+with unchanged `harness.agent-dev-local@1.1.1` (still unverified): real rein/Glas
+CLI and Claude 2.1.266 startup, read-only runtime, synthetic host-file and
+inherited environment/child-process denial, exact task identity/private state,
+deterministic workspace Git effect, task removal and destruction. A separately
+labelled synthetic route fixture passed workload-only delivery, output redaction
+and clean subsequent housekeeping through the same actual manager. Wrong
+actor/project/run, expired execution, expiry cleanup, cancellation and
+post-cancellation refusal passed. All 141 Glas tests and seven rein lock/rehearsal
+tests passed; whole artifact digest remained unchanged after proof.
+
+The first proof runner correctly encountered the manager's PermissionError for
+wrong consumer but expected ValueError/RuntimeError. Its finally cleanup ran;
+the runner catch was refined and the failure retained. This does not earn an
+unchanged execution success. No model/provider request, real credential read,
+queue access or spend occurred.
+
+The preparation artifact is not the artifact of this integrated owner revision.
+Rebuild from the exact committed owner source and verify its new digest and
+actual-manager proof before considering installation. Source inputs, receipts,
+reproducible proof and attempt history are retained in the
+[Custodian evidence directory](../../the-custodian/docs/changes/netkingdom-target-2026-10-16/agent-isolation-next/README.md).
+The same directory records the integrated-source rebuild separately.
+
+Retain `818b1b7c`, `ee3d0a53`, installed `b6e4e8a4` and their outcomes as historical
+evidence. Native acceptance still requires the queued spend memo lifecycle,
+owner artifact installation/rehearsal, renewal and Secrets Engine file-pin
+updates, required native approvals and bounded real-model/tool proof. Actual
+interactive assignment migration and external tool-path denial remain Custodian
+acceptance obligations; no profile readiness or supervision authority changed.