Record post-fix Glas pilot blocker

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

workplans/ACTIVITY-WP-0032-glas-profile-execution-contract.md

@@ -9,7 +9,7 @@ owner: claude
 topic_slug: activity-core
 priority: medium
 created: "2026-08-21"
-updated: "2026-08-21"
+updated: "2026-08-23"
 related:
   - ACT-ADR-006
   - ACTIVITY-WP-0026
@@ -254,16 +254,22 @@ Live progress 2026-08-23 is recorded in
 `docs/evidence/ACTIVITY-WP-0032-glas-profile-pilot-2026-08-23.md`. Migration,
 current image rollout, definition sync, selector/refs, profile resolution, and
 normalized failure evidence are proven. Installing the missing Ubuntu
-`bubblewrap` package enabled a direct create/destroy preflight. The remaining
-consumer mismatch is rein-aharness passing queue worker id
-`rein-aharness@railiance01` as sand-boxer's governance actor instead of `agt`;
-handoff `c9a4ae44-f092-424f-9a4d-9b4cf58d65fd` requests the minimal adapter fix
-without weakening queue ownership identity.
+`bubblewrap` package enabled a direct create/destroy preflight.
 
-Returned to wait after exhausting Activity Core and host-side remediation. A
-temporary `AGENT_HARNESS_WORKER_ID=agt` override would conflate governance actor
-with queue ownership in the opposite direction and is not accepted as proof.
-Resume when rein-aharness deploys the explicit actor mapping.
+Rein-aharness then fixed and deployed the governance mapping in source
+`c633291`: the queue claim owner remains `rein-aharness@railiance01`, while the
+Glas `ExecutionRequest.actor` is now `agt`. Rein ran the exact disabled pilot
+once after that deployment. Ops run `ededc939-266f-473c-8386-ffd3f027f5f0`
+preserved `harness.agent-dev-local@1.0.0` and both T05 refs, resolved the
+rein/model constellation, created sandbox `d750cd5c`, and failed closed at
+`session_start` before provider dispatch. The sandbox reached `destroyed`, its
+workspace is absent, and no artifact or commit was produced. This resolves the
+actor mismatch without weakening queue ownership identity.
+
+Returned to wait on upstream `GLAS-IN-0002`: the managed consumer is denied
+`nsenter`, and the rein/model runtime and egress contract is not yet available
+inside the sandbox. Resume after that contract is implemented; do not trigger
+another pilot until the upstream blocker changes.
 
 ## Acceptance