Record post-fix Glas pilot blocker

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

docs/evidence/ACTIVITY-WP-0032-glas-profile-pilot-2026-08-23.md

@@ -41,10 +41,29 @@ does not include worker tokens, provider responses, prompts, or tool output.
    rein-aharness passed queue worker id `rein-aharness@railiance01` as the
    sand-boxer governance actor, whose contract permits only `adm`, `agt`, or
    `atm`. No repository commit occurred.
+5. Rein-aharness source `c633291` fixed and deployed that mapping. Queue claim
+   ownership remains `rein-aharness@railiance01`, while the Glas execution actor
+   is now `agt`. Rein triggered the exact disabled pilot once after deployment;
+   activity-core did not duplicate that trigger.
+6. Post-fix run `ededc939-266f-473c-8386-ffd3f027f5f0` preserved profile
+   `harness.agent-dev-local@1.0.0` and assignment/correlation ref
+   `ACTIVITY-WP-0032-T05`. It resolved `rein-aharness` `0.1.0`, model route
+   `claude-code-cli`, and model `claude-sonnet-4-6`, then created sandbox
+   `d750cd5c` with governance actor `agt`.
+7. The run failed closed at `session_start`, before Claude/provider dispatch.
+   It emitted no token or tool events and produced no artifact or commit.
+   Sand-boxer reports `d750cd5c` as `destroyed` with no lifecycle error, and the
+   corresponding workspace is absent.
 
 The normalized production evidence surface is therefore proven for both
-profile resolution and failure. A successful commit/teardown proof remains
+profile resolution and failure. The actor adapter mismatch is resolved. A
-pending the rein adapter fix. Handoff messages:
+successful commit proof remains blocked by upstream `GLAS-IN-0002`: the managed
+consumer is denied `nsenter`, and the rein/model runtime and egress contract is
+absent inside the sandbox. Teardown after the normalized `session_start`
+failure is proven. Handoff messages:
 
 - rein-aharness: `c9a4ae44-f092-424f-9a4d-9b4cf58d65fd`
 - glas-harness: `b36b575b-7366-4b66-b916-ace705c57f4a`
+- rein-aharness post-fix: `923338e3-deb2-4764-98b6-ebe525d12acd`
+- rein-aharness post-fix run: `64568b0a-f5b4-41f2-8abd-9acc7e10ee38`
+- glas-harness actor validation: `726686fb-a356-47cd-952a-11c10dabc0e1`

workplans/ACTIVITY-WP-0032-glas-profile-execution-contract.md

@@ -9,7 +9,7 @@ owner: claude
 topic_slug: activity-core
 priority: medium
 created: "2026-08-21"
-updated: "2026-08-21"
+updated: "2026-08-23"
 related:
   - ACT-ADR-006
   - ACTIVITY-WP-0026
@@ -254,16 +254,22 @@ Live progress 2026-08-23 is recorded in
 `docs/evidence/ACTIVITY-WP-0032-glas-profile-pilot-2026-08-23.md`. Migration,
 current image rollout, definition sync, selector/refs, profile resolution, and
 normalized failure evidence are proven. Installing the missing Ubuntu
-`bubblewrap` package enabled a direct create/destroy preflight. The remaining
+`bubblewrap` package enabled a direct create/destroy preflight.
-consumer mismatch is rein-aharness passing queue worker id
-`rein-aharness@railiance01` as sand-boxer's governance actor instead of `agt`;
-handoff `c9a4ae44-f092-424f-9a4d-9b4cf58d65fd` requests the minimal adapter fix
-without weakening queue ownership identity.
 
-Returned to wait after exhausting Activity Core and host-side remediation. A
+Rein-aharness then fixed and deployed the governance mapping in source
-temporary `AGENT_HARNESS_WORKER_ID=agt` override would conflate governance actor
+`c633291`: the queue claim owner remains `rein-aharness@railiance01`, while the
-with queue ownership in the opposite direction and is not accepted as proof.
+Glas `ExecutionRequest.actor` is now `agt`. Rein ran the exact disabled pilot
-Resume when rein-aharness deploys the explicit actor mapping.
+once after that deployment. Ops run `ededc939-266f-473c-8386-ffd3f027f5f0`
+preserved `harness.agent-dev-local@1.0.0` and both T05 refs, resolved the
+rein/model constellation, created sandbox `d750cd5c`, and failed closed at
+`session_start` before provider dispatch. The sandbox reached `destroyed`, its
+workspace is absent, and no artifact or commit was produced. This resolves the
+actor mismatch without weakening queue ownership identity.
+
+Returned to wait on upstream `GLAS-IN-0002`: the managed consumer is denied
+`nsenter`, and the rein/model runtime and egress contract is not yet available
+inside the sandbox. Resume after that contract is implemented; do not trigger
+another pilot until the upstream blocker changes.
 
 ## Acceptance