fix: validate sandbox consumer actors early

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

docs/channel-contract.md

@@ -22,6 +22,12 @@ revision. Channels may obtain a profile choice from their own approved
 configuration, but must pass it explicitly and must surface resolution refusal
 to their caller.
 
+Channels pass `actor` as a governed sandbox consumer type: `adm`, `agt`, or
+`atm`. A queue's concrete `worker_id` is not an actor and remains upstream
+ownership metadata. For example, a worker named `rein-aharness@railiance01`
+invoking ordinary governed agent work passes `actor="agt"`; it does not copy
+its worker id into the actor field.
+
 The channel renders the full direct `GatewayResult`. State Hub receives only
 the compact `ExecutionEvidence` subset.
 

docs/harness-contract.md

@@ -15,6 +15,14 @@ title, and description. It may carry correlation and organizational references
 leadership/workforce records; they do not transfer organizational authority to
 Glas.
 
+`actor` is the governed sandbox consumer type and must be `adm`, `agt`, or
+`atm`. It is not a worker instance identifier. Queue consumers retain values
+such as `rein-aharness@railiance01` as upstream `worker_id` ownership metadata
+and map governed agent execution to `actor="agt"`. Glas validates this before
+sandbox creation and returns a normalized `resolution` refusal for invalid
+channel/library requests; the CLI rejects invalid choices during argument
+parsing.
+
 The gateway returns `GatewayResult` with:
 
 - `ok`, derived from normalized outcome;

docs/intakes/residuals.md

@@ -101,3 +101,31 @@ description: |
   legacy identifiers without C-35 or C-31 warnings.
 state_hub_intake_id: "01a02b78-adff-70b5-8088-594784edff23"
 ```
+
+## GLAS-IN-0004 — Align the mandated ad hoc convention with identifier canon
+
+```yaml
+id: GLAS-IN-0004
+kind: intake
+title: "Make ADHOC workplans valid under the fleet identifier canon"
+lane: green
+status: todo
+priority: medium
+owner: repo-manager
+repo: glas-harness
+origin: residual
+origin_ref: GLAS-WP-0006
+description: |
+  The repository's generated agent instructions mandate
+  workplans/ADHOC-YYYY-MM-DD.md with ADHOC-YYYY-MM-DD-Txx task ids for small,
+  low-risk fixes. On 2026-08-23, statehub fix-consistency accepted the task id
+  but Repo Manager identity preflight raised C-35 because the matching
+  ADHOC-2026-08-23 workplan id is absent from the canon kind registry.
+
+  Align the generated convention, Repo Manager identity preflight, and State
+  Hub synchronization. Either register the documented ad hoc workplan form or
+  replace the generated instruction with one canonical representation. Prove
+  the chosen form through registrar-reconcile without a contradictory identity
+  warning. Do not grandfather the one discarded local attempt; no UUID was
+  assigned and GLAS-WP-0006 is the authoritative record for that work.
+```