fix: validate sandbox consumer actors early
Some checks failed
ci / validate (push) Has been cancelled

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b
This commit is contained in:
tegwick 2026-08-23 01:45:35 +02:00
parent ae2a706a68
commit 79bf88a3c4
9 changed files with 150 additions and 2 deletions

View file

@ -22,6 +22,12 @@ revision. Channels may obtain a profile choice from their own approved
configuration, but must pass it explicitly and must surface resolution refusal
to their caller.
Channels pass `actor` as a governed sandbox consumer type: `adm`, `agt`, or
`atm`. A queue's concrete `worker_id` is not an actor and remains upstream
ownership metadata. For example, a worker named `rein-aharness@railiance01`
invoking ordinary governed agent work passes `actor="agt"`; it does not copy
its worker id into the actor field.
The channel renders the full direct `GatewayResult`. State Hub receives only
the compact `ExecutionEvidence` subset.