fix: validate sandbox consumer actors early

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

src/glas_harness/cli.py

@@ -21,7 +21,12 @@ def main(argv: list[str] | None = None) -> int:
     run.add_argument("--repo", required=True, help="Local repo path to mirror into the sandbox")
     run.add_argument("--title", required=True)
     run.add_argument("--description", required=True)
-    run.add_argument("--actor", default="agt")
+    run.add_argument(
+        "--actor",
+        choices=("adm", "agt", "atm"),
+        default="agt",
+        help="Governed execution actor type; queue worker identifiers belong upstream",
+    )
     run.add_argument("--project", default="glas-harness")
     run.add_argument("--no-hub", action="store_true", help="Skip the gateway's own hub reporting")
 

src/glas_harness/gateway.py

@@ -10,6 +10,7 @@ import time
 import uuid
 from datetime import UTC, datetime
 
+from pydantic import ValidationError
 from sandboxer.core.manager import SandboxManager
 from sandboxer.models import Consumer, SandboxCreateRequest
 
@@ -44,6 +45,18 @@ def _request_refs(request: ExecutionRequest) -> dict:
     return {key: value for key, value in refs.items() if value not in (None, [], "")}
 
 
+def _consumer_from_request(request: ExecutionRequest) -> Consumer:
+    """Validate the governed execution identity before sandbox provisioning."""
+
+    try:
+        return Consumer(actor=request.actor, project=request.project)
+    except ValidationError as exc:
+        raise ValueError(
+            "execution actor must be a governed consumer type: adm, agt, or atm; "
+            "queue worker identifiers are not execution actors"
+        ) from exc
+
+
 def run_execution(
     request: ExecutionRequest,
     *,
@@ -69,6 +82,7 @@ def run_execution(
     error: str | None = None
 
     try:
+        consumer = _consumer_from_request(request)
         profile, descriptor = catalog.resolve(request.harness_profile_ref)
         selected_rein = rein or catalog.build_rein(profile, descriptor)
     except Exception as exc:
@@ -102,7 +116,7 @@ def run_execution(
                 SandboxCreateRequest(
                     profile=profile.sandbox_profile,
                     inputs={"repo": request.repo},
-                    consumer=Consumer(actor=request.actor, project=request.project),
+                    consumer=consumer,
                     ttl=None,
                 )
             )