fix: validate sandbox consumer actors early

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

tests/test_cli.py

@@ -1,6 +1,8 @@
 import json
 from pathlib import Path
 
+import pytest
+
 from glas_harness.cli import main
 from glas_harness.contract import ExecutionRequest
 
@@ -19,3 +21,24 @@ def test_execution_request_example_matches_contract() -> None:
 
     assert request.harness_profile_ref == "harness.agent-dev-local@1.0.0"
     assert request.assignment_ref == "role-assignment:agent-7:42"
+
+
+def test_run_command_rejects_worker_identifier_as_actor() -> None:
+    with pytest.raises(SystemExit) as exc_info:
+        main(
+            [
+                "run",
+                "--harness-profile",
+                "harness.agent-dev-local@1.0.0",
+                "--repo",
+                "/tmp/repo",
+                "--title",
+                "t",
+                "--description",
+                "d",
+                "--actor",
+                "rein-aharness@railiance01",
+            ]
+        )
+
+    assert exc_info.value.code == 2

tests/test_gateway.py

@@ -139,6 +139,22 @@ def test_run_execution_refuses_unknown_profile_before_sandbox() -> None:
     manager.create.assert_not_called()
 
 
+def test_run_execution_refuses_worker_identifier_before_sandbox() -> None:
+    manager = MagicMock()
+    request = _request().model_copy(update={"actor": "rein-aharness@railiance01"})
+
+    result = run_execution(request, rein=_FakeRein(), manager=manager)
+
+    assert result.ok is False
+    assert result.evidence.outcome == "refused"
+    assert result.evidence.failure_stage == "resolution"
+    assert result.evidence.error == (
+        "execution actor must be a governed consumer type: adm, agt, or atm; "
+        "queue worker identifiers are not execution actors"
+    )
+    manager.create.assert_not_called()
+
+
 def test_hub_receives_normalized_evidence_without_raw_output() -> None:
     manager = MagicMock()
     manager.create.return_value = _fake_status()