fix: validate sandbox readiness before rein handoff

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

workplans/GLAS-WP-0012-first-local-profile-production-proof.md

@@ -249,3 +249,12 @@ production service identity and verified lane activation. Publication is not
 deployment. T02 stays waiting, and runtime pinning and combined acceptance
 remain required. No new owner inbox message or activation evidence was found
 in this review.
+
+## 2026-09-06 digest verification follow-up
+
+Reviewed secrets-engine `6e9c152` and `925d028`: owner corrected correlation
+field handling in the flex-auth digest and refreshed fixtures. Its tests also
+record an unresolved approval/native action-vocabulary and embedded-claim
+digest mismatch for dual-control requests. This is owner integration evidence,
+not successful live activation; SECRETS-WP-0009-T03 remains wait. No new
+activation receipt was found in the Glas inbox. T02 remains waiting.

workplans/GLAS-WP-0014-sandbox-handoff-validation.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Validate sandbox readiness before rein handoff"
 domain: infotech
 repo: glas-harness
-status: active
+status: finished
 owner: codex
 topic_slug: sandbox-handoff-validation
 created: "2026-09-06"
@@ -23,7 +23,7 @@ normalized failure evidence while preserving destruction attempts.
 
 ```task
 id: GLAS-WP-0014-T01
-status: progress
+status: done
 priority: high
 state_hub_task_id: "64b1e1ab-421b-566d-b2ee-64284446db8a"
 ```
@@ -35,3 +35,11 @@ the returned sandbox, and keep raw error details out of Hub evidence. Preserve
 successful behavior and existing cleanup status semantics. Add regression
 coverage for non-ready states and malformed reachability; run the full suite
 and catalog validation. No owner implementation or profile readiness changes.
+
+## Completion
+
+Completed 2026-09-06. All seven non-READY owner states are rejected before rein
+startup and the returned sandbox is destroyed. Reachability preparation runs
+inside the session_start failure boundary. Eight regressions failed before the
+fix and pass afterwards; full suite 129 passed and catalog validation passed.
+No residuals from this fix; real-profile acceptance remains GLAS-WP-0012.