diff --git a/workplans/GLAS-WP-0014-sandbox-handoff-validation.md b/workplans/GLAS-WP-0014-sandbox-handoff-validation.md
new file mode 100644
index 0000000..f394ffb
--- /dev/null
+++ b/workplans/GLAS-WP-0014-sandbox-handoff-validation.md
@@ -0,0 +1,35 @@
+---
+id: GLAS-WP-0014
+type: workplan
+title: "Validate sandbox readiness before rein handoff"
+domain: infotech
+repo: glas-harness
+status: active
+owner: codex
+topic_slug: sandbox-handoff-validation
+created: "2026-09-06"
+updated: "2026-09-06"
+---
+
+# Sandbox handoff validation
+
+Review found that the gateway accepts any returned sandbox state and prepares
+reachability outside its stage-specific exception handling. An owner returning
+a non-ready sandbox must not reach rein startup; preparation errors must carry
+normalized failure evidence while preserving destruction attempts.
+
+## Validate and report the owner handoff
+
+```task
+id: GLAS-WP-0014-T01
+status: progress
+priority: high
+```
+
+Require READY after create returns an identified sandbox. Classify non-ready
+returns as sandbox_create failures and reachability/handle preparation errors
+as session_start failures. Refuse before rein methods or owner exec, destroy
+the returned sandbox, and keep raw error details out of Hub evidence. Preserve
+successful behavior and existing cleanup status semantics. Add regression
+coverage for non-ready states and malformed reachability; run the full suite
+and catalog validation. No owner implementation or profile readiness changes.