---
id: GLAS-WP-0014
type: workplan
title: "Validate sandbox readiness before rein handoff"
domain: infotech
repo: glas-harness
status: finished
owner: codex
topic_slug: sandbox-handoff-validation
created: "2026-09-06"
updated: "2026-09-06"
state_hub_workstream_id: "7fd7f846-8bb9-5409-b818-5fbdb8d884ba"
---

# Sandbox handoff validation

Review found that the gateway accepts any returned sandbox state and prepares
reachability outside its stage-specific exception handling. An owner returning
a non-ready sandbox must not reach rein startup; preparation errors must carry
normalized failure evidence while preserving destruction attempts.

## Validate and report the owner handoff

```task
id: GLAS-WP-0014-T01
status: done
priority: high
state_hub_task_id: "64b1e1ab-421b-566d-b2ee-64284446db8a"
```

Require READY after create returns an identified sandbox. Classify non-ready
returns as sandbox_create failures and reachability/handle preparation errors
as session_start failures. Refuse before rein methods or owner exec, destroy
the returned sandbox, and keep raw error details out of Hub evidence. Preserve
successful behavior and existing cleanup status semantics. Add regression
coverage for non-ready states and malformed reachability; run the full suite
and catalog validation. No owner implementation or profile readiness changes.

## Completion

Completed 2026-09-06. All seven non-READY owner states are rejected before rein
startup and the returned sandbox is destroyed. Reachability preparation runs
inside the session_start failure boundary. Eight regressions failed before the
fix and pass afterwards; full suite 129 passed and catalog validation passed.
No residuals from this fix; real-profile acceptance remains GLAS-WP-0012.