glas-harness/workplans/GLAS-WP-0006-consumer-actor-validation.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
GLAS-WP-0006	workplan	Fail fast on invalid sandbox consumer actors	infotech	glas-harness	finished	codex	sandbox-consumer-actor-validation	2026-08-23	2026-08-23	c963a886-bb44-564e-86ec-a698373ea44c

Fail fast on invalid sandbox consumer actors

Validate the actor boundary before provisioning

id: GLAS-WP-0006-T01
status: done
priority: high
state_hub_task_id: "e05adf13-93e2-5fd8-8daf-071434c316c6"

The Activity Core live pilot passed its queue/profile boundary but supplied the rein worker identifier as ExecutionRequest.actor. Sand-boxer accepts only the governed consumer actor types adm, agt, and atm, so the mismatch was found during sandbox creation.

Validate and normalize this boundary before provisioning, retain worker_id as an upstream queue-ownership field rather than an execution actor, document the distinction, and test that an invalid actor produces resolution refusal without calling sand-boxer.

Completed 2026-08-23: the gateway now validates the sand-boxer Consumer while resolving the request and returns a normalized resolution refusal without constructing or calling a sandbox manager when the actor is invalid. The CLI constrains --actor to adm|agt|atm; contract and channel guidance separates the upstream queue worker_id from the governed execution actor. Unit coverage proves both gateway and CLI refusal paths. All 58 tests and the packaged profile catalog pass.

The repo-mandated ADHOC-YYYY-MM-DD workplan form was attempted first, but Repo Manager rejected the otherwise instruction-conformant identifier as C-35. That fleet convention mismatch is retained as residual GLAS-IN-0004; this completed implementation uses the accepted normal workplan identity.