4061ce860f
All checks were successful
ci / validate (push) Successful in 3m49s
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b
47 lines
1.8 KiB
Markdown
47 lines
1.8 KiB
Markdown
---
|
|
id: GLAS-WP-0006
|
|
type: workplan
|
|
title: "Fail fast on invalid sandbox consumer actors"
|
|
domain: infotech
|
|
repo: glas-harness
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: sandbox-consumer-actor-validation
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
state_hub_workstream_id: "c963a886-bb44-564e-86ec-a698373ea44c"
|
|
---
|
|
|
|
# Fail fast on invalid sandbox consumer actors
|
|
|
|
## Validate the actor boundary before provisioning
|
|
|
|
```task
|
|
id: GLAS-WP-0006-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "e05adf13-93e2-5fd8-8daf-071434c316c6"
|
|
```
|
|
|
|
The Activity Core live pilot passed its queue/profile boundary but supplied the
|
|
rein worker identifier as `ExecutionRequest.actor`. Sand-boxer accepts only the
|
|
governed consumer actor types `adm`, `agt`, and `atm`, so the mismatch was found
|
|
during sandbox creation.
|
|
|
|
Validate and normalize this boundary before provisioning, retain `worker_id` as
|
|
an upstream queue-ownership field rather than an execution actor, document the
|
|
distinction, and test that an invalid actor produces resolution refusal without
|
|
calling sand-boxer.
|
|
|
|
**Completed 2026-08-23:** the gateway now validates the sand-boxer `Consumer`
|
|
while resolving the request and returns a normalized `resolution` refusal
|
|
without constructing or calling a sandbox manager when the actor is invalid.
|
|
The CLI constrains `--actor` to `adm|agt|atm`; contract and channel guidance
|
|
separates the upstream queue `worker_id` from the governed execution actor.
|
|
Unit coverage proves both gateway and CLI refusal paths. All 58 tests and the
|
|
packaged profile catalog pass.
|
|
|
|
The repo-mandated `ADHOC-YYYY-MM-DD` workplan form was attempted first, but
|
|
Repo Manager rejected the otherwise instruction-conformant identifier as C-35.
|
|
That fleet convention mismatch is retained as residual `GLAS-IN-0004`; this
|
|
completed implementation uses the accepted normal workplan identity.
|