glas-harness/workplans/GLAS-WP-0014-sandbox-handoff-validation.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
GLAS-WP-0014	workplan	Validate sandbox readiness before rein handoff	infotech	glas-harness	finished	codex	sandbox-handoff-validation	2026-09-06	2026-09-06	7fd7f846-8bb9-5409-b818-5fbdb8d884ba

Sandbox handoff validation

Review found that the gateway accepts any returned sandbox state and prepares reachability outside its stage-specific exception handling. An owner returning a non-ready sandbox must not reach rein startup; preparation errors must carry normalized failure evidence while preserving destruction attempts.

Validate and report the owner handoff

id: GLAS-WP-0014-T01
status: done
priority: high
state_hub_task_id: "64b1e1ab-421b-566d-b2ee-64284446db8a"

Require READY after create returns an identified sandbox. Classify non-ready returns as sandbox_create failures and reachability/handle preparation errors as session_start failures. Refuse before rein methods or owner exec, destroy the returned sandbox, and keep raw error details out of Hub evidence. Preserve successful behavior and existing cleanup status semantics. Add regression coverage for non-ready states and malformed reachability; run the full suite and catalog validation. No owner implementation or profile readiness changes.

Completion

Completed 2026-09-06. All seven non-READY owner states are rejected before rein startup and the returned sandbox is destroyed. Reachability preparation runs inside the session_start failure boundary. Eight regressions failed before the fix and pass afterwards; full suite 129 passed and catalog validation passed. No residuals from this fix; real-profile acceptance remains GLAS-WP-0012.