fix: separate Glas actor from claim worker identity

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d

tests/test_glas_execution.py

@@ -7,7 +7,7 @@ from pathlib import Path
 
 import pytest
 
-from rein_aharness.glas_execution import GlasExecutionError, execute_profiled_run
+from rein_aharness.glas_execution import GLAS_ACTOR, GlasExecutionError, execute_profiled_run
 from rein_aharness.ops_run_client import OpsRun, OpsRunConfig
 
 
@@ -69,7 +69,7 @@ def test_profiled_run_builds_complete_execution_request(tmp_path: Path) -> None:
         "repo": str(repo.resolve()),
         "title": "Governed task",
         "description": "Do the bounded work",
-        "actor": "rein-aharness@test",
+        "actor": GLAS_ACTOR,
         "project": "rein-aharness",
         "request_id": "run-1",
         "correlation_id": "corr-1",
@@ -91,3 +91,39 @@ def test_profiled_run_rejects_invalid_gateway_result(tmp_path: Path) -> None:
             request_factory=lambda **kwargs: kwargs,
             gateway=lambda request: {"evidence": {}},
         )
+
+
+def test_profiled_actor_validates_against_real_glas_and_sandboxer(tmp_path: Path) -> None:
+    contract = pytest.importorskip("glas_harness.contract")
+    sandbox_models = pytest.importorskip("sandboxer.models")
+    repo = _repo(tmp_path)
+    captured = {}
+
+    def validating_gateway(request):
+        captured["request"] = request
+        captured["sandbox_request"] = sandbox_models.SandboxCreateRequest(
+            profile="profile.bwrap-local",
+            inputs={"repo": request.repo},
+            consumer=sandbox_models.Consumer(
+                actor=request.actor,
+                project=request.project,
+                run_id=request.request_id,
+            ),
+        )
+        return {
+            "ok": True,
+            "evidence": {"outcome": "succeeded"},
+            "tool_output": "",
+            "tool_error": None,
+        }
+
+    execute_profiled_run(
+        _run(repo),
+        OpsRunConfig(worker_id="rein-aharness@railiance01", repo_roots=(str(tmp_path),)),
+        request_factory=contract.ExecutionRequest,
+        gateway=validating_gateway,
+    )
+
+    assert captured["request"].actor == "agt"
+    assert captured["sandbox_request"].consumer.actor == sandbox_models.ActorType.AGT
+    assert captured["sandbox_request"].consumer.run_id == "run-1"