Fail closed on invalid Glas profiles

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

tests/test_sync_activity_definitions.py

@@ -1,6 +1,8 @@
 import uuid
 
-from activity_core.definition_parser import scan_and_parse
+import pytest
+
+from activity_core.definition_parser import ParseError, parse_file, scan_and_parse
 from activity_core.models import ActivityDefinition
 from activity_core.sync_activity_definitions import _definition_uuid
 
@@ -95,3 +97,94 @@ context_sources:
     assert definition.context_sources[0]["params"]["evidence_sinks"][0]["type"] == (
         "state-hub-progress"
     )
+
+
+def _write_profiled_definition(tmp_path, action_lines: str) -> None:
+    (tmp_path / "profiled.md").write_text(
+        f"""---
+id: profiled
+name: Profiled
+enabled: true
+trigger:
+  type: cron
+  cron_expression: "0 9 * * *"
+---
+
+```rule
+id: emit
+condition: ""
+action:
+  task_template: Run it
+{action_lines}
+```
+""",
+        encoding="utf-8",
+    )
+
+
+def test_definition_parse_normalises_a_versioned_profile(tmp_path) -> None:
+    _write_profiled_definition(
+        tmp_path,
+        "  harness_profile_ref: '  harness.agent-dev@1.0.0  '\n",
+    )
+
+    definition = parse_file(tmp_path / "profiled.md")
+
+    assert definition.rules[0]["action"]["harness_profile_ref"] == (
+        "harness.agent-dev@1.0.0"
+    )
+
+
+def test_definition_parse_rejects_a_malformed_profile(tmp_path) -> None:
+    _write_profiled_definition(
+        tmp_path,
+        "  harness_profile_ref: harness.agent-dev\n",
+    )
+
+    with pytest.raises(ParseError, match="must pin a version"):
+        parse_file(tmp_path / "profiled.md")
+
+
+def test_definition_parse_requires_rule_profile_in_strict_mode(
+    tmp_path,
+    monkeypatch,
+) -> None:
+    _write_profiled_definition(tmp_path, "")
+    monkeypatch.setenv("ACTIVITY_CORE_REQUIRE_HARNESS_PROFILE", "true")
+
+    with pytest.raises(ParseError, match="must declare harness_profile_ref"):
+        parse_file(tmp_path / "profiled.md")
+
+
+def test_strict_mode_does_not_require_profile_for_deterministic_report(
+    tmp_path,
+    monkeypatch,
+) -> None:
+    path = tmp_path / "report.md"
+    path.write_text(
+        """---
+id: report
+name: Report only
+enabled: true
+trigger:
+  type: cron
+  cron_expression: "0 9 * * *"
+---
+
+```instruction
+id: report-only
+trusted_fields: []
+model: deterministic
+prompt: Report
+output_schema: ""
+report_sinks:
+  - type: state-hub-progress
+```
+""",
+        encoding="utf-8",
+    )
+    monkeypatch.setenv("ACTIVITY_CORE_REQUIRE_HARNESS_PROFILE", "true")
+
+    definition = parse_file(path)
+
+    assert definition.instructions[0]["id"] == "report-only"