Make profile runtime readiness explicit

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

docs/harness-contract.md

@@ -32,6 +32,13 @@ The gateway returns `GatewayResult` with:
 Raw prompts, model output, tool output, and credential material are excluded
 from the State Hub detail.
 
+`HarnessProfile.status` governs catalog selection. The separate
+`OperationalReadiness` model records runtime status, a reason, its owner, and
+an evidence reference. `ready` requires positive evidence; `blocked` requires
+an owner and evidence and is refused during resolution before sandbox
+creation; `unverified` permits only a labeled proof attempt. The selected state
+is copied into `ResolvedExecutionContext` and `ExecutionEvidence`.
+
 ## Rein lifecycle
 
 ```python
@@ -99,7 +106,8 @@ remain rein-local under ADR-002.
 
 The gateway returns evidence for every normal refusal/failure path:
 
-- `resolution`: unknown, disabled, ambiguous, incompatible, or unsafe profile;
+- `resolution`: unknown, disabled, ambiguous, incompatible, operationally
+  blocked, or unsafe profile;
 - `sandbox_create`;
 - `session_start`;
 - `execution` (including a rein-declared unsuccessful result);