Make profile runtime readiness explicit

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

src/glas_harness/cli.py

@@ -30,7 +30,7 @@ def main(argv: list[str] | None = None) -> int:
     run.add_argument("--project", default="glas-harness")
     run.add_argument("--no-hub", action="store_true", help="Skip the gateway's own hub reporting")
 
-    profiles = sub.add_parser("profiles", help="Validate and list executable Glas profiles")
+    profiles = sub.add_parser("profiles", help="Validate and list Glas catalog profiles")
     profiles.add_argument("--json", action="store_true", help="Emit machine-readable JSON")
 
     args = parser.parse_args(argv)
@@ -76,6 +76,7 @@ def main(argv: list[str] | None = None) -> int:
                 print(
                     f"{row['profile']['id']}@{row['profile']['version']}\t"
                     f"rein={row['rein_id']}@{row['rein_version']}\t"
+                    f"readiness={row['operational_readiness']['status']}\t"
                     f"model={row['model']['model']}\t"
                     f"sandbox={row['sandbox_profile']}"
                 )

src/glas_harness/contract.py

@@ -11,7 +11,7 @@ import re
 from abc import ABC, abstractmethod
 from typing import Any, Literal
 
-from pydantic import BaseModel, ConfigDict, Field, field_validator
+from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
 
 CONTRACT_VERSION = "1.0"
 _SEMVER = re.compile(r"^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:[-+][0-9A-Za-z.-]+)?$")
@@ -54,11 +54,31 @@ class ReinSelection(ContractModel):
     required_capabilities: dict[str, Any] = Field(default_factory=dict)
 
 
+class OperationalReadiness(ContractModel):
+    """Evidence-backed runtime status, separate from catalog selection policy."""
+
+    status: Literal["ready", "unverified", "blocked"] = "unverified"
+    reason: str = Field(default="no operational proof declared", min_length=1)
+    owner: str | None = Field(default=None, min_length=1)
+    evidence_ref: str | None = Field(default=None, min_length=1)
+
+    @model_validator(mode="after")
+    def validate_evidence(self) -> OperationalReadiness:
+        if self.status == "ready" and self.evidence_ref is None:
+            raise ValueError("ready operational status requires evidence_ref")
+        if self.status == "blocked" and (self.owner is None or self.evidence_ref is None):
+            raise ValueError("blocked operational status requires owner and evidence_ref")
+        return self
+
+
 class HarnessProfile(ContractModel):
     id: str = Field(pattern=r"^harness\.[a-z0-9][a-z0-9._-]*$")
     version: str
     contract_version: str
     status: Literal["enabled", "disabled"] = "enabled"
+    operational_readiness: OperationalReadiness = Field(
+        default_factory=OperationalReadiness
+    )
     rein: ReinSelection
     sandbox_profile: str = Field(pattern=r"^profile\.[a-z0-9][a-z0-9._-]*$")
     tool_profile: str = Field(min_length=1)
@@ -152,6 +172,9 @@ class ResolvedExecutionContext(ContractModel):
     profile: HarnessProfileRef
     rein_id: str
     rein_version: str
+    operational_readiness: OperationalReadiness = Field(
+        default_factory=OperationalReadiness
+    )
     sandbox_profile: str
     tool_profile: str
     model: ModelRoute
@@ -166,6 +189,7 @@ class ExecutionEvidence(ContractModel):
     target_repo: str
     contract_version: str = CONTRACT_VERSION
     profile_ref: str | None = None
+    profile_readiness: OperationalReadiness | None = None
     rein_id: str | None = None
     rein_version: str | None = None
     model_route: str | None = None

src/glas_harness/gateway.py

@@ -84,6 +84,7 @@ def run_execution(
     try:
         consumer = _consumer_from_request(request)
         profile, descriptor = catalog.resolve(request.harness_profile_ref)
+        catalog.require_operational(profile)
         selected_rein = rein or catalog.build_rein(profile, descriptor)
     except Exception as exc:
         outcome = "refused"
@@ -292,6 +293,7 @@ def _build_result(
         target_repo=request.repo,
         contract_version=CONTRACT_VERSION,
         profile_ref=str(profile.ref) if profile else None,
+        profile_readiness=profile.operational_readiness if profile else None,
         rein_id=descriptor.id if descriptor else None,
         rein_version=descriptor.version if descriptor else None,
         model_route=profile.model.route if profile else None,

src/glas_harness/profiles.py

@@ -37,6 +37,10 @@ class IncompatibleProfileError(ProfileError):
     pass
 
 
+class OperationallyBlockedProfileError(ProfileError):
+    pass
+
+
 _SENSITIVE_KEY = re.compile(
     r"(^|_)(api_key|password|passwd|secret|secret_value|token_value|private_key)$",
     re.IGNORECASE,
@@ -186,12 +190,25 @@ class ProfileCatalog:
             profile=profile.ref,
             rein_id=descriptor.id,
             rein_version=descriptor.version,
+            operational_readiness=profile.operational_readiness,
             sandbox_profile=profile.sandbox_profile,
             tool_profile=profile.tool_profile,
             model=profile.model,
             limits=profile.limits,
         )
 
+    def require_operational(self, profile: HarnessProfile) -> None:
+        """Refuse known runtime blockers while allowing labeled proof attempts."""
+
+        readiness = profile.operational_readiness
+        if readiness.status != "blocked":
+            return
+        raise OperationallyBlockedProfileError(
+            f"profile {profile.ref} operational readiness is blocked: "
+            f"{readiness.reason} (owner={readiness.owner}; "
+            f"evidence={readiness.evidence_ref})"
+        )
+
     def build_rein(self, profile: HarnessProfile, descriptor: ReinDescriptor) -> Rein:
         module_name, class_name = descriptor.handler.split(":", 1)
         module = importlib.import_module(module_name)