Make profile runtime readiness explicit

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

src/glas_harness/profiles.py

@@ -37,6 +37,10 @@ class IncompatibleProfileError(ProfileError):
     pass
 
 
+class OperationallyBlockedProfileError(ProfileError):
+    pass
+
+
 _SENSITIVE_KEY = re.compile(
     r"(^|_)(api_key|password|passwd|secret|secret_value|token_value|private_key)$",
     re.IGNORECASE,
@@ -186,12 +190,25 @@ class ProfileCatalog:
             profile=profile.ref,
             rein_id=descriptor.id,
             rein_version=descriptor.version,
+            operational_readiness=profile.operational_readiness,
             sandbox_profile=profile.sandbox_profile,
             tool_profile=profile.tool_profile,
             model=profile.model,
             limits=profile.limits,
         )
 
+    def require_operational(self, profile: HarnessProfile) -> None:
+        """Refuse known runtime blockers while allowing labeled proof attempts."""
+
+        readiness = profile.operational_readiness
+        if readiness.status != "blocked":
+            return
+        raise OperationallyBlockedProfileError(
+            f"profile {profile.ref} operational readiness is blocked: "
+            f"{readiness.reason} (owner={readiness.owner}; "
+            f"evidence={readiness.evidence_ref})"
+        )
+
     def build_rein(self, profile: HarnessProfile, descriptor: ReinDescriptor) -> Rein:
         module_name, class_name = descriptor.handler.split(":", 1)
         module = importlib.import_module(module_name)