Make profile runtime readiness explicit

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

tests/test_gateway.py

@@ -6,12 +6,14 @@ from sandboxer.models import Reachability, SandboxState, SandboxStatus
 from glas_harness.contract import (
     ExecutionRequest,
     ExecutionSummary,
+    OperationalReadiness,
     Rein,
     SandboxHandle,
     ToolCall,
     ToolResult,
 )
 from glas_harness.gateway import run_execution, run_task_through_rein
+from glas_harness.profiles import ProfileCatalog
 
 
 PROFILE = "harness.agent-dev-local@1.0.0"
@@ -83,12 +85,29 @@ def _request(*, profile: str = PROFILE, report_to_hub: bool = False) -> Executio
     )
 
 
+def _catalog_with_readiness(status: str = "ready") -> ProfileCatalog:
+    catalog = ProfileCatalog()
+    profile, _ = catalog.resolve(PROFILE)
+    readiness = OperationalReadiness(
+        status=status,
+        reason="test-only readiness state",
+        owner="tests",
+        evidence_ref="test:gateway-readiness",
+    )
+    catalog.profiles()[(profile.id, profile.version)] = profile.model_copy(
+        update={"operational_readiness": readiness}
+    )
+    return catalog
+
+
 def test_run_execution_creates_and_destroys_sandbox() -> None:
     manager = MagicMock()
     manager.create.return_value = _fake_status()
     rein = _FakeRein()
 
-    result = run_execution(_request(), rein=rein, manager=manager)
+    result = run_execution(
+        _request(), catalog=_catalog_with_readiness(), rein=rein, manager=manager
+    )
 
     assert rein.calls == [
         "start_session",
@@ -100,6 +119,7 @@ def test_run_execution_creates_and_destroys_sandbox() -> None:
     manager.destroy.assert_called_once_with("sbx1")
     assert result.ok is True
     assert result.evidence.profile_ref == PROFILE
+    assert result.evidence.profile_readiness.status == "ready"
     assert result.evidence.rein_id == "rein-aharness"
     assert result.evidence.commit_sha == "deadbeef"
     assert result.evidence.tokens_spent == 123
@@ -116,7 +136,9 @@ def test_run_execution_normalizes_execution_failure_and_tears_down() -> None:
             raise RuntimeError("boom")
 
     rein = _FailingRein()
-    result = run_execution(_request(), rein=rein, manager=manager)
+    result = run_execution(
+        _request(), catalog=_catalog_with_readiness(), rein=rein, manager=manager
+    )
 
     assert result.ok is False
     assert result.evidence.outcome == "failed"
@@ -139,6 +161,35 @@ def test_run_execution_refuses_unknown_profile_before_sandbox() -> None:
     manager.create.assert_not_called()
 
 
+def test_run_execution_refuses_blocked_profile_before_sandbox() -> None:
+    manager = MagicMock()
+
+    result = run_execution(_request(), rein=_FakeRein(), manager=manager)
+
+    assert result.ok is False
+    assert result.evidence.outcome == "refused"
+    assert result.evidence.failure_stage == "resolution"
+    assert result.evidence.profile_readiness.status == "blocked"
+    assert "GLAS-IN-0002" in (result.evidence.error or "")
+    manager.create.assert_not_called()
+
+
+def test_run_execution_allows_labeled_unverified_proof_attempt() -> None:
+    manager = MagicMock()
+    manager.create.return_value = _fake_status()
+
+    result = run_execution(
+        _request(),
+        catalog=_catalog_with_readiness("unverified"),
+        rein=_FakeRein(),
+        manager=manager,
+    )
+
+    assert result.ok is True
+    assert result.evidence.profile_readiness.status == "unverified"
+    manager.create.assert_called_once()
+
+
 def test_run_execution_refuses_worker_identifier_before_sandbox() -> None:
     manager = MagicMock()
     request = _request().model_copy(update={"actor": "rein-aharness@railiance01"})
@@ -160,7 +211,12 @@ def test_hub_receives_normalized_evidence_without_raw_output() -> None:
     manager.create.return_value = _fake_status()
 
     with patch("glas_harness.gateway.hub.post_progress_event", return_value=True) as post:
-        result = run_execution(_request(report_to_hub=True), rein=_FakeRein(), manager=manager)
+        result = run_execution(
+            _request(report_to_hub=True),
+            catalog=_catalog_with_readiness(),
+            rein=_FakeRein(),
+            manager=manager,
+        )
 
     post.assert_called_once()
     detail = post.call_args.kwargs["detail"]
@@ -181,7 +237,10 @@ def test_hub_failure_detail_excludes_raw_provider_error() -> None:
 
     with patch("glas_harness.gateway.hub.post_progress_event", return_value=True) as post:
         result = run_execution(
-            _request(report_to_hub=True), rein=_FailingRein(), manager=manager
+            _request(report_to_hub=True),
+            catalog=_catalog_with_readiness(),
+            rein=_FailingRein(),
+            manager=manager,
         )
 
     detail = post.call_args.kwargs["detail"]
@@ -201,6 +260,7 @@ def test_wrapper_requires_and_reports_harness_profile() -> None:
         description="d",
         rein=_FakeRein(),
         manager=manager,
+        catalog=_catalog_with_readiness(),
         report_to_hub=False,
     )
 
@@ -213,7 +273,12 @@ def test_teardown_failure_is_visible_in_evidence() -> None:
     manager.create.return_value = _fake_status()
     manager.destroy.side_effect = RuntimeError("cannot teardown")
 
-    result = run_execution(_request(), rein=_FakeRein(), manager=manager)
+    result = run_execution(
+        _request(),
+        catalog=_catalog_with_readiness(),
+        rein=_FakeRein(),
+        manager=manager,
+    )
 
     assert result.ok is False
     assert result.evidence.failure_stage == "teardown"