feat: route profiled ops runs through Glas

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d

rein_aharness/glas_execution.py

@@ -0,0 +1,91 @@
+"""Profile-authoritative execution of activity-core ops runs through Glas.
+
+Glas and sand-boxer are sibling runtime packages rather than hard dependencies
+of rein-aharness's legacy paths. Imports therefore stay at the execution edge:
+profile-absent coexistence continues to work, while a profiled row fails closed
+with an actionable error if the governed runtime is not installed.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from typing import Any
+
+from rein_aharness.ops_run_client import OpsRun, OpsRunConfig, resolve_ops_target
+
+GLAS_APPROACH = "glas-profile"
+
+_SCALAR_REFS = (
+    "correlation_id",
+    "assignment_ref",
+    "role_ref",
+    "duty_ref",
+)
+_LIST_REFS = ("goal_refs", "resource_envelope_refs")
+
+
+class GlasExecutionError(RuntimeError):
+    """The authoritative Glas invocation could not produce a GatewayResult."""
+
+
+def _request_kwargs(run: OpsRun, config: OpsRunConfig, report_to_hub: bool) -> dict[str, Any]:
+    if not run.harness_profile_ref:
+        raise GlasExecutionError(f"ops_run {run.id} has no harness_profile_ref")
+
+    refs = run.execution_refs
+    kwargs: dict[str, Any] = {
+        "harness_profile_ref": run.harness_profile_ref,
+        "repo": str(resolve_ops_target(run, config)),
+        "title": run.title or "(untitled)",
+        "description": run.description or "",
+        "actor": config.worker_id,
+        "project": "rein-aharness",
+        "request_id": run.id,
+        "report_to_hub": report_to_hub,
+    }
+    for key in _SCALAR_REFS:
+        value = refs.get(key)
+        if isinstance(value, str) and value:
+            kwargs[key] = value
+    for key in _LIST_REFS:
+        value = refs.get(key)
+        if isinstance(value, list):
+            kwargs[key] = [item for item in value if isinstance(item, str)]
+    return kwargs
+
+
+def execute_profiled_run(
+    run: OpsRun,
+    config: OpsRunConfig,
+    *,
+    report_to_hub: bool = True,
+    request_factory: Callable[..., Any] | None = None,
+    gateway: Callable[[Any], Any] | None = None,
+) -> dict[str, Any]:
+    """Invoke Glas and return its complete JSON-compatible GatewayResult."""
+    if request_factory is None or gateway is None:
+        try:
+            from glas_harness.contract import ExecutionRequest
+            from glas_harness.gateway import run_execution
+        except ImportError as exc:
+            raise GlasExecutionError(
+                "profiled ops_run requires glas-harness with sand-boxer support; "
+                "install the sibling checkouts into the claim-worker environment"
+            ) from exc
+        request_factory = request_factory or ExecutionRequest
+        gateway = gateway or run_execution
+
+    try:
+        request = request_factory(**_request_kwargs(run, config, report_to_hub))
+        result = gateway(request)
+        raw = result.model_dump(mode="json") if hasattr(result, "model_dump") else result
+    except GlasExecutionError:
+        raise
+    except Exception as exc:
+        raise GlasExecutionError(f"Glas gateway invocation failed: {exc}") from exc
+
+    if not isinstance(raw, dict) or not isinstance(raw.get("ok"), bool):
+        raise GlasExecutionError("Glas gateway returned an invalid GatewayResult")
+    if not isinstance(raw.get("evidence"), dict):
+        raise GlasExecutionError("Glas GatewayResult is missing execution evidence")
+    return raw