feat: route profiled ops runs through Glas

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d

tests/test_claim_loop.py

@@ -6,6 +6,7 @@ from unittest.mock import MagicMock, patch
 
 from rein_aharness.approaches import ApproachResult, APPROACH_FI_RESEARCH_BRIEF
 from rein_aharness.claim_loop import process_one, poll_peek
+from rein_aharness.glas_execution import GLAS_APPROACH, GlasExecutionError
 from rein_aharness.ops_run_client import OpsRun, OpsRunConfig, ActivityCoreOpsClient
 
 
@@ -95,3 +96,90 @@ def test_poll_peek() -> None:
     rows = poll_peek(client)
     assert len(rows) == 1
     assert rows[0]["approach"] == APPROACH_FI_RESEARCH_BRIEF
+
+
+def test_profiled_run_uses_glas_and_completes_with_full_result() -> None:
+    client = MagicMock(spec=ActivityCoreOpsClient)
+    client.config = OpsRunConfig(worker_id="w", lease_seconds=90)
+    run = _claimed_run()
+    run.harness_profile_ref = "harness.agent-dev-local@1.0.0"
+    run.approach_hint = "fi-research-brief"
+    client.claim.return_value = [run]
+    client.complete.return_value = OpsRun(
+        id=run.id,
+        activity_definition_id="def",
+        idempotency_key="k",
+        target_repo=run.target_repo,
+        title=run.title,
+        description="",
+        state="succeeded",
+    )
+    gateway_result = {
+        "ok": True,
+        "evidence": {
+            "outcome": "succeeded",
+            "profile_ref": run.harness_profile_ref,
+            "sandbox_id": "sbx-1",
+        },
+        "tool_output": "not copied into ProcessResult.detail",
+        "tool_error": None,
+    }
+    with (
+        patch("rein_aharness.claim_loop.execute_profiled_run", return_value=gateway_result),
+        patch("rein_aharness.claim_loop.select_approach") as select,
+        patch("rein_aharness.claim_loop.execute_approach") as execute,
+    ):
+        result = process_one(client)
+
+    assert result.ok is True
+    assert result.approach == GLAS_APPROACH
+    assert result.detail == {"execution_evidence": gateway_result["evidence"]}
+    client.complete.assert_called_once_with(run.id, result=gateway_result)
+    client.fail.assert_not_called()
+    select.assert_not_called()
+    execute.assert_not_called()
+
+
+def test_profile_refusal_fails_terminally_without_legacy_fallback() -> None:
+    client = MagicMock(spec=ActivityCoreOpsClient)
+    client.config = OpsRunConfig(worker_id="w", lease_seconds=90)
+    run = _claimed_run()
+    run.harness_profile_ref = "harness.unknown@9.9.9"
+    run.approach_hint = "fi-research-brief"
+    client.claim.return_value = [run]
+    client.fail.return_value = OpsRun(
+        id=run.id,
+        activity_definition_id="def",
+        idempotency_key="k",
+        target_repo=run.target_repo,
+        title=run.title,
+        description="",
+        state="failed",
+    )
+    with (
+        patch(
+            "rein_aharness.claim_loop.execute_profiled_run",
+            side_effect=GlasExecutionError("unknown harness profile"),
+        ),
+        patch("rein_aharness.claim_loop.select_approach") as select,
+        patch("rein_aharness.claim_loop.execute_approach") as execute,
+    ):
+        result = process_one(client)
+
+    assert result.ok is False
+    assert result.ops_state == "failed"
+    assert client.fail.call_args.kwargs["reopen"] is False
+    select.assert_not_called()
+    execute.assert_not_called()
+
+
+def test_poll_peek_reports_authoritative_profile_route() -> None:
+    client = MagicMock(spec=ActivityCoreOpsClient)
+    run = _claimed_run()
+    run.harness_profile_ref = "harness.agent-dev-local@1.0.0"
+    client.list_open.return_value = [run]
+    with patch("rein_aharness.claim_loop.select_approach") as select:
+        rows = poll_peek(client)
+    assert rows[0]["approach"] == GLAS_APPROACH
+    assert rows[0]["harness_profile_ref"] == run.harness_profile_ref
+    select.assert_not_called()

tests/test_glas_execution.py

@@ -0,0 +1,93 @@
+"""Tests for the authoritative activity-core -> Glas consumer boundary."""
+
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from rein_aharness.glas_execution import GlasExecutionError, execute_profiled_run
+from rein_aharness.ops_run_client import OpsRun, OpsRunConfig
+
+
+def _repo(tmp_path: Path) -> Path:
+    repo = tmp_path / "target"
+    repo.mkdir()
+    subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
+    return repo
+
+
+def _run(repo: Path) -> OpsRun:
+    return OpsRun(
+        id="run-1",
+        activity_definition_id="def-1",
+        idempotency_key="key-1",
+        target_repo="target",
+        title="Governed task",
+        description="Do the bounded work",
+        state="claimed",
+        harness_profile_ref="harness.agent-dev-local@1.0.0",
+        approach_hint="agent-session",
+        execution_refs={
+            "correlation_id": "corr-1",
+            "assignment_ref": "assignment:1",
+            "role_ref": "role:1",
+            "duty_ref": "duty:1",
+            "goal_refs": ["goal:1"],
+            "resource_envelope_refs": ["resource:1"],
+            "unknown": "must-not-cross",
+        },
+    )
+
+
+def test_profiled_run_builds_complete_execution_request(tmp_path: Path) -> None:
+    repo = _repo(tmp_path)
+    captured = {}
+
+    def request_factory(**kwargs):
+        captured.update(kwargs)
+        return kwargs
+
+    expected = {
+        "ok": True,
+        "evidence": {"outcome": "succeeded", "profile_ref": "profile"},
+        "tool_output": "direct caller output",
+        "tool_error": None,
+    }
+    result = execute_profiled_run(
+        _run(repo),
+        OpsRunConfig(worker_id="rein-aharness@test", repo_roots=(str(tmp_path),)),
+        report_to_hub=False,
+        request_factory=request_factory,
+        gateway=lambda request: expected,
+    )
+
+    assert result is expected
+    assert captured == {
+        "harness_profile_ref": "harness.agent-dev-local@1.0.0",
+        "repo": str(repo.resolve()),
+        "title": "Governed task",
+        "description": "Do the bounded work",
+        "actor": "rein-aharness@test",
+        "project": "rein-aharness",
+        "request_id": "run-1",
+        "correlation_id": "corr-1",
+        "assignment_ref": "assignment:1",
+        "role_ref": "role:1",
+        "duty_ref": "duty:1",
+        "goal_refs": ["goal:1"],
+        "resource_envelope_refs": ["resource:1"],
+        "report_to_hub": False,
+    }
+
+
+def test_profiled_run_rejects_invalid_gateway_result(tmp_path: Path) -> None:
+    repo = _repo(tmp_path)
+    with pytest.raises(GlasExecutionError, match="invalid GatewayResult"):
+        execute_profiled_run(
+            _run(repo),
+            OpsRunConfig(repo_roots=(str(tmp_path),)),
+            request_factory=lambda **kwargs: kwargs,
+            gateway=lambda request: {"evidence": {}},
+        )

tests/test_mail_triage.py

@@ -169,6 +169,8 @@ def test_llm_connect_client_complete(monkeypatch) -> None:
     import rein_aharness.llm_connect_client as mod
 
     class FakeResp:
+        status_code = 200
+
         def raise_for_status(self) -> None:
             return None
 
@@ -187,6 +189,68 @@ def test_llm_connect_client_complete(monkeypatch) -> None:
     assert client.last_response_metadata.get("model") == "test-model"
 
 
+class _ErrorResp:
+    def __init__(self, status_code: int, body) -> None:
+        self.status_code = status_code
+        self._body = body
+
+    def json(self):
+        if isinstance(self._body, Exception):
+            raise self._body
+        return self._body
+
+
+def test_llm_connect_error_preserves_safe_provider_cause(monkeypatch) -> None:
+    import rein_aharness.llm_connect_client as mod
+
+    response = _ErrorResp(
+        502,
+        {
+            "error": "provider_api_error",
+            "provider_status": 401,
+            "provider": "openrouter",
+            "model": "model-1",
+            "message": "No auth credentials found",
+            "api_key": "sk-must-not-appear",
+            "raw_response": {"authorization": "Bearer secret"},
+        },
+    )
+    monkeypatch.setattr(mod.httpx, "post", lambda *args, **kwargs: response)
+
+    with pytest.raises(LLMConnectError) as excinfo:
+        LLMConnectClient("http://llm.test").complete("hi")
+
+    text = str(excinfo.value)
+    assert "HTTP 502" in text
+    assert "error=provider_api_error" in text
+    assert "provider_status=401" in text
+    assert "provider=openrouter" in text
+    assert "model=model-1" in text
+    assert "message=No auth credentials found" in text
+    assert "sk-must-not-appear" not in text
+    assert "authorization" not in text
+
+
+def test_llm_connect_error_message_is_bounded(monkeypatch) -> None:
+    import rein_aharness.llm_connect_client as mod
+
+    response = _ErrorResp(502, {"error": "provider_api_error", "message": "x" * 5000})
+    monkeypatch.setattr(mod.httpx, "post", lambda *args, **kwargs: response)
+    with pytest.raises(LLMConnectError) as excinfo:
+        LLMConnectClient("http://llm.test").complete("hi")
+    assert len(str(excinfo.value)) < 600
+
+
+@pytest.mark.parametrize("body", [ValueError("not json"), ["unexpected"]])
+def test_llm_connect_error_without_usable_body_reports_status(monkeypatch, body) -> None:
+    import rein_aharness.llm_connect_client as mod
+
+    response = _ErrorResp(504, body)
+    monkeypatch.setattr(mod.httpx, "post", lambda *args, **kwargs: response)
+    with pytest.raises(LLMConnectError, match="llm-connect returned HTTP 504"):
+        LLMConnectClient("http://llm.test").complete("hi")
+
+
 def test_get_client_requires_env(monkeypatch) -> None:
     monkeypatch.delenv("LLM_CONNECT_URL", raising=False)
     with pytest.raises(LLMConnectError, match="LLM_CONNECT_URL"):

tests/test_ops_run_client.py

@@ -31,10 +31,20 @@ def test_ops_run_from_api() -> None:
             "labels": ["automated", "research-brief"],
             "state": "open",
             "attempt": 0,
+            "harness_profile_ref": "harness.agent-dev-local@1.0.0",
+            "execution_refs": {
+                "correlation_id": "corr-1",
+                "goal_refs": ["goal:42@1"],
+            },
         }
     )
     assert row.target_repo == "freedom-intelligence"
     assert "research-brief" in row.labels
+    assert row.harness_profile_ref == "harness.agent-dev-local@1.0.0"
+    assert row.execution_refs == {
+        "correlation_id": "corr-1",
+        "goal_refs": ["goal:42@1"],
+    }
 
 
 def test_config_from_env(monkeypatch: pytest.MonkeyPatch) -> None: