feat: support governed Glas execution

src/rein_openweights/cli.py

@@ -17,6 +17,7 @@ def main(argv: list[str] | None = None) -> int:
     run.add_argument("--model", default=None)
     run.add_argument("--max-turns", type=int, default=20)
     run.add_argument("--budget-tokens", type=int, default=60_000)
+    run.add_argument("--tool-profile", default="green-commit-only")
     run.add_argument("--no-hub", action="store_true", help="Skip hub reporting")
 
     args = parser.parse_args(argv)
@@ -29,6 +30,7 @@ def main(argv: list[str] | None = None) -> int:
             model=args.model or DEFAULT_MODEL,
             max_turns=args.max_turns,
             budget_tokens=args.budget_tokens,
+            tool_profile=args.tool_profile,
             report_to_hub=not args.no_hub,
         )
         print(json.dumps(asdict(result), indent=2))

src/rein_openweights/credentials.py

@@ -16,6 +16,7 @@ from pathlib import Path
 
 _KV_PATH_ENV = "REIN_OPENWEIGHTS_OPENROUTER_KV_PATH"
 _DEFAULT_KV_PATH = "reins/rein-openweights/openrouter"
+_DEFAULT_APPROLE_DIR = Path("~/.local/rein-openweights/approle").expanduser()
 _KV_FIELD = "api_key"
 _BAO_TIMEOUT = 30
 
@@ -38,11 +39,10 @@ def _bao(*args: str, env: dict[str, str] | None = None) -> str:
 
 
 def _acquire_token() -> str | None:
-    approle_dir = os.environ.get("REIN_OPENWEIGHTS_APPROLE_DIR")
-    if not approle_dir:
-        return None
-    role_id_file = Path(approle_dir) / "role_id"
-    secret_id_file = Path(approle_dir) / "secret_id"
+    configured = os.environ.get("REIN_OPENWEIGHTS_APPROLE_DIR")
+    approle_dir = Path(configured).expanduser() if configured else _DEFAULT_APPROLE_DIR
+    role_id_file = approle_dir / "role_id"
+    secret_id_file = approle_dir / "secret_id"
     if not (role_id_file.is_file() and secret_id_file.is_file()):
         return None
     return _bao(

src/rein_openweights/runner.py

@@ -8,6 +8,7 @@ completion unless --no-hub is set.
 from __future__ import annotations
 
 import subprocess
+import time
 from dataclasses import asdict, dataclass
 from pathlib import Path
 
@@ -19,6 +20,7 @@ from rein_openweights.openrouter_client import OpenRouterClient
 from rein_openweights.taskspec import TaskSpec
 
 DEFAULT_MODEL = "meta-llama/llama-3.1-70b-instruct"
+SUPPORTED_TOOL_PROFILES = {"green-commit-only"}
 
 
 @dataclass
@@ -29,6 +31,9 @@ class RunResult:
     turns: int
     tokens_spent: int
     reason: str = ""
+    model: str | None = None
+    execution_time_s: float = 0.0
+    tool_profile: str = "green-commit-only"
 
 
 def _git_head(repo: Path) -> str:
@@ -44,18 +49,34 @@ def run_task(
     model: str = DEFAULT_MODEL,
     max_turns: int = 20,
     budget_tokens: int = 60_000,
+    tool_profile: str = "green-commit-only",
     api_key: str | None = None,
     report_to_hub: bool = True,
 ) -> RunResult:
+    started = time.monotonic()
     task = TaskSpec.load(task_file)
     repo = Path(task.target_repo).expanduser().resolve()
     head_before = _git_head(repo)
 
+    if tool_profile not in SUPPORTED_TOOL_PROFILES:
+        result = RunResult(
+            ok=False, committed=False, commit_sha="", turns=0, tokens_spent=0,
+            reason=f"unsupported tool profile: {tool_profile}",
+            model=model,
+            execution_time_s=time.monotonic() - started,
+            tool_profile=tool_profile,
+        )
+        _report(result, task, report_to_hub)
+        return result
+
     key = api_key or resolve_openrouter_api_key()
     if not key:
         result = RunResult(
             ok=False, committed=False, commit_sha="", turns=0, tokens_spent=0,
             reason="no OpenRouter credential resolved",
+            model=model,
+            execution_time_s=time.monotonic() - started,
+            tool_profile=tool_profile,
         )
         _report(result, task, report_to_hub)
         return result
@@ -63,9 +84,24 @@ def run_task(
     client = OpenRouterClient(api_key=key, model=model)
     budget = BudgetTracker(total=budget_tokens)
 
-    loop_result = run_loop(
-        client, repo, task.title, task.description, max_turns=max_turns, budget=budget
-    )
+    try:
+        loop_result = run_loop(
+            client, repo, task.title, task.description, max_turns=max_turns, budget=budget
+        )
+    except Exception as exc:  # provider/client failures become rein evidence
+        result = RunResult(
+            ok=False,
+            committed=False,
+            commit_sha=_git_head(repo),
+            turns=0,
+            tokens_spent=budget.spent,
+            reason=f"session failed: {exc}",
+            model=model,
+            execution_time_s=time.monotonic() - started,
+            tool_profile=tool_profile,
+        )
+        _report(result, task, report_to_hub)
+        return result
 
     head_after = _git_head(repo)
     committed = bool(head_after) and head_after != head_before
@@ -77,6 +113,9 @@ def run_task(
         turns=loop_result.turns,
         tokens_spent=budget.spent,
         reason=loop_result.error or ("" if committed else "no commit produced"),
+        model=model,
+        execution_time_s=time.monotonic() - started,
+        tool_profile=tool_profile,
     )
     _report(result, task, report_to_hub)
     return result