feat: support governed Glas execution

tests/test_runner.py

@@ -73,3 +73,32 @@ def test_run_task_fails_fast_without_credential(tmp_path):
 
     assert result.ok is False
     assert "credential" in result.reason
+
+
+def test_run_task_refuses_unknown_tool_profile_before_credential_lookup(tmp_path):
+    repo = _init_repo(tmp_path)
+    task_file = _task_file(tmp_path, repo)
+
+    with patch("rein_openweights.runner.resolve_openrouter_api_key") as resolve:
+        result = run_task(task_file, tool_profile="unsafe-shell", report_to_hub=False)
+
+    assert result.ok is False
+    assert result.reason == "unsupported tool profile: unsafe-shell"
+    assert result.tool_profile == "unsafe-shell"
+    resolve.assert_not_called()
+
+
+def test_run_task_normalizes_provider_failure(tmp_path):
+    repo = _init_repo(tmp_path)
+    task_file = _task_file(tmp_path, repo)
+
+    with (
+        patch("rein_openweights.runner.resolve_openrouter_api_key", return_value="sk-test"),
+        patch("rein_openweights.runner.run_loop", side_effect=RuntimeError("provider down")),
+    ):
+        result = run_task(task_file, report_to_hub=False)
+
+    assert result.ok is False
+    assert result.committed is False
+    assert result.reason == "session failed: provider down"
+    assert result.model