feat(gateway): operator status derives readiness from canonical rows (ADK D4(a))

[LamaSu]

What

ADK D4(a), PX-10/R40: GET /api/operators/:slug/status derives readiness from canonical rows, with the interface agreed with gateway in bus #2622.

The route called an operator ready once a kernel, a capability and a channel existed. Nothing checked that a device could execute or that any run had produced real evidence, so an operator with only a mock device and a self-attested setup test read as ready.

The response gains an aggregate readiness object, and status: "ready" now also depends on it.

Field	Meaning
devices {registered, executable}, adapterReady	A registered machine whose adapter the kernel can build (listRegisteredMachineAdapters()), excluding the simulator and the generic-http refusal. Sensors, cameras and adapters the kernel cannot build as machines (modbus, sila) do not count.
verifiedRun	A completed job on one of the operator's kernels whose evidence verifies against that kernel's registered signer. The check uses SEAM-2's verifyDeviceSignedEvidence and registeredSignerInputFromColumns, reused, not copied, and the settlement gate is untouched.
runEvidence, setupTestEvidence	Evidence classes only: verified, invalid, unregistered-signer, unverifiable, test-key, gateway-placeholder, self-attest or none. Keys, signatures and job or bundle ids are never included.
payout	Always "not_supported" (R41).
openOffers	Open job offers for the operator's capability types, or null when the offer store is absent.

Other changes:

• The docstring said the endpoint was PUBLIC. It is not on the api-gate allowlist, so the doc now says it needs a key. Gateway said in #2622 to fix the doc, not the code.
• Owner-only detail waits for WP-A (N2).

Why a setup test does not count: POST /api/setup/test-job never exercises the operator's machine (bus #3367). A kernel with no devices gets a self-attested bundle. Otherwise the job runs on the gateway's in-process KernelService, whose emitter signs with the zero-address test key.

The work examined is bounded: 10 completed runs per kernel and 10 bundles per run. The bound errs toward "not ready", never toward "ready".

Consumers

• The only non-test consumer is the agent package's get_operator_status tool, whose description still says "Public" and "four slots, then go live". That file belongs to aeo and feat(adk): @pcc/adk skeleton with a pinned agent package and a clean external install check (R4 D1) #411 pins its hash, so I will propose the new text to aeo instead of editing it here.
• The dashboard does not call this route.

Tests

• 29 new unit tests with real Ed25519 keys (tweetnacl), in onboarding-readiness.test.ts.
• The route test grows from 7 to 18 cases. The two "ready" cases now seed a verified run. New cases cover self-attest, the test key, a wrong key, an unregistered signer, a failed job, another operator's run, a flood of newer failed jobs, mock-only devices, no secrets served, and open offers.
• 10 of 10 mutants are killed.
• Gateway suite: 3021 passed, 6 skipped. tsc is clean.

Review

The owner of this route is gateway (0600b204), and gateway reviews. The PR touches evidence verification (read-only) and auth-adjacent copy, so it also needs a cross-family pack under the operator's current process.

🤖 Generated with Claude Code