feat(runtime): enforce governed mutation boundaries

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9

tests/test_claim_loop.py

@@ -2,8 +2,10 @@
 
 from __future__ import annotations
 
-from unittest.mock import MagicMock, patch
+import subprocess
 import time
+from pathlib import Path
+from unittest.mock import MagicMock, patch
 
 from rein_aharness.approaches import ApproachResult, APPROACH_FI_RESEARCH_BRIEF
 from rein_aharness.claim_loop import (
@@ -20,6 +22,7 @@ from rein_aharness.ops_run_client import (
     OpsRunConfig,
     OpsRunError,
 )
+from rein_aharness.repository_transaction import RepositoryTransaction
 
 
 def _claimed_run() -> OpsRun:
@@ -37,6 +40,41 @@ def _claimed_run() -> OpsRun:
     )
 
 
+def _profiled_case(
+    tmp_path: Path,
+) -> tuple[Path, OpsRun, MagicMock]:
+    repo = tmp_path / "freedom-intelligence"
+    repo.mkdir()
+    subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
+    (repo / "README.md").write_text("controlled target\n", encoding="utf-8")
+    subprocess.run(["git", "add", "."], cwd=repo, check=True)
+    subprocess.run(
+        [
+            "git",
+            "-c",
+            "user.email=test@example.invalid",
+            "-c",
+            "user.name=test",
+            "commit",
+            "-qm",
+            "baseline",
+        ],
+        cwd=repo,
+        check=True,
+    )
+
+    run = _claimed_run()
+    run.harness_profile_ref = "harness.agent-dev-local@1.0.0"
+    client = MagicMock(spec=ActivityCoreOpsClient)
+    client.config = OpsRunConfig(
+        worker_id="w",
+        lease_seconds=90,
+        repo_roots=(str(tmp_path),),
+    )
+    client.claim.return_value = [run]
+    return repo, run, client
+
+
 def test_process_one_empty() -> None:
     client = MagicMock(spec=ActivityCoreOpsClient)
     client.config = OpsRunConfig(worker_id="w", lease_seconds=90)
@@ -231,12 +269,8 @@ def test_process_one_records_adapter_exception_without_unbound_result() -> None:
     client.fail.assert_not_called()
 
 
-def test_profiled_exception_after_lease_loss_skips_close() -> None:
-    client = MagicMock(spec=ActivityCoreOpsClient)
-    client.config = OpsRunConfig(worker_id="w", lease_seconds=90)
-    run = _claimed_run()
-    run.harness_profile_ref = "harness.agent-dev-local@1.0.0"
-    client.claim.return_value = [run]
+def test_profiled_exception_after_lease_loss_skips_close(tmp_path: Path) -> None:
+    repo, _run, client = _profiled_case(tmp_path)
     client.heartbeat.side_effect = OpsRunError("lease rejected", status_code=409)
 
     def slow_profile(*_args, **_kwargs):
@@ -253,6 +287,8 @@ def test_profiled_exception_after_lease_loss_skips_close() -> None:
     assert result.reason.startswith("lease lost")
     client.complete.assert_not_called()
     client.fail.assert_not_called()
+    with RepositoryTransaction(repo) as retry:
+        assert retry.locked is True
 
 
 def test_poll_peek() -> None:
@@ -263,13 +299,11 @@ def test_poll_peek() -> None:
     assert rows[0]["approach"] == APPROACH_FI_RESEARCH_BRIEF
 
 
-def test_profiled_run_uses_glas_and_completes_with_full_result() -> None:
-    client = MagicMock(spec=ActivityCoreOpsClient)
-    client.config = OpsRunConfig(worker_id="w", lease_seconds=90)
-    run = _claimed_run()
-    run.harness_profile_ref = "harness.agent-dev-local@1.0.0"
+def test_profiled_run_uses_glas_and_completes_with_full_result(
+    tmp_path: Path,
+) -> None:
+    _repo, run, client = _profiled_case(tmp_path)
     run.approach_hint = "fi-research-brief"
-    client.claim.return_value = [run]
     client.complete.return_value = OpsRun(
         id=run.id,
         activity_definition_id="def",
@@ -313,13 +347,12 @@ def test_profiled_run_uses_glas_and_completes_with_full_result() -> None:
     execute.assert_not_called()
 
 
-def test_profile_refusal_fails_terminally_without_legacy_fallback() -> None:
-    client = MagicMock(spec=ActivityCoreOpsClient)
-    client.config = OpsRunConfig(worker_id="w", lease_seconds=90)
-    run = _claimed_run()
+def test_profile_refusal_fails_terminally_without_legacy_fallback(
+    tmp_path: Path,
+) -> None:
+    _repo, run, client = _profiled_case(tmp_path)
     run.harness_profile_ref = "harness.unknown@9.9.9"
     run.approach_hint = "fi-research-brief"
-    client.claim.return_value = [run]
     client.fail.return_value = OpsRun(
         id=run.id,
         activity_definition_id="def",
@@ -346,6 +379,49 @@ def test_profile_refusal_fails_terminally_without_legacy_fallback() -> None:
     execute.assert_not_called()
 
 
+def test_profiled_signal_cancellation_releases_repository_lock(
+    tmp_path: Path,
+) -> None:
+    repo, _run, client = _profiled_case(tmp_path)
+
+    def cancel_during_gateway(*_args, **_kwargs):
+        _cancel_active_run("signal")
+        return {"ok": True, "evidence": {"outcome": "late-success"}}
+
+    with patch(
+        "rein_aharness.claim_loop.execute_profiled_run",
+        side_effect=cancel_during_gateway,
+    ):
+        result = process_one(client)
+
+    assert result.ok is False
+    assert result.reason == "execution cancelled (signal)"
+    client.complete.assert_not_called()
+    client.fail.assert_not_called()
+    with RepositoryTransaction(repo) as retry:
+        assert retry.locked is True
+
+
+def test_profiled_close_failure_happens_after_repository_lock_release(
+    tmp_path: Path,
+) -> None:
+    repo, _run, client = _profiled_case(tmp_path)
+    client.complete.side_effect = OpsRunError("complete transport failed")
+    gateway_result = {"ok": True, "evidence": {"outcome": "succeeded"}}
+
+    with patch(
+        "rein_aharness.claim_loop.execute_profiled_run",
+        return_value=gateway_result,
+    ):
+        result = process_one(client)
+
+    assert result.ok is False
+    assert result.reason.startswith("close ops_run failed:")
+    assert "repository_transaction" in result.detail
+    with RepositoryTransaction(repo) as retry:
+        assert retry.locked is True
+
+
 def test_poll_peek_reports_authoritative_profile_route() -> None:
     client = MagicMock(spec=ActivityCoreOpsClient)
     run = _claimed_run()