Define repository grant contract

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d

rein_aharness/runner.py

@@ -84,6 +84,22 @@ def run_task(
     tool_profile_override: str | None = None,
     budget_tokens_override: int | None = None,
 ) -> RunResult:
+    if spec.repository_grant is not None:
+        return RunResult(
+            ok=False,
+            committed=False,
+            head_before="",
+            head_after="",
+            persona_source="none",
+            session_output="",
+            reason=(
+                "refused: repository_grant enforcement is not enabled; "
+                "no adapter was dispatched"
+            ),
+            tool_profile="",
+            budget_tokens=None,
+            model=model,
+        )
     try:
         profile_name, budget_tokens, lane, blueprint = resolve_run_policy(
             spec.target_repo, spec.agent