Define repository grant contract

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d

rein_aharness/taskspec.py

@@ -11,6 +11,8 @@ import json
 from dataclasses import dataclass, field
 from pathlib import Path
 
+from rein_aharness.repository_grant import RepositoryGrant, RepositoryGrantError
+
 
 class TaskSpecError(ValueError):
     pass
@@ -26,6 +28,7 @@ class TaskSpec:
     hub_task_id: str | None = None
     completion_event_type: str = "executor_run"
     timeout_seconds: int = 900
+    repository_grant: RepositoryGrant | None = None
 
     @classmethod
     def from_file(cls, path: str | Path) -> "TaskSpec":
@@ -36,6 +39,12 @@ class TaskSpec:
         target = Path(raw["target_repo"]).expanduser()
         if not (target / ".git").is_dir():
             raise TaskSpecError(f"target_repo is not a git repository: {target}")
+        grant = None
+        if "repository_grant" in raw:
+            try:
+                grant = RepositoryGrant.from_mapping(raw["repository_grant"])
+            except RepositoryGrantError as exc:
+                raise TaskSpecError(f"invalid repository_grant: {exc}") from exc
         return cls(
             title=str(raw["title"]),
             description=str(raw["description"]),
@@ -45,4 +54,5 @@ class TaskSpec:
             hub_task_id=raw.get("hub_task_id"),
             completion_event_type=str(raw.get("completion_event_type", "executor_run")),
             timeout_seconds=int(raw.get("timeout_seconds", 900)),
+            repository_grant=grant,
         )