feat: import governed sandbox commits and enforce native CLI limits

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

rein_aharness/taskspec.py

@@ -11,6 +11,7 @@ import json
 from dataclasses import dataclass, field
 from pathlib import Path
 
+from rein_aharness.native_limits import validate_limits
 from rein_aharness.repository_grant import RepositoryGrant, RepositoryGrantError
 
 
@@ -29,6 +30,14 @@ class TaskSpec:
     completion_event_type: str = "executor_run"
     timeout_seconds: int = 900
     repository_grant: RepositoryGrant | None = None
+    max_budget_usd: float | None = None
+    max_turns: int | None = None
+
+    def __post_init__(self) -> None:
+        try:
+            validate_limits(self.max_budget_usd, self.max_turns)
+        except ValueError as exc:
+            raise TaskSpecError(str(exc)) from exc
 
     @classmethod
     def from_file(cls, path: str | Path) -> "TaskSpec":
@@ -55,4 +64,6 @@ class TaskSpec:
             completion_event_type=str(raw.get("completion_event_type", "executor_run")),
             timeout_seconds=int(raw.get("timeout_seconds", 900)),
             repository_grant=grant,
+            max_budget_usd=raw.get("max_budget_usd"),
+            max_turns=raw.get("max_turns"),
         )