chore(consistency): sync task status from DB [auto]

Updated by fix-consistency on 2026-09-04:
  - update .custodian-brief.md for rein-aharness

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9

rein_aharness/runner.py

@@ -17,9 +17,17 @@ from pathlib import Path
 from typing import Any, Callable
 
 from rein_aharness import hub, metrics
+from rein_aharness.execution_cancel import ExecutionCancelled
 from rein_aharness.manifest import resolve_run_policy
 from rein_aharness.persona import load_persona_bundle
 from rein_aharness.profiles import UnknownToolProfileError, get_profile
+from rein_aharness.repository_transaction import (
+    DirtyRepositoryError,
+    GitRepositoryError,
+    RepositoryBusyError,
+    RepositoryTransaction,
+    RepositoryTransactionError,
+)
 from rein_aharness.taskspec import TaskSpec
 
 PROMPT_TEMPLATE = """\
@@ -59,6 +67,7 @@ class RunResult:
     # called with emit_tool_events=True. See adapter.py's module docstring
     # for why this is observation, not external tool dispatch.
     tool_events: list[dict[str, Any]] = field(default_factory=list)
+    transaction: dict[str, Any] | None = None
 
 
 def _git(repo: Path, *args: str) -> str:
@@ -73,6 +82,28 @@ def _git(repo: Path, *args: str) -> str:
     return result.stdout.strip()
 
 
+def _refused_run(
+    *,
+    reason: str,
+    model: str | None = None,
+    head_before: str = "",
+    transaction: dict[str, Any] | None = None,
+) -> RunResult:
+    return RunResult(
+        ok=False,
+        committed=False,
+        head_before=head_before,
+        head_after=head_before,
+        persona_source="none",
+        session_output="",
+        reason=reason,
+        tool_profile="",
+        budget_tokens=None,
+        model=model,
+        transaction=transaction,
+    )
+
+
 def run_task(
     spec: TaskSpec,
     adapter=None,
@@ -83,21 +114,14 @@ def run_task(
     model: str | None = None,
     tool_profile_override: str | None = None,
     budget_tokens_override: int | None = None,
+    transaction: RepositoryTransaction | None = None,
 ) -> RunResult:
     if spec.repository_grant is not None:
-        return RunResult(
-            ok=False,
-            committed=False,
-            head_before="",
-            head_after="",
-            persona_source="none",
-            session_output="",
+        return _refused_run(
             reason=(
                 "refused: repository_grant enforcement is not enabled; "
                 "no adapter was dispatched"
             ),
-            tool_profile="",
-            budget_tokens=None,
             model=model,
         )
     try:
@@ -110,31 +134,9 @@ def run_task(
             budget_tokens = budget_tokens_override
         profile = get_profile(profile_name)
     except UnknownToolProfileError as exc:
-        return RunResult(
-            ok=False,
-            committed=False,
-            head_before="",
-            head_after="",
-            persona_source="none",
-            session_output="",
-            reason=f"refused: {exc}",
-            tool_profile="",
-            budget_tokens=None,
-            model=model,
-        )
+        return _refused_run(reason=f"refused: {exc}", model=model)
     except Exception as exc:
-        return RunResult(
-            ok=False,
-            committed=False,
-            head_before="",
-            head_after="",
-            persona_source="none",
-            session_output="",
-            reason=f"manifest resolution failed: {exc}",
-            tool_profile="",
-            budget_tokens=None,
-            model=model,
-        )
+        return _refused_run(reason=f"manifest resolution failed: {exc}", model=model)
 
     collected_events: list[dict[str, Any]] = []
 
@@ -162,7 +164,58 @@ def run_task(
             adapter_kwargs["model"] = model
         adapter = AgenticClaudeCodeAdapter(**adapter_kwargs)
 
-    head_before = _git(spec.target_repo, "rev-parse", "HEAD")
+    def _run_locked(tx: RepositoryTransaction) -> RunResult:
+        return _execute_locked_task(
+            spec,
+            tx,
+            adapter=adapter,
+            profile=profile,
+            blueprint=blueprint,
+            lane=lane,
+            budget_tokens=budget_tokens,
+            collected_events=collected_events,
+            report_to_hub=report_to_hub,
+            write_metrics=write_metrics,
+            model=model,
+        )
+
+    if transaction is not None:
+        return _run_locked(transaction)
+    try:
+        with RepositoryTransaction(
+            spec.target_repo,
+            correlation_id=spec.hub_task_id or spec.title,
+        ) as tx:
+            return _run_locked(tx)
+    except DirtyRepositoryError as exc:
+        return _refused_run(
+            reason=f"refused: {exc}",
+            model=model,
+            head_before=exc.baseline.head,
+            transaction={"baseline": exc.baseline.evidence()},
+        )
+    except RepositoryBusyError as exc:
+        return _refused_run(reason=f"refused: {exc}", model=model)
+    except (GitRepositoryError, RepositoryTransactionError) as exc:
+        return _refused_run(reason=f"refused: {exc}", model=model)
+
+
+def _execute_locked_task(
+    spec: TaskSpec,
+    tx: RepositoryTransaction,
+    *,
+    adapter: Any,
+    profile: Any,
+    blueprint: str,
+    lane: str | None,
+    budget_tokens: int | None,
+    collected_events: list[dict[str, Any]],
+    report_to_hub: bool,
+    write_metrics: bool,
+    model: str | None,
+) -> RunResult:
+    assert tx.baseline is not None
+    head_before = tx.baseline.head
     persona, persona_source = load_persona_bundle(blueprint, spec.target_repo)
     prompt = PROMPT_TEMPLATE.format(
         persona=persona or "(no persona bundle available for this run)",
@@ -188,6 +241,11 @@ def run_task(
         resolved_model = response.model
         session_ok = True
         reason = ""
+    except ExecutionCancelled as exc:
+        session_output = ""
+        session_ok = False
+        reason = f"execution cancelled ({exc.reason})"
+        resolved_model = model
     except Exception as exc:  # adapter / budget failures must still be reported
         session_output = ""
         session_ok = False
@@ -217,6 +275,7 @@ def run_task(
         tokens_spent=tokens_spent,
         execution_time_s=execution_time_s,
         tool_events=collected_events,
+        transaction=tx.evidence(),
     )
 
     if write_metrics: