Normalize Glas execution evidence

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

tests/test_glas_evidence.py

@@ -0,0 +1,115 @@
+"""Normalized Glas evidence boundary (ACTIVITY-WP-0032-T04)."""
+
+from __future__ import annotations
+
+import json
+
+from activity_core.glas_evidence import (
+    normalise_execution_evidence,
+    normalise_ops_result,
+)
+
+
+def _gateway_result() -> dict:
+    return {
+        "ok": True,
+        "evidence": {
+            "request_id": "request-1",
+            "correlation_id": "corr-1",
+            "actor": "agt",
+            "project": "activity-core",
+            "target_repo": "activity-core",
+            "contract_version": "1.0",
+            "profile_ref": "harness.agent-dev@1.0.0",
+            "rein_id": "rein-aharness",
+            "rein_version": "0.1.0",
+            "model_route": "claude-code-cli",
+            "resolved_model": "claude-sonnet-4-6",
+            "sandbox_profile": "profile.bwrap-local",
+            "sandbox_id": "sandbox-1",
+            "tool_profile": "green-commit-only",
+            "outcome": "succeeded",
+            "started_at": "2026-08-22T20:00:00Z",
+            "finished_at": "2026-08-22T20:00:05Z",
+            "duration_s": 5.0,
+            "tokens_spent": 0,
+            "token_budget": 60000,
+            "commit_sha": "deadbeef",
+            "artifacts": ["README.md"],
+            "tool_events_count": 0,
+            "tool_events_completeness": "unavailable",
+            "refs": {
+                "assignment_ref": "assignment:42",
+                "goal_refs": ["goal:42@1", {"credential": "must-drop"}],
+                "api_key": "must-drop",
+            },
+            "raw_prompt": "must-drop",
+            "provider_response": {"must": "drop"},
+        },
+        "tool_output": "sensitive direct model output",
+        "tool_error": "sensitive provider exception",
+        "provider_blob": {"credential": "must-drop"},
+    }
+
+
+def test_normalises_gateway_result_and_drops_direct_output() -> None:
+    result = normalise_ops_result(_gateway_result())
+
+    assert result["ok"] is True
+    evidence = result["execution_evidence"]
+    assert evidence["profile_ref"] == "harness.agent-dev@1.0.0"
+    assert evidence["rein_id"] == "rein-aharness"
+    assert evidence["tokens_spent"] == 0
+    assert evidence["tool_events_count"] == 0
+    assert evidence["tool_events_completeness"] == "unavailable"
+    assert evidence["refs"] == {
+        "assignment_ref": "assignment:42",
+        "goal_refs": ["goal:42@1"],
+    }
+
+    serialized = json.dumps(result)
+    for forbidden in (
+        "tool_output",
+        "tool_error",
+        "provider_blob",
+        "raw_prompt",
+        "provider_response",
+        "credential",
+    ):
+        assert forbidden not in serialized
+
+
+def test_rejects_invalid_enums_and_non_finite_measurements() -> None:
+    evidence = normalise_execution_evidence(
+        {
+            "outcome": "maybe",
+            "failure_stage": "provider-internal",
+            "duration_s": float("nan"),
+            "tokens_spent": -1,
+            "tool_events_completeness": "unknown-ish",
+        }
+    )
+
+    assert evidence == {}
+
+
+def test_keeps_legacy_artifact_fields_but_not_unknown_blobs() -> None:
+    result = normalise_ops_result(
+        {
+            "ok": True,
+            "path": "briefs/report.md",
+            "head_after": "deadbeef",
+            "target_repo": "activity-core",
+            "artifact_urls": [
+                {"kind": "report", "label": "Report", "url": "https://example.test/a"},
+                {"kind": "unsafe", "label": "Unsafe", "url": "file:///tmp/key"},
+            ],
+            "messages": [{"role": "user", "content": "secret"}],
+        }
+    )
+
+    assert result["path"] == "briefs/report.md"
+    assert result["artifact_urls"] == [
+        {"kind": "report", "label": "Report", "url": "https://example.test/a"}
+    ]
+    assert "messages" not in result