feat: reconcile granted ops run closes

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06bfe-2a55-7ed3-bacd-879977b099bf

tests/rules/test_actions.py

@@ -86,6 +86,35 @@ def test_action_carries_declared_profile_and_renders_attribution_refs() -> None:
     }
 
 
+def test_action_carries_repository_grant_without_rendering_authority() -> None:
+    grant = {
+        "version": "1",
+        "allowed_paths": ["docs/{context.request.scope}", "README.md"],
+        "commit_count": {"min": 1, "max": 1},
+        "publish": False,
+    }
+    rules = [
+        {
+            "id": "granted-task",
+            "condition": "",
+            "action": {
+                "task_template": "Run controlled task",
+                "target_repo": "activity-core",
+                "repository_grant": grant,
+            },
+        }
+    ]
+
+    specs = expand_rule_actions(
+        rules,
+        _Event(),
+        {"request": {"scope": "must-not-be-authority"}},
+    )
+
+    assert specs[0]["repository_grant"] == grant
+    assert specs[0]["repository_grant"] is not grant
+
+
 def test_for_each_binds_each_list_item_before_condition_and_action_rendering() -> None:
     rules = [
         {