feat: reconcile granted ops run closes

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06bfe-2a55-7ed3-bacd-879977b099bf

tests/test_glas_evidence.py

@@ -7,6 +7,7 @@ import json
 from activity_core.glas_evidence import (
     normalise_execution_evidence,
     normalise_ops_result,
+    normalise_repository_transaction,
 )
 
 
@@ -113,3 +114,61 @@ def test_keeps_legacy_artifact_fields_but_not_unknown_blobs() -> None:
         {"kind": "report", "label": "Report", "url": "https://example.test/a"}
     ]
     assert "messages" not in result
+
+
+def test_preserves_bounded_repository_transaction_identity() -> None:
+    transaction = normalise_repository_transaction(
+        {
+            "transaction_id": "tx-1",
+            "correlation_id": "run-1",
+            "baseline": {"repo_id": "repo-1", "head": "base", "secret": "drop"},
+            "repository_grant": {
+                "grant_id": "grant-1",
+                "acceptance_policy_id": "policy-1",
+                "version": "1",
+                "allowed_path_count": 2,
+                "allowed_paths_digest": "digest",
+                "min_commits": 1,
+                "max_commits": 1,
+                "publish": False,
+                "allowed_paths": ["must-not-persist"],
+            },
+            "acceptance": {
+                "policy_id": "policy-1",
+                "accepted": True,
+                "head": "result",
+                "commit_count": 1,
+                "commits": ["result"],
+                "changed_path_count": 1,
+                "changed_paths": ["docs/result.md"] * 101,
+                "changed_paths_digest": "paths-digest",
+                "clean_post_state": True,
+                "provider_blob": "drop",
+            },
+            "metrics": {
+                "storage": "external",
+                "session_id": "tx-1",
+                "projection_ready": True,
+            },
+            "tool_output": "drop",
+        }
+    )
+
+    assert transaction["transaction_id"] == "tx-1"
+    assert transaction["repository_grant"]["grant_id"] == "grant-1"
+    assert transaction["acceptance"]["accepted"] is True
+    assert len(transaction["acceptance"]["changed_paths"]) == 100
+    assert transaction["metrics"]["session_id"] == "tx-1"
+    assert "allowed_paths" not in transaction["repository_grant"]
+    assert "tool_output" not in transaction
+    assert "secret" not in transaction["baseline"]
+
+
+def test_ops_result_accepts_repository_transaction_alias() -> None:
+    result = normalise_ops_result(
+        {"transaction": {"transaction_id": "tx-alias", "unknown": "drop"}}
+    )
+
+    assert result == {
+        "repository_transaction": {"transaction_id": "tx-alias"}
+    }