feat: reconcile granted ops run closes

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06bfe-2a55-7ed3-bacd-879977b099bf

workplans/ACTIVITY-WP-0037-repository-grant-close-reconciliation.md

@@ -0,0 +1,126 @@
+---
+id: ACTIVITY-WP-0037
+type: workplan
+title: "Carry repository grants and reconcile terminal queue closes"
+domain: infotech
+repo: activity-core
+status: active
+owner: codex
+topic_slug: activity-core
+priority: high
+created: "2026-09-04"
+updated: "2026-09-04"
+related:
+  - ACT-ADR-005
+  - ACT-ADR-006
+  - ACTIVITY-WP-0032
+  - ACTIVITY-WP-0036
+  - REINAH-WP-0003
+---
+
+# Carry Repository Grants and Reconcile Terminal Queue Closes
+
+## Origin
+
+Rein-aharness enabled its versioned local repository-grant validator and durable
+close outbox on 2026-09-04, then reported two Activity Core contract gaps:
+
+1. queued/profiled work has no separately typed authoritative repository grant;
+2. a response-lost terminal close retry receives the same undifferentiated 409
+   as a wrong-owner, expired-lease, or conflicting-result mutation, while the
+   result allowlist drops repository transaction and acceptance identity.
+
+These are Activity Core responsibilities at the definition/emission and durable
+queue boundaries. The grant must not be inferred from task prose, labels,
+`execution_refs`, a profile, or repository defaults.
+
+## Review and specify the cross-repository contract
+
+```task
+id: ACTIVITY-WP-0037-T01
+status: done
+priority: high
+```
+
+Review rein-aharness repository-grant v1, its close-outbox identity, and exact
+ADR-002 revision `36e1096`. Define compatibility, rejection, evidence, and
+repeat-close semantics before changing the queue.
+
+Decision: preserve the four-field v1 grant unchanged in a dedicated JSON
+column after strict structural and path-safety validation. A first accepted
+terminal close returns `applied`; an identical repeat by the same claim owner
+returns `reconciled`. Missing rows, wrong owners, expired leases, non-terminal
+states, and different terminal intents receive distinct refusal codes. Legacy
+grant-absent rows remain valid during migration.
+
+## Carry the authoritative repository grant
+
+```task
+id: ACTIVITY-WP-0037-T02
+status: done
+priority: high
+```
+
+Add a typed repository-grant v1 model to rule actions and instructions, reject
+unsupported or unsafe grants during definition parsing and emission preflight,
+and carry the exact field through `ops_runs` and claim/read projections. Add an
+additive migration; do not place the grant in attribution-only
+`execution_refs` or synthesize it from another field.
+
+Completed 2026-09-04. `RepositoryGrant` and `CommitCount` enforce the exact v1
+shape, strict scalar types, local-only publication, bounded commit counts, and
+safe repository-relative patterns. Definition sync and complete-batch emission
+preflight both reject invalid grants. Rule actions copy static grant data
+without rendering it; instructions carry the typed payload. Migration `0010`
+adds nullable `ops_runs.repository_grant`, and claim/read/run projections keep
+it separate from `execution_refs`. Cross-implementation identity tests match
+rein-aharness grant id `af2e7c8275c9ba8c8f78485067f9608e` and acceptance
+policy id `2ed31282d721f4466bc9ea722067d9d0` for the shared fixture.
+
+## Preserve evidence and reconcile terminal closes
+
+```task
+id: ACTIVITY-WP-0037-T03
+status: done
+priority: high
+```
+
+Allowlist bounded repository transaction, grant, acceptance, and external
+metrics identities in queue results. Persist a digest of the accepted terminal
+close intent. Under the row lock, accept an identical repeat by the original
+claim owner as reconciled without requiring a now-cleared lease, while refusing
+different outcomes/actions/flags, wrong owners, expired active claims, and
+unknown rows with distinct API codes. Reopened failures are not terminal and
+must not be mistaken for reconciled delivery.
+
+Completed 2026-09-04. The result allowlist now retains bounded
+`repository_transaction` baseline, grant, acceptance, and external-metrics
+evidence while dropping raw grant patterns and unknown blobs. Migration `0010`
+adds `close_intent_digest`. The row-locked close decision returns `applied` for
+the first accepted mutation and `reconciled` for an exact normalized terminal
+repeat by the same owner. It reports distinct `not_found`, `wrong_owner`,
+`expired_lease`, `state_conflict`, `evidence_conflict`, and
+`terminal_conflict` refusals. Granted completion additionally proves that the
+reported grant and acceptance-policy identities match the queued authority and
+that acceptance is positive. Reopened failures clear close identity and remain
+non-terminal.
+
+## Verify and hand off
+
+```task
+id: ACTIVITY-WP-0037-T04
+status: progress
+priority: high
+```
+
+Run focused and full tests, migration/static checks, update the queue contract,
+sync State Hub, and return the exact revision/schema/repeat semantics to
+rein-aharness. Production rollout and live outbox activation remain separate
+until both repositories consume and deploy the reviewed contract.
+
+Source verification 2026-09-04: 493 tests passed with one live integration test
+skipped; critical Python lint, compilation, and whitespace checks passed.
+Alembic reports one head (`0010`). A throwaway PostgreSQL 16 database passed
+full upgrade, `0010` downgrade to `0009`, column-removal inspection, re-upgrade,
+and type/nullability inspection; it was then removed. Remaining work is the
+exact-revision State Hub handoff and consistency sync.