---
id: ACTIVITY-WP-0037
type: workplan
title: "Carry repository grants and reconcile terminal queue closes"
domain: infotech
repo: activity-core
status: active
owner: codex
topic_slug: activity-core
priority: high
created: "2026-09-04"
updated: "2026-09-04"
related:
  - ACT-ADR-005
  - ACT-ADR-006
  - ACTIVITY-WP-0032
  - ACTIVITY-WP-0036
  - REINAH-WP-0003
---

# Carry Repository Grants and Reconcile Terminal Queue Closes

## Origin

Rein-aharness enabled its versioned local repository-grant validator and durable
close outbox on 2026-09-04, then reported two Activity Core contract gaps:

1. queued/profiled work has no separately typed authoritative repository grant;
2. a response-lost terminal close retry receives the same undifferentiated 409
   as a wrong-owner, expired-lease, or conflicting-result mutation, while the
   result allowlist drops repository transaction and acceptance identity.

These are Activity Core responsibilities at the definition/emission and durable
queue boundaries. The grant must not be inferred from task prose, labels,
`execution_refs`, a profile, or repository defaults.

## Review and specify the cross-repository contract

```task
id: ACTIVITY-WP-0037-T01
status: done
priority: high
```

Review rein-aharness repository-grant v1, its close-outbox identity, and exact
ADR-002 revision `36e1096`. Define compatibility, rejection, evidence, and
repeat-close semantics before changing the queue.

Decision: preserve the four-field v1 grant unchanged in a dedicated JSON
column after strict structural and path-safety validation. A first accepted
terminal close returns `applied`; an identical repeat by the same claim owner
returns `reconciled`. Missing rows, wrong owners, expired leases, non-terminal
states, and different terminal intents receive distinct refusal codes. Legacy
grant-absent rows remain valid during migration.

## Carry the authoritative repository grant

```task
id: ACTIVITY-WP-0037-T02
status: done
priority: high
```

Add a typed repository-grant v1 model to rule actions and instructions, reject
unsupported or unsafe grants during definition parsing and emission preflight,
and carry the exact field through `ops_runs` and claim/read projections. Add an
additive migration; do not place the grant in attribution-only
`execution_refs` or synthesize it from another field.

Completed 2026-09-04. `RepositoryGrant` and `CommitCount` enforce the exact v1
shape, strict scalar types, local-only publication, bounded commit counts, and
safe repository-relative patterns. Definition sync and complete-batch emission
preflight both reject invalid grants. Rule actions copy static grant data
without rendering it; instructions carry the typed payload. Migration `0010`
adds nullable `ops_runs.repository_grant`, and claim/read/run projections keep
it separate from `execution_refs`. Cross-implementation identity tests match
rein-aharness grant id `af2e7c8275c9ba8c8f78485067f9608e` and acceptance
policy id `2ed31282d721f4466bc9ea722067d9d0` for the shared fixture.

## Preserve evidence and reconcile terminal closes

```task
id: ACTIVITY-WP-0037-T03
status: done
priority: high
```

Allowlist bounded repository transaction, grant, acceptance, and external
metrics identities in queue results. Persist a digest of the accepted terminal
close intent. Under the row lock, accept an identical repeat by the original
claim owner as reconciled without requiring a now-cleared lease, while refusing
different outcomes/actions/flags, wrong owners, expired active claims, and
unknown rows with distinct API codes. Reopened failures are not terminal and
must not be mistaken for reconciled delivery.

Completed 2026-09-04. The result allowlist now retains bounded
`repository_transaction` baseline, grant, acceptance, and external-metrics
evidence while dropping raw grant patterns and unknown blobs. Migration `0010`
adds `close_intent_digest`. The row-locked close decision returns `applied` for
the first accepted mutation and `reconciled` for an exact normalized terminal
repeat by the same owner. It reports distinct `not_found`, `wrong_owner`,
`expired_lease`, `state_conflict`, `evidence_conflict`, and
`terminal_conflict` refusals. Granted completion additionally proves that the
reported grant and acceptance-policy identities match the queued authority and
that acceptance is positive. Reopened failures clear close identity and remain
non-terminal.

## Verify and hand off

```task
id: ACTIVITY-WP-0037-T04
status: progress
priority: high
```

Run focused and full tests, migration/static checks, update the queue contract,
sync State Hub, and return the exact revision/schema/repeat semantics to
rein-aharness. Production rollout and live outbox activation remain separate
until both repositories consume and deploy the reviewed contract.

Source verification 2026-09-04: 493 tests passed with one live integration test
skipped; critical Python lint, compilation, and whitespace checks passed.
Alembic reports one head (`0010`). A throwaway PostgreSQL 16 database passed
full upgrade, `0010` downgrade to `0009`, column-removal inspection, re-upgrade,
and type/nullability inspection; it was then removed. Remaining work is the
exact-revision State Hub handoff and consistency sync.