activity-core/workplans/ACTIVITY-WP-0037-repository-grant-close-reconciliation.md

id	type	title	domain	repo	status	owner	topic_slug	priority	created	updated	related
ACTIVITY-WP-0037	workplan	Carry repository grants and reconcile terminal queue closes	infotech	activity-core	active	codex	activity-core	high	2026-09-04	2026-09-04	ACT-ADR-005 ACT-ADR-006 ACTIVITY-WP-0032 ACTIVITY-WP-0036 REINAH-WP-0003

Carry Repository Grants and Reconcile Terminal Queue Closes

Origin

Rein-aharness enabled its versioned local repository-grant validator and durable close outbox on 2026-09-04, then reported two Activity Core contract gaps:

1. queued/profiled work has no separately typed authoritative repository grant;
2. a response-lost terminal close retry receives the same undifferentiated 409 as a wrong-owner, expired-lease, or conflicting-result mutation, while the result allowlist drops repository transaction and acceptance identity.

These are Activity Core responsibilities at the definition/emission and durable queue boundaries. The grant must not be inferred from task prose, labels, execution_refs, a profile, or repository defaults.

Review and specify the cross-repository contract

id: ACTIVITY-WP-0037-T01
status: done
priority: high

Review rein-aharness repository-grant v1, its close-outbox identity, and exact ADR-002 revision 36e1096. Define compatibility, rejection, evidence, and repeat-close semantics before changing the queue.

Decision: preserve the four-field v1 grant unchanged in a dedicated JSON column after strict structural and path-safety validation. A first accepted terminal close returns applied; an identical repeat by the same claim owner returns reconciled. Missing rows, wrong owners, expired leases, non-terminal states, and different terminal intents receive distinct refusal codes. Legacy grant-absent rows remain valid during migration.

Carry the authoritative repository grant

id: ACTIVITY-WP-0037-T02
status: done
priority: high

Add a typed repository-grant v1 model to rule actions and instructions, reject unsupported or unsafe grants during definition parsing and emission preflight, and carry the exact field through ops_runs and claim/read projections. Add an additive migration; do not place the grant in attribution-only execution_refs or synthesize it from another field.

Completed 2026-09-04. RepositoryGrant and CommitCount enforce the exact v1 shape, strict scalar types, local-only publication, bounded commit counts, and safe repository-relative patterns. Definition sync and complete-batch emission preflight both reject invalid grants. Rule actions copy static grant data without rendering it; instructions carry the typed payload. Migration 0010 adds nullable ops_runs.repository_grant, and claim/read/run projections keep it separate from execution_refs. Cross-implementation identity tests match rein-aharness grant id af2e7c8275c9ba8c8f78485067f9608e and acceptance policy id 2ed31282d721f4466bc9ea722067d9d0 for the shared fixture.

Preserve evidence and reconcile terminal closes

id: ACTIVITY-WP-0037-T03
status: done
priority: high

Allowlist bounded repository transaction, grant, acceptance, and external metrics identities in queue results. Persist a digest of the accepted terminal close intent. Under the row lock, accept an identical repeat by the original claim owner as reconciled without requiring a now-cleared lease, while refusing different outcomes/actions/flags, wrong owners, expired active claims, and unknown rows with distinct API codes. Reopened failures are not terminal and must not be mistaken for reconciled delivery.

Completed 2026-09-04. The result allowlist now retains bounded repository_transaction baseline, grant, acceptance, and external-metrics evidence while dropping raw grant patterns and unknown blobs. Migration 0010 adds close_intent_digest. The row-locked close decision returns applied for the first accepted mutation and reconciled for an exact normalized terminal repeat by the same owner. It reports distinct not_found, wrong_owner, expired_lease, state_conflict, evidence_conflict, and terminal_conflict refusals. Granted completion additionally proves that the reported grant and acceptance-policy identities match the queued authority and that acceptance is positive. Reopened failures clear close identity and remain non-terminal.

Verify and hand off

id: ACTIVITY-WP-0037-T04
status: progress
priority: high

Run focused and full tests, migration/static checks, update the queue contract, sync State Hub, and return the exact revision/schema/repeat semantics to rein-aharness. Production rollout and live outbox activation remain separate until both repositories consume and deploy the reviewed contract.

Source verification 2026-09-04: 493 tests passed with one live integration test skipped; critical Python lint, compilation, and whitespace checks passed. Alembic reports one head (0010). A throwaway PostgreSQL 16 database passed full upgrade, 0010 downgrade to 0009, column-removal inspection, re-upgrade, and type/nullability inspection; it was then removed. Remaining work is the exact-revision State Hub handoff and consistency sync.