feat(mgtp): implement evaluate_transition, DecisionRecord, and canonical serialization

[Copilot]

The mgtp package was scaffolded but missing its core evaluation logic — no evaluate_transition function, no DecisionRecord type, and no canonical serialization. This PR wires up the MGTP core so all PR invariant checks pass.

Changes

mgtp/types.py

• Added DecisionRecord frozen dataclass with fields: transition_id, outcome, authority_basis, risk_class, reason
• to_canonical_json() emits compact, key-sorted UTF-8 JSON: sort_keys=True, separators=(",", ":")

mgtp/evaluate.py (new)

• Pure evaluate_transition(request, context, registry) -> DecisionRecord
• No I/O, no clock, no randomness, no state mutation
• Delegates authority check to the existing AuthorityGate primitive

from mgtp.evaluate import evaluate_transition
from mgtp.types import AuthorityContext, RiskClass, TransitionRequest

record = evaluate_transition(
    request=TransitionRequest(
        transition_id="TOOL_CALL_HTTP",
        risk_class=RiskClass.HIGH,
        irreversible=True,
        resource_identifier="https://example.com",
        trust_boundary_crossed=True,
        override_token=None,
        timestamp="2026-02-28T12:00:00Z",
    ),
    context=AuthorityContext(actor_id="alice", authority_basis="OWNER", tenant_id="t1"),
    registry={"TOOL_CALL_HTTP": {"required_authority": "OWNER"}},
)
# record.outcome == TransitionOutcome.APPROVED
# record.to_canonical_json() == b'{"authority_basis":"OWNER","outcome":"APPROVED",...}'

tests/test_mgtp_evaluate.py (new)

• Covers APPROVED / REFUSED (insufficient authority) / REFUSED (unregistered transition)
• Validates DecisionRecord immutability and canonical JSON properties (sorted keys, no whitespace, determinism)

.gitignore (new)

• Excludes __pycache__, *.pyc, .pytest_cache

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.