[codex] fix portfolio truth Notion context mapping

[saagpatel]

Summary

• add Notion title aliases for GitHub Repo Auditor, MCP Audit, and Notion operating spellings
• resolve Notion export project mappings through exact and normalized aliases
• guard portfolio truth publishing against silently replacing existing Notion context rows with zero rows

Verification

• uv run pytest tests/test_notion_export.py tests/test_notion_registry.py tests/test_portfolio_truth.py tests/test_project_registry.py -q
• git diff --check HEAD^ HEAD

Notes

• This is the clean follow-up branch containing only the Notion context mapping fix from the preserved local branch, rebased onto current canonical/main.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7294001ba8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use the same Notion config path for the drop guard

When audit is run from outside the source checkout, load_safe_notion_project_context() still queries load_notion_project_context() with its default Path("config") relative to the working directory, but this guard checks _CONFIG_DIR/notion-config.json relative to the package repo. In that context a real config/notion-config.json with projects_data_source_id is ignored here, so a missing token/API response can produce notion_context_rows == 0 and still overwrite a previous nonzero truth snapshot because the guard returns early.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Restore mappings for the active Notion-backed repos

When an audit report includes mcp-trust, cross-provider-egress-guard, or fable-outputs, deleting their entries from notion-project-map.json makes export_notion_events() unable to resolve a localProjectId, so those Audit signals are emitted under unmapped_repos instead of being delivered to Notion. These projects are still declared in config/portfolio-catalog.yaml, so this removal regresses the existing mapping coverage rather than just adding aliases.

Useful? React with 👍 / 👎.