Flow-Research · abiorh-claw · Jul 26, 2026 · Jul 26, 2026 · Jul 26, 2026 · Jul 26, 2026
diff --git a/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md b/.agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md
@@ -1,15 +1,20 @@
 # Status: WS-ENG-008 — Repository-Native SDLC Assurance
 
-- Phase: planning intake review
+- Phase: implementation
 - Active planning chunk: none
-- Active implementation chunk: none
-- Proposed planning merge: `WS-ENG-008-PLAN`
-- Proposed first implementation chunk: `WS-ENG-008-01`
-- Current gate: planning-only artifacts require internal review, exact-head
-  external checks, and explicit human merge approval
+- Active implementation chunk: `WS-ENG-008-01`
+- Completed planning chunk: `WS-ENG-008-PLAN`, merged through PR #196 as
+  `bd2203d5e8a972d8afbf833805b92ed70dedee4a`
+- Current gate: implement and prove the exact signed chunk, complete all nine
+  internal reviewer tracks, then stop for exact-PR human review
 - Original discovery base: `bcf1292e1a591e3e84bf8ee212ee7191d80741fa`
-- Final reconciled main: `a04fd1a0a623b7150ec40c9934a9982f80a2dce7`
-- Final signed-state tip: `33edd1a682ea5fe5ea973870f89bdd3a75a63da3`
-- Concurrent signed state at final reconciliation: REV-03P active; ART stopped
-  at PLAN2, AUTH stopped at 11, and CON stopped at 02A
-- Successor after planning: `WS-ENG-008-01`, separate explicit start required
+- Implementation base: `bd2203d5e8a972d8afbf833805b92ed70dedee4a`
+- Signed start run: `30191914510`; ENG start projection commit `6923f9ed4a8e48327d3aa4d046c8a8dc3a31ea3a`
+- Latest reconciled signed-state tip: `9645fdfcf1f7cfea989612ae656209e311e63388`
+- Concurrent signed state: `WS-REV-001-03P`, `WS-AUTH-001-11A`,
+  `WS-ART-001-03A`, and `WS-ENG-008-01` active in distinct initiatives
+- Publication overlap check: active PR #195 has no path overlap. Stale PR #149
+  overlaps `scripts/check_internal_review_evidence.py` and
+  `scripts/test_agent_gates.py`; it is not active ENG-008 authority and must
+  reconcile independently rather than weaken this cutover.
+- Proposed successor after merge: `WS-ENG-008-02`, separate explicit start required
diff --git a/...ory-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md b/...ory-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md
@@ -33,6 +33,47 @@ P1
 
 `implementation`
 
+## Machine-checkable scope
+
+```chunk-scope-json
+{
+  "schema_version": 1,
+  "chunk_id": "WS-ENG-008-01",
+  "phase": "implementation",
+  "risk_class": "L1",
+  "allowed_paths": [
+    "CONTRIBUTING.md",
+    "AGENTS.md",
+    "README.md",
+    "docs/glossary.md",
+    "docs/architecture_lockdown.md",
+    ".agent-loop/templates/CHUNK_CONTRACT.md",
+    ".agent-loop/policies/repository-engineering-policy.md",
+    ".agent-loop/policies/definition-of-done.md",
+    ".github/workflows/agent-gates.yml",
+    "scripts/check_chunk_contract.py",
+    "scripts/check_internal_review_evidence.py",
+    "scripts/test_check_chunk_contract.py",
+    "scripts/test_agent_gates.py",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-01-machine-checkable-chunk-scope.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-01-internal-review-evidence.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-01-pr-trust-bundle.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-01-external-review-response.md",
+    ".agent-loop/merge-intents/WS-ENG-008-01.json"
+  ],
+  "forbidden_paths": ["backend/**", "frontend/**"],
+  "required_reviewers": ["senior engineering", "qa/test", "security/auth", "product/ops", "architecture", "ci integrity", "docs", "reuse/dedup", "test delta"],
+  "verification_commands": ["chunk-scope-tests", "agent-gate-tests", "internal-review-evidence", "markdown-links", "stale-wording", "git-diff-check"]
+}
+```
+
 ## Allowed files
 
 ```text

diff --git a/...ative-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md b/...ative-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md
@@ -32,6 +32,34 @@ P1
 
 `implementation`
 
+## Machine-checkable scope
+
+```chunk-scope-json
+{
+  "schema_version": 1,
+  "chunk_id": "WS-ENG-008-02",
+  "phase": "implementation",
+  "risk_class": "L1",
+  "allowed_paths": [
+    ".github/workflows/loop-memory-drift-audit.yml",
+    "scripts/audit_loop_memory_drift.py",
+    "scripts/test_audit_loop_memory_drift.py",
+    "scripts/test_agent_gates.py",
+    "docs/operations_post_merge_memory.md",
+    ".agent-loop/policies/repository-engineering-policy.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-02-scheduled-signed-state-drift-audit.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-02-internal-review-evidence.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-02-pr-trust-bundle.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-02-external-review-response.md",
+    ".agent-loop/merge-intents/WS-ENG-008-02.json"
+  ],
+  "forbidden_paths": ["backend/**", "frontend/**"],
+  "required_reviewers": ["senior engineering", "qa/test", "security/auth", "product/ops", "architecture", "ci integrity", "docs", "reuse/dedup", "test delta"],
+  "verification_commands": ["loop-memory-drift-tests", "agent-gate-tests", "markdown-links", "stale-wording", "git-diff-check"]
+}
+```
+
 ## Allowed files
 
 ```text

diff --git a/...ory-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md b/...ory-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md
@@ -32,6 +32,42 @@ P1
 
 `implementation`
 
+## Machine-checkable scope
+
+```chunk-scope-json
+{
+  "schema_version": 1,
+  "chunk_id": "WS-ENG-008-03",
+  "phase": "implementation",
+  "risk_class": "L1",
+  "allowed_paths": [
+    ".agents/skills/risk-router/SKILL.md",
+    ".agents/skills/security-review/SKILL.md",
+    ".agents/skills/qa-review/SKILL.md",
+    ".agents/skills/evidence-gate/SKILL.md",
+    ".agent-loop/templates/CHUNK_CONTRACT.md",
+    ".agent-loop/templates/PR_TRUST_BUNDLE.md",
+    ".agent-loop/templates/ADVERSARIAL_PROOF.md",
+    ".agent-loop/policies/routing-policy.md",
+    ".github/pull_request_template.md",
+    "scripts/check_internal_review_evidence.py",
+    "scripts/test_agent_gates.py",
+    "CONTRIBUTING.md",
+    "AGENTS.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-03-risk-routed-adversarial-proof.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-internal-review-evidence.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-pr-trust-bundle.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-adversarial-proof.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-03-external-review-response.md",
+    ".agent-loop/merge-intents/WS-ENG-008-03.json"
+  ],
+  "forbidden_paths": ["backend/**", "frontend/**"],
+  "required_reviewers": ["senior engineering", "qa/test", "security/auth", "product/ops", "architecture", "ci integrity", "docs", "reuse/dedup", "test delta"],
+  "verification_commands": ["agent-gate-tests", "internal-review-evidence", "markdown-links", "stale-wording", "git-diff-check"]
+}
+```
+
 ## Allowed files
 
 ```text

diff --git a/...y-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md b/...y-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md
@@ -32,6 +32,34 @@ P2
 
 `implementation`
 
+## Machine-checkable scope
+
+```chunk-scope-json
+{
+  "schema_version": 1,
+  "chunk_id": "WS-ENG-008-04",
+  "phase": "implementation",
+  "risk_class": "L1",
+  "allowed_paths": [
+    "scripts/agent-gate-requirements.txt",
+    "scripts/assurance-requirements.txt",
+    "scripts/test_loop_memory_properties.py",
+    "scripts/test_agent_gates.py",
+    ".github/workflows/agent-gates.yml",
+    "docs/operations_post_merge_memory.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-04-loop-memory-property-invariants.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-04-internal-review-evidence.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-04-pr-trust-bundle.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-04-external-review-response.md",
+    ".agent-loop/merge-intents/WS-ENG-008-04.json"
+  ],
+  "forbidden_paths": ["backend/**", "frontend/**"],
+  "required_reviewers": ["senior engineering", "qa/test", "security/auth", "product/ops", "architecture", "ci integrity", "docs", "reuse/dedup", "test delta"],
+  "verification_commands": ["loop-memory-property-tests", "agent-gate-tests", "markdown-links", "stale-wording", "git-diff-check"]
+}
+```
+
 ## Allowed files
 
 ```text

diff --git a/...native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md b/...native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md
@@ -32,6 +32,34 @@ P2
 
 `implementation`
 
+## Machine-checkable scope
+
+```chunk-scope-json
+{
+  "schema_version": 1,
+  "chunk_id": "WS-ENG-008-05",
+  "phase": "implementation",
+  "risk_class": "L1",
+  "allowed_paths": [
+    "backend/pyproject.toml",
+    "backend/tests/test_authorization_properties.py",
+    ".github/workflows/backend.yml",
+    "scripts/assurance-requirements.txt",
+    "docs/operations_authorization_service.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-05-authorization-property-invariants.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-internal-review-evidence.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-pr-trust-bundle.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-adversarial-proof.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-05-external-review-response.md",
+    ".agent-loop/merge-intents/WS-ENG-008-05.json"
+  ],
+  "forbidden_paths": ["backend/app/**", "backend/alembic/**"],
+  "required_reviewers": ["senior engineering", "qa/test", "security/auth", "product/ops", "architecture", "ci integrity", "docs", "reuse/dedup", "test delta"],
+  "verification_commands": ["authorization-property-tests", "authorization-property-lint", "markdown-links", "stale-wording", "git-diff-check"]
+}
+```
+
 ## Allowed files
 
 ```text

diff --git a/...ory-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md b/...ory-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md
@@ -32,6 +32,36 @@ P2
 
 `implementation`
 
+## Machine-checkable scope
+
+```chunk-scope-json
+{
+  "schema_version": 1,
+  "chunk_id": "WS-ENG-008-06",
+  "phase": "implementation",
+  "risk_class": "L1",
+  "allowed_paths": [
+    "backend/pyproject.toml",
+    "backend/scripts/mutation_policy.py",
+    "backend/tests/test_mutation_policy.py",
+    ".github/workflows/backend.yml",
+    "scripts/assurance-requirements.txt",
+    "scripts/test_agent_gates.py",
+    "docs/operations_backend_testing.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-06-changed-module-mutation-pilot.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-internal-review-evidence.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-pr-trust-bundle.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-adversarial-proof.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-06-external-review-response.md",
+    ".agent-loop/merge-intents/WS-ENG-008-06.json"
+  ],
+  "forbidden_paths": ["backend/app/**", "backend/alembic/**"],
+  "required_reviewers": ["senior engineering", "qa/test", "security/auth", "product/ops", "architecture", "ci integrity", "docs", "reuse/dedup", "test delta"],
+  "verification_commands": ["mutation-policy-tests", "mutation-policy-lint", "agent-gate-tests", "markdown-links", "stale-wording", "git-diff-check"]
+}
+```
+
 ## Allowed files
 
 ```text

diff --git a/...tory-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md b/...tory-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md
@@ -36,6 +36,42 @@ Execution remains blocked until this planning intake is merged, chunks 01–06
 are completed in order, and the explicit post-merge signed start selects this
 exact contract from current trusted `main`.
 
+## Machine-checkable scope
+
+```chunk-scope-json
+{
+  "schema_version": 1,
+  "chunk_id": "WS-ENG-008-07",
+  "phase": "implementation",
+  "risk_class": "L1",
+  "allowed_paths": [
+    ".agent-loop/README.md",
+    ".agent-loop/REVIEW_LOG.md",
+    ".agent-loop/review-log-archive/**",
+    ".agent-loop/policies/repository-engineering-policy.md",
+    "scripts/check_review_log_archive.py",
+    "scripts/test_check_review_log_archive.py",
+    "scripts/check_loop_memory_state.py",
+    "scripts/check_stale_artifact_contracts.py",
+    "scripts/check_markdown_links.py",
+    "scripts/check_stale_workstream_wording.py",
+    "scripts/test_agent_gates.py",
+    "AGENTS.md",
+    "CONTRIBUTING.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/STATUS.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/chunks/WS-ENG-008-07-lossless-review-memory-index.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-internal-review-evidence.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-pr-trust-bundle.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-external-review-response.md",
+    ".agent-loop/initiatives/WS-ENG-008-repository-native-sdlc-assurance/reviews/WS-ENG-008-07-pre-migration-reconciliation.json",
+    ".agent-loop/merge-intents/WS-ENG-008-07.json"
+  ],
+  "forbidden_paths": ["backend/**", "frontend/**", ".github/workflows/**"],
+  "required_reviewers": ["senior engineering", "qa/test", "security/auth", "product/ops", "architecture", "ci integrity", "docs", "reuse/dedup", "test delta"],
+  "verification_commands": ["review-log-archive-tests", "review-log-archive-check", "agent-gate-tests", "loop-memory-state", "stale-artifact-contracts", "markdown-links", "stale-wording", "git-diff-check"]
+}
+```
+
 ## Allowed files
 
 ```text

diff --git a/...ository-native-sdlc-assurance/reviews/WS-ENG-008-01-external-review-response.md b/...ository-native-sdlc-assurance/reviews/WS-ENG-008-01-external-review-response.md
@@ -0,0 +1,72 @@
+# External Review Response: WS-ENG-008-01
+
+## Review source
+
+- Pull request: `#203`
+- Source: CodeRabbit
+- Reviewed external head: `55dcad602f705cec7e6798234bdabb911e6683c3`
+- Repaired implementation SHA: `848c6d972eba229478573faddb252eb534f8e5a8`
+
+## Comments addressed
+
+1. Provenance SHA consolidation: corrected the genuinely truncated signed-state
+   commit to `6923f9ed4a8e48327d3aa4d046c8a8dc3a31ea3a` in status and evidence. The
+   reviewed implementation SHA subclaim was dismissed: shell length and
+   `git cat-file` prove `1ef5c3bd0bffedec684ae8b6cec2e6affbcb3b21`
+   was already a resolvable 40-character commit.
+2. Added the exact Ruff invocation to the authoritative Commands Run fence.
+3. Mapped all nine reviewer tracks to the six sessions that performed them.
+4. Replaced hard-coded template phase/risk values with explicit placeholders.
+5. Added all conditional reviewer tracks and alignment guidance to the machine
+   template example, plus a direct-runner regression.
+6. Replaced the negated bootstrap check with a positive marker test and explicit
+   `exit 1` for both trusted scope and evidence bootstrap paths.
+7. Split validator imports from guarded execution so ImportError cannot refer to
+   an unbound `LoopMemoryError`.
+8. Normalized strict UTF-8 failures across contract, projection, tree, merge
+   intent, and authenticated-ledger paths to stable `ContractError` failures.
+9. Materialized both internal evidence code and its scope parser from trusted
+   base after cutover, while an explicit absolute repository-root contract keeps
+   all candidate Git/filesystem reads bound to `${{ github.workspace }}`.
+
+## Comments deferred
+
+None.
+
+## Human decisions needed
+
+None. All valid findings were inside the signed chunk contract. The false
+reviewed-SHA subclaim was resolved from deterministic Git object evidence.
+
+## Internal repair review
+
+- senior engineering: PASS
+- QA/test: PASS
+- security/auth: PASS
+- architecture: PASS WITH LOW RISKS
+- CI integrity: PASS WITH LOW RISKS
+- docs: PASS
+- product/ops: PASS
+- test delta: PASS
+- reuse/dedup: prior PASS WITH LOW RISKS remains applicable; no new reuse blocker
+
+## Commands rerun
+
+```bash
+python3 scripts/check_chunk_contract.py --base-ref origin/main --head-ref HEAD --state-ref origin/automation/loop-memory
+python3 scripts/test_check_chunk_contract.py
+python3 scripts/test_agent_gates.py
+python3 scripts/update_post_merge_memory.py validate-merge-intent --repository-root . --base-ref origin/main
+python3 scripts/check_internal_review_evidence.py
+python3 scripts/check_markdown_links.py
+python3 scripts/check_stale_workstream_wording.py
+ruff check scripts/check_chunk_contract.py scripts/check_internal_review_evidence.py scripts/test_check_chunk_contract.py scripts/test_agent_gates.py
+git diff --check origin/main...HEAD
+```
+
+## Remaining risks
+
+Only the previously accepted Low-risk consolidation opportunities remain:
+duplicated reviewer/intent parsing and explicit trusted dependency lists. They
+do not weaken this gate and require a separate future contract to consolidate.
+