feat(auth): close prepared artifact boundaries

.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md

@@ -3,7 +3,7 @@
 | Chunk | Purpose | Risk | Dependency |
 |---|---|---|---|
 | `WS-XINT-002-01` | Reconcile the entire ART catalogue, permissions, owners, migration parity, and fixed-service matrix while every new action stays planned. | L1 | approved plan |
-| `WS-XINT-002-02` | Extend PREP with closed feature-owned typed composition contracts and ART lock plans; activate nothing. | L1 | 01 |
+| `WS-XINT-002-02` | Close the reusable PREP-to-ART operation interface: opaque prepared authority on durable mutation requests, no obsolete upload-session port, and no action activation. | L1 | 01 |
 | `WS-XINT-002-03` | Activate verifier, scheduler scan, and put resolver services from merged ART recovery evidence. | L1 | 02 plus ART 02C/02D evidence |
 | `WS-XINT-002-04` | Activate guide ingest, guide binding, and guide read in evidence-ordered substeps. | L1 | 02 plus ART 03A/03B evidence |
 | `WS-XINT-002-05A` | Activate initial contributor bundle preparation and durable ready admission. | L1 | 02 plus ART 04A-C evidence |
@@ -17,3 +17,7 @@
 Chunks 03-07 may be split only by the evidence boundaries named above. A split
 cannot add catalogue values, permissions, identities, matrix rows, or a second
 runtime protocol; such a discovery is contract drift and returns to planning.
+Each activation chunk owns its exact feature resource contexts, non-forgeable
+session/root-bound composer proof, lock order, stale-fact matrix, and crossed
+race tests. Those facts must not be front-loaded into AUTH before the owning
+feature behavior exists.

.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/DECISIONS.md

@@ -20,3 +20,9 @@
    evidence-gated and cannot be eliminated safely.
 9. The simple contribution loop applies: planning does not require a signed
    start/cancel event or merge-intent file.
+10. WS-XINT-002-02 closes the reusable operation interface only. It does not
+    issue production capabilities for planned actions or invent feature facts
+    ahead of merged behavior. Exact session/root-bound feature composers,
+    resource contexts, locks, and race proof belong to chunks 03-07 and 05A-D.
+11. Initiative status records durable merged facts and reviewed delivery order,
+    never transient “active” or “merge-pending” branch state.

.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md

@@ -6,7 +6,9 @@ Deliver the dependency in two front-loaded AUTH foundations followed by thin,
 evidence-gated activation waves:
 
 1. Reconcile the complete v0.1 catalogue and static service matrix once.
-2. Extend PREP once with closed typed feature integration contracts.
+2. Close the PREP-to-ART operation interface once: durable mutation requests
+   carry opaque prepared authority, while exact feature contexts remain with
+   their evidence-backed activation chunks.
 3. Activate fixed internal recovery services before any durable provider work.
 4. Activate guide ingest/use only after the matching hidden ART behavior.
 5. Activate initial contributor preparation, then atomic Submission/binding
@@ -62,7 +64,7 @@ initial submission; checker remediation rooted in the exact final
 `needs_revision` CheckerRun; and human-review revision rooted in the exact
 revision obligation. Checker remediation records the server-derived
 `remediation_source_checker_run_id`, immediate same-task predecessor, existing
-locked task context, and current `allow_review`; it has no ReviewFinding
+locked task context; it has no inherited `allow_review`, ReviewFinding
 response, revision preparation, human revision deadline/round consumption,
 reviewer contribution, or synthetic human actor.
 
@@ -85,9 +87,13 @@ replaced-transaction, revoked, stale, or already consumed handles deny.
 ## Ownership rule
 
 AUTH evaluates authority but does not load feature rows or encode product
-lifecycle. Feature modules expose closed typed composers/loaders and own their
-locks and invariants. ART orchestrates bytes and receives only opaque prepared
-handles plus typed decisions; it never imports AUTH repositories.
+lifecycle. Chunk 02 closes durable ART mutation ports around the existing
+opaque prepared handle and removes the obsolete upload-session interface.
+Each activation chunk then defines its closed typed composer/loader in the
+owning feature module, binds its proof to the same session and root
+transaction, and owns its locks and invariants. ART orchestrates bytes and
+receives only opaque prepared handles plus typed decisions; it never imports
+AUTH repositories.
 
 ## Verification
 

.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md

@@ -1,9 +1,16 @@
 # Status: WS-XINT-002 ART-AUTH End-to-End Contract
 
-`WS-XINT-002-01` is implemented and merge-pending. It reconciles the closed ART
-catalogue and fixed-service matrix without activating any action, evaluator,
-route, command, grant, or lifecycle behavior. The dirty ART-03A worktree remains
-preserved and untouched.
+## Durable completed state
 
-Next same-initiative gate after merge and a new explicit start:
-`WS-XINT-002-02`.
+- `WS-XINT-002-PLAN` is merged.
+- `WS-XINT-002-01` is merged on `main` at merge commit `89956cff`; the closed
+  ART catalogue and fixed-service matrix are reconciled without activating any
+  new action.
+
+This file records only durable merged state and reviewed delivery order. It
+does not describe a branch as “in progress”, “merge-pending”, or “active”;
+GitHub branches and pull requests are the source of truth for transient work.
+That rule prevents a merged PR from carrying stale pre-merge prose onto
+`main`. The durable successor order remains in `CHUNK_MAP.md`; this status file
+does not duplicate a transient “next chunk” pointer that becomes stale at
+merge.

.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-02-prepared-feature-boundaries.md

@@ -1,9 +1,19 @@
-# Chunk Contract: WS-XINT-002-02 Prepared Feature Boundaries
+# Chunk Contract: WS-XINT-002-02 Prepared Operation Boundaries
 
 ## Goal
 
-Extend the existing opaque transaction-local PREP protocol once for all durable
-ART boundaries using closed typed feature-owned composition contracts.
+Close the reusable PREP-to-ART operation interface without activating an ART
+action or pretending that unmerged feature rows can already be composed.
+
+This chunk preserves the existing opaque transaction-local PREP mechanism,
+removes the obsolete upload-session interface, and makes every declared
+durable ART mutation request carry opaque prepared authority instead of a raw
+request authentication context. Exact feature-owned row composers and final
+resource contexts remain owned by their evidence-backed activation chunks.
+
+## Base
+
+Reviewed against `main` merge commit `89956cff`.
 
 ## Risk class
 
@@ -12,75 +22,99 @@ L1.
 ## Allowed files
 
 ```text
-backend/app/modules/authorization/kernel.py
 backend/app/modules/authorization/prepared.py
-backend/app/modules/authorization/runtime.py
-backend/app/modules/authorization/repository.py
 backend/app/interfaces/artifact_operations.py
-backend/app/modules/artifacts/authorization.py
 backend/tests/test_authorization.py
-backend/tests/test_auth.py
-backend/tests/test_artifact_authorization.py
+backend/tests/test_artifact_architecture.py
 docs/spec_authorization_service.md
 docs/spec_artifact_storage_service.md
+.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md
+.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md
+.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/DECISIONS.md
 .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md
 .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-02-prepared-feature-boundaries.md
 .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-02-*.md
 ```
 
 ## Not allowed
 
-- action activation or catalogue/migration changes;
+- action activation, catalogue, migration, evaluator, kernel, repository,
+  route, command, provider, durable-write, or product-lifecycle changes;
 - feature repository imports in AUTH, caller callbacks, open dictionaries,
-  generic service locators, or a second capability implementation;
-- provider I/O, ART durable writes, or product lifecycle mutation.
+  generic service locators, caller-asserted feature facts, or a second
+  capability implementation;
+- production handle issuance for a planned ART action;
+- defining task, assignment, CheckerRun, review lease, finding/response,
+  predecessor, revision-obligation, or advancement-fence truth before its
+  owning feature chunk merges.
+
+## Closed interface changes
+
+- Remove `ContributorArtifactUploadPort` and every upload-session request from
+  the live interface; there is no compatibility alias.
+- Add `SubmissionBundlePreparationPort.prepare` with one closed
+  `SubmissionBundlePreparationRequest` for the outer ZIP.
+- Replace `ReadyUploadSetRequest` with process-local
+  `PreparedBundleMaterializationRequest`.
+- Guide ingest, submission preparation, verified binding, prepared-bundle and
+  binding materialization, and checker-output write requests carry an exact
+  `PreparedAuthorizationHandle`; they do not accept `AuthorizationContext` as
+  mutation authority.
+- Each typed mutation method maps to one closed expected `ActionId`; guide,
+  submission, and checker-output binding use separate request types with their
+  exact owning selectors. Requests carry no caller-selected action, generic
+  resource selector, or facts map.
+- Operator read/recovery requests remain unchanged; their existing bounded
+  authorization path is outside this durable mutation interface cut.
+- Review-packet materialization and review-evidence binding are intentionally
+  deferred to WS-XINT-002-07. They require merged REV lease/evidence-slot facts
+  and will extend the same typed prepared-operation convention without adding a
+  second capability protocol or a generic materialization/binding escape hatch.
 
 ## Acceptance criteria
 
-- Define closed typed contexts and authority plans for guide ingest, submission
-  preparation/create, artifact binding, checker materialization/output, review
-  packet, and review evidence binding.
-- Preserve exact service/session/root-transaction/action/actor/scope/key/digest
-  binding, opacity, non-copyability, non-serialization, and single use.
-- Human plans lock exact actor/link plus effective project grant/assignment;
-  service plans lock exact profile/link and validate immutable identity, matrix,
-  and availability.
-- Feature modules own row loading/locking and final context composition through
-  typed ports; AUTH owns no feature repository and accepts no caller assertion
-  as authority.
-- Initial, checker-remediation, and human-review revision contexts are closed
-  variants. Checker remediation binds the final `needs_revision` CheckerRun,
-  server-derived remediation source, immediate predecessor, locked task context,
-  and current `allow_review`, without human-review facts. Revision binds exact
-  predecessor, preparation head/digest, obligation/findings/responses,
-  replacement assignment, limits, deadline, and advancement fence.
-- Consume stages one final decision in the caller transaction; denial and any
-  participant failure roll back with no reusable handle. The service-local
-  issuance registry burns the handle before evaluation outside database
-  rollback semantics; denial, evidence failure, participant failure, caller
-  rollback, timeout, or cancellation cannot restore it.
-- PostgreSQL tests cover revoke/suspend, wrong action/resource/session/service,
-  replay/concurrent consume, transaction replacement, stale feature facts, and
-  evidence failure. Each rollback class retries the identical handle and proves
-  rejection before authority evaluation, evidence, or participant mutation.
-- No planned ART action becomes executable in this chunk.
+- Existing PREP remains bound to the exact service instance, session, root
+  transaction, action, actor, scope, idempotency key, and canonical request
+  digest; handles remain opaque, non-copyable, non-serializable, and single-use.
+- Production `prepare()` issues no handle or evidence for every planned ART
+  action in this chunk. Matrix membership is checked first: a wrong fixed
+  service receives `permission_not_granted`; the owning fixed service reaches
+  planned availability and receives `action_unavailable`.
+- Denial, evidence failure, participant failure, caller rollback, commit
+  failure, timeout, or cancellation burns an issued handle outside database
+  rollback semantics. Existing failure tests must retry the identical handle
+  and prove rejection before a second kernel evaluation or evidence attempt.
+- The declared durable ART mutation ports contain no `AuthorizationContext`,
+  upload-session method, upload-session identifier, or caller-selected generic
+  resource/facts mapping.
+- Static tests prove the exact exported interface names and reject reintroduced
+  raw-context or upload-session authority paths.
+- `PreparedAuthorizationHandle` appears only on process-local, non-Pydantic ART
+  mutation request objects. Static tests reject it in route schemas, outbox or
+  Celery payloads, provider interfaces, and any serializable public contract.
+- Exact final contexts and non-forgeable feature proofs are deliberately not
+  invented here. Chunks 03-07 and 05A-D must define them in the owning feature
+  modules, bind them to the same session/root transaction, lock their exact
+  rows, and test stale/cross-session/cross-root/direct-construction bypasses
+  before the corresponding action is activated.
+- No planned ART action becomes executable.
 
 ## Verification
 
 ```bash
 (cd backend && .venv/bin/python -m ruff check app tests scripts)
-(cd backend && WORKSTREAM_TEST_DATABASE_URL=<test-db> .venv/bin/pytest tests/test_authorization.py tests/test_auth.py tests/test_artifact_authorization.py -q --cov=app.modules.authorization --cov-report=term-missing --cov-fail-under=90)
+(cd backend && WORKSTREAM_TEST_DATABASE_URL=<postgres-test-db> .venv/bin/pytest tests/test_authorization.py tests/test_artifact_architecture.py -q --cov=app.modules.authorization.prepared --cov-report=term-missing --cov-fail-under=90)
 python3 scripts/check_markdown_links.py
 python3 scripts/check_stale_authorization_docs.py
 python3 scripts/check_stale_artifact_contracts.py
+python3 scripts/check_stale_workstream_wording.py
 git diff --check
 ```
 
-The exact PR head must pass GitHub checks `Backend / test` and
-`Agent Gates / agent-gates`, preserving the 78 percent global and 90 percent
-materially changed subsystem coverage floors.
-
-Full backend coverage runs in GitHub Actions.
+The focused coverage command measures the materially changed PREP subsystem;
+it must remain at or above 90 percent. The exact PR head must also pass GitHub
+checks `Backend / test` and `Agent Gates / agent-gates`, preserving the 78
+percent repository-wide floor. Full backend coverage runs in GitHub Actions.
 
 ## Required reviewers
 
@@ -89,5 +123,6 @@ integrity, docs, reuse/dedup, and test delta.
 
 ## Human review focus
 
-No feature truth in AUTH, no caller-asserted authority, exact lock order, and
-atomic evidence/mutation semantics.
+No raw authentication context as durable mutation authority, no obsolete
+upload-session interface, no planned-action handle, and no premature feature
+truth in AUTH.

.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-02-external-review-response.md

@@ -0,0 +1,39 @@
+# WS-XINT-002-02 External Review Response
+
+Date: 2026-07-27
+
+## Comments addressed
+
+- CodeRabbit correctly observed that the exhaustive
+  `PreparedBundleMaterializationRequest` prose omitted its task and assignment
+  selectors. The spec now names both fields.
+
+## Comments deferred
+
+- CodeRabbit's generic docstring-coverage warning is not actionable: the exact
+  hosted repository Docstring Coverage step passed before the Backend job
+  reached semantic tests. No coverage threshold or unrelated docstring was
+  changed.
+
+## GitHub checks
+
+- Agent Gates: passed.
+- Backend first run: one pre-existing PostgreSQL lock-observation test timed out
+  under four-lane load after the other 1,596 shared-foundation tests passed.
+  The evidence validator failed closed and interrupted the remaining lanes.
+  Reruns use the same exact PR head without changing a gate. GitHub checks,
+  rather than committed prose, own transient rerun and merge-readiness state.
+
+## Human decisions needed
+
+None.
+
+## Commands rerun
+
+- Markdown link and stale documentation checks after the CodeRabbit fix.
+- GitHub Backend failed-job rerun on the exact PR head.
+
+## Remaining risks
+
+The PR's exact-head Backend and Agent Gates checks must pass before merge; their
+live state remains in GitHub and is not duplicated in this durable record.

.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-02-internal-review.md

@@ -0,0 +1,48 @@
+# WS-XINT-002-02 Internal Review
+
+Date: 2026-07-27
+
+## Evidence gate
+
+PASS.
+
+- Scope: 10 implementation/planning/spec files inside the chunk contract before
+  this review record; no workflow, dependency, migration, evaluator, route,
+  provider, or durable-write change.
+- Ruff: `ruff check app tests scripts` passed.
+- PostgreSQL: 364 authorization/architecture tests passed; PREP coverage was
+  98.32 percent. The final reviewer-driven rollback assertions then passed the
+  isolated PostgreSQL atomicity test again.
+- Architecture: all 11 artifact architecture tests passed after final changes.
+- Documentation: markdown links and stale authorization, artifact-contract,
+  and Workstream-wording checks passed.
+- Integrity: no skipped tests, lowered thresholds, CI bypass, or new dependency.
+  GitHub owns the full repository coverage run at the exact PR head.
+
+## Reviewer results
+
+- Senior engineering: PASS after module-router and complete signature leak
+  guards were added.
+- Architecture: PASS after provider-interface coverage and action-specific
+  guide/submission/checker binding requests replaced the generic request.
+- QA/test: PASS after wrong-service ordering and rollback no-reentry proof were
+  completed.
+- Security/auth: PASS; planned actions issue no handle or evidence, and matrix
+  denial precedes planned availability.
+- Product/ops: PASS after exact guide setup-generation ownership and the
+  unchanged Operator recovery boundary were made explicit.
+- CI integrity: PASS; hosted 78 percent global and 90 percent subsystem gates
+  remain unchanged.
+- Docs: PASS after stale binding names and premature review lookup vocabulary
+  were corrected.
+- Test delta: PASS after every failure/cancellation retry used the zero-reentry
+  helper and mutation protocols rejected parameter escape hatches.
+- Reuse/dedup: PASS WITH LOW RISK. The older single-action planned-denial test
+  overlaps the new exhaustive parametrized test. It remains as a focused
+  regression for row refresh; no production duplication or second protocol
+  exists.
+
+## Findings resolved
+
+All High and Medium findings were fixed and re-reviewed. No blocking finding
+remains.