diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md index 91abf69e1..248675fbe 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md @@ -31,7 +31,7 @@ change its availability; it may not invent another action or permission. | ActionId | PermissionId | Authority | |---|---|---| -| `artifact.guide_source.ingest` | `artifact.guide_source.ingest` | exact Project Manager project grant | +| `artifact.guide_source.ingest` | `artifact.guide_source.ingest` | covered Project Manager grant | | `artifact.submission_bundle.prepare` | `submission.create` | active assigned contributor | | `submission.create` | `submission.create` | fresh active assigned contributor | | `review.context.read` | `submission.read_for_review` | exact active reviewer lease | diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md index eb4f5719e..32aad2753 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md @@ -12,10 +12,12 @@ scheduler scan, and put-resolver authority are active with hosted artifact coverage at 90.02 percent. - Guide activation is split into `WS-XINT-002-04A` ingest and - `WS-XINT-002-04B` read/binding. 04A cannot implement or activate until - ART-03A is rebased onto the merged opaque PREP interface and merged; the - preserved ART worktree's raw-context/local-authority seam is not activation - evidence. + `WS-XINT-002-04B` read/binding. ART-03A merged through PR #215 at `bb9082a7` + and provides the PREP-compatible guide-ingest seam. Pre-implementation review + for 04A found two required corrections: add the existing ingest permission to + the canonical Project Manager policy, and complete ART-owned final lineage + locking across the project, draft guide, snapshot, and item. The corrected + 04A contract owns those narrow changes before activating guide ingest. This file records only durable merged state and reviewed delivery order. It does not describe a branch as “in progress”, “merge-pending”, or “active”; diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04A-guide-ingest-activation.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04A-guide-ingest-activation.md index 7e5a1fbfb..85dd8794d 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04A-guide-ingest-activation.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04A-guide-ingest-activation.md @@ -23,15 +23,20 @@ L1. ```text backend/app/modules/authorization/catalogue.py backend/app/modules/authorization/kernel.py +backend/app/modules/authorization/policy.py backend/app/modules/authorization/prepared.py backend/app/modules/authorization/repository.py backend/app/modules/authorization/runtime.py backend/app/modules/artifacts/authorization.py +backend/app/modules/artifacts/repository.py +backend/tests/test_audit.py backend/tests/test_authorization.py backend/tests/test_guide_artifacts.py backend/tests/test_artifact_admission.py docs/spec_authorization_service.md docs/spec_artifact_storage_service.md +docs/operations_authorization_service.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-04A-internal-review.md .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-04A-pr-trust-bundle.md .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-04A-external-review-response.md @@ -39,16 +44,23 @@ docs/spec_artifact_storage_service.md ## Not allowed -ART byte/admission implementation, project routes or lifecycle behavior, +ART byte/admission orchestration, project routes or lifecycle transitions, guide binding/read, submission/review behavior, provider redesign, token roles, -generic guide download, new catalogue values, or a second authority protocol. +generic guide download, new action or permission identifiers, or a second +authority protocol. The ART repository change is limited to composing and +locking the already-required project, draft guide, snapshot, and item lineage; +the catalogue change may correct activation custody to `WS-XINT-002-04A`. This contract, the chunk map, and other planning files are not editable by the 04A implementation PR; any required scope change returns to planning review. ## Acceptance criteria -- Initial authority requires the exact active Project Manager grant for the - project and occurs before scratch or request-body byte intake. +- Initial authority requires an active covered Project Manager grant for the + project—system-scoped or exact-project under canonical resource/lifecycle + guards—and occurs before scratch or request-body byte intake. +- The canonical Project Manager role policy grants the existing + `artifact.guide_source.ingest` permission; no other administrative or project + role gains that permission. - Final PREP consumption recomposes and locks actor/link, grant, project, draft guide, snapshot/item, operation identity, request digest, and server-computed digest, byte count, and media type in the caller-owned root transaction. @@ -65,7 +77,7 @@ This contract, the chunk map, and other planning files are not editable by the ```bash (cd backend && .venv/bin/python -m ruff check app tests scripts) -(cd backend && WORKSTREAM_TEST_DATABASE_URL= .venv/bin/pytest tests/test_authorization.py tests/test_guide_artifacts.py tests/test_artifact_admission.py -q --cov=app.modules.authorization --cov=app.modules.artifacts --cov=app.modules.projects --cov-report=term-missing --cov-fail-under=90) +(cd backend && WORKSTREAM_TEST_DATABASE_URL= .venv/bin/pytest tests/test_audit.py tests/test_authorization.py tests/test_guide_artifacts.py tests/test_artifact_admission.py -q --cov=app.modules.authorization --cov=app.modules.artifacts --cov=app.modules.projects --cov-report=term-missing --cov-fail-under=90) python3 scripts/check_stale_authorization_docs.py python3 scripts/check_stale_artifact_contracts.py python3 scripts/check_markdown_links.py