docs(xint): correct guide ingest activation contract

.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md

@@ -31,7 +31,7 @@ change its availability; it may not invent another action or permission.
 
 | ActionId | PermissionId | Authority |
 |---|---|---|
-| `artifact.guide_source.ingest` | `artifact.guide_source.ingest` | exact Project Manager project grant |
+| `artifact.guide_source.ingest` | `artifact.guide_source.ingest` | covered Project Manager grant |
 | `artifact.submission_bundle.prepare` | `submission.create` | active assigned contributor |
 | `submission.create` | `submission.create` | fresh active assigned contributor |
 | `review.context.read` | `submission.read_for_review` | exact active reviewer lease |

.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md

@@ -12,10 +12,12 @@
   scheduler scan, and put-resolver authority are active with hosted artifact
   coverage at 90.02 percent.
 - Guide activation is split into `WS-XINT-002-04A` ingest and
-  `WS-XINT-002-04B` read/binding. 04A cannot implement or activate until
-  ART-03A is rebased onto the merged opaque PREP interface and merged; the
-  preserved ART worktree's raw-context/local-authority seam is not activation
-  evidence.
+  `WS-XINT-002-04B` read/binding. ART-03A merged through PR #215 at `bb9082a7`
+  and provides the PREP-compatible guide-ingest seam. Pre-implementation review
+  for 04A found two required corrections: add the existing ingest permission to
+  the canonical Project Manager policy, and complete ART-owned final lineage
+  locking across the project, draft guide, snapshot, and item. The corrected
+  04A contract owns those narrow changes before activating guide ingest.
 
 This file records only durable merged state and reviewed delivery order. It
 does not describe a branch as “in progress”, “merge-pending”, or “active”;

.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04A-guide-ingest-activation.md

@@ -23,32 +23,44 @@ L1.
 ```text
 backend/app/modules/authorization/catalogue.py
 backend/app/modules/authorization/kernel.py
+backend/app/modules/authorization/policy.py
 backend/app/modules/authorization/prepared.py
 backend/app/modules/authorization/repository.py
 backend/app/modules/authorization/runtime.py
 backend/app/modules/artifacts/authorization.py
+backend/app/modules/artifacts/repository.py
+backend/tests/test_audit.py
 backend/tests/test_authorization.py
 backend/tests/test_guide_artifacts.py
 backend/tests/test_artifact_admission.py
 docs/spec_authorization_service.md
 docs/spec_artifact_storage_service.md
+docs/operations_authorization_service.md
+.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md
 .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-04A-internal-review.md
 .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-04A-pr-trust-bundle.md
 .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-04A-external-review-response.md
 ```
 
 ## Not allowed
 
-ART byte/admission implementation, project routes or lifecycle behavior,
+ART byte/admission orchestration, project routes or lifecycle transitions,
 guide binding/read, submission/review behavior, provider redesign, token roles,
-generic guide download, new catalogue values, or a second authority protocol.
+generic guide download, new action or permission identifiers, or a second
+authority protocol. The ART repository change is limited to composing and
+locking the already-required project, draft guide, snapshot, and item lineage;
+the catalogue change may correct activation custody to `WS-XINT-002-04A`.
 This contract, the chunk map, and other planning files are not editable by the
 04A implementation PR; any required scope change returns to planning review.
 
 ## Acceptance criteria
 
-- Initial authority requires the exact active Project Manager grant for the
-  project and occurs before scratch or request-body byte intake.
+- Initial authority requires an active covered Project Manager grant for the
+  project—system-scoped or exact-project under canonical resource/lifecycle
+  guards—and occurs before scratch or request-body byte intake.
+- The canonical Project Manager role policy grants the existing
+  `artifact.guide_source.ingest` permission; no other administrative or project
+  role gains that permission.
 - Final PREP consumption recomposes and locks actor/link, grant, project, draft
   guide, snapshot/item, operation identity, request digest, and server-computed
   digest, byte count, and media type in the caller-owned root transaction.
@@ -65,7 +77,7 @@ This contract, the chunk map, and other planning files are not editable by the
 
 ```bash
 (cd backend && .venv/bin/python -m ruff check app tests scripts)
-(cd backend && WORKSTREAM_TEST_DATABASE_URL=<test-db> .venv/bin/pytest tests/test_authorization.py tests/test_guide_artifacts.py tests/test_artifact_admission.py -q --cov=app.modules.authorization --cov=app.modules.artifacts --cov=app.modules.projects --cov-report=term-missing --cov-fail-under=90)
+(cd backend && WORKSTREAM_TEST_DATABASE_URL=<test-db> .venv/bin/pytest tests/test_audit.py tests/test_authorization.py tests/test_guide_artifacts.py tests/test_artifact_admission.py -q --cov=app.modules.authorization --cov=app.modules.artifacts --cov=app.modules.projects --cov-report=term-missing --cov-fail-under=90)
 python3 scripts/check_stale_authorization_docs.py
 python3 scripts/check_stale_artifact_contracts.py
 python3 scripts/check_markdown_links.py