WS-XINT-003-02A: enforce immutable policy identity lineage

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-12D2-guide-bound-policy-mutations.md

@@ -15,22 +15,27 @@ Add separately authorized routes for review and revision policy records after
 
 This contract is reconciled with REV-03P by WS-XINT-003-01. REV owns the
 immutable/versioned policy semantics; AUTH owns the mutation authorization,
-PREP consumption, and decision evidence. Chunk WS-XINT-003-02 implements the
-single path below; neither parent contract may build an alternate writer.
+PREP consumption, and decision evidence. WS-XINT-003-02A first installs exact
+immutable policy identity and downstream lineage without activation; 02B then
+implements the single writer path below. Neither parent contract may build an
+alternate writer.
 
 ## One writer path
 
 - Surviving API: separate `PUT /projects/{project_id}/review-policy` and
-  `PUT /projects/{project_id}/revision-policy` routes in
-  `backend/app/modules/projects/router.py`, each declaring its exact primary
-  ActionId.
+  `PUT /projects/{project_id}/revision-policy` routes in the dedicated
+  `backend/app/modules/projects/policy_mutation_router.py`, registered once by
+  `backend/app/api/router.py`, each declaring its exact primary ActionId. This
+  follows the project-create and guide-mutation router boundary on current main.
 - Surviving service: new `ProjectPolicyMutationService` methods
   `replace_review_policy()` and `replace_revision_policy()`.
 - Surviving repository: new append-only
   `ProjectRepository.add_review_policy_version()` and
   `ProjectRepository.add_revision_policy_version()` methods over the existing
   `ReviewPolicy` and `RevisionPolicy` tables/models, upgraded as necessary for
   immutable version provenance.
+- A separate `PolicyMutationReplayRepository` may own only the idempotency
+  ledger. It must not read or write either policy table.
 - Retired callable mutators: `ProjectRepository.upsert_review_policy()`,
   `ProjectRepository.upsert_revision_policy()`,
   `ProjectService._review_policy_model()`, and

.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-03P-review-revision-policy-persistence.md

@@ -2,7 +2,7 @@
 
 ## Status
 
-Reconciled planning input to `WS-XINT-003-02`. It is not an independent
+Reconciled planning input to `WS-XINT-003-02A` and `02B`. It is not an independent
 implementation path.
 
 ## Goal
@@ -12,7 +12,8 @@ later routing, lease, decision, and human revision behavior.
 
 REV owns field semantics, version identity, draft/active immutability, and the
 facts later lifecycle code consumes. AUTH-12D2 owns authority, PREP, evidence,
-and the only mutation surface. The shared implementation is XINT-003-02.
+and the only mutation surface. XINT-003-02A owns immutable identity/lineage;
+02B owns the shared mutation activation.
 
 ## Canonical persistence path
 
@@ -41,7 +42,7 @@ L1: policy immutability, duration/limit semantics, and later decision authority.
 
 The exact current-main project models, migration, policy schemas, canonical
 writer service/repository, AUTH PREP integration, focused tests, and initiative
-evidence must be fixed in the refreshed XINT-003-02 contract.
+evidence must be fixed in the refreshed XINT-003-02A/02B contracts.
 
 ## Not allowed
 
@@ -78,4 +79,4 @@ reuse/dedup, docs, test-delta, and CI integrity.
 ## Stop
 
 Do not implement this parent contract independently. Refresh and implement only
-WS-XINT-003-02 after an explicit user request.
+WS-XINT-003-02A/02B after an explicit user request.

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/ACTION_CUSTODY.md

@@ -6,8 +6,8 @@ This table is the planning source of truth for the v0.1 review and human-revisio
 
 | ActionId | PermissionId | Principal and scope | Resource family | Surface owner | State | Activation wave |
 |---|---|---|---|---|---|---|
-| `project.review_policy.update` | `project.review_policy.manage` | Project Manager grant for exact project | draft guide + ReviewPolicy version | project/REV semantics; AUTH mutation | registered planned | `WS-XINT-003-02` |
-| `project.revision_policy.update` | `project.review_policy.manage` | Project Manager grant for exact project | draft guide + RevisionPolicy version | project/REV semantics; AUTH mutation | registered planned | `WS-XINT-003-02` |
+| `project.review_policy.update` | `project.review_policy.manage` | Project Manager grant for exact project | draft guide + ReviewPolicy version | project/REV semantics; AUTH mutation | registered planned | `WS-XINT-003-02B` after 02A lineage |
+| `project.revision_policy.update` | `project.review_policy.manage` | Project Manager grant for exact project | draft guide + RevisionPolicy version | project/REV semantics; AUTH mutation | registered planned | `WS-XINT-003-02B` after 02A lineage |
 | `review.queue.read` | `review.queue.read` | reviewer grant; exact project; self-review denied | concealed current-work view | REV | registered planned | `WS-XINT-003-03A` |
 | `review.claim` | `review.claim` | reviewer grant; exact project; self-review denied | queue entry + global reviewer lease state | REV | registered planned | `WS-XINT-003-03A` |
 | `review.release` | `review.release` | owning reviewer and active lease | ReviewLease | REV | registered planned | `WS-XINT-003-03A` |
@@ -64,8 +64,8 @@ These actions are not XINT-003 custody. Generic artifact download, adjudication,
 
 | ActionId | Exact prerequisite behavior/manifest |
 |---|---|
-| `project.review_policy.update` | existing policy records plus refreshed REV-03P/AUTH-12D2 contract; implemented only by `WS-XINT-003-02` |
-| `project.revision_policy.update` | existing policy records plus refreshed REV-03P/AUTH-12D2 contract; implemented only by `WS-XINT-003-02` |
+| `project.review_policy.update` | 02A immutable identity/lineage plus refreshed REV-03P/AUTH-12D2; activated only by `WS-XINT-003-02B` |
+| `project.revision_policy.update` | 02A immutable identity/lineage plus refreshed REV-03P/AUTH-12D2; activated only by `WS-XINT-003-02B` |
 | `review.queue.read` | merged hidden REV-05 concealed current-work view |
 | `review.claim` | merged hidden REV-05 queue admission and REV-06 atomic lease behavior |
 | `review.release` | merged hidden REV-06 lease release behavior |

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/CHUNK_MAP.md

@@ -3,8 +3,9 @@
 | Chunk | Purpose | Risk | Dependency |
 |---|---|---|---|
 | `WS-XINT-003-01` | Reconcile policy ownership, complete REV catalogue, permissions, surfaces, resource families, and fixed-service matrix while actions stay planned. | L1 | approved plan |
-| `WS-XINT-003-02` | Join REV policy semantics/persistence to AUTH-12D2 prepared policy mutation cutover and remove duplicate writer paths. | L1 | 01 plus refreshed REV-03P/AUTH-12D2 |
-| `WS-XINT-003-03A` | Activate concealed reviewer current-work plus claim/release/preference with exact project grant, self-review denial, global lease limit, and atomic lease/packet-manifest freeze. | L1 | 02 plus hidden REV queue/lease behavior |
+| `WS-XINT-003-02A` | Cut policy persistence and Task/Submission/Checker locks from guide-version aliases to immutable policy-version identity; activate nothing. | L1 | 01 plus refreshed REV-03P/AUTH-12D2 |
+| `WS-XINT-003-02B` | Activate the sole review/revision policy mutation service through AUTH PREP after immutable lineage exists. | L1 | merged 02A |
+| `WS-XINT-003-03A` | Activate concealed reviewer current-work plus claim/release/preference with exact project grant, self-review denial, global lease limit, and atomic lease/packet-manifest freeze. | L1 | 02B plus hidden REV queue/lease behavior |
 | `WS-XINT-003-03B` | Activate preference and lease expiry fixed services only. | L1 | 03A plus hidden timer behavior |
 | `WS-XINT-003-04` | Activate human `review.context.read` and reviewer finding evidence while consuming XINT-002-07A's ART-only packet/materialization/binding capability. | L1 | 03B plus hidden REV packet/evidence manifests and XINT-002-07A |
 | `WS-XINT-003-05` | Activate only bounded `review.chain.read`, consuming the active REV context and XINT-002 packet/materialization boundary. | L1 | 04 plus merged XINT-002-07A |
@@ -13,9 +14,9 @@
 | `WS-XINT-003-08R` | Register four missing privileged recovery/lifecycle ActionIds as planned with complete catalogue/migration parity; activate nothing. | L1 | 07 plus exact hidden-feature registration manifests |
 | `WS-XINT-003-08A` | Activate Project Manager and Operator queue/revision recovery commands with exact scope and reasons. | L1 | 08R plus hidden REV recovery behavior |
 | `WS-XINT-003-08B` | Activate both identities for the single `review.reconcile.run` ActionId together, plus artifact-reference, projection, and lifecycle-control surfaces. | L1 | 08A plus hidden REV jobs/projection/control |
-| `WS-XINT-003-09` | Prove end-to-end least privilege, revocation, replay, concurrency, atomicity, artifact isolation, and coherent route release. | L1 | 02-08B |
+| `WS-XINT-003-09` | Prove end-to-end least privilege, revocation, replay, concurrency, atomicity, artifact isolation, and coherent route release. | L1 | 02A-08B |
 
-Chunks 02 through 09 are planning skeletons, not implementation-ready contracts,
+Chunks 02A through 09 are planning skeletons, not implementation-ready contracts,
 until refreshed on current main with exact allowed files and commands. Each row
 maps to one PR unless its current-main contract is split into smaller
 children before implementation. A split cannot add a new permission, action,

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md

@@ -7,8 +7,10 @@ activation waves:
 
 1. Reconcile policy ownership, the complete catalogue, permissions, principal
    classes, fixed-service matrix, surface manifests, and planned availability.
-2. Cut over review/revision policy configuration through one persistence path:
-   REV owns semantics; AUTH-12D2 owns authorization and PREP consumption.
+2. First cut policy persistence and every downstream lock to immutable policy
+   identity in 02A without runtime activation. Then cut over review/revision
+   policy configuration through one persistence path in 02B: REV owns
+   semantics; AUTH-12D2 owns authorization and PREP consumption.
 3. Activate concealed reviewer current-work, claim/release/preference, and timer
    services only after REV queue/lease behavior exists.
 4. Amend XINT-002-07 into two ART-only owner waves: 07A is the only ActionId
@@ -106,7 +108,7 @@ hidden behavior are rejected.
 ## Stop boundary
 
 This planning amendment creates no runtime code and activates no action. Chunks
-02 through 09 are non-implementable planning skeletons until a current-main
+02A through 09 are non-implementable planning skeletons until a current-main
 refresh replaces every file/command placeholder with exact boundaries and the
 user explicitly requests that chunk. Planning complete does not start runtime
 work.

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/REVIEW_LOG.md

@@ -64,3 +64,20 @@ findings corrected fixed-service identity drift, ART global-matrix wording,
 runtime owner versus sub-wave ambiguity, missing per-action dependencies,
 07B/human activation order, and obsolete signed-start gates. All tracks passed;
 the final evidence is in `reviews/WS-XINT-003-01-internal-review.md`.
+
+## WS-XINT-003-02A immutable policy identity and lineage
+
+Architecture, security/auth, product/operations, QA/test, senior engineering,
+reuse/dedup, docs, test-delta, and CI integrity reviewed the completed runtime
+chunk. Valid findings corrected guide-selection freezing and exact joins,
+CheckerRun-to-Submission Task binding, stale active E2E/docs surfaces, vacuous
+legacy assertions, asymmetric immutability proof, and the final schema
+fingerprint. All tracks passed after correction; no finding remains open. The
+final evidence is in `reviews/WS-XINT-003-02A-internal-review.md`.
+
+CodeRabbit's PR #242 review found missing ORM identity-shape metadata, overly
+broad joined row locks, invalid active-guide fixture ordering, and a duplicated
+test semantics mapping. Its post-main-merge review also found that the guide
+sufficiency migration test did not protect cleanup when the initial downgrade
+failed. All findings were valid and corrected; the exact response is in
+`reviews/WS-XINT-003-02A-external-review-response.md`.

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/STATUS.md

@@ -2,8 +2,9 @@
 
 ## Current status
 
-WS-XINT-003-01 contract reconciliation is complete and awaiting human
-review/merge. No runtime code or action availability is changed.
+WS-XINT-003-01 is merged. WS-XINT-003-02A immutable policy identity and
+downstream lineage is implemented on its bounded branch and has passed final
+internal review. No policy mutation action or public surface is activated.
 
 ## Baseline
 
@@ -28,7 +29,20 @@ REV-owned semantics with AUTH-owned mutation authorization.
 - All registered review actions remain planned; four lifecycle/recovery actions
   remain missing until 08R; no service identity is provisioned by chunk 01.
 
+## WS-XINT-003-02A implementation
+
+- ReviewPolicy and RevisionPolicy are append-only identities with generation,
+  canonical digest, semantics status, and predecessor lineage.
+- ProjectGuide selects exact policy identities; Task locks them, and Submission
+  and CheckerRun copy and foreign-key chain the same immutable facts.
+- Historical rows become readable `legacy_incomplete` records and fail the
+  canonical readiness predicate. No preference or lease meaning is inferred.
+- PostgreSQL rejects update, delete, truncate, cross-project/guide lineage, and
+  unsafe populated downgrade.
+- Focused migration, activation, task, submission/checker, digest, and coverage
+  proof is green. Repository-wide coverage remains assigned to hosted CI.
+
 ## Next step
 
-Keep hosted exact-head gates green, resolve all external review, and obtain
-human merge. Then stop before runtime policy work in WS-XINT-003-02.
+Open the 02A PR, run exact-head hosted CI and CodeRabbit, obtain human merge,
+and stop. WS-XINT-003-02B requires a new explicit user start after 02A merges.

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-02-policy-mutation-activation.md

@@ -2,9 +2,11 @@
 
 ## Status
 
-Non-implementable planning skeleton after 01. Before implementation, refresh on
-current main with exact allowed files and commands, then require an explicit
-user request for this chunk.
+Superseded before implementation by `WS-XINT-003-02A` and
+`WS-XINT-003-02B`. Current-main plan review proved that immutable policy
+versions cannot be introduced safely while Task, Submission, and CheckerRun
+still use guide version as policy identity. This record is retained only as the
+rejected combined design input and is not an implementation path.
 
 ## Goal
 
@@ -17,9 +19,51 @@ L1 policy and authorization mutation.
 
 ## Allowed files
 
-Must be enumerated exactly at current-main start. Only policy-owned project/REV
-models, repository/service/routes, AUTH typed contexts/catalogue parity,
-migration, focused tests, docs, and this initiative's evidence may be included.
+```text
+backend/app/api/router.py
+backend/app/modules/projects/models.py
+backend/app/modules/projects/repository.py
+backend/app/modules/projects/schemas.py
+backend/app/modules/projects/service.py
+backend/app/modules/projects/policy_mutation_replay_repository.py
+backend/app/modules/projects/policy_mutation_service.py
+backend/app/modules/projects/policy_mutation_router.py
+backend/app/modules/authorization/catalogue.py
+backend/app/modules/authorization/kernel.py
+backend/app/modules/authorization/prepared.py
+backend/app/modules/authorization/runtime.py
+backend/alembic/versions/0046_review_revision_policy_authority.py
+backend/tests/test_authorization.py
+backend/tests/test_project_policy_mutations.py
+backend/tests/test_projects.py
+backend/tests/test_alembic.py
+backend/scripts/api_contract_e2e.py
+docs/spec_authorization_service.md
+docs/spec_review_lifecycle.md
+.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-12D2-guide-bound-policy-mutations.md
+.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-03P-review-revision-policy-persistence.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/STATUS.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/REVIEW_LOG.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-02-policy-mutation-activation.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-02-preimplementation-review.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-02-internal-review.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-02-pr-trust-bundle.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-02-external-review-response.md
+```
+
+The dedicated policy mutation router/service and replay-only repository follow
+the existing project-create and guide-mutation boundaries. The replay
+repository may touch only the policy-mutation idempotency ledger and must not
+read, insert, update, or delete `ReviewPolicy` or `RevisionPolicy` rows.
+`ProjectRepository.add_review_policy_version()` and
+`add_revision_policy_version()` are the only policy-table write primitives;
+its policy read/lock/append methods remain internal and are not an independently
+callable authorization path.
+
+AUTH edits are limited to activating these two existing ActionIds and enforcing
+their already-typed resource contexts through the existing PREP protocol. This
+chunk may not reshape the general kernel, prepared-capability protocol, or any
+unrelated action evaluator.
 
 ## Not allowed
 
@@ -43,9 +87,44 @@ reputation, frontend, duplicate policy tables, or legacy writer compatibility.
 
 ## Verification
 
-Focused PostgreSQL policy/authorization/migration/concurrency tests, Ruff,
-90-percent changed-subsystem coverage, hosted full coverage, API contract proof,
-and all required L1 reviewers.
+```bash
+(cd backend && .venv/bin/python -m ruff check app tests scripts)
+(cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL="$WORKSTREAM_TEST_ADMIN_DATABASE_URL" \
+  .venv/bin/python scripts/run_isolated_tests.py \
+  --metadata-json .ci/xint-003-02-focused.json --lane xint_003_02 \
+  -- .venv/bin/pytest -q tests/test_authorization.py \
+  tests/test_project_policy_mutations.py tests/test_projects.py tests/test_alembic.py)
+(cd backend && WORKSTREAM_TEST_DATABASE_URL="$WORKSTREAM_TEST_DATABASE_URL" \
+  .venv/bin/pytest -q tests/test_project_policy_mutations.py \
+  --cov=app.modules.projects.policy_mutation_replay_repository \
+  --cov=app.modules.projects.policy_mutation_service \
+  --cov=app.modules.projects.policy_mutation_router \
+  --cov-report=term-missing --cov-fail-under=90)
+(cd backend && .venv/bin/python scripts/api_contract_e2e.py)
+python3 scripts/check_stale_authorization_docs.py
+python3 scripts/check_stale_artifact_contracts.py
+python3 scripts/check_stale_workstream_wording.py
+python3 scripts/check_markdown_links.py
+git diff --check
+```
+
+PostgreSQL tests must cover migration upgrade, downgrade/re-upgrade, direct SQL
+update/delete refusal, crossed replacements, rollback, stale authority and
+policy lineage, and exactly-once replay. GitHub `Backend / test` supplies the
+repository-wide 78-percent full-suite gate; materially changed policy-mutation
+files must remain at or above 90 percent. `Agent Gates / agent-gates` and
+CodeRabbit must pass on the exact final PR head.
+
+## Required reviewers
+
+Architecture, security/auth, product/operations, QA/test, senior engineering,
+reuse/dedup, docs, test-delta, and CI integrity.
+
+## Human review focus
+
+Confirm the sole writer path, immutable-version semantics, exact Project
+Manager/project/guide binding, active-guide freeze, no compatibility path, and
+absence of review-lifecycle activation.
 
 ## Stop condition