From 4768f0b512ec882cca87bedf6e07fc5f21112e35 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Sun, 2 Aug 2026 16:58:52 +0100 Subject: [PATCH 1/2] docs(art): reconcile remaining v0.1 plan --- .../AUTH_HANDOFF.md | 24 ++- .../CHUNK_MAP.md | 191 +++++++----------- .../DECISIONS.md | 37 ++++ .../DISCOVERY.md | 25 +++ .../INTENT.md | 6 +- .../PLAN.md | 46 +++++ .../RISKS.md | 5 + .../STATUS.md | 28 ++- ...S-ART-001-04A-upload-inspection-sealing.md | 4 +- ...-04A1-legacy-contributor-intake-removal.md | 37 ++++ .../WS-ART-001-04A2-outer-zip-safety.md | 38 ++++ ...-001-04A3-semantic-manifest-change-gate.md | 40 ++++ .../WS-ART-001-04B-pre-submit-admission.md | 6 +- ...4C-verified-submission-bundle-admission.md | 4 +- .../WS-ART-001-04C1-durable-put-intent.md | 38 ++++ ...RT-001-04C2-ready-admission-publication.md | 40 ++++ ...-ART-001-05-submission-artifact-cutover.md | 4 +- ...T-001-05A-admission-consumption-binding.md | 43 ++++ .../WS-ART-001-05B-submission-api-cutover.md | 40 ++++ ...T-001-06A-checker-input-materialization.md | 2 +- .../WS-ART-001-07-recovery-live-proof.md | 4 +- ...T-001-07A-review-packet-materialization.md | 44 ++++ ...T-001-07B-contribution-identity-handoff.md | 40 ++++ ...ART-001-08A-local-minio-lifecycle-proof.md | 40 ++++ ...-001-08B-aws-production-readiness-proof.md | 40 ++++ .../WS-ART-001-08C-final-v01-conformance.md | 45 +++++ ...-PLAN2-submission-bundle-reconciliation.md | 7 +- ...001-PLAN3-v01-end-to-end-reconciliation.md | 71 +++++++ ...-ART-001-PLAN3-internal-review-evidence.md | 66 ++++++ .../ACTIVATION_CUSTODY.md | 24 +-- .../CHUNK_MAP.md | 13 +- .../DECISIONS.md | 17 +- .../RISKS.md | 6 +- .../PLAN.md | 6 +- .../CHUNK_MAP.md | 45 +++-- .../DECISIONS.md | 4 + .../WS-XINT-002-art-auth-end-to-end/PLAN.md | 27 ++- .../WS-XINT-002-art-auth-end-to-end/STATUS.md | 9 + ...-002-05A-initial-submission-preparation.md | 3 + .../WS-XINT-002-06-checker-activation.md | 6 +- ...A-pre-submit-materialization-activation.md | 43 ++++ ...-002-06B-post-submit-checker-activation.md | 42 ++++ ...-XINT-002-07-review-artifact-activation.md | 17 +- ...NT-002-07A-reviewer-artifact-activation.md | 32 ++- ...INT-002-07B-response-artifact-extension.md | 21 +- .../chunks/WS-XINT-002-08-conformance.md | 3 +- .../ACTION_CUSTODY.md | 14 +- .../CHUNK_MAP.md | 4 +- .../DECISIONS.md | 12 +- .../DISCOVERY.md | 23 ++- .../WS-XINT-003-rev-auth-end-to-end/INTENT.md | 3 +- .../WS-XINT-003-rev-auth-end-to-end/PLAN.md | 15 +- .../WS-XINT-003-rev-auth-end-to-end/RISKS.md | 2 +- .../WS-XINT-003-rev-auth-end-to-end/STATUS.md | 6 +- .../WS-XINT-003-01-contract-reconciliation.md | 12 +- ...S-XINT-003-04-review-context-activation.md | 21 +- ...-XINT-003-05-review-evidence-activation.md | 3 +- ...S-XINT-003-07-human-revision-activation.md | 18 +- docs/spec_artifact_storage_service.md | 23 ++- docs/spec_authorization_service.md | 35 ++-- docs/spec_review_lifecycle.md | 61 +++--- 61 files changed, 1231 insertions(+), 354 deletions(-) create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A1-legacy-contributor-intake-removal.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A2-outer-zip-safety.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A3-semantic-manifest-change-gate.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C1-durable-put-intent.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C2-ready-admission-publication.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05A-admission-consumption-binding.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05B-submission-api-cutover.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-07A-review-packet-materialization.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-07B-contribution-identity-handoff.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-08A-local-minio-lifecycle-proof.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-08B-aws-production-readiness-proof.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-08C-final-v01-conformance.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-PLAN3-v01-end-to-end-reconciliation.md create mode 100644 .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-PLAN3-internal-review-evidence.md create mode 100644 .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06A-pre-submit-materialization-activation.md create mode 100644 .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06B-post-submit-checker-activation.md diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/AUTH_HANDOFF.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/AUTH_HANDOFF.md index 0a6bc8131..590bd8303 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/AUTH_HANDOFF.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/AUTH_HANDOFF.md @@ -10,6 +10,19 @@ guards, surface manifests, and feature tests. AUTH owns ActionId/PermissionId catalogues, service identities, fixed matrices, evaluator integration, grants, activation custody, and availability. +## 2026-08-02 Reconciliation + +XINT-002-01 already registered the one contributor action and removed the six +obsolete upload-session actions. AUTH-04B has an approved corrected contract, +but its implementation/activation has not merged; guide binding/read remain +planned. No ART status may describe that planning merge as runtime activation. + +The remaining AUTH order requires one correction before submission work can go +live: split XINT-06 into `06A` (pre-submit materializer only, after hidden +ART-04B and before XINT-05A) and `06B` (post-submit materializer plus checker +output write/binding, after ART-06A/06B). This prevents contributor preparation +from activating while its mandatory fixed materializer still denies. + ## Guide Source Sequence 1. Existing guide-source actions remain planned and unavailable. @@ -67,9 +80,7 @@ create generic artifact-download authority. ## Submission Bundle Sequence -Before ART-04A starts, AUTH must merge a separately reviewed registration -contract, provisionally named -`WS-AUTH-001-ART-SUBMISSION-BUNDLE-REGISTRATION`, that: +XINT-002-01 has already merged the registration contract that: - registers planned ActionId `artifact.submission_bundle.prepare`; - maps it only to existing human PermissionId `submission.create`; @@ -81,16 +92,17 @@ contract, provisionally named - deletes the unused planned multi-step upload authority from the live closed catalogue, constraints, and service matrix without compatibility aliases. -After that AUTH contract merges, the retired identifiers may remain only in +The retired identifiers may remain only in immutable historical records and the deterministic deletion proof. They are not an active design, grant, route, compatibility alias, or permission to implement a second intake path. -ART-04A through 04C then implement one hidden continuous surface and publish +ART-04A1 through 04C2 then implement one hidden continuous surface and publish its exact route/resource/guard manifest. After 04C, a separate reviewed AUTH activation contract may integrate the evaluator and change only `artifact.submission_bundle.prepare` to active. ART-05 cannot start until that -activation merges. +activation merges. Before XINT-05A, XINT-06A must separately activate the fixed +pre-submit materializer required by the locked-guide checker boundary. The preparation surface authorizes before scratch intake, but the initial decision cannot authorize the later durable mutation. Immediately before diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/CHUNK_MAP.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/CHUNK_MAP.md index 779327070..d28ee9a4a 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/CHUNK_MAP.md @@ -1,131 +1,84 @@ -# Chunk Map: WS-ART-001 S3-Compatible Object Storage +# Chunk Map: WS-ART-001 Immutable Artifact Storage Each chunk is one PR. No later chunk starts automatically. -| Chunk | Goal | Risk | Status | +## Durable Merged Work + +| Range | Outcome | Status | +|---|---|---| +| `PLAN`, `01`, object-storage amendment | Original plan, artifact domain, AWS-first correction | Merged | +| `02A1`-`02A3` | Typed adapter foundation, bounded scratch, ArtifactStore v2 clean cut | Merged | +| `02B1` | S3-compatible adapter, MinIO, AWS profile | Merged | +| `02C1`-`02D` | Admission, put/verification fencing, recovery, Operator surfaces | Merged | +| `PLAN2` | One-ZIP and guide/submission reconciliation | Merged planning | +| `03A` | Guide-source opaque-byte ingest | Merged PR #215 | +| `03B1`-`03B4` | Binding, generation, materialization, extraction, canonical sufficiency | Merged through PR #240 | + +The original combined `03` was cancelled before implementation. The original +future `04A`, `04C`, `05`, and `07` contracts are superseded by PLAN3 because +they cross multiple L1 boundaries. + +## Remaining v0.1 Chunks + +| Chunk | Goal | Risk | Entry gate/status | |---|---|---:|---| -| `WS-ART-001-PLAN` | Original artifact planning. | L1 | Merged through PR #97 | -| `WS-ART-001-01` | Artifact domain and LocalStorage v1 foundation. | L1 | Merged through PR #101 | -| `WS-ART-001-OBJECT-STORAGE-AMENDMENT` | Make AWS S3 the v0.1 production provider with MinIO local/CI protocol proof; keep optional providers outside v0.1. | L1 | Merged through PR #120 as `4408256` | -| `WS-ART-001-02A1` | Install only ADR 0014's small typed external-service adapter/factory foundation without migrating a capability. | L1 | Merged through PR #127 as `f64a8e5` | -| `WS-ART-001-02A2` | Add bounded committed-source preparation and inactive scratch-cleanup mechanics without changing the active v1 port. | L1 | Merged through PR #129 as `9a04434` on 2026-07-16 | -| `WS-ART-001-02A3` | Replace ArtifactStore v1 with byte-only v2, activate API-startup and Celery Beat scratch cleanup, migrate schema/callers/factory, and remove `flow_node` in one atomic clean cut. | L1 | Merged through PR #141 as `a10d901` on 2026-07-18 | -| `WS-ART-001-02B1` | Implement the S3-compatible adapter, MinIO integration, and AWS S3 production profile. | L1 | Merged through PR #151 as `1b5422fc` on 2026-07-19 | -| `WS-ART-001-02C1` | Add the generic durable-byte admission ledger and durable put-attempt state foundation without provider execution. | L1 | Merged through PR #154 as `44f2467c` on 2026-07-19 | -| `WS-ART-001-02C2` | Add put resolution, verification publication, complete-object observation, immutable receipts, and PostgreSQL execution fencing without recovery attempts or routes. | L1 | Merged through PR #159 as `bc5e6a42` | -| `WS-ART-001-02C3` | Add the recovery-attempt model and exact idempotent source-job to retry-job chain without public or Operator routes. | L1 | Merged through PR #174 as `92b8a7aa` | -| `WS-ART-001-02D` | Add hidden Operator content/job/retry/recovery/audit APIs, canonical resource composition, and production-readiness checks while actions and provider profiles remain inactive. | L1 | Merged through PR #177 as `93c14181` | -| `WS-ART-001-03` | Original combined guide-source cutover. | L1 | Cancelled before implementation; no runtime changes | -| `WS-ART-001-PLAN2` | Reconcile guide and one-ZIP submission planning with bounded scratch, existing immutable admission/recovery, exact AUTH sequencing, and downstream ownership. | L1 | Planning-only successor proposed after cancellation | -| `WS-ART-001-03A` | Add hidden guide-source byte ingest through existing preparation, admission, verification, and publication. | L1 | Merged through PR #215 as `bb9082a7` | -| `WS-ART-001-03B1` | Add authoritative verified guide-source bindings and an exact setup-generation fence while fixed-service binding remains unavailable. | L1 | Proposed after 03A and AUTH-04A | -| `WS-ART-001-03B2` | Add fixed-reader verified materialization, artifact incidents, and canonical format detection in bounded ART scratch. | L1 | Proposed after 03B1 | -| `WS-ART-001-03B3A` | Add the isolated extraction framework, canonical records, and text/Markdown/JSON/CSV extractors. | L1 | Proposed after 03B2 | -| `WS-ART-001-03B3B1` | Approve the exact pinned complex-parser dependency allowlist and deterministic CI gate without installing packages or changing runtime code. | L1 | Proposed after 03B3A | -| `WS-ART-001-03B3B2` | Install only the approved PDF dependency and add bounded PDF text extraction. | L1 | Proposed after 03B3B1 approval | -| `WS-ART-001-03B3B3A` | Add shared bounded OOXML container/security capabilities without document extraction. | L1 | Proposed after 03B3B1 approval | -| `WS-ART-001-03B3B3B` | Add bounded DOCX extraction on the approved OOXML capability. | L1 | Proposed after 03B3B3A | -| `WS-ART-001-03B3B3C` | Add bounded PPTX extraction on the approved OOXML capability. | L1 | Proposed after 03B3B3A | -| `WS-ART-001-03B3B3D` | Add bounded XLSX extraction on the approved OOXML capability. | L1 | Proposed after 03B3B3A | -| `WS-ART-001-03B3B4` | Install only the approved image dependency and add PNG/JPEG/WebP structural metadata extraction. | L1 | Proposed after 03B3B1 approval | -| `WS-ART-001-03B4` | Feed only complete same-generation canonical extracted material into the existing Celery sufficiency pipeline. | L1 | Active; all prerequisites through 03B3B4 merged | -| `WS-ART-001-03C` | Remove legacy guide-source identity and add exact same-generation setup continuation. | L1 | Proposed after 03B1-03B4 and AUTH-04B | -| `WS-ART-001-04A` | Accept one outer ZIP in bounded scratch, safely inspect its tree, normalize executable intent, produce canonical identities, and reject unchanged work before provider I/O. | L1 | Proposed after 03C and AUTH planned action registration | -| `WS-ART-001-04B` | Run mandatory platform and locked Project Guide pre-submit checks against the same scratch-bound tree and executable semantics without durable storage. | L1 | Proposed after 04A | -| `WS-ART-001-04C` | Reauthorize at durable intent, admit/verify the passing ZIP once, and publish one capacity-charged `ready` admission that may remain unbound. | L1 | Proposed after 04B; AUTH activation follows hidden completion | -| `WS-ART-001-05` | Freshly authorize and atomically consume one ready admission into one immutable Submission/binding, or terminally stale it on proven context drift. | L1 | Proposed after 04C and exact AUTH activation | -| `WS-ART-001-06A` | Persist checker input snapshots and materialize authorized immutable bytes with identical normalized executable semantics. | L1 | Proposed after 05 | -| `WS-ART-001-06B` | Ingest checker logs/outputs as artifacts, persist checker completion facts, and preserve existing checker-owned routing without creating review aggregates. | L1 | Proposed after 06A | -| `WS-ART-001-07` | Prove Local/MinIO plus AWS S3 readiness, Operator recovery, and exact-byte guide/pre/post-submit behavior through real APIs. | L1 | Proposed after 06B | +| `WS-ART-001-PLAN3` | Reconcile the complete remaining v0.1 custody chain and AUTH/REV/CON handoffs. | L1 | Planning only; proposed | +| `WS-ART-001-03C` | Clean-cut legacy guide identity/excerpts and make the verified same-generation pipeline live. | L1 | Proposed; AUTH-04B entry gate satisfied by PR #245 | +| `WS-ART-001-04A1` | Remove legacy multi-step contributor intake reachability and schema without adding the replacement route. | L1 | Proposed after 03C | +| `WS-ART-001-04A2` | Add bounded one-outer-ZIP intake and archive-safety inspection in private scratch. | L1 | Proposed after 04A1 | +| `WS-ART-001-04A3` | Add canonical semantic manifest, executable normalization, and unchanged-work gate. | L1 | Proposed after 04A2 | +| `WS-ART-001-04B` | Run non-bypassable platform and locked-guide prechecks against that exact scratch tree and persist bounded evidence. | L1 | Proposed after 04A3 | +| `WS-ART-001-04C1` | Reauthorize and atomically persist capacity plus durable put intent, then write the checked ZIP once. | L1 | Proposed after XINT-06A | +| `WS-ART-001-04C2` | Reuse verification/recovery to publish one capacity-charged ready admission and compose the hidden continuous endpoint. | L1 | Proposed after 04C1 | +| `WS-ART-001-05A` | Atomically consume ready admission into one immutable Submission and binding under fresh human/service authority. | L1 | Proposed after XINT-05A | +| `WS-ART-001-05B` | Remove legacy package URI/hash/manifest authority and cut live API/automatic post-submit dispatch to the verified binding. | L1 | Proposed after XINT-05B | +| `WS-ART-001-06A` | Persist post-submit checker input snapshot and integrity-checking materialization. | L1 | Proposed after 05B | +| `WS-ART-001-06B` | Store/bind checker outputs and preserve checker-owned routing. | L1 | Proposed after 06A | +| `WS-ART-001-07A` | Add lease-scoped exact-binding reviewer packet materialization without review lifecycle ownership. | L1 | Proposed after 06B plus hidden REV manifest | +| `WS-ART-001-07B` | Bind accepted Submission/ART identity into the CON handoff without provider I/O. | L1 | Proposed after REV acceptance and CON hidden contract | +| `WS-ART-001-08A` | Prove Local/MinIO product lifecycle through real APIs and durable background services. | L1 | Proposed after 07B | +| `WS-ART-001-08B` | Prove AWS production readiness and bounded activation independently of product behavior. | L1 | Proposed after 08A or concurrently once product contracts are stable | +| `WS-ART-001-08C` | Run final ART/AUTH/REV/CON conformance for the complete v0.1 custody chain. | L1 | Proposed after ART 08A/08B and XINT-08 | -## Dependency Order +## Corrected Cross-Initiative Order ```text -OBJECT-STORAGE-AMENDMENT --> 02A1 shared adapter/factory foundation --> 02A2 committed-source preparation and LocalStorage internals --> 02A3 ArtifactStore v2/LocalStorage/schema clean cut --> 02B1 S3-compatible adapter, MinIO, and AWS profile --> 02C1 generic durable-byte admission and put-attempt foundation --> 02C2 put resolution, verification publication, and fencing --> 02C3 recovery attempt and idempotency chain --> 02D Operator and production readiness --> PLAN2 planning reconciliation --> 03A guide-source byte ingest --> AUTH activation for exact 03A actions --> 03B1 authoritative guide binding/setup generation --> 03B2 verified materialization/format detection --> 03B3A isolated extraction framework/text formats --> 03B3B1 pinned dependency approval and CI gate --> 03B3B1 branches to: - -> 03B3B2 approved PDF extractor - -> 03B3B3A shared OOXML security capability - -> 03B3B3B DOCX - -> 03B3B3C PPTX - -> 03B3B3D XLSX - -> 03B3B4 approved image metadata --> 03B4 same-generation Celery sufficiency integration only after 03B3B2, - 03B3B3B, 03B3B3C, 03B3B3D, and 03B3B4 complete --> AUTH activation for exact 03B actions --> 03C guide-source clean cut/continuation --> AUTH planned registration of `artifact.submission_bundle.prepare` --> 04A one-ZIP scratch intake/inspection/manifest/change gate --> 04B scratch-bound platform/project pre-submit checks --> 04C one-time immutable admission/verification --> AUTH activation of exact complete contributor surface --> 05 submission cutover --> 06A checker input/materialization --> 06B checker output/post-submit routing --> 07 live proof +AUTH-04B implementation [merged PR #245] +-> ART-03C +-> ART-04A1 -> 04A2 -> 04A3 -> 04B +-> XINT-06A pre-submit materializer activation +-> ART-04C1 -> 04C2 +-> XINT-05A contributor preparation activation +-> ART-05A +-> XINT-05B Submission/binding activation +-> ART-05B -> 06A -> 06B +-> XINT-06B post-submit/output activation +-> ART/REV-07A hidden packet contract +-> XINT-07A packet activation only +-> REV acceptance -> ART/CON-07B identity handoff +-> ART-08A + ART-08B +-> XINT-08 + ART-08C ``` -`FN-ART-002` is deferred and is not in this dependency graph. R2 is also -deferred. It has no active chunk, runtime profile, credential service, or -configuration value in v0.1. -`ReviewPacketManifest` and `ReviewEvidenceArtifact` remain owned by WS-REV. -Physical deletion, temporary provider retention, candidate object storage, and -semantic search require separate approved initiatives. - -## Cross-Initiative Handoffs - -The exact authorization sequence and stop conditions are recorded in -`AUTH_HANDOFF.md`. +XINT-05C checker remediation and XINT-05D human-review revision reuse the same +one-ZIP preparation/Submission primitives only after their CHECKER/REV-owned +obligation contracts exist. They do not create alternate artifact intake. -- Artifact actions follow AUTH planned registration -> hidden ART behavior and - canonical resource composition -> AUTH evaluator integration and activation. - `WS-AUTH-001-ART-CUSTODY` first transfers the 25 current ART actions to eight - exact AUTH activation custodians without changing mappings or availability. - Protected service commands first pass AUTH-09E. They consume canonical - `ActorProfile.id`, closed `ActionId` and `PermissionId` catalogues, and exact - fixed service matrix rows. ART never changes action - availability. Provider idempotency labels and persisted role snapshots are - provenance, not authority. -- WS-REV owns `ReviewPacketManifest` and `ReviewEvidenceArtifact`. Review code - receives verified Workstream `ArtifactBinding` IDs through a narrow - review-facing capability; it must not receive provider references, scratch - paths, or concrete adapters. REV also owns reviewer decisions and - note/findings for - the exact `Submission`; `needs_revision` authorizes a later contributor ZIP - but contains no reviewer-uploaded artifact. -- A future optional contribution-evidence projection requires separately - approved ART-owned read/write capabilities and AUTH action activation. Core - ContributionRecord creation makes no ART capability/provider call and is not - gated by that projection. No contribution capability is implied by this chunk - map. -- Cross-initiative terminology must use ART's canonical `resource_type`, - `resource_id`, and `logical_role`, or define an explicit integration mapping; - product initiatives must not create a second binding vocabulary implicitly. -- The existing immutable `Submission` row is the version aggregate. TASK/REV - jointly own the exact `needs_revision` response relation and indexed - latest/current/accepted access; no initiative creates a competing - `SubmissionVersion` table. -- Reviewer and delivery streams consume an ART-owned integrity-checking read - capability that recomputes full SHA-256 and byte count. ART does not own the - review decision, ContributionRecord, compensation, reputation, or delivery - lifecycle that consumes that capability. +Review-evidence upload/binding is not part of the approved v0.1 reviewer +workflow and remains planned/unavailable. A reviewer records only +`accept|needs_revision|reject` plus note/findings. Client delivery and physical +deletion remain future initiatives. -## Checkpoint Before Checker Expansion +## Ownership Boundaries -Do not resume checker feature expansion until `WS-ART-001-06B` proves pre-submit -evidence and post-submit execution name the same archive identity, -semantic-manifest hash, verified admission, and exact binding. +- ART owns bytes, digest/size, semantic manifests, verified content, bindings, + incidents, and integrity-checking materialization. +- AUTH owns action/permission catalogues, fixed identities/matrices, prepared + authority, evidence, and availability. +- TASK owns assignment, locked context, Submission lifecycle, predecessor, and + automatic checker dispatch. +- CHECKER owns checker policy, execution, findings, and routing. +- REV owns review packet manifest, queue/lease/assignment, decision, and + note/findings. +- CON owns ContributionRecord and references the accepted Submission/ART + identity without reading provider bytes. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DECISIONS.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DECISIONS.md index d378807b3..82ea3fef9 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DECISIONS.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DECISIONS.md @@ -501,3 +501,40 @@ incident reference to authorized Operators. A current-generation transient cancellation may retry; stale-generation cancellation commits no report. All other terminal source-format or content failures require a corrected item in a new snapshot. None creates a sufficiency decision. + +## D47 - Pre-Submit Materializer Activates Before Contributor Preparation + +The continuous submission-bundle request cannot become live while its fixed +pre-submit materializer is unavailable. AUTH therefore splits checker +activation: pre-submit materialization activates after hidden ART-04B evidence +and before XINT-05A activates contributor preparation. Post-submit +materialization and checker output/binding activate later after ART-06A/06B. + +## D48 - Remaining L1 Submission Work Is Split By Durable Boundary + +Legacy intake removal, ZIP safety, semantic identity/change detection, durable +put intent, ready-admission publication, atomic Submission consumption, and +legacy Submission API cutover are separate PRs. Process-local scratch remains +continuous across hidden 04A/04B/04C orchestration; no split serializes a +scratch handle or exposes an intermediate route. + +## D49 - Reviewer Access Is An ART Capability, Not An ART Review Aggregate + +ART supplies a hidden exact-binding review-packet materialization capability +that recomputes full digest and size. REV owns packet manifest, lease, queue, +assignment, decision, and note/findings. v0.1 has no reviewer-uploaded revision +artifact. Review-evidence binding remains planned unless a separately approved +REV requirement proves it is needed. + +## D50 - Contribution Preserves Identity Without Reading Bytes + +CON creates the ContributionRecord and references the accepted immutable +Submission and ART binding/content identities. Core contribution creation does +not require provider access or a new ART write. Client delivery is outside the +v0.1 Workstream lifecycle and requires a future reviewed initiative. + +## D51 - Live Proof Is Split From Product Implementation + +Local/MinIO product lifecycle proof, AWS deployment activation proof, and final +cross-domain conformance are separate PRs. AWS readiness cannot bury product +behavior, and product API proof cannot claim AWS production eligibility. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DISCOVERY.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DISCOVERY.md index 3e4baaccf..f081d32f6 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DISCOVERY.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DISCOVERY.md @@ -159,3 +159,28 @@ containers must pass one bounded classifier that distinguishes DOCX, PPTX, and XLSX by internal markers. Audio/video transcription and OCR are not required by current v0.1 setup and remain unsupported. PNG/JPEG/WebP classification and metadata do not imply OCR or textual sufficiency. + +## 2026-08-02 End-to-End v0.1 Planning Audit + +Current `main` contains all ART guide implementation through `03B4`. During +this audit AUTH-04B was still pending; it subsequently merged in PR #245 at +`6babf81b`. Both fixed-service guide binding/read actions are now active, so +ART-03C may start after this planning reconciliation merges. + +The remaining map had four material defects: + +1. statuses still described merged 03B chunks as proposed or active; +2. 04A, 04C, 05, and 07 crossed too many L1 boundaries for one PR; +3. XINT-05A would activate contributor preparation before the fixed + `artifact.pre_submit.checker_input.materialize` service action, even though + hidden 04B makes that authority mandatory inside the continuous request; +4. ART ended at checker routing while XINT expected later reviewer artifact + capabilities and the product intent required accepted contribution records + to retain the same artifact identity. + +The corrected finish line is bounded: ART owns guide cutover, one-ZIP intake, +semantic identity, prechecks, durable ready admission, atomic Submission +binding, checker materialization/output custody, reviewer packet byte access, +and accepted-contribution identity projection. REV owns review lifecycle and +notes/findings; CON owns ContributionRecord; client delivery remains a future +owner and is not silently implemented by ART v0.1. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/INTENT.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/INTENT.md index 8b6861140..55427b854 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/INTENT.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/INTENT.md @@ -130,8 +130,12 @@ v0.1 contribution lifecycle. - no candidate storage namespace, promotion copy, or temporary provider retention window; - no second artifact recovery aggregate; -- no review packet or reviewer evidence implementation, which remains WS-REV; +- no reviewer queue, lease, assignment, decision, or finding lifecycle, which + remains WS-REV; ART supplies only exact integrity-checking byte access; - no payment, reputation, blockchain, or marketplace expansion. +- no client-delivery lifecycle in v0.1. Contribution records retain the + accepted Submission/binding identity; a future delivery owner must consume a + separately authorized ART egress capability without changing that identity. ## Proof diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/PLAN.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/PLAN.md index e50c07c92..b272c88b4 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/PLAN.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/PLAN.md @@ -676,3 +676,49 @@ declarations that have no active v0.1 provider meaning. Chunk 03 removes direct provider schemes from guide-source identity. Chunk 05 deletes the remaining caller transport as part of the submission binding clean cut. Later code must not preserve an alias, fallback, or compatibility parser. + +## 2026-08-02 Remaining v0.1 Execution Amendment + +This section supersedes the earlier unsplit future-chunk sequence. It does not +change the merged foundation or guide extraction design. + +```text +AUTH-04B implementation/activation [merged PR #245] +-> ART-03C guide verified-pipeline clean cut +-> ART-04A1 legacy contributor-intake removal +-> ART-04A2 bounded outer-ZIP safety/intake +-> ART-04A3 semantic manifest + unchanged-work gate +-> ART-04B scratch-bound platform/project prechecks +-> XINT-06A pre-submit materializer activation +-> ART-04C1 durable intent + one provider write +-> ART-04C2 verified ready-admission publication +-> XINT-05A contributor preparation activation +-> ART-05A atomic Submission/binding/admission consumption +-> XINT-05B Submission/binding activation +-> ART-05B legacy Submission transport/API + automatic dispatch clean cut +-> ART-06A post-submit checker snapshot/materialization +-> ART-06B checker output binding and routing +-> XINT-06B post-submit/output activation +-> ART-07A lease-scoped reviewer packet materialization +-> XINT-07A reviewer packet activation only +-> ART-07B accepted-contribution artifact identity handoff +-> ART-08A Local/MinIO real API lifecycle proof +-> ART-08B AWS production-readiness/activation proof +-> XINT-08 + ART-08C final v0.1 conformance +``` + +04A1-04C2 remain hidden internal pieces of one continuous contributor request. +No intermediate HTTP route, durable upload session, scratch handle, local path, +or prepared authorization crosses those PR boundaries. 04C2 alone composes the +hidden endpoint after every internal dependency exists. + +XINT-06 must split because live preparation requires the fixed pre-submit +materializer before XINT-05A can safely activate the human preparation action. +The later 06B activation owns only post-submit materialization plus checker +output write/binding. This removes the previous dependency cycle. + +Reviewer packet materialization is an ART byte-custody capability consumed by +REV under an exact active lease. ART creates no review aggregate or decision. +Reviewer evidence upload/binding is not required by the approved v0.1 reviewer +workflow and remains unavailable. CON records the accepted Submission and ART +identity without provider I/O. Client delivery is explicitly deferred. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/RISKS.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/RISKS.md index f309bcfd0..49f339066 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/RISKS.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/RISKS.md @@ -62,3 +62,8 @@ | Stale Celery delivery processes replaced guide content | Critical | Payloads contain identifiers plus setup generation only; executors reload current lineage, binding, extraction, run, and generation before invocation and persistence. | | Unsupported image/audio/video content is passed raw to an agent | High | PNG/JPEG/WebP expose bounded structural metadata only; OCR and audio/video are unsupported, and image-only required text stops setup internally. | | Extracted guide text performs prompt injection | Critical | Delimit and label extracted material as untrusted data, expose no tools/secrets/provider authority, enforce typed output, and test adversarial embedded instructions. | +| Contributor preparation activates before its fixed pre-submit materializer | Critical | Split XINT checker activation: activate pre-submit materialization after hidden 04B and before XINT-05A; keep post-submit/output actions planned until ART-06 evidence. | +| Review packet ownership is confused with review lifecycle ownership | Critical | ART owns exact binding materialization and integrity; REV owns packet manifest, lease, assignment, decision, and notes/findings through a typed joint contract. | +| Reviewer evidence actions create an unapproved upload path | High | Keep review-evidence binding planned and unavailable unless a separate approved REV requirement adds exact slots and guards; reviewer revision remains note/findings only. | +| Contribution or delivery silently changes accepted bytes | Critical | ContributionRecord stores accepted Submission/binding/content identity without provider I/O; future delivery requires a separate authorized full-read capability and rehash. | +| Final live-proof PR hides product or cloud implementation | High | Split Local/MinIO API proof, AWS deployment activation, and final conformance into separate reviewable chunks. | diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md index 852831ae4..52ed58649 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md @@ -1,5 +1,20 @@ # Status: WS-ART-001 Immutable Artifact Storage +## Audited Durable State At 2026-08-02 + +ART-03A and every split ART-03B chunk through 03B4 are merged. The complete +verified guide binding, materialization, classification, extraction, and hidden +same-generation sufficiency continuation exist on `main`. + +AUTH-04B production implementation merged in PR #245 at `6babf81b`. The fixed +guide binding and guide-reader services are live, and +`artifact.guide_source.binding.create` plus `artifact.guide_source.read` are +active under `XINT_002_04B`. ART-03C's dependency is satisfied. + +`WS-ART-001-PLAN3` is the planning-only end-to-end audit of remaining v0.1 +work. It splits oversized chunks, repairs activation order, and adds explicit +reviewer/contribution custody handoffs. It starts no implementation. + ## Completed Foundation Planning and the artifact foundation merged through PR #97 and PR #101. The @@ -58,11 +73,11 @@ the guide-content boundary is being corrected explicitly: verified binding, full-read materialization, format classification, isolated extraction, canonical extraction provenance, incremental complex-format support, and same-generation sufficiency continuation are separate PR-sized contracts. -`WS-ART-001-03B4` is active: its reviewed contract fixes the artifact-owned +`WS-ART-001-03B4` is merged: its reviewed contract fixes the artifact-owned material port, all-items-required semantics, deterministic 12 MiB assembly, normalized report-to-extraction provenance, and the hidden pre-submit -identifier/generation continuation. AUTH binding/read actions remain planned -and unavailable; ART-03C remains blocked on AUTH-04B. +identifier/generation continuation. AUTH binding/read production activation +remains unmerged; ART-03C remains blocked on that implementation. After 03B3A merged, the original complex-format chunk was found too broad for one dependency and parser-security review. It is replaced by 03B3B1 dependency @@ -76,6 +91,7 @@ package, lock, runtime import, or parser behavior change. Its approval gate requires independent protected GitHub review of the exact final PR head before merge; repository-authored evidence alone is not authority. +03B1 merged through PR #222, 03B2 through PR #223, and 03B3A through PR #225. 03B3B2 is merged through PR #231. It installs only the approved `pypdf` wheel and adds bounded passive-PDF text extraction inside the existing isolated child. @@ -86,9 +102,9 @@ wheel and adds the shared bounded OPC/OOXML container security capability. omission facts on the shared OOXML boundary. 03B3B3C merged through PR #235 and adds bounded PPTX slide/notes extraction. 03B3B3D merged through PR #238 and adds bounded XLSX cell extraction. 03B3B4 merged through PR #239 and adds only -bounded PNG/JPEG/WebP structural metadata. 03B4 is now the active hidden -same-generation sufficiency continuation. AUTH binding/read actions remain -inactive. +bounded PNG/JPEG/WebP structural metadata. 03B4 merged through PR #240 and adds +the hidden same-generation sufficiency continuation. AUTH binding/read actions +remain planned. AUTH `WS-XINT-002-04B` follows the complete hidden split-03B series and activates only fixed-service binding and guide read. ART-03C then removes the diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A-upload-inspection-sealing.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A-upload-inspection-sealing.md index efe560469..abe645867 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A-upload-inspection-sealing.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A-upload-inspection-sealing.md @@ -1,6 +1,8 @@ # Chunk Contract: WS-ART-001-04A - One-ZIP Scratch Intake And Manifest -Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 03C and AUTH planned registration +Initiative: `WS-ART-001` | Risk: L1 | Status: Superseded by PLAN3 (`04A1`-`04A3`) + +Historical design input only. This file is not an executable chunk contract. Artifact contract phase: `upload_admission` diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A1-legacy-contributor-intake-removal.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A1-legacy-contributor-intake-removal.md new file mode 100644 index 000000000..e5cb3dca6 --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A1-legacy-contributor-intake-removal.md @@ -0,0 +1,37 @@ +# Chunk Contract: WS-ART-001-04A1 — Legacy Contributor Intake Removal + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 03C + +## Goal + +Remove legacy multi-step upload-session/item contributor reachability and its +unused schema before building the one-ZIP replacement. + +## Allowed Files + +ART upload models/migration/repository/routes/schemas, static architecture and +migration tests, stale-contract/docs, and scoped CI evidence. + +## Not Allowed Changes + +Replacement upload route, ZIP parsing, provider I/O, Submission/checker/review, +AUTH catalogue/availability, compatibility aliases, or fabricated backfill. + +## Acceptance Criteria + +No route, command, service matrix lookup, model, or schema can create/use the +old intake; historical audit values remain readable where required; populated +unsafe downgrade/upgrade refuses honestly; no new intake becomes reachable. + +## Verification Commands + +Focused Alembic/architecture/route tests, Ruff, stale scans, hosted Backend and +Agent Gates, repository 78% and changed subsystem 90% coverage. + +## Required Reviewers + +Architecture, security/auth, QA, product/ops, senior, CI, docs, reuse, test delta. + +## Human Review Focus And Stop Conditions + +Prove deletion without opening a replacement or losing historical evidence. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A2-outer-zip-safety.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A2-outer-zip-safety.md new file mode 100644 index 000000000..26d8c4520 --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A2-outer-zip-safety.md @@ -0,0 +1,38 @@ +# Chunk Contract: WS-ART-001-04A2 — Bounded Outer-ZIP Safety + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 04A1 + +## Goal + +Accept one outer ZIP into canonical private scratch and safely enumerate its +complete file/directory tree without provider I/O or a public route. + +## Allowed Files + +ART scratch intake/archive safety capability, bounded configuration use, +adversarial ZIP tests/fuzz fixtures, docs, and scoped coverage evidence. + +## Not Allowed Changes + +Semantic manifest/change comparison, project checker, durable admission, +provider I/O, nested archive extraction, larger limits, or AUTH activation. + +## Acceptance Criteria + +Reject non-ZIP/additional items, traversal/absolute/UNC/backslash/control paths, +symlink/special/encrypted/malformed entries, duplicates/NFC/case-fold +collisions, bombs, and every configured limit breach; nested ZIPs stay opaque; +all outcomes clean scratch and disclose no path/handle. + +## Verification Commands + +Focused archive/scratch/fuzz tests, Ruff, stale scans, hosted gates, 90% owned +subsystem and 78% repository coverage. + +## Required Reviewers + +Security, architecture, QA, product/ops, senior, CI, docs, reuse, test delta. + +## Human Review Focus And Stop Conditions + +No unchecked byte may escape scratch and no declared ZIP size is trusted. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A3-semantic-manifest-change-gate.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A3-semantic-manifest-change-gate.md new file mode 100644 index 000000000..45532af7b --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A3-semantic-manifest-change-gate.md @@ -0,0 +1,40 @@ +# Chunk Contract: WS-ART-001-04A3 — Semantic Manifest And Change Gate + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 04A2 + +## Goal + +Build the canonical archive/tree identities and reject exact or semantic +unchanged work before checker or provider I/O. + +## Allowed Files + +ART manifest/executable normalization, TASK predecessor read capability, +read-only sealed workspace projection, migration only if immutable manifest +control-plane persistence is required, focused tests/docs/CI. + +## Not Allowed Changes + +Project checker execution, provider I/O, durable admission, Submission/review, +arbitrary permission preservation, file execution, or AUTH activation. + +## Acceptance Criteria + +Manifest commits normalized paths/types/file hashes/sizes/executable flag; +packaging metadata is excluded; explicit/synthetic directories are canonical; +same archive or manifest as immediate predecessor rejects under lock; executable +changes count, timestamp/compression-only changes do not; fixed modes match all +later materializers. + +## Verification Commands + +Focused manifest/predecessor/concurrency/mode tests, Ruff, stale scans, hosted +gates, 90% owned subsystem and 78% repository coverage. + +## Required Reviewers + +Architecture, security, QA, product/ops, senior, CI, docs, reuse, test delta. + +## Human Review Focus And Stop Conditions + +Ensure semantic equality ignores packaging only, never actual work. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04B-pre-submit-admission.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04B-pre-submit-admission.md index 8adc3cdba..8eb486f85 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04B-pre-submit-admission.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04B-pre-submit-admission.md @@ -1,6 +1,6 @@ # Chunk Contract: WS-ART-001-04B - Scratch-Bound Pre-Submission Checks -Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 04A +Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 04A3 Artifact contract phase: `upload_admission` @@ -66,8 +66,8 @@ artifact content, provider object, or Submission. same scratch handle and exact predecessor observed in 04A; they do not make bytes authoritative or durable; - 04B remains an internal hidden library seam with no separately invocable - contributor route; 04C composes the one continuous same-process endpoint; -- the complete operation remains process-local through 04C; process loss or + contributor route; 04C2 composes the one continuous same-process endpoint; +- the complete operation remains process-local through 04C2; process loss or scratch loss invalidates the result and requires reupload rather than routing a later distributed service to a local path; - completion, failure, cancellation, deadline, and abandoned-work cleanup are diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C-verified-submission-bundle-admission.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C-verified-submission-bundle-admission.md index 31ca953e9..63b30724d 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C-verified-submission-bundle-admission.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C-verified-submission-bundle-admission.md @@ -1,6 +1,8 @@ # Chunk Contract: WS-ART-001-04C - Verified Submission Bundle Admission -Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 04B +Initiative: `WS-ART-001` | Risk: L1 | Status: Superseded by PLAN3 (`04C1`-`04C2`) + +Historical design input only. This file is not an executable chunk contract. Artifact contract phase: `upload_admission` diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C1-durable-put-intent.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C1-durable-put-intent.md new file mode 100644 index 000000000..2d18828e4 --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C1-durable-put-intent.md @@ -0,0 +1,38 @@ +# Chunk Contract: WS-ART-001-04C1 — Submission Durable Put Intent + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after XINT-06A + +## Goal + +Consume the passing scratch result, reauthorize final facts, reserve capacity, +persist one put attempt, and hand the checked ZIP to ArtifactStore once. + +## Allowed Files + +Submission producer integration with generic admission/put attempt, typed +TASK/PROJECT/AUTH seams, hidden orchestration, tests/docs/scoped CI. + +## Not Allowed Changes + +Ready admission publication, Submission creation/binding, public route, +provider redesign, second recovery aggregate, retention/deletion, or availability. + +## Acceptance Criteria + +Fresh transaction-local authority and locked actor/assignment/task/predecessor/ +context commit with capacity and put intent before provider I/O; denial/drift +causes no durable/provider effect; exact replay is single-effect; post-intent +ambiguity uses existing observation/recovery; scratch never crosses process. + +## Verification Commands + +Focused crossed-revocation/admission/put/replay tests, Ruff, hosted gates, 90% +owned subsystem and 78% repository coverage. + +## Required Reviewers + +Security/auth, architecture, QA, product/ops, senior, CI, docs, reuse, test delta. + +## Human Review Focus And Stop Conditions + +Provider I/O must be impossible before the durable authorization transaction. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C2-ready-admission-publication.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C2-ready-admission-publication.md new file mode 100644 index 000000000..5e437a178 --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C2-ready-admission-publication.md @@ -0,0 +1,40 @@ +# Chunk Contract: WS-ART-001-04C2 — Ready Admission Publication + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 04C1 + +## Goal + +Publish one immutable capacity-charged ready admission after exact read-back +verification and compose the hidden continuous contributor endpoint. + +## Allowed Files + +SubmissionBundleAdmission model/migration/repository, verification publication +integration, bounded Operator projection, hidden route composition, tests/docs/CI. + +## Not Allowed Changes + +Submission/binding consumption, public activation, expiry/release/delete, +candidate storage, review/contribution, or new recovery machinery. + +## Acceptance Criteria + +Only verified matching bytes publish ready; lifecycle is ready->consumed|stale; +actor/link/project/task/assignment/predecessor/context/manifest/evidence lineage +is immutable; abandoned ready remains charged; exact POST replay returns the +same operation/admission; 04A2-04C2 run in one request with no serialized local +handle; fixed pre-submit materializer is active before later live activation. + +## Verification Commands + +Focused verification/publication/lifecycle/concurrency/operator tests, Ruff, +hosted gates, 90% owned subsystem and 78% repository coverage. + +## Required Reviewers + +Security/auth, architecture, QA, product/ops, senior, CI, docs, reuse, test delta. + +## Human Review Focus And Stop Conditions + +No bindable admission exists before complete verification; no abandoned state +causes product lifecycle effects. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05-submission-artifact-cutover.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05-submission-artifact-cutover.md index da548d962..733191c25 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05-submission-artifact-cutover.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05-submission-artifact-cutover.md @@ -1,6 +1,8 @@ # Chunk Contract: WS-ART-001-05 - Submission Bundle Binding Cutover -Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 04C and exact AUTH activation +Initiative: `WS-ART-001` | Risk: L1 | Status: Superseded by PLAN3 (`05A`-`05B`) + +Historical design input only. This file is not an executable chunk contract. Artifact contract phase: `submission_cutover` diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05A-admission-consumption-binding.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05A-admission-consumption-binding.md new file mode 100644 index 000000000..1ee6e129a --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05A-admission-consumption-binding.md @@ -0,0 +1,43 @@ +# Chunk Contract: WS-ART-001-05A — Admission Consumption And Submission Binding + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after XINT-05A + +## Goal + +Atomically consume one compatible `ready` admission, create the immutable +Submission, and bind it to the exact verified artifact and semantic manifest. + +## Allowed Files + +Submission/admission/binding models and migration, transactional service and +repository seams, canonical resource facts, focused tests/docs/CI evidence. + +## Not Allowed Changes + +Legacy API transport cutover, checker execution, review decisions or notes, +contribution lifecycle, provider reads/writes, deletion, or AUTH activation. + +## Acceptance Criteria + +- fresh human and fixed binding-service prepared authority is consumed in the + same transaction as the protected mutation; +- actor, identity, project, task, assignment, predecessor, locked context, + content, manifest, and checker evidence match under locks; +- `ready -> consumed`, Submission creation, and binding commit once; +- mismatch proven during consumption makes the admission stale where specified; +- concurrent attempts create one business effect and exact replay is stable; +- denial or persistence failure rolls back every effect. + +## Verification Commands + +Focused transaction, concurrency, replay, stale-context, authorization, model, +migration, coverage, and hosted Backend/Agent Gates. + +## Required Reviewers + +Architecture, security/auth, product/ops, QA, senior engineering, CI integrity, +reuse/dedup, test delta, and docs. + +## Human Review Focus And Stop Conditions + +Review the atomic boundary and immutable lineage. Stop before transport cutover. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05B-submission-api-cutover.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05B-submission-api-cutover.md new file mode 100644 index 000000000..58b79b847 --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05B-submission-api-cutover.md @@ -0,0 +1,40 @@ +# Chunk Contract: WS-ART-001-05B — Submission API And Dispatch Cutover + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after XINT-05B + +## Goal + +Make verified admission consumption the only contributor Submission path and +dispatch post-submit work using immutable identifiers rather than package data. + +## Allowed Files + +Submission schemas/router/service, exact legacy field migration/removal, +post-submit dispatch payloads, API examples, focused tests/docs/CI evidence. + +## Not Allowed Changes + +ZIP inspection, admission production, checker execution, review/contribution, +generic artifact download, AUTH catalogue/availability, or compatibility paths. + +## Acceptance Criteria + +- the public request accepts an admission identity, not URI/hash/manifest facts; +- caller-owned package identity fields are unreachable and removed safely; +- response exposes immutable Submission/binding identities without provider URLs; +- Celery payloads contain durable identifiers/version facts only; +- old and new paths cannot coexist or create duplicate business effects. + +## Verification Commands + +Focused API, schema, migration, dispatch, replay, stale-field, coverage, and +hosted Backend/Agent Gates. + +## Required Reviewers + +Architecture, security/auth, product/ops, QA, senior engineering, CI integrity, +reuse/dedup, test delta, and docs. + +## Human Review Focus And Stop Conditions + +Review the clean cut and API compatibility impact. Stop before checker changes. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-06A-checker-input-materialization.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-06A-checker-input-materialization.md index 3ba3ab3db..a45b57f6c 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-06A-checker-input-materialization.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-06A-checker-input-materialization.md @@ -1,6 +1,6 @@ # Chunk Contract: WS-ART-001-06A - Checker Input And Materialization -Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 05 +Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 05B Artifact contract phase: `submission_cutover` diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-07-recovery-live-proof.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-07-recovery-live-proof.md index c81513347..686056995 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-07-recovery-live-proof.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-07-recovery-live-proof.md @@ -1,6 +1,8 @@ # Chunk Contract: WS-ART-001-07 - Real API And Provider Proof -Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 06B +Initiative: `WS-ART-001` | Risk: L1 | Status: Superseded by PLAN3 (`07A`-`08C`) + +Historical design input only. This file is not an executable chunk contract. Artifact contract phase: `checker_cutover` diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-07A-review-packet-materialization.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-07A-review-packet-materialization.md new file mode 100644 index 000000000..85fc35e6f --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-07A-review-packet-materialization.md @@ -0,0 +1,44 @@ +# Chunk Contract: WS-ART-001-07A — Exact Reviewer Packet Materialization + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after XINT-06B + +## Goal + +Provide an authorized, bounded reviewer packet for one exact immutable +Submission without moving review decisions, notes, or routing into ART. + +## Allowed Files + +Existing `ArtifactMaterializationPort.materialize_bindings(...)` and +`BindingMaterializationRequest` convention, immutable reviewer-packet resource +manifest, ArtifactStore/ScratchManager integration, focused tests/docs/CI. + +## Not Allowed Changes + +Review queues, assignments, leases, decisions, findings/note storage, reviewer +artifact upload, contribution lifecycle, generic download, or AUTH activation. + +## Acceptance Criteria + +- packet resolution binds task, Submission, artifact binding, content, manifest, + checker evidence, and locked policy facts; +- fresh fixed reviewer-reader service authority is consumed before provider I/O; +- every full read recomputes and verifies digest and byte count; +- stale/replaced/cross-resource/unverified input fails before byte exposure; +- reviewer decisions remain only `accept`, `needs_revision`, or `reject`, with + their note/findings related to the reviewed immutable Submission aggregate. + +## Verification Commands + +Focused auth, integrity, cross-resource, scratch cleanup, packet provenance, +coverage, and hosted Backend/Agent Gates. + +## Required Reviewers + +Architecture, security/auth, product/ops, QA, senior engineering, CI integrity, +reuse/dedup, test delta, and docs. + +## Human Review Focus And Stop Conditions + +Confirm ART supplies exact bytes only. Stop if reviewer-uploaded evidence or +review lifecycle ownership appears. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-07B-contribution-identity-handoff.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-07B-contribution-identity-handoff.md new file mode 100644 index 000000000..2dcbc8012 --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-07B-contribution-identity-handoff.md @@ -0,0 +1,40 @@ +# Chunk Contract: WS-ART-001-07B — Contribution Artifact Identity Handoff + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 07A + +## Goal + +Expose the immutable accepted Submission artifact identity that CON can record +without provider I/O or ART ownership of contribution lifecycle. + +## Allowed Files + +Typed read-only identity/provenance contract, acceptance-binding guards, +integration tests, docs, and scoped CI evidence. + +## Not Allowed Changes + +Contribution creation/state, compensation, reputation, review acceptance logic, +provider reads, delivery/export, generic download, or AUTH activation. + +## Acceptance Criteria + +- the handoff identifies accepted Review, Submission, binding, content digest, + byte count, manifest digest, and locked policy/checker provenance; +- non-accepted, stale, mismatched, or unverified lineage fails closed; +- the contract performs no provider I/O and grants no byte-reading authority; +- CON remains the owner of ContributionRecord lifecycle. + +## Verification Commands + +Focused identity, accepted-state, cross-resource, no-provider-I/O, coverage, and +hosted Backend/Agent Gates. + +## Required Reviewers + +Architecture, security/auth, product/ops, QA, senior engineering, CI integrity, +reuse/dedup, test delta, and docs. + +## Human Review Focus And Stop Conditions + +Review ownership and provenance. Stop before CON implementation or delivery. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-08A-local-minio-lifecycle-proof.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-08A-local-minio-lifecycle-proof.md new file mode 100644 index 000000000..33d016f3c --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-08A-local-minio-lifecycle-proof.md @@ -0,0 +1,40 @@ +# Chunk Contract: WS-ART-001-08A — Local And MinIO Lifecycle Proof + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 07B + +## Goal + +Prove the v0.1 artifact custody lifecycle through real APIs and durable workers +against LocalStorage and MinIO without weakening production boundaries. + +## Allowed Files + +Bounded proof harness/fixtures/report, provider conformance tests, operations +documentation, scoped CI wiring, and evidence artifacts. + +## Not Allowed Changes + +Product shortcuts, direct database mutation, Terminal Benchmark coupling, AWS +activation, new lifecycle features, generic download, or reduced CI gates. + +## Acceptance Criteria + +- proof covers guide and submission ingest, verification, binding, authorized + materialization, stale/replay/denial cases, and immutable identity continuity; +- LocalStorage and MinIO satisfy one provider-neutral contract; +- proof uses public/internal supported interfaces and sanitized bounded fixtures; +- failures are reproducible and evidence contains no secrets. + +## Verification Commands + +Provider conformance suite, lifecycle drill, report validation, coverage, and +hosted Backend/Agent Gates. + +## Required Reviewers + +Architecture, security, product/ops, QA, senior engineering, CI integrity, +reuse/dedup, test delta, and docs. + +## Human Review Focus And Stop Conditions + +Confirm the proof exercises production boundaries. Stop before AWS readiness. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-08B-aws-production-readiness-proof.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-08B-aws-production-readiness-proof.md new file mode 100644 index 000000000..b3717760e --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-08B-aws-production-readiness-proof.md @@ -0,0 +1,40 @@ +# Chunk Contract: WS-ART-001-08B — AWS S3 Production Readiness Proof + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 08A + +## Goal + +Prove secret-free AWS S3 composition, conditional-write behavior, recovery, and +operational readiness without requiring live credentials in CI. + +## Allowed Files + +AWS provider readiness/conformance harness, composition checks, deployment and +operations documentation, scoped tests/CI evidence. + +## Not Allowed Changes + +Committed credentials, live production mutation, provider-specific product +identity, new ART lifecycle features, delivery/export, or CI gate weakening. + +## Acceptance Criteria + +- production composition selects the existing AWS provider explicitly; +- endpoint, region, addressing, encryption, conditional writes, retries, and + ambiguous-result recovery have deterministic validation; +- logs/evidence redact secrets and provider responses; +- artifact identity remains provider-neutral. + +## Verification Commands + +AWS readiness/conformance checks, configuration/security tests, coverage, and +hosted Backend/Agent Gates. + +## Required Reviewers + +Architecture, security, product/ops, QA, senior engineering, CI integrity, +reuse/dedup, test delta, and docs. + +## Human Review Focus And Stop Conditions + +Confirm operational readiness without hidden live-environment assumptions. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-08C-final-v01-conformance.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-08C-final-v01-conformance.md new file mode 100644 index 000000000..229f83196 --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-08C-final-v01-conformance.md @@ -0,0 +1,45 @@ +# Chunk Contract: WS-ART-001-08C — Final v0.1 Conformance And Closure + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after XINT-08 + +## Goal + +Audit the complete merged ART v0.1 system against approved intent and publish a +bounded closure record without adding product behavior. + +## Allowed Files + +Aggregation of existing ART-08A/08B and XINT-08 evidence, targeted missing +conformance assertions only, stale-contract scans, specifications, initiative +status, review evidence, operations documentation, and CI evidence. Do not +create a third overlapping end-to-end harness. + +## Not Allowed Changes + +New product capability, relaxed limits, auth activation, reviewer evidence +upload, retention/deletion, client delivery, or unrelated cleanup. + +## Acceptance Criteria + +- every v0.1 ART action, service identity, durable state, and provider operation + maps to an approved chunk and live AUTH contract; +- guide, submission, checker, reviewer-packet, and contribution identity chains + preserve exact immutable identity and fail closed; +- no legacy caller-owned artifact path remains reachable; +- coverage floors, migration continuity, docs, and provider proofs pass; +- deferred work is recorded explicitly and is not claimed complete. + +## Verification Commands + +Complete ART conformance suite, stale wording/artifact/auth scans, Markdown +links, coverage gates, migrations, and hosted Backend/Agent Gates. + +## Required Reviewers + +Architecture, security/auth, product/ops, QA, senior engineering, CI integrity, +reuse/dedup, test delta, and docs. + +## Human Review Focus And Stop Conditions + +Approve closure only from merged evidence. Client delivery remains a future +initiative. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-PLAN2-submission-bundle-reconciliation.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-PLAN2-submission-bundle-reconciliation.md index e92cf33bc..095d28312 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-PLAN2-submission-bundle-reconciliation.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-PLAN2-submission-bundle-reconciliation.md @@ -102,9 +102,10 @@ AUTH, task, checker, review, contribution, or delivery behavior. contracts and activation sequence; - the obsolete multi-step upload-session action plan is not reused blindly: AUTH first registers one planned contributor action - `artifact.submission_bundle.prepare` mapped to `submission.create`, ART-04A-C - then implement one hidden continuous orchestration, and AUTH alone activates - that action after exact manifest/guard proof; existing fixed service actions + `artifact.submission_bundle.prepare` mapped to `submission.create`; PLAN3 + supersedes the old ART-04A-C shorthand with 04A1-04B, XINT-002-06A, + 04C1-04C2, then XINT-002-05A activation after exact manifest/guard proof; + existing fixed service actions remain distinct for verification, pending-work scanning, put resolution, checker materialization, and binding; - every implementation successor is PR-sized, names exact allowed/forbidden diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-PLAN3-v01-end-to-end-reconciliation.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-PLAN3-v01-end-to-end-reconciliation.md new file mode 100644 index 000000000..837270a62 --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-PLAN3-v01-end-to-end-reconciliation.md @@ -0,0 +1,71 @@ +# Chunk Contract: WS-ART-001-PLAN3 — v0.1 End-to-End Reconciliation + +Parent initiative: `WS-ART-001` | Risk: L1 | Status: Planning only + +## Goal + +Audit current main and make every remaining ART/AUTH/REV/CON dependency, +ownership boundary, PR boundary, and v0.1 completion proof explicit. + +## Allowed Files + +WS-ART planning artifacts and future contracts; WS-XINT-002 planning artifacts +needed to correct dependency order; related specifications and review evidence. + +## Not Allowed Changes + +Application code, migrations, workflows, action availability, grants, provider +configuration, or successor implementation. + +## Acceptance Criteria + +- merged guide work and the subsequently merged AUTH-04B implementation are + stated accurately; +- every future L1 chunk has one durable/security boundary; +- pre-submit materializer activation precedes contributor preparation; +- reviewer packet and contribution identity handoffs have explicit owners; +- reviewer evidence upload and client delivery are not implied v0.1 work; +- exact remaining order, stop conditions, and final conformance are documented. + +## Verification Commands + +Every successor contract inherits this exact minimum and must add its mapped +focused module before implementation begins; descriptive test prose alone is +not sufficient: + +```bash +(cd backend && .venv/bin/python -m ruff check app tests scripts) +python3 scripts/check_stale_artifact_contracts.py +python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_stale_workstream_wording.py +python3 scripts/check_markdown_links.py +git diff --check +``` + +| Chunk | Required focused test module(s) | +|---|---| +| `04A1` | `tests/test_artifact_architecture.py`, `tests/test_alembic.py` | +| `04A2` | `tests/test_submission_archive.py`, `tests/test_artifact_scratch_manager.py` | +| `04A3` | `tests/test_submission_manifest.py`, `tests/test_submission_change_gate.py` | +| `04B` | `tests/test_submission_precheck.py`, `tests/test_checker_materialization.py` | +| `04C1`-`04C2` | `tests/test_submission_bundle_admission.py`, `tests/test_artifact_verification.py`, `tests/test_artifact_recovery.py` | +| `05A`-`05B` | `tests/test_submission_concurrency.py`, `tests/test_submissions.py`, `tests/test_alembic.py` | +| `06A`-`06B` | `tests/test_checker_materialization.py`, `tests/test_checkers.py` | +| `07A` | `tests/test_review_artifacts.py`, `tests/test_artifact_materialization.py` | +| `07B` | `tests/test_contributions.py`, `tests/test_review_lifecycle.py` | +| `08A`-`08C` | Provider conformance, API drill, AUTH parity, and migration suites named in the existing 08/XINT-08 contracts. | + +Each materially changed subsystem must pass focused `--cov-fail-under=90`. +The exact PR head must pass hosted `Backend / test` at the repository-wide 78 +percent floor and `Agent Gates / agent-gates`; the local machine need not run +the full backend suite. + +## Required Reviewers + +Architecture, security/auth, product/ops, QA, senior engineering, CI integrity, +docs, reuse/dedup, and test delta. + +## Human Review Focus And Stop Conditions + +Confirm the finish line and corrected AUTH order. Stop after planning; every +implementation chunk requires a separate human start. diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-PLAN3-internal-review-evidence.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-PLAN3-internal-review-evidence.md new file mode 100644 index 000000000..a778e5076 --- /dev/null +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-PLAN3-internal-review-evidence.md @@ -0,0 +1,66 @@ +# WS-ART-001 PLAN3 Internal Review Evidence + +Date: 2026-08-02 + +## Scope + +End-to-end v0.1 ART planning reconciliation only. No application code, +migration, action availability, grant, provider configuration, or product +lifecycle behavior changed. + +## Result + +PASS WITH LOW RISKS after corrections. + +## Review Tracks + +| Track | Final result | Material correction | +|---|---|---| +| Architecture | PASS WITH LOW RISKS | Corrected pre-admission resource facts, surviving chunk dependencies, feature/resource ownership versus activation custody, and custody cardinality. | +| Security/auth | PASS | Removed every live v0.1 reviewer-evidence activation path and fixed XINT-06 ordering. | +| Product/ops | PASS WITH LOW RISKS | Preserved one contributor ZIP per Submission, reviewer decision plus note/findings, capacity-charged admissions, and CON ownership. | +| QA | PASS WITH LOW RISKS | Corrected stale entry gates and terminology; deterministic doc gates pass. | +| Senior engineering | PASS WITH LOW RISKS | Split broad L1 chunks and marked replaced contracts historical/non-executable. | +| CI integrity | PASS WITH LOW RISKS | No CI weakening; PLAN3 pins focused 90 percent and hosted 78 percent/Agent Gates evidence. | +| Docs | PASS WITH LOW RISKS | Reconciled ART, AUTH, XINT, REV, and normative specifications. | +| Reuse/dedup | PASS after corrections | ART-07A reuses the existing materialization port/request convention; final closure aggregates existing proof. | +| Test delta | PASS WITH LOW RISKS | Added exact shared commands, focused test-module map, crossed-state packet tests, and coverage floors. | + +## Resolved Blocking Findings + +- Replaced the incorrect durable-admission fact at pre-submit materialization + with the process-local prepared-bundle/scratch generation. +- Made `XINT-002-06A` a prerequisite of contributor preparation and separated + later post-submit/output activation into `06B`. +- Split the remaining broad ART chunks at durable/security boundaries. +- Kept `artifact.review_evidence.binding.create` planned and unavailable; + reviewer v0.1 behavior is decision plus note/findings, and a contributor + revision is a new outer ZIP through the normal revision path. +- Assigned reviewer packet access to ART capability, review lifecycle to REV, + accepted artifact identity to the CON handoff, and client delivery to a + future separately approved initiative. +- Distinguished feature resource ownership, runtime catalogue ownership, and + XINT activation custody throughout the planning corpus. + +## Verification + +Passed: + +```text +git diff --check +python3 scripts/check_stale_artifact_contracts.py +python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_stale_workstream_wording.py +python3 scripts/check_markdown_links.py +``` + +No backend suite was run because this is a planning/docs-only change and the +user requested avoiding full local tests on the constrained machine. + +## Residual Low Risks + +- Historical review records retain superseded design discussion for provenance; + executable contracts and normative specifications now state the replacement. +- Each successor must read PLAN3 and finalize any chunk-specific new test file + name before implementation; PLAN3 supplies the mandatory minimum commands, + mapped modules, crossed-state expectations, and coverage floors. diff --git a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md index 2a3185ea7..40c6f204f 100644 --- a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md +++ b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md @@ -45,20 +45,20 @@ mappings, and availability must remain identical. | `WS-XINT-002-04B` | Active: `artifact.guide_source.read`, `artifact.guide_source.binding.create` | | `WS-XINT-002-04A` | Active: `artifact.guide_source.ingest` | | `WS-XINT-002-05A` | Planned: `artifact.submission_bundle.prepare` | -| `WS-AUTH-001-ART-04B` | Planned: `artifact.pre_submit.checker_input.materialize` | -| `WS-AUTH-001-ART-05` | Planned: `artifact.submission.binding.create` | -| `WS-AUTH-001-ART-06A` | Planned: `artifact.post_submit.checker_input.materialize` | -| `WS-AUTH-001-ART-06B` | Planned: `artifact.checker_output.write`, `artifact.checker_output.binding.create` | -| `WS-XINT-002-07` | Planned: `artifact.review_packet.materialize`, `artifact.review_evidence.binding.create` | +| `WS-XINT-002-06A` | Planned: `artifact.pre_submit.checker_input.materialize` | +| `WS-XINT-002-05B` | Planned: `artifact.submission.binding.create` | +| `WS-XINT-002-06B` | Planned: `artifact.post_submit.checker_input.materialize`, `artifact.checker_output.write`, `artifact.checker_output.binding.create` | +| `WS-XINT-002-07A` | Planned: `artifact.review_packet.materialize` only | +| Future REV-owned activation, not approved for v0.1 | Planned/unavailable: `artifact.review_evidence.binding.create` | -Runtime owner `WS-XINT-002-07` contains two planning sub-waves: 07A is the -only availability transition and initially permits finding slots; 07B changes -no availability and only extends the evaluator to response slots. +Runtime owner `WS-XINT-002-07` retains catalogue custody. The only approved +v0.1 availability transition is 07A packet materialization. Evidence binding +remains planned and unavailable pending a separate REV-owned intent. `WS-AUTH-001-ART-CUSTODY` historically transferred 25 rows. WS-XINT-002-01 reconciles the live catalogue by removing the six unused multi-step upload rows and registering three end-to-end bundle/review rows. The resulting 22 rows have -exact owner cardinalities `3/8/2/1/1/1/1/1/2/2` in the table order above. The +exact action cardinalities `3/8/2/1/1/1/1/3/1/1` in the table order above. The `OPERATOR` suffix denotes only future activation custody; it grants no Operator entitlement. Sixteen actions remain planned after the three ART foundation service actions, `artifact.guide_source.ingest`, and the two fixed-service @@ -138,9 +138,9 @@ fresh replay. Counts are derived from trusted `main` when a gate executes. REV registration adds exactly four planned actions and zero active actions. WS-XINT-002-01 registers review-evidence binding under runtime owner `WS-XINT-002-07`; planned -sub-wave 07A adds it to the -existing `workstream.artifact.binding` static row without adding an identity or -database grant. +and unavailable. It may remain named in the closed +`workstream.artifact.binding` static matrix, but 07A does not activate or extend +it. Any activation requires a separate approved REV-owned intent. ## Prepared mutation prerequisite diff --git a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md index 0ccc9aa9c..464d7f853 100644 --- a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md @@ -88,11 +88,10 @@ feature manifest exists, then requires a separate explicit start. | `WS-AUTH-001-ART-02D-INTERNAL` | ART 02D Internal Action Activation | L1 | Feature-gated | | `WS-AUTH-001-ART-02D-OPERATOR` | ART 02D Operator Read/Status And Independently Evaluated Retry Activation | L1 | Feature-gated | | `WS-AUTH-001-ART-03` | ART 03 Guide Source Action Activation | L1 | Feature-gated | -| `WS-XINT-002-05A` | Submission Bundle Preparation Activation | L1 | Feature-gated on complete ART-04A-C hidden behavior | -| `WS-AUTH-001-ART-04B` | ART 04B Pre-Submit Materialization Activation | L1 | Feature-gated | -| `WS-AUTH-001-ART-05` | ART 05 Submission Binding Activation | L1 | Feature-gated | -| `WS-AUTH-001-ART-06A` | ART 06A Post-Submit Materialization Activation | L1 | Feature-gated | -| `WS-AUTH-001-ART-06B` | ART 06B Checker Output Action Activation | L1 | Feature-gated | +| `WS-XINT-002-06A` | Pre-Submit Materialization Activation | L1 | After hidden ART-04B; before 05A | +| `WS-XINT-002-05A` | Submission Bundle Preparation Activation | L1 | Feature-gated on complete ART-04A1-04C2 hidden behavior and 06A | +| `WS-XINT-002-05B` | Submission Binding Activation | L1 | Feature-gated on hidden ART-05A | +| `WS-XINT-002-06B` | Post-Submit Materialization And Checker Output Activation | L1 | Feature-gated on ART-06A/06B | | `WS-AUTH-001-REV-05` | REV 05 Queue Read Activation | L1 | Feature-gated | | `WS-AUTH-001-REV-06` | REV 06 Claim Lease And Expiry Activation | L1 | Feature/service-gated | | `WS-AUTH-001-REV-07` | REV 07 Context Chain And Finding Evidence Activation | L1 | Feature/ART-gated | @@ -101,8 +100,8 @@ feature manifest exists, then requires a separate explicit start. | `WS-AUTH-001-REV-11` | REV 11 Recovery And Reconciliation Activation | L1 | Feature/service-gated | | `WS-AUTH-001-REV-12` | REV 12 Artifact Reconciliation And Projection Activation | L1 | Feature/service-gated | | Historical alias `WS-AUTH-001-REV-LIFECYCLE` | Superseded by `WS-XINT-003-08A` and `WS-XINT-003-08B` activation | L1 | Not executable; use canonical XINT-003 custody | -| `WS-XINT-002-07A` (runtime owner `WS-XINT-002-07`) | Review Packet And Finding Evidence Binding Activation | L1 | Feature-gated on exact REV lease/version and ART finding evidence behavior | -| `WS-XINT-002-07B` (runtime owner `WS-XINT-002-07`) | Response Evidence Binding Evaluator Extension (no availability change) | L1 | 07A plus exact human revision obligation/preparation | +| `WS-XINT-002-07A` (runtime owner `WS-XINT-002-07`) | Review Packet Materialization Activation Only | L1 | Feature-gated on exact REV lease/version and ART packet behavior | +| `WS-XINT-002-07B` (runtime owner `WS-XINT-002-07`) | Reserved future review-evidence binding | L1 | Not approved for v0.1 | ## Dependency order diff --git a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md index 699d80114..0ea16ac2f 100644 --- a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md +++ b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md @@ -352,10 +352,10 @@ Initial and revision submissions share the same `submission.create` action, permission, and route. There is no `submission.revise`, `review.assign`, `review_revision.record`, or separately callable revision-preparation action. Revision preparation is an internal participant and lifecycle guard of the -canonical submission command. Finding and finding-response evidence intake use -distinct actions mapped to existing `review.decision` and `submission.create` -permissions because each is a protected human command that can create artifact -state before the final transaction. +canonical submission command. The earlier finding/finding-response artifact +intake design is superseded for v0.1: reviewers store note/findings, and the +contributor's next outer ZIP is the revision artifact. Related evidence actions +remain planned/unavailable pending separate REV-owned intent. `artifact_recovery.request` is rejected. Operator recovery consumes the already registered `artifact.verification_job.retry` action through the ART-owned @@ -566,11 +566,10 @@ principal, typed context, facts, guards, surfaces, transaction ownership, and hidden dependency manifests. Registration is planned and availability-neutral, uses existing PermissionIds, and adds typed/PostgreSQL evidence parity. -The review-evidence binding action extends only -`workstream.artifact.binding`, making 12 exact matrix memberships across the -same seven identities. Its activation requires separate human and service -decisions, two evidence records, explicit lock order, and one transaction; a -human request is never silently converted to service authority. REV timer, +The review-evidence binding action remains a future planned/unavailable member +of the closed `workstream.artifact.binding` matrix. It has no approved v0.1 +activation; a separate REV-owned intent must define any future human/service +transaction. REV timer, expiry, reconciliation, projection, artifact-reference, and release-control services require later exact identity-specific contracts. No catch-all service identity is pre-created. diff --git a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/RISKS.md b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/RISKS.md index 7b8fff455..b32563d3c 100644 --- a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/RISKS.md +++ b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/RISKS.md @@ -1,8 +1,8 @@ # Risks: WS-AUTH-001 - Workstream Authorization Service -Planned REV custody permits only the reconciled XINT-003-02 policy-writer path -and designates XINT-002-07A as the sole evidence-binding availability -transition, with 07B evaluator-only. These are planning rules, not current +Planned REV custody permits only the reconciled XINT-003-02 policy-writer path. +XINT-002-07A may activate reviewer packet materialization only; evidence +binding remains planned/unavailable and 07B is reserved. These are planning rules, not current runtime protections; enforcement begins only when the named activation gates merge and activate their exact actions. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md index 8cde9daa1..c8239bcd1 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md @@ -330,10 +330,12 @@ are: - 05A online checker admission; 05B server-selected reviewer/admin reads. Historical admission classification/scan belongs to 11C reconciliation. - 06A claim/freeze; 06B release/decline/preferences; 06C expiry/lazy recovery. -- 07A lease-bounded context; 07B reviewer finding evidence only. +- 07A lease-bounded context and packet; 07B reviewer decision note/findings, + with no reviewer artifact upload. - 08 pure decision schemas, validation, and typed participant inputs only. - 09A1 Review-rooted preparation schema; 09A2 preparation resolver and Task - Context; 09A3 human response evidence; 09A4 internal prepared human N+1 plus + Context; 09A3 revision-obligation response metadata only (no separate + artifact upload); 09A4 internal prepared human N+1 plus the exact source XOR that consumes the owner's immutable checker-remediation `remediation_source_checker_run_id`; 09A5 replacement-assignment transfer; 09B replay/resolution/return routing. diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md index 232cf0683..88860402f 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md @@ -1,26 +1,27 @@ # Chunk Map: WS-XINT-002 ART-AUTH End-to-End Contract -| Chunk | Purpose | Risk | Dependency | +| Chunk | Purpose | Risk | Dependency/status | |---|---|---|---| -| `WS-XINT-002-01` | Reconcile the entire ART catalogue, permissions, owners, migration parity, and fixed-service matrix while every new action stays planned. | L1 | approved plan | -| `WS-XINT-002-02` | Close the reusable PREP-to-ART operation interface: opaque prepared authority on durable mutation requests, no obsolete upload-session port, and no action activation. | L1 | 01 | -| `WS-XINT-002-03` | Activate verifier, scheduler scan, and put resolver services from merged ART recovery evidence. | L1 | 02 plus ART 02C/02D evidence | -| `WS-XINT-002-04A` | Activate Project Manager guide ingest through the one opaque PREP seam. | L1 | 02 plus merged ART 03A PREP-compatible evidence | -| `WS-XINT-002-04B` | Activate fixed-service guide binding and guide read. | L1 | 04A plus merged ART 03B evidence | -| `WS-XINT-002-05A` | Activate initial contributor bundle preparation and durable ready admission. | L1 | 02 plus ART 04A-C evidence | -| `WS-XINT-002-05B` | Activate fresh human Submission creation plus fixed artifact binding with exactly-once admission consumption. | L1 | 05A plus ART 05/TASK evidence | -| `WS-XINT-002-05C` | Activate checker-remediation submission preparation/creation against one final CheckerRun. | L1 | 05B plus checker remediation evidence | -| `WS-XINT-002-05D` | Activate human-review revision preparation/creation against exact revision obligations. | L1 | 05B plus REV revision-preparation evidence | -| `WS-XINT-002-06` | Activate pre/post-submit materialization and checker output/binding. | L1 | 02 plus ART 04B/06A/06B evidence | -| `WS-XINT-002-07A` | Activate lease-scoped packets and the one evidence-binding ActionId for reviewer-finding slots; response slots hard deny. | L1 | 02 plus merged ART/REV lease/finding manifests | -| `WS-XINT-002-07B` | Extend the active evidence-binding evaluator to exact human-revision response slots; no availability change. | L1 | 07A plus merged hidden REV obligation/preparation behavior; precedes XINT-003-07 activation | -| `WS-XINT-002-08` | Prove complete catalogue, least privilege, revocation, replay, concurrency, audit, and live lifecycle conformance. | L1 | 03-07B including 05A-D | +| `01` | Reconcile ART catalogue, permissions, owners, migration parity, and fixed matrix. | L1 | Merged | +| `02` | Close reusable opaque PREP-to-ART operation interface. | L1 | Merged | +| `03` | Activate verifier, scheduler scan, and put resolver. | L1 | Merged | +| `04A` | Activate Project Manager guide ingest. | L1 | Merged/active | +| `04B` | Activate fixed-service guide binding and read. | L1 | Merged/active in PR #245 (`6babf81b`) | +| `06A` | Activate only pre-submit checker-input materialization. | L1 | Hidden ART-04B evidence; must precede 05A | +| `05A` | Activate initial contributor preparation and durable ready admission. | L1 | 06A plus ART-04A1-04C2 evidence | +| `05B` | Activate fresh human Submission creation plus fixed binding/consumption. | L1 | 05A plus ART-05A/TASK evidence | +| `05C` | Activate checker-remediation submission context. | L1 | 05B plus checker remediation evidence | +| `05D` | Activate human-review revision context. | L1 | 05B plus REV revision-obligation evidence | +| `06B` | Activate post-submit materialization and checker output write/binding. | L1 | ART-06A/06B evidence | +| `07A` | Activate lease-scoped reviewer packet materialization only. | L1 | ART-07A plus REV lease/packet evidence | +| `07B` | Reserved review-evidence binding gate; keep unavailable absent new approved REV intent. | L1 | Future approved REV evidence-upload contract, if any | +| `08` | Prove complete catalogue, least privilege, revocation, replay, concurrency, audit, and lifecycle conformance. | L1 | All activated v0.1 waves | -Chunks 03-07B may be split only by the evidence boundaries named above. The -guide wave is therefore fixed as 04A after ART-03A and 04B after ART-03B. A split -cannot add catalogue values, permissions, identities, matrix rows, or a second -runtime protocol; such a discovery is contract drift and returns to planning. -Each activation chunk owns its exact feature resource contexts, non-forgeable -session/root-bound composer proof, lock order, stale-fact matrix, and crossed -race tests. Those facts must not be front-loaded into AUTH before the owning -feature behavior exists. +The split 06 ordering is mandatory: contributor preparation cannot activate +while its fixed pre-submit materializer still denies. Review packet authority +does not imply reviewer evidence upload or generic artifact download. + +Each activation chunk owns exact feature resource contexts, session/root-bound +composer proof, lock order, stale-fact matrix, and crossed-race tests. A chunk +cannot add catalogue values, permissions, identities, matrix rows, or another +runtime protocol; that discovery returns to planning. diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/DECISIONS.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/DECISIONS.md index 3f3387681..a713b9d38 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/DECISIONS.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/DECISIONS.md @@ -26,3 +26,7 @@ resource contexts, locks, and race proof belong to chunks 03-07 and 05A-D. 11. Initiative status records durable merged facts and reviewed delivery order, never transient “active” or “merge-pending” branch state. +12. Pre-submit materialization activates before contributor preparation; + post-submit materialization and checker output/binding activate later. +13. Reviewer packet activation does not imply reviewer evidence upload or + binding. That action remains planned without separately approved REV intent. diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md index 248675fbe..b49d895ce 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md @@ -11,14 +11,21 @@ evidence-gated activation waves: their evidence-backed activation chunks. 3. Activate fixed internal recovery services before any durable provider work. 4. Activate guide ingest/use only after the matching hidden ART behavior. -5. Activate initial contributor preparation, then atomic Submission/binding - consumption, then checker-remediation and human-review revision variants as - separate reviewable gates. -6. Activate checker materialization/output only after exact checker behavior. -7. Activate reviewer packet and evidence binding only after both ART and REV - provide their hidden typed facts and lease/revision guards. +5. Activate pre-submit checker materialization after hidden ART-04B, then + activate initial contributor preparation only after the complete hidden + ready-admission path exists. +6. Activate atomic Submission/binding consumption, then post-submit checker + materialization/output after exact ART/CHECKER behavior; remediation and + human-review revision contexts remain separate gates. +7. Activate reviewer packet materialization only after ART and REV provide the + hidden typed facts and lease guards. Keep evidence binding unavailable. 8. Run end-to-end conformance and crossed-state proof. +The 2026-08-02 ART audit corrects two future waves: split chunk 06 into 06A +pre-submit materialization before XINT-05A and 06B post-submit/output after +ART-06A/06B; activate reviewer packet materialization independently while +review-evidence binding remains planned absent separately approved REV intent. + Registration is deliberately complete up front. Activation remains separate because AUTH cannot safely allow an action until the protected implementation, resource composer, and denial tests exist. Each activation chunk may only @@ -55,6 +62,14 @@ change its availability; it may not invent another action or permission. | `artifact.review_packet.materialize` | `artifact.review_packet.materialize` | `workstream.artifact.materializer` | | `artifact.review_evidence.binding.create` | `artifact.binding.create` | `workstream.artifact.binding` | +The canonical set records catalogue custody, not approval to activate every +row. For v0.1, `review.finding_evidence.ingest`, +`review.finding_response_evidence.ingest`, and +`artifact.review_evidence.binding.create` remain planned/unavailable future +rows. Reviewers record a decision plus note/findings without uploading an +artifact. Only `artifact.review_packet.materialize` is in the approved reviewer +artifact activation sequence. + The existing bounded Operator actions remain unchanged. Fixed recovery services execute recovery; Operators request retry/reconciliation and inspect bounded state. There is no generic artifact-download action. diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md index 32aad2753..2874eca4e 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md @@ -26,3 +26,12 @@ That rule prevents a merged PR from carrying stale pre-merge prose onto `main`. The durable successor order remains in `CHUNK_MAP.md`; this status file does not duplicate a transient “next chunk” pointer that becomes stale at merge. + +## 2026-08-02 Planning Correction + +04A is merged and active. 04B production implementation merged in PR #245 at +`6babf81b`; guide read and binding are active for their fixed services. +Future chunk 06 must split: 06A activates pre-submit materialization before +05A, and 06B later activates post-submit materialization plus checker output +write/binding. Reviewer packet activation is independent; review-evidence +binding remains planned without approved reviewer-upload intent. diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-05A-initial-submission-preparation.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-05A-initial-submission-preparation.md index 961ee21db..35237856a 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-05A-initial-submission-preparation.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-05A-initial-submission-preparation.md @@ -1,5 +1,8 @@ # Chunk Contract: WS-XINT-002-05A Initial Submission Preparation +Entry gate: merged `WS-XINT-002-06A` pre-submit materializer activation and +complete hidden ART-04A1 through ART-04C2 evidence. + ## Goal Activate one-ZIP preparation through one durable ready admission for an initial submission. diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06-checker-activation.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06-checker-activation.md index 385fd6b8c..fa4bf6d1d 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06-checker-activation.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06-checker-activation.md @@ -1,4 +1,8 @@ -# Chunk Contract: WS-XINT-002-06 Checker Authorization Activation +# Chunk Contract: WS-XINT-002-06 — Checker Authorization Activation (Superseded) + +Status: Superseded by `WS-XINT-002-06A` and `WS-XINT-002-06B`. The original +contract could activate contributor preparation before its mandatory +pre-submit materializer and combined two independently reviewable boundaries. ## Goal diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06A-pre-submit-materialization-activation.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06A-pre-submit-materialization-activation.md new file mode 100644 index 000000000..c1b46f956 --- /dev/null +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06A-pre-submit-materialization-activation.md @@ -0,0 +1,43 @@ +# Chunk Contract: WS-XINT-002-06A — Pre-Submit Materialization Activation + +Parent initiative: `WS-XINT-002` | Risk: L1 | Status: Proposed after ART-04B + +## Goal + +Activate only the fixed pre-submit checker materializer before contributor +preparation can become available. + +## Allowed Files + +AUTH catalogue/matrix/composition, ART authorization adapter/resource facts, +pre-submit checker materialization integration, focused tests/docs/CI evidence. + +## Not Allowed Changes + +Contributor preparation activation, post-submit reads, checker output writes or +bindings, human checker authority, generic artifact reads, or new ActionIds. + +## Acceptance Criteria + +- only `artifact.pre_submit.checker_input.materialize` changes availability; +- only the fixed pre-submit materializer identity may prepare and consume it; +- authority binds the process-local prepared-bundle/scratch generation, + task/project/guide/locked policy, archive/manifest, checker definition, + request, session, and transaction facts; no durable admission exists yet; +- denial/replay/stale/cross-resource cases fail before scratch exposure; +- prepared handles never enter Celery payloads. + +## Verification Commands + +Focused AUTH/ART/checker tests, stale auth/artifact scans, coverage, and hosted +Backend/Agent Gates. + +## Required Reviewers + +Architecture, security/auth, product/ops, QA, senior engineering, CI integrity, +reuse/dedup, test delta, and docs. + +## Human Review Focus And Stop Conditions + +Confirm this one activation precedes XINT-05A. Stop before contributor or +post-submit action activation. diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06B-post-submit-checker-activation.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06B-post-submit-checker-activation.md new file mode 100644 index 000000000..0d33fffd3 --- /dev/null +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06B-post-submit-checker-activation.md @@ -0,0 +1,42 @@ +# Chunk Contract: WS-XINT-002-06B — Post-Submit Checker Activation + +Parent initiative: `WS-XINT-002` | Risk: L1 | Status: Proposed after ART-06B + +## Goal + +Activate the fixed post-submit materializer and checker output write/binding +actions after their complete hidden ART/CHECKER behavior exists. + +## Allowed Files + +AUTH catalogue/matrix/composition, ART/CHECKER authorization adapters and exact +resource facts, focused tests/docs/CI evidence. + +## Not Allowed Changes + +Pre-submit or contributor action changes, review actions, generic artifact +reads, Submission consumption, or new ActionIds. + +## Acceptance Criteria + +- only post-submit materialization and checker output write/binding actions + change availability; +- fixed identities are distinct and cannot substitute for each other; +- facts bind Submission, binding/content/manifest, CheckerRun, checker role, + generated commitment, request, session, and transaction; +- denial/replay/stale/cross-resource cases precede byte exposure or mutation; +- no prepared handle is serialized. + +## Verification Commands + +Focused AUTH/ART/CHECKER tests, stale auth/artifact scans, coverage, and hosted +Backend/Agent Gates. + +## Required Reviewers + +Architecture, security/auth, product/ops, QA, senior engineering, CI integrity, +reuse/dedup, test delta, and docs. + +## Human Review Focus And Stop Conditions + +Confirm service separation and exact facts. Stop before reviewer activation. diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07-review-artifact-activation.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07-review-artifact-activation.md index cc0b24d8a..25069fdfc 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07-review-artifact-activation.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07-review-artifact-activation.md @@ -7,15 +7,14 @@ Superseded before implementation by `WS-XINT-002-07A` and ## Split invariant -07A is the only availability transition: it activates packet materialization -and the one evidence-binding ActionId for reviewer-finding slots while hard- -denying response-slot shapes. 07B changes no ActionId availability and extends -only that evaluator after an exact human revision obligation and preparation -exist. Human REV actions stay with XINT-003; shared submission actions stay -with XINT-002-05D. - -Everything below is the historical combined design input allocated between 07A -and 07B. It is retained for provenance and is not executable as one chunk. +07A is the only approved v0.1 availability transition and activates packet +materialization only. `artifact.review_evidence.binding.create` remains planned +and unavailable. 07B is reserved pending a separately approved REV-owned +evidence-upload intent. Human REV actions stay with XINT-003; shared submission +actions stay with XINT-002-05D. + +Everything below is historical combined design input. It is retained for +provenance and is not executable as one chunk or approved v0.1 behavior. ## Risk class diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07A-reviewer-artifact-activation.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07A-reviewer-artifact-activation.md index 52603d8b4..cd4718f35 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07A-reviewer-artifact-activation.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07A-reviewer-artifact-activation.md @@ -2,20 +2,44 @@ ## Goal -Activate exact lease-scoped packet materialization and the single evidence-binding ActionId for reviewer-finding slots only. +Activate exact lease-scoped packet materialization only. ## Boundary -This is the only availability transition for `artifact.review_evidence.binding.create`. It also activates `artifact.review_packet.materialize`. The fixed identities are `workstream.artifact.binding` and `workstream.artifact.materializer`. Human review actions remain with XINT-003. +This activates `artifact.review_packet.materialize` for the fixed reviewer-reader +service after ART-07A exists. Human review actions remain with XINT-003. +`artifact.review_evidence.binding.create` remains planned and unavailable; the +approved v0.1 reviewer workflow records a decision plus note/findings and does +not upload a reviewer revision artifact. ## Acceptance criteria - Packet materialization binds reviewer reference, active lease, packet manifest, Submission, checker, guide/policy, verified content, session, transaction, request, and decision evidence. -- Evidence binding accepts only server-derived `reviewer_finding` mode with the exact lease/finding slot and verified content commitment. -- `contributor_response` and every CheckerRun-rooted remediation shape hard deny even when the ActionId is active. +- Reviewer evidence binding and contributor-response artifacts remain denied. - Wrong, stale, revoked, replayed, copied, or cross-resource facts deny before byte disclosure or durable mutation. - Human and fixed-service evidence commits atomically with the protected REV/ART operation. Prepared handles never enter a job payload. ## Stop Do not add response-slot evaluation or activate human REV actions. + +## Verification + +```bash +(cd backend && .venv/bin/python -m ruff check app tests scripts) +(cd backend && WORKSTREAM_TEST_DATABASE_URL= .venv/bin/pytest tests/test_authorization.py tests/test_review_artifacts.py tests/test_artifact_materialization.py -q --cov=app.modules.authorization --cov=app.modules.artifacts --cov=app.modules.reviews --cov-report=term-missing --cov-fail-under=90) +python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_stale_artifact_contracts.py +python3 scripts/check_markdown_links.py +git diff --check +``` + +Tests must cover stale/expired lease, revoked reviewer/link, wrong fixed service, +copied/replayed handle, cross-Submission request, and denial before byte +disclosure. The exact PR head must pass hosted `Backend / test` and +`Agent Gates / agent-gates` without lowering the 78/90 coverage floors. + +## Required reviewers + +Architecture, security/auth, product/ops, QA, senior engineering, CI integrity, +reuse/dedup, test delta, and docs. diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07B-response-artifact-extension.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07B-response-artifact-extension.md index 5768a81d5..bbe856651 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07B-response-artifact-extension.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07B-response-artifact-extension.md @@ -1,19 +1,26 @@ -# Chunk Contract: WS-XINT-002-07B — Response Artifact Evaluator Extension +# Reserved Contract: WS-XINT-002-07B — Future Review Evidence Binding + +Status: Not approved for v0.1. `artifact.review_evidence.binding.create` +remains planned and unavailable. ## Goal -Extend the already-active `artifact.review_evidence.binding.create` evaluator to human-revision response slots after the exact REV obligation and preparation exist. +Preserve the future design question for review-evidence or contributor-response +artifacts without creating an implementation or activation path. ## Boundary -This chunk changes no ActionId availability, registers no action, and creates no identity. It reuses `workstream.artifact.binding` and the existing opaque transaction-bound prepared authorization. Human response authority remains with XINT-003-07; shared Submission actions remain with XINT-002-05D. +No implementation may begin until a separate REV-owned intent defines why an +uploaded evidence artifact is required, its lifecycle, and its relationship to +the approved reviewer decision plus note/findings workflow. ## Acceptance criteria -- Server-derived `contributor_response` mode binds `Review(needs_revision)`, unresolved finding/response slot, obligation, preparation head/digest, contributor assignment, predecessor Submission, deadline/round, guide/policies, verified content, session, transaction, request, and decision evidence. -- CheckerRun-rooted remediation, wrong service/action/mode, stale preparation, predecessor advancement, expired/exhausted obligation, copied/replayed handle, and cross-resource facts fail closed before durable mutation. -- ART binding and the human REV mutation commit or roll back together. The binding service cannot create a Submission or inherit contributor authority. +- no ActionId availability changes; +- reviewer packet access remains independent from evidence binding; +- reviewer decisions and note/findings require no artifact upload; +- any future activation requires a new reviewed contract and explicit human approval. ## Stop -Do not change catalogue availability or add generic artifact access. +Do not implement or activate this reserved capability in v0.1. diff --git a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-08-conformance.md b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-08-conformance.md index de8c307f1..3e74a83bb 100644 --- a/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-08-conformance.md +++ b/.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-08-conformance.md @@ -40,7 +40,8 @@ redesign, or gate weakening. availability, resource type, service membership, and human/service isolation. - Live proof covers guide ingest/use, initial and revision submission, checker remediation submission, human-review revision submission, checker input/output, - reviewer packet/evidence, recovery, Operator reads/retry, and bounded audit behavior. + reviewer packet materialization, recovery, Operator reads/retry, and bounded + audit behavior; reviewer evidence binding remains unavailable. - Crossed proof covers actor/link/grant/assignment/lease revocation, action disablement, stale guide/policy/predecessor/version facts, concurrent consume, transaction replacement, evidence/participant/commit failure, timeout, and diff --git a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/ACTION_CUSTODY.md b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/ACTION_CUSTODY.md index 67f8496e8..153ec03b7 100644 --- a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/ACTION_CUSTODY.md +++ b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/ACTION_CUSTODY.md @@ -15,10 +15,10 @@ This table is the planning source of truth for the v0.1 review and human-revisio | `review.preference_expiry.run` | `operations.timer.run` | fixed preference-expiry service only | due preference row | REV | registered planned | `WS-XINT-003-03B` | | `review.lease_expiry.run` | `operations.timer.run` | fixed lease-expiry service only | due ReviewLease | REV | registered planned | `WS-XINT-003-03B` | | `review.context.read` | `submission.read_for_review` | owning reviewer and active exact lease | immutable packet/context | REV | registered planned | `WS-XINT-003-04` | -| `review.finding_evidence.ingest` | `review.decision` | owning reviewer and active exact lease | finding slot + verified commitment | REV | registered planned | `WS-XINT-003-04` | +| `review.finding_evidence.ingest` | `review.decision` | future reviewer evidence-upload scope | future evidence slot | REV | registered planned/unavailable | future separate REV-owned intent | | `review.chain.read` | `review.chain.read` | owning reviewer and active exact lease | bounded task/Submission review chain | REV | registered planned | `WS-XINT-003-05` | | `review.decision` | `review.decision` | owning reviewer and active exact lease | Review + findings/resolutions + lifecycle effects | REV | registered planned | `WS-XINT-003-06` | -| `review.finding_response_evidence.ingest` | `submission.create` | assigned contributor; exact human-revision obligation | response slot + preparation + predecessor | REV | registered planned | `WS-XINT-003-07` | +| `review.finding_response_evidence.ingest` | `submission.create` | future contributor evidence-upload scope | future response evidence slot | REV | registered planned/unavailable | future separate REV-owned intent | | `review.queue.inspect` | `review.queue.inspect` | Operator; bounded/redacted operational scope | queue operational view | REV | registered planned | `WS-XINT-003-08A` | | `review.lease.force_release` | `review.lease.force_release` | Operator; canonical reason required | exact ReviewLease | REV | registered planned | `WS-XINT-003-08A` | | `review.queue.routing.override` | `review.queue.override` | Operator; canonical reason required | exact queue entry/routing state | REV | registered planned | `WS-XINT-003-08A` | @@ -45,7 +45,7 @@ The 19 registered `review.*` rows move from historical `AUTH_REV_*` planning lab | `review.artifact_reference.reconcile` | `workstream.review.artifact_reference_reconciliation` | this action only | `artifact_reference`; bounded review/reference shard | every human and all other services | identity, reference IDs, reason, cursor, request/idempotency, decision event | | `review.projection.rebuild` | `workstream.review.projection` | this action only | `projection_rebuild`; named projection/shard | every human and all other services | identity, projection, watermark, cursor, request/idempotency, decision event | | `artifact.review_packet.materialize` | `workstream.artifact.materializer` | global matrix also contains pre/post-submit materialization; this is its review-surface action | exact active-lease packet manifest | every human and all other services | actor/link, lease/packet/Submission/content, digests, request/transaction, decision event | -| `artifact.review_evidence.binding.create` | `workstream.artifact.binding` | global matrix also contains guide/submission/checker binding; this is its review-surface action | 07A `reviewer_finding`; 07B adds `contributor_response`; exact slot/content | every human and all other services; response mode denied until 07B | identity, mode, review/lease or obligation/preparation, slot/content, request/transaction, decision event | +| `artifact.review_evidence.binding.create` | `workstream.artifact.binding` | future ART review-surface action | no approved v0.1 mode; planned/unavailable | every principal | future REV-owned contract required before implementation | The six proposed REV identities are fixed planning names; they are not provisioned or admitted until their activation chunks. Celery payloads contain identifiers and provenance only, and every command prepares fresh authority inside its transaction. @@ -54,7 +54,7 @@ The six proposed REV identities are fixed planning names; they are not provision | ActionId | PermissionId | Principal/resource constraint | Runtime owner and planned wave | |---|---|---|---| | `artifact.review_packet.materialize` | `artifact.review_packet.materialize` | fixed ART materializer; exact active-lease packet | runtime `WS-XINT-002-07`; activation sub-wave `07A` | -| `artifact.review_evidence.binding.create` | `artifact.binding.create` | fixed ART binding service; exact finding/response slot | runtime `WS-XINT-002-07`; availability sub-wave `07A`, evaluator extension `07B` | +| `artifact.review_evidence.binding.create` | `artifact.binding.create` | future fixed ART binding service only | runtime catalogue custody `WS-XINT-002-07`; no approved activation wave | | `artifact.submission_bundle.prepare` | `submission.create` | assigned contributor; exact human-revision preparation | availability `WS-XINT-002-05A`; revision-context evaluator extension `05D` | | `submission.create` | `submission.create` | assigned contributor; exact prepared human revision | availability `WS-XINT-002-05B`; revision-context evaluator extension `05D` | @@ -73,10 +73,10 @@ These actions are not XINT-003 custody. Generic artifact download, adjudication, | `review.preference_expiry.run` | merged hidden REV-06 preference timer command | | `review.lease_expiry.run` | merged hidden REV-06 lease timer command | | `review.context.read` | merged hidden REV-07 context/packet membership plus XINT-002-07A packet materialization | -| `review.finding_evidence.ingest` | merged hidden REV-07 finding-slot behavior plus XINT-002-07A finding binding | +| `review.finding_evidence.ingest` | future only; approved v0.1 records note/findings without uploaded evidence | | `review.chain.read` | merged hidden REV-07 bounded chain behavior plus active context boundary | | `review.decision` | merged hidden REV-08 decision kernel plus required CON flush-only participant | -| `review.finding_response_evidence.ingest` | merged hidden REV-09A obligation/preparation plus merged XINT-002-07B response evaluator | +| `review.finding_response_evidence.ingest` | future only; requires separate approved REV evidence-upload intent | | `review.queue.inspect` | merged hidden REV-11 bounded/redacted queue inspection | | `review.lease.force_release` | merged hidden REV-11 force-release command | | `review.queue.routing.override` | merged hidden REV-11 override command | @@ -90,6 +90,6 @@ These actions are not XINT-003 custody. Generic artifact download, adjudication, | `review.artifact_reference.reconcile` | merged hidden REV-12 artifact-reference command and typed ART repair port | | `review.projection.rebuild` | merged hidden REV-12 derived-projection command | | `artifact.review_packet.materialize` | XINT-002-07A after hidden ART packet behavior and REV active-lease manifest | -| `artifact.review_evidence.binding.create` | XINT-002-07A finding-slot behavior; XINT-002-07B response-slot behavior after hidden REV obligation/preparation | +| `artifact.review_evidence.binding.create` | future only; remains planned/unavailable in v0.1 | | `artifact.submission_bundle.prepare` | XINT-002-05D after hidden REV human-revision preparation | | `submission.create` | XINT-002-05D after a verified, consumable human-revision admission | diff --git a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/CHUNK_MAP.md b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/CHUNK_MAP.md index febf2ce75..16bd1c2af 100644 --- a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/CHUNK_MAP.md @@ -7,10 +7,10 @@ | `WS-XINT-003-02B` | Activate the sole review/revision policy mutation service through AUTH PREP after immutable lineage exists. | L1 | merged 02A | | `WS-XINT-003-03A` | Activate concealed reviewer current-work plus claim/release/preference with exact project grant, self-review denial, global lease limit, and atomic lease/packet-manifest freeze. | L1 | 02B plus hidden REV queue/lease behavior | | `WS-XINT-003-03B` | Activate preference and lease expiry fixed services only. | L1 | 03A plus hidden timer behavior | -| `WS-XINT-003-04` | Activate human `review.context.read` and reviewer finding evidence while consuming XINT-002-07A's ART-only packet/materialization/binding capability. | L1 | 03B plus hidden REV packet/evidence manifests and XINT-002-07A | +| `WS-XINT-003-04` | Activate human `review.context.read` while consuming XINT-002-07A packet materialization; reviewer note/findings require no artifact upload. | L1 | 03B plus hidden REV packet manifest and XINT-002-07A | | `WS-XINT-003-05` | Activate only bounded `review.chain.read`, consuming the active REV context and XINT-002 packet/materialization boundary. | L1 | 04 plus merged XINT-002-07A | | `WS-XINT-003-06` | Activate `review.decision` only for the hidden atomic Review/FinalAcceptance/CON composition. | L1 | 05 plus REV decision and merged CON participant | -| `WS-XINT-003-07` | Activate human contributor response evidence, consuming XINT-002-05D shared revision submission and the already-merged XINT-002-07B ART response evaluator. | L1 | 06 plus hidden REV revision behavior, XINT-002-05D, and merged XINT-002-07B | +| `WS-XINT-003-07` | Activate human-review revision preparation/Submission context through XINT-002-05D; no response-artifact upload is approved. | L1 | 06 plus hidden REV revision behavior and XINT-002-05D | | `WS-XINT-003-08R` | Register four missing privileged recovery/lifecycle ActionIds as planned with complete catalogue/migration parity; activate nothing. | L1 | 07 plus exact hidden-feature registration manifests | | `WS-XINT-003-08A` | Activate Project Manager and Operator queue/revision recovery commands with exact scope and reasons. | L1 | 08R plus hidden REV recovery behavior | | `WS-XINT-003-08B` | Activate both identities for the single `review.reconcile.run` ActionId together, plus artifact-reference, projection, and lifecycle-control surfaces. | L1 | 08A plus hidden REV jobs/projection/control | diff --git a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DECISIONS.md b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DECISIONS.md index 2b0ca509f..b5be49ab2 100644 --- a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DECISIONS.md +++ b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DECISIONS.md @@ -10,10 +10,9 @@ self-review. Submitter/adjudicator/admin roles do not substitute. 5. `review.context.read` and `review.chain.read` expose bounded lease-scoped facts. Neither grants generic artifact or historical-byte access. -6. Finding evidence, response evidence, and ART byte binding are separate - actions with separate human/service principals. Reviewer finding evidence - may activate before decision; contributor response evidence activates only - after `needs_revision` creates the exact obligation and preparation. +6. Reviewer note/findings and bounded contributor response text require no + separate artifact upload in v0.1. ART review-evidence binding remains + planned/unavailable pending separate REV-owned intent. 7. `review.decision` activates only after Review, findings/resolutions, FinalAcceptance when accepting, Task/Assignment effects, CON records, audit, and outbox are one fail-closed transaction. @@ -41,5 +40,6 @@ persistence records. XINT-003-02 introduces the sole append-only writer and removes the four legacy callable mutator/construction paths named in the reconciled REV-03P/AUTH-12D2 contracts. -17. XINT-002-07A is the only review-evidence binding availability transition; - 07B adds response-slot evaluator shape without changing availability. +17. XINT-002-07A activates reviewer packet materialization only. Review-evidence + binding remains planned/unavailable; 07B is reserved pending separate + REV-owned intent. diff --git a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DISCOVERY.md b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DISCOVERY.md index 8cd43af1c..9a7d2f4d1 100644 --- a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DISCOVERY.md +++ b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DISCOVERY.md @@ -37,10 +37,10 @@ This initiative begins read-only and changes no application behavior. `allow_review` admission through queue, lease, packet context, immutable decisions/findings/resolutions, human revision preparation, contribution integration, recovery, projection, and final release. -- `WS-XINT-002` owns `artifact.review_packet.materialize`, - `artifact.review_evidence.binding.create`, and human-review revision artifact - preparation/Submission binding. REV-AUTH must consume those exact merged - manifests rather than duplicate them. +- `WS-XINT-002` owns `artifact.review_packet.materialize` and human-review + revision ZIP preparation/Submission binding. Review-evidence binding remains + future/planned and unavailable. REV-AUTH consumes the packet and submission + manifests rather than duplicating them. ## Principal classes @@ -70,8 +70,9 @@ or artifact-read authority. Preference expiry, lease expiry, authority-invalidation reconciliation, general review reconciliation, artifact-reference reconciliation, projection rebuild, -ART packet materialization, and ART evidence binding use separately admitted -fixed service identities and closed action matrices. A Celery payload carries +ART packet materialization uses a separately admitted fixed service identity +and closed action matrix. Future ART evidence binding is not a v0.1 dependency. +A Celery payload carries identifiers and provenance only, never a prepared handle or executable human authority. @@ -120,7 +121,8 @@ Fixed-service actions: - `review.artifact_reference.reconcile` - `review.projection.rebuild` - XINT-002 `artifact.review_packet.materialize` -- XINT-002 `artifact.review_evidence.binding.create` +- future XINT-002 `artifact.review_evidence.binding.create` (planned/unavailable; + not consumed by v0.1 REV-AUTH) ## Required resource facts @@ -154,10 +156,9 @@ needs a closed typed context with only its valid shape. - AUTH-12D2 and REV-03P must be reconciled before either policy writer is built. - REV hidden feature chunks must merge before matching AUTH action activation. -- XINT-002 remains the sole activation owner for ART review-artifact actions and - shared human-review submission actions. WS-XINT-003-01 split the combined - review-artifact contract into 07A finding availability and 07B response - evaluation after the human revision obligation exists. +- XINT-002 remains the sole activation owner for ART packet materialization and + shared human-review submission actions. 07A is packet-only; 07B evidence + binding is reserved pending separate approved REV intent. - CON atomic participant and FinalAcceptance integration must merge before `review.decision` activation. - Final product routes remain absent until the complete dependency conformance diff --git a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/INTENT.md b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/INTENT.md index 9fb264c2d..231863919 100644 --- a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/INTENT.md +++ b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/INTENT.md @@ -57,7 +57,8 @@ separate from activation and product route release. - REV owns review/revision product semantics and canonical lifecycle rows. - AUTH owns identity, permissions, candidates, evaluation, PREP custody, and authorization evidence. -- ART owns verified bytes, review packet materialization, and evidence binding. +- ART owns verified bytes and review packet materialization. Review-evidence + binding is future/planned and unavailable absent separate REV-owned intent. - Task/Submission/Checker owners supply exact upstream and resubmission facts. - CON owns contribution rules and conditional award persistence. - The request route or service command owns the transaction and commits once. diff --git a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md index 249464cc5..a096b7140 100644 --- a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md +++ b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md @@ -13,19 +13,16 @@ activation waves: semantics; AUTH-12D2 owns authorization and PREP consumption. 3. Activate concealed reviewer current-work, claim/release/preference, and timer services only after REV queue/lease behavior exists. -4. Amend XINT-002-07 into two ART-only owner waves: 07A is the only ActionId - availability transition and activates packet materialization plus - finding-slot evidence binding after lease readiness; 07B changes no ActionId - availability and only extends the active binding evaluator to response slots - after a human revision obligation exists. XINT-003 activates the - corresponding human REV actions and never takes custody of ART actions. +4. Let XINT-002-07A activate packet materialization only after lease readiness. + Keep ART review-evidence binding planned and unavailable; the approved v0.1 + reviewer flow stores a decision plus note/findings, not an uploaded reviewer + artifact. XINT-003 never takes custody of ART actions. 5. Activate bounded `review.chain.read` after the packet/context owner wave. 6. Activate `review.decision` only after the complete hidden atomic Review/FinalAcceptance/CON composition exists. 7. Let XINT-002-05D activate shared human-review revision preparation/Submission - actions, then let XINT-002-07B extend ART response binding after hidden REV - obligation/preparation behavior exists. XINT-003-07 consumes both merged - boundaries and separately activates contributor response authority. + actions after hidden REV obligation/preparation behavior exists. Any future + response-artifact upload requires separate approved REV intent. 8. Record the four missing privileged lifecycle/recovery actions as future 08R work. Keep their ActionIds unregistered until 08R, then activate Project Manager/Operator recovery and fixed service jobs with diff --git a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/RISKS.md b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/RISKS.md index 4c07e7aca..b2f2c9c9c 100644 --- a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/RISKS.md +++ b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/RISKS.md @@ -17,5 +17,5 @@ | Activation precedes hidden feature readiness | Critical | Planned-by-default catalogue and exact merged feature manifest gates. | | Historical counts/contracts are treated as current | High | Derive parity from current migrations/catalogue at every chunk start. | | One PR becomes unreviewable | High | Narrow activation waves and explicit allowed/not-allowed files per chunk. | -| One evidence-binding ActionId is activated twice | Critical | 07A alone changes availability; 07B is evaluator-only and requires the exact human obligation/preparation. | +| Review-evidence binding is activated without an approved v0.1 upload lifecycle | Critical | Keep it planned/unavailable; packet-only 07A proceeds, and any evidence upload requires separate REV-owned intent. | | Policy edits mutate active-guide history | Critical | Append-only versions, draft-only final PREP guard, and PostgreSQL update/delete refusal proof in chunk 02. | diff --git a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/STATUS.md b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/STATUS.md index e3c710d47..8b681c932 100644 --- a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/STATUS.md +++ b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/STATUS.md @@ -23,9 +23,9 @@ REV-owned semantics with AUTH-owned mutation authorization. - `ACTION_CUSTODY.md` is the canonical action/principal/resource/wave table. - REV-03P and AUTH-12D2 name one future append-only policy writer path. -- Runtime owner XINT-002-07 is split into planned sub-wave 07A, the sole - reviewer-finding packet/evidence-binding availability transition, and 07B, - an evaluator-only response-slot extension that cannot change availability. +- Runtime owner XINT-002-07 has one approved v0.1 sub-wave: 07A packet + materialization. Evidence binding remains planned/unavailable and 07B is + reserved pending separate REV-owned intent. - All registered review actions remain planned; four lifecycle/recovery actions remain missing until 08R; no service identity is provisioned by chunk 01. diff --git a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-01-contract-reconciliation.md b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-01-contract-reconciliation.md index f70fbd2d3..3c547b137 100644 --- a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-01-contract-reconciliation.md +++ b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-01-contract-reconciliation.md @@ -72,13 +72,11 @@ compatibility aliases or duplicate policy paths - Historical counts and signed-start/process-gate language are corrected where they could misdirect current implementation. - XINT-002 artifact/revision boundaries are referenced by exact chunk IDs and - are not duplicated. XINT-002-07 becomes a split record: 07A activates packet - materialization and the one evidence-binding ActionId for reviewer-finding - slots while hard-denying response-slot shapes; 07B changes no availability - and extends only the response-slot evaluator after the exact human revision - obligation/preparation exists. -- The XINT-002-07 split is ART-only: packet materialization and evidence binding - only. XINT-002-05D remains owner of shared human-review submission + are not duplicated. XINT-002-07A activates packet materialization only. + Evidence binding remains planned/unavailable; any uploaded reviewer or + response artifact requires a separate approved REV-owned intent. +- The XINT-002-07 boundary is ART-only packet materialization. XINT-002-05D + remains owner of shared human-review submission preparation/create activation. Human REV action activation remains in the XINT-003 waves. - Every later activation remains planned and fail closed. diff --git a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-04-review-context-activation.md b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-04-review-context-activation.md index 0c5b9a146..b7a22e82d 100644 --- a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-04-review-context-activation.md +++ b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-04-review-context-activation.md @@ -1,4 +1,4 @@ -# Chunk Contract: WS-XINT-003-04 — Review Context And Finding Authority Activation +# Chunk Contract: WS-XINT-003-04 — Review Context Activation ## Status and risk @@ -7,14 +7,13 @@ on current main before an explicit user request. L1 confidential artifact access ## Goal -Activate human `review.context.read` and `review.finding_evidence.ingest` against -the exact lease/packet/finding context. Consume the already-merged XINT-002-07A -fixed `artifact.review_packet.materialize` and reviewer-finding binding -capabilities. The ART contract split is completed by WS-XINT-003-01, not here. +Activate human `review.context.read` against the exact lease/packet context and +consume XINT-002-07A fixed `artifact.review_packet.materialize`. Reviewer +note/findings require no artifact upload; evidence actions remain unavailable. ## Allowed files -Enumerate exact REV context/finding service, AUTH composers/activation parity, +Enumerate exact REV context service, AUTH composers/activation parity, merged XINT-002-07A ART-only manifest, routes, tests, canonical specs, docs, and evidence files at current-main start. @@ -30,12 +29,10 @@ artifact authority. Submission and canonical immutable packet manifest/bindings. - Lease expiry/release/reassignment, actor/link/grant revocation, version drift, packet replacement, cross-resource, and wrong service/action deny bytes. -- Materializer and binding services use separate fixed identities and cannot - claim, decide, submit, or inherit reviewer authority. -- The ART materializer/binder receives only its fixed-service actions. Future - 07B response evidence requires exact `Review(needs_revision)`, obligation, - preparation head/digest, contributor assignment, predecessor, response, - deadline, and round; CheckerRun remediation is ineligible. +- The fixed ART materializer cannot claim, decide, submit, or inherit reviewer + authority. Review-evidence binding remains planned/unavailable. +- Human-review revision uses XINT-002-05D and the normal contributor ZIP path; + 07B is reserved and CheckerRun remediation remains a distinct context. ## Verification and reviewers diff --git a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-05-review-evidence-activation.md b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-05-review-evidence-activation.md index 524224f71..ea843f43c 100644 --- a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-05-review-evidence-activation.md +++ b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-05-review-evidence-activation.md @@ -9,7 +9,8 @@ confidential history access. ## Goal Activate only `review.chain.read` for the exact active lease. Evidence and ART -binding actions remain owned by XINT-002-07A/07B. +binding actions remain future/planned/unavailable; 07A supplies packet +materialization only and 07B is reserved. ## Allowed files diff --git a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-07-human-revision-activation.md b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-07-human-revision-activation.md index 8a4822f11..677284eab 100644 --- a/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-07-human-revision-activation.md +++ b/.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-07-human-revision-activation.md @@ -1,4 +1,4 @@ -# Chunk Contract: WS-XINT-003-07 — Human Revision And Response Authority Activation +# Chunk Contract: WS-XINT-003-07 — Human Revision Submission Authority Activation ## Status and risk @@ -8,10 +8,10 @@ authority and immutable predecessor lineage. ## Goal -Activate human `review.finding_response_evidence.ingest` against the exact -obligation/preparation. Consume XINT-002-05D as sole owner of shared artifact -preparation/`submission.create` and the already-merged XINT-002-07B ART response -evaluator. XINT-002 owns no human REV action. +Activate the human-review revision context for normal contributor ZIP +preparation/`submission.create` against the exact obligation through +XINT-002-05D. No separate response/finding artifact upload is approved; +XINT-002-07B remains reserved. XINT-002 owns no human REV action. ## Allowed files @@ -30,7 +30,7 @@ submission authorization protocol. head/digest and frozen or approved rebased context; it never falls back to a stale or moving guide context. - Authority binds the exact Review(needs_revision), unresolved blocking - findings, immutable responses/evidence, active preparation head/digest, + findings and reviewer note, active preparation head/digest, predecessor Submission, active/replacement assignment, project/task, locked or approved rebased guide/policies, deadline, and remaining round. - Predecessor advancement, preparation replacement, finding changes, @@ -39,10 +39,8 @@ submission authorization protocol. - Exactly one N+1 Submission consumes one preparation/obligation; concurrent attempts have one winner and preserve all prior immutable history. - Human and checker revision sources remain mutually exclusive. -- XINT-002-07B extends the active ART binding evaluator to response slots and - introduces response-slot evaluation without changing ActionId availability; - it denies CheckerRun-rooted remediation, and XINT-003 owns the corresponding - human action. +- XINT-002-07B remains reserved and unavailable. The new contributor ZIP is the + revision artifact; no parallel response-artifact binding path exists. ## Verification and reviewers diff --git a/docs/spec_artifact_storage_service.md b/docs/spec_artifact_storage_service.md index 9010d27b9..7ab9398aa 100644 --- a/docs/spec_artifact_storage_service.md +++ b/docs/spec_artifact_storage_service.md @@ -46,7 +46,8 @@ injection, and provider mutation calls outside the artifact-storage module. | content identity, product provenance, binding, lifecycle, audit | Workstream | | verification result and recovery coordination | Workstream/PostgreSQL | | private immutable bytes and protocol observations | configured object store | -| review packet and reviewer evidence aggregates | WS-REV using artifact bindings | +| review packet manifests | WS-REV using ART materialization | +| reviewer evidence artifact aggregates/uploads | Future REV-owned intent; not approved for v0.1 | Provider credentials grant transport access only. They are not actor identity, product role, product authorization, or proof of stored content. @@ -406,8 +407,9 @@ release charges or mutate capacity. The binding lookup resource vocabulary is exactly `project`, `project_guide`, `guide_source_snapshot`, `guide_source_snapshot_item`, `task`, `submission`, or -`checker_run`. Review lookup remains deferred until WS-XINT-002-07A; response- -slot evaluation is separately deferred to evaluator-only 07B. The audit +`checker_run`. Review packet lookup remains deferred until WS-XINT-002-07A. +Review/response evidence binding is future/planned and unavailable; 07B is +reserved pending separate REV-owned intent. The audit resource vocabulary is exactly `artifact_binding`, `artifact_content`, `artifact_replica`, `artifact_receipt`, `artifact_verification_job`, or `artifact_recovery_attempt`. Adding a product or @@ -1573,6 +1575,21 @@ bytes in PostgreSQL. ## Verification Strategy +### Remaining v0.1 dependency order + +The pre-submit checker materializer is a mandatory part of preparation, so its +fixed-service AUTH activation must merge after hidden ART-04B and before +contributor preparation is activated. Post-submit materialization and checker +output actions remain a later activation after ART-06A/06B. This ordering +prevents a live contributor route whose mandatory checker read is unavailable. + +ART later supplies an exact, authorized reviewer-packet byte capability, while +REV owns queueing, leases, decisions, and the reviewer note/findings. The +approved v0.1 review flow does not upload a reviewer revision artifact. CON owns +ContributionRecord lifecycle and records the accepted immutable Submission and +ART identity without provider I/O. Client delivery/export is outside this v0.1 +initiative and requires a separately planned egress capability. + - one conformance suite runs against LocalStorage and real MinIO; - inactive validation proves the closed AWS S3 configuration contract, while Chunk 07 owns live deployment proof; diff --git a/docs/spec_authorization_service.md b/docs/spec_authorization_service.md index 0590f49a5..2861f6928 100644 --- a/docs/spec_authorization_service.md +++ b/docs/spec_authorization_service.md @@ -378,7 +378,7 @@ The paired artifact hidden-behavior matrix is closed: | `WS-ART-001-02D` | Operator binding/replica/receipt/verification-job/recovery-attempt/audit reads; the operations-domain `operations.artifact_storage_admission.read` action mapped to `operations.status.read`; verification retry; `artifact.verification.execute`; `artifact.pending_work.scan`; and `artifact.put_attempt.resolve` | | `WS-ART-001-03` | Hidden guide behavior for `artifact.guide_source.ingest -> artifact.guide_source.ingest`, `artifact.guide_source.read -> artifact.guide_source.read`, and `artifact.guide_source.binding.create -> artifact.binding.create`; AUTH activation custody is split between WS-XINT-002-04A and 04B below | | `WS-ART-001-04A` historical baseline | the former multi-step upload authority had no route/command and is deleted from the live catalogue by WS-XINT-002-01 without compatibility aliases | -| `WS-ART-001-04A` through `04C` | one hidden `artifact.submission_bundle.prepare` surface mapped to `submission.create`; remains unavailable until 04C evidence and the later WS-XINT-002-05A activation contract | +| `WS-ART-001-04A1` through `04C2` | one hidden `artifact.submission_bundle.prepare` surface mapped to `submission.create`; 04B depends on 04A3, XINT-002-06A activates its fixed pre-submit materializer before 04C1, and the contributor action remains unavailable until complete 04C2 evidence and WS-XINT-002-05A | | `WS-ART-001-04B` | `artifact.pre_submit.checker_input.materialize` mapped to `artifact.checker_input.materialize` | | `WS-ART-001-05` | `artifact.submission.binding.create` mapped to `artifact.binding.create` | | `WS-ART-001-06A` | `artifact.post_submit.checker_input.materialize` mapped to `artifact.checker_input.materialize` | @@ -386,9 +386,10 @@ The paired artifact hidden-behavior matrix is closed: WS-XINT-002-01 deletes the former multi-step authority and registers planned `artifact.submission_bundle.prepare -> submission.create`. No ART implementation -may execute that ActionId while it remains planned; activation waits until -ART-04A-C publish the complete hidden surface and WS-XINT-002-05A consumes its -exact evidence. +may execute that ActionId while it remains planned. The mandatory order is +ART-04A1 -> 04A2 -> 04A3 -> 04B -> XINT-002-06A -> ART-04C1 -> 04C2 -> +XINT-002-05A. This ensures fixed-service pre-submit materialization is active +before contributor preparation can become live. WS-XINT-002-04A activates only `artifact.guide_source.ingest`. The existing permission belongs only to the Project Manager role and is evaluated through an @@ -433,15 +434,15 @@ A mapping is not a permission alias. | `WS-XINT-002-04A` | Active: `artifact.guide_source.ingest` | | `WS-XINT-002-04B` | Active: `artifact.guide_source.read`, `artifact.guide_source.binding.create` | | `WS-XINT-002-05A` | `artifact.submission_bundle.prepare` | -| `WS-AUTH-001-ART-04B` | `artifact.pre_submit.checker_input.materialize` | -| `WS-AUTH-001-ART-05` | `artifact.submission.binding.create` | -| `WS-AUTH-001-ART-06A` | `artifact.post_submit.checker_input.materialize` | -| `WS-AUTH-001-ART-06B` | `artifact.checker_output.write`, `artifact.checker_output.binding.create` | -| `WS-XINT-002-07` | `artifact.review_packet.materialize`, `artifact.review_evidence.binding.create` | +| `WS-XINT-002-06A` | `artifact.pre_submit.checker_input.materialize` | +| `WS-XINT-002-05B` | `artifact.submission.binding.create` | +| `WS-XINT-002-06B` | `artifact.post_submit.checker_input.materialize`, `artifact.checker_output.write`, `artifact.checker_output.binding.create` | +| `WS-XINT-002-07A` | `artifact.review_packet.materialize` only; `artifact.review_evidence.binding.create` remains planned/unavailable | -Within that single runtime owner, planning sub-wave 07A is the only -availability transition and initially permits finding slots; 07B changes no -availability and only extends the evaluator to response slots. +The approved v0.1 review flow has a reviewer decision plus note/findings bound +to the reviewed Submission. It does not include a reviewer-uploaded artifact. +Therefore 07A activates packet materialization only; evidence binding remains +planned and unavailable unless a later REV-owned intent explicitly approves it. The `OPERATOR` suffix names future activation custody only; it creates no Operator grant or entitlement. WS-XINT-002-03 activates the three internal @@ -469,7 +470,7 @@ remain planned and unavailable, and add no migration. | `operations.artifact_storage_admission.read` | `operations.status.read` | Operator | deployment artifact-storage namespace | `02D` | | `artifact.guide_source.ingest` | `artifact.guide_source.ingest` | exact covered Project Manager | guide-source snapshot item | `03` | | `artifact.guide_source.read` | `artifact.guide_source.read` | fixed guide-reader service | guide-source binding and verified replica | `03` | -| `artifact.submission_bundle.prepare` | `submission.create` | assigned contributor | exact task/admission context | `WS-XINT-002-05A` | +| `artifact.submission_bundle.prepare` | `submission.create` | assigned contributor | exact task/admission context | `04C2` | | `artifact.guide_source.binding.create` | `artifact.binding.create` | fixed binding service | guide-source snapshot item | `03` | | `artifact.submission.binding.create` | `artifact.binding.create` | fixed binding service | submission | `05` | | `artifact.checker_output.binding.create` | `artifact.binding.create` | fixed binding service | checker run | `06B` | @@ -479,12 +480,12 @@ remain planned and unavailable, and add no migration. | `artifact.pre_submit.checker_input.materialize` | `artifact.checker_input.materialize` | fixed materializer service | task plus current process-local prepared-bundle generation; no scratch path/handle is serialized | `04B` | | `artifact.post_submit.checker_input.materialize` | `artifact.checker_input.materialize` | fixed materializer service | checker run and immutable bindings | `06A` | | `artifact.checker_output.write` | `artifact.checker_output.write` | fixed checker-output service | checker run | `06B` | -| `artifact.review_packet.materialize` | `artifact.review_packet.materialize` | fixed materializer service | exact active lease and Submission packet | `WS-XINT-002-07` | -| `artifact.review_evidence.binding.create` | `artifact.binding.create` | fixed binding service | finding slot in 07A; response slot added by evaluator-only 07B | `WS-XINT-002-07` | +| `artifact.review_packet.materialize` | `artifact.review_packet.materialize` | fixed materializer service | exact active lease and Submission packet | `07A` | +| `artifact.review_evidence.binding.create` | `artifact.binding.create` | fixed binding service | future REV-owned evidence slot; no approved v0.1 activation | future | The resource-owning chunk cells above identify ART hidden-behavior custody; they are distinct from the AUTH activation-custodian table and runtime -`ActionOwner`. 07A/07B are contract sub-waves, not new catalogue owner values. +`ActionOwner`. XINT activation waves do not create new catalogue owner values. The fixed internal service identities and their complete action sets are also closed: @@ -494,7 +495,7 @@ closed: | `workstream.artifact.verifier` | `artifact.verification.execute` | | `workstream.artifact.put_resolver` | `artifact.put_attempt.resolve` | | `workstream.artifact.scheduler` | `artifact.pending_work.scan` | -| `workstream.artifact.binding` | `artifact.guide_source.binding.create`, `artifact.submission.binding.create`, `artifact.checker_output.binding.create`, `artifact.review_evidence.binding.create` | +| `workstream.artifact.binding` | active/activatable v0.1: `artifact.guide_source.binding.create`, `artifact.submission.binding.create`, `artifact.checker_output.binding.create`; planned/unavailable future: `artifact.review_evidence.binding.create` | | `workstream.artifact.guide_reader` | `artifact.guide_source.read` | | `workstream.artifact.materializer` | `artifact.pre_submit.checker_input.materialize`, `artifact.post_submit.checker_input.materialize`, `artifact.review_packet.materialize` | | `workstream.artifact.checker_output` | `artifact.checker_output.write` | diff --git a/docs/spec_review_lifecycle.md b/docs/spec_review_lifecycle.md index 39e3f1b61..a55019a92 100644 --- a/docs/spec_review_lifecycle.md +++ b/docs/spec_review_lifecycle.md @@ -20,9 +20,9 @@ The canonical REV-AUTH action custody is REV owns lifecycle and immutable policy semantics; AUTH owns evaluation, PREP, and decision evidence. ReviewPolicy and RevisionPolicy use immutable, append-only identities installed by XINT-003-02A; their only future writer is -the PREP-bound mutation surface owned by XINT-003-02B. XINT-002-07A alone activates -the ART evidence-binding ActionId for finding slots; 07B only extends its -evaluator to response slots after an exact human revision obligation exists. +the PREP-bound mutation surface owned by XINT-003-02B. XINT-002-07A activates +reviewer packet materialization only. ART review-evidence binding remains +planned/unavailable and 07B is reserved pending separate REV-owned intent. ## Precedence And Archival Inputs @@ -177,7 +177,7 @@ REV adds these lifecycle records in later hidden chunks: - `ReviewPacketManifest` - `Review` - `ReviewFinding` -- `ReviewEvidenceArtifact` +- future `ReviewEvidenceArtifact` only if separately approved; not v0.1 - `RevisionContextPreparation` - `SubmissionFindingResponse` - `FindingResolution` @@ -286,7 +286,7 @@ keys, provider URIs, scratch paths, receipts, or credentials. `ReviewPacketManifest` is an immutable REV semantic projection naming the exact queue entry, lease, versioned Submission, admitting CheckerRun/results, stamped -guide or revision context, response-evidence relations, and ART binding IDs. It +guide or revision context, bounded response relations, and ART binding IDs. It stores no bytes, content digest, provider location, signed URL, scratch path, receipt, or authorization-matrix data. @@ -304,32 +304,18 @@ still holds the exact project reviewer grant, or an explicitly authorized Project Manager/Operator. Prior participation grants metadata history only; artifact bytes still require the current active lease for the exact packet. -## Review And Response Evidence +## Review Notes, Findings, And Revision Responses -Reviewer finding evidence and submitter response evidence use an ART-owned -two-phase candidate/finalize capability: +A reviewer records exactly one decision (`accept`, `needs_revision`, or +`reject`) plus bounded note/findings related to the exact reviewed immutable +Submission. When revision is required, the contributor may record bounded +response text against unresolved findings and submits one new outer ZIP through +the normal human-review revision path. The ZIP is the revision artifact. -```text -preflight authority --> provider upload and verification outside lifecycle locks --> AUTH prepares final human authority --> REV locks exact lease/finding/response lineage --> ART locks candidate/admission/binding state --> REV recomposes final facts and AUTH evaluates once --> ART binding and immutable ReviewEvidenceArtifact relation flush together --> caller commits once -``` - -Authority loss, lease expiry, assignment loss, or preparation supersession may -leave only an ART-owned unbound candidate governed by ART retention. It creates -no canonical evidence relation or product effect. Decision and resubmission -revalidate evidence lineage again. - -ART owns bytes, candidates, bindings, verification, retention, provider -execution, and recovery. REV owns packet membership, evidence-slot purpose, and -the immutable relation from a finalized ArtifactBinding to the exact Review, -finding, response, or resolution evidence slot. Human bearer tokens and provider -locators never cross into storage calls. +There is no separate reviewer-finding or contributor-response artifact upload +in v0.1. `artifact.review_evidence.binding.create` and related evidence-ingest +actions remain planned/unavailable. Any future evidence-upload lifecycle needs +a separate REV-owned intent and reviewed ART/AUTH contract. ## Decision Transaction @@ -525,16 +511,15 @@ and change summary. ## Finding Replay And Resubmission For a human-review origin, every unresolved blocking ReviewFinding requires one -immutable `SubmissionFindingResponse` from the assigned submitter, with response -text and optional finalized -evidence binding. Responses to advisory findings are optional unless the locked +immutable `SubmissionFindingResponse` from the assigned submitter, with bounded +response text. Responses to advisory findings are optional unless the locked policy explicitly requires them. The checker-remediation path instead exposes only bounded contributor-safe CheckerResult messages/suggested fixes, requires no fabricated ReviewFinding/response/resolution, and returns to open routing after corrected checker admission. A human-Review Submission N+1 links its immediate predecessor, exact preparation -head, required responses, evidence relations, and target TaskAssignment. A +head, required bounded response text, and target TaskAssignment. A checker-remediation Submission N+1 instead binds the exact final needs-revision CheckerRun through its server-derived immutable `remediation_source_checker_run_id` and retains the Task's existing locked @@ -609,9 +594,9 @@ The review lifecycle currently depends on 24 unavailable actions: - four approved but unregistered REV actions defined below. The registered planned `artifact.review_evidence.binding.create -> -artifact.binding.create` service action is separate and is not one of the 24. -Future counts must be derived from trusted main at each AUTH gate; the four REV -actions and separate ART action are never collapsed into a promised total. +artifact.binding.create` service action is separate, unavailable, and not one +of the 24. It has no approved v0.1 activation. Future counts must be derived +from trusted main at each AUTH gate. The exact delivery order is: @@ -736,7 +721,7 @@ surface includes separate capabilities for: - claim, release, and decline preference; - exact leased Review Context; - authorized bounded chain history; -- finding and response evidence intake; +- reviewer note/findings and bounded contributor response text; - review decision; - Task Context revision preparation read; - human-Review revision submission with responses and distinct checker- @@ -826,7 +811,7 @@ become separately approved owner chunks; REV does not implement them opportunistically or add compatibility fallbacks. The final live proof covers first submit, checker admission, current-work -selection, claim/release/expiry, active-lease packet access, evidence intake, +selection, claim/release/expiry, active-lease packet access, note/findings, `needs_revision`, kept/forward/backward/blocked preparation, response/resolution replay, preferred return and takeover, accept with exactly one FinalAcceptance, reject, reviewer revocation, manager repair and closure, legacy recovery, From 673148b1832b947b0dc4bcb3ff6b74de947767de Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Sun, 2 Aug 2026 17:45:09 +0100 Subject: [PATCH 2/2] test(auth): separate catalogue and activation custody --- ...001-PLAN3-v01-end-to-end-reconciliation.md | 5 ++- ...-ART-001-PLAN3-internal-review-evidence.md | 29 ++++++++++++ backend/tests/test_authorization.py | 44 ++++++++++++++----- docs/spec_authorization_service.md | 3 +- 4 files changed, 69 insertions(+), 12 deletions(-) diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-PLAN3-v01-end-to-end-reconciliation.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-PLAN3-v01-end-to-end-reconciliation.md index 837270a62..7db3146fb 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-PLAN3-v01-end-to-end-reconciliation.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-PLAN3-v01-end-to-end-reconciliation.md @@ -10,7 +10,10 @@ ownership boundary, PR boundary, and v0.1 completion proof explicit. ## Allowed Files WS-ART planning artifacts and future contracts; WS-XINT-002 planning artifacts -needed to correct dependency order; related specifications and review evidence. +needed to correct dependency order; related specifications and review evidence; +and only the independent custody expectation fixture in +`backend/tests/test_authorization.py` when a reviewed custody split changes the +exact documentation-to-catalogue parity assertion. ## Not Allowed Changes diff --git a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-PLAN3-internal-review-evidence.md b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-PLAN3-internal-review-evidence.md index a778e5076..45903e1d0 100644 --- a/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-PLAN3-internal-review-evidence.md +++ b/.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-PLAN3-internal-review-evidence.md @@ -64,3 +64,32 @@ user requested avoiding full local tests on the constrained machine. - Each successor must read PLAN3 and finalize any chunk-specific new test file name before implementation; PLAN3 supplies the mandatory minimum commands, mapped modules, crossed-state expectations, and coverage floors. + +## Hosted CI Repair Review + +After current `main` was merged into the branch, hosted Backend CI correctly +failed because the revised activation-custody documentation no longer matched +the independent documentation fixture. The repair keeps runtime catalogue +ownership and future activation custody as separate exact assertions: + +- `ART_CUSTODY_EXPECTATIONS` remains the closed runtime catalogue fixture; +- `ART_ACTIVATION_CUSTODY_EXPECTATIONS` independently records the future + activation-custody split used by both normative documentation tables; +- the deferred review-evidence action remains planned/unavailable and requires + a future REV-owned approval. + +Focused security/auth, QA, test-delta, and CI-integrity re-review passed after +the initial conflated-fixture repair was rejected. No test was skipped, +weakened, or removed, and no application code, action availability, grant, +workflow, migration, or CI configuration changed. + +```text +ruff: passed +closed runtime catalogue exactness: passed +activation-custody documentation parity: passed +Markdown links: passed +stale artifact contracts: passed +stale authorization documentation: passed +stale Workstream wording: passed +git diff --check: passed +``` diff --git a/backend/tests/test_authorization.py b/backend/tests/test_authorization.py index aba95ccbf..5983a0385 100644 --- a/backend/tests/test_authorization.py +++ b/backend/tests/test_authorization.py @@ -1660,6 +1660,33 @@ async def consume_rate() -> None: ), } +ART_ACTIVATION_CUSTODY_EXPECTATIONS = { + "artifact.binding.read": "WS-AUTH-001-ART-02D-OPERATOR", + "artifact.replica.read": "WS-AUTH-001-ART-02D-OPERATOR", + "artifact.receipt.read": "WS-AUTH-001-ART-02D-OPERATOR", + "artifact.verification_job.read": "WS-AUTH-001-ART-02D-OPERATOR", + "artifact.verification_job.retry": "WS-AUTH-001-ART-02D-OPERATOR", + "artifact.recovery_attempt.read": "WS-AUTH-001-ART-02D-OPERATOR", + "artifact.audit.read": "WS-AUTH-001-ART-02D-OPERATOR", + "operations.artifact_storage_admission.read": "WS-AUTH-001-ART-02D-OPERATOR", + "artifact.verification.execute": "WS-AUTH-001-ART-02D-INTERNAL", + "artifact.pending_work.scan": "WS-AUTH-001-ART-02D-INTERNAL", + "artifact.put_attempt.resolve": "WS-AUTH-001-ART-02D-INTERNAL", + "artifact.guide_source.ingest": "WS-XINT-002-04A", + "artifact.guide_source.read": "WS-XINT-002-04B", + "artifact.guide_source.binding.create": "WS-XINT-002-04B", + "artifact.submission_bundle.prepare": "WS-XINT-002-05A", + "artifact.pre_submit.checker_input.materialize": "WS-XINT-002-06A", + "artifact.submission.binding.create": "WS-XINT-002-05B", + "artifact.post_submit.checker_input.materialize": "WS-XINT-002-06B", + "artifact.checker_output.write": "WS-XINT-002-06B", + "artifact.review_packet.materialize": "WS-XINT-002-07A", + "artifact.review_evidence.binding.create": ( + "Future REV-owned activation, not approved for v0.1" + ), + "artifact.checker_output.binding.create": "WS-XINT-002-06B", +} + REV_CUSTODY_EXPECTATIONS = { "review.queue.read": ("review.queue.read", "WS-AUTH-001-REV-05", "planned"), "review.queue.inspect": ("review.queue.inspect", "WS-AUTH-001-REV-05", "planned"), @@ -2577,7 +2604,7 @@ def _parse_custody_table(document: Path, expected_actions: set[str]) -> dict[str raise AssertionError(f"exact custody table missing from {document}") -def test_art_custody_documentation_matches_the_independent_catalogue_fixture() -> None: +def test_art_custody_documentation_matches_the_independent_activation_fixture() -> None: repository_root = Path(__file__).resolve().parents[2] custody_documents = ( repository_root / "docs/spec_authorization_service.md", @@ -2585,21 +2612,18 @@ def test_art_custody_documentation_matches_the_independent_catalogue_fixture() - / ".agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service" / "ACTIVATION_CUSTODY.md", ) - expected_custody = { - action: owner - for action, (_permission, owner, _availability) in ART_CUSTODY_EXPECTATIONS.items() - } + expected_custody = ART_ACTIVATION_CUSTODY_EXPECTATIONS expected_owner_counts = { "WS-AUTH-001-ART-02D-OPERATOR": 8, "WS-AUTH-001-ART-02D-INTERNAL": 3, "WS-XINT-002-04B": 2, "WS-XINT-002-04A": 1, "WS-XINT-002-05A": 1, - "WS-AUTH-001-ART-04B": 1, - "WS-AUTH-001-ART-05": 1, - "WS-AUTH-001-ART-06A": 1, - "WS-AUTH-001-ART-06B": 2, - "WS-XINT-002-07": 2, + "WS-XINT-002-06A": 1, + "WS-XINT-002-05B": 1, + "WS-XINT-002-06B": 3, + "WS-XINT-002-07A": 1, + "Future REV-owned activation, not approved for v0.1": 1, } for document in custody_documents: diff --git a/docs/spec_authorization_service.md b/docs/spec_authorization_service.md index 2861f6928..5d646daba 100644 --- a/docs/spec_authorization_service.md +++ b/docs/spec_authorization_service.md @@ -437,7 +437,8 @@ A mapping is not a permission alias. | `WS-XINT-002-06A` | `artifact.pre_submit.checker_input.materialize` | | `WS-XINT-002-05B` | `artifact.submission.binding.create` | | `WS-XINT-002-06B` | `artifact.post_submit.checker_input.materialize`, `artifact.checker_output.write`, `artifact.checker_output.binding.create` | -| `WS-XINT-002-07A` | `artifact.review_packet.materialize` only; `artifact.review_evidence.binding.create` remains planned/unavailable | +| `WS-XINT-002-07A` | `artifact.review_packet.materialize` only | +| Future REV-owned activation, not approved for v0.1 | `artifact.review_evidence.binding.create` remains planned/unavailable | The approved v0.1 review flow has a reviewer decision plus note/findings bound to the reviewed Submission. It does not include a reviewer-uploaded artifact.