WS-XINT-003-02C: add REV authorization readiness

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md

@@ -68,8 +68,8 @@ remains planned and
 cannot be activated by read/status proof. The historical transfer added no
 migration because owner and availability are typed metadata. WS-XINT-002-01
 reconciles PostgreSQL parity through migration `0036`; the live catalogue has
-71 PermissionIds, 96 ActionIds, 43 active actions, and 53 planned actions, with
-eight fixed-service identities and sixteen matrix memberships.
+71 PermissionIds, 100 ActionIds, 45 active actions, and 55 planned actions, with
+fourteen fixed-service identities and twenty-two matrix memberships.
 
 ## REV custody transfer
 
@@ -88,13 +88,16 @@ unchanged until each exact XINT-003 activation wave.
 | `WS-AUTH-001-REV-09A` | `review.finding_response_evidence.ingest` |
 | `WS-AUTH-001-REV-11` | `review.lease.force_release`, `review.queue.routing.override`, `review.queue.routing.correct`, `review.queue.close`, `review.reconcile.run` |
 | `WS-AUTH-001-REV-12` | `review.artifact_reference.reconcile`, `review.projection.rebuild` |
+| `WS-XINT-003-08A` | `review.revision_context.repair`, `review.revision_obligation.close`, `review.revision_context.legacy_close` |
+| `WS-XINT-003-08B` | `review.lifecycle.activation.manage` |
 
 `WS-AUTH-001-REV-CUSTODY` atomically transfers these 19 rows with exact owner
-cardinalities `2/5/3/1/1/5/2` in the table order above and removes the seven
-historical REV owner enum values. It changes no mapping or availability and
+cardinalities `2/5/3/1/1/5/2` in the table order above. The seven historical
+REV runtime owner values remain registered for those actions until their exact
+activation waves replace them. It changes no mapping or availability and
 adds no migration. All 19 actions remain planned and unavailable; these AUTH
 custodian labels grant no reviewer, Operator, or service authority. The four
-proposed lifecycle actions remain unregistered, and PREP remains separately
+approved lifecycle actions remain planned and unavailable, and PREP remains separately
 human-gated.
 
 The front-loaded readiness waves are:
@@ -124,8 +127,8 @@ actions are excluded.
 
 ## Front-loaded additive registration
 
-The following values are approved boundary proposals, not registered runtime
-actions on trusted `main`:
+The following values are registered planned runtime actions, not active
+authority:
 
 | Registration chunk | Future activation chunk | Proposed ActionId -> PermissionId |
 |---|---|---|

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/ACTION_CUSTODY.md

@@ -24,10 +24,10 @@ This table is the planning source of truth for the v0.1 review and human-revisio
 | `review.queue.routing.override` | `review.queue.override` | Operator; canonical reason required | exact queue entry/routing state | REV | registered planned | `WS-XINT-003-08A` |
 | `review.queue.routing.correct` | `review.queue.override` | Operator; canonical reason required | exact invalid routing state | REV | registered planned | `WS-XINT-003-08A` |
 | `review.queue.close` | `review.queue.override` | Operator; canonical reason required | exact stale queue entry | REV | registered planned | `WS-XINT-003-08A` |
-| `review.revision_context.repair` | `project.task.manage` | Project Manager grant for exact project | invalid revision context | REV | install unavailable in 02C | `WS-XINT-003-08A` |
-| `review.revision_obligation.close` | `project.task.manage` | Project Manager grant for exact project | exact unfulfillable obligation | REV | install unavailable in 02C | `WS-XINT-003-08A` |
-| `review.revision_context.legacy_close` | `operations.reconcile.run` | Operator; canonical reason required | exact legacy revision context | REV | install unavailable in 02C | `WS-XINT-003-08A` |
-| `review.lifecycle.activation.manage` | `operations.reconcile.run` | Operator; exact phase and reason | lifecycle release controller | REV | install unavailable in 02C | `WS-XINT-003-08B` |
+| `review.revision_context.repair` | `project.task.manage` | Project Manager grant for exact project | invalid revision context | REV | registered planned/unavailable | `WS-XINT-003-08A` |
+| `review.revision_obligation.close` | `project.task.manage` | Project Manager grant for exact project | exact unfulfillable obligation | REV | registered planned/unavailable | `WS-XINT-003-08A` |
+| `review.revision_context.legacy_close` | `operations.reconcile.run` | Operator; canonical reason required | exact legacy revision context | REV | registered planned/unavailable | `WS-XINT-003-08A` |
+| `review.lifecycle.activation.manage` | `operations.reconcile.run` | Operator; exact phase and reason | lifecycle release controller | REV | registered planned/unavailable | `WS-XINT-003-08B` |
 | `review.reconcile.run` | `operations.reconcile.run` | one of two fixed reconciler identities | invalidation or general reconciliation batch | REV | registered planned | `WS-XINT-003-08B` |
 | `review.artifact_reference.reconcile` | `operations.reconcile.run` | fixed artifact-reference reconciler only | bounded review artifact reference batch | REV | registered planned | `WS-XINT-003-08B` |
 | `review.projection.rebuild` | `operations.projection.rebuild` | fixed projection rebuilder only | derived review projection batch | REV | registered planned | `WS-XINT-003-08B` |

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/REVIEW_LOG.md

@@ -129,3 +129,26 @@ round trip passes.
 PR #248 merged the completed chunk as `25fc27c4` on 2026-08-03. Backend, Agent
 Gates, and CodeRabbit passed on the final PR head. No review/revision lifecycle
 action was activated, and no successor chunk starts automatically.
+
+## WS-XINT-003-02C AUTH catalogue and principal readiness
+
+Architecture, security/auth, product/operations, QA, senior engineering, CI
+integrity, reuse/dedup, test-delta, and docs reviewers examined the bounded 02C
+implementation. Valid findings corrected the focused async-test selector,
+canonical catalogue counts and fixed-service documentation, exact PostgreSQL
+constraint-closure proof, no-grant provisioning proof, and operator-facing
+0049 downgrade guidance. The four new actions remain planned/unavailable; the
+six REV identities are registry and matrix values only, with no seeded
+principal or lifecycle behavior.
+
+Focused catalogue/service/custody tests pass (33 tests). Changed-module
+coverage is 100.00 percent for `service_identities.py` and 97.89 percent for
+`catalogue.py`. Ruff, mypy, collection, stale authorization/review scans, and
+Markdown links pass. Local PostgreSQL execution is unavailable because this
+worktree has no `WORKSTREAM_TEST_DATABASE_URL`; the exact 16 database-backed
+tests collect cleanly and remain assigned to hosted schema and semantic lanes.
+
+The first hosted semantic lanes exposed the expected post-0049 public-schema
+fingerprint change before running product tests. The chunk contract now permits
+only that exact `tests/conftest.py` fingerprint update; no reset allow-list or
+schema-integrity behavior changed.

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/STATUS.md

@@ -28,9 +28,9 @@ REV-owned semantics with AUTH-owned mutation authorization.
 - Runtime owner XINT-002-07 has one approved v0.1 sub-wave: 07A packet
   materialization. Evidence binding remains planned/unavailable and 07B is
   reserved pending separate REV-owned intent.
-- Registered review/revision lifecycle actions remain planned; four
-  lifecycle/recovery actions remain missing until front-loaded 02C registers
-  them unavailable. The superseded 08R placeholder is never executable. The
+- All 23 registered review/revision lifecycle actions remain planned; 02C adds
+  the four recovery/lifecycle rows and six fixed-service identities without
+  provisioning or authority. The superseded 08R placeholder is never executable. The
   two policy mutation actions activated by 02B are setup authority, not
   lifecycle activation.
 
@@ -49,9 +49,9 @@ REV-owned semantics with AUTH-owned mutation authorization.
 
 ## Next step
 
-Complete the reviewed AUTH-readiness amendment, then request implementation of
-WS-XINT-003-02C. 02C and 02D front-load the complete unavailable catalogue,
-fixed-service matrix, and fail-closed PREP contracts that REV needs before it
-begins its full lifecycle implementation. Do not infer review lifecycle
+Complete WS-XINT-003-02C evidence and review, then merge it before 02D. 02C and
+02D front-load the complete unavailable catalogue, fixed-service matrix, and
+fail-closed PREP contracts that REV needs before it begins its full lifecycle
+implementation. Do not infer review lifecycle
 activation from readiness: later action activation still requires exact merged
 REV behavior and integrated proof.

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-02C-auth-catalogue-principal-readiness.md

@@ -2,8 +2,8 @@
 
 ## Status
 
-Proposed planning contract. Refresh exact migration head and verification
-commands from current `main` before implementation.
+Current-main implementation contract refreshed from `ac52da6b`. Implementation
+and internal review are complete; hosted exact-head evidence is pending.
 
 ## Parent initiative
 
@@ -30,18 +30,26 @@ review SLA.
 
 ## Allowed files
 
-Refresh to exact current-main paths within:
-
 ```text
+backend/app/modules/actors/service_identities.py
 backend/app/modules/authorization/catalogue.py
-backend/app/modules/authorization/runtime.py
-backend/app/modules/authorization/<bounded service identity modules>
-backend/alembic/versions/<one new AUTH-owned migration>.py
-backend/tests/<bounded authorization and migration tests>
+backend/alembic/versions/0049_rev_auth_readiness.py
+backend/tests/test_authorization.py
+backend/tests/test_alembic.py
+backend/tests/test_auth.py
+backend/tests/conftest.py (exact post-0049 public-schema fingerprint only)
 docs/spec_authorization_service.md
+docs/spec_review_lifecycle.md
 docs/operations_authorization_service.md
 docs/operations_roles_permissions.md
-.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/**
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/ACTION_CUSTODY.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/CHUNK_MAP.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DECISIONS.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DISCOVERY.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/REVIEW_LOG.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/STATUS.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-02C-*.md
+.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-02C-auth-catalogue-principal-readiness.md
 .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md
 ```
 
@@ -77,15 +85,78 @@ docs/operations_roles_permissions.md
   existing ART/AUTH or project authorization row.
 - `review.finding_evidence.ingest` and
   `review.finding_response_evidence.ingest` receive an explicit
-  future-intent-required unavailable classification (or an equivalently closed
-  catalogue invariant) that ordinary v0.1 activation cannot select.
+  `FUTURE_INTENT_REQUIRED_ACTIONS` catalogue invariant, remain planned, appear
+  in no fixed-service matrix row, and cannot be selected by ordinary v0.1
+  activation.
+- The exact post-02C code catalogue is 71 PermissionIds, 100 ActionIds, 45
+  active actions, and 55 planned actions. No existing active action changes.
+- The new runtime activation custodians are exact: XINT-003-08A owns
+  `review.revision_context.repair`, `review.revision_obligation.close`, and
+  `review.revision_context.legacy_close`; XINT-003-08B owns
+  `review.lifecycle.activation.manage`. Their new owner cardinalities are 3 and
+  1. Existing 19 REV action owner rows/cardinalities remain unchanged until
+  their individual activation waves.
+- The exact fixed-service registry is 14 identities and the matrix is 14 rows
+  with 22 memberships. The two reconciliation identities are separate rows
+  sharing only `review.reconcile.run`.
+- `0049_rev_auth_readiness` follows `0048_policy_authority`, adds only the four
+  action/permission evidence pairs and six service-identity constraint values,
+  and seeds no ActorProfile, ActorIdentityLink, grant, authority, route, or job.
+- Downgrade locks evidence and actor tables first, refuses every direct or
+  idempotency-linked use of the four actions, refuses use of every new service
+  identity, and otherwise restores the exact 0048 constraints.
+- Tests named `test_xint003_02c_rev_auth_readiness_schema_and_roundtrip`,
+  `test_xint003_02c_rev_auth_readiness_guarded_action_evidence_downgrade`, and
+  `test_xint003_02c_rev_auth_readiness_guarded_identity_downgrade` prove the
+  empty round trip and every action/evidence-shape/identity refusal.
+- `test_xint003_02c_provisions_all_six_review_service_identities` exercises the
+  canonical service-actor API for every new identity without granting usable
+  lifecycle authority.
 
 ## Verification commands
 
-Refresh exact paths at implementation start, then include Ruff, focused unit
-and PostgreSQL catalogue/migration/service-matrix tests, changed-subsystem
-coverage at or above 90 percent, and hosted Backend coverage preserving the
-repository-wide 78 percent floor.
+```bash
+(cd backend && .venv/bin/ruff check \
+  app/modules/actors/service_identities.py \
+  app/modules/authorization/catalogue.py \
+  alembic/versions/0049_rev_auth_readiness.py \
+  tests/test_authorization.py tests/test_alembic.py tests/test_auth.py)
+(cd backend && PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv/bin/pytest \
+  -p pytest_asyncio.plugin -q \
+  tests/test_authorization.py \
+  -k 'closed_permission_and_action_catalogue or fixed_service or rev_custody')
+(cd backend && PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv/bin/pytest \
+  -p pytest_asyncio.plugin -q \
+  tests/test_auth.py -k 'service_actor or xint003_02c')
+(cd backend && .venv/bin/coverage erase && \
+  PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv/bin/coverage run -m pytest \
+  -p pytest_asyncio.plugin -q \
+  tests/test_authorization.py tests/test_auth.py \
+  -k 'closed_permission_and_action_catalogue or fixed_service or rev_custody or service_actor or xint003_02c' && \
+  .venv/bin/coverage report \
+  --include='app/modules/actors/service_identities.py' \
+  --precision=2 --fail-under=90 && \
+  .venv/bin/coverage report \
+  --include='app/modules/authorization/catalogue.py' \
+  --precision=2 --fail-under=90)
+(cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/postgres \
+  PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv/bin/python scripts/run_test_lanes.py \
+  --lane schema_contracts_a --metadata-dir .ci/xint-003-02c/schema-a \
+  --summary-json .ci/xint-003-02c/schema-a.json --timeout-seconds 1200)
+(cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/postgres \
+  PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv/bin/python scripts/run_test_lanes.py \
+  --lane schema_contracts_b --metadata-dir .ci/xint-003-02c/schema-b \
+  --summary-json .ci/xint-003-02c/schema-b.json --timeout-seconds 1200)
+python3 scripts/check_stale_authorization_docs.py
+python3 scripts/check_stale_review_contracts.py
+python3 scripts/check_markdown_links.py
+python3 scripts/check_stale_workstream_wording.py
+git diff --check
+```
+
+GitHub's Backend workflow runs the complete sharded suite and combined coverage
+report, preserving the repository-wide 78 percent floor. Changed authorization
+and actor modules must remain at or above 90 percent coverage.
 
 ## Required reviewers
 

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-02C-external-review-response.md

@@ -0,0 +1,30 @@
+# External Review Response: WS-XINT-003-02C
+
+## Hosted CI
+
+The first Backend run exposed the expected public-schema fingerprint change
+from migration 0049. The exact observed fingerprint replaced the pre-0049
+value; no reset allow-list or integrity behavior changed.
+
+The next schema-B lane exposed two fixture-only omissions: historical
+action-parity tests needed to exclude the new 0049 owners while exercising the
+0021/0022 snapshots, and each new service-profile downgrade fixture needed its
+mandatory identity link. Both fixture lifecycles now match their migration
+era; runtime constraints were not relaxed.
+
+Schema-A then confirmed PostgreSQL renders `actor_kind` literals with a
+different cast from the service-identity allow-list. The exact-value assertion
+continues parsing every `character varying` allow-list literal (including any
+unexpected namespace), while correctly excluding the separately cast
+`human`/`service` kind predicates.
+
+## CodeRabbit
+
+Two documentation findings were valid and fixed:
+
+- the original nineteen REV actions still retain their historical runtime
+  `ActionOwner` values until their exact activation waves replace them;
+- the 02C contract status now records completed implementation/internal review
+  and pending hosted exact-head evidence.
+
+No runtime or authorization behavior was relaxed in either correction.

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-02C-internal-review.md

@@ -0,0 +1,34 @@
+# Internal Review: WS-XINT-003-02C
+
+## Scope
+
+Final review of the availability-neutral REV authorization catalogue,
+fixed-service registry/matrix, and PostgreSQL parity migration.
+
+## Results
+
+- Architecture: PASS WITH LOW RISKS; 02C stays separate from PREP and REV behavior.
+- Security/auth: PASS WITH LOW RISKS; no grant, route, job, or active authority is added.
+- Product/operations: PASS WITH LOW RISKS; Project Manager, Operator, and service custody remain distinct.
+- QA: PASS WITH LOW RISKS after no-grant provisioning proof was added.
+- Senior engineering: PASS WITH LOW RISKS after current catalogue wording was corrected.
+- CI integrity: PASS WITH LOW RISKS after focused selectors explicitly loaded async support and selected 02C tests.
+- Test delta: PASS WITH LOW RISKS after exact database constraint closure replaced presence-only assertions.
+- Reuse/dedup: PASS; existing catalogue, matrix, migration, and fixture patterns remain the sole abstractions.
+- Docs: PASS WITH LOW RISKS after the complete fourteen-identity matrix and 0049 operator guidance were added.
+
+No blocking finding remains. All reviewer sessions completed.
+
+## Deterministic evidence
+
+- Ruff and mypy pass on the changed backend surface.
+- 33 focused catalogue, service-matrix, custody, and documentation tests pass.
+- Changed-module coverage is 100.00 percent for `service_identities.py` and
+  97.89 percent for `catalogue.py`.
+- All 16 exact database/API tests collect successfully.
+- Stale authorization/review scans, Markdown links, and whitespace checks pass.
+
+The worktree has no `WORKSTREAM_TEST_DATABASE_URL`; PostgreSQL execution, the
+six-principal API case, schema lanes, and repository-wide 78-percent coverage
+remain assigned to hosted GitHub Actions on the exact PR head.
+

.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-02C-pr-trust-bundle.md

@@ -0,0 +1,46 @@
+# PR Trust Bundle: WS-XINT-003-02C
+
+## Intent and scope
+
+Register the complete unavailable REV authorization vocabulary and exact fixed
+service principals before REV implementation begins. This chunk adds four
+planned actions, six closed identities, six static matrix rows, and database
+parity only.
+
+## Design and safety
+
+- Catalogue totals become 71 permissions, 100 actions, 45 active, and 55 planned.
+- The fixed-service registry becomes fourteen rows with twenty-two memberships.
+- Two separate reconciliation identities share only `review.reconcile.run`;
+  future REV code must derive their modes server-side.
+- Evidence-ingest actions remain planned, outside the service matrix, and
+  protected by `FUTURE_INTENT_REQUIRED_ACTIONS`.
+- Migration 0049 seeds no principal or authority and refuses unsafe downgrade
+  after direct/linked action evidence or use of any new identity.
+
+## Exclusions
+
+No REV queue, lease, finding, decision, revision, recovery, projection,
+lifecycle behavior, PREP protocol, route, worker, provider I/O, or action
+activation is included.
+
+## Evidence
+
+- Ruff: pass.
+- Mypy: pass.
+- Focused tests: 33 passed.
+- Changed-module coverage: 100.00 and 97.89 percent.
+- Exact DB/API collection: 16 tests collected.
+- Internal architecture, security, product, QA, senior, CI, test-delta, reuse,
+  and docs review: pass; valid findings resolved.
+- Markdown links, stale review contracts, and diff whitespace: pass.
+
+Hosted GitHub Actions must provide PostgreSQL schema/API execution, full-suite
+coverage (repository 78 percent and changed authorization/actor subsystems 90
+percent), and the final exact-head merge evidence.
+
+## Human review focus
+
+Verify the four action/permission/owner triples, the six identity-to-action
+rows, the exact 0048-to-0049 constraint transformation, and that no availability
+or product behavior changed.