WS-QUAL-001-02R: deepen project setup behavior coverage

.agent-loop/initiatives/WS-QUAL-001-backend-coverage-floor/STATUS.md

@@ -2,25 +2,29 @@
 
 ## Current state
 
-`WS-QUAL-001-PLAN2` has reconciled the initiative against current `main` after
-the documentation cleanup merged through PR #259. Deterministic documentation
-checks and all required internal plan reviewers pass after scope, ownership,
-contract, runtime, and historical-classification repairs. No QUAL implementation
-chunk is active; PLAN2 awaits GitHub and human review.
-
-The latest complete hosted baseline after ART-03C is 88.575080 percent across
-23,475 statements and 2,925 tests. The global CI floor remains 78 percent. Multiple
-named changed subsystems already have blocking 90-percent checks.
+`WS-QUAL-001-PLAN2` merged through PR #260. `WS-QUAL-001-02R` is now at its
+external-review gate with a test-only implementation and passing required
+internal reviews.
+
+The latest complete current-main hosted baseline is Backend run `30891776021`
+on `b47a7e64`: 88.603709 percent across 23,455 statements and 2,936 tests.
+02R's first exact-head hosted run passed but measured 21,003 covered
+statements, or 89.545939 percent, one statement below the chunk's 89.55-percent
+target. A meaningful project-agent composition test now covers that remaining
+factory statement and awaits exact-head hosted verification. The global CI
+floor remains 78 percent; named protected subsystem checks remain blocking at
+90 percent.
 
 Historical QUAL work delivered the isolated database runner and test-integrity
 guards through PRs #103, #105, and #108. The many stopped semantic-analysis
 replacements remain historical evidence, not work to resume.
 
 ## Current gate
 
-Merge PLAN2 after GitHub and human review. The first proposed implementation successor is
-`WS-QUAL-001-02R`, limited to meaningful project/setup tests. It must be
-refreshed on the then-current `main` before implementation.
+Require Agent Gates, CodeRabbit, all Backend semantic lanes, final coverage
+fan-in, and human review for `WS-QUAL-001-02R`. Hosted coverage must be at least
+89.55 percent, and an unexplained hosted runtime increase above 10 percent
+stops merge readiness.
 
 ## Stop condition
 

.agent-loop/initiatives/WS-QUAL-001-backend-coverage-floor/reviews/WS-QUAL-001-02R-external-review-response.md

@@ -0,0 +1,35 @@
+# WS-QUAL-001-02R External Review Response
+
+## CodeRabbit finding addressed
+
+CodeRabbit correctly found that three new tests cleared the cached settings
+only inline. A failing assertion could therefore leave an environment-derived
+`Settings` object cached after `monkeypatch` restored the environment.
+
+The repair adds `isolated_project_settings_cache`, which clears before the test
+and unconditionally clears in a `finally` block. The submission-policy approval
+test and both parameterized queue tests use the fixture. Inline cache clearing
+was removed.
+
+## Verification
+
+- `cd backend && .venv/bin/ruff check tests/test_projects.py` — pass.
+- Repaired focused selection — 5 passed, 376 deselected in 52.59 seconds.
+- `git diff --check` — pass.
+
+## Deferred comments
+
+None.
+
+## Hosted coverage correction
+
+Backend run `30902039458` passed all five semantic lanes and the final fan-in
+on repaired head `055b0db4`. It completed 2,995 tests with 21,003 / 23,455
+covered statements (89.545939 percent), 671.329 seconds total hosted wall time,
+and a 500.118-second slowest lane. Runtime remained within the contract, but
+coverage missed the 89.55-percent target by one statement.
+
+The final test exercises the real project-agent composition boundary and
+asserts that the runtime factory receives the current settings. Ruff and the
+focused test pass locally. Fresh exact-head Agent Gates, Backend, and external
+review status remain required.

.agent-loop/initiatives/WS-QUAL-001-backend-coverage-floor/reviews/WS-QUAL-001-02R-internal-review-evidence.md

@@ -0,0 +1,62 @@
+# WS-QUAL-001-02R Internal Review Evidence
+
+## Reviewed revision
+
+- Code SHA: `f32ebc6c0c2cf8411ca0373127b0fefd523156f8`
+- Base SHA: `b47a7e64f7d75cda8a0681d1aff3bf0c4a5be4aa`
+- Reviewed at: `2026-08-04T09:02:29Z`
+- Open reviewer sessions: none
+- Valid findings addressed: yes
+
+## Reviewer results
+
+| Reviewer | Result | Blocking findings | Notes |
+|---|---:|---|---|
+| senior engineering | PASS WITH LOW RISKS | None | Large test module and fake fidelity are future maintainability risks. |
+| QA/test | PASS WITH LOW RISKS | None | Exact-head hosted coverage remains the final acceptance proof. |
+| test delta | PASS | None | Additive tests; no skips, xfails, deleted assertions, or exclusions. |
+| CI integrity | PASS WITH LOW RISKS | None | No CI changes; hosted fan-in and runtime evidence remain required. |
+| product/ops | PASS | None | Project setup provenance and lifecycle semantics are preserved. |
+| reuse/dedup | PASS | None | No blocking duplicate helper or parallel convention. |
+
+Security/auth, architecture, and docs review are not required for this
+test-only chunk: it changes no production boundary, authorization behavior,
+architecture, public contract, or contributor documentation.
+
+## Findings addressed
+
+- The first review found the branch behind `main`. Current `main` was merged;
+  the resulting delta is only `backend/tests/test_projects.py`.
+- The first QA pass used PLAN2's older baseline. The refreshed authoritative
+  hosted baseline is Backend run `30891776021` on `b47a7e64`: 20,782 covered of
+  23,455 statements. The exact 89.55-percent threshold is 21,004 statements.
+- The first exact-head hosted fan-in measured 21,003 / 23,455, or 89.545939
+  percent, one statement below the chunk target. A final focused composition
+  test now executes `app.core.project_agents.get_project_guide_agent_runtime`
+  and asserts that it supplies current settings to the adapter factory.
+- Senior engineering, QA, test delta, CI integrity, product/ops, and
+  reuse/dedup each re-reviewed this final one-test delta. All passed; CI
+  integrity retains only the expected low risk that hosted exact-head evidence
+  remains authoritative.
+
+## Commands and evidence
+
+- `cd backend && .venv/bin/ruff check tests/test_projects.py` — pass.
+- Focused new-test review run — 59 passed, 322 deselected; reviewer-observed
+  times ranged from 60.45 to 90.22 seconds on the constrained local machine.
+- Final composition test — pass; all six focused reviewer tracks independently
+  observed the test or inspected the exact delta.
+- `git diff --check origin/main...HEAD` — pass.
+- Allowed path check — only `backend/tests/test_projects.py` before this
+  evidence record was added.
+- Test-delta scan — no skip, xfail, assertion deletion, or coverage exclusion.
+- Full isolated `test_projects.py` run — no failure observed, but the bounded
+  local runner timed out at 1,200 seconds at 40 percent completion. This machine
+  is not accepted as runtime evidence; hosted Backend is mandatory.
+
+## Remaining risks
+
+- Hosted Backend must prove the exact final coverage and complete test result.
+- Compare hosted wall and slowest-lane time with main run `30891776021`
+  (718.586 seconds wall; 546.201 seconds slowest lane). An unexplained increase
+  above 10 percent stops merge readiness for review.

.agent-loop/initiatives/WS-QUAL-001-backend-coverage-floor/reviews/WS-QUAL-001-02R-pr-trust-bundle.md

@@ -0,0 +1,80 @@
+# WS-QUAL-001-02R PR Trust Bundle
+
+## Goal and scope
+
+Add meaningful fast project/setup behavior tests under the reviewed
+`WS-QUAL-001-02R` contract. The implementation changes
+`backend/tests/test_projects.py`; this evidence and status update remain within
+the allowed QUAL initiative tree. No production, migration, workflow,
+threshold, dependency, or public API file changes.
+
+## What changed
+
+- Added direct behavior coverage for payment-policy persistence, canonical
+  project resolution, strict effective-policy limits, activation readiness,
+  submission-policy derivation and approval, correction/supersession, setup
+  queue payloads and bounded failures, post-submit summaries, and correction
+  history, plus project-agent runtime composition from current settings.
+- Added 60 focused cases through 17 test functions and parameterization.
+- Reused production service, repository, and queue entry points without adding
+  duplicate broad HTTP/PostgreSQL flows.
+
+## Exact baseline and projected acceptance
+
+Current-main Backend run `30891776021` on
+`b47a7e64f7d75cda8a0681d1aff3bf0c4a5be4aa` recorded:
+
+- 2,936 completed tests;
+- 20,782 covered of 23,455 statements (88.603709 percent);
+- 718.586 seconds hosted wall time;
+- 546.201 seconds in the slowest lane.
+
+The 89.55-percent threshold requires `ceil(23,455 * 0.8955) = 21,004`
+covered statements. The first exact-head run (`30902039458`) passed every
+semantic lane and the final fan-in, but measured 21,003 / 23,455, or
+89.545939 percent: one statement below this chunk's stricter contract target.
+The final composition-boundary test exercises the previously uncovered
+project-agent runtime factory statement. A fresh GitHub exact-head fan-in is
+authoritative for acceptance.
+
+## Test and CI integrity
+
+- Ruff passes for the changed test file.
+- Focused new tests pass; reviewer runs observed 59 passing cases before the
+  final one-case composition correction, which also passes independently.
+- No test was removed, skipped, xfailed, weakened, or excluded from coverage.
+- No workflow, runner, lane, coverage command, or threshold changed.
+- Stale wording, authorization documentation, artifact contract, Markdown
+  link, lightweight Agent Gates, whitespace, and allowed-path checks pass.
+- The constrained local full-file run timed out at 1,200 seconds without a
+  test failure at 40 percent. It is not used as performance evidence.
+
+## Internal review
+
+Senior engineering, QA, test delta, CI integrity, product/ops, and reuse/dedup
+all passed on code revision `f32ebc6c0c2cf8411ca0373127b0fefd523156f8`.
+Focused re-review of the CodeRabbit repair passed on `055b0db4`; the final
+one-test coverage correction is undergoing focused re-review. Low risks are
+the size of the existing mixed test module, fake fidelity, and the need to
+confirm exact coverage/runtime in hosted CI.
+
+## External review
+
+| Source | Status | Required outcome |
+|---|---:|---|
+| Agent Gates | Passed on `055b0db4` | Must pass again on final exact PR head |
+| Backend | Correction pending | Run `30902039458` passed, but 89.545939 percent missed the contract by one statement; final head must reach >=89.55 percent |
+| CodeRabbit | Passed/rate-limited on `055b0db4` | Settings-cache finding repaired and answered; final exact-head status required |
+
+## Human review focus
+
+- Confirm the tests assert real project/setup behavior rather than percentage
+  padding.
+- Inspect fake fidelity around policy provenance and queue state transitions.
+- Confirm hosted coverage reaches at least 89.55 percent and hosted runtime
+  does not increase by more than 10 percent without explanation.
+
+## Stop
+
+This chunk does not raise the global CI floor. It stops for human review after
+the exact-head external checks complete.