ART PLAN5: resequence legacy precheck clean cut

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/CHUNK_MAP.md

@@ -23,19 +23,20 @@ they cross multiple L1 boundaries.
 | Chunk | Goal | Risk | Entry gate/status |
 |---|---|---:|---|
 | `WS-ART-001-PLAN3` | Reconcile the complete remaining v0.1 custody chain and AUTH/REV/CON handoffs. | L1 | Merged planning |
-| `WS-ART-001-PLAN4` | Define the central default pre-submission checker catalogue, disable semantics, and split execution contract. | L1 | Planning complete; internal review passed; PR pending |
+| `WS-ART-001-PLAN4` | Define the central default pre-submission checker catalogue, disable semantics, and split execution contract. | L1 | Merged PR #271 |
+| `WS-ART-001-PLAN5` | Correct legacy-precheck removal sequencing so the old public and internal paths are deleted only with the admission-backed Submission cutover. | L1 | Planning complete; PR pending |
 | `WS-ART-001-03C` | Clean-cut legacy guide identity/excerpts and make the verified same-generation pipeline live. | L1 | Merged PR #249 |
 | `WS-ART-001-04A1` | Remove legacy multi-step contributor intake reachability and schema without adding the replacement route. | L1 | Merged PR #264 |
 | `WS-ART-001-04A2` | Add bounded one-outer-ZIP intake and archive-safety inspection in private scratch. | L1 | Merged PR #266 |
 | `WS-ART-001-04A3` | Add canonical semantic manifest, executable normalization, and unchanged-work gate. | L1 | Merged PR #268 |
-| `WS-ART-001-04A4` | Remove the legacy independently invocable caller-owned submission-precheck route and contract. | L1 | Proposed after PLAN4 |
-| `WS-ART-001-04B1` | Add the single versioned checker catalogue and compile one effective execution plan from platform defaults plus locked project policy. | L1 | Proposed after 04A4 |
+| `WS-ART-001-04A4` | Former early removal of the legacy independently invocable caller-owned submission-precheck route and contract. | L1 | Superseded by PLAN5; complete removal belongs to 05B |
+| `WS-ART-001-04B1` | Add the single versioned checker catalogue and compile one effective execution plan from platform defaults plus locked project policy. | L1 | Proposed after PLAN5 |
 | `WS-ART-001-04B2` | Materialize the sealed manifest tree once and execute the mandatory platform/default catalogue phases. | L1 | Proposed after 04B1 |
 | `WS-ART-001-04B3` | Execute locked project-policy rules through the same plan and persist one bounded immutable evidence set. | L1 | Proposed after 04B2 |
 | `WS-ART-001-04C1` | Reauthorize and atomically persist capacity plus durable put intent, then write the checked ZIP once. | L1 | Proposed after XINT-06A |
 | `WS-ART-001-04C2` | Reuse verification/recovery to publish one capacity-charged ready admission and compose the hidden continuous endpoint. | L1 | Proposed after 04C1 |
 | `WS-ART-001-05A` | Atomically consume ready admission into one immutable Submission and binding under fresh human/service authority. | L1 | Proposed after XINT-05A |
-| `WS-ART-001-05B` | Remove legacy package URI/hash/manifest authority and cut live API/automatic post-submit dispatch to the verified binding. | L1 | Proposed after XINT-05B |
+| `WS-ART-001-05B` | Atomically cut the live Submission API/dispatch to verified admission and remove the complete legacy standalone/internal precheck and caller-owned package contract. | L1 | Proposed after XINT-05B |
 | `WS-ART-001-06A` | Persist post-submit checker input snapshot and integrity-checking materialization. | L1 | Proposed after 05B |
 | `WS-ART-001-06B` | Store/bind checker outputs and preserve checker-owned routing. | L1 | Proposed after 06A |
 | `WS-ART-001-07A` | Add lease-scoped exact-binding reviewer packet materialization without review lifecycle ownership. | L1 | Proposed after 06B plus hidden REV manifest |
@@ -49,7 +50,7 @@ they cross multiple L1 boundaries.
 ```text
 AUTH-04B implementation [merged PR #245]
 -> ART-03C
--> ART-04A1 -> 04A2 -> 04A3 -> PLAN4 -> 04A4 -> 04B1 -> 04B2 -> 04B3
+-> ART-04A1 -> 04A2 -> 04A3 -> PLAN4 -> PLAN5 -> 04B1 -> 04B2 -> 04B3
 -> XINT-06A pre-submit materializer activation
 -> ART-04C1 -> 04C2
 -> XINT-05A contributor preparation activation

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DECISIONS.md

@@ -577,10 +577,16 @@ must not silently remain universal blocking rules; the implementing chunk must
 classify them as narrowly high-confidence blocking checks, advisory checks, or
 project-specific policy and prove the migration.
 
-## D55 - Legacy Standalone Precheck Is Removed Before Catalogue Execution
+## D55 - Legacy Precheck Is Removed Only With Admission-Backed Submission Cutover
 
 The existing caller-owned `/submission-precheck` request cannot prove the exact
-uploaded ZIP or sealed server manifest and would create a second execution API.
-04A4 removes its route, schemas, service entry point, and OpenAPI surface before
-04B1 installs the authoritative catalogue. Pre-production accepts this clean-cut
-gap; there is no compatibility alias, redirect, or caller-manifest adapter.
+uploaded ZIP or sealed server manifest and must not survive the authoritative
+cutover. Removing its shared service before admission-backed Submission creation
+exists would either permit unchecked legacy Submission creation or preserve a
+hidden compatibility seam. PLAN5 therefore supersedes early chunk 04A4. The
+legacy route and the mandatory internal legacy Submission guard remain frozen
+while 04B1-04C2 and 05A build the replacement. ART-05B removes the route,
+schemas, public service entry point, internal guard, and caller-owned package
+contract together when verified admission consumption becomes the only live
+Submission path. No alias, redirect, fallback, or caller-manifest adapter is
+allowed.

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/PLAN.md

@@ -714,7 +714,7 @@ AUTH-04B implementation/activation [merged PR #245]
 -> ART-04A1 legacy contributor-intake removal
 -> ART-04A2 bounded outer-ZIP safety/intake
 -> ART-04A3 semantic manifest + unchanged-work gate
--> ART-04A4 legacy standalone precheck clean cut
+-> PLAN5 legacy-precheck clean-cut resequencing
 -> ART-04B1 default-checker catalogue and effective-plan contract
 -> ART-04B2 sealed scratch materialization and platform-default execution
 -> ART-04B3 locked-project execution and immutable bounded evidence
@@ -724,7 +724,7 @@ AUTH-04B implementation/activation [merged PR #245]
 -> XINT-05A contributor preparation activation
 -> ART-05A atomic Submission/binding/admission consumption
 -> XINT-05B Submission/binding activation
--> ART-05B legacy Submission transport/API + automatic dispatch clean cut
+-> ART-05B admission-backed Submission/API/dispatch cutover plus complete legacy precheck removal
 -> ART-06A post-submit checker snapshot/materialization
 -> ART-06B checker output binding and routing
 -> XINT-06B post-submit/output activation
@@ -742,6 +742,15 @@ No intermediate HTTP route, durable upload session, scratch handle, local path,
 or prepared authorization crosses those PR boundaries. 04C2 alone composes the
 hidden endpoint after every internal dependency exists.
 
+PLAN5 supersedes the former early 04A4 removal. The legacy standalone precheck
+route and its internal `TaskService.create_submission` safety guard remain
+temporary legacy behavior only until the verified-admission Submission path is
+ready. They receive no new features or compatibility adapters. ART-05B then
+deletes the route, public schemas/service entry point, internal guard, and
+caller-owned package/hash/manifest contract in the same clean-cut transaction
+and API migration that makes admission consumption authoritative. There is no
+interval in which unchecked legacy Submission creation is reachable.
+
 XINT-06 must split because live preparation requires the fixed pre-submit
 materializer before XINT-05A can safely activate the human preparation action.
 The later 06B activation owns only post-submit materialization plus checker

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/REVIEW_LOG.md

@@ -334,3 +334,15 @@
   repair. Architecture additionally required authority-neutral shared result
   identity and complete platform/default dispatch mapping; both were repaired
   before final publication.
+
+## WS-ART-001-PLAN5
+
+- Preimplementation discovery found that PLAN4's proposed 04A4 deletion shared
+  its service with the mandatory guard inside live legacy Submission creation.
+- Architecture review passed only with resequencing; security and product/ops
+  reviews blocked the original contract because it could permit unchecked
+  Submission creation, break the live path, or create a private compatibility
+  seam.
+- The correction supersedes 04A4, makes 04B1 the next implementation chunk, and
+  assigns the complete standalone/public/internal/caller-package clean cut to
+  the admission-backed 05B Submission cutover.

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/RISKS.md

@@ -71,4 +71,4 @@
 | A disabled mandatory checker is treated as a pass | Critical | Mandatory security, integrity, and accountability entries fail preparation closed when disabled; only advisory entries may be disabled while execution continues, with explicit evidence. |
 | Broad filename heuristics block legitimate generic projects | High | Keep only narrowly high-confidence universal exclusions blocking; classify ambiguous patterns as advisory or project-specific and test false-positive boundaries. |
 | Project policy or task parameters toggle platform availability | Critical | Catalogue availability is startup-validated deployment state; project policy can add or narrow rules but never disable or downgrade Workstream defaults. |
-| Legacy caller-owned precheck remains beside the new catalogue | Critical | 04A4 removes the route/schema/service/OpenAPI surface before 04B1; no alias or adapter may preserve independent execution. |
+| Legacy caller-owned precheck survives or is removed before its replacement is safe | Critical | Freeze it while hidden 04B1-05A builds the authoritative path; 05B atomically removes the route/schema/public service/internal guard and caller package contract as admission-backed Submission becomes live. No alias or adapter may preserve independent execution. |

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md

@@ -116,13 +116,15 @@ authoritative. ART-04A2 merged through PR #266. ART-04A3 merged through PR #268
 and provides canonical server-derived semantic manifests, executable
 normalization, and fail-closed unchanged-work comparison.
 
-`WS-ART-001-PLAN4` is the planning-only correction, implemented with all
-required internal L1 review tracks passing. It replaces the
-oversized 04B contract with 04A4 legacy standalone-precheck removal, 04B1
-catalogue/effective-plan composition, 04B2 sealed materialization plus mandatory
-platform/default execution, and 04B3 locked-project execution plus immutable
-bounded evidence. No runtime behavior or AUTH availability changes in PLAN4;
-hosted PR gates and human merge remain pending.
+`WS-ART-001-PLAN4` merged through PR #271. Discovery for its proposed 04A4
+implementation proved the early clean cut unsafe because live legacy Submission
+creation still calls the shared precheck service and the verified-admission
+replacement is not yet available. PLAN5 is the active planning correction: it
+supersedes 04A4, makes 04B1 the next implementation chunk, and assigns complete
+legacy route/public-service/internal-guard/caller-package removal to the 05B
+admission-backed Submission cutover. All required internal L1 reviews pass after
+repair; local documentation and agent gates pass. No runtime behavior or AUTH
+availability changes in PLAN5; hosted PR review remains pending.
 
 ## Gate
 

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04A4-legacy-precheck-removal.md

@@ -1,67 +1,43 @@
 # Chunk Contract: WS-ART-001-04A4 - Legacy Standalone Precheck Removal
 
-Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after PLAN4 approval
+Initiative: `WS-ART-001` | Risk: L1 | Status: Superseded by PLAN5
 
 Artifact contract phase: `upload_admission`
 
 ## Goal
 
-Remove the independently invocable caller-owned submission-precheck API before
-the authoritative server-derived catalogue path is installed. This is a clean
-cut with no replacement route in this chunk.
+Historical contract only. PLAN5 proved that removing the shared precheck service
+before admission-backed Submission creation exists would create an unchecked
+legacy Submission path or force a forbidden compatibility seam. No runtime work
+is authorized by this contract. Complete removal is reassigned to 05B.
 
 ## Allowed Files
 
-- checker router/service/schema removal for
-  `/api/v1/tasks/{task_id}/submission-precheck`;
-- removal of pre-submit-only legacy request/response helpers and registry
-  membership after proof that no durable/post-submit caller uses them;
-- OpenAPI, route-negative, import/reachability, docs, and focused tests;
-- CI only to preserve exact existing coverage gates.
+- none; this contract is retained only as durable planning history.
 
 ## Not Allowed
 
-- new catalogue, checker execution, ZIP/scratch changes, provider I/O, durable
-  evidence/admission/Submission, compatibility alias, redirect, or fallback;
-- removal of compiler primitives or durable/post-submit checker behavior needed
-  by 04B1/04B3 and later ART-06;
-- AUTH availability/grant changes or public replacement endpoints.
+- any runtime implementation under the 04A4 identifier;
+- partial route-only or service-only removal;
+- a private compatibility replacement for the shared legacy guard.
 
 ## Acceptance Criteria
 
-- route and OpenAPI schema are absent and return the canonical not-found result;
-- caller-owned `artifact_hash_manifest`, package/provider references, and legacy
-  packet shape cannot reach a pre-submit service through HTTP or internal public
-  methods;
-- no alias, redirect, compatibility parser, or second registry survives;
-- constrained compiler primitives and durable post-submit runner behavior remain
-  available for 04B1 reuse;
-- import/reachability tests prove no product composition root exposes the old
-  path;
-- no artifact, task, Submission, checker-run, audit, or AUTH behavior is added;
-- focused subsystem coverage is at least 90 percent and repository coverage
-  remains at least 78 percent.
+- canonical PLAN, CHUNK_MAP, DECISIONS, RISKS, STATUS, and 05B contract assign
+  the complete clean cut to 05B;
+- 04B1 follows PLAN5 without an intervening partial-removal implementation.
 
 ## Verification
 
-```bash
-(cd backend && .venv/bin/pytest tests/test_submission_precheck_removal.py tests/test_openapi_contract.py tests/test_checker_runner.py -q)
-(metadata_dir="$(mktemp -d)" && trap 'rm -rf "$metadata_dir"' EXIT && (cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/postgres .venv/bin/python scripts/run_isolated_tests.py --metadata-json "$metadata_dir/result.json" --timeout-seconds 12600 -- .venv/bin/python -m pytest -q --ignore=tests/test_isolated_database_runner.py --cov=app --cov-report=term-missing --cov-fail-under=78))
-(cd backend && .venv/bin/coverage report --include='app/modules/checkers/*,app/api/router.py' --precision=2 --fail-under=90)
-(cd backend && .venv/bin/ruff check app tests)
-python3 scripts/check_stale_artifact_contracts.py
-python3 scripts/check_stale_workstream_wording.py
-python3 scripts/check_markdown_links.py
-PYTHONPATH=. python3 scripts/test_lightweight_agent_gates.py
-```
+Documentation gates only; no application tests are authorized by this
+superseded contract.
 
 ## Required Reviewers
 
-Senior engineering, architecture, QA/test, security/auth, product/ops,
-reuse/dedup, CI integrity, test delta, and docs.
+Architecture, security/auth, product/ops, senior engineering, QA/test, docs,
+reuse/dedup, CI integrity, and test delta review PLAN5.
 
 ## Human Review Focus
 
-- Is the old API truly unreachable rather than hidden behind an alias?
-- Were reusable compiler/post-submit capabilities preserved?
-- Does this chunk introduce no replacement behavior?
+- Does the resequencing prevent both unchecked legacy Submission creation and a
+  long-lived compatibility seam?

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04B1-default-checker-catalogue.md

@@ -1,6 +1,6 @@
 # Chunk Contract: WS-ART-001-04B1 - Default Checker Catalogue
 
-Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after PLAN4 approval
+Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after PLAN5
 
 Artifact contract phase: `upload_admission`
 

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-05B-submission-api-cutover.md

@@ -4,13 +4,16 @@ Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after XINT-05B
 
 ## Goal
 
-Make verified admission consumption the only contributor Submission path and
-dispatch post-submit work using immutable identifiers rather than package data.
+Make verified admission consumption the only contributor Submission path,
+dispatch post-submit work using immutable identifiers rather than package data,
+and remove the complete legacy standalone and internal precheck path once and
+for all.
 
 ## Allowed Files
 
-Submission schemas/router/service, exact legacy field migration/removal,
-post-submit dispatch payloads, API examples, focused tests/docs/CI evidence.
+Submission and checker schemas/routers/services, exact legacy field and precheck
+removal, post-submit dispatch payloads, API examples, focused tests/docs/CI
+evidence.
 
 ## Not Allowed Changes
 
@@ -21,14 +24,37 @@ generic artifact download, AUTH catalogue/availability, or compatibility paths.
 
 - the public request accepts an admission identity, not URI/hash/manifest facts;
 - caller-owned package identity fields are unreachable and removed safely;
+- `/api/v1/tasks/{task_id}/submission-precheck`, its OpenAPI schemas, and its
+  public service entry point are absent and return canonical not-found;
+- the legacy internal `TaskService.create_submission` precheck guard is removed
+  in the same cutover because Submission creation can consume only an exact
+  verified ready admission;
+- no alias, redirect, fallback, private compatibility service, caller-owned
+  manifest input, or second checker registry survives;
+- pending, failed, expired, stale, consumed, cross-task, cross-project, and
+  otherwise non-ready admissions cannot create a Submission or dispatch work;
+- mixed admission-plus-legacy package requests fail closed rather than choosing
+  one authority source;
+- concurrent consumption of one ready admission creates exactly one Submission,
+  one binding, one admission transition, and one downstream dispatch;
+- exact idempotent replay returns the original business effect while conflicting
+  replay fails with the stable domain conflict;
 - response exposes immutable Submission/binding identities without provider URLs;
 - Celery payloads contain durable identifiers/version facts only;
 - old and new paths cannot coexist or create duplicate business effects.
 
 ## Verification Commands
 
-Focused API, schema, migration, dispatch, replay, stale-field, coverage, and
-hosted Backend/Agent Gates.
+- focused API/schema tests prove admission-only creation and reject legacy
+  `package_uri`, `package_hash`, `artifact_hash_manifest`, and mixed requests;
+- PostgreSQL state-matrix and concurrency tests prove non-ready/cross-resource
+  rejection, exact replay, one consumption, one Submission, and one dispatch;
+- route/OpenAPI/import-reachability tests prove the removed
+  `/api/v1/tasks/{task_id}/submission-precheck` route, schemas, public service
+  method, aliases, redirects, fallbacks, compatibility path, and second registry
+  are absent;
+- migration, stale-field, focused 90 percent subsystem coverage, repository 78
+  percent coverage, and hosted Backend/Agent Gates pass.
 
 ## Required Reviewers
 
@@ -37,4 +63,6 @@ reuse/dedup, test delta, and docs.
 
 ## Human Review Focus And Stop Conditions
 
-Review the clean cut and API compatibility impact. Stop before checker changes.
+Review the complete clean cut, proof that unchecked Submission creation is
+impossible, and API compatibility impact. Do not change authoritative catalogue
+definitions or checker semantics in this cutover.