ART-04B1: add pre-submission checker catalogue

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/CHUNK_MAP.md

@@ -24,13 +24,13 @@ they cross multiple L1 boundaries.
 |---|---|---:|---|
 | `WS-ART-001-PLAN3` | Reconcile the complete remaining v0.1 custody chain and AUTH/REV/CON handoffs. | L1 | Merged planning |
 | `WS-ART-001-PLAN4` | Define the central default pre-submission checker catalogue, disable semantics, and split execution contract. | L1 | Merged PR #271 |
-| `WS-ART-001-PLAN5` | Correct legacy-precheck removal sequencing so the old public and internal paths are deleted only with the admission-backed Submission cutover. | L1 | Planning complete; PR pending |
+| `WS-ART-001-PLAN5` | Correct legacy-precheck removal sequencing so the old public and internal paths are deleted only with the admission-backed Submission cutover. | L1 | Merged PR #273 |
 | `WS-ART-001-03C` | Clean-cut legacy guide identity/excerpts and make the verified same-generation pipeline live. | L1 | Merged PR #249 |
 | `WS-ART-001-04A1` | Remove legacy multi-step contributor intake reachability and schema without adding the replacement route. | L1 | Merged PR #264 |
 | `WS-ART-001-04A2` | Add bounded one-outer-ZIP intake and archive-safety inspection in private scratch. | L1 | Merged PR #266 |
 | `WS-ART-001-04A3` | Add canonical semantic manifest, executable normalization, and unchanged-work gate. | L1 | Merged PR #268 |
 | `WS-ART-001-04A4` | Former early removal of the legacy independently invocable caller-owned submission-precheck route and contract. | L1 | Superseded by PLAN5; complete removal belongs to 05B |
-| `WS-ART-001-04B1` | Add the single versioned checker catalogue and compile one effective execution plan from platform defaults plus locked project policy. | L1 | Proposed after PLAN5 |
+| `WS-ART-001-04B1` | Add the single versioned checker catalogue and compile one effective execution plan from platform defaults plus locked project policy. | L1 | Active implementation |
 | `WS-ART-001-04B2` | Materialize the sealed manifest tree once and execute the mandatory platform/default catalogue phases. | L1 | Proposed after 04B1 |
 | `WS-ART-001-04B3` | Execute locked project-policy rules through the same plan and persist one bounded immutable evidence set. | L1 | Proposed after 04B2 |
 | `WS-ART-001-04C1` | Reauthorize and atomically persist capacity plus durable put intent, then write the checked ZIP once. | L1 | Proposed after XINT-06A |

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md

@@ -119,12 +119,23 @@ normalization, and fail-closed unchanged-work comparison.
 `WS-ART-001-PLAN4` merged through PR #271. Discovery for its proposed 04A4
 implementation proved the early clean cut unsafe because live legacy Submission
 creation still calls the shared precheck service and the verified-admission
-replacement is not yet available. PLAN5 is the active planning correction: it
+replacement is not yet available. PLAN5 merged through PR #273: it
 supersedes 04A4, makes 04B1 the next implementation chunk, and assigns complete
 legacy route/public-service/internal-guard/caller-package removal to the 05B
-admission-backed Submission cutover. All required internal L1 reviews pass after
-repair; local documentation and agent gates pass. No runtime behavior or AUTH
-availability changes in PLAN5; hosted PR review remains pending.
+admission-backed Submission cutover.
+
+`WS-ART-001-04B1` is active on its bounded worktree. It owns only the immutable
+typed catalogue, startup-fixed availability validation, migration of the
+existing compiler away from parallel primitive maps, and pure composition of
+one lineage-bound effective plan. It performs no ZIP read, scratch
+materialization, checker execution, durable write, route exposure, or AUTH
+activation.
+
+The implementation and deterministic evidence are complete in draft PR #276.
+All required internal reviewer tracks ran successfully after their valid
+findings were repaired. CodeRabbit completed substantive review and its two
+actionable threads were repaired and resolved. The ready PR now waits only for
+the final hosted Backend rerun on the repaired head.
 
 ## Gate
 

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04B1-default-checker-catalogue.md

@@ -1,6 +1,6 @@
 # Chunk Contract: WS-ART-001-04B1 - Default Checker Catalogue
 
-Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after PLAN5
+Initiative: `WS-ART-001` | Risk: L1 | Status: Ready PR pending final hosted Backend rerun
 
 Artifact contract phase: `upload_admission`
 

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04B3-effective-pre-submit-evidence.md

@@ -31,15 +31,18 @@ Submission, or separate contributor route.
 ## Acceptance Criteria
 
 - one ordered result contains both platform/default and locked project entries,
-  each with catalogue ID/version, source, status, severity, bounded code/message,
+  each with stable catalogue definition ID/version, source, status, severity,
+  bounded code/message,
   and policy trace;
 - the canonical typed result envelope nests identity under `definition`
   (`dispatch_authority`, authority-neutral definition ID/version, public name,
   source) and trace
   under `policy_trace` (effective-plan hash, deterministic rule-instance ID,
   locked-policy hash); immutable evidence persists each member explicitly and
   never relies on open-ended `metadata` for required provenance; for this
-  pre-submit authority, definition ID/version are exactly catalogue ID/version;
+  pre-submit authority, definition ID/version are exactly the stable catalogue
+  definition ID/version; the effective plan separately binds the top-level
+  catalogue ID/version and manifest hash;
 - execution binds actor/task/project/assignment, predecessor, archive identity,
   manifest ID/hash, scratch generation, locked guide/policy/checker hashes, and
   effective plan identity;

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-04B1-internal-review-evidence.md

@@ -0,0 +1,51 @@
+# WS-ART-001 04B1 Internal Review Evidence
+
+Reviewed change: single pre-submission catalogue and effective-plan compiler
+
+## Preimplementation Review
+
+| Track | Result | Incorporated conditions |
+|---|---|---|
+| Architecture | PASS WITH CONDITIONS | Catalogue replaces compiler maps and durable-registry authority; platform capabilities remain typed references; no fallback constructor. |
+| Security/auth | PASS WITH CONDITIONS | Full locked lineage and domain-separated plan identity; explicit startup-owned catalogue; mandatory disabled fails closed. |
+| Product/ops | PASS WITH CONDITIONS | Mandatory disabled is infrastructure-unavailable; legacy route remains frozen; no downstream lifecycle effects. |
+
+## Final Implementation Review
+
+| Track | Final result | Resolution evidence |
+|---|---|---|
+| Architecture | PASS | No boundary, abstraction, coupling, or chunk-scope violation. |
+| Security/auth | PASS after repair | Locked policy body hash and complete compiled-rule coverage now fail closed. |
+| QA/test | PASS after repair | Omitted required rules and weakened policy bodies have regression tests. |
+| Product/ops | PASS after repair | Rule-instance identity binds catalogue ID, version, and manifest. |
+| Senior engineering | PASS after repair | Removed phase-order duplication; fixed startup test input and policy validation. |
+| CI integrity | PASS | New 90 percent checker gate strengthens CI; canonical five-lane evidence remains intact. |
+| Reuse/dedup | PASS after repair | Stable IDs are unique across versions; no alternate pre-submit authority remains. |
+| Test delta | PASS after repair | Exact 26-row catalogue contract is locked; no tests removed, skipped, or weakened. |
+| Docs | PASS WITH LOW RISKS after repair | Definition/top-level catalogue identity and five plan phases are now explicit. |
+
+The reviewer authentication outage was transient. Every required track later
+ran against the repaired PR and all blocking findings were resolved.
+
+## Deterministic Evidence
+
+```text
+21 catalogue/effective-plan tests: pass
+42 focused catalogue/compiler tests after external-review repairs: pass
+new-module coverage: above the hosted 90 percent subsystem gate
+focused compiler/catalogue selector: pass
+163 database-free checker tests: pass
+25 database-backed checker tests: not run locally; test database URL absent
+ruff app/tests: pass
+compileall changed Python: pass
+git diff --check: pass
+stale artifact contract scan: pass
+stale Workstream wording scan: pass
+Markdown links: pass
+lightweight agent gates: pass
+hosted five-lane Backend plus aggregate coverage at bb04677c: pass
+```
+
+CodeRabbit completed a substantive review. Its two actionable threads were
+repaired and are resolved; its incremental follow-up was rate-limited. The final
+repaired head still requires its hosted Backend rerun.

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-04B1-pr-trust-bundle.md

@@ -0,0 +1,130 @@
+# WS-ART-001 04B1 PR Trust Bundle
+
+## Chunk
+
+`WS-ART-001-04B1` — Default Checker Catalogue
+
+## Goal
+
+Install the single typed, versioned Workstream pre-submission catalogue and
+compile one immutable effective plan from platform defaults plus the exact
+locked project policy.
+
+## Human-Approved Intent
+
+ART owns the generic platform defaults and the single composition mechanism.
+The Project Guide workflow continues to generate and lock project-specific
+policy. No second API or registry is allowed.
+
+## What Changed
+
+- added 26 closed platform-capability and policy-primitive definitions;
+- added startup-owned enabled/disabled configuration and validation;
+- replaced compiler-local primitive/name/policy-field maps and removed the
+  durable checker registry as pre-submit compiler authority;
+- added a pure effective-plan compiler with exact lineage, catalogue manifest,
+  definition/configuration hashes, locked policy-body validation, complete-rule
+  coverage validation, and catalogue-bound deterministic rule-instance identity;
+- added focused tests and a non-weakening hosted 90 percent checker coverage
+  gate;
+- reconciled merged PLAN5 and active 04B1 status.
+
+## Why It Changed
+
+Scattered maps and the durable checker registry could become alternate
+pre-submit authorities. Workstream needs one discoverable catalogue where
+mandatory disabled state fails closed and locked project policy can only add or
+narrow requirements through constrained definitions.
+
+## Design Chosen
+
+Frozen dataclasses and closed enums define catalogue identity, classification,
+phase/dependencies, typed inputs, dispatch capability, result schema, budget,
+policy trace, and disabled behavior. The effective-plan compiler requires the
+startup-owned catalogue explicitly; it has no all-enabled fallback. It is pure
+and performs no artifact read, checker execution, persistence, or routing.
+
+## Alternatives Rejected
+
+- Keep compiler maps beside the catalogue: duplicate authority.
+- Reuse durable `default_checker_registry`: wrong lifecycle owner.
+- Optional catalogue with an enabled fallback: bypasses deployment state.
+- Dynamic plugin discovery or project registries: violates the closed v0.1
+  contract.
+
+## Scope Control
+
+No ZIP parsing, scratch materialization, checker execution, durable evidence,
+migration, route, provider I/O, AUTH availability, Submission/admission,
+review, contribution, payment, or reputation behavior changed.
+
+## Product Behavior
+
+No contributor-facing behavior is activated. Unknown startup configuration
+fails closed. Mandatory disabled definitions make the future preparation path
+infrastructure-unavailable; advisory disabled definitions remain visible in the
+plan.
+
+## Acceptance Criteria Proof
+
+- one catalogue owns all pre-submit definition/dispatch metadata;
+- all 26 initial definitions are stable, versioned, ordered, bounded, and typed;
+- compiler parallel maps and durable-registry dependency are removed;
+- plan identity includes project, guide, snapshot, effective policy, pre-submit
+  policy, catalogue manifest/state, and ordered configuration facts;
+- broad token/secret/credential/dependency-directory heuristics are absent from
+  the generic catalogue;
+- no runtime bytes or durable effects occur.
+
+## Tests And Checks Run
+
+See `WS-ART-001-04B1-internal-review-evidence.md`. The 21 focused
+catalogue/effective-plan tests pass, including exact 26-row identity and
+fail-closed policy regressions. Database-backed and repository-wide coverage
+remain hosted-CI responsibilities.
+
+## Test Delta
+
+One new focused test module; no tests removed, skipped, or weakened.
+
+## CI Integrity
+
+Adds `coverage report --include='app/modules/checkers/*' --fail-under=90`.
+No threshold, lane, workflow, package script, or existing gate is weakened.
+
+## Reviewer Results
+
+All required final tracks passed after valid security, QA, senior-engineering,
+product/ops, reuse, test-delta, and documentation findings were repaired.
+Architecture and CI-integrity found no required fixes.
+
+## External Review
+
+Agent Gates pass on the repaired tree. CodeRabbit completed a substantive
+review; its plan-configuration immutability and configuration-documentation
+threads were repaired and are resolved. Its incremental follow-up was
+rate-limited. The final hosted Backend rerun is in progress.
+
+## Remaining Risks
+
+- final hosted database tests and aggregate/per-file coverage must pass;
+- CodeRabbit incremental follow-up was rate-limited after both substantive
+  threads were resolved;
+- 04B2 must consume the exact plan without adding another dispatch path.
+
+## Follow-Up Work
+
+After human merge, stop. `04B2` begins only under a separate explicit request.
+
+## Human Review Focus
+
+- Is the catalogue the only pre-submit authority?
+- Can startup-disabled mandatory entries ever be bypassed?
+- Does the plan combine locked project policy without executing it?
+
+## Human Merge Ownership
+
+- [x] Required final internal reviews pass.
+- [ ] Hosted CI and CodeRabbit pass.
+- [ ] I can explain what changed and what could break.
+- [ ] I explicitly approve this PR for merge.

.github/workflows/backend.yml

@@ -357,6 +357,10 @@ jobs:
         working-directory: backend
         run: coverage report --include='app/modules/audit/*' --precision=2 --fail-under=90
 
+      - name: Pre-submission checker catalogue coverage
+        working-directory: backend
+        run: coverage report --include='app/modules/checkers/*' --precision=2 --fail-under=90
+
       - name: Contribution subsystem coverage
         working-directory: backend
         run: coverage report --include='app/modules/contributions/*' --precision=2 --fail-under=90

backend/app/core/config.py

@@ -174,6 +174,7 @@ class Settings(BaseSettings):
     artifact_submission_zip_maximum_inspection_seconds: float = Field(
         default=300.0, gt=0.0, le=1800.0
     )
+    artifact_pre_submission_checker_disabled_ids: str = ""
     artifact_operation_lock_timeout_seconds: float = Field(
         default=1800.0,
         gt=0.0,

backend/app/main.py

@@ -32,6 +32,10 @@
     get_settings,
 )
 from app.interfaces.artifacts import ArtifactStoreBootstrap, ArtifactStoreNamespaceClaim
+from app.modules.checkers.catalogue import (
+    build_pre_submission_checker_catalogue,
+    parse_disabled_pre_submission_checker_ids,
+)
 
 PRODUCTION_LIKE_ENVIRONMENTS = {"staging", "preview", "prod", "production"}
 MAX_VALIDATION_ERRORS = 20
@@ -64,6 +68,11 @@
 async def _application_lifespan(app: FastAPI) -> AsyncIterator[None]:
     """Reject invalid production authentication configuration before serving."""
     settings: Settings = app.state.settings
+    app.state.pre_submission_checker_catalogue = build_pre_submission_checker_catalogue(
+        disabled_entry_ids=parse_disabled_pre_submission_checker_ids(
+            settings.artifact_pre_submission_checker_disabled_ids
+        )
+    )
     if settings.pagination_cursor_hmac_secret is None:
         raise RuntimeError("pagination cursor HMAC secret is required")
     decode_pagination_cursor_hmac_secret(settings.pagination_cursor_hmac_secret)