WS-CON-001-02C: add shared lifecycle audit participant

.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/ACTIVE_DOC_INVENTORY.md

@@ -1,22 +1,22 @@
 # Active Documentation Inventory: WS-CON-001
 
-## Current 03A implementation scope
+## Current 02C implementation scope
 
 Live implementation state is carried by `STATUS.md`, `SOURCE_MANIFEST.md`, the
-`WS-CON-001-03A` chunk contract, `RUNTIME_VERIFICATION.md`, and the canonical
-schema sections in `docs/spec_contribution_compensation.md` and
-`docs/architecture_data_model.md`.
+`WS-CON-001-02C` chunk contract, `RUNTIME_VERIFICATION.md`, the 02C internal
+review evidence and PR trust bundle, and the canonical schema sections in
+`docs/spec_contribution_compensation.md` and `docs/architecture_data_model.md`.
 
 `INTENT.md`, `DISCOVERY.md`, `PLAN.md`, `JOINT_RELEASE_HANDOFF.md`, and the
 PLAN4 review artifacts are frozen historical planning evidence. Their recorded
-PLAN4 SHA/head and planning-only stop statement are not live 03A status.
+PLAN4 SHA/head and planning-only stop statement are not live 02C status.
 
-## Direct reconciliation scope
+## Direct implementation scope
 
-This planning refresh updates the WS-CON-001 initiative package plus the stale
-Required Implementation Order in the canonical contribution specification. It
-does not change runtime code, migrations, other specification sections,
-roadmaps, exports, workflows, or another initiative's files.
+02C changes only the shared audit participant modules/tests, the exact
+shared-audit note in `docs/architecture_data_model.md`, and WS-CON initiative
+evidence. It adds runtime code but no migration, route, background executor,
+product lifecycle behavior, roadmap/export, workflow, or other initiative change.
 
 The PLAN4 package was:
 
@@ -46,6 +46,7 @@ rewritten merely to restate this plan. Historical chunk evidence remains histori
 initiatives retain ownership of their own plans and runtime contracts. Local
 roadmap XLSX/CSV exports are not changed because the roadmap is not changed.
 
-The pre-existing deletion of
+The working-tree deletion of
 `docs/reference_specs/WS-CON-001-contribution-record-and-compensation-boundary-specification.pdf`
-is user-owned and remains untouched and unstaged.
+is user-owned, outside 02C scope, and remains untouched and unstaged. It is not
+part of the 02C publication diff or its reference-spec integrity result.

.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md

@@ -12,6 +12,7 @@ signed-loop records do not make behavior live.
 | `01` | Canonical specification and ADR 0016 | Merged PR #144 |
 | `02A` | Shared transactional outbox persistence/append | Merged PR #155; migration 0029 |
 | `03A` | Adapter-binding persistence | Merged PR #267; migration 0053 |
+| `03B` | Contribution-policy persistence | Merged PR #274; migration 0055 |
 | `PLAN5` | Complete-context human needs-revision rebase reconciliation | Merged PR #270 |
 
 ## Current reconciliation
@@ -25,8 +26,8 @@ signed-loop records do not make behavior live.
 
 | Chunk | Goal | Entry gate | Status |
 |---|---|---|---|
-| `03B` | Contribution-policy persistence | 03A | Implemented and internally reviewed; PR checkpoint; unblocks REV-03A2 FK after merge |
-| `02C` | Shared lifecycle-audit participant | PLAN4; current AuditEvent contract | Proposed; independent of dispatcher; required before REV-04B |
+| `03B` | Contribution-policy persistence | 03A | Merged PR #274; REV-03A2 FK is unblocked |
+| `02C` | Shared lifecycle-audit participant | PLAN4; current AuditEvent contract | Implementation, deterministic proof, and required internal review complete; PR/external review pending; independent of dispatcher; required before REV-04B |
 | `04A` | Hidden adapter-binding service | 03A + exact AUTH registration/PREP contract | Blocked on AUTH registration |
 | `04B` | Hidden contribution-policy service | 03B + 04A + exact AUTH registration/PREP contract | Blocked on AUTH registration |
 | `05A` | Legacy semantic cutover + initial TaskAssignment policy freeze and guarded human-revision rebase support | 04B + task/assignment/revision authority contract + row-classification decision | Proposed |
@@ -80,7 +81,7 @@ distributed-lane changes.
 
 ## Stop
 
-CON-03B stops at this PR checkpoint. No later chunk starts until 03B passes its
-external checks and receives human merge approval. Binding creation/lifecycle
-behavior remains deferred and existing ART/REV identities do not substitute
-for the future AUTH-approved compensation adapter contract.
+CON-02C stops at its PR checkpoint. Do not begin another CON chunk
+automatically. Binding creation/lifecycle behavior remains deferred and
+existing ART/REV identities do not substitute for the future AUTH-approved
+compensation adapter contract.

.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/SOURCE_MANIFEST.md

@@ -2,9 +2,9 @@
 
 ## Reconciliation baseline
 
-- Reconciled `main`: `9550b3cdb8ac12dea72931277cf46ac1b8ffda7f`.
-- Current migration head on `main`: `0054_guide_sufficiency_authority`;
-  this branch advances it to `0055_contribution_policy`.
+- Reconciled `main`: `9865456b3fb1f6048f4c7b7aef4dac71fbf3323e`.
+- Current migration head on `main`: `0056_review_lease_preference`; 02C adds no
+  migration.
 - Current capability ledger: `docs/roadmap_status.md`.
 - Current contribution process: `AGENTS.md`, `CONTRIBUTING.md`, and
   `.agent-loop/README.md`. Historical signed-start and merge-intent records are
@@ -36,8 +36,9 @@
   guide sufficiency, and guide read/binding foundations.
 - `backend/app/modules/outbox/**` and migration `0029`: shared outbox
   persistence/append only; no dispatcher exists.
-- `backend/app/modules/audit/**`: existing shared audit foundation; no typed
-  lifecycle participant yet.
+- `backend/app/modules/audit/**`: existing shared audit foundation plus the 02C
+  branch's typed, flush-only REV/CON lifecycle participant. This branch state
+  remains unpublished until PR review and human merge.
 - `backend/app/modules/compensation/**` and merged migration `0053` add only the
   adapter-binding schema; no creation/lifecycle service exists.
 - Review queue persistence now exists; ReviewLease, Review, and FinalAcceptance

.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md

@@ -2,19 +2,18 @@
 
 ## Current baseline
 
-- Reconciled main: `9550b3cdb8ac12dea72931277cf46ac1b8ffda7f`.
-- Alembic head on main: `0054_guide_sufficiency_authority`; 03B advances the branch
-  to `0055_contribution_policy` after AUTH migration
-  `0054_guide_sufficiency_authority`.
+- Reconciled main: `9865456b3fb1f6048f4c7b7aef4dac71fbf3323e`.
+- Alembic head on main: `0056_review_lease_preference`.
 - CON-01, CON-02A, and CON-03A are merged; 03A merged in PR #267.
 - PLAN5 is merged in PR #270 and preserves the human-confirmed complete-context
   `needs_revision` rebase rule.
-- Runtime on main contains shared outbox persistence and the schema-only
-  compensation binding foundation. 03B is complete on its bounded branch and
-  adds contribution-policy persistence; contribution-record,
+- Runtime on main contains shared outbox persistence, the schema-only
+  compensation binding foundation, and contribution-policy persistence. 02C
+  implementation, deterministic proof, internal review, and external checks
+  are complete; human approval and merge remain pending. Contribution-record,
   dispatcher, fulfillment, operations, and CON API behavior remain absent.
 - The pre-existing local deletion of the archival reference PDF is user-owned
-  and excluded from this planning change.
+  and excluded from this runtime change.
 
 ## Current external work inspected
 
@@ -38,9 +37,9 @@ of main; their contracts remain ART-owned inputs rather than CON behavior.
 
 ### REV
 
-REV PR #258 is merged planning-only end-to-end evidence. It correctly
-preserves CON ownership and identifies CON-03B as
-the policy FK prerequisite for REV-03A2.
+REV planning evidence remains aligned with CON ownership. REV-03A2 lease and
+preference persistence is merged in PR #280 on top of the merged CON-03B policy
+FK prerequisite; Review and FinalAcceptance behavior remain future REV work.
 
 ## Corrected CON priority
 
@@ -66,15 +65,16 @@ schema work. Current dependency analysis yields:
   registered.
 - CON-05A/05B: deterministic legacy-row classification remains a human data
   decision.
-- CON-03C: REV Review/ReviewLease/FinalAcceptance tables are not implemented.
+- CON-03C: REV Review and FinalAcceptance tables are not implemented.
 - CON-06/07: corresponding REV lease/decision caller contracts are future.
 - CON-03A creation behavior: AUTH has not approved a compensation-adapter
   service identity/capability; existing ART/REV identities cannot substitute.
 
 ## Immediate next action
 
-Publish 03B for external CI, CodeRabbit, and human review, then stop at its PR
-checkpoint. Do not begin another chunk automatically. After 03B merges it
-unblocks the stable policy-version FK required by REV-03A2; binding creation
-remains deferred to 04A after AUTH approves the exact adapter
+Move CON-02C through external review and human approval now that implementation,
+deterministic proof, and required internal review are complete. REV-03A2 may
+proceed against the merged contribution-policy version FK, and REV-04B may
+proceed in parallel against the 02C contract but must merge after 02C.
+Binding creation remains deferred to 04A after AUTH approves the exact adapter
 identity/capability contract.

.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/chunks/WS-CON-001-02C-shared-lifecycle-audit-participant.md

@@ -25,7 +25,7 @@ docs/architecture_data_model.md only exact shared-audit ownership note
 
 ```text
 AuditEvent schema/migration rewrite
-review, contribution, compensation, task, AUTH or outbox event semantics
+review, contribution, compensation, task, AUTH or outbox product behavior or persistence
 commit ownership, route, background executor, dependency or CI weakening
 ```
 
@@ -38,7 +38,9 @@ commit ownership, route, background executor, dependency or CI weakening
 - [ ] Caller rollback removes audit with all other transaction effects; exact
   replay/idempotency ownership is explicit and no second audit ledger appears.
 - [ ] REV-04 and CON-07 may depend on the merged interface without importing
-  feature services; this chunk implements no feature-specific event.
+  feature services. The shared interface owns only the adopted closed REV/CON
+  audit-event vocabulary, primary-entity pairings, and required immutable
+  source references; it implements no feature lifecycle behavior.
 
 ## Verification and reviewers
 

.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/reviews/WS-CON-001-02C-internal-review-evidence.md

@@ -0,0 +1,46 @@
+# Internal Review Evidence: WS-CON-001-02C
+
+## Scope
+
+02C adds a typed, feature-neutral lifecycle-audit participant over the existing
+append-only `audit_events` ledger. It uses the caller's `AsyncSession`, flushes
+without committing, and adds no schema, migration, route, worker, AUTH, REV,
+CON product behavior, or outbox behavior.
+
+Current reconciled main: `9865456b3fb1f6048f4c7b7aef4dac71fbf3323e`.
+
+## Deterministic evidence
+
+```text
+39 isolated PostgreSQL audit tests passed before final main reconciliation
+26 focused lifecycle tests passed again after final main reconciliation
+11 schema-only lifecycle input tests passed
+audit subsystem coverage: 94.64% (required at least 90%)
+Ruff: passed
+git diff --check: passed
+Markdown links: passed
+stale Workstream wording: passed
+```
+
+The proof covers caller rollback, exact persisted replay, changed replay
+conflict, deterministic concurrent replay through an observed PostgreSQL
+advisory-lock waiter, fixed internal provenance, complete canonical event/entity
+mapping, exact event-specific UUID references, reason/status consistency,
+generic repository bypass denial, and forged-input secret non-retention.
+
+## Review state
+
+Preimplementation architecture review passed with low-risk conditions. Those
+conditions were implemented: the participant uses the existing
+lifecycle-compatible `audit_events` representation, fixes internal provenance
+itself, has a dedicated
+repository replay path with an explicit immutable comparison set, raises a
+non-leaking typed conflict, and prevents the generic repository from
+impersonating it.
+
+Required internal postimplementation review is complete. Senior engineering, QA,
+security, product/ops, architecture, docs, reuse/dedup, and test-delta all
+passed after their valid findings were repaired. Repairs included canonical
+PascalCase REV/CON event ownership, exact source-lineage reference sets,
+removal of ambiguous authority/generic contribution tokens, complete state
+endpoints, deterministic concurrent replay proof, and current initiative docs.

.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/reviews/WS-CON-001-02C-pr-trust-bundle.md

@@ -0,0 +1,166 @@
+# WS-CON-001-02C PR Trust Bundle
+
+## Chunk
+
+`WS-CON-001-02C` — Shared Lifecycle Audit Participant.
+
+## Goal
+
+Provide the flush-only, caller-transaction audit participant required by future
+REV and CON lifecycle transactions without creating a second ledger or taking
+commit ownership.
+
+## Human-approved intent
+
+Workstream must record bounded canonical lifecycle evidence in the same
+transaction as the product facts it describes. This chunk supplies that shared
+boundary only; it does not implement review, contribution, compensation, or
+outbox lifecycle behavior.
+
+## What changed
+
+- Added closed canonical REV/CON lifecycle event, entity, reason, and reference
+  types.
+- Enforced exact event-to-entity and event-to-reference contracts, including
+  FinalAcceptance, reviewer/submitter contribution, and award lineage.
+- Added `LifecycleAuditParticipant` over the existing `audit_events` ledger and
+  caller-owned `AsyncSession`.
+- Added exact replay handling and changed-replay conflict behavior serialized by
+  a transaction-scoped PostgreSQL advisory lock.
+- Reserved fixed internal provenance and blocked generic-repository bypass.
+- Added rollback, privacy, replay, concurrency, vocabulary-completeness, and
+  lineage tests.
+- Reconciled 02C status and evidence with current main, REV-03A2, and migration
+  head `0056_review_lease_preference`.
+
+## Why it changed
+
+Future REV decision and CON contribution/award transactions need audit evidence
+to succeed or roll back atomically with their domain rows. The previous generic
+repository path accepted unbounded compatibility shapes and did not define
+deterministic concurrent replay behavior.
+
+## Design chosen
+
+The participant reuses the existing lifecycle-compatible `audit_events`
+representation. Its persisted discriminator remains `legacy_lifecycle`, but
+that compatibility token is not exposed as the interface name or product
+boundary. Callers can supply only typed canonical facts. It flushes through the
+caller's session and never commits or creates a session. Exact event-ID replay
+returns the existing immutable row; changed reuse raises a non-leaking
+`LifecycleAuditConflict`. A transaction-scoped advisory lock serializes the
+read/insert decision for that event ID.
+
+Nested `project_id` is provenance evidence only. Authorization and filtering
+must reload the canonical entity chain rather than trusting audit payload data.
+
+## Alternatives rejected
+
+- A second lifecycle audit table or event domain: duplicate ledger authority.
+- Participant-owned sessions or commits: breaks atomic REV/CON transactions.
+- Arbitrary event names or metadata: permits semantic and privacy drift.
+- Unique-constraint failure as replay behavior: leaks a storage concern and is
+  nondeterministic for callers.
+- Authorization-link events in this participant: canonical authority decisions
+  remain owned by the typed authority audit boundary.
+
+## Scope control
+
+Changed runtime scope is limited to:
+
+- `backend/app/modules/audit/{schemas,repository,service}.py`
+- `backend/tests/test_audit.py`
+- the exact shared-audit architecture note and WS-CON-001 loop evidence
+
+No model, migration, route, background executor, feature service, dependency,
+workflow, CI threshold, outbox dispatcher, review command, contribution
+persistence, compensation fulfillment, or reputation behavior changed.
+
+## Product behavior
+
+No user-facing lifecycle is activated. The shared contract distinguishes
+`accept`, `needs_revision`, and `reject`; only acceptance evidence may reference
+FinalAcceptance. Reviewer and submitter contribution evidence use distinct exact
+source shapes. Generic or ambiguous contribution events are not admitted.
+
+## Acceptance criteria proof
+
+- Caller rollback removes staged lifecycle evidence.
+- The participant flushes without commit and opens no independent session.
+- Event vocabulary and primary-entity mappings are complete and closed.
+- Event references are exact; unrelated lineage is rejected.
+- Exact replay succeeds and changed replay fails closed.
+- Concurrent replay waits on the exact event advisory lock.
+- Generic repository bypass and forged secret-bearing input are rejected.
+- The existing append-only ledger remains the only audit store.
+
+## Tests and checks run
+
+- 39 isolated PostgreSQL audit tests passed before final main reconciliation.
+- 26 focused lifecycle tests passed again after reconciliation with current
+  main and migration `0056`.
+- 11 schema-only lifecycle input tests passed.
+- Audit subsystem coverage: 94.64 percent; required minimum: 90 percent.
+- Four focused replay/concurrency tests passed after lifecycle fixture cleanup.
+- Ruff, Markdown links, stale Workstream wording, stale authorization docs, and
+  diff integrity passed.
+
+## Test delta
+
+Lifecycle audit tests were added; no existing test was removed, skipped,
+weakened, or rewritten to accept broken behavior. Test cleanup now removes all
+audit rows created by the fixture, including lifecycle compatibility rows.
+
+## CI integrity
+
+No workflow, lane, runner, dependency, package script, coverage threshold, or
+branch-protection behavior changed. Final hosted results pass:
+
+- Agent Gates
+- Backend `shared_foundations`
+- Backend `schema_contracts_a`
+- Backend `schema_contracts_b`
+- Backend `project_lifecycle`
+- Backend `task_lifecycle`
+- merged Backend `test`
+
+## Reviewer results
+
+Senior engineering, QA, security, product/ops, architecture, docs,
+reuse/dedup, and test-delta tracks passed after valid findings were fixed. See
+`WS-CON-001-02C-internal-review-evidence.md`.
+
+## External review
+
+CodeRabbit passes. Actionable findings were addressed: concurrent replay is
+atomic, committed lifecycle fixtures are cleaned up, the waiter assertion is
+bound to the exact event lock, coverage evidence is precise, and initiative
+status wording is current.
+
+## Remaining risks
+
+- The participant uses fixed internal values in compatibility provenance columns;
+  future audit-schema cleanup may replace that compatibility representation.
+- New lifecycle event tokens require an adopted feature contract, exact primary
+  entity, exact source references, and contract tests.
+- REV/CON readers must not use nested audit `project_id` as authorization truth.
+
+## Follow-up work
+
+After human merge, stop. REV-04B may consume this interface and merge after 02C.
+CON-03C contribution/award persistence begins only under a separate explicit
+instruction and after its REV-owned FK prerequisites exist.
+
+## Human review focus
+
+- Is caller transaction ownership preserved with no hidden commit path?
+- Are accepted, revision, contribution, and award lineage shapes exact?
+- Does concurrent event-ID replay deterministically return or conflict?
+- Is the shared audit module free of REV/CON feature-service coupling?
+
+## Human merge ownership
+
+- [x] Required internal reviewers passed.
+- [x] Hosted CI and CodeRabbit passed.
+- [x] Valid external findings were addressed.
+- [ ] The user explicitly approves PR #277 for merge.