feat(artifacts): persist effective pre-submit evidence

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/AUTH_HANDOFF.md

@@ -147,7 +147,8 @@ evidence. No human grant supplies fixed service authority.
 04B2 defines the pre-submit materializer facts as task, assignment, project,
 effective submission-artifact-policy ID, pre-submit checker-policy ID,
 process-local prepared generation, effective-plan hash, catalogue-manifest hash,
-archive SHA-256/byte count, and semantic-manifest hash. The fixed
+archive SHA-256/byte count, semantic-manifest hash, and the server-selected
+ArtifactStore storage scheme evaluated by the locked policy. The fixed
 `workstream.artifact.materializer` capability must be consumed before any
 prepared-byte read, ZIP open, workspace reservation, or checker result. ART
 ships only a deny-by-default adapter while the action is planned; XINT-06A owns

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/CHUNK_MAP.md

@@ -31,8 +31,8 @@ they cross multiple L1 boundaries.
 | `WS-ART-001-04A3` | Add canonical semantic manifest, executable normalization, and unchanged-work gate. | L1 | Merged PR #268 |
 | `WS-ART-001-04A4` | Former early removal of the legacy independently invocable caller-owned submission-precheck route and contract. | L1 | Superseded by PLAN5; complete removal belongs to 05B |
 | `WS-ART-001-04B1` | Add the single versioned checker catalogue and compile one effective execution plan from platform defaults plus locked project policy. | L1 | Merged PR #276 |
-| `WS-ART-001-04B2` | Materialize the sealed manifest tree once and execute the mandatory platform/default catalogue phases. | L1 | Active implementation |
-| `WS-ART-001-04B3` | Execute locked project-policy rules through the same plan and persist one bounded immutable evidence set. | L1 | Proposed after 04B2 |
+| `WS-ART-001-04B2` | Materialize the sealed manifest tree once and execute the mandatory platform/default catalogue phases. | L1 | Merged PR #282 |
+| `WS-ART-001-04B3` | Execute locked project-policy rules through the same plan and persist one bounded immutable evidence set. | L1 | Active implementation |
 | `WS-ART-001-04C1` | Reauthorize and atomically persist capacity plus durable put intent, then write the checked ZIP once. | L1 | Proposed after XINT-06A |
 | `WS-ART-001-04C2` | Reuse verification/recovery to publish one capacity-charged ready admission and compose the hidden continuous endpoint. | L1 | Proposed after 04C1 |
 | `WS-ART-001-05A` | Atomically consume ready admission into one immutable Submission and binding under fresh human/service authority. | L1 | Proposed after XINT-05A |

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/REVIEW_LOG.md

@@ -346,3 +346,19 @@
 - The correction supersedes 04A4, makes 04B1 the next implementation chunk, and
   assigns the complete standalone/public/internal/caller-package clean cut to
   the admission-backed 05B Submission cutover.
+
+## WS-ART-001-04B3
+
+- Initial review found missing migration/persistence reachability, incomplete
+  composite lineage, stale guide/source comparison, forged result-envelope
+  acceptance, replay capability duplication, and open result membership.
+- The implementation now uses the real locked-context loader, database-enforced
+  actor/identity/assignment/task/project/policy lineage, immutable normalized
+  evidence, exact member-verifying replay, and one non-replayable process-local
+  continuation capability.
+- A real isolated-PostgreSQL workflow proves passing, replay, blocked evidence,
+  bounded audit, scratch-safe cleanup, aggregate immutability, and absence of
+  artifact/admission/Submission/checker/review-queue side effects.
+- Architecture, security, QA, product/ops, senior engineering, CI integrity,
+  docs, reuse/dedup, and test-delta final reviews pass. Full crossed-state
+  durable-consumption proof remains explicitly owned by ART-04C.

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md

@@ -125,13 +125,16 @@ legacy route/public-service/internal-guard/caller-package removal to the 05B
 admission-backed Submission cutover.
 
 `WS-ART-001-04B1` merged through PR #276 and supplies the immutable typed
-catalogue plus lineage-bound effective plan. `WS-ART-001-04B2` is implemented
-and internally reviewed on its bounded branch; hosted PR gates and human merge
-remain pending. It owns only fixed-service authorization before byte access,
+catalogue plus lineage-bound effective plan. `WS-ART-001-04B2` merged through
+PR #282. It owns only fixed-service authorization before byte access,
 quota-reserved callback-scoped sealed ZIP projection, platform/default phase
 execution, bounded non-durable results, and cleanup. It performs no
 project-policy execution, durable evidence/admission/Submission write, route
-exposure, provider I/O, or AUTH activation.
+exposure, provider I/O, or AUTH activation. `WS-ART-001-04B3` implementation
+and internal L1 review are complete on its bounded branch. It executes the
+project-policy continuation through that same plan and sealed tree and persists
+one immutable platform-plus-project evidence set. Hosted PR gates, CodeRabbit,
+human review, and merge remain pending.
 
 ## Gate
 

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04B3-effective-pre-submit-evidence.md

@@ -1,6 +1,6 @@
 # Chunk Contract: WS-ART-001-04B3 - Effective Pre-Submit Evidence
 
-Initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 04B2
+Initiative: `WS-ART-001` | Risk: L1 | Status: Active after merged PR #282
 
 Artifact contract phase: `upload_admission`
 
@@ -13,27 +13,63 @@ Submission, or separate contributor route.
 
 ## Allowed Files
 
-- locked task/guide/effective-policy/checker context assembly;
-- constrained project-rule execution through the central catalogue;
-- pre-submit attempt/result/evidence control-plane models and one migration;
-- bounded same-request contributor response projection and audit metadata;
-- focused tests, docs, evidence, and CI gate maintenance.
+- `backend/app/modules/checkers/pre_submit_execution.py` and new narrowly named
+  pre-submit result/primitive modules under `backend/app/modules/checkers/`;
+- the narrow `backend/app/modules/checkers/compiler.py` projection that binds a
+  locked required-artifact/evidence key to its server-approved canonical ZIP
+  path; it may not change the policy schema, catalogue, or compilation authority;
+- new pre-submit evidence models/repository under
+  `backend/app/modules/artifacts/`, plus their schema exports;
+- the narrow actor/task model constraints required to make evidence
+  actor-identity-assignment-task-project lineage database-enforced;
+- one Alembic migration for the closed pre-submit evidence schema;
+- the smallest task-context assembler needed to lock/reload task, assignment,
+  predecessor, guide and policy lineage before persistence;
+- `backend/tests/test_effective_pre_submit_execution.py`,
+  `backend/tests/test_default_pre_submit_execution.py`, migration tests, semantic
+  lane ownership, docs, review evidence, and exact CI-gate assertions.
 
 ## Not Allowed
 
 - project executable code, arbitrary shell/network access, or agent judgment;
 - a second project checker API/registry or caller-selected checker names;
+- `pre_submit_static_feedback`, `CheckerRegistry`, `SubmissionCreate`, legacy
+  package URI/evidence-item inputs, or any other caller-owned precheck path;
+- reuse of post-submit `CheckerRun`/`CheckerResult`, creation of a fake or early
+  Submission, or changes to the post-submit checker repository lifecycle;
 - provider I/O, verified admission, Submission, Review, contribution, payment,
   reputation, post-submit routing, or AUTH activation/grant changes;
 - filenames, scratch/provider references, credentials, raw checker output, or
   unbounded details in durable evidence.
 
+## Persistence And Orchestration Lock
+
+- `PreSubmitEvidenceSet` owns the immutable attempt context; normalized
+  `PreSubmitEvidenceResult` rows own the ordered result members. Required
+  provenance is held in typed columns, never generic JSON metadata.
+- One deterministic operation identity binds actor, task, project, assignment,
+  predecessor selector, prepared generation, archive digest/size, manifest ID
+  and hash, effective-plan hash, catalogue manifest hash, and locked guide,
+  artifact-policy, and checker-policy hashes.
+- A database uniqueness constraint permits exactly one evidence set for that
+  operation identity. Exact replay returns the same set; any reused operation
+  identity with different bound facts fails closed as a conflict.
+- The sealed-tree callback executes both phase families and returns one bounded
+  canonical result DTO. A separate transaction-bound orchestration/repository
+  boundary persists it only after locked context revalidation; scratch and
+  materialization services never perform evidence writes.
+- The durable evidence set is audit/provenance. The successful immediate-use
+  capability remains process-local, single-use, and generation/predecessor
+  bound for 04C; an evidence-set ID alone is never a consumption capability.
+
 ## Acceptance Criteria
 
 - one ordered result contains both platform/default and locked project entries,
   each with stable catalogue definition ID/version, source, status, severity,
   bounded code/message,
   and policy trace;
+- 04B2 results and project-policy results are normalized into that one envelope
+  before persistence; no parallel default/project result contract survives;
 - the canonical typed result envelope nests identity under `definition`
   (`dispatch_authority`, authority-neutral definition ID/version, public name,
   source) and trace
@@ -48,9 +84,12 @@ Submission, or separate contributor route.
   effective plan identity;
 - project rules consume server-derived manifest/workspace facts and may require
   project-specific files such as `task.toml` without making them platform defaults;
+- locked policy keys resolve through one closed server-owned key-to-canonical-path
+  projection; unknown, duplicate or unmappable keys are retryable policy/setup
+  failures, and contributor labels or evidence tokens cannot satisfy them;
 - project policy can add/narrow but cannot disable, reorder, downgrade, or raise
   platform limits;
-- blocking findings create no durable artifact, admission, Submission, review,
+- blocking pre-submit checker results create no durable artifact, admission, Submission, review,
   contribution, compensation, reputation, or provider charge;
 - infrastructure/authorization failure is retryable platform state, never
   contributor blame or a product review decision;
@@ -63,14 +102,18 @@ Submission, or separate contributor route.
 - no ID-addressed evidence-read route or independently invocable precheck route
   is introduced; the eventual 04C2 endpoint returns only bounded same-request
   results;
+- the only audit projection is `pre_submission_check_failed` with bounded
+  attempt/result identifiers, stable codes, counts and categories; it excludes
+  filenames, paths, scratch/provider references, credentials, raw output,
+  evidence content, free-form checker messages and review-finding vocabulary;
 - focused subsystem coverage is at least 90 percent and repository coverage
   remains at least 78 percent.
 
 ## Verification
 
 ```bash
 docker compose up -d --wait postgres redis
-(cd backend && WORKSTREAM_TEST_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/workstream_test .venv/bin/pytest tests/test_alembic.py tests/test_effective_pre_submit_execution.py tests/test_submission_precheck_scratch.py -q)
+(cd backend && WORKSTREAM_TEST_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/workstream_test .venv/bin/pytest tests/test_alembic.py tests/test_effective_pre_submit_execution.py tests/test_default_pre_submit_execution.py -q)
 (metadata_dir="$(mktemp -d)" && trap 'rm -rf "$metadata_dir"' EXIT && (cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/postgres .venv/bin/python scripts/run_isolated_tests.py --metadata-json "$metadata_dir/result.json" --timeout-seconds 12600 -- .venv/bin/python -m pytest -q --ignore=tests/test_isolated_database_runner.py --cov=app --cov-report=term-missing --cov-fail-under=78))
 (cd backend && .venv/bin/coverage report --include='app/modules/artifacts/*,app/modules/checkers/*,app/modules/tasks/*' --precision=2 --fail-under=90)
 (cd backend && .venv/bin/ruff check app tests)

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-04B3-external-review-response.md

@@ -0,0 +1,60 @@
+# WS-ART-001-04B3 External Review Response
+
+## Comments addressed
+
+- The evidence-set database now binds `guide_id`, `project_id`, and
+  `guide_version` to one canonical `ProjectGuide` row through a composite
+  foreign key and matching unique target.
+- Evidence orchestration now rejects an already-open session transaction before
+  materialization, and captures the prepared generation before awaiting scratch
+  work.
+- Project evidence keys must project to a canonical relative path, so `.` and
+  `..` cannot collapse into ambiguous evidence identities.
+- The materializer and execution validator share one closed storage-scheme
+  constant.
+- Exact durable-evidence replay is documented as returning no new pass
+  capability; later submission attempts must re-prepare the bundle.
+- Migration `0058` now enforces result-status/failure-code shape and rejects a
+  caller-supplied evidence-set creation timestamp outside the creating
+  transaction.
+- Tests cover noncanonical evidence keys, a mismatched prepared generation
+  before capability consumption, and the transaction-free orchestration
+  precondition.
+- Evidence-set delete and truncate tests now avoid child-FK interference and
+  assert the exact immutable-trigger error.
+- The hosted task-lifecycle failure exposed one stale test mutation against the
+  retired `evidence_keys` config field; the test now mutates the canonical
+  `evidence_paths` field and proves required-evidence coverage fails closed.
+- Policy primitive dispatch now has an explicit fail-closed default, result
+  metadata types match their integer-only validator, result schema comes from
+  the exact plan entry, and compiler/executor path checks share one helper.
+- The persistence transaction explicitly starts at PostgreSQL `READ COMMITTED`
+  before locked-context reads, so a conflict replay can observe the committed
+  winning row.
+
+## Comments deferred
+
+None. CodeRabbit's suggested `task.locked_guide_id` filter was rejected because
+`WorkstreamTask` intentionally has no such column. The task locks the unique
+project/guide-version lineage; the new composite evidence foreign key binds the
+resolved guide ID to that same project and version at persistence.
+
+## Human decisions needed
+
+The ART changes require no product decision. The hosted protected-mutation
+workflow failure is a separate CI-reliability defect already repaired by PR
+`#289`; that PR still requires repository-owner approval before merge.
+
+## Verification
+
+- focused Ruff validation for every changed Python file;
+- focused effective/default pre-submit unit tests;
+- isolated PostgreSQL evidence workflow and `0058` migration round trip;
+- `git diff --check`.
+
+## Remaining risks
+
+PR `#291` cannot obtain a green protected-mutation result while the retired
+workflow remains on `main`: its evaluator cannot map model/import-only changes
+and its eight-claim ceiling is lower than this chunk's eligible target count.
+No ART-local claim can safely bypass that failure.

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-04B3-internal-review-evidence.md

@@ -0,0 +1,82 @@
+# WS-ART-001-04B3 Internal Review Evidence
+
+## Scope
+
+Hidden effective pre-submission execution and immutable evidence custody only.
+Provider I/O, admission, Submission creation, route exposure, AUTH activation,
+review, contribution, compensation, reputation, and legacy removal remain out
+of scope.
+
+## Deterministic evidence
+
+- Focused effective-execution unit suite: 14 tests passed.
+- Real isolated-PostgreSQL passing, replay, blocked, immutability, and
+  no-side-effect workflow: passed.
+- Alembic `0058_pre_submit_evidence` empty downgrade/upgrade round trip: passed.
+- Focused non-database ART/CI tests: 67 passed; the database test was run
+  separately through the canonical isolated runner.
+- Ruff passed for backend application, tests, and scripts.
+- Stale artifact contracts, lightweight agent gates, Markdown links, and diff
+  integrity passed.
+- The local combined Alembic/effective/default suite exceeded its deliberately
+  short 900-second diagnostic timeout after nine passing tests; hosted sharded
+  Backend Gates remain the authoritative full-suite and coverage proof.
+
+## Reviewer results
+
+- Architecture: PASS; exact actor/identity/assignment/task/project and locked
+  policy lineage is database-enforced.
+- Security/auth: PASS after exact enum and boolean result-envelope validation.
+- QA: PASS after real locked-context, scratch-safe passing/replay/blocked, and
+  immutable aggregate proofs.
+- Product/ops: PASS after replay was prevented from minting a second pass
+  capability.
+- Senior engineering: PASS after closing result membership and revalidating
+  every ordered result on replay.
+- CI integrity: PASS WITH LOW RISK; no workflow or coverage weakening.
+- Docs: PASS after canonical architecture, glossary, and artifact-spec updates.
+- Reuse/dedup: PASS WITH LOW RISKS; no second checker, scratch, provider, or
+  persistence path was introduced.
+- Test delta: PASS; no removed, skipped, xfailed, or weakened test.
+
+## Resolved findings
+
+- Added the missing Alembic schema and exact composite lineage constraints.
+- Wired evidence persistence into the hidden prepared-bundle workflow.
+- Revalidated exact guide version, source snapshot, and policy lineage.
+- Rejected forged result status, failure-code, and eligibility values.
+- Made evidence membership immutable and replay member-verifying.
+- Prevented replay from issuing another process-local continuation capability.
+- Proved blocked evidence produces only bounded audit/evidence effects.
+
+## External-review repair re-review
+
+- Architecture: PASS WITH LOW RISKS; the composite guide lineage, transaction
+  ownership, and shared checker semantics remain inside 04B3.
+- Security: PASS; the new database guards fail closed.
+- QA: PASS after the isolated PostgreSQL evidence workflow and migration round
+  trip passed together (`2 passed`).
+- Product/ops: PASS; replay and blocked outcomes remain outside review,
+  contribution, compensation, and reputation effects.
+- Senior engineering: PASS WITH LOW RISKS.
+- CI integrity: PASS; no workflow, coverage, or mutation-policy bypass was
+  added to ART.
+- Docs: PASS after replay/capability and external-response corrections.
+- Reuse/dedup: PASS WITH LOW RISKS; the remaining product-code storage-scheme
+  literal was removed after review.
+- Test delta: PASS after adding behavioral proof that a forged creation
+  timestamp is rejected.
+- Final focused non-database suite: `37 passed, 1 deselected`; the deselected
+  PostgreSQL workflow passed through the canonical isolated runner.
+- CodeRabbit's final guard-test nitpick was verified with the isolated
+  PostgreSQL workflow (`1 passed`): evidence-set delete and truncate now assert
+  the exact immutability-trigger error without child-FK interference.
+- The hosted task-lifecycle failure was reproduced as a stale test field, not a
+  runtime or segmentation failure. The corrected canonical-field regression
+  and focused suite pass (`38 passed, 1 deselected`).
+
+## Remaining external gates
+
+GitHub Backend Gates, CodeRabbit, and human review remain external checks. Human
+merge ownership remains with the repository owner; this evidence does not
+authorize merge.