WS-AUTH-001-12F2: govern manual submission policy drafts

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md

@@ -69,8 +69,8 @@ stopped.
 | `WS-AUTH-001-12D2` | Review And Revision Policy Mutation Separation | L1 | Superseded by merged XINT-003-02A/02B; economic policy remains CON-owned |
 | `WS-AUTH-001-12E` | Guide Sufficiency Mutation Cutover | L1 | Merged through PR #263 |
 | `WS-AUTH-001-12F` | Submission Artifact Policy Planning Parent | L1 | Split after failed L1 pre-start review; zero activation |
-| `WS-AUTH-001-12F1` | Submission Policy Authority Foundation | L1 | Proposed after 12E; zero activation |
-| `WS-AUTH-001-12F2` | Manual Submission Policy Drafts | L1 | Proposed after 12F1 |
+| `WS-AUTH-001-12F1` | Submission Policy Authority Foundation | L1 | Merged through PR #286; zero activation |
+| `WS-AUTH-001-12F2` | Manual Submission Policy Drafts | L1 | In progress after passed corrected pre-start review |
 | `WS-AUTH-001-12F3` | Fixed-Service Policy Derivation | L1 | Proposed after 12F2 |
 | `WS-AUTH-001-12F4` | Submission Policy Approval Chain | L1 | Proposed after 12F3 |
 | `WS-AUTH-001-12G` | Post-Submit Checker Policy Mutation Cutover | L1 | Proposed after 12F4 |

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md

@@ -842,3 +842,22 @@ replacement identity in the approval transaction; it may otherwise only stage
 bounded continuation identity. 12G alone owns post-submit checker-policy
 derivation, compilation, correction, approval, or execution. Consequently 12G
 and 12B2 depend on merged 12F4, not the rejected combined 12F contract.
+
+## D37: Manual policy updates are append-only authorized replacements
+
+Status: accepted preimplementation correction on 2026-08-05.
+
+12F2 does not mutate a draft policy body in place. A manual update requires the
+predecessor's expected hash and a new successor policy version, derives a stable
+actor/link-bound successor identity from the protected operation, and binds predecessor and
+successor facts separately through PREP and replay. The successor records fresh
+update-action authority provenance while the predecessor is superseded in the
+same root transaction. This preserves exact authorship and CAS evidence without
+adding ambiguous update columns to an old row.
+
+Both system-scoped and exact-project-scoped active Project Manager grants cover
+the project; wrong-project grants and role/token assertions do not. A warning
+result is usable only when its acknowledgement has the complete merged 12E
+actor, identity-link, grant, action, decision, scope, report, snapshot, and
+setup-generation custody. The legacy role-string acknowledgement is not
+authority.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md

@@ -184,8 +184,8 @@ bounded merge.
 | `WS-AUTH-001-12D2` | Superseded | - | #248 | XINT-003-02A/02B own immutable review/revision policy lineage and the sole authorized mutation path; 02B merged as `25fc27c4`. |
 | `WS-AUTH-001-12E` | Merged | `codex/ws-auth-001-12e-guide-sufficiency` | #263 | Three guide-sufficiency actions plus fixed setup-service run PREP merged as `b510bc4f`. |
 | `WS-AUTH-001-12F` | Planning split | `codex/ws-auth-001-12f-submission-artifact-policy` | - | Combined contract failed required L1 pre-start review; parent now activates nothing and delegates to 12F1-12F4. |
-| `WS-AUTH-001-12F1` | External review | `codex/ws-auth-001-12f1-submission-policy-foundation` | - | Submission-policy PREP, replay, provenance, and audit custody foundation complete; zero activation; hosted CI and CodeRabbit pending. |
-| `WS-AUTH-001-12F2` | Proposed | - | - | Governed Project Manager manual-draft create/update cutover. |
+| `WS-AUTH-001-12F1` | Merged | `codex/ws-auth-001-12f1-submission-policy-foundation` | #286 | Submission-policy PREP, replay, provenance, and audit custody foundation merged as `5a4186cc`; zero activation. |
+| `WS-AUTH-001-12F2` | In progress | `codex/ws-auth-001-12f2-manual-submission-policy` | - | Corrected contract passed all required L1 pre-start reviews; governed Project Manager append-only manual-draft create/update cutover is active. |
 | `WS-AUTH-001-12F3` | Proposed | - | - | Fixed setup-service derivation and asynchronous executor cutover. |
 | `WS-AUTH-001-12F4` | Proposed | - | - | Project Manager approval and atomic effective/pre-submit policy chain. |
 | `WS-AUTH-001-12G` | Proposed | - | - | Post-submit checker policy approval/correction cutover after 12F4. |

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-12F2-submission-policy-manual-drafts.md

@@ -2,7 +2,9 @@
 
 ## Status and prerequisite
 
-Proposed and inactive after merged 12F1. Risk: L1.
+Authorized for implementation after merged 12F1. Risk: L1. The original
+contract failed pre-implementation architecture, security, and QA review; the
+review corrections below are part of the implementation boundary.
 
 ## Goal
 
@@ -20,9 +22,11 @@ backend/app/modules/authorization/runtime.py
 backend/app/modules/projects/router.py
 backend/app/modules/projects/schemas.py
 backend/app/modules/projects/repository.py
+backend/app/modules/projects/service.py
 backend/app/modules/projects/submission_policy_mutation_service.py
 backend/app/modules/projects/submission_policy_mutation_repository.py
 backend/tests/test_authorization.py
+backend/tests/test_alembic.py
 backend/tests/test_projects.py
 backend/scripts/api_contract_e2e.py
 docs/spec_authorization_service.md
@@ -34,36 +38,76 @@ docs/operations_project_operating_manual.md
 ## Not allowed
 
 Agent derivation, approval, effective/pre-submit compilation, Celery execution,
-post-submit behavior, compatibility routes, or edits to agent-derived drafts.
+post-submit behavior, compatibility routes, in-place policy-body mutation, or
+edits to agent-derived drafts. Changes to `projects/service.py` are limited to
+extracting one public, shared default-floor validator and removing the obsolete
+self-committing create/update entry points; this chunk must not create a second
+policy validator.
 
 ## Acceptance
 
 - Activate only `project.submission_artifact_policy.create` and
-  `project.submission_artifact_policy.update` for a human Project Manager with
-  an exact active project grant. Admin role name alone, token claims, service
-  membership, or a contributor grant cannot substitute.
+  `project.submission_artifact_policy.update` for a human with an active,
+  covered Project Manager `AdminRoleGrant`: either system scope or the exact
+  project scope. A wrong-project grant, admin role name alone, token claims,
+  service membership, or contributor grant cannot substitute. Attribute both
+  actions to child owner `WS-AUTH-001-12F2`; the zero-activation 12F parent and
+  derive/approve actions remain unavailable.
 - Both routes require a valid UUID `Idempotency-Key` before actor provisioning,
   use the dedicated PREP dependency, expose exact OpenAPI action metadata, and
   reject service tokens at the public boundary.
 - Create locks exact project/draft guide/latest snapshot/sufficiency/setup
-  generation and binds the canonical manual payload digest. Update additionally
-  locks the exact draft policy ID/status/hash and compare-and-swaps that hash.
+  generation and binds the canonical manual payload digest. All acquisition
+  paths use one order: project -> draft guide -> latest source snapshot -> setup
+  run -> sufficiency report -> target draft policy (update only).
+- Update requires `expected_policy_hash` and `successor_policy_version` in the
+  request body. Both fields are part of the idempotency request digest and PREP
+  resource facts. The successor policy ID is server-derived deterministically
+  from the action, actor, identity link, project, selected predecessor, and
+  idempotency key so exact retries bind the same identity without cross-actor
+  collisions. PREP/replay bind predecessor policy ID,
+  version, status and expected hash separately from successor policy ID and
+  version; the runtime resource contract must expose both without overloading
+  one `policy_id`/`policy_version` pair. Missing, malformed, cross-policy,
+  duplicate-version, or stale values deny before mutation. Update is
+  append-only: it creates a new manual draft row with
+  `creation_action_id=project.submission_artifact_policy.update`, complete fresh
+  creation authority provenance, and `supersedes_policy_id` pointing to the
+  selected draft; it atomically marks the old draft superseded. It never
+  rewrites an existing policy body/hash in place.
 - The exact authoritative sufficiency report must match the snapshot and setup
   generation and be `passed`, or `passed_with_warnings` with the same report's
-  warnings acknowledged. Missing, blocked, stale, diagnostic-only, or
-  unacknowledged-warning reports deny without policy/replay/evidence mutation.
+  warnings acknowledged through the exact 12E-authorized acknowledgement.
+  Warning acceptance requires non-null actor profile, identity link, matched
+  Project Manager grant, action, decision event, scope project, timestamp, and
+  the same report/snapshot/setup-generation lineage. Legacy role-string-only
+  acknowledgement is insufficient. Missing, blocked, stale, diagnostic-only,
+  or incompletely acknowledged reports deny without policy/replay/evidence
+  mutation.
 - Manual payload validation preserves every non-bypassable Workstream default
   submission rule. It may tighten project requirements but cannot disable,
   replace, or weaken the startup-fixed default policy/catalogue floor.
 - Manual rows record complete local actor/link/grant/project/action/decision
-  provenance and `manual` derivation source. Agent provenance fields must be
-  null. Agent-derived rows are immutable through this path.
+  provenance and the canonical persisted manual derivation token
+  `manual_admin_derivation`. This token describes provenance; it does not grant
+  authority. Agent provenance fields must be null. Agent-derived rows are
+  immutable through this path.
 - Exact committed replay reauthorizes then returns the stored response without
-  another mutation. Changed/pending/cross-action/link-substitution reuse denies.
-  Concurrent exact calls produce one row/update; fault injection rolls back
-  policy, replay completion and allowed evidence together.
-- Existing legacy role-based create/update calls are removed, not retained as
-  fallback aliases.
+  another mutation. Create and update return their normal committed success
+  status on replay and return the originally stored response JSON, never a
+  later current-row projection. Changed/pending/cross-action/link-substitution
+  reuse denies. Concurrent exact calls produce one append-only result.
+- Replay reservation, replacement policy staging, predecessor supersession,
+  local authority provenance, AUTH evidence, and replay completion share one
+  root transaction. Fault injection after replay reservation, policy staging,
+  AUTH evidence staging, and replay completion-before-commit must roll all of
+  them back together.
+- Manual mutation may read and lock setup-run/generation state but cannot set
+  setup outputs, advance setup status/current step, enqueue continuation, or
+  impersonate the 12F3 derived-policy output.
+- Public routes use only the new mutation service and route-owned
+  commit/rollback. Existing self-committing, role-based `ProjectService`
+  create/update calls are removed, not retained as fallback aliases.
 
 ## Verification commands
 
@@ -87,3 +131,13 @@ git diff --check
 Every selector must be non-zero; exact pushed head passes Agent Gates and full
 hosted Backend. Required reviewers: all L1 tracks. Human focus: manual-only
 provenance, agent immutability, PM grant isolation and replay atomicity.
+
+The focused selectors must contain child-owned 12F2 tests, not merely collect
+older parent or legacy tests. API E2E must assert exact OpenAPI action metadata,
+successful create/update and exact replay, plus denial for service tokens,
+contributors, wrong-project grants, role claims, and missing/invalid
+idempotency or update-precondition input. Focused tests must also prove system
+and exact-project Project Manager grants succeed; wrong-project grants fail;
+default-floor weakening, agent-row update, stale acknowledgement/lineage, stale
+or concurrent CAS, copied/cross-action replay, and each named fault-injection
+point leave no protected mutation or allowed evidence.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-12F2-internal-review-evidence.md

@@ -0,0 +1,48 @@
+# WS-AUTH-001-12F2 Internal Review Evidence
+
+## Scope reviewed
+
+Manual Project Manager submission-policy create/update activation, exact PM
+admission and PREP authority, authoritative sufficiency custody, append-only
+replacement, replay classification, transaction rollback, and API denial
+ordering.
+
+## Reviewer results
+
+- Architecture: PASS after placeholder PREP evidence was removed and committed
+  replay was made independent of later live-lineage drift.
+- Security/auth: PASS. The preliminary PM query is concealment-only; exact
+  locked PREP remains the sole durable mutation authority.
+- Product/operations: PASS. Manual and agent provenance remain separate and no
+  setup-run, worker, reviewer, payment, or reputation lifecycle was expanded.
+- QA: PASS WITH LOW RISKS. The focused selector collects 27 tests; database
+  execution remains assigned to hosted PostgreSQL.
+- Senior engineering: PASS WITH LOW RISKS after replay-first handling preserved
+  committed responses and matching pending operations remain retryable.
+- Test delta: PASS WITH LOW RISKS after PATCH key/precondition coverage and the
+  agent-provenance assertion were repaired.
+- Reuse/dedup: PASS WITH LOW RISKS. Shared canonical policy validation and
+  verified-source projection are reused; no second authorization protocol was
+  introduced.
+- Documentation: PASS. Catalogue availability, append-only behavior, and
+  operational custody are aligned.
+- CI integrity: PASS after restoring the existing hosted replay-repository
+  selector token; the selector collects and passes both intended tests.
+
+## Repairs driven by review
+
+- Added a dedicated manual submission-policy dependency and conflict envelope.
+- Replaced fabricated preflight resource evidence with a non-authorizing,
+  covered-Project-Manager concealment gate.
+- Added replay-first pending/committed classification against stored operation,
+  request, resource, actor, link, action, and response facts.
+- Made update append-only with deterministic successor identity, predecessor
+  supersession, CAS, and one root transaction.
+- Added four create fault points plus update post-supersession rollback proof.
+- Added service, contributor, role-claim-only, wrong-project, malformed key,
+  malformed precondition, stale CAS, warning custody, cross-action replay, and
+  concurrent replacement coverage.
+
+All reviewer sessions completed with no blocking finding. Hosted database
+tests, per-file and repository coverage, Agent Gates, API E2E, and CodeRabbit
+remain required on the exact pushed head.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-12F2-pr-trust-bundle.md

@@ -0,0 +1,82 @@
+# Workstream PR Trust Bundle
+
+## Chunk
+
+`WS-AUTH-001-12F2` - Manual Submission Policy Drafts
+
+## Goal
+
+Activate only human Project Manager manual create/update for submission-policy
+drafts, with exact sufficiency lineage, non-bypassable Workstream defaults,
+append-only replacement, PREP evidence, and replay custody.
+
+## What changed
+
+- Activated create/update under child owner 12F2; derive/approve remain planned.
+- Added a dedicated human/key/PREP API boundary with service concealment.
+- Added exact system-or-project Project Manager admission before protected
+  lookups and exact locked PREP before mutation.
+- Replaced in-place updates with a deterministic successor row and atomic
+  predecessor supersession.
+- Added replay-first pending/committed handling that reauthorizes stored facts
+  without depending on later guide/setup lineage.
+- Removed obsolete self-committing manual create/update service entry points.
+- Expanded focused, fault-injection, OpenAPI, and real API contract coverage.
+- Added the required bounded behavior-mutation claim for the activating writer.
+
+## Scope and behavior
+
+- Project Managers may create or replace a manual draft only for a covered
+  project and its current authoritative sufficiency lineage.
+- Warning-bearing sufficiency requires exact 12E acknowledgement custody.
+- Agent-derived rows remain immutable through the manual route.
+- Derivation, approval, effective/pre-submit compilation, Celery, submission,
+  review, revision, payment, and reputation behavior are unchanged.
+- No migration is introduced by this chunk.
+
+## Local evidence
+
+```text
+Ruff app/tests/scripts: passed
+AUTH exact selector: 7 passed
+Non-database boundary/schema/replay checks: passed
+Project exact selector: 27 tests collected
+Hosted replay/service selector: 2 tests collected
+CI lane contract: 33 passed
+Python compileall: passed
+Stale authorization docs: passed
+Markdown links: passed
+Stale Workstream wording: passed
+git diff --check: passed
+Branch versus origin/main: 0 ahead / 0 behind before commit
+```
+
+Database-backed project tests and the roughly four-hour full suite are not run
+on the user's slow local machine. GitHub Actions must run the PostgreSQL-backed
+focused coverage, API E2E, repository-wide 78 percent floor, and changed-
+subsystem 90 percent floor on the exact pushed head.
+
+## Acceptance proof
+
+- [x] Only manual create/update are active under 12F2.
+- [x] System and exact-project PM grants admit; wrong-project, contributor,
+      service, and role-claim-only callers deny.
+- [x] Exact locked lineage and warning acknowledgement bind PREP and replay.
+- [x] Update is append-only and CAS-bound; agent rows cannot use this path.
+- [x] Exact committed replay returns stored response after later lineage drift.
+- [x] Matching pending replay is retryable; changed/cross-action reuse denies.
+- [x] Named create and update fault boundaries roll back product, replay, and
+      allowed evidence together.
+- [ ] Hosted PostgreSQL, full coverage, Agent Gates, API E2E, and CodeRabbit
+      pass on the exact pushed head.
+
+## Human review focus
+
+- Concealment-only PM admission versus exact durable PREP authority.
+- Stored-fact replay independence from later guide/setup changes.
+- Append-only predecessor/successor identity and transaction atomicity.
+- Default-floor preservation and manual/agent provenance isolation.
+
+## Human merge ownership
+
+- [ ] The user explicitly approved this specific PR for merge.

.github/workflows/backend.yml

@@ -468,7 +468,7 @@ jobs:
           set -euo pipefail
           coverage run --append -m pytest -q -p pytest_asyncio.plugin \
             tests/test_projects.py \
-            -k 'submission_artifact_policy_replay_repository or submission_artifact_policy_authority_service'
+            -k 'submission_artifact_policy_replay_repository or submission_artifact_policy_authority_service or submission_artifact_policy_manual_service_executes_authorized_create_and_update or submission_artifact_policy_manual_lineage_loads_exact_locked_context or submission_artifact_policy_manual_service_fail_closed_guards'
           for source in \
             app/modules/projects/submission_policy_mutation_repository.py \
             app/modules/projects/submission_policy_mutation_service.py