WS-XINT-002-06A: activate pre-submit materialization

[Abiorh001]

PR Trust Bundle: WS-XINT-002-06A

Goal

Activate exactly artifact.pre_submit.checker_input.materialize for
workstream.artifact.materializer, fail closed before private contributor
bytes reach inspection/scratch/checkers, and unblock ART-04C1 without activating
contributor submission authority.

Design

• Reuse the existing opaque, process-local, single-use, transaction-bound PREP
  service and fixed-service identity matrix.
• Prepare before ZIP inspection using exact task, immutable assignment UUID,
  project/guide/snapshot, locked-policy, plan/catalogue, prepared-generation,
  archive, and storage-scheme facts.
• Consume the same handle after inspection with the server-computed canonical
  semantic-manifest hash, before scratch reservation or checker execution.
• Persist bounded authorization evidence with the full resource-context digest
  and project/prepared-generation coordinates.

Scope

The catalogue changes one planned action to active WS-XINT-002-06A custody.
No new ActionId, PermissionId, service identity, migration, alternate evaluator,
serializable handle, public route, generic artifact read, durable admission,
Submission, post-submit checker, checker output, or review capability is added.

Proof

• Catalogue/service tests prove the sole availability transition and fixed
  materializer identity.
• Real PREP tests prove exact preflight/final binding, transaction ownership,
  replay denial, cross-resource mismatch denial, and audit digest/coordinates.
• Materialization tests prove preparation denial precedes inspection, canonical
  manifest drift precedes final consumption/workspace, and final consumption
  precedes scratch/checker execution.
• No test, CI gate, coverage threshold, lint rule, or workflow was weakened.
• Local focused tests passed; hosted Backend and Agent Gates remain mandatory on
  the exact PR head.

Delivery order

After this PR merges, ART may run 04C1 then 04C2. AUTH can concurrently resume
at 12F3. ART-04C1 owns production composition and the locked-current-assignment
revalidation immediately before PREP.

Reviewer result

Architecture, security, product/ops, QA, senior engineering, CI integrity,
reuse/dedup, test-delta, and docs reviewers pass after all valid findings were
repaired. See WS-XINT-002-06A-internal-review.md.

Human review focus

Review the two-stage ordering, exact fixed identity, complete scalar/final fact
binding, audit digest, single action activation, and the explicit ART-04C1
composition boundary. Human approval owns merge.

[coderabbitai]

Warning

Review limit reached

@Abiorh001, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 14 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4bceba53-6bd2-4c9b-b3d9-d6adfe645934

📥 Commits

Reviewing files that changed from the base of the PR and between 81f281b and e33c1ca.

📒 Files selected for processing (23)

• .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/CHUNK_MAP.md
• .agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md
• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md
• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06A-pre-submit-materialization-activation.md
• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-06A-internal-review.md
• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-06A-pr-trust-bundle.md
• backend/app/modules/artifacts/authorization.py
• backend/app/modules/artifacts/submission_materialization.py
• backend/app/modules/audit/schemas.py
• backend/app/modules/authorization/catalogue.py
• backend/app/modules/authorization/kernel.py
• backend/app/modules/authorization/prepared.py
• backend/app/modules/authorization/runtime.py
• backend/tests/test_audit.py
• backend/tests/test_authorization.py
• backend/tests/test_default_pre_submit_execution.py
• docs/architecture_checker_framework.md
• docs/architecture_lockdown.md
• docs/operations_authorization_service.md
• docs/spec_authorization_service.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Abiorh001]

Temporarily closing and reopening to retrigger required checks after GitHub Actions incident left the prior reruns permanently stuck before job creation. No code or review scope changed; exact head remains e33c1ca.