Implement ART-04C2 ready admission publication

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/AUTH_HANDOFF.md

@@ -118,6 +118,28 @@ own facts; ART receives only the typed capability and never imports AUTH-owned
 repositories. Authorization evidence, capacity reservation, and durable put
 intent commit atomically before provider I/O.
 
+### Exact 04C2 activation manifest
+
+The hidden surface is
+`POST /api/v1/tasks/{task_id}/submission-bundle-preparations`. Its body is the
+one outer ZIP (`Content-Type: application/zip`). It accepts required headers
+`X-Task-Assignment-Id`, `Idempotency-Key`, `X-Submission-Summary`, and
+`X-Contributor-Attestation`, plus optional `X-Predecessor-Submission-Id`.
+Until activation, absent or malformed selectors and authorization denial are
+concealed as the same not-found response. The bounded `202` response contains
+only `put_attempt_id`, nullable `admission_id`, `status`, and `replayed`.
+
+The preflight action is exactly `artifact.submission_bundle.prepare`. Final
+transaction-bound consumption binds every field of
+`SubmissionBundleDurableIntentAuthorityFacts`: actor profile, identity link,
+project, task, assignment, nullable predecessor ID/version, passing evidence
+set, prepared generation, locked guide/version/source snapshot, effective
+artifact policy, checker policy, effective plan, semantic manifest, archive
+digest/bytes/media type, storage scheme, operation identity, and nullable
+server-selected replay intent. Consumption precedes capacity reservation,
+durable intent creation, and provider I/O. AUTH must not accept client-selected
+resource facts, serialize handles, or activate any additional action.
+
 ART-05 requires a new human authorization decision for `submission.create` and
 a separately prepared fixed-service capability for
 ActionId `artifact.submission.binding.create`, mapped to PermissionId

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md

@@ -132,10 +132,12 @@ exposure, provider I/O, or AUTH activation. `WS-ART-001-04B3` merged through
 PR #291 as `8f516e6d`. It executes the project-policy continuation through that
 same plan and sealed tree and persists one immutable platform-plus-project
 evidence set. AUTH `WS-XINT-002-06A` merged through PR #293 as `1ddb941e` and
-activated only the mandatory fixed pre-submit materializer. ART-04C1 then
-merged through PR #296 and persists the evidence-linked durable put intent.
-The dependency-ordered successor is 04C2; open pull requests determine whether
-it is currently under review.
+activated only the mandatory fixed pre-submit materializer. ART-04C1 merged
+through PR #296 as `6e1d5c9f` and installed the evidence-bound durable put
+intent. ART-04C2 is active and owns verified ready-admission publication plus
+the still-hidden, fail-closed continuous preparation composition. AUTH action
+activation, admission consumption, Submission creation, and binding remain out
+of scope.
 
 ## Gate
 

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-04C2-ready-admission-publication.md

@@ -1,6 +1,6 @@
 # Chunk Contract: WS-ART-001-04C2 — Ready Admission Publication
 
-Parent initiative: `WS-ART-001` | Risk: L1 | Status: Proposed after 04C1
+Parent initiative: `WS-ART-001` | Risk: L1 | Status: Active after merged 04C1
 
 ## Goal
 
@@ -9,32 +9,79 @@ verification and compose the hidden continuous contributor endpoint.
 
 ## Allowed Files
 
-SubmissionBundleAdmission model/migration/repository, verified
-`SubmissionBundleDurableIntent` reload, verification publication integration,
-bounded Operator projection, hidden route composition, tests/docs/CI.
+Only these implementation surfaces may change:
+
+- `backend/app/modules/artifacts/models.py` and the next linear Alembic migration;
+- the existing canonical `SubmissionBundlePreparationRequest` and port in
+  `backend/app/interfaces/artifact_operations.py`;
+- `backend/app/modules/artifacts/repository.py`;
+- one narrow submission-admission publisher module under
+  `backend/app/modules/artifacts/` and its composition call from
+  `backend/app/modules/artifacts/service.py`;
+- the existing `backend/app/modules/artifacts/pre_submit_evidence.py` only to
+  derive and persist the admission's database-verifiable locked-context hash;
+- the existing hidden submission preparation composition under
+  `backend/app/modules/artifacts/`, the existing
+  `backend/app/adapters/artifacts/` composition root, and
+  `backend/app/modules/tasks/router.py`; TASK-owned locked preparation-plan
+  projection may change only in
+  `backend/app/modules/tasks/pre_submit_context.py`;
+- bounded admission-usage projection fields in
+  `backend/app/modules/artifacts/operator.py` and
+  `backend/app/modules/artifacts/router.py`;
+- directly corresponding tests, CI lane inventory, ART specification/data-model
+  documentation, and this initiative's status/review evidence.
 
 ## Not Allowed Changes
 
 Submission/binding consumption, public activation, expiry/release/delete,
-candidate storage, review/contribution, or new recovery machinery.
+candidate storage, review/contribution, or new recovery machinery. Do not
+change AUTH catalogue, grants, constraints, evaluators, or action availability;
+legacy `TaskService` Submission creation; provider adapters; scanners; recovery
+aggregates; or create a second verification path.
 
 ## Acceptance Criteria
 
-Only verified matching bytes publish ready. 04C2 locks and reloads the exact
+Only verified matching bytes publish `ready`. The generic verifier calls one
+narrow submission-admission publisher only from its verified terminal
+transaction. The publisher locks and reloads the exact
 `SubmissionBundleDurableIntent`, its passing/eligible `PreSubmitEvidenceSet`,
-generic put attempt, verified content, replica, and receipt as the sole durable
-publication lineage; it never parses an opaque request digest or relies on
-scratch, prepared handles, or process-local capability state. Lifecycle is
-ready->consumed|stale; actor/link/project/task/assignment/predecessor/context/
-manifest/evidence lineage is immutable; abandoned ready remains charged; exact
-POST replay returns the same operation/admission; 04A2-04C2 run in one request
-with no serialized local handle; fixed pre-submit materializer is active before
-later live activation.
+generic put attempt, verified `ArtifactContent`, verified `ArtifactReplica`,
+and mandatory successful `ArtifactVerificationReceipt` as the sole durable
+publication lineage. It also records whichever provider-write evidence exists:
+the nullable direct `ArtifactOperationReceipt` or nullable
+`ArtifactPutObservationReceipt`. Exactly one of those write-evidence paths must
+match the same put attempt and replica lineage. Guide and checker-output
+verification remain unaware of submission lifecycle semantics beyond invoking
+the typed publisher with durable identifiers.
+
+The hidden POST composes 04A2-04C1 continuously in the request, returns only a
+bounded operation/current-admission result, and never waits for or replaces the
+durable verifier. Exact POST replay returns the same durable operation and, when
+verification has already published it, the same admission. Ready publication
+may therefore occur after the request returns. No scratch path, prepared handle,
+byte stream, or process-local capability crosses into the verification job or
+publisher.
+
+04C2 creates only `ready`. Its schema defines the complete
+`ready -> consumed|stale` terminal shape, immutable actor/link/project/task/
+assignment/predecessor/context/manifest/evidence lineage, and uniqueness needed
+for later consumption, but 04C2 does not execute `consumed` or `stale`
+transitions and does not create a Submission or binding. Those mutations and
+their final Submission-consumption uniqueness fence belong to 05A. Abandoned
+ready admissions remain charged. Fixed pre-submit materializer authority is
+already active; contributor preparation remains hidden and
+`artifact.submission_bundle.prepare` remains planned/unavailable.
 
 ## Verification Commands
 
-Focused verification/publication/lifecycle/concurrency/operator tests, Ruff,
-hosted gates, 90% owned subsystem and 78% repository coverage.
+Focused verification/publication tests must cover direct acknowledgement,
+observed-confirmed recovery, non-verified outcomes, replay, concurrent verified
+publication, lineage mismatch, and no guide/checker admission side effect.
+Schema tests prove immutable lineage and valid ready/consumed/stale shapes
+without exercising 05A transitions. Operator tests prove bounded unbound-ready
+and stale counts/bytes. Run Ruff, hosted gates, 90% owned subsystem coverage,
+and the 78% repository baseline.
 
 ## Required Reviewers
 

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-04C2-external-review-response.md

@@ -0,0 +1,53 @@
+# WS-ART-001-04C2 External Review Response
+
+## Comments addressed
+
+- Verifier publication failure now converts the same fenced verification
+  receipt and job to terminal `conflict`, preserving bounded attempt accounting
+  without appending a contradictory second receipt.
+- A partial unique database index now guarantees that one Submission ID cannot
+  consume multiple admissions.
+- Summary and contributor-attestation header values must be ASCII before they
+  enter immutable packet evidence; invalid encoding returns bounded `422`.
+- Locked task/predecessor/policy races now return bounded context-changed `409`
+  rather than an internal error.
+- The evidence policy-context constraint now uses the repository's logical
+  naming-convention suffix.
+- Alembic round-trip inspection now covers the evidence column/constraint,
+  restored immutability trigger, and consumer uniqueness index.
+
+## Comments deferred or declined
+
+- The migration intentionally retains its local canonical-JSON implementation
+  instead of importing mutable application code. Its encoding exactly matches
+  `canonical_json_hash`, while keeping historical migration execution
+  self-contained.
+- CodeRabbit's generic docstring-percentage warning is not treated as a code
+  failure: the repository's authoritative Agent Gates passed, and new boundary
+  helpers have focused docstrings.
+- Predicate-by-predicate negative publisher tests remain a low-risk follow-up;
+  the current service-negative, database-trigger, and real concurrent workflow
+  tests cover the complete fail-closed boundary.
+
+## Human decisions needed
+
+None.
+
+## Commands rerun
+
+- Focused Ruff and formatting for every changed response file.
+- `git diff --check`.
+- PostgreSQL migration upgrade from `0059` through `0061`.
+- Canonical schema fingerprint validation after the new constraint and index.
+- Focused admission tests and all hosted Backend lanes on the updated PR head.
+
+## Remaining risks
+
+AUTH activation and admission consumption remain separate reviewed chunks. The
+route remains hidden and unavailable in this PR.
+
+WS-QUAL-002-01 merged its protected exact module partition while this ART chunk
+was in flight. The ready-admission publisher and hidden preparation command are
+therefore consolidated in `submission_admission.py`; the QUAL-owned partition
+is unchanged. Do not re-split those classes into new eligible Python modules
+until a QUAL-owned protected-partition update has merged.