Add fixed service identity foundation

.agent-loop/LOOP_STATE.md

@@ -6,23 +6,22 @@
   post-merge state. Canonical state is the signed schema-v2 output on
   `automation/loop-memory`.
 - Active initiatives include parallel `WS-AUTH-001` and `WS-ART-001`.
-- PR #139 merged the planning-only `WS-XINT-001-PLAN` boundary reconciliation
-  into `main` as `5d353b6` on 2026-07-17.
-- Active planning chunk: `WS-AUTH-001-XINT` on
-  `codex/ws-auth-001-xint-reconciliation`.
-- PR #132 remains open at `79d1989` and conflicts with current `main`. Its
-  AUTH-09A fixed service foundation remains valid but must converge after this
-  AUTH planning amendment; AUTH-09B remains inactive.
-- Start basis: trusted `main` at `5d353b6` after PR #139.
+- PR #140 merged `WS-AUTH-001-XINT` into `main` as `d541521` on
+  2026-07-17; signed schema-v2 memory recorded the stopped checkpoint.
+- Active implementation chunk: `WS-AUTH-001-09A` on
+  `codex/ws-auth-001-09-actor-state-service-actors` after explicit user start.
+- PR #132 is being converged from trusted `main`; its fixed service foundation
+  remains bounded to migration `0023`, seven identities, eleven static matrix
+  memberships, and eight planned route actions. AUTH-09B remains inactive.
+- Start basis: trusted `main` at `d541521` after PR #140.
 - PR #119 merged `WS-AUTH-001-05B` as `ad71c7e`.
 - PR #120 merged `WS-ART-001-OBJECT-STORAGE-AMENDMENT` as `4408256`.
 - PR #122 merged the first automated post-merge memory implementation as
   `fc89fb6`; its schema-v1 cross-initiative next pointer is superseded by the
   schema-v2 initiative-local clean cut.
-- Current gate: required internal review passes on the externally repaired
-  planning state at `bac3073`, and final deterministic closure passes on
-  evidence head `7cb02b5`; replacement external checks and the human checkpoint
-  remain for PR #140. No runtime starts from this planning branch.
+- Current gate: resolve PR #132 against merged XINT, run deterministic migration
+  and catalogue proof, repeat exact-head internal review, and rerun external
+  checks. No AUTH-09 action or service caller becomes executable in 09A.
 - Scope checkpoint: AWS S3 is the only v0.1 production provider; MinIO is
   local/CI S3 protocol proof; LocalStorage is focused development/test; R2 and
   Flow Node are deferred. Product modules receive narrow artifact capabilities,

.agent-loop/REVIEW_LOG.md

@@ -1,5 +1,15 @@
 # Review Log
 
+## 2026-07-17 - WS-AUTH-001-09A Convergence Started
+
+After PR #140 merged as `d541521` and signed memory stopped, the user explicitly
+started the bounded PR #132 repair. The branch is converging migration `0023`,
+seven fixed service identities, eleven exact static matrix memberships, and
+eight planned actions onto current XINT without restoring feature-owned
+activation, combined-role, token-role, or compatibility authority. Prior
+SHA-bound evidence is stale until deterministic proof and required exact-head
+review repeat.
+
 ## 2026-07-17 - WS-AUTH-001-XINT External Review Repair Passed
 
 CodeRabbit posted nine actionable comments on PR #140. Eight valid contract,

.agent-loop/WORK_QUEUE.md

@@ -4,7 +4,7 @@
 
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
-| `WS-AUTH-001-XINT` | Lifecycle Boundary Plan Reconciliation | L1 | Planning-only AUTH owner response to merged PR #139 |
+| `WS-AUTH-001-09A` | Fixed Service Identity Foundation | L1 | PR #132 convergence and exact-head re-review from merged PR #140 |
 
 Live post-merge state remains read from signed `automation/loop-memory`
 output. This authored queue records the separately approved parallel chunks.
@@ -14,7 +14,7 @@ output. This authored queue records the separately approved parallel chunks.
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
 | `WS-QUAL-001-01B2` | Baseline Evidence And CI Ratchet | L1 | Paused for AUTH priority; no valid replacement baseline yet |
-| `WS-AUTH-001-09A` | Fixed Service Identity Foundation | L1 | PR #132 remains unmerged/conflicting; converge on merged XINT and re-review after this plan merges |
+| `WS-AUTH-001-09B` | Controlled Service Actor Provisioning | L1 | Inactive until 09A merge/memory and explicit user start |
 | `WS-QUAL-001-02` | Project Service Coverage | L1 | Inactive until 01B2 merge/memory plus explicit user start |
 | `WS-POL-002-04` | Locked Runtime Execution And Routing Hardening | L1 | Inactive pending relevant authorization proof and a separate explicit user start |
 | `WS-ART-001-02A3` | ArtifactStore v2 Local Clean Cut | L1 | Reviewed in isolated parallel worktree; pending its own PR and merge |
@@ -82,10 +82,10 @@ output. This authored queue records the separately approved parallel chunks.
 AUTH-05A merged through PR #115 as `8e1cde6`, and CAT plus its post-merge memory
 merged through PRs #117 and #118. AUTH-05B merged through PR #119 as `ad71c7e`.
 AUTH-06 merged through PR #124 as `f599551`. AUTH-07A, AUTH-07B, and AUTH-08
-merged through PRs #126, #130, and #131. WS-XINT planning merged through PR #139.
-`WS-AUTH-001-XINT` now reconciles AUTH's owner plan. AUTH-09A remains open
-and conflicting in PR #132; converge and re-review it only after this planning
-amendment merges. Do not start an AUTH-09 successor or POL-002-04 automatically.
+merged through PRs #126, #130, and #131. WS-XINT planning merged through PR #139,
+and its AUTH owner reconciliation merged through PR #140 as `d541521`.
+AUTH-09A convergence and exact-head re-review are active on PR #132. Do not
+start AUTH-09B or POL-002-04 automatically.
 
 Coverage R10 merged through PR #108. Do not start 01B2, chunk 02, or another
 coverage implementation chunk from this worktree.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md

@@ -14,13 +14,15 @@ This plan applies the merged `WS-XINT-001` handoffs to AUTH. It distinguishes:
 Feature chunks never change availability. AUTH never invents feature facts or
 performs feature lifecycle mutations.
 
-## Current catalogue baseline
-
-Trusted `main` after PR #139 contains 74 PermissionIds and 57 ActionIds: nine
-active and 48 planned. Of the planned rows, 25 ART actions and 19 REV actions
-still carry historical feature-chunk owner values. The two custody-transfer
-chunks below change only those owner values. Counts, mappings, and availability
-must remain identical.
+## Catalogue baselines
+
+Trusted entry `main` after PR #140 contains 74 PermissionIds and 57 ActionIds:
+nine active and 48 planned. AUTH-09A adds zero permissions and eight planned
+actor/link/service actions, producing 74 PermissionIds and 65 ActionIds: nine
+active and 56 planned. Of those planned rows, the same 25 ART actions and 19 REV
+actions still carry historical feature-chunk owner values. The two later
+custody-transfer chunks change only those owner values; their entry counts,
+mappings, and availability must remain identical.
 
 ## ART custody transfer
 

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md

@@ -27,9 +27,9 @@ stopped.
 | `WS-AUTH-001-07A` | Closed Permission And Action Catalogue | L1 | Merged through PR #126 as `e9d72a1` |
 | `WS-AUTH-001-07B` | Deny-By-Default Kernel And Self-Action Cutover | L1 | Merged through PR #130 as `90eca12` |
 | `WS-AUTH-001-08` | Bootstrap And Administrative Role Grants | L1 | Merged through PR #131 as `aa0fdcd` |
-| `WS-AUTH-001-XINT` | Lifecycle Boundary Plan Reconciliation | L1 | Active planning-only correction after merged PR #139 |
+| `WS-AUTH-001-XINT` | Lifecycle Boundary Plan Reconciliation | L1 | Merged through PR #140 as `d541521` |
 | `WS-AUTH-001-09` | Actor State, Identity Revocation, And Service Actors | L1 | Split before runtime implementation |
-| `WS-AUTH-001-09A` | Fixed Service Identity Foundation | L1 | PR #132 remains open and conflicting; converge on XINT before merge |
+| `WS-AUTH-001-09A` | Fixed Service Identity Foundation | L1 | Active PR #132 convergence and exact-head re-review from merged XINT |
 | `WS-AUTH-001-09B` | Controlled Service Actor Provisioning | L1 | Inactive until 09A merge/memory and explicit start |
 | `WS-AUTH-001-09C` | Actor And Identity-Link Administration Reads | L1 | Inactive until 09B merge/memory and explicit start |
 | `WS-AUTH-001-09D` | Actor And Identity-Link Lifecycle Mutations | L1 | Inactive until 09C merge/memory and explicit start |
@@ -185,10 +185,9 @@ signed automated memory completed, and the user explicitly started AUTH-07.
 Required L1 review rejected the combined contract before runtime edits and
 required 07A/07B. AUTH-07B merged through PR #130 as `90eca12`; AUTH-08 merged
 through PR #131 as `aa0fdcd`. Parent AUTH-09 was split before implementation.
-AUTH-09A implementation and review are complete in PR #132, but merged PR #139
-changed its planning base and the PR now conflicts with trusted `main`. Its
-seven identities, eleven static matrix actions, and migration `0023` remain
-valid. After this planning amendment merges, PR #132 must be converged without
-restoring stale owner or combined-role wording, re-reviewed on the exact head,
-and pass checks before human merge. Do not start AUTH-09B or POL-002-04
-automatically.
+PR #140 merged the required XINT planning reconciliation as `d541521`, signed
+memory stopped, and the user explicitly started the PR #132 convergence. Its
+seven identities, eleven static matrix memberships, eight planned actions, and
+migration `0023` remain valid. The repair must preserve XINT custody and
+independent-role wording, pass exact-head review and checks, and stop for human
+merge. Do not start AUTH-09B or POL-002-04 automatically.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DISCOVERY.md

@@ -3,6 +3,31 @@
 Discovery is read-only. No application code was changed while producing this
 artifact.
 
+## AUTH-09 delta discovery - 2026-07-16
+
+Merged AUTH-08 provides `AuthorityControl`, immutable AdminRoleGrants, seven
+active administrative actions, final-admin grant locking, shared authority
+idempotency/audit contracts, and caller-owned route transactions. ActorProfile
+already supports human/service kind and active/suspended/deactivated state;
+ActorIdentityLink already supports active/revoked state and one exact external
+issuer subject. The model has no stable local service-identity field.
+
+The inherited AUTH-09 contract required durable service-to-action matrix rows,
+but the repository has no assignment model and the policy is a fixed
+seven-identity/eleven-action matrix. Persisting each pair would duplicate static
+policy and create unnecessary reconciliation. The accepted direction stores one
+immutable `service_identity` on a service ActorProfile and derives candidate
+actions from one closed typed matrix. ActorIdentityLink remains the only opaque
+external credential binding. Services receive no human/admin/project grant.
+
+The combined contract also conflicted with canonical routes, omitted migration
+and test ownership, and combined schema, provisioning, reads, lifecycle
+mutations, service admission, and concurrency. Required L1 review split it into
+09A through 09E before runtime implementation. AUTH-09A takes migration `0023`;
+the merged XINT plan reserves `0024` through `0029` for AUTH-10 through AUTH-15
+without allocating migrations to the availability-neutral custody or PREP
+chunks.
+
 ## Current behavior
 
 ### Authentication

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md

@@ -86,27 +86,24 @@ initial security/architecture, QA/product, and senior/CI/docs review before
 runtime edits. The repaired contract passed all required preimplementation
 tracks at `cbe7c6c`; bounded AUTH-08 implementation later merged through PR #131
 as `aa0fdcd`. AUTH-09 was split before runtime implementation. AUTH-09A was
-reviewed through PR #132. PR #139 then merged the authoritative WS-XINT boundary
-reconciliation as `5d353b6` on 2026-07-17. PR #132 remains open and now
-conflicts with trusted `main`; its fixed service foundation remains valid, but
-its planning and evidence must converge from the merged XINT contract and be
-re-reviewed before merge. `WS-AUTH-001-XINT` is the active planning-only AUTH
-owner response. No runtime successor or feature action is active.
+reviewed through PR #132. PR #140 then merged the authoritative AUTH XINT
+reconciliation as `d541521` on 2026-07-17 and signed memory stopped. The user
+explicitly started PR #132 convergence from that trusted head. Prior review
+evidence is stale until exact-head review repeats. No AUTH-09 runtime action or
+feature action is active.
 
 ## Active planning chunk
 
-`WS-AUTH-001-XINT` - Lifecycle Boundary Plan Reconciliation.
+None. `WS-AUTH-001-XINT` merged through PR #140.
 
 ## Active implementation chunk
 
-None. `WS-AUTH-001-09A` has completed implementation on its PR branch, but its
-prior review no longer authorizes merge until the branch converges on trusted
-`main` and passes exact-head re-review. This chunk changes plans and future
-contracts only.
+`WS-AUTH-001-09A` - Fixed Service Identity Foundation convergence and exact-head
+re-review. This chunk activates no route, action, or service admission path.
 
 ## Current review branch
 
-`codex/ws-auth-001-xint-reconciliation`
+`codex/ws-auth-001-09-actor-state-service-actors`
 
 ## Chunk status
 
@@ -128,9 +125,9 @@ contracts only.
 | `WS-AUTH-001-07A` | Merged | `codex/ws-auth-001-07-authorization-kernel` | #126 | Merged as `e9d72a1`; 74 permissions, 50 planned actions, and action-aware audit parity only. |
 | `WS-AUTH-001-07B` | Merged | `codex/ws-auth-001-07b-deny-default-kernel` | #130 | Merged as `90eca12`; signed memory passed. |
 | `WS-AUTH-001-08` | Merged | `codex/ws-auth-001-08-bootstrap-admin-grants` | #131 | Merged as `aa0fdcd`; signed memory passed. |
-| `WS-AUTH-001-XINT` | External repair reviewed | `codex/ws-auth-001-xint-reconciliation` | #140 | Exact repair state `bac3073` passed all required tracks; replacement external checks pending. |
+| `WS-AUTH-001-XINT` | Merged | `codex/ws-auth-001-xint-reconciliation` | #140 | Merged as `d541521`; signed schema-v2 memory passed. |
 | `WS-AUTH-001-09` | Split | - | - | Split into 09A through 09E before runtime implementation. |
-| `WS-AUTH-001-09A` | Awaiting human merge | `codex/ws-auth-001-09-actor-state-service-actors` | #132 | Merge checkpoint is blocked: branch is open/conflicting; foundation valid, planning must converge on PR #139 and repeat exact-head review. |
+| `WS-AUTH-001-09A` | In progress | `codex/ws-auth-001-09-actor-state-service-actors` | #132 | Converging from merged PR #140; deterministic proof and exact-head re-review required. |
 | `WS-AUTH-001-09B` | Proposed | - | - | Controlled service ActorProfile/ActorIdentityLink provisioning after 09A. |
 | `WS-AUTH-001-09C` | Proposed | - | - | Actor and identity-link administrative reads. |
 | `WS-AUTH-001-09D` | Proposed | - | - | Actor and identity-link lifecycle mutations. |
@@ -152,11 +149,9 @@ merged feature manifests and separate human starts exist.
 
 ## Blockers
 
-PR #132 cannot merge unchanged because PR #139 modified overlapping AUTH loop,
-plan, chunk, and public-spec files. Resolve this only after the planning
-reconciliation merges: converge the 09A runtime/migration/evidence onto current
-`main`, preserve XINT role/service/activation wording, repeat required internal
-review on the exact head, and rerun external checks. The convergence must also
+PR #132 cannot merge until its current convergence preserves XINT
+role/service/activation wording, repeats required internal review on the exact
+head, and reruns external checks. The convergence must also
 preserve PR #132's packaged frozen migration contract, zero mutable migration
 imports, script-owned repository root, built-wheel location-independent replay,
 same-event-loop CLI cleanup, and original-exception/cancellation behavior.