diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CHUNK_MAP.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CHUNK_MAP.md index 9fc91c80e..0d7921670 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CHUNK_MAP.md @@ -11,9 +11,12 @@ explicit start signal. | Chunk | Title | Risk | Gate | Status | |---|---|---:|---|---| | `WS-REV-001-PLAN` | Review And Revision Lifecycle Planning | L1 | None | Merged through PR #128 at trusted main `0302bcf854a565d429e232ad6b076a1931ea74e4` | -| `WS-REV-001-01` | Canonical Contract Adoption And Dependency Conformance | L1 | Plan approval; current-main refresh; merged WS-XINT-001 handoffs, AUTH PR #140 planning contracts, AUTH-09A/09B foundations, and CON-01 canonical contract adoption | Active on `codex/ws-rev-001-01` | -| `WS-REV-001-02` | Locked Review Policy And Task Lifecycle Alignment | L1 | AUTH canonical actor foundation; separately reviewed and merged AUTH-owned schema-only contributor-field foundation that breaks the current AUTH-13/14 <-> REV-09A cycle; ART submission commitment contract stable; canonical rejected/cancelled lifecycle amendment; D6 behavior approved | Proposed | -| `WS-REV-001-03` | Review Queue And Lease Persistence | L1 | 02 merged; WS-CON ContributionPolicyVersion persistence merged | Proposed | +| `WS-REV-001-01` | Canonical Contract Adoption And Dependency Conformance | L1 | Plan approval; current-main refresh; merged WS-XINT-001 handoffs, AUTH PR #140 planning contracts, AUTH-09A/09B foundations, and CON-01 canonical contract adoption | Merged through PR #145 at trusted main `b2b9016d5fee33ddca40882c97620a178d8e52f0` | +| `WS-REV-001-02` | Locked Review Policy And Task Lifecycle Alignment | L1 | Parent explicitly started; required L1 plan review | Split before runtime; non-executable parent | +| `WS-REV-001-02A` | Project Guide Activation Sequence And Publication Locking | L1 | AUTH-09D-A and the subsequent AUTH-owned contributor-field foundation merged; exact dependency SHA/head refresh; separate human start | Planning prepared; runtime blocked | +| `WS-REV-001-02B` | Locked Review Policy And Dormant Task Lifecycle Compatibility | L1 | 02A merged; approved preference/lease duration defaults; separate human start | Proposed | +| `WS-REV-001-02C` | Submission Attribution, Context, And Immutable Lineage | L1 | 02B merged; exact AUTH contributor/human-lineage constraints present; separate human start | Proposed | +| `WS-REV-001-03` | Review Queue And Lease Persistence | L1 | 02C merged; WS-CON ContributionPolicyVersion persistence merged | Proposed | | `WS-REV-001-04` | Immutable Review, Final Acceptance, Findings, And Replay Persistence | L1 | 03 merged; shared transactional-outbox persistence and caller-transaction lifecycle-audit participant merged at exact refreshed SHAs | Proposed | | `WS-REV-001-05` | Checker Admission, Preferred Routing, And Queue Views | L1 | 04; ART v2 submission/checker cutover; AUTH-10 reviewer grants and AUTH-11 project visibility; registered actions remain planned; hidden manifest later gates `WS-AUTH-001-REV-05` | Proposed | | `WS-REV-001-06` | Atomic Claims, Release, Preference, And Timers | L1 | 05; merged `WS-AUTH-001-REV-CUSTODY` and `WS-AUTH-001-PREP`; merged AUTH-09A foundation and AUTH-09B provisioning capability plus exact expiry identity extensions/provisioning and AUTH-09E admission from the merged REV-01 manifest; WS-CON ReviewLease ContributionPolicyVersion freeze participant; hidden manifest later gates `WS-AUTH-001-REV-06` | Proposed | @@ -30,7 +33,7 @@ explicit start signal. ## Dependency order ```text -PLAN -> 01 -> 02 -> 03 -> 04 -> 05 -> 06 -> 07 -> 08 -> 09A -> 09B -> 10 -> 11 -> 12 -> 12A -> 13 +PLAN -> 01 -> 02(parent split) -> 02A -> 02B -> 02C -> 03 -> 04 -> 05 -> 06 -> 07 -> 08 -> 09A -> 09B -> 10 -> 11 -> 12 -> 12A -> 13 ``` External initiative gates are inserted without changing same-initiative @@ -43,15 +46,16 @@ WS-REV-001-01 active contract and immutable registration/service manifests -> corresponding REV mutation/service chunks may consume registered actions and exact identities while every action remains unavailable -AUTH canonical human plus an AUTH-owned schema-only contributor-field foundation +AUTH-09D-A plus AUTH canonical human and the subsequent AUTH-owned +schema-only contributor-field foundation + merged AUTH-08 transaction/error/timestamp invariants + ART v2 stable contracts - -> WS-REV-001-02 + -> WS-REV-001-02A -> WS-REV-001-02B -> WS-REV-001-02C -WS-REV-001-02 +WS-REV-001-02C -> WS-CON exact attribution consumption and retired compensation-context field removal -WS-REV-001-02 + merged WS-CON ContributionPolicyVersion persistence +WS-REV-001-02C + merged WS-CON ContributionPolicyVersion persistence -> WS-REV-001-03 WS-REV-001-03 + merged CON-owned shared transactional-outbox persistence @@ -88,8 +92,9 @@ REV planning does not create or start it on ART's behalf. ## Chunk boundaries - 01 changes contracts and active documentation, not runtime behavior. -- 02-04 land persistence and constraints, including immutable FinalAcceptance, - without public review mutations. +- 02 is a non-executable split record. 02A-02C and 03-04 land bounded + persistence and constraints, including immutable FinalAcceptance, without + public review mutations. - 05-07 build routing, leases, and evidence consumption behind an unavailable production composition boundary; registration remains availability-neutral. - 08 freezes decision inputs, validation, task effects, and the @@ -110,14 +115,15 @@ REV planning does not create or start it on ART's behalf. Every chunk: senior engineering, QA/test, security/auth, and product/ops. -Add architecture and reuse/dedup to 01-13. Add docs to PLAN and every chunk that -changes schema, routes, runtime jobs, configuration, or active behavior: 01-13. Add -test-delta to every runtime chunk. Add CI integrity whenever a +Add architecture and reuse/dedup to 01-13, including split children 02A-02C. +Add docs to PLAN and every chunk that changes schema, routes, runtime jobs, +configuration, or active behavior. Add test-delta to every runtime chunk. Add +CI integrity whenever a workflow, script, dependency, or coverage gate changes. ## Stop condition -Planning is approved and merged AUTH PR #140/AUTH-08/AUTH-09A plus -ART-02A2/ART-02A3 contracts are reconciled. Finish, review, and merge Chunk 01 -with explicit human approval, then stop. Do not start Chunk 02 automatically; -its merge-intent gate remains separate. +Parent 02 planning may be reviewed and merged without runtime. Stop after its +automated memory names 02A. Do not start 02A until AUTH-09D-A and the subsequent +AUTH contributor foundation merge and the user provides a separate explicit +start. The duration defaults gate 02B, not 02A. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CONFORMANCE_MATRIX.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CONFORMANCE_MATRIX.md index 6de00b52d..f7ce55ea5 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CONFORMANCE_MATRIX.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CONFORMANCE_MATRIX.md @@ -11,7 +11,7 @@ collected node IDs; a section is not complete based only on prose. | 25.2 Queue routing | 03, 05-06, 09B, 11-12 | First-open, revision-preferred, immutable exact successful admitting-CheckerRun anchor, admission-versus-supersession both race orders, duplicate delivery, active preference conflict, expiry/decline/invalidation age preservation, admin time-limited assignment, preferred-before-open, current returns one/lease/none, arbitrary or stale ID denied | Existing `review_pending` activation scan, legacy remediation report, preferred return/takeover, admin assignment, operational counts/ages | | 25.3 Leases | 03, 06, 11 | One lease per queue and canonical human `ActorProfile.id`; immutable ReviewPacketManifest; frozen reviewer ContributionPolicyVersion independent of guide context; release/expiry distinction, database time, exact reviewer-revocation effects with submitter/adjudicator grants unchanged, service/human isolation, races in both permutations, rollback injection | Claim/release/expiry/reclaim/revocation with AUTH-09E-admitted service jobs and lazy recovery enabled | | 25.4 Reviews | 04, 08, 10 | Every decision appends one immutable Review; every submitted finding and later resolution is immutable; later rounds append rather than rewrite; canonical human reviewer identity; lease/queue/packet-manifest linkage; ReviewEvidenceArtifact slots; finding rules; reject reason; idempotency; CON reviewer operation runs before the decision branch; an `accept` Review additionally creates one immutable FinalAcceptance with unique task/Review/Submission and exact ReviewPolicy/actor lineage, then invokes the CON submitter operation; exact locked Review/Submission/lease/assignment/actor/ContributionPolicyVersion/stabilized artifact_hash lineage; reviewer contribution direct from Review, submitter contribution only from FinalAcceptance; REV-staged audit/outbox; no ART call or no-op participant; rollback | needs_revision without FinalAcceptance, accept with exactly one FinalAcceptance, reject without FinalAcceptance, exact contribution source shapes and task/assignment effects for all three decisions, explicit unpaid/payable awards, changed replay, revoked replay, crossed-lineage rejection, and atomic rollback across Review, the accept-path FinalAcceptance, contributions, and outbox | -| 25.5 Revisions | 02, 04, 09A-09B, 13 | Immutable same-task N-1 Submission chain; strict prepared cutover; immutable guide activation sequence; equal identity/sequence keeps and any different current active guide rebases; every preparation episode is bound to its Review/prior Submission/task/assignments/project and forms one non-branching chain; AUTH-13 replacement appends a target-assignment successor; preparation freezes guide/source/task-execution policy but no ContributionPolicyVersion; Submission N+1 and CheckerRun use the frozen context; TaskAssignment and ReviewLease contribution-policy freezes do not drift; Task Context uses the head; no reviewer rebase; all blocking findings answered/resolved | v1 guide context -> needs_revision -> same/forward/backward/unsafe classification -> optional authority-loss replacement -> prepared v2 context without contribution-policy drift -> contributor context -> checker readmission -> reviewer consumes v2 -> resolution -> accept | +| 25.5 Revisions | 02A-02C, 04, 09A-09B, 13 | Immutable same-task N-1 Submission chain; strict prepared cutover; immutable guide activation sequence; equal identity/sequence keeps and any different current active guide rebases; every preparation episode is bound to its Review/prior Submission/task/assignments/project and forms one non-branching chain; AUTH-13 replacement appends a target-assignment successor; preparation freezes guide/source/task-execution policy but no ContributionPolicyVersion; Submission N+1 and CheckerRun use the frozen context; TaskAssignment and ReviewLease contribution-policy freezes do not drift; Task Context uses the head; no reviewer rebase; all blocking findings answered/resolved | v1 guide context -> needs_revision -> same/forward/backward/unsafe classification -> optional authority-loss replacement -> prepared v2 context without contribution-policy drift -> contributor context -> checker readmission -> reviewer consumes v2 -> resolution -> accept | | 25.6 Reject | 08, 10 | Queue close, lease consume, same-task assignment block, task `rejected` with bounded reason, grants unchanged, other tasks unaffected, later version denied, reviewer contribution only | Authorized reject plus API/database/audit/CON agreement; no `closed` status token or synthetic Review | | 25.7 Recovery | 06, 09A, 11, 12A | Idempotent preference/lease sweeps and lazy repair; every actor/grant/self-review/policy invalidation; reason-bound covered Project Manager preparation-successor repair with stale-head/race proof; separate covered Project Manager D6 closure only after server-proven limit/deadline, with Operator/cross-project/not-reached denial; leased-without-active and consumed-without-Review detection; canonical reconciliation identity/generation with one unresolved partial uniqueness, duplicate/concurrent scan reload, one resolution, and post-resolution recurrence; Operator-only evidence-linked closure for legacy needs_revision without Review/root; no synthetic Review or silent immutable rewrite; persisted joint lifecycle phases, shared/exclusive advisory-lock mutation fencing, bounded drains, callbacks-through-drain, crash resume, and forward-only timeout recovery | Service-job loss/restart, revocation, preparation repair, D6 closure/replay/races, duplicate reconciliation, legacy unrecoverable closure, controlled recurrence, reconciliation alert, durable fence/drain/crash-resume/forward-reactivation procedure | | 25.8 Artifact evidence | 05-09B, 11 | ART v2 only; active-lease read limited to immutable ReviewPacketManifest; chain history metadata-only; expired/consumed/prior/later/sibling/cross-task/project access denied; exact ReviewEvidenceArtifact finding/response slots; ART candidate intake outside locks then AUTH -> REV -> ART database finalization with one final AUTH evaluation; exact `artifact.review_evidence.binding.create` service action and binding identity; no raw store, v1 retention, generic retrieval/binding-read, provider locator, or human-token forwarding | Current packet bounded stream, prior history without bytes, finding/response finalize, orphan-only failed races, outage/integrity block with no adverse decision, ART-owned recovery, LocalStorage/MinIO/S3 conformance | diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DECISIONS.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DECISIONS.md index a0a1dcabb..1a92e3354 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DECISIONS.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DECISIONS.md @@ -129,13 +129,14 @@ They are replaced in chunk 09A with direct project/guide/policy/context integrity constraints and a Submission-to-preparation binding. The original WorkstreamTask locks and all earlier Submissions remain unchanged. -Guide ordering never compares version strings. Chunk 02 adds a per-project, +Guide ordering never compares version strings. Chunk 02A adds a per-project, monotonic immutable `activation_sequence`. Existing active/superseded guides are backfilled deterministically from effective time, creation time, and ID under migration validation; drafts remain null until first activation. Active or superseded state requires a non-null sequence, draft state requires null, and a -sequence is allocated exactly once while locking the project. Task, preparation, -and Submission contexts stamp guide ID, version, and activation sequence. Equal +sequence is allocated exactly once while locking the project. Task stamps guide +identity in 02A, Submission stamps it in 02C, and later preparation stamps it in +09A. Equal identity/sequence keeps. Any different currently active guide identity/sequence rebases, including an intentional backward rebase to an older activation sequence. An internally inconsistent pair whose identity and activation sequence @@ -481,3 +482,33 @@ are one registered planned submission action, 19 registered planned review actions, and four approved but unregistered additions; none is active. The separate ART review-evidence binding proposal is not one of the 24, so future counts remain current-main-derived rather than a promised fixed total. + +### D21 - Parent REV-02 Is Split And AUTH Contributor Ownership Remains Prior + +The user explicitly started parent REV-02, but required L1 plan review found the +combined guide, policy/lifecycle, and Submission migration unreviewable as one +chunk. Parent 02 is therefore a non-executable split record: + +```text +02A guide activation sequence/publication locking +-> 02B immutable review/revision policy and dormant task/assignment states +-> 02C Submission attribution/context/immediate-predecessor immutability +``` + +AUTH owns migration `0026` for AUTH-09D-A. After 09D-A merges, AUTH owns the +separately reviewed contributor-field foundation from the then-current head. +That foundation clean-cuts both retired task-subsystem contributor-identity +fields to `contributor_id`, preserves current behavior, and supplies database-backed +canonical-human ActorProfile lineage. REV records its exact merged PR/SHA and +constraint contract before generating any child migration; REV never supplies a +parallel rename, compatibility alias, or ActorProfile constraint. + +02B keeps terminal Task/Assignment values dormant. It adds no transition into +`accepted`, `rejected`, `completed`, or `blocked`, and no reject Review FK. +The Review decision/task participant owns those effects after immutable Review +persistence exists. The later reason-bound administrative command owns the +`cancelled` edge. D6 continues to prohibit synthetic reject. + +The review preference and lease durations are independent positive policy +values. Neither may be inferred from `ReviewPolicy.sla_hours`; their exact v0.1 +migration defaults remain a human decision before 02B can start. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DISCOVERY.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DISCOVERY.md index ba3ebe6a1..a173acdff 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DISCOVERY.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DISCOVERY.md @@ -118,6 +118,24 @@ AUTH-owned schema-only contributor-field foundation before REV-02. REV-09A hidden behavior then precedes amended full AUTH-13/14 product cutovers. This is an AUTH repair gate, not permission for REV to rename AUTH-owned fields. +The 2026-07-18 parent-02 start audit against exact main `b2b9016d5fee33ddca40882c97620a178d8e52f0` +confirmed that the foundation is not yet present. Alembic head is +`0025_artifact_store_v2`; TaskAssignment and Submission still store +unconstrained retired contributor-identity strings; no contributor-foundation merge intent, +PR/SHA, migration, or database-backed child human-lineage constraint exists. +AUTH now owns migration `0026` for AUTH-09D-A profile lifecycle. The user +directed AUTH to make the contributor foundation its next priority after 09D-A, +from the then-current head, and authorized REV only for non-runtime planning and +test design meanwhile. + +The same required L1 plan review found parent REV-02 too broad. Guide activation +chronology/publication, review policy/dormant lifecycle, and Submission +attribution/lineage are three independent migration boundaries. The executable +work is therefore split into 02A, 02B, and 02C; parent 02 records no runtime. +Two policy inputs remain absent from every source reviewed: concrete v0.1 values +for the review preference window and review lease duration. They are explicit +human decisions and cannot be inferred from `ReviewPolicy.sla_hours`. + Merged AUTH reconciliation PR #140 is planning-only. Its `74` PermissionId / `57` ActionId / `9` active / `48` planned snapshot is now historical because AUTH-09A PR #132 added eight planned actions. PR #140 defines diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md index 6bc2268ae..99c16ac04 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md @@ -237,8 +237,11 @@ The cross-initiative sequence is explicit: reviewed schema-only contributor-field foundation. That foundation performs only the canonical TaskAssignment/Submission field clean cuts and preserves current behavior; full AUTH-13/14 product cutovers are explicitly later; -- `WS-REV-001-02` then establishes immutable - `Submission.task_assignment_id` attribution and guide activation sequence; +- parent `WS-REV-001-02` is a non-executable split record. After the exact + AUTH foundation merge, 02A establishes guide activation chronology and Task + stamps, 02B establishes immutable review/revision policy plus dormant + task/assignment compatibility, and 02C establishes immutable + `Submission.task_assignment_id` attribution and lineage; - WS-CON's approved replacement chunks then freeze submitter `ContributionPolicyVersion` on `TaskAssignment` and remove legacy compensation-context fields and @@ -333,10 +336,13 @@ prohibited. transitions plus bounded terminal reasons. Human reject enters `rejected`; the approved administrative revision-limit/deadline closure enters `cancelled` with its exact reason and creates no Review. -- `TaskAssignment` receives completed/blocked compatibility fields and a reject - Review reference. -- `ReviewPolicy` receives locked preference, lease, capacity, self-review, - reject, and finding-evidence settings. +- `TaskAssignment` receives dormant completed/blocked compatibility fields. + No service path enters either state and no reject Review reference is added + until Review persistence and the owning decision/task participant exist. +- `ReviewPolicy` receives positive preference/lease durations, capacity fixed + to one, self-review fixed false, close-task reject, and typed finding-evidence + settings. Existing policy migration uses separately approved duration + defaults and never infers either duration from `sla_hours`. - Existing locked non-compensation task/submission policy references remain the immutable execution-context anchor. @@ -716,7 +722,7 @@ missing typed capability becomes a separately approved dependency-owner chunk; it is not added opportunistically to a WS-REV PR. The pre-WS-CON task/project schema may still contain retired compensation-context -locks when chunk 02 lands. Those are transitional migration inputs only. +locks when children 02A-02C land. Those are transitional migration inputs only. WS-CON owns their consumer cutover and schema removal; WS-REV-09A and every public/final context operate only after that removal and must not replace the frozen `ContributionPolicyVersion` with a moving current policy. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/REVIEW_LOG.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/REVIEW_LOG.md index 6769f57c5..0310f3edc 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/REVIEW_LOG.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/REVIEW_LOG.md @@ -885,3 +885,33 @@ AUTH-09C keeps 74 PermissionIds and 65 ActionIds, activating only dependencies remain unavailable. The trusted PR-scope base is now `0ffdabf3dbb77e4e066683fde1a095d744ff1f43`. Fresh deterministic evidence and all nine exact-SHA reviewer tracks are required. + +## WS-REV-001-02 Start And Planning Circuit Breaker - 2026-07-18 + +The user explicitly started parent REV-02 from exact trusted main +`b2b9016d5fee33ddca40882c97620a178d8e52f0`. Read-only dependency review +returned FAIL: Alembic remains at `0025`, both task-subsystem models still use +retired contributor-identity storage names, and the separately reviewed AUTH contributor foundation +has no merged PR/SHA, migration, merge intent, or canonical-human child +constraint. + +Senior/architecture/reuse review also returned SPLIT REQUIRED. Parent 02 crossed +guide chronology/publication, policy/task lifecycle, and Submission +attribution/immutability boundaries. QA found the parent PLAN's reject Review FK +wording contradicted the approved contract and that preference/lease migration +defaults were unspecified. Security confirmed REV must not absorb the AUTH +rename or ActorProfile schema. + +The user then confirmed REV may continue non-runtime planning and test design. +AUTH owns migration `0026` for AUTH-09D-A and will prioritize the contributor +foundation afterward from the then-current head. Planning converts parent 02 to +a non-executable split record, defines children 02A/02B/02C, corrects the Review +FK wording, and records the full future test matrix. No backend model, service, +migration, or persistence test is edited. + +Candidate `0292825a52f884f42d82e1522637f2ff2bf4bb7a` passed the repaired +circuit breaker and all required internal planning tracks. Mandatory stale +authorization/Workstream/review/artifact scanners, Markdown links, 87 agent +gates, diff integrity, and the schema-v2 merge-intent validator pass. Remaining +gates are the dependency-owned AUTH merges, a separate 02A start, and the two +human-owned duration defaults before 02B. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/RISKS.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/RISKS.md index de15fb4a1..c8fca7ad5 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/RISKS.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/RISKS.md @@ -51,3 +51,7 @@ | R47 | Future adjudication concerns leak policy, states, actions, or readiness dependencies into v0.1 | High | Keep only dormant role/interface compatibility wording; add no adjudication behavior or dependency, and prove the shipping path is Review -> FinalAcceptance -> ContributionRecord. | | R48 | A prepared authority handle is replayed or substituted across sessions, actions, actors, or requests | Critical | REV recomposes final facts, then AUTH validates the opaque handle's exact bindings/current authority, consumes once, evaluates once, and stages evidence; prove rejected pre-consumption substitution preserves the legitimate handle for one later exact use, while stale/already-consumed and concurrent duplicate attempts remain invalid and stage no new state; separately prove evaluated denial rollback, clean AUTH evidence restaging, and restaging-failure atomicity. | | R49 | Parallel AUTH and REV chunks both rename contributor fields or own the same migration | Critical | REV-02 waits for a separately reviewed and merged AUTH-owned schema-only contributor-field foundation; amended full AUTH-13/14 product cutovers remain downstream of REV-09A; allocate REV migrations only from then-current main and prohibit parallel schema edits. | +| R50 | Parent REV-02 combines too many L1 database boundaries for reliable review | Critical | Parent 02 is non-executable; 02A owns guide chronology, 02B policy/dormant lifecycle, and 02C Submission lineage. Each child has one migration, separate review, merge memory, and explicit start. | +| R51 | Review preference or lease duration is invented from unrelated SLA data | High | Require two explicit positive human-approved defaults before 02B; never infer either from `sla_hours`, current timestamps, or archival examples. | +| R52 | Dormant terminal schema accidentally enables a human outcome without Review | Critical | 02B defines storage/constants only, adds no terminal transition edges or reject Review FK, and proves checker/limit/deadline paths create no terminal Task/Assignment or downstream effect. | +| R53 | Finalized Submission immutability blocks later ART-owned verified digest publication | High | 02C defines the finalization guard with an explicit future set-once `artifact_hash` exception owned by the approved ART/task amendment; it never permits overwrite or caller digest promotion. | diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md index 10932fe0b..7f346f7dc 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md @@ -2,10 +2,33 @@ ## Current status -`WS-REV-001-PLAN` merged through PR #128 at trusted main -`0302bcf854a565d429e232ad6b076a1931ea74e4`. The user explicitly started -`WS-REV-001-01`, which is active on `codex/ws-rev-001-01` from that exact base. -No runtime review or revision behavior is active in this chunk. +`WS-REV-001-01` merged through PR #145 at trusted main +`b2b9016d5fee33ddca40882c97620a178d8e52f0`. The user explicitly started +parent `WS-REV-001-02` on 2026-07-18. Required L1 plan review failed the +combined implementation boundary and required a 02A/02B/02C split before any +runtime or migration edit. + +REV may continue planning and test design only. AUTH currently owns migration +`0026` for AUTH-09D-A profile lifecycle. After AUTH-09D-A merges, AUTH owns the +next-priority, separately reviewed contributor-field foundation from the +then-current migration head. That foundation must clean-cut both retired +task-subsystem contributor-identity fields to `contributor_id`, preserve +existing behavior, establish +database-backed canonical-human ActorProfile lineage, and provide an exact +merged PR/SHA. REV runtime remains blocked until that merge. + +The parent 02 contract is now non-executable. Planning defines 02A guide +activation chronology/publication locking, 02B immutable policy and dormant +task/assignment lifecycle compatibility, and 02C Submission +attribution/context/lineage. No backend model, service, migration, or persistence +test has changed. + +Planning candidate `0292825a52f884f42d82e1522637f2ff2bf4bb7a` passed the +repaired circuit breaker, all required internal reviewer tracks, mandatory +contract scanners, Markdown links, 87 agent gates, and schema-v2 merge-intent +validation. It is planning-publication ready, not runtime-ready. + +## Chunk 01 merge history While Chunk 01 was under review, CON planning PR #142 merged to main at `a947b8693a97bdb94c9dc63202a51e197834d613`. The branch pulled that merge and @@ -72,10 +95,17 @@ gate. It changes no backend, migration, AUTH, ART, or CON runtime code. ordered flush-only participant before a canonical Review can commit. Every valid Review creates reviewer contribution; only an accept-created FinalAcceptance creates submitter contribution. -- AUTH-owned contributor-field foundations, ART submission commitment and - packet-read contracts, CON persistence/participant contracts, and the - remaining per-chunk gates stay external prerequisites exactly as listed in - `CHUNK_MAP.md`. +- AUTH-09D-A is in progress and owns migration `0026`. No AUTH contributor + foundation PR/SHA or migration exists on this REV base. REV assigns no + migration number and performs no runtime preparation against retired + contributor-identity storage. +- After AUTH-09D-A, AUTH must merge the bounded contributor-field foundation. + ART submission commitment/packet-read contracts, CON + persistence/participant contracts, and the remaining per-child gates stay + external prerequisites exactly as listed in `CHUNK_MAP.md`. +- Two product values remain human-owned before 02B implementation: + `review_preference_window_seconds` and + `review_lease_duration_seconds`. Neither is inferred from `sla_hours`. ## Canonical lifecycle boundary @@ -106,7 +136,7 @@ security/auth, product/ops, architecture, docs, reuse/dedup, test delta, and CI integrity. All 80 current-main agent tests and seven REV additions are retained; 87 agent-gate tests and the deterministic contract gates pass. -Chunk 01 is published as PR #145. CodeRabbit's nine actionable findings and one +Chunk 01 was published and merged as PR #145. CodeRabbit's nine actionable findings and one Markdown lint nit were repaired without runtime or successor-scope expansion. After ART-02A3 PR #141 advanced main, the branch merged and reconciled its active byte-only v2 LocalStorage clean cut while retaining every later @@ -115,13 +145,14 @@ review-facing ART gate. Candidate internal reviewer tracks against `0ffdabf3dbb77e4e066683fde1a095d744ff1f43`; 87 agent gates, Ruff, scanners, links, checksums, renderer checks, merge-intent validation, and the exact -71-entry A/M reviewed-scope comparison pass. Status-change, removal, -rename-as-D+A, and addition probes fail closed. Replacement GitHub checks are -required after push. This chunk activates no review action or endpoint and does -not authorize merge. +71-entry A/M reviewed-scope comparison passed. Status-change, removal, +rename-as-D+A, and addition probes failed closed. This chunk activated no review +action or endpoint. ## Stop condition -After Chunk 01 is reviewed, merged with explicit human approval, and automated -merge memory records it, stop. Do not start `WS-REV-001-02` without a separate -explicit user instruction. +Complete parent-02 planning review only. Do not edit backend runtime, migration, +or persistence tests. After the exact AUTH contributor-foundation merge and +human approval of the planning split, 02A still requires a separate explicit +start. The duration defaults gate 02B. No child starts its successor +automatically. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/TEST_DESIGN_WS-REV-001-02.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/TEST_DESIGN_WS-REV-001-02.md new file mode 100644 index 000000000..3e64a5884 --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/TEST_DESIGN_WS-REV-001-02.md @@ -0,0 +1,197 @@ +# Test Design: WS-REV-001-02 Split + +## Status + +Planning-only test design. No backend test or fixture is implemented until the +AUTH-owned contributor-field foundation merges and the relevant child receives +a separate human start. + +## Shared dependency gate + +Every child begins with a deterministic dependency test that records: + +- trusted-main SHA and single Alembic head; +- merged AUTH-09D-A PR/SHA; +- merged AUTH contributor-foundation PR/SHA and migration ID; +- absence of both retired task-subsystem contributor-identity storage names; +- presence of canonical `contributor_id` on TaskAssignment and Submission; +- database-backed canonical-human ActorProfile lineage; +- preserved task, submission, checker, and legacy-revision regression tests. + +Any missing proof stops before a REV migration is generated. + +## 02A - Guide Activation And Task Context + +### Migration fixtures + +| Case | Expected proof | +|---|---| +| Multiple projects with draft, active, and superseded guides | Active/superseded rows number independently per project; drafts remain null. | +| Historical rows with different effective times | Sequence follows `effective_at`, `created_at`, then `id`. | +| Activated guide missing required provenance | Upgrade fails and names the project/guide plus remediation. | +| Non-draft Task with exact same-project guide version | Task guide ID and activation sequence backfill exactly. | +| Task with missing, cross-project, or ambiguous guide context | Upgrade fails; current active guide is never substituted. | +| Protected Task stamps present | Downgrade refuses with destructive-remediation guidance. | + +### Direct SQL constraints + +- Reject zero/negative activation sequence. +- Reject draft with sequence. +- Reject active/superseded without sequence. +- Reject duplicate project/sequence. +- Reject mutation or clearing of an allocated sequence. +- Preserve sequence across active -> superseded -> active. +- Reject partial Task guide triplets and mixed guide ID/version/sequence. + +### Concurrency + +- Two first-time activations for one project serialize on the Project row and + allocate distinct monotonically increasing sequences. +- Activations in different projects proceed independently. +- Reactivation racing with a new activation retains the old sequence and does + not allocate twice. +- Publication locks all generation rows in deterministic type/ID order and a + concurrent mutation of ProjectGuide, GuideSourceSnapshot, + GuideSufficiencyReport, ProjectSetupRun, SubmissionArtifactPolicy, + EffectiveProjectSubmissionArtifactPolicy, PreSubmitCheckerPolicy, + PostSubmitCheckerPolicy, ReviewPolicy, RevisionPolicy, or transitional + compensation-context row cannot create a mixed generation. + +### Service behavior + +- Draft creation allocates no sequence. +- First activation allocates once. +- Repeated activation of the sole active guide is a no-write idempotent return. +- Superseded-guide reactivation preserves original approval/effective + provenance and sequence, clears superseded time, supersedes the current guide, + and writes the reactivation audit with server-owned reason + `older_guide_reactivated`; the route accepts no new caller reason/body. +- Draft, active-repeat, superseded-reactivation, invalid-state, and both + competing-reactivation request/commit permutations have separate tests under + the one canonical lock order. +- Task screening copies one complete guide identity. +- No semantic or lexical version comparison is used. +- No external call occurs while publication locks are held. + +## 02B - Review Policy And Dormant Lifecycle + +### Migration fixtures + +| Case | Expected proof | +|---|---| +| Safe ReviewPolicy row | Approved duration defaults plus capacity 1, self-review false, close-task reject, optional evidence backfill. | +| `requires_second_review=true` | Upgrade refuses with guide/policy remediation. | +| Missing canonical decisions or finding fields | Upgrade refuses rather than broadening policy. | +| Existing RevisionPolicy with either legacy auto-reject value | Column is removed; no product row or lifecycle effect is created. | +| Existing normal Task/Assignment statuses | Values and timestamps are preserved. | +| Unknown or inconsistent historical status shape | Upgrade refuses with row IDs and remediation. | + +### Direct SQL constraints + +- Reject nonpositive preference/lease duration. +- Reject capacity other than one. +- Reject self-review true. +- Reject reject policy other than `close_task`. +- Reject unknown finding-evidence requirement. +- Reject malformed/duplicate/missing canonical decisions and finding fields. +- Reject `requires_second_review=true`. +- Reject activated ReviewPolicy and RevisionPolicy update or delete. +- Allow both draft-policy replacements before first activation. +- Reject unknown Task and TaskAssignment status values. +- Reject terminal Task without mapped reason/time and nonterminal Task with + terminal fields. +- Reject Assignment status/timestamp mismatch. + +### Service and lifecycle behavior + +- New guide policy validates the exact v0.1 values. +- Activated ReviewPolicy/RevisionPolicy upserts fail without modifying the row. +- Either changed policy is created only under a new draft guide version. +- Lifecycle constants include accepted/rejected/cancelled and + completed/blocked, but transition guards still reject attempts to enter them. +- Removal of `auto_reject_after_limit` creates no Review, finding, Task terminal + status, Assignment terminal status, contribution, award, audit, or outbox + effect. Executable limit/deadline block tests remain required in 09A. +- Checker paths cannot select `rejected` or `cancelled`. +- All three dormant cancellation reasons, including + `legacy_revision_context_unrecoverable`, satisfy storage constraints but no + 02B service transition can create them. + +## 02C - Submission Attribution And Lineage + +### Migration fixtures + +| Case | Expected proof | +|---|---| +| One assignment satisfying the exact inclusive temporal predicate | Submission receives that assignment ID. | +| No responsible assignment | Upgrade fails with submission/task IDs. | +| Multiple plausible assignments | Upgrade fails; current or latest assignment is not selected. | +| Assignment belongs to another task | Upgrade fails. | +| Submission contributor differs from assignment contributor | Upgrade fails. | +| Submission time equals assigned/accepted/released boundary | Inclusive predicate is applied exactly. | +| Missing acceptance, invalid interval, or overlapping reassignment intervals | Upgrade fails with responsible row IDs. | +| Same contributor assigned twice with non-overlapping intervals | The one interval containing submitted time is selected. | +| Timestamp tie yields two qualifying assignments | Upgrade fails as ambiguous. | +| Exact historical guide context | Guide ID/sequence backfill from locked version and task context. | +| Missing or inconsistent historical guide context | Upgrade fails; active guide is not substituted. | +| Valid N-1 chain | Upgrade succeeds and preserves every ID/version. | +| Cross-task, skipped, branched, or self-linked chain | Upgrade fails with chain remediation. | +| Protected lineage in use | Downgrade refuses. | + +### Direct SQL constraints and immutability + +- Reject assignment from another task. +- Reject contributor unequal to exact assignment contributor. +- Reject nonhuman contributor through the merged AUTH foundation. +- Reject version 1 with a predecessor. +- Reject version greater than one without predecessor. +- Reject predecessor whose task or version is not exact N-1. +- Reject a second successor for the same predecessor. +- Reject mutation/deletion of a finalized Submission's identity, attribution, + version, predecessor, context, packet, evidence, or attestation. +- Reject EvidenceItem insert, update, or delete when its parent + `Submission.locked_at` is non-null; `finalized_at` remains only the API alias. +- Permit only the separately owned set-once `artifact_hash` extension after + finalization when that ART amendment later exists; reject overwrite. + +### Concurrency and service behavior + +- Two concurrent creates for one task serialize on Task/current head; one + receives N and the other either receives N+1 under valid lifecycle state or + fails with the stable conflict. They never create duplicate N or branches. +- Concurrent reassignment cannot change the assignment selected for a + submission already being finalized. +- Release, authority revocation, and later reassignment preserve prior + attribution. +- Suspended/deactivated human and service ActorProfiles are denied by the + transaction-local AUTH revalidation. External subject, email, legacy typed + profile ID, and token role are rejected as contributor substitutes. +- Submission request input never supplies assignment ID, contributor ID, + version, predecessor, or guide context. +- TaskAssignment gains no guide/context field. +- No duplicate SubmissionVersion model/table/API appears. + +## Regression and negative-scope proof + +For every child: + +- existing project-guide, task claim/start, submission finalization, checker, + and legacy revision tests remain enabled; +- no assertion is weakened, skipped, or rewritten to accept unsafe lineage; +- no AUTH, ART, CON, compensation, contribution, reputation, adjudication, queue, + lease, Review, finding, or public review-route file changes; +- migration upgrade is tested against real PostgreSQL, not only metadata; +- unsafe upgrades leave no partial DDL/data effects; safe fixtures prove + upgrade/downgrade/upgrade, and protected-row fixtures prove downgrade refusal; +- full isolated suite remains at or above 78 percent repository coverage; +- each materially changed backend module remains at or above 90 percent; +- stale wording and Markdown-link checks pass. + +## Human decisions still required + +1. Exact positive v0.1 default for + `review_preference_window_seconds`. +2. Exact positive v0.1 default for `review_lease_duration_seconds`. + +These values are product policy. They are not inferred from the unrelated +`ReviewPolicy.sla_hours`, and no migration may start while either is unset. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02-review-policy-task-alignment.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02-review-policy-task-alignment.md index aca85f1d9..fd4c0c5cb 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02-review-policy-task-alignment.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02-review-policy-task-alignment.md @@ -1,155 +1,89 @@ # Chunk Contract: WS-REV-001-02 - Locked Review Policy And Task Lifecycle Alignment -## Goal +## Status -Align locked review policy, task terminal states, assignment blocking fields, -and the existing versioned Submission with WS-REV without adding review queues. +Split before runtime implementation after required L1 plan review. No backend, +migration, or persistence-test work may execute against this parent contract. -## Risk class +The user explicitly started parent `WS-REV-001-02` on 2026-07-18, then confirmed +that REV may continue planning and test design only. Runtime remains blocked +until AUTH-09D-A merges and AUTH subsequently merges its separately reviewed +contributor-field foundation from the then-current migration head. -L1 schema, policy, and lifecycle. +## Parent initiative -## Preconditions +`WS-REV-001` - Review And Revision Lifecycle -- Current trusted main contains the merged WS-AUTH definition of done. -- Current trusted main contains AUTH-08's regression proof for rollback-only - authorization-dependency teardown, typed decision-evidence SQL failure mapped - to the stable retryable 503, and documented route-owned canonical - verification-timestamp semantics. -- Before this chunk starts, AUTH must amend its current circular AUTH-13/14 graph - and merge an AUTH-owned schema-only contributor-field foundation. That bounded - foundation performs only the canonical `TaskAssignment.contributor_id` and - `Submission.contributor_id` clean cuts while preserving current task, - submission, checker, and legacy-revision behavior. It must not claim the later - replacement/replay behavior that depends on REV-09A. AUTH assigns the exact - chunk ID and migration numbers from then-current main through a separately - reviewed contract; REV does not invent them or edit the retired fields. -- Full AUTH-13/14 product cutovers are not REV-02 prerequisites. After REV-09A - merges hidden prepared revision/replacement behavior, AUTH must amend and - complete those cutovers before REV-13. Parallel edits to contributor fields or - revision behavior outside this order are prohibited. -- This chunk consumes those contracts but changes no AUTH implementation. +## Goal -## Allowed files +Bound the locked guide, review-policy, task-lifecycle, assignment, and existing +Submission alignment work without adding review queues or creating overlapping +AUTH schema ownership. -```text -backend/app/modules/projects/{models,schemas,repository,service}.py -backend/app/modules/tasks/{models,schemas,lifecycle,repository,service}.py -backend/app/db/models.py -backend/alembic/versions/_review_policy_task_alignment.py -backend/tests/test_{alembic,projects,tasks}.py -docs/architecture_lifecycle_state_machine.md -docs/operations_revision_replay.md -docs/operations_operator_workflow.md only for migration/deployment/remediation notes -.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/** -.agent-loop/merge-intents/WS-REV-001-02.json -``` +## Why the split is required -## Not allowed +The original contract combined three independently risky PostgreSQL boundaries: -```text -new SubmissionVersion table -review queue, lease, Review, or finding tables -public review routes -authorization or artifact implementation -contribution or compensation implementation -synthetic reject from checker, deadline, or revision limit -``` +- Project Guide activation sequencing and publication locking; +- locked ReviewPolicy/RevisionPolicy plus dormant task/assignment lifecycle + compatibility; and +- existing Submission attribution, predecessor integrity, context stamping, and + finalized-row immutability. -## Acceptance criteria - -- Dependency refresh records the exact merged AUTH repair SHA and proves every - precondition above before migration or runtime edits begin. -- Review policy stores task-lockable preference, lease, capacity=1, - self-review=false, close-task reject, and finding-evidence settings. -- Once a ReviewPolicy is part of an activated Project Guide context, it is - immutable; policy changes require a new guide version. Its canonical UUID is - the typed `policy_context_ref` later stored by FinalAcceptance, while Task and - Submission continue to stamp the matching locked review-policy version. -- Existing policy rows receive an explicit safe migration rule; unsafe data - fails with a remediation message. -- Task supports canonical `accepted`, `rejected`, and `cancelled` transitions - without weakening existing transitions. Only human reject enters `rejected`; - reason-bound administrative revision closure enters `cancelled`. No - undocumented `closed` status or synthetic reject is added. -- TaskAssignment supports `completed` and `blocked` state compatibility, but no - reject Review FK is added and no code can block before the Review table lands. -- Existing Submission remains the only version chain and its predecessor and - actor semantics are enforced: immutable rows, same-task predecessor, exact - version N-1 linkage, and canonical submitter ActorProfile identity. Database - constraints or deferred constraint triggers guard direct SQL as well as the - service path; unsafe historical lineage fails with a remediation message. -- Submission gains an immutable `task_assignment_id` bound by composite - integrity to the same task. Its AUTH-14-owned `Submission.contributor_id` must - equal the AUTH-13-owned `TaskAssignment.contributor_id` on that exact - assignment. Existing rows are - backfilled only when exactly one assignment is provably responsible; ambiguous - lineage fails migration with explicit remediation instead of selecting a - current or recent assignment. Assignment release/reassignment never changes - a prior Submission's attribution. -- TaskAssignment stores only `task_id` for context resolution and does not - duplicate or reference a guide/context lock. The task-context resolver uses - the task lock for initial work, a later immutable preparation for revision - work, and each Submission's own stamped context for history. -- ProjectGuide receives a per-project monotonic immutable activation sequence; - activation allocates it exactly once under a project row lock. Existing - active/superseded guides are deterministically backfilled by effective time, - creation time, and ID with collision/ambiguity validation; draft guides remain - null until first activation. Database checks require null for drafts and - non-null for active/superseded guides, and uniqueness covers project plus - activation sequence. Task and Submission contexts stamp guide ID, version, - and activation sequence; no semantic or lexical version comparison determines - rebase order. -- Direct-SQL tests reject sequence mutation, duplicate project/sequence, - draft-with-sequence, active/superseded-without-sequence, and allocation of a - second sequence when a previously activated guide is reactivated. Migration - fixtures prove deterministic historical backfill, sequence preservation on - reactivation, concurrent allocation under the project lock, and downgrade - refusal once task/Submission contexts stamp activation sequence. -- Project-guide activation locks Project, candidate/current guide, - source-snapshot, and artifact/effective/pre-check/post-check/review/revision/ - policy rows in the canonical PLAN order before publication. If retired - compensation-context state still exists before WS-CON cutover, it is locked only as a - transitional consistency input; WS-CON owns its later consumer and schema - removal. The final Project Guide/revision context contains no retired compensation or - ContributionPolicyVersion. Publication never assembles mixed generations. -- Every persisted human identity added or validated here is the canonical - active human `ActorProfile.id`. External subjects, email, legacy typed-profile - IDs, token roles, and current-assignment inference are rejected as identity - substitutes. -- Human-only persistence is database-enforced with an immutable composite - actor-kind candidate key plus local `actor_kind='human'` check, or an - equivalently reviewed deferred constraint trigger. A plain FK to - `ActorProfile.id` is insufficient; mutable active status is revalidated by - AUTH in the transaction rather than treated as an immutable FK fact. -- The approved limit/deadline decision is encoded without fabricating Review. -- Legacy `auto_reject_after_limit` is removed or migrated to the approved - fail-closed D6 behavior; reaching the boundary blocks revision preparation - and submission with no automatic task/assignment/Review/CON mutation. - -## Verification +Each boundary requires its own migration preflight, direct-SQL constraints, +concurrency proof, downgrade rules, focused coverage, and human review. The +combined L1 change was not credibly PR-sized. -```text -cd backend && alembic upgrade head -cd backend && pytest -q tests/test_alembic.py tests/test_projects.py tests/test_tasks.py -cd backend && ruff check app/modules/projects app/modules/tasks tests/test_alembic.py tests/test_projects.py tests/test_tasks.py -cd backend && docstr-coverage --config .docstr.yaml -(metadata_dir="$(mktemp -d)" && trap 'rm -rf "$metadata_dir"' EXIT && (cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/postgres .venv/bin/python scripts/run_isolated_tests.py --metadata-json "$metadata_dir/result.json" --timeout-seconds 12600 -- .venv/bin/python -m pytest -q --ignore=tests/test_isolated_database_runner.py --cov=app --cov-report=term-missing --cov-fail-under=78)) -cd backend && for path in app/modules/projects/models.py app/modules/projects/schemas.py app/modules/projects/repository.py app/modules/projects/service.py app/modules/tasks/models.py app/modules/tasks/schemas.py app/modules/tasks/lifecycle.py app/modules/tasks/repository.py app/modules/tasks/service.py; do coverage report --include="$path" --precision=2 --fail-under=90 || exit 1; done -``` +## Child chunks -## Required reviewers +| Chunk | Title | Boundary | +|---|---|---| +| `WS-REV-001-02A` | Project Guide Activation Sequence And Publication Locking | Allocate immutable per-project activation chronology, stamp Task guide identity, and publish one internally consistent guide generation. | +| `WS-REV-001-02B` | Locked Review Policy And Dormant Task Lifecycle Compatibility | Make guide-bound review/revision policy exact and immutable and add non-executable terminal task/assignment schema compatibility without fabricating Review. | +| `WS-REV-001-02C` | Submission Attribution, Context, And Immutable Lineage | Bind each existing Submission to its exact assignment and canonical contributor, enforce same-task immediate-predecessor lineage, stamp guide identity, and protect finalized rows. | -Senior engineering, QA/test, security/auth, product/ops, architecture, -reuse/dedup, docs, and test-delta. +## Dependency order -## Human review focus +```text +AUTH-09D-A merged +-> AUTH-owned contributor-field foundation reviewed and merged +-> WS-REV-001-02A +-> human approval of the two duration defaults recorded in 02B +-> WS-REV-001-02B +-> WS-REV-001-02C +-> WS-REV-001-03 +``` -Migration safety, policy defaults, no duplicate submission identity, and no -synthetic human decision. Guide-sequence allocation/backfill and the rule that -the current active guide remains authoritative in both sequence directions -receive explicit human attention. +AUTH currently owns migration `0026` for profile lifecycle. REV assigns no +migration identifier in planning. Every child refreshes from trusted `main` and +uses the then-current single Alembic head only after the contributor foundation +has merged. + +## Preserved boundaries + +- AUTH owns the clean cuts from both retired contributor-identity storage fields + to `contributor_id` and the reusable database-backed ActorProfile human-lineage + foundation. REV consumes the merged result and never recreates it. +- `Submission` remains the only versioned submission identity. +- TaskAssignment stores only `task_id`; it receives no guide/context duplicate. +- No child adds a Review, queue, lease, finding, FinalAcceptance, public review + route, AUTH implementation, ART implementation, CON behavior, or synthetic + reject. +- `accepted`, `rejected`, `cancelled`, `completed`, and `blocked` are dormant + compatibility states here. Their Review-driven service transitions land only + with the owning immutable Review/decision chunks. +- The reject Review foreign key is owned by later Review persistence and is not + added by 02B. + +## Planning proof + +The future test cases are specified in +`TEST_DESIGN_WS-REV-001-02.md`. The plan must retain explicit tests for unsafe +migration refusal, direct SQL, concurrency, downgrade refusal, and absence of +premature Review-driven effects. ## Stop condition -Merge, record automated memory, and stop. Do not start 03. +Stop at this split record. Do not implement a child until its exact dependency +SHAs, migration head, child-specific human decisions, contract review, and +separate human start are recorded. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A-guide-activation-sequence.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A-guide-activation-sequence.md new file mode 100644 index 000000000..9690eb96e --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A-guide-activation-sequence.md @@ -0,0 +1,146 @@ +# Chunk Contract: WS-REV-001-02A - Project Guide Activation Sequence And Publication Locking + +## Parent initiative + +`WS-REV-001` - Review And Revision Lifecycle + +## Goal + +Give every activated Project Guide an immutable per-project chronology and make +guide publication assemble and lock one internally consistent generation. + +## Why this chunk exists + +Revision rebase compares the prior Submission's stamped guide identity with the +currently active guide. Semantic or lexical version comparison cannot establish +chronology, and the current activation path can read policy rows from mixed +generations. This child establishes the chronology and Task-side lock before +Submission copies it in 02C. + +## Risk class + +L1 schema, migration, and concurrency. + +## SLA + +P2. + +## Preconditions + +- AUTH-09D-A and the separately reviewed AUTH-owned contributor-field + foundation are merged, even though this child does not edit contributor + fields; the user has declared that foundation a runtime gate for all REV-02 + implementation. +- Dependency refresh records exact merged PR/SHA evidence and the then-current + single Alembic head. REV does not reserve a migration number during planning. +- This contract receives a separate human start after parent 02 planning is + approved. + +## Allowed files + +```text +backend/app/modules/projects/{models,schemas,repository,service}.py +backend/app/modules/tasks/{models,schemas,repository,service}.py only for Task guide stamps +backend/app/db/models.py +backend/alembic/versions/_guide_activation_sequence.py +backend/tests/test_{alembic,projects,tasks}.py +docs/architecture_data_model.md +docs/architecture_lifecycle_state_machine.md +docs/operations_operator_workflow.md only for migration/deployment/remediation +.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/** +.agent-loop/merge-intents/WS-REV-001-02A.json +``` + +## Not allowed changes + +```text +Submission attribution, lineage, or immutability +ReviewPolicy or RevisionPolicy field changes +Task or TaskAssignment lifecycle state changes +AUTH-owned contributor or ActorProfile schema +review queue, lease, Review, finding, FinalAcceptance, or public review routes +ART, CON, compensation, contribution, adjudication, or synthetic reject behavior +``` + +## Acceptance criteria + +- `ProjectGuide.activation_sequence` is a nullable positive bigint allocated + exactly once on first activation. +- Database checks require drafts to have null sequence and active/superseded + guides to have a non-null sequence; `(project_id, activation_sequence)` is + unique. +- A database guard rejects sequence mutation or clearing. Reactivating a + previously activated guide preserves its original sequence and allocates no + second value. +- Existing active/superseded guides are deterministically numbered per project + by `effective_at`, `created_at`, then `id`. Missing required activation + provenance, invalid status/sequence shape, or conflicting historical data + fails with an actionable remediation message. Drafts remain null. +- Activation takes a `FOR UPDATE` project row lock before allocating + `max(activation_sequence)+1`; concurrent first activations cannot duplicate or + invert allocation. +- Publication uses this exact lock order: Project; candidate/current + ProjectGuide rows; GuideSourceSnapshot; GuideSufficiencyReport; + ProjectSetupRun; SubmissionArtifactPolicy; + EffectiveProjectSubmissionArtifactPolicy; PreSubmitCheckerPolicy; + PostSubmitCheckerPolicy; ReviewPolicy; RevisionPolicy; then the transitional + compensation-context row if it still exists. Rows of one type lock by ascending + primary key. That retired row is consistency input only and is not copied into + the final guide/revision context. +- `WorkstreamTask` stamps `locked_guide_id`, `locked_guide_version`, and + `locked_guide_activation_sequence` as one composite guide identity when it + leaves draft. Draft tasks keep the triplet null; non-draft tasks require it + complete and reference one guide row. +- Existing non-draft tasks backfill only from an exact same-project locked + guide version with a valid activation sequence. Missing or ambiguous context + fails migration rather than choosing the current guide. +- Publication cannot assemble policy rows from different guide/source/policy + generations and performs no external I/O while locks are held. +- First activation is allowed only from draft: it allocates sequence, records + `approved_by` and `effective_at=database_now`, and clears no historical + provenance. Repeating activation of the sole active candidate is idempotent + and changes no timestamp, provenance, sequence, or audit row. +- Reactivation is allowed only from superseded. It preserves original + `approved_by`, `effective_at`, and activation sequence; changes status to + active; clears `superseded_at`; supersedes the current active guide at + database time; and appends a reactivation audit event with server-owned reason + `older_guide_reactivated`, canonical actor, and replaced guide. The existing + route gains no caller-supplied reason or request body. No other status may + reactivate. +- Two competing activations/reactivations serialize under the Project lock. + Each valid request observes and supersedes the then-current guide; both lock + acquisition orders leave exactly one active guide and preserve every + previously allocated sequence. +- Downgrade refuses once Task rows stamp activation sequence unless the operator + uses the documented destructive remediation procedure. + +## Verification commands + +```text +cd backend && alembic upgrade head +cd backend && pytest -q tests/test_alembic.py tests/test_projects.py tests/test_tasks.py +cd backend && ruff check app/modules/projects app/modules/tasks tests/test_alembic.py tests/test_projects.py tests/test_tasks.py +cd backend && docstr-coverage --config .docstr.yaml +python3 scripts/check_stale_workstream_wording.py +python3 scripts/check_markdown_links.py +``` + +The full isolated PostgreSQL suite must preserve the repository-wide 78 percent +floor. Every materially changed projects/tasks module must remain at or above +90 percent coverage. + +## Required reviewers + +Senior engineering, QA/test, security/auth, product/ops, architecture, +reuse/dedup, docs, and test-delta. + +## Human review focus + +Historical ordering, concurrent allocation, reactivation preservation, lock +order, task backfill refusal, and downgrade limits. + +## Stop conditions + +- Stop if contributor or ActorProfile schema must change. +- Stop if historical task/guide lineage is ambiguous. +- Merge, record automated memory, and stop. Do not start 02B automatically. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02B-review-policy-task-lifecycle.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02B-review-policy-task-lifecycle.md new file mode 100644 index 000000000..a4cc81595 --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02B-review-policy-task-lifecycle.md @@ -0,0 +1,161 @@ +# Chunk Contract: WS-REV-001-02B - Locked Review Policy And Dormant Task Lifecycle Compatibility + +## Parent initiative + +`WS-REV-001` - Review And Revision Lifecycle + +## Goal + +Make guide-bound review/revision policy immutable and add the exact dormant Task +and TaskAssignment state shape required by later human Review decisions. + +## Why this chunk exists + +The current ReviewPolicy lacks routing, lease, no-self-review, reject, and +evidence rules; RevisionPolicy still advertises automatic reject. Tasks and +assignments also lack the terminal values later decision transactions require. +This child adds safe schema compatibility without making a human decision or +enabling a review effect before Review persistence exists. + +## Risk class + +L1 schema, policy, and lifecycle. + +## SLA + +P2. + +## Preconditions + +- 02A is merged and automated memory is current. +- The exact merged AUTH contributor-foundation PR/SHA and its canonical-human + database constraint names are recorded. +- The human has approved concrete positive values for + `review_preference_window_seconds` and `review_lease_duration_seconds`. + Neither value may be inferred from `sla_hours`. +- This contract receives a separate human start. + +## Proposed exact policy schema + +`ReviewPolicy` retains `id`, `project_id`, `guide_version`, +`allowed_decisions`, `minimum_finding_fields`, `sla_hours`, and `created_at`, +and adds: + +```text +review_preference_window_seconds integer not null, > 0 +review_lease_duration_seconds integer not null, > 0 +max_active_review_leases_per_reviewer integer not null, = 1 in v0.1 +self_review_allowed boolean not null, = false in v0.1 +reject_policy varchar(30) not null, = 'close_task' in v0.1 +finding_evidence_requirement varchar(30) not null, + in ('optional', 'required_for_blocking', 'required_for_all') +``` + +`finding_evidence_requirement` backfills to `optional`. Capacity, self-review, +and reject policy backfill to their single v0.1 values. Existing duration values +use only the two separately approved migration defaults. Existing +`allowed_decisions` must equal the canonical three decision values and +`minimum_finding_fields` must contain `description` and `severity`; unsafe rows +fail with remediation rather than being silently broadened. + +`requires_second_review` is retained but database-constrained to false in v0.1. +Migration fails if any existing row is true. +`RevisionPolicy.auto_reject_after_limit` is removed because D6 permits no +automatic reject; the migration records that the retired field never had an +implemented Review-producing runtime path. + +## Allowed files + +```text +backend/app/modules/projects/{models,schemas,repository,service}.py +backend/app/modules/tasks/{models,schemas,lifecycle,repository,service}.py only for Task/TaskAssignment lifecycle compatibility +backend/app/db/models.py +backend/alembic/versions/_review_policy_task_lifecycle.py +backend/tests/test_{alembic,projects,tasks}.py +docs/architecture_data_model.md +docs/architecture_lifecycle_state_machine.md +docs/operations_revision_replay.md +docs/operations_operator_workflow.md only for migration/deployment/remediation +.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/** +.agent-loop/merge-intents/WS-REV-001-02B.json +``` + +## Not allowed changes + +```text +Submission schema, attribution, predecessor, or finalization behavior +ProjectGuide activation-sequence behavior except consuming merged 02A fields +Review, ReviewLease, ReviewFinding, FinalAcceptance, or reject Review foreign key +service transition into accepted, rejected, completed, or blocked +public review or revision-obligation-close route +AUTH, ART, CON, compensation, contribution, reputation, or adjudication behavior +synthetic reject from checker, revision limit, deadline, or administrative close +``` + +## Acceptance criteria + +- Once its guide has an activation sequence, ReviewPolicy and RevisionPolicy are + update/delete protected by database guards. Policy changes require a new draft + guide version; both draft policies remain replaceable before first activation. +- `ReviewPolicy.id` is the canonical future `policy_context_ref`. Task and + Submission continue to stamp the matching locked policy version; no duplicate + review policy snapshot table is added. +- `allowed_decisions` remains exactly `accept`, `needs_revision`, and + `reject`. Capacity is one, self-review is false, and reject policy is + `close_task`. +- Review-policy service/schema validation matches the database constraints; + an upsert cannot mutate a policy whose guide was ever activated. +- Removing `auto_reject_after_limit` creates no Task, Assignment, Review, CON, + award, outbox, or audit mutation. Executable limit/deadline blocking belongs + to 09A revision preparation/submission and is not implemented in 02B. +- Task storage accepts canonical terminal statuses `accepted`, `rejected`, and + `cancelled` plus a bounded terminal reason/time shape. The only reserved + reason mapping is `accepted -> review_accepted`, + `rejected -> review_rejected`, and + `cancelled -> revision_limit_reached | revision_deadline_expired | + legacy_revision_context_unrecoverable`. All cancellation reasons remain + dormant until their separately authorized administrative commands land. +- The lifecycle module defines the status constants but exposes no transition + edge into those terminal states in this child. Review-driven edges land with + the decision/task participant; the administrative cancellation edge lands + with its reason-bound command. +- TaskAssignment storage accepts `active`, `released`, `completed`, and + `blocked`, with compatible `completed_at` and `blocked_at` timestamp shape. + No service path enters completed/blocked, and no reject Review FK or + `blocked_reason_review_id` is added before Review persistence. +- Existing task/assignment rows preserve their status. Unknown statuses or + inconsistent existing terminal timestamps fail with explicit remediation. +- No checker, limit, deadline, or migration creates a synthetic Review or human + reject outcome. + +## Verification commands + +```text +cd backend && alembic upgrade head +cd backend && pytest -q tests/test_alembic.py tests/test_projects.py tests/test_tasks.py +cd backend && ruff check app/modules/projects app/modules/tasks tests/test_alembic.py tests/test_projects.py tests/test_tasks.py +cd backend && docstr-coverage --config .docstr.yaml +python3 scripts/check_stale_workstream_wording.py +python3 scripts/check_markdown_links.py +``` + +The full isolated PostgreSQL suite must preserve the repository-wide 78 percent +floor. Every materially changed projects/tasks module must remain at or above +90 percent coverage. + +## Required reviewers + +Senior engineering, QA/test, security/auth, product/ops, architecture, +reuse/dedup, docs, and test-delta. + +## Human review focus + +Duration defaults, activated-policy immutability, removal of automatic reject, +dormant versus executable status behavior, and no premature Review FK. + +## Stop conditions + +- Stop if duration defaults are unapproved or historical policy values are + unsafe. +- Stop if the change needs Review persistence or an AUTH schema edit. +- Merge, record automated memory, and stop. Do not start 02C automatically. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02C-submission-attribution-lineage.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02C-submission-attribution-lineage.md new file mode 100644 index 000000000..bb952d854 --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02C-submission-attribution-lineage.md @@ -0,0 +1,149 @@ +# Chunk Contract: WS-REV-001-02C - Submission Attribution, Context, And Immutable Lineage + +## Parent initiative + +`WS-REV-001` - Review And Revision Lifecycle + +## Goal + +Bind every existing versioned Submission to the exact TaskAssignment and +canonical contributor that produced it, stamp the complete guide identity, and +enforce immutable immediate-predecessor lineage after finalization. + +## Why this chunk exists + +Current Submission service logic allocates sequential versions, but direct SQL +can create cross-task or skipped predecessor chains and prior attribution can be +misread after reassignment. The existing Submission must become durable review +lineage without introducing a competing SubmissionVersion table. + +## Risk class + +L1 schema, migration, identity, and lineage. + +## SLA + +P2. + +## Preconditions + +- 02B is merged and automated memory is current. +- The exact merged AUTH contributor foundation is present: both models expose + canonical `contributor_id`, retired contributor-identity storage names are + absent, and database-backed + human ActorProfile lineage is proven. +- The merged AUTH contract exposes the supported transaction-local + canonical-active-human revalidation consumed by task submission. If it does + not, 02C stops for an AUTH-owned amendment rather than querying actor/grant + tables. +- 02A Task guide stamps and activation-sequence constraints are present. +- This contract receives a separate human start. + +## Allowed files + +```text +backend/app/modules/tasks/{models,schemas,repository,service}.py +backend/app/db/models.py +backend/alembic/versions/_submission_attribution_lineage.py +backend/tests/test_{alembic,tasks}.py +docs/architecture_data_model.md +docs/architecture_lifecycle_state_machine.md +docs/operations_revision_replay.md +docs/operations_operator_workflow.md only for migration/deployment/remediation +.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/** +.agent-loop/merge-intents/WS-REV-001-02C.json +``` + +## Not allowed changes + +```text +new SubmissionVersion table or public submission route redesign +AUTH-owned contributor field rename, compatibility alias, or ActorProfile schema +ProjectGuide activation allocation or ReviewPolicy shape +review queue, lease, Review, finding, response, preparation, or FinalAcceptance +ART artifact_hash cutover or provider calls +CON, compensation, contribution, reputation, adjudication, or synthetic reject +``` + +## Acceptance criteria + +- Submission gains immutable non-null `task_assignment_id` and a composite + same-task foreign key to `(TaskAssignment.id, TaskAssignment.task_id)`. +- Submission `contributor_id` must equal the exact referenced assignment's + `contributor_id`. A database constraint trigger or equivalently reviewed + composite key enforces direct-SQL parity without duplicating AUTH ownership. +- Existing rows backfill only when exactly one TaskAssignment satisfies this + SQL-compatible predicate: same task and contributor; + `assigned_at <= Submission.submitted_at`; non-null + `accepted_at <= Submission.submitted_at`; and `released_at is null or + Submission.submitted_at <= released_at`. Boundaries are inclusive, current + assignment status is not historical evidence, and overlapping qualifying + intervals are ambiguous. Zero or multiple candidates, null acceptance, + timestamp ties that yield multiple candidates, or invalid interval ordering + fail with task/submission IDs and remediation; current/recent assignment + inference is prohibited. +- Assignment release, contributor authority loss, or reassignment never changes + a prior Submission's assignment or contributor attribution. +- Submission stamps non-null `locked_guide_id`, `locked_guide_version`, and + `locked_guide_activation_sequence` copied from the exact Task context used for + that attempt. Same-guide composite integrity rejects mixed identities. +- Existing rows backfill guide ID/sequence only from their existing locked guide + version and same-project Task context. Missing or inconsistent lineage fails + rather than choosing the current active guide. +- `supersedes_submission_id` is null only for version 1. Version N greater than + one points to version N-1 for the same task. Direct SQL rejects self-links, + cross-task predecessors, skips, branches, and duplicate successors. +- Draft/staged submission fields required by current finalization/checker flows + remain mutable only until the existing finalization boundary. After physical + `Submission.locked_at` is set (publicly serialized as `finalized_at`), + identity, task/assignment/contributor, version, + predecessor, locked context, packet, evidence, and attestation fields are + update/delete protected. Later ART-owned server-derived `artifact_hash` + publication remains an explicitly allowed set-once extension and is not + implemented here. +- Version allocation and predecessor selection lock the Task plus current chain + head so concurrent submissions cannot allocate the same version or create two + successors. +- TaskAssignment continues to store only task identity and contributor/freeze + terms; it receives no guide or revision-preparation duplicate. +- Submission creation revalidates that the canonical contributor ActorProfile + is active in the transaction through the supported AUTH-owned boundary. + Suspended/deactivated humans, services, external subjects, emails, legacy + profile IDs, and token-role values cannot substitute. +- No Review, queue entry, checker decision, contribution, or task terminal + effect is created by migration or lineage enforcement. +- Downgrade refuses after rows depend on the new assignment/guide lineage unless + the documented destructive remediation procedure is used. + +## Verification commands + +```text +cd backend && alembic upgrade head +cd backend && pytest -q tests/test_alembic.py tests/test_tasks.py +cd backend && ruff check app/modules/tasks tests/test_alembic.py tests/test_tasks.py +cd backend && docstr-coverage --config .docstr.yaml +python3 scripts/check_stale_workstream_wording.py +python3 scripts/check_markdown_links.py +``` + +The full isolated PostgreSQL suite must preserve the repository-wide 78 percent +floor. Every materially changed tasks module must remain at or above 90 percent +coverage. + +## Required reviewers + +Senior engineering, QA/test, security/auth, product/ops, architecture, +reuse/dedup, docs, and test-delta. + +## Human review focus + +Ambiguous historical attribution, human-only identity parity, finalized-row +boundary, concurrent version allocation, ART set-once compatibility, and +downgrade refusal. + +## Stop conditions + +- Stop if the AUTH foundation is incomplete or a retired contributor-identity + storage name remains. +- Stop if attribution or guide context cannot be proved for every migrated row. +- Merge, record automated memory, and stop. Do not start 03 automatically. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-09A-revision-context-resubmission.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-09A-revision-context-resubmission.md index a06a7a62e..378d58ccb 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-09A-revision-context-resubmission.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-09A-revision-context-resubmission.md @@ -159,7 +159,13 @@ production `/api/v1` review-router registration work; neither domain imports the other's repository. - Required response evidence references verified same-project/task bindings. - Checker gate does not admit a revision missing required responses/evidence. -- Revision limits/deadlines follow the approved non-synthetic behavior. +- At the exact revision-round limit or revision deadline, preparation and N+1 + submission fail with stable policy errors. Task remains `needs_revision`, + TaskAssignment remains active, and no Review, finding, terminal Task or + Assignment status, CON record, award, feature audit, or outbox record is + created. Tests cover below/at/after each boundary, retry, and transaction + rollback. The explicit reason-bound cancellation command remains owned only by + REV-11; 09A never closes the obligation or fabricates reject. - Response-evidence authorization uses `review.finding_response_evidence.ingest` mapped to `submission.create`, plus the owned active assignment, prepared revision context, and exact diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02-external-review-response.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02-external-review-response.md new file mode 100644 index 000000000..42c727b69 --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02-external-review-response.md @@ -0,0 +1,30 @@ +# External Review Response: WS-REV-001-02 + +## Reviewed head + +- PR: `#147` +- External review head: `2187a1e0e5fc3024cf1deba18f2d86a349f3f861` +- Reviewer: CodeRabbit +- Run ID: `5e37295b-e72c-48dd-ad5f-fd4da1b00534` + +## Findings + +| Thread | Disposition | Response | +|---|---|---| +| `PRRT_kwDOSwL_U86R_Gi7` | Fixed | The internal evidence now identifies `0292825a` as the planning implementation candidate, identifies `4b00cd3a` as the evidence/status head, records that all reviewer sessions reran over the complete range through `4b00cd3a`, and binds PASS only to exact reviewed SHA `4b00cd3a`. | + +## PR description warning + +CodeRabbit reported that the initial PR description did not follow the +repository trust-bundle template. The PR description was replaced with the +required chunk, intent, scope, evidence, test-delta, reviewer, external-review, +integrity, risk, follow-up, human-focus, and merge-ownership sections. + +## Verification + +- `python3 scripts/check_internal_review_evidence.py`: PASS. +- `python3 scripts/check_markdown_links.py`: PASS. +- `git diff --check`: PASS. +- CodeRabbit must rerun after this response is pushed. + +No external finding is deferred. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02-internal-review-evidence.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02-internal-review-evidence.md new file mode 100644 index 000000000..f9695749a --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02-internal-review-evidence.md @@ -0,0 +1,98 @@ +# Internal Review Evidence: WS-REV-001-02 + +## Candidate + +- Trusted base: `b2b9016d5fee33ddca40882c97620a178d8e52f0` +- Reviewed planning candidate: `0292825a52f884f42d82e1522637f2ff2bf4bb7a` +- Scope: planning, chunk contracts, test design, conformance ownership, and one + merge intent only +- Runtime status: blocked; no backend model, service, migration, persistence + test, frontend, workflow, or dependency file changed + +Open sub-agent sessions: none + +Valid findings addressed: yes + +## Reviewed revision + +Reviewed code SHA: 4b00cd3a7c0886f3fa0e6cf4b4b280aa58bc1a10 + +Reviewed at: 2026-07-18T12:19:40Z + +Reviewer run IDs: /root/rev01_senior_arch_reuse@4b00cd3a7c0886f3fa0e6cf4b4b280aa58bc1a10, WS-REV-001-02/qa-product-test-delta/rebind-4b00cd3-20260718, WS-REV-001-02/security-docs-ci/4b00cd3a/2026-07-18T12:19:40Z + +## Revision lineage + +- `0292825a52f884f42d82e1522637f2ff2bf4bb7a` is the implementation candidate + that introduced the planning split, child contracts, test design, and merge + intent. +- `4b00cd3a7c0886f3fa0e6cf4b4b280aa58bc1a10` adds only the review log, status, + internal evidence, and trust bundle for that candidate. All three reviewer + sessions reran against the complete trusted-base-to-`4b00cd3a` range. +- The PASS disposition and reviewer rows below are bound exclusively to exact + reviewed SHA `4b00cd3a7c0886f3fa0e6cf4b4b280aa58bc1a10`. Later commits change only + allowed review evidence and do not alter the reviewed planning candidate. + +## Circuit breaker + +`SPLIT REQUIRED` on the original parent contract, then `PASS` after repair. +Parent 02 is non-executable. Guide chronology, policy/dormant lifecycle, and +Submission lineage are owned separately by 02A, 02B, and 02C. + +## Reviewer results + +| Reviewer | Result | Blocking findings | Notes | +|---|---:|---|---| +| Senior engineering | PASS AFTER FIXES | None | The split, stop condition, publication order, lineage predicate, and dormant cancellation reason are explicit and bounded. | +| QA/test | PASS AFTER FIXES | None | The planning matrix covers migrations, direct SQL, races, rollback, active-human checks, attribution, and immutability without adding executable tests. | +| Security/auth | PASS AFTER FIXES | None | AUTH owns canonical-human and contributor-field foundations; REV remains blocked and adds no early authorization or schema behavior. | +| Product/ops | PASS | None | The v0.1 accept, needs-revision, and reject effects remain exact; adjudication stays dormant and out of implementation scope. | +| Architecture | PASS AFTER FIXES | None | Parent 02 is non-executable and the 02A, 02B, and 02C boundaries separate guide, policy/task, and Submission ownership. | +| CI integrity | PASS AFTER FIXES | None | Canonical exact-SHA provenance, statements, and per-track rows now satisfy the fail-closed evidence contract. | +| Docs | PASS AFTER FIXES | None | Active planning consistently records runtime blockers, current authorities, split ownership, and the explicit successor start gate. | +| Reuse/dedup | PASS | None | The contracts require reuse of existing project-guide, task, Submission, assignment, audit, and locking boundaries. | +| Test delta | PASS | None | No executable tests or gates changed, and no assertion, coverage, or workflow behavior was weakened. | + +All reviewer sessions completed. No Critical, High, or Medium finding remains. + +## Findings repaired + +- Added the dormant legacy unrecoverable cancellation reason required by REV-11. +- Defined the exact inclusive assignment-attribution temporal predicate and + ambiguous-history refusal. +- Enumerated guide-publication locking and reactivation semantics. +- Protected activated ReviewPolicy and RevisionPolicy. +- Kept terminal states dormant with no Review-driven transition or Review FK. +- Kept active-human status revalidation transaction-local and AUTH-owned. +- Moved executable D6 limit/deadline enforcement and proof to 09A. +- Distinguished physical `Submission.locked_at` from API `finalized_at` and + included finalized EvidenceItem protection. +- Reassigned conformance section 25.5 from parent 02 to 02A-02C. +- Removed retired identifier/compensation wording rejected by repo scanners. + +## Deterministic evidence + +- `git diff --check`: PASS. +- Stale authorization, Workstream, review, and artifact scanners: PASS. +- Markdown links: PASS for 14 changed Markdown files. +- Agent gates: 87 passed. +- Schema-v2 merge intent: PASS for `WS-REV-001-02`. +- Exactly one merge intent names 02A and requires a separate explicit start. + +The first system-Python pytest attempt failed before collection because a +globally installed web3 plugin imported an incompatible eth-typing symbol. The +repository interpreter with third-party plugin autoload disabled passed all 87 +tests; this was an environment isolation issue, not a product/test failure. + +## Remaining gates + +- AUTH-09D-A must merge first. +- AUTH must then merge its contributor/canonical-human foundation and provide + exact PR/SHA/migration/constraint evidence. +- 02A requires a separate explicit start after that merge. +- The human must approve exact positive preference-window and lease-duration + defaults before 02B starts. + +## Disposition + +PASS for planning publication. Runtime implementation remains prohibited. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02-pr-trust-bundle.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02-pr-trust-bundle.md new file mode 100644 index 000000000..46530a75f --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02-pr-trust-bundle.md @@ -0,0 +1,53 @@ +# PR Trust Bundle: WS-REV-001-02 + +## Intent + +Make REV-02 implementation-ready without coding against retired contributor +identity storage or combining three L1 migrations in one PR. + +## Design + +- Parent 02 becomes a non-executable split record. +- 02A owns guide activation sequence, reactivation, publication locking, and + Task guide stamps. +- 02B owns immutable ReviewPolicy/RevisionPolicy plus dormant terminal Task and + TaskAssignment schema compatibility. +- 02C owns exact Submission attribution, guide stamps, predecessor lineage, and + finalized-row protection. +- AUTH retains contributor-field and ActorProfile schema ownership. +- D6 creates no synthetic Review; blocking remains in 09A and explicit + cancellation remains in 11. + +## Scope + +Changed only REV planning, contracts, conformance/test design, review evidence, +and one schema-v2 merge intent. No runtime, migration, executable test, route, +workflow, dependency, AUTH, ART, or CON runtime file changed. + +## Evidence + +- Required internal reviewer tracks: PASS. +- Mandatory stale-contract scanners: PASS. +- Markdown links and diff integrity: PASS. +- Agent gates: 87 passed. +- Merge intent: PASS for `WS-REV-001-02 -> WS-REV-001-02A`, explicit start. + +## Risks + +- AUTH foundation timing can move the future migration head. REV reserves no + identifier. +- Historical attribution or guide context may be ambiguous. Future migrations + fail with remediation rather than guessing. +- Preference/lease defaults remain a human decision before 02B. + +## Human review focus + +- Accept the 02A/02B/02C split and dependency order. +- Confirm AUTH remains the contributor/canonical-human schema owner. +- Confirm terminal states remain dormant and no synthetic reject exists. +- Confirm the two duration defaults stay unresolved until explicitly approved. + +## Stop + +Merge planning only with explicit approval. Automated memory must stop at 02A; +do not start runtime automatically. diff --git a/.agent-loop/merge-intents/WS-REV-001-02.json b/.agent-loop/merge-intents/WS-REV-001-02.json new file mode 100644 index 000000000..586a230e2 --- /dev/null +++ b/.agent-loop/merge-intents/WS-REV-001-02.json @@ -0,0 +1,9 @@ +{ + "chunk_id": "WS-REV-001-02", + "chunk_title": "Locked Review Policy And Task Lifecycle Alignment", + "initiative_id": "WS-REV-001", + "next_chunk_id": "WS-REV-001-02A", + "next_chunk_title": "Project Guide Activation Sequence And Publication Locking", + "next_requires_explicit_start": true, + "schema_version": 2 +}