diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CHUNK_MAP.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CHUNK_MAP.md index b93430b0a..5330219b7 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CHUNK_MAP.md @@ -15,9 +15,12 @@ typed symbol/manifest, and tests. | `WS-REV-001-PLAN` | Review And Revision Lifecycle Planning | L1 | None | Merged PR #128 | | `WS-REV-001-01` | Canonical Contract Adoption And Dependency Conformance | L1 | PLAN | Merged PR #145 | | `WS-REV-001-02` | Locked Review Policy And Task Lifecycle Alignment | L1 | 01 | Merged PR #147; non-executable split record | -| `WS-REV-001-PLAN2` | REV-02A Runtime Readiness Plan Refresh | L1 | 02; planning-only human start | Active planning/specification chunk; no runtime | -| `WS-REV-001-02A` | Project Guide Activation Sequence And Publication Locking | L1 | Exact merged AUTH contributor foundation; refreshed SHA/head; separate human start | Runtime blocked | -| `WS-REV-001-02B` | Locked Review Policy And Dormant Task Lifecycle Compatibility | L1 | 02A; approved duration defaults; separate start | Proposed | +| `WS-REV-001-PLAN2` | REV-02A Runtime Readiness Plan Refresh | L1 | 02; planning-only human start | Merged PR #150 | +| `WS-REV-001-02A` | Guide Chronology And Task Locking Split | L1 | PLAN2; exact merged AUTH contributor foundation; separate human start | Active planning-only split record after preimplementation FAIL; no runtime | +| `WS-REV-001-02A1` | Project And Setup Publication Fence | L1 | 02A; current writer inventory; separate human start | Proposed executable child | +| `WS-REV-001-02A3` | Guide Activation Chronology | L1 | 02A1; current AUTH foundation/head; separate human start | Proposed executable child | +| `WS-REV-001-02A4` | Task Guide Triplet And Screening | L1 | 02A3; current migration head; separate human start | Proposed executable child | +| `WS-REV-001-02B` | Locked Review Policy And Dormant Task Lifecycle Compatibility | L1 | 02A4; approved duration defaults; separate start | Proposed | | `WS-REV-001-02C` | Submission Attribution, Context, And Immutable Lineage | L1 | 02B; merged AUTH canonical contributor constraints; separate start | Proposed | | `WS-REV-001-03` | Review Queue And Lease Persistence | L1 | 02C | Non-executable split record | | `WS-REV-001-03A` | Queue And Lease Base Persistence | L1 | 02C; merged `WS-CON-001-03B`; contract review | Proposed; no contract yet | @@ -36,7 +39,7 @@ typed symbol/manifest, and tests. | `WS-REV-001-07A` | Lease-Bounded Packet And Review Chain Context | L1 | 06C; exact ART packet-read owner chunk | Proposed; owner chunk unscheduled | | `WS-REV-001-07B` | Reviewer Finding Evidence Candidate And Finalize | L1 | 07A; exact ART review-evidence owner chunk and AUTH binding contracts | Proposed; owner chunk unscheduled | | `WS-REV-001-08` | Pure Decision, Final Acceptance, And Task-Effect Contract | L1 | 07B; typed participant contracts | Proposed; executable contract after repair, no canonical write | -| `WS-REV-001-02A2` | Prepared Superseded Guide Reactivation | L1 | 08; merged AUTH-PREP/custody; AUTH-12 contract amendment; `project.guide.activate` remains unavailable | Proposed hidden behavior; manifest gates AUTH-12 evaluator/cutover/activation | +| `WS-REV-001-02A2` | Prepared Superseded Guide Reactivation | L1 | 08 and 02A4; merged AUTH-PREP/custody; AUTH-12 contract amendment; `project.guide.activate` remains unavailable | Proposed hidden behavior; manifest gates AUTH-12 evaluator/cutover/activation | | `WS-REV-001-09A` | Revision Context Preparation And Resubmission | L1 | 08 | Non-executable split record | | `WS-REV-001-09A1` | Review-Rooted Revision Preparation Persistence | L1 | 02A2; approved human round/deadline semantics; migration/head refresh | Proposed; no contract yet | | `WS-REV-001-09A2` | Revision Preparation Participant, Resolver, And Task Context | L1 | 09A1 | Proposed; task-owned flush-only participant, no transaction composition | @@ -67,7 +70,8 @@ typed symbol/manifest, and tests. ## Same-initiative order ```text -PLAN -> 01 -> 02(parent) -> PLAN2 -> 02A -> 02B -> 02C +PLAN -> 01 -> 02(parent) -> PLAN2 -> 02A(parent split) +-> 02A1 -> 02A3 -> 02A4 -> 02B -> 02C -> 03(parent) -> 03A -> 03B -> 04(parent) -> 04A -> 04B -> 05(parent) -> 05A -> 05B @@ -97,14 +101,16 @@ owner chunk ID + merged PR + merge SHA + migration head (if schema) ``` Known merged/planned CON IDs may be named, but proposed status remains blocked. -The contributor clean cut and ART packet-read/review-evidence/digest work do not -yet have trusted-main owner chunk IDs. REV neither invents those IDs nor edits -owner plans. +The contributor clean cut is merged as +`WS-AUTH-001-CONTRIBUTOR-FOUNDATION` through PR #153 at `8d5eb15b`. ART +packet-read/review-evidence/digest work still lacks exact merged owner chunks; +REV neither invents those IDs nor edits owner plans. ## Parent split records -Existing parent contract files for 03, 04, 05, 06, 07, 09A, 11, 12, former -12A release control, and 13 are non-executable historical planning records. +After this planning-only split merges, parent 02A joins the existing parent +contract files for 03, 04, 05, 06, 07, 09A, 11, 12, former 12A release control, +and 13 as a non-executable historical planning record. They must not be used as implementation authorization. New child contracts are authored only from the then-current main when each child receives a human start. @@ -117,7 +123,6 @@ configuration, or coverage changes add CI integrity. ## Stop condition -Complete and merge only `WS-REV-001-PLAN2`, then stop. Its schema-v2 merge -intent names `WS-REV-001-02A` and requires a separate explicit start after the -exact AUTH runtime foundation merges. Do not begin 02A or any later child from -this planning PR. +Complete and merge only the planning-only parent split `WS-REV-001-02A`, then +stop. Its schema-v2 merge intent names `WS-REV-001-02A1` and requires a separate +explicit start. Do not begin 02A1, 02A3, 02A4, 02A2, or 02B from this PR. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CONFORMANCE_MATRIX.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CONFORMANCE_MATRIX.md index 92dd1eeec..9954ec7a4 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CONFORMANCE_MATRIX.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CONFORMANCE_MATRIX.md @@ -6,12 +6,12 @@ No row is complete from prose or an unmerged owner contract. | Area | Owning chunks | Required executable proof | Release proof | |---|---|---|---| | Authority | 05B, 06A-C, 07A-B, 08, 02A2, 09A2-A5, 10, 11A-D, 12P2, 12A1-A4, 13C | Exact active/project reviewer grant; canonical human actors; AUTH-first prepared mutations; opaque one-use bindings; clean denial/restaging; service identity isolation; no direct grant reads; no adjudication authority | Exact merged feature manifests -> AUTH activation -> phase-enabled HTTP denial/allow matrix | -| Guide chronology | 02A, 02A2 | Positive immutable per-project sequence; exact status/provenance; Project-first publication/screening; immutable Task triplet; hidden prepared If-Match reactivation; both-order races | Forward/backward active guide changes without reviewer-side rebase or stale retry | +| Guide chronology | 02A1, 02A3, 02A4, 02A2 | Complete Project/setup writer fence; positive immutable per-project sequence; canonical-human approval; exact status/provenance; Project-first screening; immutable Task triplet; hidden prepared If-Match reactivation; both-order races | Forward/backward active guide changes without reviewer-side rebase or stale retry | | Queue routing | 03A-B, 05A-B, 06A-C, 09B, 11A/C | Exact checker admission; one open/preferred entry; normalized packet membership; current returns lease/offer/none; duplicate/supersession races; authorized batched historical classification | New and historical eligible rows, preferred return, takeover, counts/age evidence | | Leases | 03A-B, 06A-C, 11A/C | One active lease globally; canonical reviewer; packet manifest; reviewer ContributionPolicyVersion freeze; release/decline/expiry/revocation/lazy recovery and both-order races | Claim/release/expiry/reclaim/revocation through exact admitted service identities | | Review history | 04A-B, 08, 10 | Every decision/finding/resolution immutable; exact predecessor/assignment lineage; reviewer CON operation before branch; accept-only FinalAcceptance and submitter operation; reject exact assignment; atomic rollback | Real accept/needs_revision/reject HTTP/database/audit/CON agreement and changed replay denial | | Revision paths | 02C, 09A1-A5, 09B, 10, 11B-D | Human Review revision creates one immutable non-branching preparation before readable state; checker remediation persists unique immutable `remediation_source_checker_run_id`, keeps task context, creates no Review/preparation/CON record, and is never classified as legacy | Separate checker and human drills both reach corrected N+1 without policy or lineage drift | -| Revision context | 02A-C, 09A1-A5, 09B | Review-rooted task-owned preparation; kept/forward/backward/blocked; exact head acknowledgement; one winner per head; replacement successor; no contribution-policy rebase; checker path bypasses rebase | Human context display, checker rerun, prior-reviewer preference, resolution, final decision; checker correction returns open | +| Revision context | 02A1, 02A3, 02A4, 02A2, 02B-C, 09A1-A5, 09B | Prepared `If-Match`-protected superseded-guide reactivation; Review-rooted task-owned preparation; kept/forward/backward/blocked; exact head acknowledgement; one winner per head; replacement successor; no contribution-policy rebase; checker path bypasses rebase | Human context display, checker rerun, prior-reviewer preference, resolution, final decision; checker correction returns open | | Limits/deadlines | 09A1-A4, 11B | Human-approved round/deadline semantics only; DB time and frozen episode facts; checker retries excluded; repair cannot bypass exhaustion; D6 close only | Before/equal/after, exact replay/races, checker D6 denial, no synthetic Review/CON record | | Reject/admin close | 10, 11B/D | Human reject only from Review; exact assignment blocked/task rejected. PM/Operator closes use canonical cancelled reasons and create no Review/CON | Authorized/denied/cross-project/rollback proof; no `closed` token | | Artifact evidence | 03B, 07A-B, 09A3, 11D | Active-exact-lease bytes; metadata-only history; ART candidate/finalize; immutable slot plus append-only attachment; orphan-only failed finalization; no raw store/provider path | Local/MinIO/S3 owner conformance plus outage/integrity no-adverse-outcome drill | diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DECISIONS.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DECISIONS.md index 22df469a2..c36d468fb 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DECISIONS.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DECISIONS.md @@ -130,16 +130,15 @@ They are replaced in chunk 09A with direct project/guide/policy/context integrity constraints and a Submission-to-preparation binding. The original WorkstreamTask locks and all earlier Submissions remain unchanged. -Guide ordering never compares version strings. Chunk 02A adds a per-project, +Guide ordering never compares version strings. Chunk 02A3 adds a per-project, monotonic immutable `activation_sequence`. Existing active/superseded guides are backfilled deterministically from effective time, creation time, and ID under migration validation; drafts remain null until first activation. Active or superseded state requires a non-null sequence, draft state requires null, and a sequence is allocated exactly once while locking the project. Task stamps guide -identity in 02A, Submission stamps it in 02C, and later preparation stamps it in -09A. Equal -identity/sequence keeps. Any different currently active guide identity/sequence -rebases, including an intentional backward rebase to an older activation +identity in 02A4, Submission stamps it in 02C, and later preparation stamps it +in 09A. Equal identity/sequence keeps. Any different currently active guide +identity/sequence rebases, including an intentional backward rebase to an older activation sequence. An internally inconsistent pair whose identity and activation sequence do not belong to the same guide record, or incomplete/unsafe context, blocks for manager repair. @@ -495,22 +494,24 @@ combined guide, policy/lifecycle, and Submission migration unreviewable as one chunk. Parent 02 is therefore a non-executable split record: ```text -02A guide activation sequence/publication locking +02A parent split + -> 02A1 Project/setup publication fence + -> 02A3 guide activation chronology + -> 02A4 Task guide triplet screening -> 02B immutable review/revision policy and dormant task/assignment states -> 02C Submission attribution/context/immediate-predecessor immutability ``` -Trusted main does not assign REV a migration and does not contain the contributor -foundation. AUTH-09D-A merged through PR #148 as +AUTH-09D-A merged through PR #148 as `99ae4c963e53f317175dcb308b9e47c93ccf19ed`, establishing migration `0026_actor_profile_lifecycle` and database-backed ActorProfile lifecycle -provenance without renaming either retired task field. AUTH next owns the -separately reviewed contributor-field foundation from that then-current head. -That foundation clean-cuts both retired task-subsystem contributor-identity -fields to `contributor_id`, preserves current behavior, and supplies database-backed -canonical-human ActorProfile lineage. REV records its exact merged PR/SHA and -constraint contract before generating any child migration; REV never supplies a -parallel rename, compatibility alias, or ActorProfile constraint. +provenance. `WS-AUTH-001-CONTRIBUTOR-FOUNDATION` later merged through PR #153 at +`8d5eb15b` with migration `0027_contributor_foundation`. It clean-cuts both +retired task-subsystem contributor-identity fields to `contributor_id`, preserves +current behavior, and supplies database-backed canonical-human ActorProfile +lineage. REV consumes that exact merged contract and never supplies a parallel +rename, compatibility alias, or ActorProfile constraint. Each executable REV +child allocates a migration only from its then-current explicit-start head. 02B keeps terminal Task/Assignment values dormant. It adds no transition into `accepted`, `rejected`, `completed`, or `blocked`, and no reject Review FK. @@ -546,9 +547,14 @@ bypassed through context repair. ### D24 - Guide Chronology Precedes Hidden Authorized Reactivation -02A adds activation sequence, Project-first publication/screening locking, and -immutable Task guide stamps while preserving public superseded-candidate denial. -After AUTH-PREP/custody and an AUTH-12 contract amendment, 02A2 adds hidden +Parent 02A is a planning-only split after L1 review rejected its combined +runtime boundary. 02A1 first makes the complete Project/setup writer graph share +one Project-first fence. 02A3 then adds activation sequence and canonical-human +approval provenance, freezes the complete activated guide row except exact +lifecycle transitions, and adds an explicit no-write active-repeat success while +preserving public superseded-candidate denial. 02A4 adds immutable Task guide +stamps and Project-first screening. After AUTH-PREP/custody and an +AUTH-12 contract amendment, 02A2 adds hidden bodyless `If-Match` reactivation while `project.guide.activate` remains unavailable. Its complete resource manifest gates AUTH-12 evaluator/cutover/ activation. This prevents new behavior from appearing under legacy local roles @@ -578,7 +584,7 @@ decision command. ### D27 - Oversized Parent Contracts Are Non-Executable -Parents 03, 04, 05, 06, 07, 09A, 11, 12, 12A, and 13 are split records. Only +Parents 02A, 03, 04, 05, 06, 07, 09A, 11, 12, 12A, and 13 are split records. Only the unique children in `CHUNK_MAP.md` may receive future implementation contracts. Chunk 08 is pure contracts/validation only; chunk 10 is the first canonical Review/FinalAcceptance/CON commit. Active release docs and router diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DISCOVERY.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DISCOVERY.md index 8d1a1ac21..01be77be8 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DISCOVERY.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DISCOVERY.md @@ -3,51 +3,62 @@ ## Baseline Discovery was refreshed read-only from trusted main -`99ae4c963e53f317175dcb308b9e47c93ccf19ed` after REV parent chunk 02 merged -through PR #147 and AUTH-09D-A merged through PR #148. The active planning chunk -makes no backend/runtime changes. +`44f2467cedc266d2efe261119cfff436ac6b7715` after ART admission foundation PR +#154 merged on top of REV PLAN2 PR #150, AUTH-09D-B PR #152, and the AUTH +contributor foundation PR #153. The active parent-split repair makes no +backend/runtime changes. ## Current backend - FastAPI/Python, async SQLAlchemy 2.x, Alembic, Pydantic, PostgreSQL. -- Single Alembic head: `0026_actor_profile_lifecycle`. +- Single Alembic head: `0028_artifact_admission`. - `Submission` is the existing versioned submission entity; no separate SubmissionVersion is needed. -- Both retired task-subsystem contributor-identity storage fields remain on - trusted main. REV must not build new schema against them. +- TaskAssignment and Submission now expose only `contributor_id`; each has an + ActorProfile FK and database-enforced human-kind lineage. - Existing checker routing can move a Task to `needs_revision` with `review_decision_id=None`. The regression `test_checker_caused_revision_resubmits_fixed_version_through_api` proves this supported path. - Existing project guide activation is a public bodyless route with legacy registered-actor/local-role checks, locks the candidate before Project, uses - application time, and allows only draft activation/idempotent active repeat. - Superseded-guide reactivation must not be added under that authorization. + application time, and allows only draft activation. It rejects both an + already-active repeat and a superseded candidate. 02A3 owns the explicit + additive no-write active repeat; superseded-guide reactivation must not be + added under legacy authorization. - Task screening currently does not share the Project-first publication lock. ## AUTH discovery -- Trusted catalogue: 74 PermissionIds, 65 ActionIds, 15 active, 50 planned. -- AUTH-09A/09B/09C and 09D-A are merged. PR #148 merged 09D-A as +- Trusted catalogue remains independent from this split; all REV lifecycle + actions remain unavailable. +- AUTH-09A/09B/09C, 09D-A, and 09D-B are merged. PR #148 merged 09D-A as `99ae4c963e53f317175dcb308b9e47c93ccf19ed` from reviewed head `9c5ef8a1feffd6324acfd947e67042921955320b`, establishing database-backed ActorProfile lifecycle status/provenance and migration `0026_actor_profile_lifecycle`. -- 09D-A intentionally leaves both retired task-subsystem contributor-identity - fields unchanged. The user-directed contributor/canonical-human foundation - remains separate and has no trusted-main chunk ID, PR/SHA, or migration. -- AUTH-09D-B, 09E, AUTH-PREP, REV custody, AUTH-10 through 14, and matching - feature activations remain unmerged. AUTH-13/14 contracts require later - amendment for prepared revision/replacement facts and cannot be treated as - current runtime gates. +- `WS-AUTH-001-CONTRIBUTOR-FOUNDATION` merged through PR #153 at `8d5eb15b` + from reviewed head `6a70b33f`. Migration `0027_contributor_foundation` + supplies the exact field clean cut, ActorProfile FKs, reusable human-kind + trigger function, active-human transaction revalidation, and regression + evidence required by REV. +- AUTH-09E, AUTH-PREP, REV custody, AUTH-10 through 14, and matching feature + activations remain unmerged. AUTH-13/14 contracts require later amendment for + prepared revision/replacement facts and cannot be treated as current runtime + gates. - All 24 REV lifecycle actions remain unavailable. REV never registers, provisions, evaluates, or activates them. ## ART discovery -- ART v2 LocalStorage clean cut merged through PR #141 at `a10d901` despite - stale ART owner status wording. -- S3/MinIO and ART 02B1 onward remain proposed. +- ART v2 LocalStorage clean cut merged through PR #141 at `a10d901`, S3/MinIO + preparation merged through PR #151 at `1b5422fc`, and admission/put-attempt + foundation merged through PR #154 at + `44f2467cedc266d2efe261119cfff436ac6b7715` from final head `c93f1a24`. +- PR #154 adds `0028_artifact_admission` and no Project/setup writer file, so + the 02A1 writer inventory is unchanged by that merge. Provider execution, + verification publication, recovery, routes, and product cutover remain later + ART work. - Current ART map does not schedule an exact lease-scoped review packet-read capability, review-evidence candidate/finalize capability, or server-derived stabilized Submission artifact digest. REV-03B, 07A/07B, 09A3/09A4, 10, and @@ -57,10 +68,10 @@ makes no backend/runtime changes. ## CON discovery -- CON-01 canonical specification/ADR is merged; runtime 02A onward remains +- CON-01 canonical specification/ADR is merged; CON runtime 02A onward remains proposed on trusted main. -- An unmerged CON outbox branch also claims migration `0026`. It must rebase and - renumber after the winning migration; REV consumes neither worktree. +- Any unmerged CON migration must rebase from the current head; REV consumes no + sibling worktree or proposed revision number. - Exact planned dependencies are CON-02A outbox, 02C audit participant, 03B ContributionPolicyVersion, 03C contribution/award persistence, 06 lease freeze, 07 atomic two-operation participant, and later delivery/readiness @@ -91,7 +102,11 @@ makes no backend/runtime changes. - Split unsafe oversized parents 03-07, 09A, 11, 12/12A, and 13. - Keep 08 pure; keep 10 as the first canonical decision transaction. -- Separate 02A chronology from later hidden 02A2 reactivation. 02A2 must merge +- Parent 02A failed L1 preimplementation review because it combined the entire + project/setup writer graph, guide chronology, Task stamping, two migrations, + and persistent coverage work. Split it into 02A1 fencing, 02A3 chronology, + and 02A4 Task triplet before runtime. Keep later hidden 02A2 reactivation + separate; 02A2 must merge before AUTH-12 evaluator/cutover/activation, not after an active action. - Move historical admission scan to authorized reconciliation child 11C. - Separate persisted phase execution denial from static router/AUTH membership @@ -100,8 +115,8 @@ makes no backend/runtime changes. ## Unknowns and owner actions -- AUTH must name/merge the contributor foundation and later amend AUTH-12/13/14 - contracts. +- AUTH must later amend AUTH-12/13/14 contracts; the contributor foundation + gate itself is satisfied. - ART must schedule/merge packet-read, review-evidence, digest, and projection capabilities. - CON must merge its runtime foundations from the then-current migration head. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md index f135f8cf7..e66a9cddc 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md @@ -3,21 +3,23 @@ ## Planning authority This plan is reconciled from trusted main -`99ae4c963e53f317175dcb308b9e47c93ccf19ed`, which contains merged REV parent -chunk 02 through PR #147 and merged AUTH-09D-A through PR #148. Worktree -branches, unmerged PRs, and proposed owner changes are discovery evidence only. +`44f2467cedc266d2efe261119cfff436ac6b7715`, which additionally contains ART +admission foundation PR #154 after REV PLAN2 PR #150, AUTH-09D-B PR #152, and +the AUTH contributor foundation PR #153. Worktree branches, unmerged PRs, and +proposed owner changes are discovery evidence only. They are not runtime dependencies until their exact owner chunk, PR, merge SHA, schema head, typed contract, and tests exist on trusted main. Current merged facts are: -- the single Alembic head is `0026_actor_profile_lifecycle`; -- task assignment and submission attribution still use the retired contributor- - identity storage names; +- the single Alembic head is `0028_artifact_admission`; +- TaskAssignment and Submission attribution use canonical `contributor_id` + ActorProfile foreign keys and database-enforced human lineage; - the AUTH catalogue contains 74 PermissionIds and 65 ActionIds, with 15 active and 50 planned; - all 24 REV lifecycle action dependencies remain unavailable; -- ART v2 LocalStorage is merged, but review packet reads, review-evidence +- ART admission and prepared put-attempt foundation is merged through PR #154, + but provider execution/publication, review packet reads, review-evidence candidate/finalize, and server-derived stabilized Submission artifact lineage do not have merged owner contracts; - CON has merged its canonical specification, but its outbox, audit, @@ -25,14 +27,17 @@ Current merged facts are: runtime chunks remain proposed. AUTH-09D-A is merged through PR #148 at -`99ae4c963e53f317175dcb308b9e47c93ccf19ed` (reviewed branch head -`9c5ef8a1feffd6324acfd947e67042921955320b`) and supplies database-backed -ActorProfile lifecycle status/provenance and migration `0026`. It does not rename -task/submission contributor fields. REV-02 runtime remains blocked until AUTH -publishes a real contributor-foundation chunk ID and merges it with exact -`contributor_id`, database-backed canonical-human ActorProfile constraints, -migration, regression tests, and PR/SHA evidence. REV never codes against -those retired fields or reserves a migration number while waiting. +`99ae4c963e53f317175dcb308b9e47c93ccf19ed` and supplies database-backed +ActorProfile lifecycle status/provenance in migration `0026`. The separate +`WS-AUTH-001-CONTRIBUTOR-FOUNDATION` merged through PR #153 at `8d5eb15b` from +reviewed head `6a70b33f`; migration `0027_contributor_foundation` clean-cuts +both task-subsystem owner fields, adds canonical-human constraints, and exposes +transaction-local active-human revalidation without changing authorization +availability. That external runtime gate is satisfied. Each REV migration still +allocates only the then-current next revision at its own explicit start. +ART PR #154 later advanced the sole head to `0028_artifact_admission` without +changing a Project/setup writer. It creates no REV migration conflict; every +future REV child still refreshes from then-current trusted main. ## Shipping boundary @@ -133,10 +138,14 @@ type/ID order. Task screening locks Project, Task, and the selected active guide before stamping. This prevents activation from changing the active generation between task context selection and commit. -02A preserves the existing public behavior: draft first activation and the -idempotent repeat of the sole active candidate are allowed, while a superseded -candidate remains denied. After the pure REV contracts and AUTH-PREP/custody -merge, 02A2 adds the hidden prepared-authorized reactivation branch while +02A1 first makes every current setup writer share one Project-first fence. +02A3 then adds chronology, freezes the complete activated guide row except exact +lifecycle transitions, and explicitly introduces a no-write idempotent repeat +for the sole active candidate; current runtime rejects that repeat, so this is +additive behavior rather than a claimed preservation. Draft first activation +remains allowed and a superseded candidate remains denied. 02A4 finally stamps +the exact Task triplet. After the pure REV contracts and AUTH-PREP/custody merge, +02A2 adds the hidden prepared-authorized reactivation branch while `project.guide.activate` remains unavailable. Its reviewed resource manifest then gates AUTH-12 evaluator/cutover/activation. The bodyless command requires `If-Match` for the exact current active guide ETag; missing precondition fails with 428 and a @@ -275,15 +284,17 @@ errors but do not substitute for database enforcement. ## Chunk strategy -Merged parent references remain as non-executable split records. Only 02A has a -current executable contract after this refresh. Every later child is proposed -and must receive a current-main chunk contract, risk routing, plan review, -explicit start, and exact owner evidence before code. +Merged parent references remain as non-executable split records. Parent 02A is +the active planning-only split repair after its L1 preimplementation review +failed; 02A1, 02A3, and 02A4 are the only executable children it declares. +Each child still requires its own current-main refresh, risk routing, plan +review, explicit start, and exact owner evidence before code. The detailed order is maintained in `CHUNK_MAP.md`. The important boundaries are: -- 02A establishes chronology/task locking. 02A2 lands after 08 and adds hidden +- 02A1 establishes the shared Project/setup fence; 02A3 adds guide chronology; + 02A4 adds Task triplet screening. 02A2 remains later after 08 and adds hidden prepared-authorized, stale-retry-safe reactivation before AUTH-12 activation. - 03A queue/lease base schema; 03B normalized packet manifest after ART contract. - 04A immutable review-chain persistence; 04B FinalAcceptance/task linkage and @@ -346,8 +357,7 @@ skip, or rewrite existing checker-caused revision coverage. ## Stop rule -`WS-REV-001-PLAN2` changes planning/specification only. After it merges, -automated memory names `WS-REV-001-02A` with an explicit-start gate. Runtime -starts only after the exact AUTH contributor foundation and all 02A-specific -conditions merge and the user explicitly starts 02A. No chunk starts its -successor automatically. +`WS-REV-001-02A` now changes planning/specification only because its L1 +preimplementation review rejected the oversized runtime contract. After this +split merges, automated memory names `WS-REV-001-02A1` with an explicit-start +gate. No runtime child or successor starts automatically. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/REVIEW_LOG.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/REVIEW_LOG.md index dd5ff917e..6ac25dbd1 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/REVIEW_LOG.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/REVIEW_LOG.md @@ -1,5 +1,110 @@ # Internal Plan Review Log: WS-REV-001 +## WS-REV-001-02A Post-Rebase Conformance Repair - 2026-07-19 + +CodeRabbit's review of rebased PR #156 found that the conformance matrix's +`Revision context` row omitted deferred owner 02A2 even though the Guide +chronology row, plan, decisions, chunk map, and 02A2 contract assign prepared +`If-Match`-protected superseded-guide reactivation to it. The repair adds 02A2 +and its exact reactivation proof to the Revision context row without starting +the chunk or changing runtime. Because the matrix is a candidate artifact, +fresh exact-SHA internal review and evidence rebinding are required again. + +## WS-REV-001-02A ART #154 Main Reconciliation - 2026-07-19 + +ART admission foundation PR #154 merged at trusted main +`44f2467cedc266d2efe261119cfff436ac6b7715` from final head +`c93f1a246ddbc595aa0676a63c2926bf26fc1612`. The user required a current-main +conflict check before any PR #156 merge. REV rebased all six commits without +conflict; the sole Alembic head is now `0028_artifact_admission`. + +ART #154 changes no Project/setup writer file. It therefore does not expand the +02A1 publication-fence inventory, but its migration becomes the publication +base for every later child refresh. The merge supplies generic durable-byte +admission and prepared put-attempt persistence only; it does not satisfy REV's +later packet-read, review-evidence finalize, or stabilized Submission digest +gates. The rebase rewrote every PR #156 SHA, so all earlier exact-SHA evidence +is historical. Deterministic gates, full internal review, evidence rebinding, +force-push, and current-head external checks are required before human merge. + +## WS-REV-001-02A External Review Repair - 2026-07-19 + +CodeRabbit passed PR #156 with one actionable source-manifest finding. The +manifest correctly recorded `8d5eb15b384fd75787ce98a099400a1d335d2560` +and `0027_contributor_foundation` as the parent 02A start, but a later historical +timeline sentence called the older AUTH-09D-A/`0026_actor_profile_lifecycle` +snapshot "the post-rebase review base" without limiting that statement to the +PLAN2 branch. The repair labels it as historical PLAN2 evidence and restates +the full 02A trusted-main SHA, `0027` head, and then-current-head allocation rule +for every executable child. No runtime, migration, child start, or owner file +changes. + +Because `SOURCE_MANIFEST.md` is a planning-candidate file, the earlier exact-SHA +review is historical after this repair. Deterministic gates and all required +internal reviewer tracks must pass on the repaired committed candidate before +the internal evidence is rebound and PR #156 is republished. + +## WS-REV-001-02A L1 Preimplementation Review Failed And Split - 2026-07-19 + +The user explicitly started parent 02A from trusted main +`8d5eb15b384fd75787ce98a099400a1d335d2560`. The AUTH runtime dependency is +now satisfied by `WS-AUTH-001-CONTRIBUTOR-FOUNDATION`, PR #153, migration +`0027_contributor_foundation`, and its successful internal/GitHub proof. + +No runtime file changed before plan review. Senior/architecture/reuse returned +FAIL because the contract combined the complete Project/setup writer fence, +guide chronology/canonical approval, Task triplet screening, two migrations, +and persistent coverage work. Security/CI returned PASS WITH CONDITIONS and +confirmed underspecified canonical-human behavior, migration refusal/downgrade, +active-repeat semantics, actor lifecycle races, and coverage commands. QA/ +product mapped every direct/indirect setup writer and the exact screening race. + +The repair converts parent 02A to a planning-only split record: + +```text +02A -> 02A1 Project And Setup Publication Fence + -> 02A3 Guide Activation Chronology + -> 02A4 Task Guide Triplet And Screening +``` + +The already planned later 02A2 prepared reactivation remains after chunk 08. +Each executable child requires its own current-main refresh, plan review, human +start, implementation PR, evidence, and reviewer fanout. The parent merge +intent names only 02A1 and requires explicit start. + +### Split Repair Review + +The first split review failed closed on incomplete direct-SQL immutability, +contradictory current-runtime/AUTH wording, a future-head hard-code, undefined +writer race groups, setup-run Project discovery, conditional coverage wording, +and ambiguous AUTH-versus-Projects identity errors. The repaired contracts: + +- freeze the complete activated ProjectGuide row except exact lifecycle fields + and reserve the narrow future reactivation guard amendment to 02A2; +- define exact chronology/triplet database objects, atomic migration refusal, + protected-history downgrade refusal, and then-current-head allocation; +- map all 18 current setup writers to both-order PostgreSQL race proof plus an + exhaustive shared-fence structural test; +- use an authority-free setup-run Project projection before the Project lock and + post-lock project/guide revalidation; +- preserve AUTH-owned pre-service errors while assigning Projects 403/503 only + to transaction-local revalidation after a valid ActorContext; and +- require global 78 percent, changed-subsystem 90 percent, docstring, stale, + link, loop-memory, evidence, merge-intent, agent-gate, and diff-integrity proof. + +Repair-cycle reviewer results: + +| Tracks | Agent | Result | +|---|---|---| +| Senior engineering, architecture, reuse/dedup, circuit breaker | `/root/rev01_senior_arch_reuse` | PASS; planning-only size exception justified | +| QA/test, product/ops, test delta | `/root/rev01_qa_product_test` | PASS | +| Security/auth, docs, CI integrity | `/root/rev01_security_docs_ci` | PASS | + +Working-tree deterministic proof passed four stale scanners, Markdown links for +18 changed files, loop-memory state, diff/scope integrity, the 90.3 percent +docstring gate, and all 88 agent-gate tests. Exact-SHA review, internal-evidence +validation, and merge-intent validation remain post-commit gates. + ## CON Reconciliation Addendum - 2026-07-15 REV's joint integration evidence was refreshed against CON planning commit diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/RISKS.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/RISKS.md index cb4fc9dba..f5f483347 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/RISKS.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/RISKS.md @@ -51,7 +51,7 @@ | R47 | Future adjudication concerns leak policy, states, actions, or readiness dependencies into v0.1 | High | Keep only dormant role/interface compatibility wording; add no adjudication behavior or dependency, and prove the shipping path is Review -> FinalAcceptance -> ContributionRecord. | | R48 | A prepared authority handle is replayed or substituted across sessions, actions, actors, or requests | Critical | REV recomposes final facts, then AUTH validates the opaque handle's exact bindings/current authority, consumes once, evaluates once, and stages evidence; prove rejected pre-consumption substitution preserves the legitimate handle for one later exact use, while stale/already-consumed and concurrent duplicate attempts remain invalid and stage no new state; separately prove evaluated denial rollback, clean AUTH evidence restaging, and restaging-failure atomicity. | | R49 | Parallel AUTH and REV chunks both rename contributor fields or own the same migration | Critical | REV-02 waits for a separately reviewed and merged AUTH-owned schema-only contributor-field foundation; amended full AUTH-13/14 product cutovers remain downstream of REV-09A; allocate REV migrations only from then-current main and prohibit parallel schema edits. | -| R50 | Parent REV-02 combines too many L1 database boundaries for reliable review | Critical | Parent 02 is non-executable; 02A owns guide chronology, 02B policy/dormant lifecycle, and 02C Submission lineage. Each child has one migration, separate review, merge memory, and explicit start. | +| R50 | Parent REV-02 or its original 02A child combines too many L1 database boundaries for reliable review | Critical | Parent 02 remains non-executable. Parent 02A is also split: 02A1 owns the Project/setup fence, 02A3 guide chronology, and 02A4 Task triplet screening; 02B and 02C retain their separate boundaries. Each executable child has separate review, merge memory, and explicit start. | | R51 | Review preference or lease duration is invented from unrelated SLA data | High | Require two explicit positive human-approved defaults before 02B; never infer either from `sla_hours`, current timestamps, or archival examples. | | R52 | Dormant terminal schema accidentally enables a human outcome without Review | Critical | 02B defines storage/constants only, adds no terminal transition edges or reject Review FK, and proves checker/limit/deadline paths create no terminal Task/Assignment or downstream effect. | | R53 | Finalized Submission immutability blocks later ART-owned verified digest publication | High | 02C defines the finalization guard with an explicit future set-once `artifact_hash` exception owned by the approved ART/task amendment; it never permits overwrite or caller digest promotion. | @@ -61,4 +61,4 @@ | R57 | Persisted release phase is mistaken for router/action/service deactivation | Critical | Keep static routing and AUTH membership owner-controlled; deny execution through mandatory phase fences, separate read/mutation classes and scheduler runbooks, and prove crash-resumable forward transitions. | | R58 | Checker completion is allowed during cutover but checker needs-revision routing is phase-denied | Critical | Classify checker needs-revision routing with checker completion through `revision_cutover_fenced`; deny both from admission fencing, and test atomic rollback in every phase. | | R59 | AUTH/ART/CON prose placeholders create circular or fictional dependencies | Critical | Require exact owner chunk ID, merged PR/SHA, migration head, typed symbol/manifest, and tests; distinguish contract amendment from later runtime activation/cutover. | -| R60 | Oversized parent contract hides multiple L1 migrations, commands, services, and release boundaries | High | Treat the parent as non-executable and implement only the reviewed unique child sequence in CHUNK_MAP. | +| R60 | Oversized parent contract hides multiple L1 migrations, commands, services, and release boundaries | High | L1 preimplementation review is a hard gate. Treat rejected parent 02A and the other declared parents as non-executable, then implement only the reviewed unique child sequence in CHUNK_MAP. | diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/SOURCE_MANIFEST.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/SOURCE_MANIFEST.md index 9b794ed8c..b6495a1f8 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/SOURCE_MANIFEST.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/SOURCE_MANIFEST.md @@ -168,6 +168,16 @@ review-evidence candidate/finalize, projection, and live-proof contracts, including a separately approved `WS-ART-001-REV-EVIDENCE` owner chunk, remain dependency gates. +ART admission foundation PR #154 later merged at trusted main +`44f2467cedc266d2efe261119cfff436ac6b7715` from final branch head +`c93f1a246ddbc595aa0676a63c2926bf26fc1612`, with migration +`0028_artifact_admission`. It adds the durable-byte admission ledger and one +prepared `ArtifactPutAttempt` before provider I/O, while keeping provider +execution, verification publication, recovery, routes, and product cutover +inactive. Its merge changes no Project/setup writer file; it therefore advances +the publication migration base without expanding 02A1's writer inventory or +satisfying REV's later packet-read, evidence-finalize, or digest gates. + The merged ART plan also leaves the narrow active-lease packet-read port and server-derived `Submission.artifact_hash` field unassigned to an approved chunk. REV-07/10 require exact merged ART/task-owner amendments for those capabilities; @@ -222,14 +232,20 @@ AUTH-09D-A merged through PR #148 at trusted main `0026_actor_profile_lifecycle`, ActorProfile lifecycle fields/constraints, direct-SQL history guards, service behavior, and tests are merged authority. -The following are explicitly unmerged discovery evidence and not authority: - -- the human-directed but unnamed AUTH contributor/canonical-human foundation; -- any unmerged CON outbox work that still claims the now-consumed `0026` number. - -Trusted main has the single head `0026_actor_profile_lifecycle`, retains both -retired task contributor storage names, and contains no merged contributor -foundation. +PLAN2 later merged through PR #150. AUTH-09D-B merged through PR #152, then +`WS-AUTH-001-CONTRIBUTOR-FOUNDATION` merged through PR #153 at trusted main +`8d5eb15b384fd75787ce98a099400a1d335d2560` from reviewed PR head +`6a70b33fee0c63da8893fca35da967d59d3d410a`. Its final reviewed code candidate +is `0ca5a6326a893e6671848dacde484b7c784b7bd0`. Migration +`0027_contributor_foundation`, the two canonical `contributor_id` fields, +ActorProfile FKs, reusable `public.require_human_actor_profile_reference()`, +active-human transaction revalidation, and successful Backend/Agent +Gates/CodeRabbit proof are merged authority for the 02A split children. + +Any unmerged CON outbox work or later sibling migration remains discovery only +and must rebase from the then-current head. Trusted main at the parent 02A split +start has the single head `0027_contributor_foundation`; no child reserves a +later revision before its own explicit start refresh. Current Submission storage also has no immutable causal field for the exact needs-revision CheckerRun that admits a corrected checker-remediation N+1. 02C owns the planned server-derived `remediation_source_checker_run_id`, exact @@ -251,7 +267,12 @@ After the initial exact-SHA review, the branch pulled merged CON PR #142 at archive-integrity proofs remain fixed. The branch then pulled merged AUTH-09B PR #143 at `053242b90d927ace3fab92eeca72da27a61cecec` and merged CON-01 PR #144 at `e118e33afcd89b8ee78ecfc8f0e0d585ae0ee4b9`; final PR scope and -exact-SHA review use the newest merged-main boundary. The branch then rebased -cleanly onto merged AUTH-09D-A PR #148 at -`99ae4c963e53f317175dcb308b9e47c93ccf19ed`; the post-rebase review base is -that trusted commit. +exact-SHA review use the newest merged-main boundary. The PLAN2 branch then +rebased cleanly onto merged AUTH-09D-A PR #148 at +`99ae4c963e53f317175dcb308b9e47c93ccf19ed`; that historical PLAN2 post-rebase +review base had the single head `0026_actor_profile_lifecycle`. Parent 02A later +started from trusted main +`8d5eb15b384fd75787ce98a099400a1d335d2560`, after the contributor foundation +merged with the single head `0027_contributor_foundation`. Every 02A executable +child must allocate from the then-current trusted-main head at its own explicit +start, never from the historical PLAN2 base. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md index 31657818e..17dcb9771 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md @@ -2,42 +2,49 @@ ## Current status -Trusted main is `99ae4c963e53f317175dcb308b9e47c93ccf19ed`, which includes REV -parent chunk 02 through PR #147 and AUTH-09D-A through PR #148. Parent 02 is a -merged non-executable split record. `WS-REV-001-PLAN2` is the active planning/ -specification-only refresh. No backend runtime, migration, model, repository, -service, route, or persistence test is authorized in this chunk. - -The user previously started 02A preparation, then accepted AUTH's runtime block -and explicitly authorized continued planning/read-only work. After this refresh, -02A requires a renewed explicit start because its exact runtime dependencies are -not all merged. +Trusted main is `44f2467cedc266d2efe261119cfff436ac6b7715`, which additionally +includes ART admission foundation PR #154 after REV PLAN2 PR #150, AUTH-09D-B +PR #152, and `WS-AUTH-001-CONTRIBUTOR-FOUNDATION` PR #153. The user explicitly +started parent 02A on 2026-07-19. L1 preimplementation review returned FAIL +before runtime edits because the contract combined three separately reviewable +database/concurrency boundaries. Parent 02A is therefore the active planning- +only split repair; no backend, migration, workflow, route, or test edit is +authorized in this PR. ## Trusted dependency truth -- Single Alembic head: `0026_actor_profile_lifecycle`. -- Both retired task-subsystem contributor-identity fields remain on trusted main. -- AUTH catalogue: 74 PermissionIds, 65 ActionIds, 15 active, 50 planned. +- Single Alembic head: `0028_artifact_admission`. +- TaskAssignment and Submission expose canonical `contributor_id` with + ActorProfile foreign keys and human-kind database guards. - All 24 REV lifecycle action dependencies remain unavailable. - AUTH-09D-A merged through PR #148 at `99ae4c963e53f317175dcb308b9e47c93ccf19ed` with reviewed head `9c5ef8a1feffd6324acfd947e67042921955320b`. Its ActorProfile lifecycle - status/provenance and direct-SQL guards are trusted dependencies. The separate - human-approved contributor clean cut still has no trusted-main chunk - ID/PR/SHA/migration, and both retired task fields remain. -- ART v2 LocalStorage merged through PR #141 at `a10d901`, but ART has no - scheduled review packet-read, review-evidence candidate/finalize, or - server-derived Submission artifact-digest owner chunk. + status/provenance and direct-SQL guards are trusted dependencies. +- The contributor foundation merged through PR #153 at `8d5eb15b` from reviewed + head `6a70b33f`, with migration `0027_contributor_foundation`, final reviewed + code candidate `0ca5a632`, and successful Backend, Agent Gates, and CodeRabbit + checks. Its field clean cut, human lineage, and active-human transaction + revalidation satisfy the former external 02A gate. +- ART admission/put-attempt foundation merged through PR #154 at `44f2467c` + from final head `c93f1a24`, advancing the sole migration head to + `0028_artifact_admission`. It changes no Project/setup writer and does not + supply review packet-read, review-evidence candidate/finalize, or + server-derived Submission artifact-digest capability. - CON-01 merged its specification. CON runtime chunks 02A onward remain - proposed on trusted main. Any unmerged CON work that previously claimed - `0026` must rebase from AUTH-09D-A's merged head before it is consumable. + proposed on trusted main. Any unmerged CON migration must rebase from the + then-current head before it is consumable. - Sibling AUTH/ART/CON status files contain stale post-merge wording. REV records actual merge facts but does not edit owner initiative memory. ## Plan-refresh results -- 02A now owns only activation sequence, Project-first publication/screening, - immutable Task guide triplet, and unchanged superseded-candidate denial. +- Parent 02A is a non-runtime split record. 02A1 owns the complete shared + Project/setup writer fence, 02A3 owns guide chronology/canonical approval, and + 02A4 owns Task triplet screening. +- Current runtime rejects an already-active activation candidate. 02A3 names + no-write active-repeat success as explicit additive behavior rather than + incorrectly describing it as existing behavior. - Proposed 02A2 owns prepared-authorized, `If-Match` protected superseded-guide reactivation after AUTH-PREP and AUTH-12. This preserves backward rebase without broadening the legacy public route. @@ -75,9 +82,8 @@ not all merged. ## Human-owned gates -- A real merged AUTH contributor/canonical-human foundation with exact ID, - PR/SHA, migration, constraints, and tests before 02A. -- Separate 02A start after this refresh merges. +- Separate 02A1, 02A3, and 02A4 starts after each predecessor merges. The AUTH + contributor foundation gate is satisfied. - Exact positive `review_preference_window_seconds` and `review_lease_duration_seconds` before 02B. Neither derives from `sla_hours`. - Exact human Review revision-round counting, deadline anchor, and boundary @@ -90,5 +96,6 @@ not all merged. ## Stop condition -Publish only `WS-REV-001-PLAN2`, let automated memory name 02A with an -explicit-start gate, and stop. Do not implement 02A, 02A2, or 02B from this PR. +Publish only the parent 02A planning split, let automated memory name 02A1 with +an explicit-start gate, and stop. Do not implement or start 02A1, 02A3, 02A4, +02A2, or 02B from this PR. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/TEST_DESIGN_WS-REV-001-02.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/TEST_DESIGN_WS-REV-001-02.md index fe3313b73..397398f0c 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/TEST_DESIGN_WS-REV-001-02.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/TEST_DESIGN_WS-REV-001-02.md @@ -19,36 +19,76 @@ Every runtime child records and asserts: Missing evidence stops before REV generates a migration. -## 02A chronology and Task locking +## 02A1 Project/setup publication fence + +- Exhaustive writer inventory proves every Project Guide/setup mutation locks + Project first, then the declared row types and same-type IDs in stable order. +- Locked reads refresh ORM identity-map state and revalidate draft ownership + before mutation. +- Agent/provider work happens outside locks; persistence rolls back the read + phase and reacquires the full fence. +- Post-commit enqueue bookkeeping uses the fenced setup-run participant rather + than direct mutation; the setup job remains a service-only caller. +- The exact 18-row writer inventory in the 02A1 contract is the race matrix; + every row races with activation in both Project-lock acquisition orders and + observes a PostgreSQL wait. A separate structural test fails if any current or + newly discovered writer bypasses the shared fence. +- Setup-run ID-only commands use an authority-free project projection, lock + Project first, refresh the graph, and revalidate project/guide ownership. +- Activation-first, writer-first, insert-only create-guide, competing activation, + readiness-denial, post-commit delegation, and remote-output assertions match + the exact matrix contract; no partial or stale graph commits. + +## 02A3 guide activation chronology ### Migration/data - Number active/superseded guides independently per project by effective time, created time, then ID; drafts remain null. -- Fail on missing activation provenance, unknown/inconsistent status, duplicate - ordering/sequence facts, or ambiguous Task guide context with row-specific - remediation and no partial DDL/data effects. -- Backfill non-draft Task only from an exact same-project guide/version/sequence. +- Fail on malformed/missing/non-human approver, invalid status/provenance/time + order, more than one active guide, or identical effective/created ordering + facts within a Project, with bounded redacted diagnostics and no partial DDL. - Prove prior-head preflight, one head, upgrade, safe downgrade/re-upgrade, - protected-row downgrade refusal, and failure rollback on real PostgreSQL. - -### Direct SQL - -- Reject nonpositive/duplicate/mutable sequence. -- Enforce exact draft/active/superseded provenance shapes and canonical-human - approver. -- Reject partial, crossed, cross-project, or valid-to-valid changed Task guide - triplet. - -### Concurrency/service - -- Project-first publication and task screening run against activation, setup - mutation, and setup-job completion in both commit orders. -- First activations serialize and allocate distinct monotonic sequences. -- Draft activation succeeds; sole-active repeat is no-write idempotent; - superseded candidate remains denied in 02A. -- Screening audit contains complete triplet; audit fault rolls back stamp. -- No external I/O occurs while locks are held; timestamp is post-lock DB time. + dependency/protected-row downgrade refusal, and failure rollback on real + PostgreSQL without dropping AUTH's shared human-reference function. + +### Direct SQL and service + +- Reject nonpositive/duplicate/mutable sequence and invalid + draft/active/superseded provenance shapes. +- Activation changes only lifecycle allocation/update-time fields. Afterward, + reject every activated-row change including ID, project/version, content, + summary, creator/creation time, sequence, approver, and effective facts. + Permit only status/superseded/update-time changes during the + database-timestamped active-to-superseded transition, then reject every change + or clear. +- Reject service approver and prove active-human profile/link revalidation in + both lifecycle race orders. Suspension, terminal deactivation, and link + revocation each prove both orders plus exact Projects-owned 403/503 envelopes. +- Public pre-service service-token, already suspended/deactivated, already + revoked, identity-verifier unavailable, and actor-registry unavailable paths + retain their exact AUTH-owned envelopes and never enter ProjectService. +- Transaction-race tests first resolve a valid ActorContext, then force the + lifecycle transition before or after the ProjectService actor lock. Only the + post-resolution revalidation failure uses the Projects envelope. Direct + non-human service misuse is tested separately from the public route. +- First activations serialize and allocate distinct monotonic sequences using + one post-lock database timestamp. +- Draft activation succeeds; sole-active repeat is explicit additive no-write + idempotency; superseded candidate remains denied. + +## 02A4 Task guide triplet and screening + +- Backfill non-draft Task only from an exact same-Project guide/version with + valid chronology; reject polluted drafts and zero/multiple legacy matches. +- Direct SQL rejects partial, crossed, cross-Project, nonpositive, changed, or + cleared Task triplets through the exact composite FK/check/trigger. +- Screening uses unlocked ID/project projection, then Project -> refreshed Task + -> refreshed active Guide locks before graph validation and stamping. +- Screening audit contains the complete triplet; audit fault rolls back status, + guide, policy, and payment stamps. +- Activation/screening races observe PostgreSQL lock waits in both commit orders + and never commit a mixed triplet. ## 02A2 hidden reactivation diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02-review-policy-task-alignment.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02-review-policy-task-alignment.md index fd4c0c5cb..8f0dafaa5 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02-review-policy-task-alignment.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02-review-policy-task-alignment.md @@ -6,9 +6,10 @@ Split before runtime implementation after required L1 plan review. No backend, migration, or persistence-test work may execute against this parent contract. The user explicitly started parent `WS-REV-001-02` on 2026-07-18, then confirmed -that REV may continue planning and test design only. Runtime remains blocked -until AUTH-09D-A merges and AUTH subsequently merges its separately reviewed -contributor-field foundation from the then-current migration head. +that REV could continue planning and test design only while AUTH-09D-A and the +separate contributor-field foundation remained unmerged. Both dependencies are +now merged; parent 02 remains non-executable because its child boundaries and +separate human-start gates still control runtime work. ## Parent initiative @@ -38,26 +39,28 @@ combined L1 change was not credibly PR-sized. | Chunk | Title | Boundary | |---|---|---| -| `WS-REV-001-02A` | Project Guide Activation Sequence And Publication Locking | Allocate immutable per-project activation chronology, stamp Task guide identity, and publish one internally consistent guide generation. | +| `WS-REV-001-02A` | Guide Chronology And Task Locking Split | Non-executable planning parent for 02A1 Project/setup fencing, 02A3 guide chronology, and 02A4 Task triplet screening. | | `WS-REV-001-02B` | Locked Review Policy And Dormant Task Lifecycle Compatibility | Make guide-bound review/revision policy exact and immutable and add non-executable terminal task/assignment schema compatibility without fabricating Review. | | `WS-REV-001-02C` | Submission Attribution, Context, And Immutable Lineage | Bind each existing Submission to its exact assignment and canonical contributor, enforce same-task immediate-predecessor lineage, stamp guide identity, and protect finalized rows. | ## Dependency order ```text -AUTH-09D-A merged --> AUTH-owned contributor-field foundation reviewed and merged --> WS-REV-001-02A +AUTH-09D-A and AUTH contributor foundation merged +-> WS-REV-001-02A planning split +-> WS-REV-001-02A1 +-> WS-REV-001-02A3 +-> WS-REV-001-02A4 -> human approval of the two duration defaults recorded in 02B -> WS-REV-001-02B -> WS-REV-001-02C -> WS-REV-001-03 ``` -AUTH currently owns migration `0026` for profile lifecycle. REV assigns no -migration identifier in planning. Every child refreshes from trusted `main` and -uses the then-current single Alembic head only after the contributor foundation -has merged. +AUTH migration `0026` owns profile lifecycle and merged migration `0027` owns +the contributor foundation. REV assigns no later migration identifier in parent +planning. Every executable child refreshes from trusted `main` and allocates +only the then-current single Alembic successor at its own start. ## Preserved boundaries diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A-guide-activation-sequence.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A-guide-activation-sequence.md index 7b27c8247..d02d5d8b8 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A-guide-activation-sequence.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A-guide-activation-sequence.md @@ -1,149 +1,130 @@ -# Chunk Contract: WS-REV-001-02A - Project Guide Activation Sequence And Publication Locking +# Chunk Contract: WS-REV-001-02A - Guide Chronology And Task Locking Split ## Goal -Add immutable per-project guide chronology, make publication and task screening -share Project-first locking, and stamp one immutable guide triplet on each Task. -Do not add public superseded-guide reactivation under legacy authorization. +Convert the oversized guide chronology, publication fencing, and Task guide +stamping proposal into separately executable L1 children. This parent records +the current-main dependency proof and the reviewed split only; it makes no +runtime, schema, migration, workflow, API, or product-document change. + +## Why This Split Exists + +Preimplementation review on trusted main +`8d5eb15b384fd75787ce98a099400a1d335d2560` found that the former contract +combined a repository-wide project/setup writer fence, canonical-human guide +activation chronology, two database migrations, Task screening composition, +and persistent coverage changes. Those boundaries cannot receive adequate +schema, concurrency, authorization, and rollback proof in one reviewable PR. + +## Risk Class + +L1 planning/specification for later schema, migration, concurrency, +authorization-lineage, and CI work. + +## Current-Main Dependency Proof + +- AUTH-09D-A merged through PR #148 at + `99ae4c963e53f317175dcb308b9e47c93ccf19ed` with migration + `0026_actor_profile_lifecycle`. +- `WS-AUTH-001-CONTRIBUTOR-FOUNDATION` merged through PR #153 at + `8d5eb15b384fd75787ce98a099400a1d335d2560` from reviewed PR head + `6a70b33fee0c63da8893fca35da967d59d3d410a`. Its final reviewed code + candidate is `0ca5a6326a893e6671848dacde484b7c784b7bd0`. +- PR #153 clean-cuts TaskAssignment and Submission ownership to + `contributor_id`, adds ActorProfile foreign keys and reusable + `public.require_human_actor_profile_reference()`, and proves active-human + transaction revalidation without changing authorization availability. +- PR #153 Backend, Agent Gates, and CodeRabbit checks passed. Its internal + evidence records real-PostgreSQL migration, direct-SQL, lifecycle race, API, + rollback, and coverage proof. +- The sole Alembic head on this start base is + `0027_contributor_foundation`. No child reserves a later revision before its + own current-main start refresh. + +## Publication Rebase Proof + +Before merge, this planning branch rebased without conflict onto ART PR #154 +merge `44f2467cedc266d2efe261119cfff436ac6b7715`. The sole publication-base head +is now `0028_artifact_admission`. ART #154 changes no Project/setup writer file, +so the planned 02A1 inventory remains complete for this publication snapshot. +This does not pre-authorize a child: 02A1 and every migration-owning successor +must refresh the then-current writer inventory and Alembic head at its own +explicit start. + +## Child Sequence -## Risk class - -L1 schema, migration, authorization preservation, and concurrency. - -## Preconditions +```text +WS-REV-001-02A +-> WS-REV-001-02A1 Project And Setup Publication Fence +-> WS-REV-001-02A3 Guide Activation Chronology +-> WS-REV-001-02A4 Task Guide Triplet And Screening +``` -- AUTH-09D-A is merged through PR #148 at - `99ae4c963e53f317175dcb308b9e47c93ccf19ed`, with migration - `0026_actor_profile_lifecycle` and database-backed ActorProfile lifecycle - evidence. -- The separate AUTH-owned contributor/canonical-human foundation has a real - trusted-main chunk ID and is merged with exact PR/SHA, migration, constraints, - and regression evidence. An unmerged branch, worktree, proposed migration - number, or prose handoff does not satisfy this remaining gate. -- Current-main refresh records the single Alembic head. REV allocates only the - then-current next migration and does not reserve a number in planning. -- The user separately starts this child after `WS-REV-001-PLAN2` merges. +`WS-REV-001-02A2` remains the separately planned post-08 hidden prepared +superseded-guide reactivation chunk. This split does not renumber, start, or +change that later boundary. -## Allowed files +## Allowed Files ```text -backend/app/modules/projects/{models,schemas,repository,service,router}.py -backend/app/workers/project_setup.py only if a direct setup writer must adopt the Project-first fence -backend/app/modules/tasks/{models,schemas,repository,service}.py only for Task guide stamps -backend/app/db/models.py -backend/alembic/versions/_guide_activation_sequence.py -backend/tests/test_{alembic,projects,tasks}.py -.github/workflows/backend.yml only to persist focused 90 percent coverage gates for changed project/task/setup-job modules -docs/architecture_data_model.md -docs/architecture_lifecycle_state_machine.md -docs/spec_chunk_3_project_guide_foundation.md -docs/operations_operator_workflow.md .agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/** .agent-loop/merge-intents/WS-REV-001-02A.json ``` -## Not allowed +## Not Allowed ```text -public or hidden superseded-guide reactivation behavior -Submission attribution, lineage, or immutability -ReviewPolicy or RevisionPolicy changes -Task or TaskAssignment lifecycle state changes -AUTH-owned contributor/ActorProfile schema or authorization implementation -review queue, lease, Review, finding, FinalAcceptance, ART, CON, or adjudication behavior -weakening or removal of any CI, coverage, lint, type, migration, or test gate +backend/** +.github/** +docs/reference_specs/** +active product documentation outside the REV initiative +AUTH, ART, or CON owner initiative artifacts +runtime, schema, migration, test, route, action, permission, or availability changes ``` -## Acceptance criteria - -- `ProjectGuide.activation_sequence` is a nullable positive bigint allocated - exactly once on first activation. `(project_id, activation_sequence)` is - unique and a database guard rejects mutation or clearing. -- The exact status domain is `draft`, `active`, and `superseded`. Draft requires - null sequence/approver/effective/superseded times; active requires positive - sequence, canonical-human approver, effective time, and null superseded time; - superseded requires all activation provenance plus superseded time. Unknown or - inconsistent shapes fail migration and direct SQL. -- Existing active/superseded guides are numbered per project by `effective_at`, - `created_at`, then `id`. Missing provenance, duplicate ordering facts, invalid - status, or conflicting history fails with row-specific remediation. Drafts - remain null. -- Publication locks Project first, then candidate/current ProjectGuide rows, - GuideSourceSnapshot, GuideSufficiencyReport, ProjectSetupRun, - SubmissionArtifactPolicy, EffectiveProjectSubmissionArtifactPolicy, - PreSubmitCheckerPolicy, PostSubmitCheckerPolicy, ReviewPolicy, - RevisionPolicy, and the exact current `payment_policies` table row if it still - exists. Same-type rows lock by ascending ID. If CON removes it first, the - refresh removes that lock rather than adding an alias. -- Every service or setup-job mutation of a guide, source snapshot, sufficiency - report, setup run, or listed policy row first locks the same Project, then its - target rows in the publication type/ID order, and revalidates that the guide is - still draft before writing. Project-setup job entry points call those fenced - service methods and perform no direct database mutation. This shared prefix is required - for the claimed activation/setup/screening race safety. -- First activation reads database time after locks, allocates - `max(activation_sequence)+1`, and records the canonical approver/effective - time. Concurrent first activations serialize and cannot duplicate or invert - allocation. Publication performs no external I/O under locks. -- The existing public route continues to allow draft first activation and the - no-write idempotent repeat of the sole active candidate. A superseded - candidate remains denied. This chunk does not broaden legacy local role - authorization or expose backward reactivation. -- `WorkstreamTask` stamps `locked_guide_id`, `locked_guide_version`, and - `locked_guide_activation_sequence` as one triplet when leaving draft. Draft - tasks keep all three null; non-draft tasks require all three and one exact - same-project guide. A database guard rejects every valid-to-valid change or - clearing after allocation. -- Task screening locks Project first, then Task and the selected active guide - before context validation/stamping. Activation, setup mutation, setup-worker - completion, and screening races run with independent sessions in both commit - orders and cannot produce a mixed or no-longer-active generation stamp. -- Existing non-draft Task backfill uses only an exact same-project locked guide - version with a valid sequence. Missing/ambiguous context fails rather than - selecting the current guide. -- Screening audit includes the complete guide triplet. Audit failure rolls back - Task stamping. One post-lock database timestamp controls each mutation. -- Downgrade refuses after protected guide sequences or Task stamps exist unless - the documented destructive remediation is performed. -- Backend CI persistently executes the focused 90 percent coverage checks for - every materially changed project/task/setup-job module; the proof is not only - a one-time local command. Existing global 78 percent and all other gates remain - unchanged or stronger. +## Acceptance Criteria + +- Current-main AUTH dependency evidence and sole migration head are exact. +- The parent is marked non-executable and the three children have complete + allowed files, prohibited changes, database/locking contracts, acceptance + criteria, verification, required reviewers, and stop conditions. +- Project/setup fencing precedes chronology so public activation cannot race an + unfenced setup writer. +- Chronology precedes Task triplet backfill so every non-draft Task can resolve + one exact guide activation sequence. +- Existing `WS-REV-001-02A2` reactivation remains deferred after chunk 08 and + does not become part of these children. +- Merge intent names only `WS-REV-001-02A1`, requires a separate human start, + and starts no runtime automatically. ## Verification -```text -cd backend && alembic heads -cd backend && alembic upgrade head -cd backend && pytest -q tests/test_alembic.py tests/test_projects.py tests/test_tasks.py -cd backend && ruff check app/modules/projects app/modules/tasks app/workers/project_setup.py tests/test_alembic.py tests/test_projects.py tests/test_tasks.py +```bash +(cd backend && .venv/bin/docstr-coverage --config .docstr.yaml) python3 scripts/check_stale_workstream_wording.py +python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_stale_review_contracts.py +python3 scripts/check_stale_artifact_contracts.py python3 scripts/check_markdown_links.py +python3 scripts/check_loop_memory_state.py +python3 scripts/check_internal_review_evidence.py PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 backend/.venv/bin/python scripts/test_agent_gates.py +backend/.venv/bin/python scripts/update_post_merge_memory.py validate-merge-intent --base-ref origin/main git diff --check -(metadata_dir="$(mktemp -d)" && trap 'rm -rf "$metadata_dir"' EXIT && cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/postgres .venv/bin/python scripts/run_isolated_tests.py --metadata-json "$metadata_dir/result.json" --timeout-seconds 12600 -- .venv/bin/python -m pytest -q --ignore=tests/test_isolated_database_runner.py --cov=app --cov-report=term-missing --cov-fail-under=78) -cd backend && coverage report --include='app/modules/projects/*' --precision=2 --fail-under=90 -cd backend && coverage report --include='app/modules/tasks/*' --precision=2 --fail-under=90 -cd backend && coverage report --include='app/workers/project_setup.py' --precision=2 --fail-under=90 ``` -Migration proof uses real PostgreSQL and covers prior-head preflight, upgrade, -safe downgrade/re-upgrade, protected-row downgrade refusal, failed-preflight -rollback/no partial DDL, direct-SQL constraints, and a single head. The isolated -full suite preserves the 78 percent floor; every materially changed project/task -module remains at or above 90 percent. - -## Required reviewers +## Required Reviewers Senior engineering, QA/test, security/auth, product/ops, architecture, docs, -reuse/dedup, test delta, and CI integrity if coverage workflow changes. +reuse/dedup, test delta, and CI integrity. -## Human review focus +## Human Review Focus -Historical ordering, Project-first races, Task triplet immutability, canonical -approver enforcement, unchanged public authorization, and downgrade limits. +Split boundaries, dependency order, exact database ownership, command-specific +lock order, canonical-human semantics, migration refusal/downgrade safety, and +the explicit-start gate before 02A1. -## Stop condition +## Stop Condition -Stop if AUTH contributor/actor schema must change or historical lineage is -ambiguous. Merge, record automated memory, and stop. Do not start 02B. +Merge, let automated memory record this parent split, and stop. Do not implement +or start 02A1, 02A3, 02A4, 02A2, or 02B from this chunk. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A1-project-setup-publication-fence.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A1-project-setup-publication-fence.md new file mode 100644 index 000000000..9fff8d5e7 --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A1-project-setup-publication-fence.md @@ -0,0 +1,205 @@ +# Chunk Contract: WS-REV-001-02A1 - Project And Setup Publication Fence + +## Goal + +Make every current Project Guide setup writer serialize through one shared +Project-first database fence and stable row-type/ID lock order. Preserve all +current route permissions, request/response shapes, guide activation behavior, +policy semantics, and setup-job orchestration. + +## Risk Class + +L1 concurrency, transaction, and shared project/setup service behavior. + +## Preconditions + +- Parent `WS-REV-001-02A` is merged with exact current-main dependency proof. +- The user separately starts this child from then-current trusted main. +- Read-only discovery confirms the writer inventory and no sibling merge has + introduced an additional direct writer or migration conflict. + +## Exact Writer Inventory + +The fence covers these `ProjectService` mutation entry points: + +```text +create_guide +update_draft_guide +create_guide_source_snapshot +approve_current_post_submit_checker_policy +request_post_submit_checker_policy_correction +create_guide_sufficiency_report +run_guide_sufficiency_agent persistence phase +acknowledge_guide_sufficiency_warnings +create_submission_artifact_policy +run_submission_artifact_policy_derivation_agent persistence phase +run_post_submit_checker_policy_derivation_agent persistence phase +update_submission_artifact_policy +approve_submission_artifact_policy +activate_guide +update_project_setup_run_task_id +update_project_setup_run_status +start_post_submit_setup_continuation +post-commit setup enqueue task-id bookkeeping +``` + +The start refresh must add any newly merged writer before implementation. +`project_setup.py` remains a service caller and performs no direct ORM mutation. + +## Lock Contract + +Every listed writer locks and refreshes the exact Project first. It then locks +existing rows in this type order, sorting every same-type set by ascending ID: + +```text +ProjectGuide +GuideSourceSnapshot +GuideSufficiencyReport +ProjectSetupRun +SubmissionArtifactPolicy +EffectiveProjectSubmissionArtifactPolicy +PreSubmitCheckerPolicy +PostSubmitCheckerPolicy +ReviewPolicy +RevisionPolicy +payment_policies table row +``` + +The writer revalidates guide ownership and `draft` state after the locks and +before its first mutation. `create_guide` has no pre-existing guide to +revalidate: it locks/revalidates Project, inserts the new guide explicitly as +draft, and then writes its optional setup rows. Other insert-only rows are added +only after the existing graph is locked. Locked reads use `populate_existing` +or an equivalent refresh so the identity map cannot return pre-lock state. Agent/provider I/O happens +before the transaction fence; the service rolls back that read phase, performs +remote work, then reacquires and revalidates the complete fence before writing. + +Setup-run commands that receive only `setup_run_id` first read an unlocked +`setup_run_id -> project_id` projection. That projection grants no authority and +is discarded after locking Project. The command then locks and refreshes the +ProjectSetupRun and full graph in the declared order and revalidates the +project/guide relation before mutation. An internal caller may instead supply a +claimed `project_id`, but the same post-lock equality and ownership checks are +mandatory. No command locks ProjectSetupRun merely to discover Project. + +## Race Matrix + +The implementation test matrix contains one row for every inventoried entry +point; grouping rows as an unnamed "mutation family" is not sufficient: + +```text +create_guide +update_draft_guide +create_guide_source_snapshot +approve_current_post_submit_checker_policy +request_post_submit_checker_policy_correction +create_guide_sufficiency_report +run_guide_sufficiency_agent persistence phase +acknowledge_guide_sufficiency_warnings +create_submission_artifact_policy +run_submission_artifact_policy_derivation_agent persistence phase +run_post_submit_checker_policy_derivation_agent persistence phase +update_submission_artifact_policy +approve_submission_artifact_policy +activate_guide +update_project_setup_run_task_id +update_project_setup_run_status +start_post_submit_setup_continuation +post-commit setup enqueue task-id bookkeeping +``` + +Each row races with activation using independent sessions, observes the +PostgreSQL wait, and forces both Project-lock acquisition orders. Same-guide +activation-first cases reload the active guide and return the command's exact +existing denial/idempotent result without mutation. `create_guide` instead +revalidates the refreshed Project and preserves its exact current new-draft +outcome. Competing 02A1 activations retain draft-only winner/loser behavior. +Writer-first cases commit the whole writer result or its exact current denial; +activation then reloads the graph and either activates a complete guide or +returns its existing readiness denial. No order may commit partial setup or +stale remote output. A separate exhaustive structural test proves every current +and newly discovered writer enters the one shared Project-first fence. + +## Allowed Files + +```text +backend/app/modules/projects/{repository,service}.py +backend/app/workers/project_setup.py only if needed to remove direct persistence or call a fenced service method +backend/tests/test_projects.py +.github/workflows/backend.yml +.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/** +.agent-loop/merge-intents/WS-REV-001-02A1.json +``` + +## Not Allowed + +```text +models, migrations, public schemas, routers, or API shapes +guide activation sequence or approver-lineage behavior +active-repeat or superseded-guide activation behavior changes +Task or Submission fields, lifecycle, screening, or attribution +ReviewPolicy, RevisionPolicy, compensation-policy, or artifact-policy semantics +AUTH actions, permissions, grants, evaluators, availability, or actor schema +ART, CON, review queue, Review, FinalAcceptance, or adjudication behavior +external I/O while any publication-fence lock is held +``` + +## Acceptance Criteria + +- One reusable repository/service fence implements the declared type order; + writers do not reproduce ad hoc lock sequences. +- Every inventoried writer acquires Project first, refreshes locked rows, and + revalidates the guide is still draft before mutation, with the declared + create-guide exception for a newly inserted draft. `activate_guide` preserves + its current draft-only behavior in this child. +- Post-commit setup enqueue never mutates `ProjectSetupRun` directly; it invokes + the fenced task-ID participant. +- Setup jobs remain service-only callers. Their internal service actor can + never become a Project Guide approver. +- Agent work performs no external call under locks and cannot persist stale + output after guide activation or replacement setup wins. +- Independent-session tests satisfy every row and assertion in the named race + matrix and observe PostgreSQL lock waits rather than depending on sleeps. +- Current authorization, response status, policy values, task behavior, and + setup-job output remain unchanged. +- Backend CI adds an additive 90 percent `app/modules/projects/*` report, + preserves the global 78 percent floor and existing task/actor/authorization/ + background-job gates, and adds an exact 90 percent `project_setup.py` report + only if that file changes. + +## Verification + +```bash +(metadata_dir="$(mktemp -d)" && trap 'rm -rf "$metadata_dir"' EXIT && cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/postgres .venv/bin/python scripts/run_isolated_tests.py --metadata-json "$metadata_dir/result.json" --timeout-seconds 12600 -- .venv/bin/python -m pytest -q tests/test_projects.py) +(metadata_dir="$(mktemp -d)" && trap 'rm -rf "$metadata_dir"' EXIT && cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/postgres .venv/bin/python scripts/run_isolated_tests.py --metadata-json "$metadata_dir/result.json" --timeout-seconds 12600 -- .venv/bin/python -m pytest -q --ignore=tests/test_isolated_database_runner.py --cov=app --cov-report=term-missing --cov-fail-under=78) +(cd backend && .venv/bin/coverage report --include='app/modules/projects/*' --precision=2 --fail-under=90) +(cd backend && .venv/bin/coverage report --include='app/workers/project_setup.py' --precision=2 --fail-under=90) # only when this file changes +(cd backend && .venv/bin/python -m ruff check app/modules/projects app/workers/project_setup.py tests/test_projects.py) +(cd backend && .venv/bin/docstr-coverage --config .docstr.yaml) +python3 scripts/check_stale_workstream_wording.py +python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_stale_review_contracts.py +python3 scripts/check_stale_artifact_contracts.py +python3 scripts/check_markdown_links.py +python3 scripts/check_loop_memory_state.py +python3 scripts/check_internal_review_evidence.py +PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 backend/.venv/bin/python scripts/test_agent_gates.py +backend/.venv/bin/python scripts/update_post_merge_memory.py validate-merge-intent --base-ref origin/main +git diff --unified=0 origin/main...HEAD -- backend/tests | (! rg '^-(.*assert|.*pytest\.raises|.*pytest\.mark\.(skip|xfail)|.*skipTest)') +git diff --check +``` + +## Required Reviewers + +Senior engineering, QA/test, security/auth, product/ops, architecture, CI +integrity, docs, reuse/dedup, and test delta. + +## Human Review Focus + +Complete writer inventory, stable lock order, stale identity-map prevention, +remote-I/O separation, setup-job indirect writes, race evidence, and unchanged +runtime semantics. + +## Stop Condition + +Merge, record automated memory, and stop. Do not start 02A3 automatically. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A2-prepared-guide-reactivation.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A2-prepared-guide-reactivation.md index 50f74b153..bfd900a2b 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A2-prepared-guide-reactivation.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A2-prepared-guide-reactivation.md @@ -17,7 +17,7 @@ L1 privileged mutation, immutable provenance, and concurrency. ## Preconditions -- 02A and 08 are merged with Project-first locking, immutable activation sequence, +- 02A1, 02A3, 02A4, and 08 are merged with Project-first locking, immutable activation sequence, pure decision/resource contracts, and unchanged superseded-candidate denial. - Exact merged AUTH-PREP/custody and an AUTH-12 contract amendment are recorded @@ -41,11 +41,17 @@ L1 privileged mutation, immutable provenance, and concurrency. and activation sequence; clears only its superseded time; supersedes the exact expected current guide at post-lock database time; and leaves exactly one active guide. +- Its migration amends the 02A3 database guard only for the exact prepared, + If-Match-protected `superseded -> active` transition and corresponding + `superseded_at -> NULL` and database-maintained update-time changes. ID, + Project, version, content, summary, creator/creation time, original approver, + effective time, and activation sequence remain immutable; every other change + remains rejected. - The shared AuditEvent records `project_guide_reactivated`, project/candidate, canonical actor, replaced/restored IDs and activation sequences, `older_guide_reactivated`, request/correlation IDs, AuthorizationDecision, and database time. Audit failure rolls back all feature mutation. -- Active repeat remains no-write idempotent. Draft first activation remains 02A +- Active repeat remains no-write idempotent. Draft first activation remains 02A3 behavior. Unknown/cross-project/wrong-state targets fail closed. - Independent-session tests cover competing reactivations, new activation versus reactivation, exact retry, delayed retry, current-guide change, authority loss, diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A3-guide-activation-chronology.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A3-guide-activation-chronology.md new file mode 100644 index 000000000..287c4fc80 --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A3-guide-activation-chronology.md @@ -0,0 +1,255 @@ +# Chunk Contract: WS-REV-001-02A3 - Guide Activation Chronology + +## Goal + +Add immutable per-project Project Guide activation chronology and canonical +human approval provenance on top of the merged Project/setup publication fence. +Preserve the public route and existing `PROJECT_SETUP_ROLES` coarse authorization, +add an explicitly no-write active-repeat success, and keep superseded-guide +reactivation denied. + +## Risk Class + +L1 schema, migration, authorization-lineage, and activation concurrency. + +## Preconditions + +- `WS-REV-001-02A1` is merged and its complete writer inventory is still + current. +- `WS-AUTH-001-CONTRIBUTOR-FOUNDATION` PR #153 and its reusable human-reference + function remain present on trusted main. +- The user separately starts this child. The start refresh records the sole + Alembic head and allocates only its then-current next revision. + +## Database Contract + +`ProjectGuide` adds: + +```text +activation_sequence BIGINT NULL +approved_by VARCHAR(36) NULL +``` + +The migration creates these exact objects: + +```text +ck_project_guides_activation_sequence_positive +ck_project_guides_activation_state +uq_project_guides_project_activation_sequence +uq_project_guides_context_triplet +fk_project_guides_approved_by_actor_profiles +project_guides_approved_by_human +guard_project_guide_activation_history() +project_guides_activation_history_guard +``` + +The two unique constraints cover exact columns: + +```text +uq_project_guides_project_activation_sequence + (project_id, activation_sequence) +uq_project_guides_context_triplet + (project_id, id, version, activation_sequence) +``` + +`fk_project_guides_approved_by_actor_profiles` references +`actor_profiles(id)`. `project_guides_approved_by_human` executes the existing +`public.require_human_actor_profile_reference('approved_by')` trigger function +configuration. This chunk does not create, replace, or drop that AUTH function. + +Status/provenance is exact: + +```text +draft -> sequence, approved_by, effective_at, superseded_at are all NULL +active -> positive sequence, approved_by, effective_at are present; superseded_at is NULL +superseded -> positive sequence and all provenance are present; + superseded_at >= effective_at >= created_at +``` + +Active also requires `effective_at >= created_at`. The activation update may +allocate only status, activation sequence, approver, effective time, and the +database-maintained update time; all draft content/context/creation fields stay +unchanged. After first activation, the entire ProjectGuide row is immutable +except the exact lifecycle transition fields. `active -> superseded` may change +only status, `superseded_at` from NULL to one database timestamp, and the +database-maintained update time. The guard then rejects every change or clear, +including changes to `id`, `project_id`, `version`, content, change summary, +creator/creation time, activation sequence, approver, effective time, or +superseded time. Status may move only `draft -> active -> superseded`; active +no-write repeat is unchanged-row idempotency, and `superseded -> active` remains +rejected. The later 02A2 chunk owns the reviewed guard amendment that permits +only its exact reactivation transition while continuing to freeze all original +context, content, creation, and approval facts. + +## Migration Contract + +- Lock `actor_profiles` and `project_guides` in access-exclusive mode before + preflight and DDL. +- Refuse unknown status, polluted draft provenance, incomplete active/ + superseded provenance, invalid timestamp order, malformed/missing/non-human + approver, or more than one active guide for a Project. +- Treat two non-draft guides in one Project with identical + `(effective_at, created_at)` as ambiguous historical chronology and refuse; + ID is used only for bounded diagnostics and deterministic ordering after the + ambiguity check. +- Bound diagnostics by table/failure class and row count. Malformed actor + values are redacted exactly as in migration 0027. +- Backfill each valid Project's active/superseded rows with `row_number()` over + `effective_at, created_at, id`; drafts remain null. +- Refusal leaves the exact prior head recorded at the 02A3 start refresh, all + original column shapes, data, constraints, and functions unchanged and creates + none of this chunk's objects. Migration 0027 remains only the historical owner + of the shared AUTH function; it is not a reserved future parent revision. +- Downgrade locks the same tables and refuses before DDL when any guide has + allocated activation provenance or any later dependency references + `uq_project_guides_context_triplet` or another chronology object. A safe + draft-only downgrade removes this chunk's triggers, owned guard function, + constraints, and sequence column in dependency order, restores + `approved_by VARCHAR(100)`, and never drops the shared AUTH function. + +## Activation Command Order + +```text +existing PROJECT_SETUP_ROLES coarse check +-> Project FOR UPDATE +-> ActorProfile FOR UPDATE +-> exact ActorIdentityLink FOR UPDATE +-> ProjectGuide rows by ascending id +-> remaining setup rows in the merged 02A1 type/id order +-> revalidate actor/link, guide status, ownership, and complete setup +-> read one database timestamp +-> allocate max(project activation_sequence)+1 for first activation only +-> supersede current active guide and activate candidate +-> commit once +``` + +ActorProfile and ActorIdentityLink form an activation-only identity fence after +Project. They do not reorder the 02A1 publication-row sequence, which still +begins at ProjectGuide and retains the same type/ID order for every command. + +The actor/link revalidation reuses +`ActorService.require_active_human_write_actor`; it is transaction-local +identity/lifecycle validation after `get_registered_actor` has already returned +an ActorContext and after the existing role check. It is not a new authorization +path. Pre-service token verification and canonical-actor resolution keep their +current AUTH-owned envelopes, including `service_actor_not_provisioned`, +`identity_link_revoked`, `actor_suspended`, `actor_deactivated`, +`identity_verification_unavailable`, and actor-registry unavailability. 02A3 +does not catch, translate, or replace those dependency outcomes. + +Only a failure discovered by the post-dependency, post-lock ProjectService +revalidation maps to these Projects-owned structured public errors: + +```text +403 active_project_approver_required + "Active project approver identity required" + retryable=false +503 project_approver_identity_unavailable + "Project approver identity verification unavailable" + retryable=true +``` + +A profile that becomes suspended or terminally deactivated, or a link that +becomes revoked, after ActorContext resolution maps to the Projects 403 when +detected under the transaction fence. Missing/inconsistent post-resolution +profile or link state and database failure during this revalidation map to the +Projects 503. Direct service misuse with a non-human ActorContext also returns +the Projects 403, but that is not the public service-token response. Both errors +roll back all guide/Project changes. Independent race tests first establish the +valid request ActorContext, then cover profile suspension, terminal +deactivation, and identity-link revocation relative to the ProjectService actor +lock in both commit orders: lifecycle-first returns the Projects 403 without +guide history; activation-first commits immutable approval and the later +lifecycle change does not invalidate it. No AUTH file, action, permission, +evaluator, or availability changes. + +## Allowed Files + +```text +backend/app/modules/projects/{models,schemas,repository,service,router}.py +backend/app/db/models.py +backend/alembic/versions/_guide_activation_chronology.py +backend/tests/test_{alembic,projects}.py +.github/workflows/backend.yml only for additive/preserved coverage proof +docs/architecture_data_model.md +docs/architecture_lifecycle_state_machine.md +docs/spec_chunk_3_project_guide_foundation.md +docs/operations_operator_workflow.md +.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/** +.agent-loop/merge-intents/WS-REV-001-02A3.json +``` + +## Not Allowed + +```text +Project/setup writer inventory or lock-order changes beyond consuming 02A1 +superseded-guide reactivation, If-Match, prepared AUTH, or 02A2 behavior +Task or Submission schema, stamping, lifecycle, or attribution +ReviewPolicy, RevisionPolicy, compensation-policy, ART, or CON semantics +AUTH schema, actions, permissions, grants, evaluators, or availability +review queue, Review, FinalAcceptance, or adjudication behavior +``` + +## Acceptance Criteria + +- First activation allocates sequence 1; later activation allocates the next + positive sequence while preserving every prior sequence and provenance. +- Concurrent activations serialize on Project and cannot duplicate or invert + chronology. Database time after locks controls effective/superseded times. +- Active canonical-human Project Manager/Admin succeeds. Existing pre-service + AUTH dependency denials retain their exact envelopes. Post-ActorContext + transaction revalidation uses only the exact Projects 403/503 split, rolls + back exactly, and never falls back to token/local identity. +- Profile suspension, terminal deactivation, and identity-link revocation races + each run in both commit orders with independent sessions and observed + PostgreSQL lock waits. Lifecycle-first returns the exact 403 without chronology + or supersession; activation-first preserves committed historical approval. +- Repeating activation for the sole already-active candidate is an explicitly + additive no-write idempotent success returning the same complete active + response without changing sequence, timestamps, audit, or Project state. +- A superseded candidate remains denied; public route, body, response model, + and coarse role authorization otherwise remain unchanged. +- Real-PostgreSQL tests prove preflight, upgrade, safe downgrade/re-upgrade, + dependency/protected-row downgrade refusal, atomic failure, direct-SQL state, + human-kind and complete activated-row immutability guards, and one Alembic + head. +- Project subsystem coverage remains at least 90 percent and global coverage + remains at least 78 percent without weakening another gate. + +## Verification + +```bash +(cd backend && .venv/bin/alembic heads) +(metadata_dir="$(mktemp -d)" && trap 'rm -rf "$metadata_dir"' EXIT && cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/postgres .venv/bin/python scripts/run_isolated_tests.py --metadata-json "$metadata_dir/result.json" --timeout-seconds 12600 -- .venv/bin/python -m pytest -q tests/test_alembic.py tests/test_projects.py) +(metadata_dir="$(mktemp -d)" && trap 'rm -rf "$metadata_dir"' EXIT && cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/postgres .venv/bin/python scripts/run_isolated_tests.py --metadata-json "$metadata_dir/result.json" --timeout-seconds 12600 -- .venv/bin/python -m pytest -q --ignore=tests/test_isolated_database_runner.py --cov=app --cov-report=term-missing --cov-fail-under=78) +(cd backend && .venv/bin/coverage report --include='app/modules/projects/*' --precision=2 --fail-under=90) +(cd backend && .venv/bin/python -m ruff check app/modules/projects app/db/models.py alembic/versions tests/test_alembic.py tests/test_projects.py) +(cd backend && .venv/bin/docstr-coverage --config .docstr.yaml) +python3 scripts/check_stale_workstream_wording.py +python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_stale_review_contracts.py +python3 scripts/check_stale_artifact_contracts.py +python3 scripts/check_markdown_links.py +python3 scripts/check_loop_memory_state.py +python3 scripts/check_internal_review_evidence.py +PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 backend/.venv/bin/python scripts/test_agent_gates.py +backend/.venv/bin/python scripts/update_post_merge_memory.py validate-merge-intent --base-ref origin/main +git diff --unified=0 origin/main...HEAD -- backend/tests | (! rg '^-(.*assert|.*pytest\.raises|.*pytest\.mark\.(skip|xfail)|.*skipTest)') +git diff --check +``` + +## Required Reviewers + +Senior engineering, QA/test, security/auth, product/ops, architecture, CI +integrity, docs, reuse/dedup, and test delta. + +## Human Review Focus + +Historical refusal/backfill, shared AUTH function reuse, actor/project lock +order, lifecycle races, DB time, no-write active repeat, superseded denial, and +downgrade dependency safety. + +## Stop Condition + +Stop if historical chronology is ambiguous or AUTH schema/logic must change. +Merge, record automated memory, and stop. Do not start 02A4 automatically. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A4-task-guide-triplet-screening.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A4-task-guide-triplet-screening.md new file mode 100644 index 000000000..1d974fde2 --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02A4-task-guide-triplet-screening.md @@ -0,0 +1,173 @@ +# Chunk Contract: WS-REV-001-02A4 - Task Guide Triplet And Screening + +## Goal + +Stamp one immutable same-Project guide ID/version/activation-sequence triplet on +each Task when it leaves draft, and make screening compose with guide activation +through the merged Project-first fence. + +## Risk Class + +L1 schema, migration, task lifecycle concurrency, and audit atomicity. + +## Preconditions + +- `WS-REV-001-02A3` is merged with valid Project Guide chronology and + `uq_project_guides_context_triplet`. +- The user separately starts this child. The start refresh records the sole + Alembic head and allocates only its then-current next revision. + +## Database Contract + +`WorkstreamTask` adds: + +```text +locked_guide_id VARCHAR(36) NULL +locked_guide_activation_sequence BIGINT NULL +``` + +The migration replaces legacy `fk_workstream_tasks_locked_guide` with: + +```text +fk_workstream_tasks_locked_guide_context + (project_id, locked_guide_id, locked_guide_version, + locked_guide_activation_sequence) + -> project_guides(project_id, id, version, activation_sequence) + +ck_workstream_tasks_locked_guide_triplet +guard_workstream_task_guide_context() +workstream_tasks_guide_context_guard +``` + +Draft Tasks require all three guide fields null. Every non-draft Task requires +all three present. The trigger permits the single draft-to-complete allocation +and rejects every later change or clearing of any triplet member. + +## Migration Contract + +- Lock `project_guides` and `workstream_tasks` before preflight and DDL. +- Reject a draft Task with any legacy locked guide field, a non-draft Task with + missing guide version, or a non-draft Task whose same-Project version resolves + to zero/multiple guides or a guide without valid chronology. +- Backfill each valid non-draft Task only from its exact same-Project + `locked_guide_version`; never choose the currently active/latest guide. +- Bound diagnostics by failure class and row count. Refusal leaves the prior + revision, data, legacy FK, and complete absence of new objects unchanged. +- Downgrade locks the same tables and refuses before DDL whenever a protected + Task triplet exists or a later dependency references the new FK/columns. Safe + downgrade is limited to databases with no allocated Task triplet; it removes + this chunk's trigger/function/check/FK/columns and restores the legacy FK. + No automatic clearing or destructive data rewrite occurs. + +## Screening Command Order + +```text +coarse project operator role check +-> unlocked Task id/project-id projection only +-> Project FOR UPDATE +-> WorkstreamTask FOR UPDATE with populate_existing +-> revalidate task project and draft status +-> selected active ProjectGuide FOR UPDATE with populate_existing +-> load/revalidate exact setup graph under the Project fence +-> stamp guide id/version/activation sequence and existing policy context +-> append audit containing the complete triplet +-> commit once +``` + +The initial projection grants no authority and is discarded after the locks. +Activation and screening both serialize on Project. No external I/O occurs in +the transaction. + +## Allowed Files + +```text +backend/app/modules/projects/repository.py only for the locked active-guide read +backend/app/modules/tasks/{models,schemas,repository,service}.py +backend/app/db/models.py +backend/alembic/versions/_task_guide_triplet.py +backend/tests/test_{alembic,projects,tasks}.py +.github/workflows/backend.yml only for additive/preserved coverage proof +docs/architecture_data_model.md +docs/architecture_lifecycle_state_machine.md +docs/spec_chunk_3_project_guide_foundation.md +docs/operations_operator_workflow.md +.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/** +.agent-loop/merge-intents/WS-REV-001-02A4.json +``` + +## Not Allowed + +```text +Project Guide chronology, approval, activation, or setup-writer behavior +Submission attribution, guide stamps, lineage, or immutability +Task or TaskAssignment lifecycle state additions or transition changes +ReviewPolicy, RevisionPolicy, compensation-policy, ART, CON, or AUTH behavior +review queue, Review, finding, FinalAcceptance, or adjudication behavior +``` + +## Acceptance Criteria + +- New draft Tasks expose/store a null triplet. Screening stamps the exact active + guide triplet atomically with all existing locked context. +- Task, operator locked-context, and contributor work-context schemas expose the + appropriate exact identity/sequence without leaking internal hashes. Guide + response exposure is inherited unchanged from merged 02A3. Required-field + validation includes all Task triplet members. +- Loading locked context validates the Task triplet against one same-Project + Project Guide rather than resolving by version alone. +- Screening audit contains `locked_guide_id`, `locked_guide_version`, and + `locked_guide_activation_sequence`. Forced audit failure rolls back status, + triplet, policies, and payment stamps. +- Direct SQL rejects partial, cross-Project, mixed-guide, nonpositive, changed, + or cleared triplets. +- Independent-session activation/screening tests observe PostgreSQL lock waits + and both commit orders: screening-first stamps the old active guide fully; + activation-first stamps the new active guide fully; no mixed or inactive-at- + selection context commits. +- Existing checker-caused revision, task transitions, submission creation, and + role/visibility behavior remain unchanged. +- Real-PostgreSQL tests prove upgrade/backfill/refusal, safe downgrade/ + re-upgrade, protected-row refusal, direct SQL, rollback, and one head. +- Existing task 90 percent and global 78 percent gates remain mandatory. If the + allowed project repository file changes, the project 90 percent report is + mandatory. + +## Verification + +```bash +(cd backend && .venv/bin/alembic heads) +(metadata_dir="$(mktemp -d)" && trap 'rm -rf "$metadata_dir"' EXIT && cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/postgres .venv/bin/python scripts/run_isolated_tests.py --metadata-json "$metadata_dir/result.json" --timeout-seconds 12600 -- .venv/bin/python -m pytest -q tests/test_alembic.py tests/test_projects.py tests/test_tasks.py) +(metadata_dir="$(mktemp -d)" && trap 'rm -rf "$metadata_dir"' EXIT && cd backend && WORKSTREAM_TEST_ADMIN_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/postgres .venv/bin/python scripts/run_isolated_tests.py --metadata-json "$metadata_dir/result.json" --timeout-seconds 12600 -- .venv/bin/python -m pytest -q --ignore=tests/test_isolated_database_runner.py --cov=app --cov-report=term-missing --cov-fail-under=78) +(cd backend && .venv/bin/coverage report --include='app/modules/tasks/*' --precision=2 --fail-under=90) +(cd backend && .venv/bin/coverage report --include='app/modules/projects/*' --precision=2 --fail-under=90) # mandatory when the allowed project repository file changes +(cd backend && .venv/bin/python -m ruff check app/modules/projects/repository.py app/modules/tasks app/db/models.py alembic/versions tests/test_alembic.py tests/test_projects.py tests/test_tasks.py) +(cd backend && .venv/bin/docstr-coverage --config .docstr.yaml) +python3 scripts/check_stale_workstream_wording.py +python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_stale_review_contracts.py +python3 scripts/check_stale_artifact_contracts.py +python3 scripts/check_markdown_links.py +python3 scripts/check_loop_memory_state.py +python3 scripts/check_internal_review_evidence.py +PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 backend/.venv/bin/python scripts/test_agent_gates.py +backend/.venv/bin/python scripts/update_post_merge_memory.py validate-merge-intent --base-ref origin/main +git diff --unified=0 origin/main...HEAD -- backend/tests | (! rg '^-(.*assert|.*pytest\.raises|.*pytest\.mark\.(skip|xfail)|.*skipTest)') +git diff --check +``` + +## Required Reviewers + +Senior engineering, QA/test, security/auth, product/ops, architecture, CI +integrity, docs, reuse/dedup, and test delta. + +## Human Review Focus + +Legacy backfill refusal, exact composite FK, set-once trigger, unlocked +projection safety, identity-map refresh, audit rollback, activation/screening +races, response visibility, and unchanged task lifecycle. + +## Stop Condition + +Stop if guide chronology is incomplete, historical Task context is ambiguous, +or a Submission field must change. Merge, record automated memory, and stop. Do +not start 02B automatically. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02B-review-policy-task-lifecycle.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02B-review-policy-task-lifecycle.md index 68e5ab3a1..79ca1aea6 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02B-review-policy-task-lifecycle.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02B-review-policy-task-lifecycle.md @@ -27,7 +27,7 @@ P2. ## Preconditions -- 02A is merged and automated memory is current. +- 02A1, 02A3, and 02A4 are merged and automated memory is current. - The exact merged AUTH contributor-foundation PR/SHA and its canonical-human database constraint names are recorded. - The human has approved concrete positive values for @@ -84,7 +84,7 @@ docs/operations_operator_workflow.md only for migration/deployment/remediation ```text Submission schema, attribution, predecessor, or finalization behavior -ProjectGuide activation-sequence behavior except consuming merged 02A fields +ProjectGuide activation-sequence behavior except consuming merged 02A3/02A4 fields Review, ReviewLease, ReviewFinding, FinalAcceptance, or reject Review foreign key service transition into accepted, rejected, completed, or blocked public review or revision-obligation-close route diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02C-submission-attribution-lineage.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02C-submission-attribution-lineage.md index 8a142636b..ff11ab1dd 100644 --- a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02C-submission-attribution-lineage.md +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-02C-submission-attribution-lineage.md @@ -39,7 +39,7 @@ P2. canonical-active-human revalidation consumed by task submission. If it does not, 02C stops for an AUTH-owned amendment rather than querying actor/grant tables. -- 02A Task guide stamps and activation-sequence constraints are present. +- 02A3 guide chronology and 02A4 Task guide stamps are present. - This contract receives a separate human start. ## Allowed files diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02A-external-review-response.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02A-external-review-response.md new file mode 100644 index 000000000..3a897be08 --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02A-external-review-response.md @@ -0,0 +1,88 @@ +# External Review Response: WS-REV-001-02A + +## Review snapshot + +- PR: `#156` +- Reviewed head: `8f12f656cb24acb88047840682d95dbc37f3eb93` +- GitHub Backend: PASS +- GitHub Agent Gates: PASS +- CodeRabbit: PASS with one actionable comment + +## Comments addressed + +### Source-manifest review-base chronology + +CodeRabbit correctly identified that the later `SOURCE_MANIFEST.md` timeline +called AUTH-09D-A commit +`99ae4c963e53f317175dcb308b9e47c93ccf19ed` the "post-rebase review base" +without making clear that it was historical PLAN2 evidence. Earlier text already +recorded parent 02A's actual trusted-main start at +`8d5eb15b384fd75787ce98a099400a1d335d2560` with sole migration head +`0027_contributor_foundation`, but the later wording could mislead a future +child migration allocation. + +The repair distinguishes the PLAN2 `0026_actor_profile_lifecycle` review base +from the parent 02A `0027_contributor_foundation` start and requires every +executable child to allocate from the then-current trusted-main head at its own +explicit start. + +### Publication evidence status + +CodeRabbit's pre-rebase re-review correctly found that the first response +mixed the historical stale-SHA gate with repaired-candidate evidence and pending +republish checks. The stale-SHA failure below is now explicitly historical. +Before the ART #154 rebase, internal evidence was rebound to reviewed candidate +`c545cd10272e10709a13b6212ef62fd1adc4f39f` and passed at evidence head +`ebb8db88550c623d87296681581e81e5bc6ef426`. Those SHAs and results are now +historical because the conflict-free ART #154 rebase rewrote the branch. The +first rebased candidate passed fresh exact-SHA review and evidence rebinding; +that result became historical when the conformance matrix changed. The repaired +conformance candidate `73a6c31ffb54a11cd22992dd3b6d0de5413d7e05` has now +passed fresh exact-SHA review and evidence rebinding. +Merge remains blocked until the rebased branch is force-pushed and every GitHub +and CodeRabbit check on the final pushed head passes with no unresolved finding, +followed by the user's approval of PR #156. + +### Revision-context conformance ownership + +After the ART rebase, CodeRabbit correctly found that the conformance matrix's +`Revision context` row omitted deferred chunk 02A2. Other initiative artifacts +already assign prepared `If-Match`-protected superseded-guide reactivation to +02A2 so backward context reachability cannot be silently removed by a stale +retry. The matrix now includes 02A2 and that exact proof. The chunk remains +deferred after 02A4 and 08 and requires its own explicit start. + +## Comments deferred + +None. + +## Human decisions needed + +Only the existing human review and merge decision for PR #156. This repair does +not start 02A1 or change product, architecture, security, or migration behavior. + +## Commands rerun + +- Workstream, AUTH, REV, and ART stale-contract scans: PASS. +- Markdown links: PASS for 21 changed Markdown files. +- Loop-memory state: PASS. +- Agent gates: PASS, 88 tests. +- Merge-intent validation: PASS. +- Docstring coverage after ART rebase: PASS, 90.5 percent overall. +- Alembic heads before the ART rebase: PASS, one head, + `0027_contributor_foundation`. After conflict-free rebase onto ART PR #154: + PASS, one head, `0028_artifact_admission`. +- Diff integrity: PASS. +- Internal-review evidence before ART #154 rebase: historical PASS after review + of candidate `c545cd10` and evidence head `ebb8db88`. Rebased candidate + `73a6c31ffb54a11cd22992dd3b6d0de5413d7e05` passed all required tracks and its + evidence is rebound against base + `44f2467cedc266d2efe261119cfff436ac6b7715`. + +## Remaining risks + +ART PR #154 merged at `44f2467c` and owns `0028_artifact_admission`; it changes +no Project/setup writer. Every future REV child must still refresh trusted main, +the writer inventory, and the sole Alembic head before implementation. +PR #156 must not merge while any current-head GitHub or CodeRabbit check is +pending or failed, or while any actionable comment remains unresolved. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02A-internal-review-evidence.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02A-internal-review-evidence.md new file mode 100644 index 000000000..3425eedc5 --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02A-internal-review-evidence.md @@ -0,0 +1,181 @@ +# Internal Review Evidence: WS-REV-001-02A + +## Candidate + +- Trusted base: `44f2467cedc266d2efe261119cfff436ac6b7715` +- Reviewed planning candidate: `73a6c31ffb54a11cd22992dd3b6d0de5413d7e05` +- Scope: 21 REV initiative Markdown paths and the one required schema-v2 merge + intent, including internal/external review publication artifacts +- Runtime status: prohibited; no backend runtime, model, schema, migration, + route, worker, test, dependency, CI workflow, frozen reference specification, + active product document, or AUTH/ART/CON owner file changed + +Open sub-agent sessions: none + +Valid findings addressed: yes + +## Reviewed revision + +Reviewed code SHA: 73a6c31ffb54a11cd22992dd3b6d0de5413d7e05 + +Reviewed at: 2026-07-19T17:12:07Z + +Reviewer run IDs: /root/rev02a_external_senior@73a6c31ffb54a11cd22992dd3b6d0de5413d7e05; /root/rev02a_external_qa@73a6c31ffb54a11cd22992dd3b6d0de5413d7e05; /root/rev02a_external_security@73a6c31ffb54a11cd22992dd3b6d0de5413d7e05 + +## Circuit breaker + +PASS with a documented planning-only size exception. The candidate changes 22 +paths with 1,548 insertions and 290 deletions, above the default review-size +guideline, but it changes no runtime, schema, migration, workflow, dependency, +test, or product-document behavior. It replaces one unreviewable L1 runtime +contract with three independently gated executable child contracts. Each child +requires a separate current-main refresh, human start, plan review, +implementation PR, deterministic proof, and reviewer fanout. + +## Reviewer results + +| Reviewer | Result | Blocking findings | Notes | +|---|---:|---|---| +| Senior engineering | PASS | None | The planning-only split, child sequence, ownership boundaries, and explicit stop are maintainable and reviewable. | +| QA/test | PASS | None | Each child contains fail-closed migration, direct-SQL, race, rollback, downgrade, and coverage proof appropriate to its boundary. | +| Security/auth | PASS | None | Canonical-human provenance reuses AUTH-owned guards and transaction revalidation without admitting service or external identities. | +| Product/ops | PASS | None | Guide chronology, Task locking, checker revision separation, and later review lifecycle behavior remain product-consistent. | +| Architecture | PASS | None | The Project-first fence, chronology, Task triplet, ART capability, and CON flush-only boundaries are explicit and non-overlapping. | +| CI integrity | PASS | None | No workflow or package script changed; the global 78 percent and future changed-subsystem 90 percent requirements remain intact. | +| Docs | PASS | None | The parent and child contracts agree with active terminology and preserve frozen reference specifications and owner boundaries. | +| Reuse/dedup | PASS | None | The split reuses ProjectGuide, Task, AUTH human guards, typed external ports, and existing transaction participants without parallel abstractions. | +| Test delta | PASS | None | No executable test, assertion, skip, xfail, coverage floor, or test command was weakened or removed. | + +No Critical, High, or Medium finding remains. + +## Findings repaired + +- Replaced contradictory active-repeat wording with the current rejection fact + and made no-write active-repeat success explicitly additive in 02A3. +- Replaced future migration-number reservation with then-current-head allocation + at each executable child's explicit start. +- Made the complete activated ProjectGuide row immutable through direct SQL, + except for the exact database-controlled active-to-superseded transition. +- Protected guide identity, content, creation, approval, activation sequence, + effective time, and supersession history from update or deletion drift. +- Enumerated all 18 current Project/setup writer entry points and required both + Project-lock race orders plus an exhaustive shared-fence structural test. +- Defined authority-free setup-run-to-Project discovery before the Project lock, + followed by refreshed graph and ownership revalidation. +- Replaced subjective changed-project coverage language with the repository-wide + 78 percent floor and independent 90 percent changed-subsystem proof. +- Required activation-only actor lifecycle races and clarified that AUTH owns + pre-service identity errors while Projects owns transaction-local 403/503 + errors after a valid ActorContext enters the service. +- Removed guide-response scope leakage from 02A4 and kept response changes with + the chronology owner. +- Preserved 02A2 as the later hidden prepared superseded-guide reactivation + chunk instead of renumbering or implicitly starting it. +- Distinguished the historical PLAN2 AUTH-09D-A/`0026` review base from parent + 02A's full trusted-main `8d5eb15b...`/`0027_contributor_foundation` start and + restated then-current-head allocation for every executable child. +- Corrected the trust bundle after review to distinguish the original 19-path + planning candidate from the full 22-path PR scope. +- Rebased without conflict onto ART PR #154 merge `44f2467c`, updated the sole + head from historical `0027_contributor_foundation` to current + `0028_artifact_admission`, and proved ART added no Project/setup writer. +- Kept ART's generic admission/put-attempt foundation separate from the still + unmerged packet-read, review-evidence finalize, and Submission digest gates. + +## Deterministic evidence + +- `python3 scripts/check_stale_workstream_wording.py`: PASS. +- `python3 scripts/check_stale_authorization_docs.py`: PASS. +- `python3 scripts/check_stale_review_contracts.py`: PASS. +- `python3 scripts/check_stale_artifact_contracts.py`: PASS at the + `artifact_store_cutover` phase. +- `python3 scripts/check_markdown_links.py`: PASS for all 21 changed Markdown + files. +- `python3 scripts/check_loop_memory_state.py`: PASS. +- `PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 backend/.venv/bin/python scripts/test_agent_gates.py`: + PASS, 88 tests. +- `(cd backend && .venv/bin/docstr-coverage --config .docstr.yaml)`: PASS, + 90.5 percent overall. +- `(cd backend && .venv/bin/alembic heads)`: PASS, one head, + `0028_artifact_admission`. +- `backend/.venv/bin/python scripts/update_post_merge_memory.py + validate-merge-intent --base-ref origin/main`: PASS for + `WS-REV-001-02A -> WS-REV-001-02A1` with explicit start required. +- `git diff --check` and `git diff --check origin/main...HEAD`: PASS. +- Scope proof: exactly 22 candidate paths, all within the REV initiative except + `.agent-loop/merge-intents/WS-REV-001-02A.json`. +- Ancestry proof: AUTH reviewed candidate `0ca5a632` is an ancestor of PR head + `6a70b33f`, which is an ancestor of AUTH merge `8d5eb15b`; ART final head + `c93f1a24` is an ancestor of trusted merge/base `44f2467c`. + +The backend runtime suite, focused Project/Task coverage, and migration +upgrade/downgrade suites were not run because this candidate changes planning +only. 02A1 carries exact real-PostgreSQL race, lock, rollback, Ruff, and +coverage proof for its non-migration boundary. Migration-owning children 02A3 +and 02A4 additionally carry direct-SQL, upgrade, downgrade, and migration +commands. + +## Remaining gates + +- All prior GitHub and CodeRabbit results are historical after the ART rebase; + fresh external checks must pass after the rebased candidate and evidence are + force-pushed. +- Human PR review remains required. +- Only the user may approve and merge the specific PR. +- Merge does not start 02A1; every child requires a new explicit instruction. + +## Evidence-only delta review + +The committed evidence-only delta at `5ac86263` added only this evidence file +and the PR trust bundle. Senior engineering/architecture/reuse and +security/docs/CI review passed with no findings. QA/product/test-delta review +found one Medium documentation-accuracy issue: two universal claims incorrectly +implied that non-migration child 02A1 carried migration-specific commands. The +repair now assigns PostgreSQL race, lock, rollback, Ruff, and coverage proof to +02A1 and reserves direct-SQL, upgrade, downgrade, and migration proof for +migration-owning children 02A3 and 02A4. QA re-review passed with no remaining +finding. All reviewer sessions completed and no reviewed planning-candidate +file changed. + +Evidence-delta reviewer run IDs: /root/rev02a_evidence_senior; /root/rev02a_evidence_qa; /root/rev02a_evidence_security + +## External-review repair review + +CodeRabbit's sole actionable finding was valid. Candidate `c545cd10` clarifies +that `99ae4c...`/`0026_actor_profile_lifecycle` was the historical PLAN2 +post-rebase snapshot while parent 02A started from full trusted main +`8d5eb15b...` with `0027_contributor_foundation`. Senior engineering, +architecture, reuse/dedup, circuit breaker, QA/test, product/ops, test delta, +security/auth, docs, and CI integrity reviewed that exact committed candidate. +The trust bundle's initially stale path count was repaired from the original +19-path planning-candidate count to the full 22-path PR count and re-reviewed to +PASS. No Critical, High, Medium, or Low finding remains; all reviewer sessions +completed. + +## ART #154 rebase review + +The branch rebased all six commits without conflict onto trusted ART merge +`44f2467cedc266d2efe261119cfff436ac6b7715`. Exact-SHA review of candidate +`6613f0611acd4682e54c4175065a34e65fc62942` verified the sole migration lineage +`0026_actor_profile_lifecycle -> 0027_contributor_foundation -> +0028_artifact_admission`, exact AUTH/ART ancestry, and no Project/setup writer +addition in ART #154. All nine required tracks passed. QA found that the +external-response artifact still described pre-rebase `c545cd10`/`ebb8db88` +evidence as current; the evidence-only repair now labels it historical and was +re-reviewed to PASS. No finding remains, and no runtime or child implementation +started. + +## Post-rebase conformance review + +CodeRabbit found that the `Revision context` conformance row omitted deferred +owner 02A2. Candidate `73a6c31` adds 02A2 and its prepared +`If-Match`-protected superseded-guide reactivation proof, matching the existing +Guide chronology row, plan, decisions, chunk map, status, and 02A2 contract. +All required tracks reviewed the exact candidate against `44f2467c`; the change +does not start 02A2, activate its action, or move its detailed 428/412, AUTH, +locking, audit, or database-transition contract. No finding remains. + +## Disposition + +PASS for publication of the planning-only `WS-REV-001-02A` split. Runtime +implementation remains prohibited. diff --git a/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02A-pr-trust-bundle.md b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02A-pr-trust-bundle.md new file mode 100644 index 000000000..ce6a9dc9e --- /dev/null +++ b/.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/reviews/WS-REV-001-02A-pr-trust-bundle.md @@ -0,0 +1,162 @@ +# PR Trust Bundle: WS-REV-001-02A + +## Chunk + +`WS-REV-001-02A` - Guide Chronology And Task Locking Split. + +## Goal + +Replace one oversized L1 runtime contract with three independently reviewable +and explicitly started children, without implementing runtime behavior. + +## Human-approved intent + +Preserve one Project Guide pipeline, exact Task-bound guide context, +canonical-human approval provenance, immutable chronology, and the existing +separation between checker remediation and Review-rooted human revision. Do not +start any runtime child from this planning parent. + +## What changed + +- Converted parent 02A into a permanently non-executable planning split. +- Added complete contracts for 02A1 Project/setup publication fencing, 02A3 + guide activation chronology, and 02A4 Task guide triplet screening. +- Reconciled the initiative plan, decisions, risks, discovery, conformance, + source manifest, test design, status, review log, and downstream gates. +- Preserved the existing deferred 02A2 prepared-guide reactivation identity. +- Added exactly one schema-v2 merge intent naming 02A1 with explicit start. + +## Why it changed + +Required L1 preimplementation review found that the former contract crossed +three independent PostgreSQL concurrency and migration boundaries: the complete +Project/setup writer fence, canonical-human guide chronology, and Task guide +triplet screening. Those boundaries could not receive credible migration, +direct-SQL, race, rollback, downgrade, coverage, and human review proof in one +PR. + +## Design chosen + +02A1 serializes every current setup writer through a Project-first publication +fence. 02A3 builds immutable per-Project activation chronology and canonical +human provenance on that fence. 02A4 then stamps and protects the exact Task +guide triplet after chronology exists. The later 02A2 remains separately gated +after chunk 08 for hidden prepared superseded-guide reactivation. + +## Alternatives rejected + +- No combined two-migration runtime PR crossing all three boundaries. +- No guide activation before all setup writers share the publication fence. +- No current/latest fallback for ambiguous guide or Task history. +- No duplicated AUTH actor/profile lifecycle logic or ad hoc identity guards. +- No public superseded-guide reactivation in 02A3. +- No automatic start of 02A1 or any later child. + +## Scope control + +The full PR changes 21 Markdown files under the REV initiative and one +merge-intent JSON file. This includes the internal evidence, trust bundle, and +external-review response added after the original 19-path planning candidate. +It changes no backend code, model, schema, migration, service, route, worker, +test, dependency, CI workflow, frozen reference specification, active product +document, or AUTH/ART/CON owner artifact. + +## Product behavior + +This PR activates no product behavior. Current guide activation continues to +reject an already-active candidate. Task guide storage and screening remain +unchanged. Stored Review decisions remain only `accept`, `needs_revision`, and +`reject`, and adjudication remains deferred beyond v0.1. + +## Acceptance criteria proof + +The parent records exact merged AUTH dependencies and the sole migration head. +Its historical start head was `0027_contributor_foundation`; the conflict-free +publication rebase onto ART PR #154 advances the current sole head to +`0028_artifact_admission` without adding a Project/setup writer. +Every child specifies allowed and prohibited files, lock order, race and +rollback proof, coverage floors, required reviewers, human focus, and a stop +condition. Migration-owning children 02A3 and 02A4 additionally specify their +database objects, migration refusal, direct-SQL parity, and downgrade rules. +The merge intent names only same-initiative successor 02A1 and requires a +separate human start. + +## Tests/checks run + +All four stale-contract scanners, Markdown links, loop-memory state, 88 agent +gate tests, docstring coverage at 90.5 percent, one-head Alembic verification, +schema-v2 merge-intent validation, scope checks, ancestry checks, and diff +integrity passed on the planning candidate. + +## Test delta + +No executable test changed. No assertion, skip, xfail, test command, coverage +floor, or CI gate was removed or weakened. + +## CI integrity + +No CI or package-script file changed. The repository-wide 78 percent baseline +and independent 90 percent minimum for future new or materially changed backend +subsystems remain explicit in the executable child contracts. + +## Reviewer results + +Senior engineering, QA/test, security/auth, product/ops, architecture, docs, +reuse/dedup, test delta, and CI integrity all pass on rebased planning SHA +`73a6c31ffb54a11cd22992dd3b6d0de5413d7e05` against ART-merged trusted base +`44f2467cedc266d2efe261119cfff436ac6b7715`. The circuit breaker approved the +planning-only size exception because every executable boundary is split and +separately gated. + +## External review + +After the prior review cycle passed, ART PR #154 merged and PR #156 rebased +without conflict onto trusted main `44f2467c`. This rewrote every branch SHA; +all prior GitHub/CodeRabbit results are historical. The rebased candidate has +now passed exact-SHA internal review and evidence rebinding; it must still be +force-pushed and pass fresh final-head external checks. + +On prior pushed head `8f12f656`, GitHub Backend and Agent Gates passed, and +CodeRabbit passed with one actionable source-manifest finding: a historical +PLAN2 AUTH-09D-A/`0026` review-base sentence could be mistaken for the later +parent 02A start. The repair labels that snapshot as historical and restates the +full 02A trusted-main SHA, `0027_contributor_foundation` head, and +then-current-head child allocation rule. +Fresh deterministic and internal review evidence passes for the repaired +candidate. At evidence head `ebb8db88`, Agent Gates passed, Backend remained +pending, and CodeRabbit's evidence-status comment required this repair. Merge is +blocked until all GitHub and CodeRabbit checks pass on the final pushed head with +no unresolved actionable comment. Human review remains pending. +On the ART-rebased head, CodeRabbit also found that the Revision-context +conformance row omitted deferred owner 02A2. The row now includes 02A2 and its +prepared `If-Match`-protected superseded-guide reactivation proof; runtime and +the explicit-start gate are unchanged. Exact-SHA internal review and evidence +rebinding pass for that repaired candidate. + +## Remaining risks + +Historical chronology or Task context ambiguity must fail closed in future +migrations. ART's generic admission foundation is merged, while remaining ART +review capabilities and CON capabilities remain dependency-owned future work. All +24 planned REV action dependencies remain unavailable. Later duration and human +revision exhaustion semantics still require explicit human decisions. + +## Follow-up work + +After merge, automated loop memory may name 02A1 with an explicit-start gate. +02A1 must refresh trusted main, the complete writer inventory, migration head, +plan review, and reviewer routing before any implementation. 02A3, 02A4, 02A2, +and 02B remain separately gated successors. + +## Human review focus + +Review the split boundaries and order, complete writer-fence inventory, +canonical-human ownership, immutable chronology, migration refusal/downgrade +safety, Task triplet integrity, and the absence of runtime changes. + +## Human merge ownership + +Only the user may approve and merge this specific PR. Merge does not authorize +02A1 or any other runtime implementation. Do not merge while any current-head +GitHub or CodeRabbit check is pending or failed, or while an actionable review +comment remains unresolved. diff --git a/.agent-loop/merge-intents/WS-REV-001-02A.json b/.agent-loop/merge-intents/WS-REV-001-02A.json new file mode 100644 index 000000000..67141704b --- /dev/null +++ b/.agent-loop/merge-intents/WS-REV-001-02A.json @@ -0,0 +1,9 @@ +{ + "chunk_id": "WS-REV-001-02A", + "chunk_title": "Guide Chronology And Task Locking Split", + "initiative_id": "WS-REV-001", + "next_chunk_id": "WS-REV-001-02A1", + "next_chunk_title": "Project And Setup Publication Fence", + "next_requires_explicit_start": true, + "schema_version": 2 +}