AUTH-09E: admit fixed services at runtime

.agent-loop/LOOP_STATE.md

@@ -19,10 +19,9 @@
 - AUTH-09C merged through PR #146 as `0ffdabf`; signed schema-v2 memory at
   `eeb3dc2` recorded its two administrative reads and stopped.
 - PR #141 merged `WS-ART-001-02A3` into `main` as `a10d901` on 2026-07-18.
-  PR #151 then merged `WS-ART-001-02B1` as `1b5422f` on 2026-07-19;
-  the user then explicitly started ART-02C1.
-- Active ART implementation chunk: `WS-ART-001-02C1` on
-  `codex/ws-art-001-02c1-admission-put-attempt`.
+  PR #151 then merged `WS-ART-001-02B1` as `1b5422f`, and PR #154 merged
+  `WS-ART-001-02C1` as `44f2467c` on 2026-07-19 with ART-owned migration
+  `0028_artifact_admission`.
 - The ART worktree consumes merged AUTH, REV, and CON contracts without
   editing or activating their independently owned runtime behavior.
 - AUTH-09D-A merged through PR #148 as `99ae4c9`; signed schema-v2 memory at
@@ -37,18 +36,14 @@
 - PR #122 merged the first automated post-merge memory implementation as
   `fc89fb6`; its schema-v1 cross-initiative next pointer is superseded by the
   schema-v2 initiative-local clean cut.
-- Active implementation chunk: `WS-AUTH-001-CONTRIBUTOR-FOUNDATION`, explicitly
-  started by the user on 2026-07-19 from trusted `main` at `93dd392`. Current
-  exact contract `2a21166d` passed required L1 preimplementation review;
-  initial findings are repaired, and exact code SHA `4d1fc507` passed all nine
-  required internal tracks. PR publication and external checks are the current
-  gate; Backend must still prove 78/90 percent aggregate coverage. It changes no action
-  availability, and no service caller becomes executable before AUTH-09E.
-- Current ART gate: integrate trusted `main`, complete deterministic 02C1
-  proof, and pass all nine exact-SHA internal reviewer tracks. Those steps are
-  complete; publish the final candidate to existing PR #154, then pass fresh
-  external checks and explicit human review. No later ART chunk starts
-  automatically.
+- PR-gate chunk: `WS-AUTH-001-09E`, explicitly started by the
+  user on 2026-07-19 from trusted `main` at `8d5eb15b` after contributor
+  foundation PR #153 and signed memory `66ab58d`. Its refreshed contract passed
+  all nine required L1 preimplementation tracks after resolving context,
+  feature-boundary, transaction, verification, coverage, docs, and reuse
+  findings. Runtime implementation, focused evidence, and all nine internal
+  reviewer tracks pass after repair; hosted Backend CI and human review are the
+  current gates. No feature action or call site becomes active in this chunk.
 - Scope checkpoint: AWS S3 is the only v0.1 production provider; MinIO is
   local/CI S3 protocol proof; LocalStorage is focused development/test; R2 and
   Flow Node are deferred. Product modules receive narrow artifact capabilities,
@@ -65,12 +60,13 @@
   AUTH planning requires availability-neutral ART custody transfer, fixed-service
   admission, prepared mutation authority, and exact AUTH-only activation chunks;
   neither reconciliation PR activates feature behavior.
-- Parallel artifact checkpoint: ART-02A1, ART-02A2, ART-02A3, and ART-02B1
-  merged through PRs #127, #129, #141, and #151. ART-02C1 is active and adds
-  only durable admission plus prepared put-attempt state before provider I/O.
-- Authorization checkpoint: AUTH-07B through AUTH-09D-B and the contributor
-  foundation merged through PRs #130, #131, #132, #143, #146, #148, #152,
-  and #153. AUTH-09E remains inactive.
+- Parallel artifact checkpoint: ART-02A1 through ART-02C1 merged through PRs
+  #127, #129, #141, #151, and #154. ART-02C1 owns durable admission, prepared
+  put-attempt state, and migration `0028_artifact_admission`.
+- Authorization checkpoint: AUTH-07B through AUTH-09D-B merged through PRs
+  #130, #131, #132, #143, #146, #148, and #152. Contributor foundation PR #153
+  merged as `8d5eb15b`; AUTH-09E is now the sole active AUTH implementation
+  chunk.
 - Parallel coverage work: `WS-QUAL-001-01B2` remains paused. Its last official
   whole-app result is `6466/8159` statements (`79.249908%`); no replacement
   evidence exists.

.agent-loop/REVIEW_LOG.md

@@ -1,5 +1,65 @@
 # Review Log
 
+## 2026-07-20 - WS-AUTH-001-09E External Review Repair
+
+CodeRabbit raised two valid findings. The specification now says the service
+variant carries a “required, closed” identity. The serialized human
+administrative path now checks the locked profile remains human before
+reconstructing `HumanAuthorizationContext`; kind drift returns bounded
+`permission_not_granted` evidence and performs no grant lookup. Ruff and 11
+focused authorization tests pass. The repair requires fresh exact-SHA internal
+review, evidence rebinding, hosted CI, and CodeRabbit re-review before human
+merge review.
+
+## 2026-07-19 - WS-AUTH-001-09E Integrated Review Passed
+
+Trusted main advanced through ART PR #154 as `44f2467c`, bringing ART-owned
+`0028_artifact_admission` and a strict artifact-admission boundary. Merge
+candidate `d2d974eb` passed senior and QA integration review but security found
+that ART's exact check against the former concrete `AuthorizationContext` could
+never accept AUTH-09E's closed human/service union. Integrated candidate
+`98376fd1` accepts only the two exact concrete context types, updates the test
+fixture to construct the matching discriminated context, and changes no
+artifact lifecycle, persistence, capacity, provider I/O, or action availability.
+Four isolated PostgreSQL admission tests, Ruff, diff integrity, and all 88 agent
+gates pass. Senior engineering, QA/test, security/auth, product/ops,
+architecture, CI integrity, reuse/dedup, and test-delta review pass; the stale
+pre-ART-merge documentation finding was then repaired. AUTH-09E adds or
+allocates no migration after ART's merged `0028`.
+
+## 2026-07-19 - WS-AUTH-001-09E Implementation Review Passed
+
+Exact implementation SHA `881ac7fc` and documentation repair `d859af3d` passed
+senior engineering, QA/test, security/auth, product/ops, architecture, CI
+integrity, docs, reuse/dedup, and test-delta review after every valid finding
+was repaired. Initial candidate `65ee8887` incorrectly staged observations for
+inactive service rows and lacked direct real-callback drift proof. The repair
+gates timestamp observation on active profile/link state and proves locked
+lifecycle, identity, matrix, and availability drift denial. One stale
+pre-09E operations sentence and the human-only dependency docstring were also
+corrected. Focused PostgreSQL and HTTP evidence passes; GitHub Backend remains
+the authoritative full-suite coverage gate. No migration is added or allocated;
+ART owns merged migration `0028_artifact_admission`.
+
+## 2026-07-19 - WS-AUTH-001-09E Preimplementation Review Passed
+
+- The user explicitly started AUTH-09E from trusted `main` `8d5eb15b` after
+  contributor foundation PR #153 and signed memory `66ab58d` completed.
+- Initial review rejected missing deterministic verification commands and an
+  acceptance criterion that overclaimed feature-owned locked resource
+  recomposition while feature call sites were forbidden.
+- The repaired contract defines a discriminated human/service context union,
+  exact ActionId matrix-before-availability dispatch, one AUTH-owned
+  transaction-local service revalidation seam, rollback-safe observations,
+  separate 90 percent actor/authorization/dependency coverage, and explicit
+  feature-boundary, privacy, cancellation, and persistence-failure proof.
+- Senior engineering, QA/test, security/auth, product/ops, architecture, CI
+  integrity, docs, reuse/dedup, and test-delta tracks passed. Implementation may
+  begin for AUTH-09E only; no feature action or call site may activate.
+- The human confirmed ART owns migration `0028`. AUTH-09E contains no migration
+  and allocates no revision; later AUTH migration work must wait for the ART PR
+  to merge and then allocate from trusted main.
+
 ## 2026-07-19 - WS-AUTH-001-CONTRIBUTOR-FOUNDATION Internal Review Passed
 
 - Exact code SHA `4d1fc507c343d483677a332c2a91885e32571693` passed senior,

.agent-loop/WORK_QUEUE.md

@@ -4,8 +4,7 @@
 
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
-| `WS-AUTH-001-CONTRIBUTOR-FOUNDATION` | Contributor Fields And Canonical-Human Lineage | L1 | Internal review passed at `4d1fc507`; PR/external checks pending; aggregate coverage mandatory in Backend |
-| `WS-ART-001-02C1` | Admission And Put-Attempt Foundation | L1 | Active after PR #151 and explicit user start; implementation and deterministic proof in progress |
+| `WS-AUTH-001-09E` | Fixed Service Runtime Admission | L1 | Runtime, focused evidence, and all nine internal tracks pass after repair; hosted Backend CI and human review remain |
 
 Live post-merge state remains read from signed `automation/loop-memory`
 output. This authored queue records the separately approved parallel chunks.
@@ -15,17 +14,17 @@ output. This authored queue records the separately approved parallel chunks.
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
 | `WS-QUAL-001-01B2` | Baseline Evidence And CI Ratchet | L1 | Paused for AUTH priority; no valid replacement baseline yet |
-| `WS-AUTH-001-09E` | Fixed Service Runtime Admission | L1 | Inactive until contributor-foundation merge/memory and explicit user start |
 | `WS-QUAL-001-02` | Project Service Coverage | L1 | Inactive until 01B2 merge/memory plus explicit user start |
 | `WS-POL-002-04` | Locked Runtime Execution And Routing Hardening | L1 | Inactive pending relevant authorization proof and a separate explicit user start |
-| `WS-ART-001-02C2` | Verification Publication And Fencing | L1 | Inactive until 02C1 merge and explicit user start |
+| `WS-ART-001-02C2` | Verification Publication And Fencing | L1 | 02C1 merged; inactive until explicit user start |
 | `WS-ART-001-02C3` | Recovery Attempt And Idempotency Chain | L1 | Inactive until 02C2 merge and explicit user start |
 | `WS-ART-001-02D` | Operator Artifact Operations And AWS Readiness | L1 | Inactive until 02C3 and exact AUTH prerequisites |
 
 ## Completed
 
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
+| `WS-ART-001-02C1` | Admission And Put-Attempt Foundation | L1 | Merged through PR #154 as `44f2467c` on 2026-07-19 |
 | `WS-ART-001-02B1` | S3-Compatible MinIO And AWS | L1 | Merged through PR #151 as `1b5422fc` on 2026-07-19 |
 | `WS-AUTH-001-09D-A` | Profile Lifecycle And Evidence Repair | L1 | Merged through PR #148 as `99ae4c9` on 2026-07-18 |
 | `WS-AUTH-001-09C` | Actor And Identity-Link Administration Reads | L1 | Merged through PR #146 as `0ffdabf` on 2026-07-18 |

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md

@@ -35,8 +35,8 @@ stopped.
 | `WS-AUTH-001-09D` | Actor And Identity-Link Lifecycle Mutations | L1 | Split before runtime implementation into 09D-A and 09D-B |
 | `WS-AUTH-001-09D-A` | Profile Lifecycle And Evidence Repair | L1 | Merged through PR #148 as `99ae4c9`; signed memory `cf8a3e8` passed |
 | `WS-AUTH-001-09D-B` | Identity-Link Lifecycle And Race Closure | L1 | Merged through PR #152 as `93dd392`; signed memory `912a6254` passed |
-| `WS-AUTH-001-CONTRIBUTOR-FOUNDATION` | Contributor Fields And Canonical-Human Lineage | L1 | Internal review passed at `4d1fc507`; PR/external checks pending; Backend coverage mandatory |
-| `WS-AUTH-001-09E` | Fixed Service Runtime Admission | L1 | Inactive until contributor-foundation merge/memory and explicit start |
+| `WS-AUTH-001-CONTRIBUTOR-FOUNDATION` | Contributor Fields And Canonical-Human Lineage | L1 | Merged through PR #153 as `8d5eb15b`; signed memory `66ab58d` passed and stopped |
+| `WS-AUTH-001-09E` | Fixed Service Runtime Admission | L1 | Runtime, focused evidence, and all nine internal tracks pass after repair; hosted Backend CI and human review remain |
 | `WS-AUTH-001-ART-CUSTODY` | ART Activation Custody Transfer | L1 | Inactive until 09E merge/memory and explicit start |
 | `WS-AUTH-001-REV-CUSTODY` | REV Activation Custody Transfer | L1 | Inactive until 09E merge/memory and explicit start |
 | `WS-AUTH-001-PREP` | Prepared Mutation Authorization Protocol | L1 | Inactive until 09E merge/memory and explicit start |

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md

@@ -115,15 +115,14 @@ None. `WS-AUTH-001-XINT` merged through PR #140.
 
 ## Active implementation chunk
 
-`WS-AUTH-001-CONTRIBUTOR-FOUNDATION` - Contributor Fields And Canonical-Human
-Lineage. Explicitly started from trusted `main` at `93dd392`; exact contract
-`2a21166d` passed required L1 review. Internal review passed at code SHA
-`4d1fc507`; PR/external checks are current and aggregate coverage is mandatory
-in Backend.
+`WS-AUTH-001-09E` - Fixed Service Runtime Admission. Explicitly started from
+trusted `main` at `8d5eb15b`; the refreshed contract passed all nine required
+L1 preimplementation tracks. Runtime implementation is active and changes no
+feature action availability.
 
 ## Current review branch
 
-`codex/ws-auth-001-contributor-foundation`
+`codex/ws-auth-001-09e-fixed-service-runtime-admission`
 
 ## Chunk status
 
@@ -153,8 +152,8 @@ in Backend.
 | `WS-AUTH-001-09D` | Split | `codex/ws-auth-001-09d-actor-identity-lifecycle` | - | Required L1 review rejected the combined contract before runtime edits. |
 | `WS-AUTH-001-09D-A` | Merged | `codex/ws-auth-001-09d-actor-identity-lifecycle` | #148 | Merged as `99ae4c9`; signed memory `cf8a3e8` passed and stopped. |
 | `WS-AUTH-001-09D-B` | Merged | `codex/ws-auth-001-09d-b-identity-link-lifecycle` | #152 | Merged as `93dd392`; signed memory `912a6254` passed and stopped. |
-| `WS-AUTH-001-CONTRIBUTOR-FOUNDATION` | PR ready | `codex/ws-auth-001-contributor-foundation` | - | Internal review passed at `4d1fc507`; PR/external checks pending; Backend coverage mandatory. |
-| `WS-AUTH-001-09E` | Proposed | - | - | Fixed service runtime admission after the contributor foundation. |
+| `WS-AUTH-001-CONTRIBUTOR-FOUNDATION` | Merged | `codex/ws-auth-001-contributor-foundation` | #153 | Merged as `8d5eb15b`; signed memory `66ab58d` passed and stopped. |
+| `WS-AUTH-001-09E` | PR gate | `codex/ws-auth-001-09e-fixed-service-runtime-admission` | - | Runtime, focused evidence, and all nine internal tracks pass after repair; hosted Backend CI and human review remain. |
 | `WS-AUTH-001-ART-CUSTODY` | Proposed | - | - | Availability-neutral 25-row ART owner transfer after 09E. |
 | `WS-AUTH-001-REV-CUSTODY` | Proposed | - | - | Availability-neutral 19-row REV owner transfer after 09E. |
 | `WS-AUTH-001-PREP` | Proposed | - | - | AUTH-first prepared mutation protocol after 09E. |
@@ -182,7 +181,13 @@ required L1 track. Initial implementation candidate `e41c33c0` failed privacy,
 proof, docs, and evidence review. Bounded repair and deterministic evidence are
 complete; exact code SHA `4d1fc507` passed all nine internal tracks. PR/external
 checks are current and aggregate coverage remains mandatory in Backend.
-AUTH-09E remains inactive behind that foundation.
+The user explicitly started AUTH-09E after contributor foundation PR #153 and
+signed memory completed. Its first preimplementation review rejected missing
+verification commands and an overbroad feature-resource revalidation claim.
+The refreshed contract limits this chunk to AUTH-owned service authority
+resolution/revalidation, defers feature-row recomposition to later activation
+chunks, and passed all nine required L1 tracks. Runtime implementation is
+active; all feature actions remain planned.
 
 The four proposed REV lifecycle actions and review-evidence binding action are
 blocked on complete feature-owned typed manifests. REV fixed services are also