docs(auth): split project role grant delivery

.agent-loop/REVIEW_LOG.md

@@ -2719,3 +2719,36 @@ any branch-policy-required renewed approval remain after publication.
 The later documentation-only audit reconciliation is reviewed independently and
 bound by the chunk's internal-review evidence; it does not replace `acc15aa5` as
 the canonical implementation and closeout evidence head.
+## 2026-07-21 - WS-AUTH-001-10 Internal Plan Review
+
+The inherited combined AUTH-10 runtime contract failed L1 plan review because
+it mixed migration/evidence, privacy-sensitive reads, and PREP-bound mutations.
+The user approved a sequential 10A/10B/10C design. The repaired plan freezes
+independent submitter/reviewer/adjudicator grants, exact API and privacy shapes,
+deterministic lock/replay behavior, migration refusal predicates, and planned
+catalogue/evidence custody without activating a route or changing runtime.
+
+Planning candidate `ca52fd6a6c51f78b3e3a10faf77f4ab235843ad2` passes
+senior engineering, QA/test, security/auth, product/ops, architecture, CI
+integrity, docs, reuse/dedup, and test-delta review with no open finding. Stale
+authorization wording, Markdown links, merge-intent validation, and diff
+integrity pass. GitHub Agent Gates, CodeRabbit, and human review remain; 10A
+requires a separate signed start after this planning parent merges.
+
+## 2026-07-21 - WS-AUTH-001-10 External Gate Repair
+
+PR #168 preflight rejected a noncanonical internal-evidence SHA heading, while
+Agent Gates rejected branch-local live state in AUTH `STATUS.md`. The repair
+uses the required `Reviewed code SHA` provenance label and restores the authored
+status file to trusted-main state; signed automation remains the sole owner of
+live active/review projection. The Backend aggregate failure was consequential:
+preflight blocked shards and API E2E, so no runtime test failed. All 88 Agent
+Gate regression tests pass locally. Exact-SHA internal repair review, an
+evidence-only binding descendant, fresh GitHub checks, and CodeRabbit remain.
+
+CodeRabbit later posted five valid planning/specification findings. The repair
+adds review-log scope to the parent contract, persists the exact active-1/
+revoked-2 grant version, keeps child actions planned until their owning child
+activates them with routes, records the complete PREP/idempotency/advisory-lock
+issue order, and makes `/api/v1` the sole endpoint namespace. Exact-SHA internal
+review and fresh external checks remain.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md

@@ -40,7 +40,10 @@ stopped.
 | `WS-AUTH-001-ART-CUSTODY` | ART Activation Custody Transfer | L1 | Merged through PR #158 as `be2a79a2`; all 25 ART actions remain planned |
 | `WS-AUTH-001-REV-CUSTODY` | REV Activation Custody Transfer | L1 | Merged through PR #160 as `fe0e4492`; all 19 REV actions remain planned |
 | `WS-AUTH-001-PREP` | Prepared Mutation Authorization Protocol | L1 | Merged through PR #162 as `c559d556`; no feature consumer or activation |
-| `WS-AUTH-001-10` | Project Qualification And Contributor Role Grants | L1 | Proposed |
+| `WS-AUTH-001-10` | Project Qualification And Contributor Role Grants | L1 | Active planning-only parent; split approved after failed L1 combined review |
+| `WS-AUTH-001-10A` | Project Role Grant Data And Evidence Foundation | L1 | Proposed successor; migration `0031`, no active surface |
+| `WS-AUTH-001-10B` | Project Role Grant Read And Candidate Surfaces | L1 | Proposed after 10A |
+| `WS-AUTH-001-10C` | Project Role Grant Mutations | L1 | Proposed after 10B |
 | `WS-AUTH-001-11` | Project Identity, Guide, Source, And Visibility Cutover | L1 | Proposed |
 | `WS-AUTH-001-12` | Project Policy And Setup Mutation Cutover | L1 | Proposed |
 | `WS-AUTH-001-13` | Task Management And Assignment Cutover | L1 | Proposed |
@@ -103,6 +106,9 @@ WS-AUTH-001-PLAN
 -> WS-AUTH-001-ART-CUSTODY and WS-AUTH-001-REV-CUSTODY
 -> WS-AUTH-001-PREP
 -> WS-AUTH-001-10
+-> WS-AUTH-001-10A
+-> WS-AUTH-001-10B
+-> WS-AUTH-001-10C
 -> WS-AUTH-001-11
 -> WS-AUTH-001-12
 -> WS-AUTH-001-13

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md

@@ -684,3 +684,35 @@ The foundation allocates only the then-current next migration from trusted
 `main`. This decision supersedes only the future fixed-number reservation
 clauses in D29, D30, and earlier decisions; their other boundaries remain in
 force. Merged migration ownership through AUTH-09D-A `0026` is unchanged.
+## D32: Split project-role truth, reads, and mutations
+
+Status: accepted by the user on 2026-07-21 after required AUTH-10 L1 plan
+review rejected the combined runtime boundary.
+
+AUTH-10 is a planning-only parent and splits into exactly three sequential
+same-initiative children. AUTH-10A owns migration
+`0031_project_role_grants`, the immutable qualification/grant aggregates, and
+the typed/PostgreSQL three-role evidence clean cut. It registers all five
+project-role actions as planned with exact AUTH-10B/AUTH-10C owners but activates
+no action or route. AUTH-10B owns activation of exactly the candidate,
+grant-list, and grant-detail read actions and privacy-safe pagination. AUTH-10C
+owns activation of exactly issue and revoke,
+multi-principal PREP ordering, idempotency, audit, invalidation, and mutation
+concurrency. Each child requires a separate signed start and stop.
+
+The project roles are independent `submitter`, `reviewer`, and `adjudicator`
+rows. `both`, replacement, automated issuance, conversion, and one-active-role-
+total semantics are removed from current contracts. Discovery and issuance are
+allowed only for draft, active, and paused projects. Historical grant reads and
+revocation remain possible for every existing project state so evidence cannot
+be hidden and authority cannot become irremovable.
+
+The current trusted-main Alembic head is `0030`; this decision assigns `0031`
+only to AUTH-10A and supersedes every older inactive AUTH-10 migration-number
+reservation in D21, D27, D28, D29, and D30. Historical migration ownership is
+unchanged.
+
+`GET /api/v1/actors/me/authorization-context` moves to AUTH-11. AUTH-10B does
+not expose a context that advertises still-inactive project/task/review actions;
+AUTH-11 must enumerate that surface with its exact ActionId, target, guards,
+and disclosure contract before implementation.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DISCOVERY.md

@@ -3,6 +3,46 @@
 Discovery is read-only. No application code was changed while producing this
 artifact.
 
+## AUTH-10 delta discovery - 2026-07-21
+
+Trusted `main` is `5a8a924d`; Alembic head is
+`0030_artifact_verification_fencing`, making `0031` the only current migration
+candidate. PREP is merged and supports actor-self plus active administrative
+mutations, but deliberately rejects ProjectRoleGrant preparation because no
+project grant table, resource context, or evaluator branch exists.
+
+The permission catalogue already contains `project.role_grant.read` and
+`project.role_grant.manage`. Project Manager has both permissions and may be
+system- or exact-project-scoped; Audit Authority has read only. No matching
+ProjectRoleGrant ActionIds or owner exist. Five surfaces therefore require five
+new action declarations: candidate list, grant list, grant detail, issue, and
+revoke. The existing authorization router is mounted directly under
+`/api/v1`, and AdminRoleGrant routes provide the closest route/idempotency/audit
+convention, but AUTH-10 mutations must use PREP rather than copying their older
+single-phase `require()` flow.
+
+`ActorProfile` already contains the only candidate fields AUTH-10 may expose:
+canonical ID and nullable display name. It also contains contact and lifecycle
+metadata that candidate responses must not disclose. `ActorIdentityLink` is
+one-to-one and supplies the active-link eligibility predicate without exposing
+issuer, subject, or link metadata. `ProjectRepository.get_project(...,
+for_update=...)` is the canonical project loader; AUTH must not add a duplicate
+project repository.
+
+Typed audit/idempotency foundations already reserve project issue/revoke
+operations, but still admit superseded `both`, `ProjectRoleGrantReplaced`, and
+replacement evidence. AUTH-10 must replace those current validators in typed
+code and migration `0031`, while leaving historical migrations immutable and
+refusing unsafe upgrade/downgrade rather than converting evidence.
+
+The inherited contract combined schema, five active routes, candidate privacy,
+PREP extension, idempotency, audit/invalidation, concurrency, and migration
+round-trip proof without the D27 surface inventory. Required L1 review rejected
+that combined boundary and identified crossed-manager lock ordering, replay,
+privacy-shape, lifecycle, reference-spec, and local-versus-hosted proof gaps.
+The user approved the resulting 10A durable-truth, 10B read, and 10C mutation
+split on 2026-07-21. D32 records the exact boundaries and successor order.
+
 ## AUTH-09 delta discovery - 2026-07-16
 
 Merged AUTH-08 provides `AuthorityControl`, immutable AdminRoleGrants, seven

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/INTENT.md

@@ -163,6 +163,10 @@ Resolved:
   on 2026-07-11 after planning and post-merge memory closed.
 - D20-D22 establish service ActorProfiles, independent three-role project
   grants, and fixed service runtime admission.
+- D32 records the user-approved AUTH-10A/10B/10C split: durable truth first,
+  privacy-safe reads second, and PREP-bound mutations third. It assigns current
+  migration `0031` to 10A and defers actor authorization-context disclosure to
+  AUTH-11.
 
 External deployment details such as issuer URL, JWKS URL, approved algorithms,
 claim names, and introspection policy are configuration inputs. Their absence

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/PLAN.md

@@ -191,9 +191,12 @@ proving the same issuer role metadata alone no longer authorizes.
 11. Transfer all current ART/REV owner labels to exact AUTH custodians without
     changing availability, then add the prepared mutation authorization
     protocol.
-12. Implement qualification snapshots and independent contributor grants scoped
-    to the exact project, including the typed/PostgreSQL clean cut from `both`
-    and replacement evidence.
+12. Close planning parent AUTH-10, then deliver project-role authority in three
+    separately started children: 10A establishes migration `0031`, immutable
+    snapshots/grants, the typed/PostgreSQL three-role clean cut, and all five
+    planned action rows with exact 10B/10C owners but no active surface; 10B
+    activates candidate/list/detail reads; 10C activates PREP-bound
+    issue/revoke mutations and concurrency proof.
 13. Cut project identity, guide, source, and visibility queries over to local
    permissions.
 14. Cut project policy mutations, approvals, activation, and setup operations