docs(auth): split project mutation cutover plan

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md

@@ -54,9 +54,19 @@ stopped.
 | `WS-AUTH-001-11` | Project Read Cutover Planning Parent | L1 | Signed start run `30167274426`; planning split authored, no runtime implementation |
 | `WS-AUTH-001-11A` | Project Read Catalogue And Projection Foundation | L1 | Merged in PR #208; migration `0035`, no active surface |
 | `WS-AUTH-001-11B` | Project Identity And Actor Context Cutover | L1 | Merged in PR #214 as `033654ac` |
-| `WS-AUTH-001-11C1` | Project Setup Diagnostic Read Cutover | L1 | Active bounded implementation after passed L1 plan review |
-| `WS-AUTH-001-11C2` | Effective Policy And Active Guide Read Cutover | L1 | Proposed after 11C1 |
-| `WS-AUTH-001-12` | Project Policy And Setup Mutation Cutover | L1 | Proposed |
+| `WS-AUTH-001-11C1` | Project Setup Diagnostic Read Cutover | L1 | Merged in PR #216 as `2965a9f9` |
+| `WS-AUTH-001-11C2` | Effective Policy And Active Guide Read Cutover | L1 | Merged in PR #221 as `3fc323d7` |
+| `WS-AUTH-001-12` | Project Mutation Cutover Planning Parent | L1 | Split before runtime implementation after failed L1 review |
+| `WS-AUTH-001-12A` | Project Mutation Catalogue And PREP Foundation | L1 | Proposed after planning merge; ART-owned `0040` prerequisite satisfied |
+| `WS-AUTH-001-12B` | Fixed Project Setup Service Foundation | L1 | Proposed after 12A; zero activation |
+| `WS-AUTH-001-12B2` | Project Setup Service Runtime Cutover | L1 | Proposed after 12E, 12F, and 12G |
+| `WS-AUTH-001-12C` | Project Creation Cutover | L1 | Proposed after 12B |
+| `WS-AUTH-001-12D` | Draft Guide And Source Metadata Cutover | L1 | Proposed after 12C |
+| `WS-AUTH-001-12D2` | Review And Revision Policy Mutation Separation | L1 | Proposed after 12D; economic policy remains CON-owned |
+| `WS-AUTH-001-12E` | Guide Sufficiency Mutation Cutover | L1 | Proposed after 12D2 |
+| `WS-AUTH-001-12F` | Submission Artifact Policy Mutation Cutover | L1 | Proposed after 12E |
+| `WS-AUTH-001-12G` | Post-Submit Checker Policy Mutation Cutover | L1 | Proposed after 12F |
+| `WS-AUTH-001-12H` | Guide Activation Cutover | L1 | Proposed after 12B2 and the owning CON clean cut |
 | `WS-AUTH-001-13` | Task Management And Assignment Cutover | L1 | Proposed |
 | `WS-AUTH-001-14` | Submission, Checker, And Audit Visibility Cutover | L1 | Proposed |
 | `WS-AUTH-001-15` | Remaining Internal Service Cutover And Obsolete Authority Removal | L1 | Proposed |
@@ -127,6 +137,16 @@ WS-AUTH-001-PLAN
 -> WS-AUTH-001-11C1
 -> WS-AUTH-001-11C2
 -> WS-AUTH-001-12
+-> WS-AUTH-001-12A
+-> WS-AUTH-001-12B
+-> WS-AUTH-001-12C
+-> WS-AUTH-001-12D
+-> WS-AUTH-001-12D2
+-> WS-AUTH-001-12E
+-> WS-AUTH-001-12F
+-> WS-AUTH-001-12G
+-> WS-AUTH-001-12B2
+-> WS-AUTH-001-12H
 -> WS-AUTH-001-13
 -> WS-AUTH-001-14
 -> WS-AUTH-001-15
@@ -169,7 +189,13 @@ WS-AUTH-001-PLAN
   and 11C2 effective policy/guide reads. 11A activates no surface. Runtime
   children 11B, 11C1, and 11C2 each make local grants the sole authority for
   their complete surface family; no compatibility path remains.
-- Chunks 12-15 migrate bounded complete product/system surfaces.
+- Parent 12 is planning-only. Its ten ordered children separately establish
+  mutation catalogue/PREP contracts, fixed setup-service authority, project
+  creation, draft guide/source metadata, separately authorized guide-bound
+  review/revision policies, sufficiency, submission-artifact policy,
+  post-submit checker policy, final setup-service runtime cutover, and terminal
+  guide activation. Chunks
+  13-15 then migrate their bounded complete product/system surfaces.
 - Artifact upload, read, retention, release/delete, replication, integrity, and
   reconciliation remain mechanically owned by the artifact subsystem but must
   receive centralized AUTH decisions. Chunk 07A owns the permission/action

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md

@@ -777,3 +777,37 @@ active-guide view. Contributors do not receive diagnostic/policy access from
 never token roles. This preserves the operating requirement that Operator and
 Audit inspect setup through authorized API projections rather than direct
 database access without conflating read authority with management.
+
+## D35: Split AUTH-12 before project-mutation runtime implementation
+
+Status: accepted required L1 preimplementation repair on 2026-07-29 after all
+nine exact-plan reviewer tracks passed.
+
+Architecture, security, product, QA, senior-engineering, and CI review rejected
+the inherited combined AUTH-12 contract before application-code edits. It
+combined route and setup-service actions, fixed-service provisioning, PREP
+extension, provenance schema, agent rollback boundaries, and terminal guide
+activation without enumerating actions or resource contexts.
+
+AUTH-12 is now a planning-only parent. 12A owns the planned catalogue, typed
+resource/PREP contracts, and action-evidence parity; 12B owns the fixed project
+setup identity with zero activation; 12C owns system-scoped project creation;
+12D owns draft guide and source metadata; 12D2 separates review/revision policy
+authority while retired economic policy remains CON-owned; 12E owns
+sufficiency; 12F owns submission-artifact policy;
+12G owns post-submit checker-policy derivation/approval/correction; 12B2 owns
+the final Celery runtime cutover; and 12H owns terminal guide activation. No
+child may accept issuer claims or a generic policy resource.
+
+The active `artifact.guide_source.ingest` boundary remains owned by
+`WS-XINT-002-04A`. AUTH-12 does not reactivate or alter it. Concurrent ART-03B2
+owns migration `0040`; AUTH allocates its next migration only after that work
+merges. Prepared handles never cross rollback, commit, external agent work,
+Celery, serialization, session, or transaction boundaries.
+
+D35 supersedes every prior future AUTH-12 migration-number allocation. AUTH-12
+allocates only after merged ART `0040` from trusted main.
+
+The stale-authorization scanner has one full-line exemption for 12B2's literal
+project-setup Celery module path. It does not exempt narrative text, authority claims,
+any other path, or any other rule.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DISCOVERY.md

@@ -3,6 +3,34 @@
 Discovery is read-only. No application code was changed while producing this
 artifact.
 
+## AUTH-12 exact mutation delta — 2026-07-29
+
+Trusted main after AUTH-11C2 is `3fc323d7`. The project router has fourteen
+human mutation routes in AUTH-12 scope plus two internal Celery setup commands.
+None has a mutation `ActionId`; human routes still enter through
+the legacy registered-actor dependency and role-claim helper. The Celery setup
+service fabricates an `ActorContext` carrying obsolete human management roles,
+and no fixed project-setup service identity exists.
+
+The merged PREP implementation supports existing administrative/project-role
+mutations and selected ART actions, but has no project create, guide,
+source-snapshot, sufficiency, project-policy, setup-run, or activation resource
+contexts. Agent-backed commands roll back before external work, so an opaque
+prepared handle cannot span their external call; final persistence needs a
+fresh transaction and fresh PREP consumption after stale-output revalidation.
+
+Current trusted-main migration head is ART-owned
+`0040_guide_materialization`. AUTH-12 does not allocate `0040`; its first
+schema child allocates the next revision from this merged head.
+
+Required architecture, security, product, QA, senior, and CI plan reviews all
+rejected the inherited combined runtime contract before code. It lacked the
+exact action/resource table, combined unrelated mutation families, misstated
+the already-active XINT guide-ingest boundary, used stale database verification
+environment variables, omitted changed-project coverage, and did not define
+service identity, provenance columns, PREP lock order, denial semantics, or
+external-work transaction breaks. D35 records the planning-only split.
+
 ## AUTH-10 delta discovery - 2026-07-21
 
 Trusted `main` is `5a8a924d`; Alembic head is

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/PLAN.md

@@ -203,8 +203,13 @@ proving the same issuer role metadata alone no longer authorizes.
     10C activates PREP-bound issue/revoke mutations and concurrency proof.
 13. Cut project identity, guide, source, and visibility queries over to local
    permissions.
-14. Cut project policy mutations, approvals, activation, and setup operations
-    over to local permissions.
+14. Treat AUTH-12 as a planning-only parent. Its ordered children register
+    exact mutation/PREP contracts, establish a zero-activation fixed setup
+    identity, cut project/guide/sufficiency/policy families separately, leave
+    retired guide-bound economic policy to CON ownership, cut the Celery call
+    graph only after its product actions are active, and finish with guide
+    activation only after the owning CON clean cut. ART-owned `0040` is now
+    merged; the first AUTH migration is allocated from that trusted head.
 15. Cut task management, queue, assignment, claim, and start operations over.
 16. Cut submission, pre-submit, checker trigger/read, and task audit visibility
     over.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/RISKS.md

@@ -1,5 +1,20 @@
 # Risks: WS-AUTH-001 - Workstream Authorization Service
 
+## AUTH-12 planning risks — 2026-07-29
+
+- Guide create/update currently co-mutate review, revision, and retired
+  economic-policy fields. 12D removes them; 12D2 restores only separately
+  authorized review/revision configuration while economic policy remains
+  CON-owned.
+- Agent-backed setup operations deliberately break transactions around external
+  work. Carrying PREP across that boundary would make stale authority usable;
+  runtime children require fresh terminal authorization.
+- The Celery setup service currently fabricates human roles. 12B provisions one
+  exact fixed identity with four planned memberships; 12B2 performs the runtime
+  cut only after 12E/12F/12G own the product actions and provenance.
+- ART-03B2 migration `0040` is merged on trusted main. AUTH-12 must allocate
+  the next revision from that exact head and must not reuse `0040`.
+
 ## Classification
 
 - Initiative direction/auth/data-model strategy: L0, human-led; D1-D10 approved

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md

@@ -111,19 +111,22 @@ or consumer feature action is active.
 
 ## Active planning chunk
 
-None; `WS-AUTH-001-11C2` planning passed required L1 preimplementation review
-and merged through PR #219 as `8bb0094f`.
+`WS-AUTH-001-12`; the user started it on 2026-07-29. Required L1
+preimplementation review rejected the inherited combined runtime contract
+before application-code edits. The repaired planning parent now splits runtime
+work into 12A through 12H plus 12B2 and 12D2. All nine exact-plan reviewer
+tracks passed after action-custody, canonical-lineage reuse, and fixed-service
+setup-run binding findings were repaired.
 
 ## Active implementation chunk
 
-`WS-AUTH-001-11C2`; bounded implementation, repair, focused deterministic
-evidence, and implementation review are in progress on
-`codex/ws-auth-001-11c2-effective-policy-active-guide-reads` in PR #221.
+None. `WS-AUTH-001-11C2` merged through PR #221 as `3fc323d7` after Backend,
+Agent Gates, and required internal review passed. AUTH-12 is planning-only
+until its repaired split passes review and a child receives a separate start.
 
 ## Current review branch
 
-`codex/ws-auth-001-11c2-effective-policy-active-guide-reads` (PR #221
-implementation evidence).
+`codex/ws-auth-001-12-project-mutation-cutover` (planning repair).
 
 ## Chunk status
 
@@ -163,8 +166,18 @@ implementation evidence).
 | `WS-AUTH-001-11A` | Merged | `codex/ws-auth-001-11a-project-read-catalogue` | #208 | Registered the project-read catalogue and migration `0035`; no activation. |
 | `WS-AUTH-001-11B` | Merged | `codex/ws-auth-001-11b-project-identity-context` | #214 | Project identity and self authorization-context hard cutover; merged as `033654ac`. |
 | `WS-AUTH-001-11C1` | Merged | `codex/ws-auth-001-11c1-setup-diagnostic-reads` | #216 | Setup-diagnostic read hard cutover merged as `2965a9f9` on 2026-07-28. |
-| `WS-AUTH-001-11C2` | Implementation review | `codex/ws-auth-001-11c2-effective-policy-active-guide-reads` | #221 | Planning repair merged in #219 as `8bb0094f`; bounded implementation and review repair are awaiting exact-head hosted Backend and final external review. |
-| `WS-AUTH-001-12` | Proposed | - | - | Project policy/setup mutation cutover. |
+| `WS-AUTH-001-11C2` | Merged | `codex/ws-auth-001-11c2-effective-policy-active-guide-reads` | #221 | Effective-policy and active-guide read cutover merged as `3fc323d7` on 2026-07-29. |
+| `WS-AUTH-001-12` | Planning repair | `codex/ws-auth-001-12-project-mutation-cutover` | - | Combined runtime contract rejected; planning parent split into 12A-12H plus 12B2/12D2 before code. |
+| `WS-AUTH-001-12A` | Proposed | - | - | Planned action/evidence/PREP foundation; ART-owned migration `0040` is merged, so only planning merge and a separate start remain before allocation. |
+| `WS-AUTH-001-12B` | Proposed | - | - | Fixed project-setup service identity and planned matrix only; zero activation. |
+| `WS-AUTH-001-12B2` | Proposed | - | - | Final Celery call-graph cutover after exact product actions activate. |
+| `WS-AUTH-001-12C` | Proposed | - | - | System-scoped project creation cutover. |
+| `WS-AUTH-001-12D` | Proposed | - | - | Draft guide and source metadata mutation cutover. |
+| `WS-AUTH-001-12D2` | Proposed | - | - | Separate review/revision authority; retired economic policy remains CON-owned. |
+| `WS-AUTH-001-12E` | Proposed | - | - | Guide sufficiency mutation cutover. |
+| `WS-AUTH-001-12F` | Proposed | - | - | Submission artifact policy mutation/provenance cutover. |
+| `WS-AUTH-001-12G` | Proposed | - | - | Post-submit checker policy approval/correction cutover. |
+| `WS-AUTH-001-12H` | Proposed | - | - | Terminal guide activation after 12B2 and the owning CON clean cut. |
 | `WS-AUTH-001-13` | Proposed | - | - | Task management and assignment cutover. |
 | `WS-AUTH-001-14` | Proposed | - | - | Submission/checker/audit visibility cutover. |
 | `WS-AUTH-001-15` | Proposed | - | - | Remaining internal service and obsolete authority removal. |