docs(arch): split submission capability repair

.agent-loop/CURRENT_STATE.md

@@ -28,7 +28,7 @@ authority; these records do not grant or withhold it.
 
 | Initiative | Durable state on `main` | Remaining boundary |
 |---|---|---|
-| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Boundary foundation is implemented in PR #310 but is not durable on `main` until human merge; no product behavior changed | After merge, split WS-ARCH-001-02 into exact AUTH, ART, TASK, and composition-root submission capability contracts before implementation |
+| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Boundary foundation is merged through PR #310; no product behavior changed | Review the proposed submission-capability split across TASKS, PROJECTS, CHECKERS, ART, AUTH, and composition before implementing or activating contributor preparation |
 | [WS-ART-001](initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md) | Active delivery initiative; verified ready-admission publication and hidden preparation are merged through `04C2` | Replace the non-executable 05-wave XINT/ART contracts with WS-ARCH-001 split public-API contracts before activation, Submission consumption, or live cutover |
 | [WS-AUTH-001](initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md) | Active delivery initiative; foundations and project-policy authority are merged through `12F3` | Remaining activation chunks depend on exact merged POL, ART, and REV behavior; refresh each executable contract on current `main` |
 | [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; policy persistence and shared lifecycle audit are merged | Complete hidden services, contribution records, conditional awards, fulfillment, and reconciliation after named AUTH and REV gates |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md

@@ -3,13 +3,24 @@
 | Chunk | Goal | Risk | State |
 |---|---|---:|---|
 | `WS-ARCH-001-01` | Canonical module map, exact general edge ledger, public-API validator, and CI foundation | L1 | Complete |
-| `WS-ARCH-001-02` | AUTH/ART/TASK submission preparation and ready-admission consumption public capabilities | L1 | Proposed after 01 and XINT-05A reconciliation |
-| `WS-ARCH-001-03` | PROJECT/TASK guide, locked-context, task and assignment capability repairs | L1 | Non-executable placeholder; requires split contract |
-| `WS-ARCH-001-04` | ART/CHECKER materialization, run and result capability repairs | L1 | Non-executable placeholder; requires split contract |
-| `WS-ARCH-001-05` | ART/TASK/REV reviewer packet and revision capability repairs | L1 | Non-executable placeholder; requires split contract |
-| `WS-ARCH-001-06` | REV/CON/COMP accepted-work and award handoff capability repairs | L1 | Non-executable placeholder; requires split contract |
-| `WS-ARCH-001-07` | Supporting-module repairs and empty-ledger closure | L1 | Non-executable placeholder; requires split contract |
+| `WS-ARCH-001-02` | Coordination record for the split submission preparation/consumption capability sequence | L1 | Split; non-executable parent |
+| `WS-ARCH-001-02A` | TASKS task/assignment/predecessor and Submission public facts/ports | L1 | Proposed first implementation chunk after plan approval |
+| `WS-ARCH-001-02B` | PROJECTS locked guide and submission-policy public facts/ports | L1 | Proposed after 02A |
+| `WS-ARCH-001-02C` | CHECKERS effective pre-submit plan and bounded execution-result public facts/ports | L1 | Proposed after 02B |
+| `WS-ARCH-001-02D` | ART hidden preparation public API and private-edge migration | L1 | Proposed after 02A-02C |
+| `WS-ARCH-001-02E` | ART ready-admission consumption and binding public capability | L1 | Proposed after 02D |
+| `WS-ARCH-001-02F` | TASK-owned immutable Submission command and hidden composed transaction | L1 | Proposed after 02E |
+| `WS-ARCH-001-02G` | AUTH contributor preparation activation after the complete hidden path | L1 | Proposed after 02F |
+| `WS-ARCH-001-02H` | AUTH human/fixed-service consumption activation | L1 | Proposed after 02G |
+| `WS-ARCH-001-02I` | Admission-only public API/dispatch cutover and complete legacy removal | L1 | Deferred after 02H plus split 03/04/05 remediation, revision, checker-output and REV admission prerequisites |
+| `WS-ARCH-001-03` | PROJECT/TASK guide, locked-context, task and assignment capability repairs | L1 | Non-executable placeholder; requires a split contract |
+| `WS-ARCH-001-04` | ART/CHECKER materialization, run and result capability repairs | L1 | Non-executable placeholder; requires a split contract |
+| `WS-ARCH-001-05` | ART/TASK/REV reviewer packet and revision capability repairs | L1 | Non-executable placeholder; requires a split contract |
+| `WS-ARCH-001-06` | REV/CON/COMP accepted-work and award handoff capability repairs | L1 | Non-executable placeholder; requires a split contract |
+| `WS-ARCH-001-07` | Supporting-module repairs and empty-ledger closure | L1 | Non-executable placeholder; requires a split contract |
 
-Chunks 02-06 are coordination contracts, not permission to combine an entire
-product milestone into one PR. Each is split further when its exact feature
-contract crosses more than one reviewable mutation boundary.
+Parent chunks 02-06 are coordination contracts, not permission to combine an
+entire product milestone into one PR. Each is split further when its exact
+feature contract crosses more than one reviewable mutation boundary. The
+02A-02I sequence is the executable split of parent 02, subject to plan review
+and human approval.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/DECISIONS.md

@@ -48,3 +48,38 @@ grow. `backend/app/interfaces/**` is not a permanent public contract surface.
 Database metadata discovery is a distinct infrastructure concern: only the
 exact registered discovery path may import module model declarations, and that
 exception grants no runtime command, repository, service, or authority access.
+
+## D8: Submission preparation requires PROJECT and CHECKER capabilities
+
+TASKS owns task, assignment, predecessor, and Submission lifecycle facts. It
+does not own locked Project Guide/policy persistence or effective checker-plan
+compilation. WS-ARCH-001-02 therefore includes explicit PROJECTS and CHECKERS
+prerequisite contracts rather than preserving those private imports behind a
+TASK facade.
+
+## D9: Activation follows hidden public-boundary proof
+
+Typed owner APIs merge first while operations remain hidden or deny-only.
+Contributor preparation activates only after its complete hidden path consumes
+public owner capabilities. Binding/human consumption authority activates only
+after the hidden TASK/ART transaction is proven. Public reachability changes
+last, in the same clean cut that removes legacy input and precheck behavior.
+
+## D10: Composition owns wiring, not lifecycle truth
+
+The application composition root opens the transaction and constructs
+transaction-bound port implementations. The TASK-owned application command
+sequences Submission creation through injected AUTH and ART ports. AUTH, ART,
+PROJECTS, CHECKERS, and TASKS retain their own locks and invariants; the
+composition layer contains no product-state branching or authorization policy.
+
+## D11: Public clean cut waits for all submission contexts
+
+Initial preparation may become live behind its hidden surface after 02G, and
+the hidden consumption transaction may receive exact authority after 02H. The
+public Submission route remains on its guarded legacy path until initial,
+checker-remediation, and reviewer-requested revision contexts all use the same
+admission-backed contract and post-submit checker/REV handoffs are live. 02I is
+therefore deferred across the required WS-ARCH-001-03/04/05 splits; it cannot
+strand `needs_revision` contributors or create Submissions that cannot reach
+visible checker and reviewer admission facts.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/DISCOVERY.md

@@ -26,11 +26,12 @@ capability family; guide compilation and locked policy custody remain in
 
 ## Existing public surfaces
 
-Only `backend/app/modules/authorization/api/` currently provides an explicit
-module public API. PRs #304 and #305 established its minimal surface, exact
+`backend/app/modules/authorization/api/` provides the first explicit module
+public API. PRs #304 and #305 established its minimal surface, exact
 private-import ledger, and no-new-AUTH-violation gate. PR #307 subsequently
 merged the first capability proof: hidden project-guide compilation uses the
-public AUTH surface without adding private AUTH debt.
+public AUTH surface without adding private AUTH debt. PR #310 added the
+repository-wide registry, exact general debt ledger, and protected-base gate.
 
 ## Observed cross-module topology
 
@@ -60,6 +61,34 @@ though `tasks` owns the Submission lifecycle. This planning change resolves
 that conflict by superseding ART-05A as executable authority until
 WS-ARCH-001-02 produces split, ownership-correct contracts.
 
+## Submission-path reconciliation after PR #310
+
+The hidden preparation route is TASK-delivered but imports private ART request,
+error, and command types. Application adapter wiring imports ART concrete
+implementations. ART's `submission_admission.py` imports TASK's private
+`pre_submit_context` and CHECKER private catalogue/execution types. TASK's
+`pre_submit_context.py` in turn reads ACTOR and PROJECT ORM rows and compiles a
+CHECKER-owned effective plan.
+
+Therefore the earlier four-part AUTH/ART/TASK/composition description is
+incomplete. Activating that shape would preserve circular authority and move
+PROJECT/CHECKER behavior behind a TASK facade. The ownership-correct graph is:
+
+```text
+AUTH -> actor/identity/grant decision and opaque prepared authority
+TASKS -> task, assignment, predecessor and Submission lifecycle facts
+PROJECTS -> locked guide and project-policy lineage facts
+CHECKERS -> effective pre-submit plan and bounded execution-result facts
+ART -> ZIP custody, manifest, verified admission, consumption and binding
+application composition -> transaction-bound concrete wiring only
+```
+
+No public capability may return an ORM row, repository, session, mutable policy
+body, scratch path, provider credential, or another module's private type.
+Preparation activation must wait until the TASKS, PROJECTS, CHECKERS, ART, and
+AUTH public contracts it exercises are present and the corresponding private
+edges are removed.
+
 ## Conventions to preserve
 
 - The target module exposes immutable facts, commands/results, stable errors,
@@ -80,12 +109,28 @@ WS-ARCH-001-02 produces split, ownership-correct contracts.
   AUTH public surface.
 - `backend/scripts/behavior_ownership.py` and `.ci/behavior-ownership/` protect
   behavior ownership, not general runtime import direction.
-- There is no repository-wide module-public-API ledger or validator yet.
+- PR #310 installed the repository-wide module registry, exact private-edge
+  ledger, public API leak/cycle checks, and protected-base validator that govern
+  every split contract below.
+
+## Resolved sequencing constraints for submission capability
+
+- Preparation and admission consumption are distinct authorization boundaries.
+- Public fact/port foundations may merge while behavior remains hidden and
+  deny-only.
+- The contributor preparation action activates only after the hidden path uses
+  public capabilities end to end.
+- ART admission/binding and TASK Submission mutations may be implemented behind
+  public ports before the route cutover, but their composed transaction must be
+  proven before fixed-service activation or public reachability.
+- The public cutover removes legacy package URI/hash/manifest input and the
+  standalone precheck path in the same PR; no dual path or compatibility alias
+  is permitted.
 
 ## Unknowns to resolve per capability
 
-- Which module owns the application command when one transaction spans public
-  ports?
+- Which exact owner-local lock/fact methods each implementation chunk can reuse
+  without widening its public contract?
 - Which exact immutable facts are sufficient without exposing an ORM row?
 - Which legacy edges can be removed in the same feature chunk without changing
   behavior?

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md

@@ -47,21 +47,70 @@ feature contract touching `artifacts`, `authorization`, `projects`, `tasks`,
 - proof that debt does not grow;
 - behavior, transaction, authorization, replay, and denial preservation.
 
-## ART/TASK correction
+## Submission capability correction
 
-Before ART-05A implementation:
+Before contributor preparation activation or ART-05A replacement behavior:
 
-- XINT-05A exposes the exact public AUTH preparation capability;
-- ART exposes ready-admission validation/consumption and binding ports;
-- TASKS exposes the immutable Submission command and predecessor/context facts;
+- TASKS exposes immutable task, assignment, predecessor, and Submission facts;
+- PROJECTS exposes locked guide and project-policy lineage facts;
+- CHECKERS exposes effective-plan compilation and bounded execution-result
+  facts; ART retains durable evidence identity, persistence, pass capability,
+  and admission attachment;
+- ART exposes hidden preparation, ready-admission validation/consumption, and
+  binding ports;
+- AUTH exposes exact preparation and consumption capabilities and activates
+  them only after the corresponding hidden behavior is complete;
 - the composition root owns the transaction/unit-of-work boundary and invokes
   the TASK-owned application command with transaction-bound AUTH and ART
-  public ports;
+  public ports while PROJECT/CHECKER facts are already immutable inputs;
 - ART does not create or query TASK ORM rows;
 - TASKS does not query ART ORM rows;
+- TASKS does not become a facade over PROJECT or CHECKER private persistence;
+- ART does not compile checker plans or read PROJECT persistence;
 - POL-03A now owns merged migration `0062_guide_compilation`; every later
   migration identifier is chosen only after rebasing on then-current `main`.
 
+## WS-ARCH-001-02 delivery order
+
+The former single coordination placeholder is split into these PR boundaries:
+
+1. `02A`: TASKS preparation/Submission immutable fact and port contract.
+2. `02B`: PROJECTS locked-policy fact and port contract.
+3. `02C`: CHECKERS effective pre-submit plan/bounded execution-result contract.
+4. `02D`: ART hidden preparation public API migration using only owner APIs;
+   production stays deny-only and proves zero effect plus the exact resource
+   manifest, not successful AUTH consumption.
+5. `02E`: ART ready-admission consumption and binding public capability.
+6. `02F`: TASK-owned immutable Submission command plus composed atomic
+   transaction, hidden from the public route; production remains deny-only and
+   proves zero effect plus the exact transaction manifest.
+7. `02G`: AUTH production activation and positive end-to-end proof of
+   contributor preparation.
+8. `02H`: AUTH fixed binding/human consumption activation and positive
+   concurrency proof against the hidden transaction.
+9. `02I`: deferred admission-only public API/dispatch cutover and complete
+   legacy precheck/caller-package removal. It may run only after the separate
+   checker-remediation and human-review revision context extensions, post-submit
+   checker materialization/output visibility and repair, and REV admission
+   handoff are merged.
+
+All hidden owner behavior and transaction wiring through 02F must merge before
+02G may make contributor preparation live. Each contract is one PR. A
+foundation PR may add typed public contracts and
+their owner-local implementation/tests but may not activate behavior or modify
+the live Submission route unless its contract explicitly owns that boundary.
+No later chunk begins merely because an earlier public type exists; its entry
+gate requires the named merge and exact resource manifest.
+
+The initial-submission foundations through 02H do not remove the live legacy
+Submission path. Before 02I, WS-ARCH-001-03/04/05 must split and deliver the
+PROJECT/TASK, CHECKER, and REV public capabilities needed to replace
+XINT-002-05C/05D, ART-06A/06B, XINT-06B, and the exact reviewer-admission
+handoff. All three contributor contexts then use one admission-backed path:
+initial submission, checker remediation, and reviewer-requested revision. A
+review note remains REV-owned and relates to the exact predecessor Submission;
+the contributor response is a new complete ZIP and immutable Submission.
+
 ## Verification
 
 - AST import-edge inventory and protected-base comparison.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md

@@ -10,3 +10,10 @@
 | One broad refactor becomes unreviewable | High | One capability and one PR per repair; no bulk moves |
 | Migration collisions across active branches | High | Resolve next identifier only after rebasing on current main |
 | ORM relationships are mistaken for runtime API authority | Medium | Keep database constraints, but prohibit cross-module model imports in services |
+| TASK becomes a facade over PROJECT/CHECKER internals | Critical | Separate immutable PROJECT locked-policy and CHECKER effective-plan capabilities before ART preparation activation |
+| AUTH preparation activates over a partly private path | Critical | Keep action unavailable through hidden public-capability and transaction work 02A-02F; activate only in 02G after exact manifests and denial proof |
+| Binding authority activates before atomic TASK/ART composition exists | Critical | Merge hidden 02F transaction proof and 02G preparation activation before 02H binding/consumption availability; public route remains legacy until deferred 02I clean cut |
+| Legacy and admission-backed Submission paths coexist | Critical | One 02I cutover removes caller package identity, standalone precheck, internal guard, aliases and fallbacks while enabling the admission-only command |
+| Initial-only cutover strands `needs_revision` contributors | Critical | Defer 02I until checker-remediation and reviewer-requested revision contexts consume the same admission-backed path with exact predecessor/obligation lineage |
+| Submission cutover precedes visible post-submit checker results | Critical | Require ART-06A/06B, XINT-06B replacements, repair/audit proof, and REV admission handoff before 02I public reachability |
+| Composition root absorbs domain decisions | High | Composition opens the unit of work and wires transaction-bound ports only; TASK command owns Submission sequencing and each target port enforces its own invariants |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md

@@ -11,5 +11,6 @@
 - Completed foundation: WS-ARCH-001-01 installs the canonical registry, exact
   general debt ledger, AUTH-ledger composition, protected-base validator,
   public-API checks, behavior-ownership record, and hosted CI enforcement.
-- Next boundary: split WS-ARCH-001-02 into exact AUTH, ART, TASK, and
-  composition-root contracts after this foundation is human-merged.
+- Planning in review: WS-ARCH-001-02 is split into 02A-02I across TASKS,
+  PROJECTS, CHECKERS, ART, AUTH, composition, and the final API clean cut.
+- Next implementation boundary after plan approval: WS-ARCH-001-02A only.