feat(auth): activate contributor bundle preparation

.agent-loop/CURRENT_STATE.md

@@ -28,7 +28,7 @@ authority; these records do not grant or withhold it.
 
 | Initiative | Durable state on `main` | Remaining boundary |
 |---|---|---|
-| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Boundary foundation and hidden submission capabilities are complete through `WS-ARCH-001-02F`, including the TASK-owned atomic Submission composition; no product route or AUTH action was activated | `WS-ARCH-001-02G` is the AUTH contributor-preparation activation boundary |
+| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02G` on merge, including activation of only contributor bundle preparation | Begin the separately bounded `02H` consumption/binding activation |
 | [WS-ART-001](initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md) | Active delivery initiative; verified ready-admission publication and hidden preparation are merged through `04C2` | Replace the non-executable 05-wave XINT/ART contracts with WS-ARCH-001 split public-API contracts before activation, Submission consumption, or live cutover |
 | [WS-AUTH-001](initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md) | Active delivery initiative; project-policy authority and unified compilation authorization are merged through `12I` | POL-03B consumes 12I next; remaining AUTH activation chunks wait for their exact hidden owner behavior |
 | [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; policy persistence and shared lifecycle audit are merged | Complete hidden services, contribution records, conditional awards, fulfillment, and reconciliation after named AUTH and REV gates |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md

@@ -11,8 +11,8 @@
 | `WS-ARCH-001-02D` | ART hidden preparation public API and private-edge migration | L1 | Complete; production remains deny-only |
 | `WS-ARCH-001-02E` | ART ready-admission consumption and binding hidden module-level capability | L1 | Complete; production remains deny-only and route-unreachable |
 | `WS-ARCH-001-02F` | TASK-owned immutable Submission command and hidden composed transaction | L1 | Complete; production remains deny-only and route-unreachable |
-| `WS-ARCH-001-02G` | AUTH contributor preparation activation after the complete hidden path | L1 | Next durable boundary |
-| `WS-ARCH-001-02H` | AUTH human/fixed-service consumption activation | L1 | Proposed after 02G |
+| `WS-ARCH-001-02G` | AUTH contributor preparation activation after the complete hidden path | L1 | Complete on merge |
+| `WS-ARCH-001-02H` | AUTH human/fixed-service consumption activation | L1 | Next after 02G merges |
 | `WS-ARCH-001-02I` | Admission-only public API/dispatch cutover and complete legacy removal | L1 | Deferred after 02H plus split 03/04/05 remediation, revision, checker-output and REV admission prerequisites |
 | `WS-ARCH-001-03` | PROJECT/TASK guide, locked-context, task and assignment capability repairs | L1 | Non-executable placeholder; requires a split contract |
 | `WS-ARCH-001-04` | ART/CHECKER materialization, run and result capability repairs | L1 | Non-executable placeholder; requires a split contract |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md

@@ -27,10 +27,10 @@
   serializes binding identity, persists the consumed Submission id/version,
   creates one provider-neutral generic binding, and proves replay, concurrency,
   rollback, and stable conflicts without activating a route or AUTH action.
-- WS-ARCH-001-02F is complete in this change. TASK owns the immutable
+- WS-ARCH-001-02F is complete. TASK owns the immutable
   admission-backed Submission command and the adapter owns one hidden root
   transaction; production remains deny-only and route-unreachable.
-- Next durable boundary: WS-ARCH-001-02G only, AUTH contributor-preparation
+- Complete on merge: WS-ARCH-001-02G AUTH contributor-preparation
   activation. Open pull requests show transient ownership.
 - Repository housekeeping after PR #315 found no competing clean-up
   initiative: WS-ARCH-001 remains the general boundary owner, WS-AUTH-003 owns

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-02G-auth-preparation-activation.md

@@ -40,48 +40,102 @@ remained unavailable through those chunks.
 ```text
 backend/app/modules/authorization/api/**
 backend/app/modules/authorization/**/submission*.py
+backend/app/modules/authorization/catalogue.py
+backend/app/modules/authorization/kernel.py
+backend/app/modules/authorization/prepared.py
+backend/app/modules/authorization/runtime.py
+backend/app/modules/authorization/repository.py
+backend/app/modules/authorization/submission_preparation.py
+backend/app/modules/authorization/artifact_project_authority.py
+backend/app/modules/authorization/pre_submit_materialization.py
 backend/app/adapters/auth/**
 backend/app/adapters/artifacts/__init__.py
-backend/alembic/versions/<next-current-main-revision>.py
+backend/app/modules/artifacts/submission_authorization.py
+backend/app/modules/artifacts/authorization.py
+backend/app/modules/artifacts/submission_admission.py
+backend/app/modules/artifacts/service.py
 backend/tests/test_authorization.py
 backend/tests/test_submission_bundle_admission.py
+backend/tests/test_default_pre_submit_execution.py
+backend/tests/submission_preparation_auth_helpers.py
+backend/tests/test_submission_preparation_adapter.py
+backend/tests/test_submission_preparation_authorization.py
 backend/tests/architecture/test_authorization_boundary.py
+backend/scripts/behavior_ownership.py
+backend/scripts/run_test_lanes.py
 .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md
 .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md
 .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md
+.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md
 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-02G-auth-preparation-activation.md
+.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md
+.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md
+.agent-loop/CURRENT_STATE.md
 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/evidence/WS-ARCH-001-02G-preparation-activation.md
+.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json
+.ci/behavior-ownership/partition.v1.json
 docs/spec_authorization_service.md
+docs/architecture_data_model.md
+docs/roadmap_status.md
 ```
 
 ## Not allowed
 
-New action/permission/service identity; Submission creation or binding action;
+New action/permission/service identity; TASK `submission.create` command
+activation or `artifact.submission.binding.create` activation;
 revision/remediation contexts; ART/TASK persistence; generic download; private
-AUTH imports by product modules; migration number chosen before rebase.
+AUTH imports by product modules; database migration or schema mutation.
+Do not create a submission-local handle registry, evaluator, or second PREP
+protocol; extend the existing kernel and `PreparedAuthorizationService` exact
+binding path.
 
 ## Acceptance criteria
 
-- [ ] Only `artifact.submission_bundle.prepare -> submission.create` becomes
-      available for an exact active assigned contributor.
+- [ ] Only ActionId `artifact.submission_bundle.prepare`, mapped to existing
+      PermissionId `submission.create`, becomes available for an exact active
+      assigned contributor. This does not activate the TASK Submission command
+      or the later fixed binding action.
 - [ ] Preflight and final transaction-bound preparation use the merged opaque
-      handle/public fact manifest.
+      handle/public fact manifest and the existing kernel/prelocked/PREP path.
+- [ ] Preliminary AUTH concealment runs before TASK disclosure; ART then locks
+      exact assignment/task/project facts through public owner ports and calls
+      the typed AUTH revalidation seam before reading the first request byte.
+      AUTH does not import TASK persistence.
+- [ ] AUTH owns strict preliminary/final resource contexts. Final binding
+      covers actor and identity link; project, task, assignment and predecessor
+      id/version; passing evidence and prepared generation; guide, snapshot,
+      effective policy, checker policy and effective plan; semantic manifest;
+      archive digest/bytes/media type; storage scheme; operation identity;
+      idempotency/request digest; session/transaction; and nullable replay
+      intent exactly as recorded by the merged ART manifest.
+- [ ] Registry custody remains the existing `WS-XINT-002-05A` row while this
+      replacement executable chunk flips only its availability; no alias,
+      duplicate owner, or second action path is introduced.
 - [ ] Live positive proof consumes the prepared handle before capacity, put
       intent, or provider I/O and produces one verified ready admission through
       the hidden route; exact replay produces no second write, charge, evidence
-      set, or admission.
+      set, admission, or provider I/O. The proof uses PostgreSQL and real AUTH
+      PREP composition rather than forged or monkeypatched handles.
 - [ ] Revoked identity/grant/assignment, stale context, wrong action/session/
       transaction/resource, replay and copied handle deny before protected work.
-- [ ] No fixed binding authority or Submission consumption becomes available.
+- [ ] Existing fixed pre-submit materialization and internal storage-service
+      authorities remain unchanged; no fixed binding authority or TASK
+      Submission consumption becomes available.
 - [ ] AUTH and general boundary ledgers do not grow.
+- [ ] New preparation behavior is factored into bounded production and test
+      modules; the frozen AUTH structural-debt ledger is regenerated only for
+      verified shrinkage, never to accept new or enlarged debt.
 
 ## Verification commands
 
 ```bash
-(cd backend && .venv/bin/python -m ruff check app/modules/authorization app/adapters/auth tests/test_authorization.py)
-(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/test_authorization.py tests/test_submission_bundle_admission.py tests/architecture/test_authorization_boundary.py --cov=app.modules.authorization --cov-fail-under=90)
+(cd backend && .venv/bin/python -m ruff check app/modules/authorization app/adapters/auth app/adapters/artifacts app/modules/artifacts/submission_authorization.py app/modules/artifacts/submission_admission.py app/modules/artifacts/authorization.py tests/test_authorization.py tests/test_submission_bundle_admission.py)
+(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/test_authorization.py tests/test_submission_bundle_admission.py tests/test_default_pre_submit_execution.py tests/architecture/test_authorization_boundary.py --cov=app.modules.authorization --cov-fail-under=90)
 python3 scripts/check_stale_authorization_docs.py
+python3 scripts/check_stale_artifact_contracts.py
+python3 scripts/check_chunk_state_sync.py --base-ref origin/main
 (cd backend && .venv/bin/python -m scripts.module_boundaries validate --protected-base origin/main)
+(cd backend && .venv/bin/python -m pytest -q tests/architecture/test_module_boundaries.py tests/test_artifact_architecture.py --no-cov)
 python3 scripts/check_markdown_links.py
 git diff --check
 ```
@@ -100,3 +154,9 @@ authority was activated.
 
 Stop if 02A-02F are not merged, either resource manifest changed, or activation
 needs a new catalogue value or broader grant.
+
+## Merge state
+
+- Outcome on merge: `complete`
+- `WS-ARCH-001-02G` becomes complete only after the exact-head hosted gates,
+  required internal reviewers, and human merge succeed.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/evidence/WS-ARCH-001-02G-preparation-activation.md

@@ -0,0 +1,30 @@
+# WS-ARCH-001-02G Evidence
+
+## Outcome
+
+Activates only `artifact.submission_bundle.prepare`, retaining historical
+`WS-XINT-002-05A` catalogue custody. The active path uses the existing opaque
+AUTH PREP service for project-scoped submitter revalidation before byte intake
+and exact final-fact consumption before capacity, durable intent, or provider
+I/O. TASK Submission creation and artifact binding remain unavailable.
+
+## Local evidence
+
+- Ruff passed for all changed AUTH, ART adapter, and focused test files.
+- Focused submission admission and AUTH boundary tests passed: 100 tests.
+- Focused real PREP full-fact, mismatch, and replay proof passed.
+- Module boundary validation and architecture tests passed without growing the
+  AUTH private-import ledger.
+- Stale AUTH/ART wording, atomic chunk state, Markdown links, and diff checks
+  passed.
+- The PostgreSQL end-to-end test now composes the real contributor preparation
+  authority; GitHub Actions owns its execution and the full coverage gate.
+
+## Human review focus
+
+- Preliminary actor concealment and project-scoped submitter revalidation occur
+  before request bytes are read.
+- Final preparation binds every durable-intent fact in the same root database
+  transaction and is consumed before capacity or provider work.
+- No adjacent action, permission, route, TASK command, or fixed binding action
+  becomes active.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md

@@ -44,7 +44,7 @@ mappings, and availability must remain identical.
 | `WS-AUTH-001-ART-02D-OPERATOR` | Planned: `artifact.binding.read`, `artifact.replica.read`, `artifact.receipt.read`, `artifact.verification_job.read`, `artifact.verification_job.retry`, `artifact.recovery_attempt.read`, `artifact.audit.read`, `operations.artifact_storage_admission.read` |
 | `WS-XINT-002-04B` | Active: `artifact.guide_source.read`, `artifact.guide_source.binding.create` |
 | `WS-XINT-002-04A` | Active: `artifact.guide_source.ingest` |
-| `WS-XINT-002-05A` | Planned: `artifact.submission_bundle.prepare`; registry custody is retained while replacement implementation chunk WS-ARCH-001-02G activates after 02A-02F |
+| `WS-XINT-002-05A` | Active: `artifact.submission_bundle.prepare`; registry custody remains historical while replacement implementation chunk WS-ARCH-001-02G supplies the executable PREP boundary |
 | `WS-XINT-002-06A` | Active: `artifact.pre_submit.checker_input.materialize` |
 | `WS-AUTH-001-ART-05` | Planned: `artifact.submission.binding.create`; registry custody is retained while replacement implementation chunk WS-ARCH-001-02H performs activation |
 | `WS-XINT-002-06B` | Planned: `artifact.post_submit.checker_input.materialize`, `artifact.checker_output.write`, `artifact.checker_output.binding.create` |
@@ -60,18 +60,16 @@ reconciles the live catalogue by removing the six unused multi-step upload rows
 and registering three end-to-end bundle/review rows. The resulting 22 rows have
 exact action cardinalities `3/8/2/1/1/1/1/3/1/1` in the table order above. The
 `OPERATOR` suffix denotes only future activation custody; it grants no Operator
-entitlement. Sixteen actions remain planned after the three ART foundation
-service actions, `artifact.guide_source.ingest`, and the two fixed-service
-guide binding/read actions activate. The independently
+entitlement. Fifteen actions remain planned after the three ART foundation
+service actions, `artifact.guide_source.ingest`, the two fixed-service guide
+binding/read actions, and `artifact.submission_bundle.prepare` activate. The independently
 gated `artifact.verification_job.retry`
 remains planned and
 cannot be activated by read/status proof. The historical transfer added no
 migration because owner and availability are typed metadata. WS-XINT-002-01
-reconciles PostgreSQL parity through migration `0036`. The post-12E-merge
-expected catalogue has 71 PermissionIds, 100 ActionIds, 48 active actions, and
-52 planned actions, with fourteen fixed-service identities and twenty-two
-matrix memberships; until 12E is human-merged, trusted `main` retains its prior
-45 active and 55 planned counts.
+reconciles PostgreSQL parity through migration `0036`. The current catalogue
+has 73 PermissionIds, 102 ActionIds, 55 active actions, and 47 planned actions,
+with fourteen fixed-service identities and twenty-two matrix memberships.
 
 ## REV custody transfer