WS-ARCH-001-02H: activate hidden submission consumption authority

.agent-loop/CURRENT_STATE.md

@@ -28,7 +28,7 @@ authority; these records do not grant or withhold it.
 
 | Initiative | Durable state on `main` | Remaining boundary |
 |---|---|---|
-| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02G` on merge, including activation of only contributor bundle preparation | Begin the separately bounded `02H` consumption/binding activation |
+| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H` on merge, including hidden preparation and consumption/binding activation | Repair the split 03/04/05 prerequisites before the deferred `02I` public clean cut |
 | [WS-ART-001](initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md) | Active delivery initiative; verified ready-admission publication and hidden preparation are merged through `04C2` | Replace the non-executable 05-wave XINT/ART contracts with WS-ARCH-001 split public-API contracts before activation, Submission consumption, or live cutover |
 | [WS-AUTH-001](initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md) | Active delivery initiative; project-policy authority and unified compilation authorization are merged through `12I` | POL-03B consumes 12I next; remaining AUTH activation chunks wait for their exact hidden owner behavior |
 | [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; policy persistence and shared lifecycle audit are merged | Complete hidden services, contribution records, conditional awards, fulfillment, and reconciliation after named AUTH and REV gates |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md

@@ -12,7 +12,7 @@
 | `WS-ARCH-001-02E` | ART ready-admission consumption and binding hidden module-level capability | L1 | Complete; production remains deny-only and route-unreachable |
 | `WS-ARCH-001-02F` | TASK-owned immutable Submission command and hidden composed transaction | L1 | Complete; production remains deny-only and route-unreachable |
 | `WS-ARCH-001-02G` | AUTH contributor preparation activation after the complete hidden path | L1 | Complete on merge |
-| `WS-ARCH-001-02H` | AUTH human/fixed-service consumption activation | L1 | Next after 02G merges |
+| `WS-ARCH-001-02H` | AUTH human/fixed-service consumption activation | L1 | Complete on merge; public route remains unchanged |
 | `WS-ARCH-001-02I` | Admission-only public API/dispatch cutover and complete legacy removal | L1 | Deferred after 02H plus split 03/04/05 remediation, revision, checker-output and REV admission prerequisites |
 | `WS-ARCH-001-03` | PROJECT/TASK guide, locked-context, task and assignment capability repairs | L1 | Non-executable placeholder; requires a split contract |
 | `WS-ARCH-001-04` | ART/CHECKER materialization, run and result capability repairs | L1 | Non-executable placeholder; requires a split contract |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md

@@ -32,6 +32,9 @@
   transaction; production remains deny-only and route-unreachable.
 - Complete on merge: WS-ARCH-001-02G AUTH contributor-preparation
   activation. Open pull requests show transient ownership.
+- Complete on merge: WS-ARCH-001-02H activates exact human Submission
+  consumption and fixed ART binding authority against the hidden atomic
+  transaction. The public route remains unchanged.
 - Repository housekeeping after PR #315 found no competing clean-up
   initiative: WS-ARCH-001 remains the general boundary owner, WS-AUTH-003 owns
   AUTH-specific debt, and test-structure repairs remain incremental with the

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-02H-auth-consumption-activation.md

@@ -1,5 +1,9 @@
 # Chunk Contract: WS-ARCH-001-02H — AUTH Submission Consumption Activation
 
+## Merge state
+
+- Outcome on merge: `complete`
+
 ## Parent initiative
 
 WS-ARCH-001 — Modular Monolith Boundaries
@@ -38,17 +42,46 @@ admission/binding, and 02F transaction manifests against current `main`.
 ```text
 backend/app/modules/authorization/api/**
 backend/app/modules/authorization/**/submission*.py
+backend/app/modules/authorization/submission_consumption.py
+backend/app/modules/authorization/submission_creation_authorization.py
+backend/app/modules/authorization/catalogue.py
+backend/app/modules/authorization/artifact_project_authority.py
+backend/app/modules/authorization/kernel.py
+backend/app/modules/authorization/prepared.py
+backend/app/modules/authorization/runtime.py
 backend/app/adapters/auth/**
+backend/app/adapters/tasks/__init__.py
+backend/app/adapters/artifacts/__init__.py
+backend/app/api/deps/authorization.py
+backend/app/modules/artifacts/authorization.py
+backend/app/modules/tasks/api/submission_command.py
+backend/app/modules/tasks/submission_composition.py
+backend/app/main.py
 backend/alembic/versions/<next-current-main-revision>.py
 backend/tests/test_authorization.py
-backend/tests/test_submission_concurrency.py
+backend/tests/test_submission_composition.py
+backend/tests/test_submission_preparation_authorization.py
+backend/tests/test_artifact_bindings.py
+backend/tests/test_artifact_bindings_db.py
+backend/tests/test_audit.py
+backend/tests/authorization/test_fixed_service_action_context.py
 backend/tests/architecture/test_authorization_boundary.py
+backend/scripts/behavior_ownership.py
+backend/scripts/run_test_lanes.py
+.ci/behavior-ownership/partition.v1.json
+.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json
+.agent-loop/CURRENT_STATE.md
+.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md
+.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md
 .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md
 .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md
 .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md
 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-02H-auth-consumption-activation.md
 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/evidence/WS-ARCH-001-02H-consumption-activation.md
+.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-02H-external-review-response.md
 docs/spec_authorization_service.md
+docs/operations_authorization_service.md
+docs/roadmap_status.md
 ```
 
 ## Not allowed
@@ -75,8 +108,12 @@ TASK persistence; human substitution for fixed service authority.
 ## Verification commands
 
 ```bash
-(cd backend && .venv/bin/python -m ruff check app/modules/authorization app/adapters/auth tests/test_authorization.py)
-(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/test_authorization.py tests/test_submission_concurrency.py tests/architecture/test_authorization_boundary.py --cov=app.modules.authorization --cov-fail-under=90)
+(cd backend && .venv/bin/python -m ruff check app/modules/authorization app/modules/artifacts/authorization.py app/modules/tasks/api/submission_command.py app/modules/tasks/submission_composition.py app/adapters/auth app/adapters/tasks app/adapters/artifacts app/api/deps/authorization.py app/main.py tests/test_authorization.py tests/test_submission_composition.py tests/test_submission_preparation_authorization.py tests/test_artifact_bindings.py tests/test_artifact_bindings_db.py tests/authorization/test_fixed_service_action_context.py tests/architecture/test_authorization_boundary.py)
+(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/test_authorization.py tests/test_submission_composition.py tests/test_submission_preparation_authorization.py tests/test_artifact_bindings.py tests/test_artifact_bindings_db.py tests/authorization/test_fixed_service_action_context.py tests/architecture/test_authorization_boundary.py --cov=app.modules.authorization --cov-fail-under=90)
+(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/test_artifact_bindings.py tests/test_artifact_bindings_db.py tests/test_submission_composition.py --cov=app.modules.artifacts --cov-fail-under=90)
+(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/test_submission_composition.py --cov=app.modules.tasks --cov-fail-under=90)
+gh pr checks <PR-number> --watch
+(cd backend && .venv/bin/python -m scripts.test_structure_boundary validate --policy ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_POLICY.md --ledger ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json)
 python3 scripts/check_stale_authorization_docs.py
 (cd backend && .venv/bin/python -m scripts.module_boundaries validate --protected-base origin/main)
 python3 scripts/check_markdown_links.py

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/evidence/WS-ARCH-001-02H-consumption-activation.md

@@ -0,0 +1,37 @@
+# WS-ARCH-001-02H Consumption Activation Evidence
+
+## Activated authority
+
+- Human `submission.create` is active only for the exact human contributor
+  holding an active submitter project-role grant.
+- Fixed-service `artifact.submission.binding.create` is active only for
+  `workstream.artifact.binding` through the existing static service matrix.
+- No new action, permission, service identity, route, or persistence schema is
+  introduced.
+
+## Exact human facts
+
+TASK passes its already-locked immutable submission context into final AUTH
+consumption. AUTH binds the decision to the actor, project, task, assignment,
+admission, predecessor identity/version, Submission identity/version, lifecycle
+kind/status, guide/source snapshot, effective artifact policy, and pre-submit
+checker policy. AUTH independently locks the actor, identity link, and active
+submitter project-role grant.
+
+## Exact fixed-service facts
+
+ART binds the fixed-service decision to the admission, evidence set, actor and
+identity link attribution, project, task, assignment, predecessor, Submission,
+guide/source/policy lineage, semantic manifest, immutable content digest and
+size, and `submission_bundle_original` logical role.
+
+## Transaction and denial
+
+Both decisions use the existing opaque process-local PREP protocol in the one
+02F root transaction. Handles remain non-copyable, non-serializable,
+session-bound, transaction-bound, action-bound, resource-bound, and single-use.
+Authorization evidence is written by AUTH in that transaction. Any human or
+service denial, cancellation, persistence failure, or transaction rollback
+rolls back the provisional Submission, binding, admission transition, and
+authorization evidence together. The public Submission route remains
+unchanged.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-02H-external-review-response.md

@@ -0,0 +1,39 @@
+# WS-ARCH-001-02H External Review Response
+
+## Comments addressed
+
+- Expanded the chunk verification contract to retain the repository-wide 78%
+  gate and require 90% coverage for AUTH, ART, and TASK.
+- Moved strict Submission creation resource construction inside its owner
+  translation boundary and moved fixed-service ART resource construction inside
+  the ART translation boundary.
+- Changed revoked-link proof to raise the canonical
+  `PreparedAuthorizationUnsupported` lifecycle denial before asserting the
+  concealed ART error and zero database effect.
+- Changed service-matrix proof to use active `project.read`, which the artifact
+  binding service does not own.
+- Kept 02H under Integration In Progress until the PR merges.
+- Split the oversized PostgreSQL proof and extracted new AUTH behavior into
+  bounded submission-specific modules. The structural-debt ledger records only
+  measured shrinkage and the validator rejects new or growing debt.
+
+## Comments deferred
+
+None.
+
+## Human decisions needed
+
+None.
+
+## Commands rerun
+
+- Focused Ruff checks.
+- AUTH module-boundary and behavior-ownership validators.
+- AUTH structural-debt validator.
+- Stale authorization wording and Markdown-link checks.
+- Isolated PostgreSQL focused suites and coverage gates.
+- Hosted GitHub Actions exact-head lanes: pending the final pushed correction.
+
+## Remaining risks
+
+The public Submission route remains unchanged and gated by 02I.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md

@@ -46,7 +46,7 @@ mappings, and availability must remain identical.
 | `WS-XINT-002-04A` | Active: `artifact.guide_source.ingest` |
 | `WS-XINT-002-05A` | Active: `artifact.submission_bundle.prepare`; registry custody remains historical while replacement implementation chunk WS-ARCH-001-02G supplies the executable PREP boundary |
 | `WS-XINT-002-06A` | Active: `artifact.pre_submit.checker_input.materialize` |
-| `WS-AUTH-001-ART-05` | Planned: `artifact.submission.binding.create`; registry custody is retained while replacement implementation chunk WS-ARCH-001-02H performs activation |
+| `WS-AUTH-001-ART-05` | Active on WS-ARCH-001-02H merge: `artifact.submission.binding.create`; only the fixed artifact-binding service may consume it |
 | `WS-XINT-002-06B` | Planned: `artifact.post_submit.checker_input.materialize`, `artifact.checker_output.write`, `artifact.checker_output.binding.create` |
 | `WS-XINT-002-07A` | Planned: `artifact.review_packet.materialize` only |
 | Future REV-owned activation, not approved for v0.1 | Planned/unavailable: `artifact.review_evidence.binding.create` |
@@ -60,15 +60,16 @@ reconciles the live catalogue by removing the six unused multi-step upload rows
 and registering three end-to-end bundle/review rows. The resulting 22 rows have
 exact action cardinalities `3/8/2/1/1/1/1/3/1/1` in the table order above. The
 `OPERATOR` suffix denotes only future activation custody; it grants no Operator
-entitlement. Fifteen actions remain planned after the three ART foundation
+entitlement. Fourteen actions remain planned after the three ART foundation
 service actions, `artifact.guide_source.ingest`, the two fixed-service guide
-binding/read actions, and `artifact.submission_bundle.prepare` activate. The independently
+binding/read actions, `artifact.submission_bundle.prepare`, and fixed-service
+`artifact.submission.binding.create` activate. The independently
 gated `artifact.verification_job.retry`
 remains planned and
 cannot be activated by read/status proof. The historical transfer added no
 migration because owner and availability are typed metadata. WS-XINT-002-01
 reconciles PostgreSQL parity through migration `0036`. The current catalogue
-has 73 PermissionIds, 102 ActionIds, 55 active actions, and 47 planned actions,
+has 73 PermissionIds, 102 ActionIds, 57 active actions, and 45 planned actions,
 with fourteen fixed-service identities and twenty-two matrix memberships.
 
 ## REV custody transfer

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md

@@ -94,7 +94,7 @@ feature manifest exists and then uses the ordinary bounded contribution loop.
 | `WS-AUTH-001-ART-03` | ART 03 Guide Source Action Activation | L1 | Feature-gated |
 | `WS-XINT-002-06A` | Pre-Submit Materialization Activation | L1 | Merged through PR #293; ART-04C1 is its next ART consumer |
 | `WS-XINT-002-05A` | Historical Submission Bundle Preparation Activation | L1 | Superseded/non-executable; replacement WS-ARCH-001-02G requires 02A-02F |
-| `WS-XINT-002-05B` | Historical Submission Binding Activation | L1 | Superseded/non-executable; replacement WS-ARCH-001-02H requires the hidden 02F transaction and 02G |
+| `WS-XINT-002-05B` | Historical Submission Binding Activation | L1 | Superseded/non-executable; replacement WS-ARCH-001-02H is complete on merge |
 | `WS-XINT-002-06B` | Post-Submit Materialization And Checker Output Activation | L1 | Feature-gated on POL-06B/07 unified plan plus ART-06A/06B evidence |
 | `WS-AUTH-001-REV-05` | REV 05 Queue Read Activation | L1 | Feature-gated |
 | `WS-AUTH-001-REV-06` | REV 06 Claim Lease And Expiry Activation | L1 | Feature/service-gated |