feat(auth): register adapter-binding authority

.agent-loop/CURRENT_STATE.md

@@ -103,7 +103,8 @@ non-executable until PLAN3 merges and its current-main contract is expanded.
 
 - WS-ARCH-001-PLAN3 is proposed planning only.
 - WS-ARCH-001-CP01 is a planned split and non-executable.
-- WS-ARCH-001-CP01A is proposed for unavailable adapter-binding registration.
+- WS-ARCH-001-CP01A is complete on merge with adapter-binding actions registered
+  but unavailable.
 - WS-ARCH-001-CP01B is proposed after CP01A for unavailable ContributionPolicy
   registration.
 - WS-ARCH-001-CP02 is proposed and non-executable.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md

@@ -17,7 +17,7 @@
 | `WS-ARCH-001-PLAN2` | Current-main reconciliation around canonical Submission-to-`allow_review` | L1 | Planned; planning contract lands on merge |
 | `WS-ARCH-001-PLAN3` | ContributionPolicy registration, behavior, activation, guide/task lineage and clean legacy-removal sequencing | L1 | Proposed planning correction; no runtime |
 | `WS-ARCH-001-CP01` | Combined AUTH registration planning parent | L1 | Planned split into CP01A/CP01B; non-executable |
-| `WS-ARCH-001-CP01A` | AUTH adapter-binding unavailable registration | L1 | Proposed executable contract after PLAN3 |
+| `WS-ARCH-001-CP01A` | AUTH adapter-binding unavailable registration | L1 | Complete on merge; four actions remain planned/unavailable |
 | `WS-ARCH-001-CP01B` | AUTH ContributionPolicy unavailable registration | L1 | Proposed executable contract after CP01A |
 | `WS-ARCH-001-CP02` | CON hidden adapter-binding behavior | L1 | Proposed skeleton after CP01B |
 | `WS-ARCH-001-CP03` | AUTH exact adapter-binding activation | L1 | Proposed skeleton after CP02 evidence |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md

@@ -51,15 +51,17 @@
 - PLAN3 corrects PLAN2's first implementation dependency. CON-05A is not a
   valid direct start: missing AUTH registration/activation and hidden CON
   behavior must precede owner-separated guide/task lineage. CP01 is the
-  non-executable split parent; CP01A and CP01B are current-main proposed
-  executable contracts, while CP02-CP09 remain non-executable skeletons.
+  non-executable split parent; CP01A is complete on merge with its four actions
+  registered/unavailable, CP01B is the remaining proposed executable contract,
+  and CP02-CP09 remain non-executable skeletons.
 
 ## Proposed PLAN3 children
 
 - WS-ARCH-001-PLAN3 is proposed planning only; runtime behavior is unchanged.
 - WS-ARCH-001-CP01 is a planned split and non-executable. Current-main discovery proved
   adapter binding and ContributionPolicy are distinct resource/action families.
-- WS-ARCH-001-CP01A is proposed: exact unavailable adapter-binding registration.
+- WS-ARCH-001-CP01A is complete on merge: exact adapter-binding identifiers,
+  mappings, typed facts, and digests are registered while unavailable.
 - WS-ARCH-001-CP01B is proposed after CP01A: exact unavailable
   ContributionPolicy registration.
 - WS-ARCH-001-CP02 is proposed: hidden adapter-binding behavior.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP01A-auth-adapter-binding-registration.md

@@ -37,7 +37,20 @@ backend/app/modules/authorization/catalogue.py
 backend/app/modules/authorization/api/__init__.py
 backend/app/modules/authorization/api/action_ids.py
 backend/app/modules/authorization/api/adapter_bindings.py
+.ci/behavior-ownership/partition.v1.json (additive AUTH target parity only)
+.ci/behavior-ownership/auth/adapter-binding-facts.json
+backend/scripts/behavior_ownership.py (exact CP01A public-API target only)
+backend/scripts/run_test_lanes.py (CP01A test custody only)
+backend/tests/test_behavior_ownership.py (exact additive-transition parity only)
 backend/tests/authorization/test_adapter_binding_registration.py
+backend/tests/test_authorization.py (closed catalogue/action-owner parity only)
+docs/operations_authorization_service.md (catalogue parity only)
+docs/spec_authorization_service.md (catalogue parity only)
+.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md (catalogue parity only)
+docs/spec_contribution_compensation.md (CP01A registration parity only)
+.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md (CP01A state only)
+docs/roadmap_status.md (CP01A capability state only)
+.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json (generated parity only)
 .agent-loop/CURRENT_STATE.md
 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/{CHUNK_MAP.md,STATUS.md}
 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP01A-auth-adapter-binding-registration.md
@@ -119,4 +132,4 @@ identity, migration, or product import; update and re-review the contract first.
 
 ## Merge state
 
-- Outcome on merge: `planned`
+- Outcome on merge: `complete`

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md

@@ -69,8 +69,10 @@ remains planned and
 cannot be activated by read/status proof. The historical transfer added no
 migration because owner and availability are typed metadata. WS-XINT-002-01
 reconciles PostgreSQL parity through migration `0036`. The current catalogue
-has 73 PermissionIds, 102 ActionIds, 57 active actions, and 45 planned actions,
+has 73 PermissionIds, 106 ActionIds, 57 active actions, and 49 planned actions,
 with fourteen fixed-service identities and twenty-two matrix memberships.
+CP01A contributes the four planned/unavailable adapter-binding actions only;
+it changes no fixed-service identity or matrix membership. CP01B remains next.
 
 ## REV custody transfer
 

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md

@@ -25,7 +25,7 @@ sequence.
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
 | `WS-ARCH-001-CP01` | Combined registration planning parent | L1 | Planned split into CP01A/CP01B; non-executable |
-| `WS-ARCH-001-CP01A` | Adapter-binding unavailable registration | L1 | Proposed; excludes retirement, callback/fulfillment, identity, evaluator, and activation |
+| `WS-ARCH-001-CP01A` | Adapter-binding unavailable registration | L1 | Complete on merge; excludes retirement, callback/fulfillment, identity, evaluator, and activation |
 | `WS-ARCH-001-CP01B` | ContributionPolicy unavailable registration | L1 | Proposed after CP01A; excludes binding behavior, evaluator, and activation |
 | `WS-ARCH-001-CP03` | Exact adapter-binding activation | L1 | Proposed after merged CP02 hidden proof |
 | `WS-ARCH-001-CP05` | Exact ContributionPolicy activation | L1 | Proposed after merged CP04 hidden proof |

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md

@@ -42,8 +42,8 @@ not current start requirements.
 - ART, REV, and CON feature actions remain unavailable until their exact hidden
   owner behavior and typed manifests are merged. Their activation order lives
   in the matching XINT and feature-owner records.
-- PLAN3 proposes the missing contribution-policy sequence: CP01A registers exact
-  adapter-binding actions while unavailable and CP01B separately registers
+- PLAN3 defines the missing contribution-policy sequence: WS-ARCH-001-CP01A is
+  complete on merge with exact adapter-binding actions still unavailable; CP01B separately registers
   policy actions while unavailable; CP03 and CP05 activate
   only their respective merged hidden behavior. Fulfillment callback authority
   remains separate and cannot be bundled into adapter-binding registration.

.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json

@@ -39,14 +39,14 @@
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "0a1e990ef039786066276283bc519669a9274aceb2949e1d320f93e75203926e",
-      "end_line": 1124,
+      "end_line": 1149,
       "hard_limit": 100,
       "kind": "production_function",
       "observed_lines": 120,
       "path": "backend/app/modules/authorization/catalogue.py",
       "qualified_symbol": "_index_service_actions",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 1005
+      "start_line": 1030
     },
     {
       "capability": "unassigned_legacy_auth",
@@ -218,11 +218,11 @@
     },
     {
       "capability": "unassigned_legacy_auth",
-      "content_sha256": "b208f0ad84feb415e88445c96cd7341b09432b04e39b23bddef0c772221640bf",
-      "end_line": 13407,
+      "content_sha256": "dd8d424d97a68ff9080aa05c16feb073f4f219eb63e0d5dd55defdfad00d28b9",
+      "end_line": 13406,
       "hard_limit": 1200,
       "kind": "test_file",
-      "observed_lines": 13407,
+      "observed_lines": 13406,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": null,
       "removal_chunk": "WS-AUTH-003-CLOSE",
@@ -531,58 +531,58 @@
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "951b44cc07e36002118fe93b7974e8d65851b0e2c3cec89a3031cbe42b014e2d",
-      "end_line": 8513,
+      "end_line": 8512,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 140,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_actor_lifecycle_service_applies_success_and_guards_conflicts",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 8374
+      "start_line": 8373
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "569084d6de89ff9eae71d526fc6c157aea7638f55ca93ad128b721fbda339be6",
-      "end_line": 9003,
+      "end_line": 9002,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 122,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_admin_resource_digest_alone_rejects_substituted_role_and_disposition",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 8882
+      "start_line": 8881
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "90b8b670b4d277209617cc1aa794188b4fb3cd9d894b69d5dc3d0adfc885f6ed",
-      "end_line": 9231,
+      "end_line": 9230,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 132,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_admin_revoke_stages_complete_state_and_evidence",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 9100
+      "start_line": 9099
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "78d9bf3df08e5633e9a75720b1e4bf5b7d7b24019bc392b4cb7496a9ac5e5e8e",
-      "end_line": 11059,
+      "end_line": 11058,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 122,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_authorization_locks_refresh_cached_actor_lifecycle_state",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 10938
+      "start_line": 10937
     },
     {
       "capability": "unassigned_legacy_auth",
-      "content_sha256": "e4d94ac97842b84c9b64d46a0a86801294a90eeca7b074de5b281c8014a8fcb5",
-      "end_line": 2243,
+      "content_sha256": "9f874fde0ed7cfe54e4cd9c3fc75d18305ec48edfb6b8696e305116b3828afea",
+      "end_line": 2242,
       "hard_limit": 120,
       "kind": "test_function",
-      "observed_lines": 322,
+      "observed_lines": 321,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_closed_permission_and_action_catalogue_is_exact_and_non_executable",
       "removal_chunk": "WS-AUTH-003-CLOSE",
@@ -591,122 +591,122 @@
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "df1df6ec2ba6aa55445e21cfcf4e4e3ad9664c9504313484a495b6a6df1e9047",
-      "end_line": 3473,
+      "end_line": 3472,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 126,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_identity_link_lifecycle_route_preserves_outcome_transaction_contract",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 3348
+      "start_line": 3347
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "05d1b020ecff0f9bc0a0567adc07f5b31a2f9dfb7828ae3ad34d4e1e7757797c",
-      "end_line": 8666,
+      "end_line": 8665,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 151,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_identity_link_lifecycle_service_applies_success_and_guards_conflicts",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 8516
+      "start_line": 8515
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "c5d6d0d480ced964354915614f15202c0159bfbb281658da0d44186dffd17848",
-      "end_line": 7461,
+      "end_line": 7460,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 142,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_prepared_actor_authority_crossed_mutations_complete_in_both_orders",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 7320
+      "start_line": 7319
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "ebb76e63671195aa4d806ac602bfe58cb22bf82d00c8a70ab186785f3acd7f9b",
-      "end_line": 7802,
+      "end_line": 7801,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 336,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_prepared_crosses_real_lifecycle_service_transactions",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 7467
+      "start_line": 7466
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "9ea4fc0ddbab4c7262a43bc3f498ee1afea3318e9a0b6c93c87763f9f22aae9c",
-      "end_line": 7292,
+      "end_line": 7291,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 518,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_prepared_postgresql_failure_and_cancellation_are_atomic",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 6775
+      "start_line": 6774
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "46e0b031394da6fee856e48615732a17ff8d2276d9cedfb0ecaa3a6879410adb",
-      "end_line": 4678,
+      "end_line": 4677,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 157,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_project_11c2_reads_require_exact_admin_context_and_role_allowlist",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 4522
+      "start_line": 4521
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "e95d2a03e3829df89c43210a9de92efca31a25905c9648c3179d17b078386b17",
-      "end_line": 2644,
+      "end_line": 2643,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 397,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_project_mutation_resources_and_prepared_scopes_are_closed",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 2248
+      "start_line": 2247
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "105667302ed6e8f2fd16ea7e95d642e72e41514673e1152503536e0520f9c362",
-      "end_line": 10934,
+      "end_line": 10933,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 204,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_project_read_permissions_have_postgresql_role_scope_matrix",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 10731
+      "start_line": 10730
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "756b7f99f9a743284934b4d85ce263617710d9b8119792ccb4526a1de04070a1",
-      "end_line": 12436,
+      "end_line": 12435,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 233,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_project_role_and_all_operation_mappings_commit_one_linked_pair",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 12204
+      "start_line": 12203
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "2e1d7db74ddb955b90a0ee12e4fb72b651a0f85d2746c76e09079c05b0b85252",
-      "end_line": 13407,
+      "end_line": 13406,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 681,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_project_role_issue_postgresql_prep_binds_target_role_and_scope",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 12727
+      "start_line": 12726
     },
     {
       "capability": "unassigned_legacy_auth",
@@ -735,14 +735,14 @@
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "05621e885ed2f88d0ba1a072c1f263fc923939f7ce755a514e9872112aa830a1",
-      "end_line": 11953,
+      "end_line": 11952,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 163,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "test_service_actor_replay_fails_closed_on_committed_state_drift",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 11791
+      "start_line": 11790
     },
     {
       "capability": "unassigned_legacy_auth",
@@ -1023,14 +1023,14 @@
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "1a0a9f3e2be6965e29f76aa74272ccfa2fe4b99e4e0c3bde5ec8ba2c374b369b",
-      "end_line": 11267,
+      "end_line": 11266,
       "hard_limit": 100,
       "kind": "test_helper",
       "observed_lines": 169,
       "path": "backend/tests/test_authorization.py",
       "qualified_symbol": "_operation_success",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 11099
+      "start_line": 11098
     },
     {
       "capability": "unassigned_legacy_auth",