diff --git a/.agent-loop/CURRENT_STATE.md b/.agent-loop/CURRENT_STATE.md index 6ecc24f0b..c10a860c6 100644 --- a/.agent-loop/CURRENT_STATE.md +++ b/.agent-loop/CURRENT_STATE.md @@ -28,10 +28,10 @@ authority; these records do not grant or withhold it. | Initiative | Durable state on `main` | Remaining boundary | |---|---|---| -| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H`; CP01A-CP02 establish unavailable authority facts and hidden CON adapter-binding behavior; PLAN4 planned incremental debt retirement | Expand and review CP03 before activating the exact adapter-binding actions; PLAN4 keeps debt retirement delivery-coupled without blocking features on unrelated frozen debt; the wider PLAN2 path still targets durable `allow_review`, and `02I` remains later | +| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H`; CP01A-CP02 establish unavailable authority facts and hidden CON adapter-binding behavior; CP03 is split with executable CP03A/CP03B contracts complete on merge; PLAN4 planned incremental debt retirement | Implement CP03A owner identity/eligibility, then CP03B exact Finance Authority activation; PLAN4 keeps debt retirement delivery-coupled without blocking features on unrelated frozen debt; the wider PLAN2 path still targets durable `allow_review`, and `02I` remains later | | [WS-ART-001](initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md) | Active delivery initiative; verified ready-admission publication, hidden preparation, consumption and binding are merged through ARCH-02H | Implement exact post-submit materialization only after the unified guide/checker and PLAN2 public contracts are executable; live cutover remains later | | [WS-AUTH-001](initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md) | Active delivery initiative; project-policy authority and unified compilation authorization are merged through `12I` | POL-03B consumes 12I next; remaining AUTH activation chunks wait for their exact hidden owner behavior | -| [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; CP02 is complete on merge with hidden adapter-binding lifecycle behavior; ContributionPolicy persistence, shared lifecycle audit, and unavailable AUTH registrations are merged | Expand and review CP03 before exact adapter-binding activation; later complete guide-activation validation/persistence before task readiness, preserving immutable attempt lineage through Submission and ReviewLease | +| [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; CP02 is merged with hidden adapter-binding lifecycle behavior; CP03 is split with executable CP03A/CP03B contracts complete on merge; ContributionPolicy persistence, shared lifecycle audit, and unavailable AUTH registrations are merged | Implement CP03A target identity/owner eligibility, then CP03B exact Finance Authority activation; later complete guide-activation validation/persistence before task readiness, preserving immutable attempt lineage through Submission and ReviewLease | | [WS-AUTH-003](initiatives/WS-AUTH-003-module-boundary-recovery/STATUS.md) | AUTH boundary foundation and first public-capability proof through POL-03A are merged | Repair each touched AUTH capability through `authorization.api` and shrink the canonical AUTH ledger | | [WS-POL-003](initiatives/WS-POL-003-unified-project-guide-compilation/STATUS.md) | Active delivery initiative; hidden compilation custody and AUTH-12I activation are merged | Implement POL-03B authorized compilation persistence, then continue the reviewed dependency order | | [WS-REV-001](initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md) | Independent foundations through queue admission and reviewer-lease persistence are merged through `03A2`; schema/packet foundations may continue behind their own gates | Live admission/claim requires canonical 04E `allow_review`; ReviewLease copies the admitted Submission's immutable attempt policy version, and the first Review commit requires CON-03C/07 atomic contribution/award behavior | @@ -99,7 +99,8 @@ Do not start historical CON-05A directly. The CP01-CP09 sequence owns AUTH unavailable registration, hidden CON binding/policy behavior, exact AUTH activations, CON validation, PROJECT guide binding, TASK attempt lineage, and clean v0.1 legacy economic-path removal in that order. CP02 is complete on -merge while all four actions remain unavailable; later children remain +merge while all four actions remain unavailable. CP03 is split with executable +CP03A/CP03B contracts complete on merge; later CP04-CP09 children remain non-executable until their current-main contracts are expanded. - WS-ARCH-001-PLAN3 is planned; its planning merge changed no runtime behavior. @@ -112,7 +113,11 @@ non-executable until their current-main contracts are expanded. adapter-binding identity and lifecycle-version facts. - WS-ARCH-001-CP02 is complete on merge with hidden, route-unreachable behavior, exact lifecycle history, and deny-default production composition. -- WS-ARCH-001-CP03 is proposed and non-executable. +- WS-ARCH-001-CP03 is a planned split/non-executable parent. CP03A and CP03B have executable + contracts complete on merge and are the next ordered bounded boundaries. +- WS-ARCH-001-CP03A is planned with an executable implementation contract. +- WS-ARCH-001-CP03B is planned with an executable implementation contract after + merged CP03A. - WS-ARCH-001-CP04 is proposed and non-executable. - WS-ARCH-001-CP05 is proposed and non-executable. - WS-ARCH-001-CP06 is proposed and non-executable. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md index 7e4fcdc74..a74cb1697 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md @@ -22,8 +22,10 @@ | `WS-ARCH-001-CP01B` | AUTH ContributionPolicy unavailable registration | L1 | Complete on merge; five actions remain planned/unavailable | | `WS-ARCH-001-CP01C` | AUTH adapter-binding fact correction | L1 | Complete on merge; corrects unavailable facts before CON behavior | | `WS-ARCH-001-CP02` | CON hidden adapter-binding behavior | L1 | Complete on merge; route-unreachable and deny-default while actions remain unavailable | -| `WS-ARCH-001-CP03` | AUTH exact adapter-binding activation | L1 | Next proposed skeleton; requires a current-main executable contract | -| `WS-ARCH-001-CP04` | CON hidden ContributionPolicy behavior | L1 | Proposed skeleton after CP03 | +| `WS-ARCH-001-CP03` | Adapter-binding activation coordination parent | L1 | Planned split into CP03A/CP03B; non-executable | +| `WS-ARCH-001-CP03A` | Closed adapter target identity and PROJECTS/ACTORS owner eligibility | L1 | Planned executable contract; implementation next | +| `WS-ARCH-001-CP03B` | AUTH exact Finance Authority adapter-binding activation | L1 | Planned executable contract; follows merged CP03A | +| `WS-ARCH-001-CP04` | CON hidden ContributionPolicy behavior | L1 | Proposed skeleton after merged CP03B evidence | | `WS-ARCH-001-CP05` | AUTH exact ContributionPolicy activation | L1 | Proposed skeleton after CP04 evidence | | `WS-ARCH-001-CP06` | CON guide-activation/revision policy-validation port | L1 | Proposed skeleton after CP05 | | `WS-ARCH-001-CP07` | PROJECT guide-bound ContributionPolicyVersion persistence | L1 | Proposed skeleton after CP06 | @@ -50,11 +52,13 @@ feature contract crosses more than one reviewable mutation boundary. The 02A-02I sequence is the executable split of parent 02, subject to plan review and human approval. -CP03-CP09 and chunks 03A-04F are non-executable planning skeletons. Before implementation, +CP04-CP09 and chunks 03A-04F are non-executable planning skeletons. Before implementation, each must be replaced with a current-main contract that names exact allowed and not-allowed files, migration head, runnable commands, reviewers, and the public types it extends. Their sequencing is approved here; their current text does -not authorize code changes. +not authorize code changes. CP03 is split/non-executable; CP03A and CP03B are +the current-main executable exceptions and authorize only their ordered exact +implementations after these contracts merge. PLAN4 does not insert a new prerequisite into the product sequence. Each current or future delivery chunk applies its no-new-debt and touched-debt rules diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/DECISIONS.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/DECISIONS.md index c18c2719b..a0c38af37 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/DECISIONS.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/DECISIONS.md @@ -155,5 +155,6 @@ canonical row locking, and immutable created/suspended/resumed lifecycle events. AUTH owns Finance Authority, action availability, opaque PREP handles, authorization decisions, and decision evidence. Read uses request-scoped authorization; create/suspend/resume use one domain-specific opaque -prepare/consume/close port backed by AUTH only in CP03. CON never imports AUTH -internals or translates the CON-owned `instrument_type` value. +prepare/consume/close port backed by AUTH only in CP03B. CP03A owns the exact +adapter target identity and PROJECTS/ACTORS eligibility prerequisite. CON never +imports AUTH internals or translates the CON-owned `instrument_type` value. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md index 1fe81b797..724965116 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md @@ -350,7 +350,8 @@ CP01A AUTH adapter-binding unavailable registration -> CP01B AUTH ContributionPolicy unavailable registration -> CP01C AUTH adapter-binding fact correction -> CP02 CON hidden adapter-binding behavior --> CP03 AUTH adapter-binding activation +-> CP03A adapter target identity and owner eligibility +-> CP03B AUTH Finance Authority adapter-binding activation -> CP04 CON hidden ContributionPolicy behavior -> CP05 AUTH ContributionPolicy activation -> CP06 CON validation port diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md index 6857ad4c8..4e0828277 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md @@ -24,14 +24,14 @@ | Live assignment or review claim loses the one task-governing ContributionPolicyVersion | Critical | Enforce immutable guide -> task -> assignment -> Submission/allow_review -> ReviewLease lineage; missing, cross-project, stale or mismatched facts deny before claim effects, and neither claim performs CON policy lookup | | Review decision commits without mandatory contribution consequences | Critical | Stable REV schema precedes CON-03C/07; every decision atomically creates reviewer ContributionRecord/awards and accept additionally creates FinalAcceptance plus submitter record/awards | | Composition root absorbs domain decisions | High | Composition opens the unit of work and wires transaction-bound ports only; TASK command owns Submission sequencing and each target port enforces its own invariants | -| Policy behavior starts before exact AUTH registration | Critical | CP01A and CP01B register their separate typed unavailable authority before CP02/CP04 behavior; CP03/CP05 activate only after hidden proof | -| Binding management inherits retirement, fulfillment, callback, or delivery authority | Critical | CP01A through CP03 exclude retirement actions plus fulfillment, callback, and delivery action IDs, permissions, identities, routes, evaluators, and service-matrix rows entirely | +| Policy behavior starts before exact AUTH registration | Critical | CP01A and CP01B register their separate typed unavailable authority before CP02/CP04 behavior; CP03B/CP05 activate only after their hidden proof and exact prerequisites | +| Binding management inherits retirement, fulfillment, callback, or delivery authority | Critical | CP01A through CP03 exclude all action-bearing identities and authority for retirement, fulfillment, callback, and delivery; CP03A adds only the closed target-only `workstream.compensation.adapter` identity with no action, permission, route, evaluator, or service-matrix row | | CON writes PROJECT or TASK aggregates | Critical | CP06 returns immutable validation facts only; CP07 and CP08 own their respective writes | | Consolidated v0.1 schema gains fake compatibility debt | High | CP09 performs a clean current-baseline cut and forbids aliases, dual paths, and invented backfills | | Legacy debt becomes a blanket blocker for v0.1 delivery | High | Block new debt and require directly touched debt to shrink; never require unrelated frozen debt in a bounded feature PR | | Debt repayment expands a feature beyond a reviewable safety boundary | High | Record exact stranded debt, prove no growth, and create a later owner-sized closure contract rather than mixing product boundaries | | Mechanical quotas reward noisy or cosmetic cleanup | Medium | Use exact edge/finding deltas and behavior ownership; prohibit arbitrary per-PR percentages and cosmetic test splitting | | Overlapping ledgers are added together and misstate debt | Medium | Report general, AUTH, structural, and behavior-ownership measurements separately under their existing owners | -| Adapter-binding resume erases suspension attribution | Critical | CP02 appends one immutable CON lifecycle event per version in the same transaction; CP03 later stages AUTH decision evidence atomically beside it | -| Unrelated internal service is bound as a compensation adapter | Critical | CP02 requires an injected exact ACTORS eligibility capability; generic service kind and existing ART/REV identities fail closed, and CP03 cannot activate without an approved compensation-adapter identity rule | -| CP02 invents a second authorization protocol or imports AUTH internals | Critical | CON defines only a domain-facing opaque prepare/consume/close port; production denies until CP03 adapts the existing AUTH PREP implementation | +| Adapter-binding resume erases suspension attribution | Critical | CP02 appends one immutable CON lifecycle event per version in the same transaction; CP03B later stages AUTH decision evidence atomically beside it | +| Unrelated internal service is bound as a compensation adapter | Critical | CP02 requires an injected exact ACTORS eligibility capability; generic service kind and existing ART/REV identities fail closed; CP03A installs the exact target identity/owner rule before CP03B activation | +| CP02 invents a second authorization protocol or imports AUTH internals | Critical | CON defines only a domain-facing opaque prepare/consume/close port; production denies until CP03B adapts the existing AUTH PREP implementation | diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md index 1c365ba4c..ebaafd027 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md @@ -54,7 +54,9 @@ non-executable split parent; CP01A is complete on merge with its four actions registered/unavailable, CP01B is complete on merge with five policy actions registered/unavailable. CP02 is complete on merge with hidden CON behavior - while its AUTH actions remain unavailable; CP03-CP09 remain non-executable skeletons. + while its AUTH actions remain unavailable; CP03 is split with executable + CP03A/CP03B contracts complete on merge, while CP04-CP09 remain + non-executable skeletons. - [WS-ARCH-001-PLAN4](chunks/WS-ARCH-001-PLAN4-incremental-debt-retirement.md) is planned on merge and changes no runtime. It makes the existing incremental strangler operational: unrelated frozen debt cannot block delivery, new debt is @@ -77,8 +79,14 @@ match exact binding identity and lifecycle generation without a unit alias. - WS-ARCH-001-CP02 is complete on merge: hidden, route-unreachable adapter-binding behavior while its AUTH actions remain unavailable. -- WS-ARCH-001-CP03 is the next proposed boundary: exact adapter-binding - activation after its current-main contract is expanded and reviewed. +- WS-ARCH-001-CP03 is a planned split/non-executable parent. CP03A's executable + contract specifies the closed compensation-adapter target identity and + PROJECTS/ACTORS owner eligibility while actions remain unavailable. CP03B's + executable contract specifies and requires proof of exact Finance Authority + activation without adding a route or adjacent compensation authority. +- WS-ARCH-001-CP03A is planned with an executable implementation contract. +- WS-ARCH-001-CP03B is planned with an executable implementation contract after + merged CP03A. - WS-ARCH-001-CP04 is proposed: hidden ContributionPolicy behavior. - WS-ARCH-001-CP05 is proposed: exact ContributionPolicy activation. - WS-ARCH-001-CP06 is proposed: CON policy-validation port. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md index 299cac161..88cf2481d 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md @@ -1,11 +1,26 @@ -# Chunk Contract: WS-ARCH-001-CP03 — Adapter-Binding AUTH Activation +# Chunk Contract: WS-ARCH-001-CP03 — Adapter-Binding Activation Split Parent -Status: proposed non-executable skeleton after CP02. Risk: L1. +## Status -AUTH integrates the exact adapter-binding evaluator and activates only the -binding create/read/suspend/resume actions proven by CP02. It adds no CON -behavior, callback authority, policy activation, or generic compensation -management permission. +Split and non-executable. + +## Goal + +Coordinate the two independently reviewable prerequisites for safe +adapter-binding activation. + +## Approved split + +```text +CP02 hidden adapter-binding lifecycle behavior +-> CP03A compensation-adapter identity and owner eligibility +-> CP03B exact Finance Authority AUTH activation +-> CP04 hidden ContributionPolicy behavior +``` + +CP03A owns no AUTH action activation. CP03B owns no identity registration, +schema change, or owner eligibility behavior. Neither child adds a public +adapter-binding route. ## Merge state diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md new file mode 100644 index 000000000..3898d3436 --- /dev/null +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md @@ -0,0 +1,243 @@ +# Chunk Contract: WS-ARCH-001-CP03A — Adapter Target Identity And Owner Eligibility + +## Merge state + +- Outcome on merge: `planned` +- Future implementation target: complete while binding actions remain unavailable. + +## Parent initiative + +WS-ARCH-001 — Modular Monolith Boundaries + +## Goal + +Register one closed compensation-adapter target identity and implement the real +PROJECTS- and ACTORS-owned eligibility adapters required by CP02 create/resume, +through their owner modules' public APIs and without activating any +adapter-binding action. + +## Why this chunk exists + +CP02 intentionally used strict fakes because current main has only public owner +protocols. Its contract requires an active service actor explicitly eligible +for compensation-adapter binding and rejects generic service kind or reuse of +ART, REV, checker, dispatcher, and other internal identities. The ActorProfile +schema requires every service actor to carry a closed ServiceIdentity. CP03A +therefore establishes that target identity and owner-held locks before CP03B +can activate AUTH. + +## Risk class + +L1 — actor identity, authorization prerequisite, and transaction custody. + +## SLA + +P1 + +## Exact identity rule + +`workstream.compensation.adapter` is a closed service ActorProfile identity +used only as the eligible target of a ProjectCompensationAdapterBinding. It is +not the Finance Authority caller and receives no action, permission, service +matrix row, database grant, route, callback, provider credential, or implicit +feature authority. + +Eligibility requires, under ACTORS-owned transaction-held row locks: + +- exact `adapter_actor_id`; +- `actor_kind=service`; +- `status=active`; +- `service_identity=workstream.compensation.adapter`; +- the actor's exact service ActorIdentityLink exists, is active, and has + `subject_kind=service`. + +ACTORS exposes these facts only through +`app.modules.actors.api.CompensationAdapterActorEligibilityPort`; its concrete +implementation remains private to ACTORS. CON consumes that injected public +port. AUTH may register/provision the closed identity through existing public +composition surfaces, but AUTH must not import the ACTORS implementation or +create an AUTH-to-ACTORS domain adapter. ACTORS also exposes the closed +`ServiceIdentity` vocabulary and immutable identity collections through +`app.modules.actors.api`; AUTH catalogue, request-schema, provisioning, and API +composition code must import that public contract rather than +`app.modules.actors.service_identities`. + +PROJECTS independently locks the exact project and validates only +PROJECTS-owned binding eligibility through +`app.modules.projects.api.ProjectCompensationBindingEligibilityPort`. PROJECTS +does not inspect or decide a CON binding lifecycle state. CON owns the binding +lifecycle and decides that create and resume require the PROJECTS and ACTORS +eligibility ports, while suspend remains possible after owner ineligibility. +Both owner adapters flush nothing, commit nothing, and return only their public +immutable facts. CP02 retains the locks through the caller-owned root +transaction. + +## Allowed files + +```text +backend/app/modules/actors/service_identities.py +backend/app/modules/actors/api/service_identities.py +backend/app/modules/actors/models.py (constraint parity only) +backend/app/modules/actors/compensation_adapter.py +backend/app/modules/actors/api/compensation_adapter.py (fact/port parity only) +backend/app/modules/actors/api/__init__.py +backend/app/modules/projects/compensation_binding.py +backend/app/modules/projects/api/compensation_binding.py (fact/port parity only) +backend/app/modules/projects/api/__init__.py +backend/app/modules/authorization/service_actor_schemas.py (closed identity parity only) +backend/app/modules/authorization/service_actor_service.py (provisioning admission parity only) +backend/app/modules/authorization/catalogue.py (separate target-only identities from action-bearing fixed services) +backend/app/modules/compensation/service.py (owner-adapter injection only) +backend/app/api/deps/authorization.py (composition only; no route) +backend/app/main.py (composition only; no route) +backend/alembic/env.py +backend/alembic/versions/0005_compensation_adapter_identity.py +backend/tests/actors/test_compensation_adapter_eligibility.py +backend/tests/projects/test_compensation_binding_eligibility.py +backend/tests/compensation/test_adapter_binding_owner_fences.py +backend/tests/compensation/test_adapter_binding_authorization_integration.py +backend/tests/test_auth.py (controlled provisioning parity only) +backend/tests/test_authorization.py (closed identity/matrix separation only) +backend/tests/test_alembic.py +backend/tests/test_database_reset.py +backend/tests/conftest.py (exact current-schema fingerprint/reset parity only) +backend/alembic/baseline/v01_approved_manifest_delta.json (generated current-head parity only; do not rewrite 0001) +backend/alembic/baseline/v01_baseline_manifest.json (generated current-head parity only; do not rewrite 0001) +backend/alembic/baseline/v01_pre_reset_source_manifest.json (generated current-head parity only; do not rewrite 0001) +backend/alembic/baseline/v01_schema.sql (generated current-head parity only; do not rewrite 0001) +backend/scripts/behavior_ownership.py +backend/scripts/run_test_lanes.py +.ci/behavior-ownership/partition.v1.json +.ci/behavior-ownership/actors/compensation-adapter-eligibility.json +.ci/behavior-ownership/projects/compensation-binding-eligibility.json +.ci/module-boundaries/private-edge-debt.v1.json (remove only its corrected API-composition edge to ACTORS service identities) +.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json (generated parity only) +.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/IMPORT_LEDGER.md (remove only the corrected three AUTH-module service-identity entries; it does not inventory API composition) +.agent-loop/CURRENT_STATE.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03A-plan-review-evidence.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03A-implementation-review-evidence.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03A-external-review-response.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03A-pr-trust-bundle.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md +.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md +.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md +.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md +docs/architecture_data_model.md +docs/spec_authorization_service.md +docs/operations_authorization_service.md +docs/spec_contribution_compensation.md +docs/roadmap_status.md +``` + +## Not allowed + +```text +adapter-binding action activation or evaluator +Finance Authority grant/evaluation changes +service action matrix row for workstream.compensation.adapter +public route, provider adapter, credential, endpoint, account, or network I/O +binding lifecycle, repository, event, recovery, or idempotency changes +ContributionPolicy, retirement, award, fulfillment, callback, delivery, dispatcher, reconciliation, or reputation behavior +generic service eligibility, prefix matching, runtime plugin discovery, or reuse of another fixed identity +private cross-module imports or a second owner-adapter path +compatibility support for old identities or deployed rows +``` + +## Acceptance criteria + +- [ ] Exactly one closed identity, `workstream.compensation.adapter`, is added; + all existing identities and matrix memberships are unchanged. +- [ ] Closed ActorProfile service identities and action-bearing fixed-service + identities are explicit separate sets. The target identity belongs only + to the former; catalogue import succeeds without an empty or invented + matrix row, and runtime service-action admission rejects it. +- [ ] Migration `0005_compensation_adapter_identity` updates only the closed + ActorProfile service-identity constraint and refuses downgrade without + mutation when the new identity is referenced. +- [ ] Existing controlled service provisioning can create the exact profile and + identity link but grants it no role, permission, matrix membership, or + feature authority. +- [ ] ACTORS locks and validates the exact active profile and active service + identity link; human actors, generic service kind, missing/revoked links, + inactive profiles, and every existing ART/REV/project/checker identity + deny with one concealed unavailable result. +- [ ] ACTORS exposes and CP02/CON consumes only the immutable public + `CompensationAdapterActorEligibilityPort`; AUTH and CON import no ACTORS + private model, repository, service, or concrete adapter. +- [ ] ACTORS exposes `ServiceIdentity`, `SERVICE_IDENTITIES`, and any required + immutable closed-identity values through `app.modules.actors.api` without + duplicating or translating the vocabulary. AUTH `catalogue.py`, + `service_actor_schemas.py`, `service_actor_service.py`, and API composition + `app/api/deps/authorization.py` consume only that public API and have no + direct `actors.service_identities` import. +- [ ] The module-boundary debt ledger and human-readable import ledger remove + exactly their respective corrected private edges: the machine ledger + removes its one inventoried API-composition edge, while the AUTH outbound + ledger removes its three inventoried AUTH-module entries. CP03A adds no + new private edge and does not claim unrelated existing AUTH-to-ACTORS + debt as repaired. +- [ ] PROJECTS locks and validates only the exact project's PROJECTS-owned + binding eligibility through the immutable public + `ProjectCompensationBindingEligibilityPort`; absent, ineligible, and + cross-project targets deny, and PROJECTS contains no CON lifecycle rule. +- [ ] CON alone decides that create/resume invoke both owner eligibility ports + and that suspend does not; no owner module interprets binding status or + lifecycle version. +- [ ] Owner locks remain held through CP02 authorization and mutation for + create/resume; a competing revocation or project-ineligibility commit + cannot enter between validation and product transition. +- [ ] If revocation/ineligibility commits first, create/resume denies before + AUTH consumption and creates no binding, lifecycle event, or allowed + evidence. +- [ ] Suspend remains possible after target/project ineligibility once CP03B + provides Finance Authority; CP03A does not weaken that recovery rule. +- [ ] All four adapter-binding actions remain planned/unavailable; no route or + product behavior becomes reachable. + +## Verification commands + +```bash +(cd backend && .venv/bin/python -m ruff check app/modules/actors/service_identities.py app/modules/actors/api/service_identities.py app/modules/actors/models.py app/modules/actors/compensation_adapter.py app/modules/actors/api/compensation_adapter.py app/modules/actors/api/__init__.py app/modules/projects/compensation_binding.py app/modules/projects/api/compensation_binding.py app/modules/projects/api/__init__.py app/modules/authorization/service_actor_schemas.py app/modules/authorization/service_actor_service.py app/modules/authorization/catalogue.py app/modules/compensation/service.py app/api/deps/authorization.py app/main.py alembic/env.py alembic/versions/0005_compensation_adapter_identity.py scripts/behavior_ownership.py scripts/run_test_lanes.py tests/actors/test_compensation_adapter_eligibility.py tests/projects/test_compensation_binding_eligibility.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_authorization_integration.py tests/test_auth.py tests/test_authorization.py tests/test_alembic.py tests/test_database_reset.py tests/conftest.py) +(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/actors/test_compensation_adapter_eligibility.py tests/projects/test_compensation_binding_eligibility.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_authorization_integration.py tests/test_alembic.py tests/test_database_reset.py --cov=app.modules.actors.compensation_adapter --cov=app.modules.projects.compensation_binding --cov-fail-under=90) +(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/test_auth.py -k service_actor) +(cd backend && .venv/bin/python -m pytest -q tests/test_authorization.py -k "service_actor or service_identity or service_action_matrix") +(cd backend && .venv/bin/python -m scripts.test_structure_boundary validate --policy ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_POLICY.md --ledger ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json) +(cd backend && .venv/bin/python -m scripts.module_boundaries validate --protected-base origin/main) +! rg -n "app\.modules\.actors\.service_identities" backend/app/modules/authorization/catalogue.py backend/app/modules/authorization/service_actor_schemas.py backend/app/modules/authorization/service_actor_service.py backend/app/api/deps/authorization.py +python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_stale_workstream_wording.py +python3 scripts/check_chunk_state_sync.py --base-ref origin/main +python3 scripts/check_markdown_links.py +git diff --check +gh pr checks --watch +``` + +Hosted GitHub Actions owns the full PostgreSQL matrix and repository coverage. +The local machine must not run the full suite. + +Sub-agent session closure is verified by the executing agent at completion; it +is orchestration state, not a repository command. + +## Required reviewers + +Architecture, security/auth, product/operations, QA, test delta, CI integrity, +senior engineering, reuse/dedup, and documentation. + +## Human review focus + +Confirm the exact target-only identity, absence of a service matrix grant, +owner-module lock custody, denial of every existing fixed identity, migration +safety, and continued unavailability of all binding actions. + +## Stop conditions + +Stop and amend/re-review if another identity, permission, action, matrix row, +provider behavior, owner fact, schema surface, or cross-module private import is +required. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md new file mode 100644 index 000000000..4315e66dc --- /dev/null +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md @@ -0,0 +1,324 @@ +# Chunk Contract: WS-ARCH-001-CP03B — Adapter-Binding AUTH Activation + +## Merge state + +- Outcome on merge: `planned` +- Future implementation target: complete. + +## Parent initiative + +WS-ARCH-001 — Modular Monolith Boundaries + +## Goal + +Install the AUTH-owned adapter for CP02's hidden adapter-binding service and +activate exactly the existing read, create, suspend, and resume actions for a +human Finance Authority covering the exact project. + +## Why this chunk exists + +CP01A/CP01C registered exact immutable authorization facts while leaving the +four actions unavailable. CP02 then proved the route-unreachable CON lifecycle, +owner fences, transaction custody, idempotent recovery, and deny-default +composition. CP03A registers the exact compensation-adapter target identity and +installs real PROJECTS/ACTORS owner adapters. CP03B is the narrow activation +boundary: AUTH may now authorize +those proven operations without granting generic compensation authority or +moving CON behavior into AUTH. + +## Approved plan references + +- INTENT: `.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md` +- CP02 contract: `.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP02-con-binding-behavior.md` +- CON handoff: `.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md` + +## Risk class + +L1 — authorization and compensation infrastructure activation. + +## SLA + +P1 + +## Entry gate + +- CP01A and CP01C are merged with the exact four action identifiers, permission + mapping, typed facts, and canonical resource digests. +- CP02 is merged with hidden CON create/read/suspend/resume behavior, immutable + lifecycle history, owner-held eligibility fences, operation fencing, and + deny-default production composition. +- CP03A is merged with the exact target identity, owner adapters, and migration + head recorded by that chunk. CP03B adds no migration. +- No public adapter-binding route exists. CP03 does not add one. + +## Exact activation manifest + +| ActionId | PermissionId | Principal | Protocol | Exact resource | +|---|---|---|---|---| +| `compensation.adapter_binding.read` | `compensation.adapter_binding.manage` | active human Finance Authority covering the exact project | request-scoped query authorization | `project_id`, `adapter_binding_id` | +| `compensation.adapter_binding.create` | `compensation.adapter_binding.manage` | active human Finance Authority covering the exact project | opaque transaction-bound PREP | project, server-generated binding identity, `instrument_type`, eligible adapter actor, non-secret route key, operation and request digest | +| `compensation.adapter_binding.suspend` | `compensation.adapter_binding.manage` | active human Finance Authority covering the exact project | opaque transaction-bound PREP | project, exact active binding, expected lifecycle version, operation and request digest | +| `compensation.adapter_binding.resume` | `compensation.adapter_binding.manage` | active human Finance Authority covering the exact project | opaque transaction-bound PREP | project, exact suspended binding, expected lifecycle version, operation and request digest | + +System-scoped Finance Authority covers every eligible project; project-scoped +Finance Authority covers only its exact project. No other administrative role, +project role, service identity, or database principal may substitute. + +## Required authorization composition + +### Query + +`read` resolves the authenticated human ActorProfile and exact active identity +link, uses canonical owner facts for the exact project/binding, verifies one +effective Finance Authority grant covering the project, and evaluates the +active read action against the exact CP01C resource digest. Missing, stale, +cross-project, revoked, wrong-kind, or unauthorized targets use CP02's single +concealed conflict behavior. + +Exact duplicate mutation recovery performs this fresh read authorization. It +creates no mutation PREP, mutation-allowed evidence, binding change, lifecycle +event, or product effect. Query-scoped read-decision evidence may be staged for +the recovered binding but cannot be used as mutation authority. + +### Mutation + +The adapter translates CP02's public immutable mutation facts into the existing +AUTH public PREP protocol. The prepared handle remains opaque, process-local, +non-serializable, single-use, actor-bound, identity-link-bound, action-bound, +permission-bound, resource-digest-bound, operation-bound, request-digest-bound, +session-bound, and transaction-bound. + +CP02 retains its mandatory ordering: + +```text +root transaction +-> canonical request digest +-> PostgreSQL operation fence and recovery check +-> PROJECTS then ACTORS eligibility fences where required +-> binding row lock where required +-> AUTH prepare +-> AUTH consume +-> AUTH close in finally +-> CON mutation and immutable lifecycle event +-> flush +-> caller commits once +``` + +AUTH returns the exact authorized `actor_profile_id`; CP02 rejects any mismatch. +AUTH evidence and the CON mutation commit or roll back together. AUTH does not +commit, construct product rows, acquire CON locks, or import CON models or +repositories. + +## Allowed files + +```text +backend/app/modules/authorization/api/adapter_bindings.py +backend/app/modules/authorization/api/__init__.py +backend/app/modules/authorization/catalogue.py +backend/app/modules/authorization/runtime.py (closed resource-context union only) +backend/app/modules/authorization/prepared.py (reuse/integration only) +backend/app/modules/authorization/kernel.py (exact Finance Authority evaluator integration only) +backend/app/modules/authorization/adapter_binding_authorization.py +backend/app/modules/authorization/domain/adapter_bindings.py +backend/app/modules/authorization/domain/prepared_adapter_bindings.py +backend/app/adapters/auth/adapter_bindings.py +backend/app/adapters/auth/__init__.py +backend/app/api/deps/authorization.py (composition only; no route) +backend/app/main.py (composition only; no route) +backend/app/modules/compensation/api/adapter_bindings.py (public-port parity only) +backend/app/modules/compensation/service.py (dependency injection only; no lifecycle behavior change) +backend/tests/authorization/test_adapter_binding_activation.py +backend/tests/authorization/test_adapter_binding_authorization.py +backend/tests/compensation/test_adapter_binding_authorization_integration.py +backend/tests/compensation/test_adapter_binding_authorization_failures.py +backend/tests/compensation/test_adapter_binding_recovery.py +backend/tests/compensation/test_adapter_binding_owner_fences.py +backend/tests/compensation/test_adapter_binding_service.py +backend/tests/compensation/test_adapter_binding_database_guards.py +backend/tests/compensation/test_adapter_binding_persistence.py +backend/tests/architecture/test_authorization_boundary.py +backend/tests/test_authorization.py (closed catalogue/evaluator parity only) +backend/tests/test_audit.py (atomic evidence parity only) +backend/scripts/behavior_ownership.py (exact changed-target ownership only) +backend/scripts/run_test_lanes.py (exact CP03 test custody only) +.ci/behavior-ownership/partition.v1.json (exact additive target parity only) +.ci/behavior-ownership/auth/adapter-binding-activation.json +.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json (generated parity only) +.agent-loop/CURRENT_STATE.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03B-plan-review-evidence.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03B-implementation-review-evidence.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03B-external-review-response.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03B-pr-trust-bundle.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md +.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md +.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md +.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md +docs/spec_authorization_service.md +docs/operations_authorization_service.md +docs/spec_contribution_compensation.md +docs/roadmap_status.md +``` + +If implementation proves another file is essential, stop and amend/re-review +this contract before touching it. The named review paths do not authorize +arbitrary initiative files. + +## Not allowed + +```text +public HTTP routes or frontend behavior +new ActionId, PermissionId, role, service identity, matrix row, or database grant +database migration or schema change +ContributionPolicy behavior or activation +adapter-binding retirement +award, fulfillment, callback, dispatcher, delivery, reconciliation, or provider behavior +CON model, repository, lifecycle, operation-fence, owner-fence, or idempotency changes +AUTH imports of CON private modules, models, repositories, or services +CON imports of AUTH private modules +raw AuthorizationContext as durable mutation authority +another prepared-authorization protocol, generic resource dictionary, compatibility alias, fallback evaluator, or dual composition path +Project Manager, Operator, Access Administrator, Audit Authority, project-role, or service substitution for Finance Authority +``` + +## Acceptance criteria + +- [ ] Exactly the four manifest actions become `ACTIVE`, remain mapped only to + `compensation.adapter_binding.manage`, and retain their existing owner. +- [ ] The active catalogue count increases by exactly four; every adjacent + ContributionPolicy, retirement, award, fulfillment, callback, delivery, + dispatcher, and reconciliation action remains unavailable or absent. +- [ ] Only an active human profile with the exact active identity link and an + effective system- or same-project `finance_authority` grant can read or + mutate a binding in that covered project. +- [ ] Project Manager, Operator, Access Administrator, Audit Authority, + Submitter, Reviewer, Adjudicator, fixed services, unrelated services, + wrong-project Finance Authority, revoked/inactive profiles or links, and + revoked/stale grants deny without target disclosure. +- [ ] Read authorization binds the exact project and binding identity. +- [ ] Create PREP binds actor, link, action, permission, project, generated + binding ID, `instrument_type`, adapter actor, route key, operation, + request digest, resource digest, session, and transaction. +- [ ] Suspend/resume PREP additionally binds the exact expected status and + positive lifecycle version. Wrong action/status/version/resource, + copied handle, replay, wrong session, wrong transaction, replaced root + transaction, or mutated facts deny. +- [ ] Every prepared object closes exactly once on success, denial, conflict, + exception, and rollback; no handle can be serialized or reused. +- [ ] AUTH evidence commits atomically with the exact CP02 binding/lifecycle + event. Denial or downstream failure leaves no binding change, lifecycle + event, or allowed evidence. +- [ ] Exact duplicate recovery uses fresh read authority and produces the + immutable original result without a second mutation PREP or mutation + evidence effect; any read evidence remains query-only, and changed facts + or denied current read remain concealed. +- [ ] CP02's PROJECTS-then-ACTORS eligibility fences and operation ordering + remain intact for create/resume, including revocation races. +- [ ] Delivery composition injects one AUTH-owned adapter through public ports; + no reachable composed production command intentionally omits it. CP02's + safe deny-default constructor remains for uncomposed/isolated use. +- [ ] No public route becomes reachable and no migration is added. +- [ ] AUTH and changed compensation authorization coverage remain at or above + 90 percent; repository coverage remains at or above the protected floor. + +## Required focused proof + +### Positive + +- system Finance Authority read/create/suspend/resume; +- exact-project Finance Authority read/create/suspend/resume; +- one lifecycle event and one allowed evidence effect per successful mutation; +- exact duplicate recovery with fresh authorized read and no second mutation + effect. + +### Principal and scope isolation + +- every excluded administrative/project/service principal denies; +- wrong-project, revoked/inactive profile or link, revoked/stale grant, + non-human context, and mismatched authenticated actor deny; +- system scope does not bypass resource lifecycle or owner eligibility. + +### PREP and resource integrity + +- wrong action, permission, project, binding, instrument, adapter actor, route, + operation, request digest, expected status/version, session, transaction, and + replaced transaction deny; +- copied, reconstructed, serialized, closed, and replayed handles deny; +- returned-actor mismatch denies before CON mutation. + +### Atomicity and ordering + +- AUTH consumes before binding mutation/lifecycle-event staging; +- consume denial/exception, close failure, wrong actor, CON flush failure, and + transaction rollback leave zero product and allowed-evidence effects; +- create/resume owner locks remain held through AUTH and mutation; +- concurrent same-operation recovery and distinct-operation one-active-binding + behavior remain unchanged. + +## Verification commands + +```bash +(cd backend && .venv/bin/python -m ruff check app/modules/authorization/api/adapter_bindings.py app/modules/authorization/api/__init__.py app/modules/authorization/catalogue.py app/modules/authorization/runtime.py app/modules/authorization/prepared.py app/modules/authorization/kernel.py app/modules/authorization/domain/adapter_bindings.py app/modules/authorization/domain/prepared_adapter_bindings.py app/modules/authorization/adapter_binding_authorization.py app/adapters/auth/adapter_bindings.py app/adapters/auth/__init__.py app/api/deps/authorization.py app/main.py app/modules/compensation/api/adapter_bindings.py app/modules/compensation/service.py tests/authorization/test_adapter_binding_activation.py tests/authorization/test_adapter_binding_authorization.py tests/compensation/test_adapter_binding_authorization_integration.py tests/compensation/test_adapter_binding_authorization_failures.py tests/compensation/test_adapter_binding_recovery.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_service.py tests/compensation/test_adapter_binding_database_guards.py tests/compensation/test_adapter_binding_persistence.py tests/architecture/test_authorization_boundary.py tests/test_authorization.py tests/test_audit.py) +(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/authorization/test_adapter_binding_activation.py tests/authorization/test_adapter_binding_authorization.py tests/compensation/test_adapter_binding_authorization_integration.py tests/compensation/test_adapter_binding_authorization_failures.py tests/compensation/test_adapter_binding_recovery.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_service.py tests/compensation/test_adapter_binding_database_guards.py tests/compensation/test_adapter_binding_persistence.py tests/architecture/test_authorization_boundary.py tests/test_authorization.py tests/test_audit.py --cov=app.modules.authorization.adapter_binding_authorization --cov=app.modules.authorization.api.adapter_bindings --cov=app.modules.authorization.domain.adapter_bindings --cov=app.modules.authorization.domain.prepared_adapter_bindings --cov=app.adapters.auth.adapter_bindings --cov-fail-under=90) +(cd backend && .venv/bin/python -m scripts.test_structure_boundary validate --policy ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_POLICY.md --ledger ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json) +(cd backend && .venv/bin/python -m scripts.module_boundaries validate --protected-base origin/main) +python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_stale_workstream_wording.py +python3 scripts/check_chunk_state_sync.py --base-ref origin/main +python3 scripts/check_markdown_links.py +git diff --check +gh pr checks --watch +``` + +Hosted GitHub Actions owns the full PostgreSQL matrix and repository-wide +coverage run. The local machine must not run the full suite. + +The focused coverage command measures the materially changed AUTH +adapter/evaluator modules. Existing catalogue, kernel, PREP, package-export, +composition-root, and CON injection files receive exact behavioral assertions +in the listed tests plus GitHub's repository-wide coverage gate; adding those +large parity surfaces to one combined focused percentage would obscure rather +than prove the new boundary. Sub-agent session closure is verified by the +executing agent at completion, not by an invented repository command. + +## Required reviewers + +- architecture +- security/auth +- product/operations +- QA +- test delta +- CI integrity +- senior engineering +- reuse/dedup +- documentation + +All Critical and High findings are fixed before readiness. Every external +finding is replayed against the exact head and fixed only when valid. + +## Human review focus + +Confirm that only covered human Finance Authority can cross the four exact +CP02 boundaries; resource and transaction binding are complete; duplicate +recovery does not mint mutation authority; CON ownership/fences remain intact; +and no adjacent compensation action, service identity, route, or migration is +activated. + +## Stop conditions + +Stop and amend/re-review this contract if implementation needs: + +- another action, permission, principal, role, service identity, or resource + fact; +- a migration, route, CON lifecycle change, or new product behavior; +- a generic compensation evaluator or another PREP protocol; +- a private cross-module import or second composition path; +- weakened authorization, boundary, test, or CI proof. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP04-con-policy-behavior.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP04-con-policy-behavior.md index 9e01e291e..79440a4e0 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP04-con-policy-behavior.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP04-con-policy-behavior.md @@ -1,6 +1,6 @@ # Chunk Contract: WS-ARCH-001-CP04 — Hidden ContributionPolicy Behavior -Status: proposed non-executable skeleton after CP03. Risk: L1. +Status: proposed non-executable skeleton after merged CP03B evidence. Risk: L1. CON implements hidden ContributionPolicy read/draft/update/publish/retire behavior using the existing persistence aggregate, exact binding lifecycle, and diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md new file mode 100644 index 000000000..0ea93b97d --- /dev/null +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md @@ -0,0 +1,86 @@ +# WS-ARCH-001-CP03 Plan Review Evidence + +## Result + +pass + +## Reviewed intent + +Prepare the next safe adapter-binding activation boundary from current main. +The review proved the former singular CP03 skeleton was not executable because +CP02 requires an explicitly eligible service target plus real PROJECTS/ACTORS +owner fences that current main did not provide. + +## Corrected design + +```text +CP02 hidden adapter-binding lifecycle +-> CP03A closed target identity and PROJECTS/ACTORS owner eligibility +-> CP03B exact human Finance Authority AUTH activation +-> CP04 hidden ContributionPolicy behavior +``` + +CP03A registers `workstream.compensation.adapter` as a target-only service +identity, separates closed ActorProfile identities from action-bearing +fixed-service identities, adds no matrix membership, implements owner-held +eligibility, and keeps all four actions unavailable. CP03B reuses the existing +AUTH read/PREP machinery and activates only read/create/suspend/resume. + +## Findings resolved + +- Added the closed AUTH runtime and domain PREP files needed for canonical + resource contexts instead of another authorization protocol. +- Distinguished duplicate-recovery read evidence from mutation PREP/evidence. +- Split identity/schema/owner eligibility from action activation. +- Added exact PROJECTS/ACTORS owner adapter files and retained-lock/race proof. +- Made ACTORS identity eligibility and PROJECTS project eligibility explicit + public owner APIs consumed by injected CON ports; AUTH imports neither owner + implementation, PROJECTS interprets no CON lifecycle state, and CON alone + decides which lifecycle operations require the ports. +- Required ACTORS to expose its unchanged closed `ServiceIdentity` contract + through `actors.api`, moved the three CP03A-touched AUTH consumers and the + touched API-composition consumer to that public surface, and scoped each + boundary ledger to retire exactly the edges it inventories: three in the + AUTH outbound ledger and one composition edge in the machine ledger. +- Defined a target-only identity that cannot enter the service action matrix. +- Added exact migration, reset fingerprint, fixed-baseline, provisioning, and + downgrade-refusal proof for CP03A. +- Replaced broad package coverage with exact changed-module coverage. +- Added existing CP02 fence, database, persistence, recovery, and concurrency + tests to CP03B verification. +- Removed nonexistent grant expiry semantics and retained revoked/stale proof. +- Preserved CP02's safe deny-default constructor while requiring composed + delivery to inject the real adapter. +- Reconciled current state, ARCH/AUTH/CON maps and status, activation custody, + handoff, plan, decisions, risks, conformance matrix, roadmap, and canonical + specifications. + +## Reviewer results + +| Track | Result | Notes | Remaining blocker | +|---|---|---|---| +| Architecture / senior engineering | pass | Closed-identity public API and exact ledger scope corrected | none | +| Security / authorization | pass | Low evidence-cleanup risk resolved in this document | none | +| Product / operations | pass | — | none | +| Reuse / QA / test delta | pass | — | none | +| CI integrity | pass | — | none | +| Documentation | pass | Current entry points and executable contracts are consistent; completed CP02 remains historical exact-change evidence under the atomic-state gate | none | + +## Deterministic evidence + +- stale authorization wording scan: pass; +- atomic chunk-state synchronization: pass; +- changed Markdown links: pass; +- module-boundary validation: pass; +- test-structure debt validation: pass; +- `git diff --check`: pass. + +No runtime code, action availability, service identity, schema, route, or +product behavior changes in this planning PR. + +The merged CP02 contract retains its then-current umbrella `CP03` wording as +historical exact-change evidence. Editing that completed contract in this +planning PR would combine a `complete` outcome with the planned CP03/CP03A/CP03B +outcomes and is rejected by the atomic chunk-state gate. Current implementation +authority is instead explicit in `CURRENT_STATE.md`, the initiative maps and +statuses, and the executable CP03A/CP03B contracts. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md new file mode 100644 index 000000000..c2fbe4f8c --- /dev/null +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md @@ -0,0 +1,62 @@ +# WS-ARCH-001-CP03 Planning PR Trust Bundle + +## Intent + +Replace the stale non-executable CP03 activation skeleton with current-main, +reviewed, PR-sized contracts that can be implemented without boundary shortcuts +or accidental service authority. + +## Scope + +- Record CP03 as a split/non-executable parent. +- Add executable CP03A for the closed compensation-adapter target identity, + PROJECTS/ACTORS owner eligibility, and migration proof while actions remain + unavailable. +- Add executable CP03B for exact human Finance Authority read/PREP activation + after CP03A merges. +- Reconcile all current planning, status, custody, handoff, risk, conformance, + roadmap, and canonical specification records affected by the split. + +## Non-goals + +This PR adds no production code, migration, identity, matrix row, route, +evaluator, action activation, CON behavior, ContributionPolicy behavior, +provider integration, callback, fulfillment, delivery, or reputation behavior. + +## Key safety decision + +`workstream.compensation.adapter` is a future binding target, not an AUTH +caller. CP03A must allow controlled provisioning and owner locking but must not +give it any action or matrix membership. CP03B admits only an authenticated +human Finance Authority covering the exact project. + +## Verification + +- stale authorization wording scan: pass; +- chunk-state synchronization: pass; +- changed Markdown links: pass; +- module-boundary and test-structure validation: pass; +- `git diff --check`: pass. + +Hosted CI will provide the exact-head repository gates for this documentation +change. Future CP03A/CP03B implementation PRs own their focused PostgreSQL and +coverage commands plus GitHub's full distributed backend suite. + +## Reviewer result + +Result: `pass`. + +Architecture, security, product/operations, reuse/QA/test-delta, CI-integrity, +senior-engineering, and documentation plan reviews passed after the contracts +were corrected. The detailed dispositions are in +`WS-ARCH-001-CP03-plan-review-evidence.md`. + +## Human review focus + +Confirm the linear CP03A-before-CP03B dependency, target-only identity with no +matrix authority, ACTORS-owned public identity contracts with no AUTH private +import, owner-module lock custody, exact Finance Authority principal, no public +route, and complete exclusion of adjacent compensation behavior. + +Only an authorized human may merge the planning PR. CP03A implementation must +not start until this plan merges. diff --git a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md index 6f87f0744..38c62e61c 100644 --- a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md +++ b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md @@ -198,6 +198,25 @@ focused coverage commands for every changed subsystem at 90 percent or higher, and the full backend suite preserving the global 78 percent floor. Generic “as applicable” proof or AUTH-only tests cannot authorize activation. +`WS-ARCH-001-CP03` is split/non-executable. CP03A is the prerequisite executable +contract for the closed adapter target identity and real owner eligibility; it +activates no action. CP03B is the activation executable contract. CP02 provides +the immutable hidden feature manifest, transaction custody, recovery behavior, +and deny-default composition. After CP03A merges, CP03B may activate only: + +```text +compensation.adapter_binding.read +compensation.adapter_binding.create +compensation.adapter_binding.suspend +compensation.adapter_binding.resume +``` + +All four remain unavailable until CP03B implementation merges. They admit only +an active human Finance Authority covering the exact project, use the existing +request-scoped read and opaque PREP protocols, add no service identity or +route, and do not activate ContributionPolicy, retirement, fulfillment, +callback, delivery, dispatcher, or reconciliation authority. + `WS-AUTH-001-ART-02D-INTERNAL` requires the exact merged ART-02C2 verification, resolution, and scanner behavior plus ART-02C3 recovery/fencing foundations and any ART-02D resource-composer dependency. ART-02D does not own the internal diff --git a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md index 17ad58957..29ddd3faa 100644 --- a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md @@ -18,7 +18,7 @@ may proceed concurrently; open pull requests show transient ownership. ## Chunks `WS-ARCH-001/CHUNK_MAP.md` owns the ordered cross-module sequence -`WS-ARCH-001-CP01A -> CP01B -> CP01C -> CP02 -> CP03 -> CP04 -> CP05`; the AUTH entries below +`WS-ARCH-001-CP01A -> CP01B -> CP01C -> CP02 -> CP03A -> CP03B -> CP04 -> CP05`; the AUTH entries below project only AUTH-owned registration and activation responsibilities from that sequence. @@ -28,7 +28,9 @@ sequence. | `WS-ARCH-001-CP01A` | Adapter-binding unavailable registration | L1 | Complete on merge; excludes retirement, callback/fulfillment, identity, evaluator, and activation | | `WS-ARCH-001-CP01B` | ContributionPolicy unavailable registration | L1 | Complete on merge; excludes binding behavior, evaluator, and activation | | `WS-ARCH-001-CP01C` | Adapter-binding fact correction | L1 | Complete on merge; unavailable facts match binding identity and lifecycle generation | -| `WS-ARCH-001-CP03` | Exact adapter-binding activation | L1 | Proposed after merged CP02 hidden proof | +| `WS-ARCH-001-CP03` | Adapter-binding activation parent | L1 | Split into CP03A/CP03B; non-executable | +| `WS-ARCH-001-CP03A` | Adapter target identity and owner eligibility prerequisite | L1 | Executable contract complete on merge; actions remain unavailable | +| `WS-ARCH-001-CP03B` | Exact Finance Authority adapter-binding activation | L1 | Executable contract complete on merge; follows CP03A | | `WS-ARCH-001-CP05` | Exact ContributionPolicy activation | L1 | Proposed after merged CP04 hidden proof | | `WS-AUTH-001-PLAN` | Authorization Service Planning | L0 | Merged through PR #91 as `ad6d644` | | `WS-AUTH-001-01` | Adopt Authorization Baseline And Repository Contracts | L1 | Merged through PR #93 as `772af1d` | diff --git a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md index 79b5b1e54..15d3ef80f 100644 --- a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md +++ b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md @@ -46,8 +46,11 @@ not current start requirements. complete on merge with exact adapter-binding actions still unavailable; CP01B is complete on merge and separately registers policy actions while unavailable; CP01C is complete on merge with corrected - unavailable binding identity and lifecycle-generation facts; CP03 and CP05 activate - only their respective merged hidden behavior. Fulfillment callback authority + unavailable binding identity and lifecycle-generation facts; CP03 is split. + CP03A's executable contract adds only the target identity and owner + eligibility while actions remain unavailable; CP03B's implementation then + activates only CP02's four exact Finance Authority boundaries. CP05 later activates + only CP04's merged hidden policy behavior. Fulfillment callback authority remains separate and cannot be bundled into adapter-binding registration. Open pull requests are the transient-work view. This status page does not name diff --git a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md index 054aa96e5..cf3e4f94d 100644 --- a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md +++ b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md @@ -4,12 +4,16 @@ Current `main` contains the AUTH actor, grant, fixed-service, prepared-mutation, project-guide, policy-mutation, and REV-readiness -foundations plus merged REV PLAN4 and ART foundations. The old -`0052_legacy_intake_removal` identifier is historical merge evidence. Current -main ends at `0003_submission_lineage`; CP02 installs -`0004_compensation_adapter_binding_lifecycle` as the active head on merge. These foundations do -not create CON runtime, activate CON behavior, or give an outbox dispatcher -feature authority. +foundations plus merged REV PLAN4, ART foundations, and CP02 hidden CON +adapter-binding behavior. The old `0052_legacy_intake_removal` identifier is +historical merge evidence. Current main ends at +`0004_compensation_adapter_binding_lifecycle`, whose tracked predecessor is +`0003_submission_lineage`. No later numbered migration is part of the active +tracked graph. CP02's four binding actions +remain unavailable. CP03 is split: CP03A installs the target identity and owner +eligibility while actions stay unavailable; CP03B activates only the four exact +Finance Authority boundaries. No public CON route, ContributionPolicy +behavior, or outbox-dispatcher authority is active. AUTH owns identifiers, stable permission mappings, principals, grants, fixed-service identities and matrix rows, prepared authorization, evaluators, @@ -43,7 +47,7 @@ protocol and one caller-owned commit. | `02C` lifecycle audit participant | none; caller supplies already-authorized typed facts | CON may proceed | | `CP01A` binding registration | exact binding actions, typed contexts, custody and permission mapping; retirement/callback/fulfillment excluded | register unavailable first | | `CP01B` policy registration | exact `contribution.policy.*` actions, typed contexts, custody and permission mapping | register unavailable after CP01A and before hidden services | -| `CP03` binding activation | exact CP02-proven binding actions only | activate after hidden proof | +| `CP03A/CP03B` binding prerequisite/activation | exact adapter target identity and owner eligibility, then exact CP02-proven binding actions only | keep unavailable through CP03A; activate in CP03B | | `CP05` policy activation | exact CP04-proven policy actions only | activate after hidden proof | | `CP06-CP08` validation and owner persistence | existing guide activation authority; later TASK readiness/claim authority remains TASK/AUTH-owned | CON validates only; PROJECT/TASK own writes | | `06` former review-claim lookup | none | planned retirement; REV copies the admitted Submission's immutable attempt version, verifies Task/Assignment only for equality, and performs no CON/current-policy lookup | @@ -82,9 +86,11 @@ matrix rows, or evaluators. No AUTH change blocks planning or completed CON `03A`, `03B`, or `02C`. CP01A and CP01B separately register binding and policy authority while unavailable. CP01C corrects binding identity and lifecycle-generation facts before CP02. -CP02 is complete on merge with hidden CON behavior while every binding action -remains unavailable. CP03 and CP05 activate -only their respective CP02/CP04 hidden proof. Before CON +CP02 is merged with hidden CON behavior while every binding action remains +unavailable. CP03 is split: CP03A first installs the exact target identity and +owner eligibility without activation; CP03B then activates only the four exact +CP02 Finance Authority boundaries. CP05 later +activates only CP04's hidden proof. Before CON `02B`, AUTH must deliver the complete dispatcher identity/admission/action contract. That later dispatcher work must not delay the persistence and transaction-participant foundations now needed by REV. diff --git a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md index 0b86ec098..374984565 100644 --- a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md @@ -14,6 +14,9 @@ signed-loop records do not make behavior live. | `03A` | Adapter-binding persistence | Merged PR #267; migration 0053 | | `03B` | Contribution-policy persistence | Merged PR #274; migration 0055 | | `WS-ARCH-001-CP02` | Hidden adapter-binding lifecycle behavior | Complete on merge; actions remain unavailable | +| `WS-ARCH-001-CP03` | Adapter-binding activation parent | Split into CP03A/CP03B; non-executable | +| `WS-ARCH-001-CP03A` | Adapter target identity and owner eligibility | Executable contract complete on merge; actions remain unavailable | +| `WS-ARCH-001-CP03B` | Exact Finance Authority adapter-binding activation | Executable contract complete on merge; follows CP03A | | `PLAN5` | Historical complete-context human needs-revision rebase reconciliation | Merged PR #270; continuing-TaskAssignment rebase retained, independent reviewer-selection wording superseded by current PLAN2 | ## Current reconciliation @@ -61,7 +64,7 @@ PLAN4 -> 02C ----------------------------------> REV-04B REV-04B + 03B -> 03C -> 03D -CP01A -> CP01B -> CP01C -> CP02 -> CP03 -> CP04 -> CP05 -> CP06 -> CP07 -> CP08 +CP01A -> CP01B -> CP01C -> CP02 -> CP03A -> CP03B -> CP04 -> CP05 -> CP06 -> CP07 -> CP08 CP08 -> WS-ARCH-001-03A/03B replacement behavior -> WS-ARCH-001-03C activation -> CP09 task-locked policy lineage -> assignment -> Submission-stamped attempt lineage -> allow_review -> ReviewLease REV revision lineage + 03C/03D + CP06/CP08 -> 07 -> REV-10 first Review commit diff --git a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md index 6b6b6fc17..68d5c0404 100644 --- a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md +++ b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md @@ -3,9 +3,9 @@ | Family | Owning chunks | Required proof | Final gate | |---|---|---|---| | Canonical policy model | 01,03B,CP04/CP05 | ContributionPolicy/version/rules/definitions; explicit unpaid; immutable publish; one active policy; NUMERIC(38,18) decimal-string bounds; ISO 4217 money units; project-scoped points units; stable binding references | CON-11 | -| Adapter binding | 03A,CP02/CP03,10B | one active binding per project/instrument; policy definitions and awards reference a binding with matching project/instrument identity while the binding stores no policy/award identifiers; non-secret route; suspend/resume and existing-award callback/replay behavior; retirement refuses active policy, unfinished frozen work, or unfulfilled award dependencies | CON-11 + joint live drill | +| Adapter binding | 03A,CP02/CP03A/CP03B,03D/08B,10B | CP02 proves the four hidden read/create/suspend/resume behaviors; CP03A proves exact target identity and owner eligibility; CP03B owns only exact human Finance Authority activation proof for those four actions; policy definitions and awards reference matching project/instrument identity while the binding stores no policy/award identifiers; 03D/08B own existing-award callback/replay proof; 10B owns retirement refusal for active policy, unfinished frozen work, or unfulfilled award dependencies | CON-11 + joint live drill | | Legacy clean cut | CP09 after WS-ARCH-001-03C activation | zero semantic consumers before schema removal; clean current-baseline parity; no alias/fallback/backfill | CON-11 | -| Authorization | AUTH + each feature | current AUTH actor/grant/fixed-service/PREP and REV-readiness foundations, with current repository migrations through ART-owned `0050`; provisioning grants no service execution; CON mappings, identities, and static rows are absent on current main; every future artifact requires exact AUTH-owned registration and activation evidence, exact grant/static row, fixed-service admission, prepared handle bound to session/action/actor-ref/idempotency/request digest with substitution non-consumption, planned denial, and no local role logic | AUTH activation + CON-11 | +| Authorization | AUTH + each feature | current AUTH actor/grant/fixed-service/PREP and REV-readiness foundations, with the active tracked migration graph through `0004_compensation_adapter_binding_lifecycle` (`0003_submission_lineage` predecessor); older ART `0050` references are historical pre-baseline evidence, not an active graph head; provisioning grants no service execution; CON mappings, identities, and static rows are absent on current main; every future artifact requires exact AUTH-owned registration and activation evidence, exact grant/static row, fixed-service admission, prepared handle bound to session/action/actor-ref/idempotency/request digest with substitution non-consumption, planned denial, and no local role logic | AUTH activation + CON-11 | | Final acceptance | REV + 03C,07 | accept creates one immutable FinalAcceptance per task/Review/Submission; needs_revision/reject create none; no create API/action, reopen, replacement, or adjudication path | joint live drill | | Contribution cardinality | 03C,07 + REV | one completed_review per valid Review with direct Review/lease lineage; one accepted_submission per FinalAcceptance with assignment lineage; mutually exclusive sources; revision Reviews distinct; automated outcomes create none | joint live drill | | Policy lock and human revision rebase | CP06-CP08, ARCH-03B,07 + PROJECT/TASK/REV | one guide-bound version; exact `WorkstreamTask.locked_contribution_policy_version_id`, `TaskAssignment.submitter_contribution_policy_version_id`, `Submission.contribution_policy_version_id`, and `ReviewLease.reviewer_contribution_policy_version_id` lineage; no claim-time lookup or publication-time drift; human needs_revision keeps/rebases/blocks the complete next-task context atomically and preserves completed history | joint live drill | diff --git a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md index 9ed88f06c..cf45e6dad 100644 --- a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md +++ b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md @@ -82,9 +82,11 @@ historical-row backfill or compatibility behavior. exact ContributionPolicy actions registered but unavailable. CP01C is complete on merge with corrected binding identity and lifecycle-generation facts. Callback/fulfillment authority stays separate. -- CP02 is complete on merge with hidden, route-unreachable adapter-binding - behavior and immutable lifecycle history while all four AUTH actions remain - unavailable. CP03-CP05 remain non-executable activation/policy skeletons. +- CP02 is merged with hidden, route-unreachable adapter-binding behavior and + immutable lifecycle history while all four AUTH actions remain unavailable. + CP03 is split: CP03A's executable target-identity/owner-eligibility contract + precedes CP03B's executable Finance Authority activation contract. CP04-CP05 + remain non-executable policy behavior/activation skeletons. - CP06-CP09: validation, owner schema lineage, and clean legacy removal wait for the preceding public behavior. No historical-row classification is required unless current-main discovery proves real deployed data exists. @@ -116,7 +118,8 @@ CP08/ARCH-03B replacement path. ## Immediate next action CON-02C merged through PR #277. REV-04B may consume its shared lifecycle-audit -participant after REV's earlier gates merge. Expand and review CP03 against -current main before activating the exact adapter-binding actions. CP02 itself -remains hidden and route-unreachable. +participant after REV's earlier gates merge. Implement reviewed CP03A while all +binding actions remain unavailable, then CP03B to activate exactly those four +actions for covered Finance Authority. CP02 remains hidden and route-unreachable; +neither child adds a route. Open pull requests determine transient CON work. diff --git a/docs/roadmap_status.md b/docs/roadmap_status.md index 97c2bea1b..9c0bc6fc3 100644 --- a/docs/roadmap_status.md +++ b/docs/roadmap_status.md @@ -137,7 +137,10 @@ review. Their presence does not change the implemented-on-`main` list above. authority while keeping all nine actions unavailable. CP01C corrects the unavailable binding facts before CP02. CP02 is complete on merge with hidden, route-unreachable adapter-binding behavior and immutable lifecycle history. - The remaining order is CP03 adapter-binding activation, CP04 hidden ContributionPolicy behavior, + CP03 is split with executable CP03A/CP03B contracts complete on merge. The + remaining order is CP03A target identity/owner eligibility, CP03B activation + for an authenticated human Finance Authority covering the exact project, + CP04 hidden ContributionPolicy behavior, then CP05 ContributionPolicy activation; expose CON validation; then bind one exact published, complete, binding-valid ContributionPolicyVersion at guide activation, and diff --git a/docs/spec_authorization_service.md b/docs/spec_authorization_service.md index 726fa3d99..0209b9b0d 100644 --- a/docs/spec_authorization_service.md +++ b/docs/spec_authorization_service.md @@ -273,6 +273,12 @@ resource facts: create binds the server-selected binding identity and no unit, copies CON's exact `instrument_type` without translation, while suspend/resume bind the exact positive lifecycle version. Catalogue counts, mappings, owners, and availability remain unchanged. +WS-ARCH-001-CP03 is split after merged CP02 hidden behavior. CP03A adds only +the closed target identity `workstream.compensation.adapter` and real +PROJECTS/ACTORS eligibility adapters; it adds no service-matrix membership and +keeps all four binding actions unavailable. CP03B then installs the exact +read/PREP adapter for an authenticated human Finance Authority covering the +exact project and activates only those four actions. AUTH-10A added five project-role read/manage rows; AUTH-10B owns and activates the three reads, while AUTH-10C owns and activates the two reason-bound, idempotent project-role mutations. AUTH-11A adds eleven diff --git a/docs/spec_contribution_compensation.md b/docs/spec_contribution_compensation.md index edfb371eb..697bc3ede 100644 --- a/docs/spec_contribution_compensation.md +++ b/docs/spec_contribution_compensation.md @@ -779,7 +779,16 @@ and an opaque prepare/consume/close authorization participant before product mutation. Every create, suspend, or resume appends one immutable lifecycle event atomically. Exact duplicate recovery requires fresh read authorization; changed or unauthorized recovery is concealed. Production composition remains -deny-default and the actions remain unavailable until CP03. +deny-default and the actions remain unavailable through CP03A. + +CP03 is split to preserve owner and activation custody. CP03A first registers +the closed target-only `workstream.compensation.adapter` service identity and +installs PROJECTS/ACTORS owner-held eligibility adapters; it grants that target +no action or service-matrix membership, and all four binding actions remain +unavailable. CP03B then installs the AUTH read/PREP adapter and activates only +the four exact binding actions for an authenticated human Finance Authority +covering the exact project. Neither child adds a public route, provider +behavior, or ContributionPolicy authority. | ActionId | PermissionId | Principal / target | Protocol | Feature owner | |---|---|---|---:|---|