From efc1a784eb6c236988adc5e541f3f0c881fbca79 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Sat, 15 Aug 2026 13:44:00 +0100 Subject: [PATCH 1/7] plan(arch): split adapter binding activation --- .agent-loop/CURRENT_STATE.md | 10 +- .../CHUNK_MAP.md | 12 +- .../DECISIONS.md | 5 +- .../PLAN.md | 3 +- .../RISKS.md | 4 +- .../STATUS.md | 11 +- ...S-ARCH-001-CP03-auth-binding-activation.md | 12 - .../chunks/WS-ARCH-001-CP03.md | 27 ++ .../WS-ARCH-001-CP03A-owner-eligibility.md | 198 +++++++++++ ...-ARCH-001-CP03B-auth-binding-activation.md | 315 ++++++++++++++++++ .../WS-ARCH-001-CP04-con-policy-behavior.md | 2 +- .../WS-ARCH-001-CP03-plan-review-evidence.md | 70 ++++ .../WS-ARCH-001-CP03-pr-trust-bundle.md | 59 ++++ .../ACTIVATION_CUSTODY.md | 19 ++ .../CHUNK_MAP.md | 6 +- .../STATUS.md | 7 +- .../AUTHORIZATION_HANDOFF.md | 24 +- .../CHUNK_MAP.md | 5 +- .../CONFORMANCE_MATRIX.md | 2 +- .../STATUS.md | 15 +- docs/roadmap_status.md | 4 +- docs/spec_authorization_service.md | 5 + docs/spec_contribution_compensation.md | 10 +- 23 files changed, 772 insertions(+), 53 deletions(-) delete mode 100644 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md create mode 100644 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03.md create mode 100644 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md create mode 100644 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md create mode 100644 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md create mode 100644 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md diff --git a/.agent-loop/CURRENT_STATE.md b/.agent-loop/CURRENT_STATE.md index 6ecc24f0b..f93d0e90d 100644 --- a/.agent-loop/CURRENT_STATE.md +++ b/.agent-loop/CURRENT_STATE.md @@ -28,10 +28,10 @@ authority; these records do not grant or withhold it. | Initiative | Durable state on `main` | Remaining boundary | |---|---|---| -| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H`; CP01A-CP02 establish unavailable authority facts and hidden CON adapter-binding behavior; PLAN4 planned incremental debt retirement | Expand and review CP03 before activating the exact adapter-binding actions; PLAN4 keeps debt retirement delivery-coupled without blocking features on unrelated frozen debt; the wider PLAN2 path still targets durable `allow_review`, and `02I` remains later | +| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H`; CP01A-CP02 establish unavailable authority facts and hidden CON adapter-binding behavior; CP03 is split with executable CP03A/CP03B contracts complete on merge; PLAN4 planned incremental debt retirement | Implement CP03A owner identity/eligibility, then CP03B exact Finance Authority activation; PLAN4 keeps debt retirement delivery-coupled without blocking features on unrelated frozen debt; the wider PLAN2 path still targets durable `allow_review`, and `02I` remains later | | [WS-ART-001](initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md) | Active delivery initiative; verified ready-admission publication, hidden preparation, consumption and binding are merged through ARCH-02H | Implement exact post-submit materialization only after the unified guide/checker and PLAN2 public contracts are executable; live cutover remains later | | [WS-AUTH-001](initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md) | Active delivery initiative; project-policy authority and unified compilation authorization are merged through `12I` | POL-03B consumes 12I next; remaining AUTH activation chunks wait for their exact hidden owner behavior | -| [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; CP02 is complete on merge with hidden adapter-binding lifecycle behavior; ContributionPolicy persistence, shared lifecycle audit, and unavailable AUTH registrations are merged | Expand and review CP03 before exact adapter-binding activation; later complete guide-activation validation/persistence before task readiness, preserving immutable attempt lineage through Submission and ReviewLease | +| [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; CP02 is merged with hidden adapter-binding lifecycle behavior; CP03 is split with executable CP03A/CP03B contracts complete on merge; ContributionPolicy persistence, shared lifecycle audit, and unavailable AUTH registrations are merged | Implement CP03A target identity/owner eligibility, then CP03B exact Finance Authority activation; later complete guide-activation validation/persistence before task readiness, preserving immutable attempt lineage through Submission and ReviewLease | | [WS-AUTH-003](initiatives/WS-AUTH-003-module-boundary-recovery/STATUS.md) | AUTH boundary foundation and first public-capability proof through POL-03A are merged | Repair each touched AUTH capability through `authorization.api` and shrink the canonical AUTH ledger | | [WS-POL-003](initiatives/WS-POL-003-unified-project-guide-compilation/STATUS.md) | Active delivery initiative; hidden compilation custody and AUTH-12I activation are merged | Implement POL-03B authorized compilation persistence, then continue the reviewed dependency order | | [WS-REV-001](initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md) | Independent foundations through queue admission and reviewer-lease persistence are merged through `03A2`; schema/packet foundations may continue behind their own gates | Live admission/claim requires canonical 04E `allow_review`; ReviewLease copies the admitted Submission's immutable attempt policy version, and the first Review commit requires CON-03C/07 atomic contribution/award behavior | @@ -99,7 +99,8 @@ Do not start historical CON-05A directly. The CP01-CP09 sequence owns AUTH unavailable registration, hidden CON binding/policy behavior, exact AUTH activations, CON validation, PROJECT guide binding, TASK attempt lineage, and clean v0.1 legacy economic-path removal in that order. CP02 is complete on -merge while all four actions remain unavailable; later children remain +merge while all four actions remain unavailable. CP03 is split with executable +CP03A/CP03B contracts complete on merge; later CP04-CP09 children remain non-executable until their current-main contracts are expanded. - WS-ARCH-001-PLAN3 is planned; its planning merge changed no runtime behavior. @@ -112,7 +113,8 @@ non-executable until their current-main contracts are expanded. adapter-binding identity and lifecycle-version facts. - WS-ARCH-001-CP02 is complete on merge with hidden, route-unreachable behavior, exact lifecycle history, and deny-default production composition. -- WS-ARCH-001-CP03 is proposed and non-executable. +- WS-ARCH-001-CP03 is split/non-executable. CP03A and CP03B have executable + contracts complete on merge and are the next ordered bounded boundaries. - WS-ARCH-001-CP04 is proposed and non-executable. - WS-ARCH-001-CP05 is proposed and non-executable. - WS-ARCH-001-CP06 is proposed and non-executable. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md index 7e4fcdc74..c7d271278 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md @@ -22,8 +22,10 @@ | `WS-ARCH-001-CP01B` | AUTH ContributionPolicy unavailable registration | L1 | Complete on merge; five actions remain planned/unavailable | | `WS-ARCH-001-CP01C` | AUTH adapter-binding fact correction | L1 | Complete on merge; corrects unavailable facts before CON behavior | | `WS-ARCH-001-CP02` | CON hidden adapter-binding behavior | L1 | Complete on merge; route-unreachable and deny-default while actions remain unavailable | -| `WS-ARCH-001-CP03` | AUTH exact adapter-binding activation | L1 | Next proposed skeleton; requires a current-main executable contract | -| `WS-ARCH-001-CP04` | CON hidden ContributionPolicy behavior | L1 | Proposed skeleton after CP03 | +| `WS-ARCH-001-CP03` | Adapter-binding activation coordination parent | L1 | Split into CP03A/CP03B; non-executable | +| `WS-ARCH-001-CP03A` | Closed adapter target identity and PROJECTS/ACTORS owner eligibility | L1 | Executable contract complete on merge; implementation next | +| `WS-ARCH-001-CP03B` | AUTH exact Finance Authority adapter-binding activation | L1 | Executable contract complete on merge; follows merged CP03A | +| `WS-ARCH-001-CP04` | CON hidden ContributionPolicy behavior | L1 | Proposed skeleton after merged CP03B evidence | | `WS-ARCH-001-CP05` | AUTH exact ContributionPolicy activation | L1 | Proposed skeleton after CP04 evidence | | `WS-ARCH-001-CP06` | CON guide-activation/revision policy-validation port | L1 | Proposed skeleton after CP05 | | `WS-ARCH-001-CP07` | PROJECT guide-bound ContributionPolicyVersion persistence | L1 | Proposed skeleton after CP06 | @@ -50,11 +52,13 @@ feature contract crosses more than one reviewable mutation boundary. The 02A-02I sequence is the executable split of parent 02, subject to plan review and human approval. -CP03-CP09 and chunks 03A-04F are non-executable planning skeletons. Before implementation, +CP04-CP09 and chunks 03A-04F are non-executable planning skeletons. Before implementation, each must be replaced with a current-main contract that names exact allowed and not-allowed files, migration head, runnable commands, reviewers, and the public types it extends. Their sequencing is approved here; their current text does -not authorize code changes. +not authorize code changes. CP03 is split/non-executable; CP03A and CP03B are +the current-main executable exceptions and authorize only their ordered exact +implementations after these contracts merge. PLAN4 does not insert a new prerequisite into the product sequence. Each current or future delivery chunk applies its no-new-debt and touched-debt rules diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/DECISIONS.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/DECISIONS.md index c18c2719b..a0c38af37 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/DECISIONS.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/DECISIONS.md @@ -155,5 +155,6 @@ canonical row locking, and immutable created/suspended/resumed lifecycle events. AUTH owns Finance Authority, action availability, opaque PREP handles, authorization decisions, and decision evidence. Read uses request-scoped authorization; create/suspend/resume use one domain-specific opaque -prepare/consume/close port backed by AUTH only in CP03. CON never imports AUTH -internals or translates the CON-owned `instrument_type` value. +prepare/consume/close port backed by AUTH only in CP03B. CP03A owns the exact +adapter target identity and PROJECTS/ACTORS eligibility prerequisite. CON never +imports AUTH internals or translates the CON-owned `instrument_type` value. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md index 1fe81b797..724965116 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md @@ -350,7 +350,8 @@ CP01A AUTH adapter-binding unavailable registration -> CP01B AUTH ContributionPolicy unavailable registration -> CP01C AUTH adapter-binding fact correction -> CP02 CON hidden adapter-binding behavior --> CP03 AUTH adapter-binding activation +-> CP03A adapter target identity and owner eligibility +-> CP03B AUTH Finance Authority adapter-binding activation -> CP04 CON hidden ContributionPolicy behavior -> CP05 AUTH ContributionPolicy activation -> CP06 CON validation port diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md index 6857ad4c8..7d4b5a889 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md @@ -24,7 +24,7 @@ | Live assignment or review claim loses the one task-governing ContributionPolicyVersion | Critical | Enforce immutable guide -> task -> assignment -> Submission/allow_review -> ReviewLease lineage; missing, cross-project, stale or mismatched facts deny before claim effects, and neither claim performs CON policy lookup | | Review decision commits without mandatory contribution consequences | Critical | Stable REV schema precedes CON-03C/07; every decision atomically creates reviewer ContributionRecord/awards and accept additionally creates FinalAcceptance plus submitter record/awards | | Composition root absorbs domain decisions | High | Composition opens the unit of work and wires transaction-bound ports only; TASK command owns Submission sequencing and each target port enforces its own invariants | -| Policy behavior starts before exact AUTH registration | Critical | CP01A and CP01B register their separate typed unavailable authority before CP02/CP04 behavior; CP03/CP05 activate only after hidden proof | +| Policy behavior starts before exact AUTH registration | Critical | CP01A and CP01B register their separate typed unavailable authority before CP02/CP04 behavior; CP03B/CP05 activate only after their hidden proof and exact prerequisites | | Binding management inherits retirement, fulfillment, callback, or delivery authority | Critical | CP01A through CP03 exclude retirement actions plus fulfillment, callback, and delivery action IDs, permissions, identities, routes, evaluators, and service-matrix rows entirely | | CON writes PROJECT or TASK aggregates | Critical | CP06 returns immutable validation facts only; CP07 and CP08 own their respective writes | | Consolidated v0.1 schema gains fake compatibility debt | High | CP09 performs a clean current-baseline cut and forbids aliases, dual paths, and invented backfills | @@ -33,5 +33,5 @@ | Mechanical quotas reward noisy or cosmetic cleanup | Medium | Use exact edge/finding deltas and behavior ownership; prohibit arbitrary per-PR percentages and cosmetic test splitting | | Overlapping ledgers are added together and misstate debt | Medium | Report general, AUTH, structural, and behavior-ownership measurements separately under their existing owners | | Adapter-binding resume erases suspension attribution | Critical | CP02 appends one immutable CON lifecycle event per version in the same transaction; CP03 later stages AUTH decision evidence atomically beside it | -| Unrelated internal service is bound as a compensation adapter | Critical | CP02 requires an injected exact ACTORS eligibility capability; generic service kind and existing ART/REV identities fail closed, and CP03 cannot activate without an approved compensation-adapter identity rule | +| Unrelated internal service is bound as a compensation adapter | Critical | CP02 requires an injected exact ACTORS eligibility capability; generic service kind and existing ART/REV identities fail closed; CP03A installs the exact target identity/owner rule before CP03B activation | | CP02 invents a second authorization protocol or imports AUTH internals | Critical | CON defines only a domain-facing opaque prepare/consume/close port; production denies until CP03 adapts the existing AUTH PREP implementation | diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md index 1c365ba4c..f66fc9e3b 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md @@ -54,7 +54,9 @@ non-executable split parent; CP01A is complete on merge with its four actions registered/unavailable, CP01B is complete on merge with five policy actions registered/unavailable. CP02 is complete on merge with hidden CON behavior - while its AUTH actions remain unavailable; CP03-CP09 remain non-executable skeletons. + while its AUTH actions remain unavailable; CP03 is split with executable + CP03A/CP03B contracts complete on merge, while CP04-CP09 remain + non-executable skeletons. - [WS-ARCH-001-PLAN4](chunks/WS-ARCH-001-PLAN4-incremental-debt-retirement.md) is planned on merge and changes no runtime. It makes the existing incremental strangler operational: unrelated frozen debt cannot block delivery, new debt is @@ -77,8 +79,11 @@ match exact binding identity and lifecycle generation without a unit alias. - WS-ARCH-001-CP02 is complete on merge: hidden, route-unreachable adapter-binding behavior while its AUTH actions remain unavailable. -- WS-ARCH-001-CP03 is the next proposed boundary: exact adapter-binding - activation after its current-main contract is expanded and reviewed. +- WS-ARCH-001-CP03 is split/non-executable. CP03A's executable contract first + installs the closed compensation-adapter target identity and PROJECTS/ACTORS + owner eligibility while actions remain unavailable. CP03B's executable + contract then installs and proves exact Finance Authority activation without + adding a route or adjacent compensation authority. - WS-ARCH-001-CP04 is proposed: hidden ContributionPolicy behavior. - WS-ARCH-001-CP05 is proposed: exact ContributionPolicy activation. - WS-ARCH-001-CP06 is proposed: CON policy-validation port. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md deleted file mode 100644 index 299cac161..000000000 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md +++ /dev/null @@ -1,12 +0,0 @@ -# Chunk Contract: WS-ARCH-001-CP03 — Adapter-Binding AUTH Activation - -Status: proposed non-executable skeleton after CP02. Risk: L1. - -AUTH integrates the exact adapter-binding evaluator and activates only the -binding create/read/suspend/resume actions proven by CP02. It adds no CON -behavior, callback authority, policy activation, or generic compensation -management permission. - -## Merge state - -- Outcome on merge: `planned` diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03.md new file mode 100644 index 000000000..b55e8c24b --- /dev/null +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03.md @@ -0,0 +1,27 @@ +# Chunk Contract: WS-ARCH-001-CP03 — Adapter-Binding Activation Split Parent + +## Status + +Split and non-executable. + +## Goal + +Coordinate the two independently reviewable prerequisites for safe +adapter-binding activation. + +## Approved split + +```text +CP02 hidden lifecycle behavior +-> CP03A compensation-adapter identity and owner eligibility +-> CP03B exact Finance Authority AUTH activation +-> CP04 hidden ContributionPolicy behavior +``` + +CP03A owns no AUTH action activation. CP03B owns no identity registration, +schema change, or owner eligibility behavior. Neither child adds a public +adapter-binding route. + +## Merge state + +- Outcome on merge: `split parent recorded; no runtime behavior` diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md new file mode 100644 index 000000000..b4bd3d59c --- /dev/null +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md @@ -0,0 +1,198 @@ +# Chunk Contract: WS-ARCH-001-CP03A — Adapter Target Identity And Owner Eligibility + +## Merge state + +- Contract outcome on merge: `executable contract complete; implementation next` +- Implementation outcome on merge: `complete; binding actions remain unavailable` + +## Parent initiative + +WS-ARCH-001 — Modular Monolith Boundaries + +## Goal + +Register one closed compensation-adapter target identity and implement the real +PROJECTS- and ACTORS-owned eligibility adapters required by CP02 create/resume, +without activating any adapter-binding action. + +## Why this chunk exists + +CP02 intentionally used strict fakes because current main has only public owner +protocols. Its contract requires an active service actor explicitly eligible +for compensation-adapter binding and rejects generic service kind or reuse of +ART, REV, checker, dispatcher, and other internal identities. The ActorProfile +schema requires every service actor to carry a closed ServiceIdentity. CP03A +therefore establishes that target identity and owner-held locks before CP03B +can activate AUTH. + +## Risk class + +L1 — actor identity, authorization prerequisite, and transaction custody. + +## SLA + +P1 + +## Exact identity rule + +`workstream.compensation.adapter` is a closed service ActorProfile identity +used only as the eligible target of a ProjectCompensationAdapterBinding. It is +not the Finance Authority caller and receives no action, permission, service +matrix row, database grant, route, callback, provider credential, or implicit +feature authority. + +Eligibility requires, under ACTORS-owned transaction-held row locks: + +- exact `adapter_actor_id`; +- `actor_kind=service`; +- `status=active`; +- `service_identity=workstream.compensation.adapter`; +- the actor's exact service ActorIdentityLink exists, is active, and has + `subject_kind=service`. + +PROJECTS independently locks the exact project and accepts only the existing +CP02-approved binding lifecycle states. Both owner adapters flush nothing, +commit nothing, and return only their public immutable facts. CP02 retains the +locks through the caller-owned root transaction. + +## Allowed files + +```text +backend/app/modules/actors/service_identities.py +backend/app/modules/actors/models.py (constraint parity only) +backend/app/modules/actors/compensation_adapter.py +backend/app/modules/actors/api/compensation_adapter.py (fact/port parity only) +backend/app/modules/actors/api/__init__.py +backend/app/modules/projects/compensation_binding.py +backend/app/modules/projects/api/compensation_binding.py (fact/port parity only) +backend/app/modules/projects/api/__init__.py +backend/app/modules/authorization/service_actor_schemas.py (closed identity parity only) +backend/app/modules/authorization/service_actor_service.py (provisioning admission parity only) +backend/app/modules/authorization/catalogue.py (separate target-only identities from action-bearing fixed services) +backend/app/modules/compensation/service.py (owner-adapter injection only) +backend/app/api/deps/authorization.py (composition only; no route) +backend/app/main.py (composition only; no route) +backend/alembic/env.py +backend/alembic/versions/0005_compensation_adapter_identity.py +backend/tests/actors/test_compensation_adapter_eligibility.py +backend/tests/projects/test_compensation_binding_eligibility.py +backend/tests/compensation/test_adapter_binding_owner_fences.py +backend/tests/compensation/test_adapter_binding_authorization_integration.py +backend/tests/test_auth.py (controlled provisioning parity only) +backend/tests/test_authorization.py (closed identity/matrix separation only) +backend/tests/test_alembic.py +backend/tests/test_database_reset.py +backend/tests/conftest.py (exact current-schema fingerprint/reset parity only) +backend/alembic/baseline/v01_approved_manifest_delta.json (generated current-head parity only; do not rewrite 0001) +backend/alembic/baseline/v01_baseline_manifest.json (generated current-head parity only; do not rewrite 0001) +backend/alembic/baseline/v01_pre_reset_source_manifest.json (generated current-head parity only; do not rewrite 0001) +backend/alembic/baseline/v01_schema.sql (generated current-head parity only; do not rewrite 0001) +backend/scripts/behavior_ownership.py +backend/scripts/run_test_lanes.py +.ci/behavior-ownership/partition.v1.json +.ci/behavior-ownership/actors/compensation-adapter-eligibility.json +.ci/behavior-ownership/projects/compensation-binding-eligibility.json +.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json (generated parity only) +.agent-loop/CURRENT_STATE.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03A-plan-review-evidence.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03A-implementation-review-evidence.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03A-external-review-response.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03A-pr-trust-bundle.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md +.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md +.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md +.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md +docs/architecture_data_model.md +docs/spec_authorization_service.md +docs/operations_authorization_service.md +docs/spec_contribution_compensation.md +docs/roadmap_status.md +``` + +## Not allowed + +```text +adapter-binding action activation or evaluator +Finance Authority grant/evaluation changes +service action matrix row for workstream.compensation.adapter +public route, provider adapter, credential, endpoint, account, or network I/O +binding lifecycle, repository, event, recovery, or idempotency changes +ContributionPolicy, retirement, award, fulfillment, callback, delivery, dispatcher, reconciliation, or reputation behavior +generic service eligibility, prefix matching, runtime plugin discovery, or reuse of another fixed identity +private cross-module imports or a second owner-adapter path +compatibility support for old identities or deployed rows +``` + +## Acceptance criteria + +- [ ] Exactly one closed identity, `workstream.compensation.adapter`, is added; + all existing identities and matrix memberships are unchanged. +- [ ] Closed ActorProfile service identities and action-bearing fixed-service + identities are explicit separate sets. The target identity belongs only + to the former; catalogue import succeeds without an empty or invented + matrix row, and runtime service-action admission rejects it. +- [ ] Migration `0005_compensation_adapter_identity` updates only the closed + ActorProfile service-identity constraint and refuses downgrade without + mutation when the new identity is referenced. +- [ ] Existing controlled service provisioning can create the exact profile and + identity link but grants it no role, permission, matrix membership, or + feature authority. +- [ ] ACTORS locks and validates the exact active profile and active service + identity link; human actors, generic service kind, missing/revoked links, + inactive profiles, and every existing ART/REV/project/checker identity + deny with one concealed unavailable result. +- [ ] PROJECTS locks and validates the exact project under the CP02-approved + lifecycle rule; absent/ineligible/cross-project targets deny. +- [ ] Owner locks remain held through CP02 authorization and mutation for + create/resume; a competing revocation or project-ineligibility commit + cannot enter between validation and product transition. +- [ ] If revocation/ineligibility commits first, create/resume denies before + AUTH consumption and creates no binding, lifecycle event, or allowed + evidence. +- [ ] Suspend remains possible after target/project ineligibility once CP03B + provides Finance Authority; CP03A does not weaken that recovery rule. +- [ ] All four adapter-binding actions remain planned/unavailable; no route or + product behavior becomes reachable. + +## Verification commands + +```bash +(cd backend && .venv/bin/python -m ruff check app/modules/actors/service_identities.py app/modules/actors/compensation_adapter.py app/modules/projects/compensation_binding.py app/modules/authorization/catalogue.py tests/actors/test_compensation_adapter_eligibility.py tests/projects/test_compensation_binding_eligibility.py tests/compensation/test_adapter_binding_owner_fences.py tests/test_auth.py tests/test_authorization.py tests/test_alembic.py tests/test_database_reset.py) +(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/actors/test_compensation_adapter_eligibility.py tests/projects/test_compensation_binding_eligibility.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_authorization_integration.py tests/test_alembic.py tests/test_database_reset.py --cov=app.modules.actors.compensation_adapter --cov=app.modules.projects.compensation_binding --cov-fail-under=90) +(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/test_auth.py -k service_actor) +(cd backend && .venv/bin/python -m pytest -q tests/test_authorization.py -k "service_actor or service_identity or service_action_matrix") +(cd backend && .venv/bin/python -m scripts.test_structure_boundary validate --policy ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_POLICY.md --ledger ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json) +(cd backend && .venv/bin/python -m scripts.module_boundaries validate --protected-base origin/main) +python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_chunk_state_sync.py --base-ref origin/main +python3 scripts/check_markdown_links.py +git diff --check +gh pr checks --watch +``` + +Hosted GitHub Actions owns the full PostgreSQL matrix and repository coverage. +The local machine must not run the full suite. + +## Required reviewers + +Architecture, security/auth, product/operations, QA, test delta, CI integrity, +senior engineering, reuse/dedup, and documentation. + +## Human review focus + +Confirm the exact target-only identity, absence of a service matrix grant, +owner-module lock custody, denial of every existing fixed identity, migration +safety, and continued unavailability of all binding actions. + +## Stop conditions + +Stop and amend/re-review if another identity, permission, action, matrix row, +provider behavior, owner fact, schema surface, or cross-module private import is +required. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md new file mode 100644 index 000000000..9a0367e63 --- /dev/null +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md @@ -0,0 +1,315 @@ +# Chunk Contract: WS-ARCH-001-CP03B — Adapter-Binding AUTH Activation + +## Merge state + +- Contract outcome on merge: `executable contract complete; implementation next` +- Implementation outcome on merge: `complete` + +## Parent initiative + +WS-ARCH-001 — Modular Monolith Boundaries + +## Goal + +Install the AUTH-owned adapter for CP02's hidden adapter-binding service and +activate exactly the existing read, create, suspend, and resume actions for a +human Finance Authority covering the exact project. + +## Why this chunk exists + +CP01A/CP01C registered exact immutable authorization facts while leaving the +four actions unavailable. CP02 then proved the route-unreachable CON lifecycle, +owner fences, transaction custody, idempotent recovery, and deny-default +composition. CP03A registers the exact compensation-adapter target identity and +installs real PROJECTS/ACTORS owner adapters. CP03B is the narrow activation +boundary: AUTH may now authorize +those proven operations without granting generic compensation authority or +moving CON behavior into AUTH. + +## Approved plan references + +- INTENT: `.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md` +- CP02 contract: `.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP02-con-binding-behavior.md` +- CON handoff: `.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md` + +## Risk class + +L1 — authorization and compensation infrastructure activation. + +## SLA + +P1 + +## Entry gate + +- CP01A and CP01C are merged with the exact four action identifiers, permission + mapping, typed facts, and canonical resource digests. +- CP02 is merged with hidden CON create/read/suspend/resume behavior, immutable + lifecycle history, owner-held eligibility fences, operation fencing, and + deny-default production composition. +- CP03A is merged with the exact target identity, owner adapters, and migration + head recorded by that chunk. CP03B adds no migration. +- No public adapter-binding route exists. CP03 does not add one. + +## Exact activation manifest + +| ActionId | PermissionId | Principal | Protocol | Exact resource | +|---|---|---|---|---| +| `compensation.adapter_binding.read` | `compensation.adapter_binding.manage` | active human Finance Authority covering the exact project | request-scoped query authorization | `project_id`, `adapter_binding_id` | +| `compensation.adapter_binding.create` | `compensation.adapter_binding.manage` | active human Finance Authority covering the exact project | opaque transaction-bound PREP | project, server-generated binding identity, `instrument_type`, eligible adapter actor, non-secret route key, operation and request digest | +| `compensation.adapter_binding.suspend` | `compensation.adapter_binding.manage` | active human Finance Authority covering the exact project | opaque transaction-bound PREP | project, exact active binding, expected lifecycle version, operation and request digest | +| `compensation.adapter_binding.resume` | `compensation.adapter_binding.manage` | active human Finance Authority covering the exact project | opaque transaction-bound PREP | project, exact suspended binding, expected lifecycle version, operation and request digest | + +System-scoped Finance Authority covers every eligible project; project-scoped +Finance Authority covers only its exact project. No other administrative role, +project role, service identity, or database principal may substitute. + +## Required authorization composition + +### Query + +`read` resolves the authenticated human ActorProfile and exact active identity +link, uses canonical owner facts for the exact project/binding, verifies one +effective Finance Authority grant covering the project, and evaluates the +active read action against the exact CP01C resource digest. Missing, stale, +cross-project, revoked, wrong-kind, or unauthorized targets use CP02's single +concealed conflict behavior. + +Exact duplicate mutation recovery performs this fresh read authorization. It +creates no mutation PREP, mutation-allowed evidence, binding change, lifecycle +event, or product effect. Query-scoped read-decision evidence may be staged for +the recovered binding but cannot be used as mutation authority. + +### Mutation + +The adapter translates CP02's public immutable mutation facts into the existing +AUTH public PREP protocol. The prepared handle remains opaque, process-local, +non-serializable, single-use, actor-bound, identity-link-bound, action-bound, +permission-bound, resource-digest-bound, operation-bound, request-digest-bound, +session-bound, and transaction-bound. + +CP02 retains its mandatory ordering: + +```text +root transaction +-> canonical request digest +-> PostgreSQL operation fence and recovery check +-> PROJECTS then ACTORS eligibility fences where required +-> binding row lock where required +-> AUTH prepare +-> AUTH consume +-> AUTH close in finally +-> CON mutation and immutable lifecycle event +-> flush +-> caller commits once +``` + +AUTH returns the exact authorized `actor_profile_id`; CP02 rejects any mismatch. +AUTH evidence and the CON mutation commit or roll back together. AUTH does not +commit, construct product rows, acquire CON locks, or import CON models or +repositories. + +## Allowed files + +```text +backend/app/modules/authorization/api/adapter_bindings.py +backend/app/modules/authorization/api/__init__.py +backend/app/modules/authorization/catalogue.py +backend/app/modules/authorization/runtime.py (closed resource-context union only) +backend/app/modules/authorization/prepared.py (reuse/integration only) +backend/app/modules/authorization/kernel.py (exact Finance Authority evaluator integration only) +backend/app/modules/authorization/adapter_binding_authorization.py +backend/app/modules/authorization/domain/adapter_bindings.py +backend/app/modules/authorization/domain/prepared_adapter_bindings.py +backend/app/adapters/auth/adapter_bindings.py +backend/app/adapters/auth/__init__.py +backend/app/api/deps/authorization.py (composition only; no route) +backend/app/main.py (composition only; no route) +backend/app/modules/compensation/api/adapter_bindings.py (public-port parity only) +backend/app/modules/compensation/service.py (dependency injection only; no lifecycle behavior change) +backend/tests/authorization/test_adapter_binding_activation.py +backend/tests/authorization/test_adapter_binding_authorization.py +backend/tests/compensation/test_adapter_binding_authorization_integration.py +backend/tests/compensation/test_adapter_binding_authorization_failures.py +backend/tests/compensation/test_adapter_binding_recovery.py +backend/tests/compensation/test_adapter_binding_owner_fences.py +backend/tests/compensation/test_adapter_binding_service.py +backend/tests/compensation/test_adapter_binding_database_guards.py +backend/tests/compensation/test_adapter_binding_persistence.py +backend/tests/architecture/test_authorization_boundary.py +backend/tests/test_authorization.py (closed catalogue/evaluator parity only) +backend/tests/test_audit.py (atomic evidence parity only) +backend/scripts/behavior_ownership.py (exact changed-target ownership only) +backend/scripts/run_test_lanes.py (exact CP03 test custody only) +.ci/behavior-ownership/partition.v1.json (exact additive target parity only) +.ci/behavior-ownership/auth/adapter-binding-activation.json +.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json (generated parity only) +.agent-loop/CURRENT_STATE.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03B-plan-review-evidence.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03B-implementation-review-evidence.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03B-external-review-response.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03B-pr-trust-bundle.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md +.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md +.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md +.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md +.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md +docs/spec_authorization_service.md +docs/operations_authorization_service.md +docs/spec_contribution_compensation.md +docs/roadmap_status.md +``` + +If implementation proves another file is essential, stop and amend/re-review +this contract before touching it. The named review paths do not authorize +arbitrary initiative files. + +## Not allowed + +```text +public HTTP routes or frontend behavior +new ActionId, PermissionId, role, service identity, matrix row, or database grant +database migration or schema change +ContributionPolicy behavior or activation +adapter-binding retirement +award, fulfillment, callback, dispatcher, delivery, reconciliation, or provider behavior +CON model, repository, lifecycle, operation-fence, owner-fence, or idempotency changes +AUTH imports of CON private modules, models, repositories, or services +CON imports of AUTH private modules +raw AuthorizationContext as durable mutation authority +another prepared-authorization protocol, generic resource dictionary, compatibility alias, fallback evaluator, or dual composition path +Project Manager, Operator, Access Administrator, Audit Authority, project-role, or service substitution for Finance Authority +``` + +## Acceptance criteria + +- [ ] Exactly the four manifest actions become `ACTIVE`, remain mapped only to + `compensation.adapter_binding.manage`, and retain their existing owner. +- [ ] The active catalogue count increases by exactly four; every adjacent + ContributionPolicy, retirement, award, fulfillment, callback, delivery, + dispatcher, and reconciliation action remains unavailable or absent. +- [ ] Only an active human profile with the exact active identity link and an + effective system- or same-project `finance_authority` grant can read or + mutate a binding in that covered project. +- [ ] Project Manager, Operator, Access Administrator, Audit Authority, + Submitter, Reviewer, Adjudicator, fixed services, unrelated services, + wrong-project Finance Authority, revoked/inactive profiles or links, and + revoked/stale grants deny without target disclosure. +- [ ] Read authorization binds the exact project and binding identity. +- [ ] Create PREP binds actor, link, action, permission, project, generated + binding ID, `instrument_type`, adapter actor, route key, operation, + request digest, resource digest, session, and transaction. +- [ ] Suspend/resume PREP additionally binds the exact expected status and + positive lifecycle version. Wrong action/status/version/resource, + copied handle, replay, wrong session, wrong transaction, replaced root + transaction, or mutated facts deny. +- [ ] Every prepared object closes exactly once on success, denial, conflict, + exception, and rollback; no handle can be serialized or reused. +- [ ] AUTH evidence commits atomically with the exact CP02 binding/lifecycle + event. Denial or downstream failure leaves no binding change, lifecycle + event, or allowed evidence. +- [ ] Exact duplicate recovery uses fresh read authority and produces the + immutable original result without a second mutation PREP or mutation + evidence effect; any read evidence remains query-only, and changed facts + or denied current read remain concealed. +- [ ] CP02's PROJECTS-then-ACTORS eligibility fences and operation ordering + remain intact for create/resume, including revocation races. +- [ ] Delivery composition injects one AUTH-owned adapter through public ports; + no reachable composed production command intentionally omits it. CP02's + safe deny-default constructor remains for uncomposed/isolated use. +- [ ] No public route becomes reachable and no migration is added. +- [ ] AUTH and changed compensation authorization coverage remain at or above + 90 percent; repository coverage remains at or above the protected floor. + +## Required focused proof + +### Positive + +- system Finance Authority read/create/suspend/resume; +- exact-project Finance Authority read/create/suspend/resume; +- one lifecycle event and one allowed evidence effect per successful mutation; +- exact duplicate recovery with fresh authorized read and no second mutation + effect. + +### Principal and scope isolation + +- every excluded administrative/project/service principal denies; +- wrong-project, revoked/inactive profile or link, revoked/stale grant, + non-human context, and mismatched authenticated actor deny; +- system scope does not bypass resource lifecycle or owner eligibility. + +### PREP and resource integrity + +- wrong action, permission, project, binding, instrument, adapter actor, route, + operation, request digest, expected status/version, session, transaction, and + replaced transaction deny; +- copied, reconstructed, serialized, closed, and replayed handles deny; +- returned-actor mismatch denies before CON mutation. + +### Atomicity and ordering + +- AUTH consumes before binding mutation/lifecycle-event staging; +- consume denial/exception, close failure, wrong actor, CON flush failure, and + transaction rollback leave zero product and allowed-evidence effects; +- create/resume owner locks remain held through AUTH and mutation; +- concurrent same-operation recovery and distinct-operation one-active-binding + behavior remain unchanged. + +## Verification commands + +```bash +(cd backend && .venv/bin/python -m ruff check app/modules/authorization/api/adapter_bindings.py app/modules/authorization/runtime.py app/modules/authorization/domain/adapter_bindings.py app/modules/authorization/domain/prepared_adapter_bindings.py app/modules/authorization/adapter_binding_authorization.py app/adapters/auth/adapter_bindings.py tests/authorization/test_adapter_binding_activation.py tests/authorization/test_adapter_binding_authorization.py tests/compensation/test_adapter_binding_authorization_integration.py tests/compensation/test_adapter_binding_authorization_failures.py tests/compensation/test_adapter_binding_recovery.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_service.py tests/compensation/test_adapter_binding_database_guards.py tests/compensation/test_adapter_binding_persistence.py tests/architecture/test_authorization_boundary.py tests/test_authorization.py tests/test_audit.py) +(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/authorization/test_adapter_binding_activation.py tests/authorization/test_adapter_binding_authorization.py tests/compensation/test_adapter_binding_authorization_integration.py tests/compensation/test_adapter_binding_authorization_failures.py tests/compensation/test_adapter_binding_recovery.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_service.py tests/compensation/test_adapter_binding_database_guards.py tests/compensation/test_adapter_binding_persistence.py tests/architecture/test_authorization_boundary.py tests/test_authorization.py tests/test_audit.py --cov=app.modules.authorization.adapter_binding_authorization --cov=app.modules.authorization.api.adapter_bindings --cov=app.modules.authorization.domain.adapter_bindings --cov=app.modules.authorization.domain.prepared_adapter_bindings --cov=app.adapters.auth.adapter_bindings --cov-fail-under=90) +(cd backend && .venv/bin/python -m scripts.test_structure_boundary validate --policy ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_POLICY.md --ledger ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json) +(cd backend && .venv/bin/python -m scripts.module_boundaries validate --protected-base origin/main) +python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_chunk_state_sync.py --base-ref origin/main +python3 scripts/check_markdown_links.py +git diff --check +gh pr checks --watch +``` + +Hosted GitHub Actions owns the full PostgreSQL matrix and repository-wide +coverage run. The local machine must not run the full suite. + +## Required reviewers + +- architecture +- security/auth +- product/operations +- QA +- test delta +- CI integrity +- senior engineering +- reuse/dedup +- documentation + +All Critical and High findings are fixed before readiness. Every external +finding is replayed against the exact head and fixed only when valid. + +## Human review focus + +Confirm that only covered human Finance Authority can cross the four exact +CP02 boundaries; resource and transaction binding are complete; duplicate +recovery does not mint mutation authority; CON ownership/fences remain intact; +and no adjacent compensation action, service identity, route, or migration is +activated. + +## Stop conditions + +Stop and amend/re-review this contract if implementation needs: + +- another action, permission, principal, role, service identity, or resource + fact; +- a migration, route, CON lifecycle change, or new product behavior; +- a generic compensation evaluator or another PREP protocol; +- a private cross-module import or second composition path; +- weakened authorization, boundary, test, or CI proof. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP04-con-policy-behavior.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP04-con-policy-behavior.md index 9e01e291e..79440a4e0 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP04-con-policy-behavior.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP04-con-policy-behavior.md @@ -1,6 +1,6 @@ # Chunk Contract: WS-ARCH-001-CP04 — Hidden ContributionPolicy Behavior -Status: proposed non-executable skeleton after CP03. Risk: L1. +Status: proposed non-executable skeleton after merged CP03B evidence. Risk: L1. CON implements hidden ContributionPolicy read/draft/update/publish/retire behavior using the existing persistence aggregate, exact binding lifecycle, and diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md new file mode 100644 index 000000000..2fa0d98fe --- /dev/null +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md @@ -0,0 +1,70 @@ +# WS-ARCH-001-CP03 Plan Review Evidence + +## Result + +Pass after correction. + +## Reviewed intent + +Prepare the next safe adapter-binding activation boundary from current main. +The review proved the former singular CP03 skeleton was not executable because +CP02 requires an explicitly eligible service target plus real PROJECTS/ACTORS +owner fences that current main did not provide. + +## Corrected design + +```text +CP02 hidden adapter-binding lifecycle +-> CP03A closed target identity and PROJECTS/ACTORS owner eligibility +-> CP03B exact human Finance Authority AUTH activation +-> CP04 hidden ContributionPolicy behavior +``` + +CP03A registers `workstream.compensation.adapter` as a target-only service +identity, separates closed ActorProfile identities from action-bearing +fixed-service identities, adds no matrix membership, implements owner-held +eligibility, and keeps all four actions unavailable. CP03B reuses the existing +AUTH read/PREP machinery and activates only read/create/suspend/resume. + +## Findings resolved + +- Added the closed AUTH runtime and domain PREP files needed for canonical + resource contexts instead of another authorization protocol. +- Distinguished duplicate-recovery read evidence from mutation PREP/evidence. +- Split identity/schema/owner eligibility from action activation. +- Added exact PROJECTS/ACTORS owner adapter files and retained-lock/race proof. +- Defined a target-only identity that cannot enter the service action matrix. +- Added exact migration, reset fingerprint, fixed-baseline, provisioning, and + downgrade-refusal proof for CP03A. +- Replaced broad package coverage with exact changed-module coverage. +- Added existing CP02 fence, database, persistence, recovery, and concurrency + tests to CP03B verification. +- Removed nonexistent grant expiry semantics and retained revoked/stale proof. +- Preserved CP02's safe deny-default constructor while requiring composed + delivery to inject the real adapter. +- Reconciled current state, ARCH/AUTH/CON maps and status, activation custody, + handoff, plan, decisions, risks, conformance matrix, roadmap, and canonical + specifications. + +## Reviewer results + +| Track | Result | Remaining blocker | +|---|---|---| +| Architecture / senior engineering | pass | none | +| Security / authorization | pass with completed stale-doc condition | none | +| Product / operations | pass | none | +| Reuse / QA / test delta | pass | none | +| CI integrity | pass | none | +| Documentation | pass after CP04 dependency wording correction | none | + +## Deterministic evidence + +- stale authorization wording scan: pass; +- atomic chunk-state synchronization: pass; +- changed Markdown links: pass; +- module-boundary validation: pass; +- test-structure debt validation: pass; +- `git diff --check`: pass. + +No runtime code, action availability, service identity, schema, route, or +product behavior changes in this planning PR. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md new file mode 100644 index 000000000..b94bfa8b2 --- /dev/null +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md @@ -0,0 +1,59 @@ +# WS-ARCH-001-CP03 Planning PR Trust Bundle + +## Intent + +Replace the stale non-executable CP03 activation skeleton with current-main, +reviewed, PR-sized contracts that can be implemented without boundary shortcuts +or accidental service authority. + +## Scope + +- Record CP03 as a split/non-executable parent. +- Add executable CP03A for the closed compensation-adapter target identity, + PROJECTS/ACTORS owner eligibility, and migration proof while actions remain + unavailable. +- Add executable CP03B for exact human Finance Authority read/PREP activation + after CP03A merges. +- Reconcile all current planning, status, custody, handoff, risk, conformance, + roadmap, and canonical specification records affected by the split. + +## Non-goals + +This PR adds no production code, migration, identity, matrix row, route, +evaluator, action activation, CON behavior, ContributionPolicy behavior, +provider integration, callback, fulfillment, delivery, or reputation behavior. + +## Key safety decision + +`workstream.compensation.adapter` is a future binding target, not an AUTH +caller. CP03A must allow controlled provisioning and owner locking but must not +give it any action or matrix membership. CP03B admits only an authenticated +human Finance Authority covering the exact project. + +## Verification + +- stale authorization wording scan: pass; +- chunk-state synchronization: pass; +- changed Markdown links: pass; +- module-boundary and test-structure validation: pass; +- `git diff --check`: pass. + +Hosted CI will provide the exact-head repository gates for this documentation +change. Future CP03A/CP03B implementation PRs own their focused PostgreSQL and +coverage commands plus GitHub's full distributed backend suite. + +## Reviewer result + +Architecture, security, product/operations, reuse/QA/test-delta, CI-integrity, +senior-engineering, and documentation plan reviews passed after the contracts +were corrected. The detailed dispositions are in +`WS-ARCH-001-CP03-plan-review-evidence.md`. + +## Human review focus + +Confirm the linear CP03A-before-CP03B dependency, target-only identity with no +matrix authority, owner-module lock custody, exact Finance Authority principal, +no public route, and complete exclusion of adjacent compensation behavior. + +Only an authorized human may merge the planning PR. CP03A implementation must +not start until this plan merges. diff --git a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md index 6f87f0744..38c62e61c 100644 --- a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md +++ b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md @@ -198,6 +198,25 @@ focused coverage commands for every changed subsystem at 90 percent or higher, and the full backend suite preserving the global 78 percent floor. Generic “as applicable” proof or AUTH-only tests cannot authorize activation. +`WS-ARCH-001-CP03` is split/non-executable. CP03A is the prerequisite executable +contract for the closed adapter target identity and real owner eligibility; it +activates no action. CP03B is the activation executable contract. CP02 provides +the immutable hidden feature manifest, transaction custody, recovery behavior, +and deny-default composition. After CP03A merges, CP03B may activate only: + +```text +compensation.adapter_binding.read +compensation.adapter_binding.create +compensation.adapter_binding.suspend +compensation.adapter_binding.resume +``` + +All four remain unavailable until CP03B implementation merges. They admit only +an active human Finance Authority covering the exact project, use the existing +request-scoped read and opaque PREP protocols, add no service identity or +route, and do not activate ContributionPolicy, retirement, fulfillment, +callback, delivery, dispatcher, or reconciliation authority. + `WS-AUTH-001-ART-02D-INTERNAL` requires the exact merged ART-02C2 verification, resolution, and scanner behavior plus ART-02C3 recovery/fencing foundations and any ART-02D resource-composer dependency. ART-02D does not own the internal diff --git a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md index 17ad58957..29ddd3faa 100644 --- a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md @@ -18,7 +18,7 @@ may proceed concurrently; open pull requests show transient ownership. ## Chunks `WS-ARCH-001/CHUNK_MAP.md` owns the ordered cross-module sequence -`WS-ARCH-001-CP01A -> CP01B -> CP01C -> CP02 -> CP03 -> CP04 -> CP05`; the AUTH entries below +`WS-ARCH-001-CP01A -> CP01B -> CP01C -> CP02 -> CP03A -> CP03B -> CP04 -> CP05`; the AUTH entries below project only AUTH-owned registration and activation responsibilities from that sequence. @@ -28,7 +28,9 @@ sequence. | `WS-ARCH-001-CP01A` | Adapter-binding unavailable registration | L1 | Complete on merge; excludes retirement, callback/fulfillment, identity, evaluator, and activation | | `WS-ARCH-001-CP01B` | ContributionPolicy unavailable registration | L1 | Complete on merge; excludes binding behavior, evaluator, and activation | | `WS-ARCH-001-CP01C` | Adapter-binding fact correction | L1 | Complete on merge; unavailable facts match binding identity and lifecycle generation | -| `WS-ARCH-001-CP03` | Exact adapter-binding activation | L1 | Proposed after merged CP02 hidden proof | +| `WS-ARCH-001-CP03` | Adapter-binding activation parent | L1 | Split into CP03A/CP03B; non-executable | +| `WS-ARCH-001-CP03A` | Adapter target identity and owner eligibility prerequisite | L1 | Executable contract complete on merge; actions remain unavailable | +| `WS-ARCH-001-CP03B` | Exact Finance Authority adapter-binding activation | L1 | Executable contract complete on merge; follows CP03A | | `WS-ARCH-001-CP05` | Exact ContributionPolicy activation | L1 | Proposed after merged CP04 hidden proof | | `WS-AUTH-001-PLAN` | Authorization Service Planning | L0 | Merged through PR #91 as `ad6d644` | | `WS-AUTH-001-01` | Adopt Authorization Baseline And Repository Contracts | L1 | Merged through PR #93 as `772af1d` | diff --git a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md index 79b5b1e54..15d3ef80f 100644 --- a/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md +++ b/.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md @@ -46,8 +46,11 @@ not current start requirements. complete on merge with exact adapter-binding actions still unavailable; CP01B is complete on merge and separately registers policy actions while unavailable; CP01C is complete on merge with corrected - unavailable binding identity and lifecycle-generation facts; CP03 and CP05 activate - only their respective merged hidden behavior. Fulfillment callback authority + unavailable binding identity and lifecycle-generation facts; CP03 is split. + CP03A's executable contract adds only the target identity and owner + eligibility while actions remain unavailable; CP03B's implementation then + activates only CP02's four exact Finance Authority boundaries. CP05 later activates + only CP04's merged hidden policy behavior. Fulfillment callback authority remains separate and cannot be bundled into adapter-binding registration. Open pull requests are the transient-work view. This status page does not name diff --git a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md index 054aa96e5..e2e40630b 100644 --- a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md +++ b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md @@ -4,12 +4,14 @@ Current `main` contains the AUTH actor, grant, fixed-service, prepared-mutation, project-guide, policy-mutation, and REV-readiness -foundations plus merged REV PLAN4 and ART foundations. The old -`0052_legacy_intake_removal` identifier is historical merge evidence. Current -main ends at `0003_submission_lineage`; CP02 installs -`0004_compensation_adapter_binding_lifecycle` as the active head on merge. These foundations do -not create CON runtime, activate CON behavior, or give an outbox dispatcher -feature authority. +foundations plus merged REV PLAN4, ART foundations, and CP02 hidden CON +adapter-binding behavior. The old `0052_legacy_intake_removal` identifier is +historical merge evidence. Current main ends at +`0004_compensation_adapter_binding_lifecycle`. CP02's four binding actions +remain unavailable. CP03 is split: CP03A installs the target identity and owner +eligibility while actions stay unavailable; CP03B activates only the four exact +Finance Authority boundaries. No public CON route, ContributionPolicy +behavior, or outbox-dispatcher authority is active. AUTH owns identifiers, stable permission mappings, principals, grants, fixed-service identities and matrix rows, prepared authorization, evaluators, @@ -43,7 +45,7 @@ protocol and one caller-owned commit. | `02C` lifecycle audit participant | none; caller supplies already-authorized typed facts | CON may proceed | | `CP01A` binding registration | exact binding actions, typed contexts, custody and permission mapping; retirement/callback/fulfillment excluded | register unavailable first | | `CP01B` policy registration | exact `contribution.policy.*` actions, typed contexts, custody and permission mapping | register unavailable after CP01A and before hidden services | -| `CP03` binding activation | exact CP02-proven binding actions only | activate after hidden proof | +| `CP03A/CP03B` binding prerequisite/activation | exact adapter target identity and owner eligibility, then exact CP02-proven binding actions only | keep unavailable through CP03A; activate in CP03B | | `CP05` policy activation | exact CP04-proven policy actions only | activate after hidden proof | | `CP06-CP08` validation and owner persistence | existing guide activation authority; later TASK readiness/claim authority remains TASK/AUTH-owned | CON validates only; PROJECT/TASK own writes | | `06` former review-claim lookup | none | planned retirement; REV copies the admitted Submission's immutable attempt version, verifies Task/Assignment only for equality, and performs no CON/current-policy lookup | @@ -82,9 +84,11 @@ matrix rows, or evaluators. No AUTH change blocks planning or completed CON `03A`, `03B`, or `02C`. CP01A and CP01B separately register binding and policy authority while unavailable. CP01C corrects binding identity and lifecycle-generation facts before CP02. -CP02 is complete on merge with hidden CON behavior while every binding action -remains unavailable. CP03 and CP05 activate -only their respective CP02/CP04 hidden proof. Before CON +CP02 is merged with hidden CON behavior while every binding action remains +unavailable. CP03 is split: CP03A first installs the exact target identity and +owner eligibility without activation; CP03B then activates only the four exact +CP02 Finance Authority boundaries. CP05 later +activates only CP04's hidden proof. Before CON `02B`, AUTH must deliver the complete dispatcher identity/admission/action contract. That later dispatcher work must not delay the persistence and transaction-participant foundations now needed by REV. diff --git a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md index 0b86ec098..374984565 100644 --- a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md @@ -14,6 +14,9 @@ signed-loop records do not make behavior live. | `03A` | Adapter-binding persistence | Merged PR #267; migration 0053 | | `03B` | Contribution-policy persistence | Merged PR #274; migration 0055 | | `WS-ARCH-001-CP02` | Hidden adapter-binding lifecycle behavior | Complete on merge; actions remain unavailable | +| `WS-ARCH-001-CP03` | Adapter-binding activation parent | Split into CP03A/CP03B; non-executable | +| `WS-ARCH-001-CP03A` | Adapter target identity and owner eligibility | Executable contract complete on merge; actions remain unavailable | +| `WS-ARCH-001-CP03B` | Exact Finance Authority adapter-binding activation | Executable contract complete on merge; follows CP03A | | `PLAN5` | Historical complete-context human needs-revision rebase reconciliation | Merged PR #270; continuing-TaskAssignment rebase retained, independent reviewer-selection wording superseded by current PLAN2 | ## Current reconciliation @@ -61,7 +64,7 @@ PLAN4 -> 02C ----------------------------------> REV-04B REV-04B + 03B -> 03C -> 03D -CP01A -> CP01B -> CP01C -> CP02 -> CP03 -> CP04 -> CP05 -> CP06 -> CP07 -> CP08 +CP01A -> CP01B -> CP01C -> CP02 -> CP03A -> CP03B -> CP04 -> CP05 -> CP06 -> CP07 -> CP08 CP08 -> WS-ARCH-001-03A/03B replacement behavior -> WS-ARCH-001-03C activation -> CP09 task-locked policy lineage -> assignment -> Submission-stamped attempt lineage -> allow_review -> ReviewLease REV revision lineage + 03C/03D + CP06/CP08 -> 07 -> REV-10 first Review commit diff --git a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md index 6b6b6fc17..7f7602c8f 100644 --- a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md +++ b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md @@ -3,7 +3,7 @@ | Family | Owning chunks | Required proof | Final gate | |---|---|---|---| | Canonical policy model | 01,03B,CP04/CP05 | ContributionPolicy/version/rules/definitions; explicit unpaid; immutable publish; one active policy; NUMERIC(38,18) decimal-string bounds; ISO 4217 money units; project-scoped points units; stable binding references | CON-11 | -| Adapter binding | 03A,CP02/CP03,10B | one active binding per project/instrument; policy definitions and awards reference a binding with matching project/instrument identity while the binding stores no policy/award identifiers; non-secret route; suspend/resume and existing-award callback/replay behavior; retirement refuses active policy, unfinished frozen work, or unfulfilled award dependencies | CON-11 + joint live drill | +| Adapter binding | 03A,CP02/CP03A/CP03B,10B | one active binding per project/instrument; exact target identity and owner eligibility; policy definitions and awards reference a binding with matching project/instrument identity while the binding stores no policy/award identifiers; non-secret route; suspend/resume and existing-award callback/replay behavior; retirement refuses active policy, unfinished frozen work, or unfulfilled award dependencies | CON-11 + joint live drill | | Legacy clean cut | CP09 after WS-ARCH-001-03C activation | zero semantic consumers before schema removal; clean current-baseline parity; no alias/fallback/backfill | CON-11 | | Authorization | AUTH + each feature | current AUTH actor/grant/fixed-service/PREP and REV-readiness foundations, with current repository migrations through ART-owned `0050`; provisioning grants no service execution; CON mappings, identities, and static rows are absent on current main; every future artifact requires exact AUTH-owned registration and activation evidence, exact grant/static row, fixed-service admission, prepared handle bound to session/action/actor-ref/idempotency/request digest with substitution non-consumption, planned denial, and no local role logic | AUTH activation + CON-11 | | Final acceptance | REV + 03C,07 | accept creates one immutable FinalAcceptance per task/Review/Submission; needs_revision/reject create none; no create API/action, reopen, replacement, or adjudication path | joint live drill | diff --git a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md index 9ed88f06c..cf45e6dad 100644 --- a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md +++ b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md @@ -82,9 +82,11 @@ historical-row backfill or compatibility behavior. exact ContributionPolicy actions registered but unavailable. CP01C is complete on merge with corrected binding identity and lifecycle-generation facts. Callback/fulfillment authority stays separate. -- CP02 is complete on merge with hidden, route-unreachable adapter-binding - behavior and immutable lifecycle history while all four AUTH actions remain - unavailable. CP03-CP05 remain non-executable activation/policy skeletons. +- CP02 is merged with hidden, route-unreachable adapter-binding behavior and + immutable lifecycle history while all four AUTH actions remain unavailable. + CP03 is split: CP03A's executable target-identity/owner-eligibility contract + precedes CP03B's executable Finance Authority activation contract. CP04-CP05 + remain non-executable policy behavior/activation skeletons. - CP06-CP09: validation, owner schema lineage, and clean legacy removal wait for the preceding public behavior. No historical-row classification is required unless current-main discovery proves real deployed data exists. @@ -116,7 +118,8 @@ CP08/ARCH-03B replacement path. ## Immediate next action CON-02C merged through PR #277. REV-04B may consume its shared lifecycle-audit -participant after REV's earlier gates merge. Expand and review CP03 against -current main before activating the exact adapter-binding actions. CP02 itself -remains hidden and route-unreachable. +participant after REV's earlier gates merge. Implement reviewed CP03A while all +binding actions remain unavailable, then CP03B to activate exactly those four +actions for covered Finance Authority. CP02 remains hidden and route-unreachable; +neither child adds a route. Open pull requests determine transient CON work. diff --git a/docs/roadmap_status.md b/docs/roadmap_status.md index 97c2bea1b..912657fbf 100644 --- a/docs/roadmap_status.md +++ b/docs/roadmap_status.md @@ -137,7 +137,9 @@ review. Their presence does not change the implemented-on-`main` list above. authority while keeping all nine actions unavailable. CP01C corrects the unavailable binding facts before CP02. CP02 is complete on merge with hidden, route-unreachable adapter-binding behavior and immutable lifecycle history. - The remaining order is CP03 adapter-binding activation, CP04 hidden ContributionPolicy behavior, + CP03 is split with executable CP03A/CP03B contracts complete on merge. The + remaining order is CP03A target identity/owner eligibility, CP03B Finance + Authority activation, CP04 hidden ContributionPolicy behavior, then CP05 ContributionPolicy activation; expose CON validation; then bind one exact published, complete, binding-valid ContributionPolicyVersion at guide activation, and diff --git a/docs/spec_authorization_service.md b/docs/spec_authorization_service.md index 726fa3d99..a4ffbb557 100644 --- a/docs/spec_authorization_service.md +++ b/docs/spec_authorization_service.md @@ -273,6 +273,11 @@ resource facts: create binds the server-selected binding identity and no unit, copies CON's exact `instrument_type` without translation, while suspend/resume bind the exact positive lifecycle version. Catalogue counts, mappings, owners, and availability remain unchanged. +WS-ARCH-001-CP03 is split after merged CP02 hidden behavior. CP03A adds only +the closed target identity `workstream.compensation.adapter` and real +PROJECTS/ACTORS eligibility adapters; it adds no service-matrix membership and +keeps all four binding actions unavailable. CP03B then installs the exact +Finance Authority read/PREP adapter and activates only those four actions. AUTH-10A added five project-role read/manage rows; AUTH-10B owns and activates the three reads, while AUTH-10C owns and activates the two reason-bound, idempotent project-role mutations. AUTH-11A adds eleven diff --git a/docs/spec_contribution_compensation.md b/docs/spec_contribution_compensation.md index edfb371eb..2851d9ee2 100644 --- a/docs/spec_contribution_compensation.md +++ b/docs/spec_contribution_compensation.md @@ -779,7 +779,15 @@ and an opaque prepare/consume/close authorization participant before product mutation. Every create, suspend, or resume appends one immutable lifecycle event atomically. Exact duplicate recovery requires fresh read authorization; changed or unauthorized recovery is concealed. Production composition remains -deny-default and the actions remain unavailable until CP03. +deny-default and the actions remain unavailable through CP03A. + +CP03 is split to preserve owner and activation custody. CP03A first registers +the closed target-only `workstream.compensation.adapter` service identity and +installs PROJECTS/ACTORS owner-held eligibility adapters; it grants that target +no action or service-matrix membership, and all four binding actions remain +unavailable. CP03B then installs the AUTH read/PREP adapter and activates only +the four exact Finance Authority binding actions. Neither child adds a public +route, provider behavior, or ContributionPolicy authority. | ActionId | PermissionId | Principal / target | Protocol | Feature owner | |---|---|---|---:|---| From 3b1d759bbc4a2556f74fb93e6fc6d5fc13e0ec1b Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Sat, 15 Aug 2026 13:50:32 +0100 Subject: [PATCH 2/7] fix(plan): preserve tracked cp03 contract path --- .agent-loop/CURRENT_STATE.md | 2 +- .../WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md | 2 +- .../WS-ARCH-001-modular-monolith-boundaries/STATUS.md | 2 +- ...01-CP03.md => WS-ARCH-001-CP03-auth-binding-activation.md} | 4 ++-- .../chunks/WS-ARCH-001-CP03A-owner-eligibility.md | 2 +- .../chunks/WS-ARCH-001-CP03B-auth-binding-activation.md | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) rename .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/{WS-ARCH-001-CP03.md => WS-ARCH-001-CP03-auth-binding-activation.md} (86%) diff --git a/.agent-loop/CURRENT_STATE.md b/.agent-loop/CURRENT_STATE.md index f93d0e90d..5ea5fce34 100644 --- a/.agent-loop/CURRENT_STATE.md +++ b/.agent-loop/CURRENT_STATE.md @@ -113,7 +113,7 @@ non-executable until their current-main contracts are expanded. adapter-binding identity and lifecycle-version facts. - WS-ARCH-001-CP02 is complete on merge with hidden, route-unreachable behavior, exact lifecycle history, and deny-default production composition. -- WS-ARCH-001-CP03 is split/non-executable. CP03A and CP03B have executable +- WS-ARCH-001-CP03 is a planned split/non-executable parent. CP03A and CP03B have executable contracts complete on merge and are the next ordered bounded boundaries. - WS-ARCH-001-CP04 is proposed and non-executable. - WS-ARCH-001-CP05 is proposed and non-executable. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md index c7d271278..8ae52ad44 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md @@ -22,7 +22,7 @@ | `WS-ARCH-001-CP01B` | AUTH ContributionPolicy unavailable registration | L1 | Complete on merge; five actions remain planned/unavailable | | `WS-ARCH-001-CP01C` | AUTH adapter-binding fact correction | L1 | Complete on merge; corrects unavailable facts before CON behavior | | `WS-ARCH-001-CP02` | CON hidden adapter-binding behavior | L1 | Complete on merge; route-unreachable and deny-default while actions remain unavailable | -| `WS-ARCH-001-CP03` | Adapter-binding activation coordination parent | L1 | Split into CP03A/CP03B; non-executable | +| `WS-ARCH-001-CP03` | Adapter-binding activation coordination parent | L1 | Planned split into CP03A/CP03B; non-executable | | `WS-ARCH-001-CP03A` | Closed adapter target identity and PROJECTS/ACTORS owner eligibility | L1 | Executable contract complete on merge; implementation next | | `WS-ARCH-001-CP03B` | AUTH exact Finance Authority adapter-binding activation | L1 | Executable contract complete on merge; follows merged CP03A | | `WS-ARCH-001-CP04` | CON hidden ContributionPolicy behavior | L1 | Proposed skeleton after merged CP03B evidence | diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md index f66fc9e3b..b2fc6f05b 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md @@ -79,7 +79,7 @@ match exact binding identity and lifecycle generation without a unit alias. - WS-ARCH-001-CP02 is complete on merge: hidden, route-unreachable adapter-binding behavior while its AUTH actions remain unavailable. -- WS-ARCH-001-CP03 is split/non-executable. CP03A's executable contract first +- WS-ARCH-001-CP03 is a planned split/non-executable parent. CP03A's executable contract first installs the closed compensation-adapter target identity and PROJECTS/ACTORS owner eligibility while actions remain unavailable. CP03B's executable contract then installs and proves exact Finance Authority activation without diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md similarity index 86% rename from .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03.md rename to .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md index b55e8c24b..88cf2481d 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md @@ -12,7 +12,7 @@ adapter-binding activation. ## Approved split ```text -CP02 hidden lifecycle behavior +CP02 hidden adapter-binding lifecycle behavior -> CP03A compensation-adapter identity and owner eligibility -> CP03B exact Finance Authority AUTH activation -> CP04 hidden ContributionPolicy behavior @@ -24,4 +24,4 @@ adapter-binding route. ## Merge state -- Outcome on merge: `split parent recorded; no runtime behavior` +- Outcome on merge: `planned` diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md index b4bd3d59c..190fae100 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md @@ -96,7 +96,7 @@ backend/scripts/run_test_lanes.py .agent-loop/CURRENT_STATE.md .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md -.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03A-plan-review-evidence.md diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md index 9a0367e63..ed9905dac 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md @@ -149,7 +149,7 @@ backend/scripts/run_test_lanes.py (exact CP03 test custody only) .agent-loop/CURRENT_STATE.md .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md -.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03.md +.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03-auth-binding-activation.md .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03B-plan-review-evidence.md From ba11dc472c65727facc7918480fa9f9bca2098bf Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Sat, 15 Aug 2026 13:51:46 +0100 Subject: [PATCH 3/7] fix(plan): declare atomic chunk outcomes --- .agent-loop/CURRENT_STATE.md | 3 +++ .../WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md | 4 ++-- .../WS-ARCH-001-modular-monolith-boundaries/STATUS.md | 3 +++ .../chunks/WS-ARCH-001-CP03A-owner-eligibility.md | 4 ++-- .../chunks/WS-ARCH-001-CP03B-auth-binding-activation.md | 4 ++-- 5 files changed, 12 insertions(+), 6 deletions(-) diff --git a/.agent-loop/CURRENT_STATE.md b/.agent-loop/CURRENT_STATE.md index 5ea5fce34..c10a860c6 100644 --- a/.agent-loop/CURRENT_STATE.md +++ b/.agent-loop/CURRENT_STATE.md @@ -115,6 +115,9 @@ non-executable until their current-main contracts are expanded. exact lifecycle history, and deny-default production composition. - WS-ARCH-001-CP03 is a planned split/non-executable parent. CP03A and CP03B have executable contracts complete on merge and are the next ordered bounded boundaries. +- WS-ARCH-001-CP03A is planned with an executable implementation contract. +- WS-ARCH-001-CP03B is planned with an executable implementation contract after + merged CP03A. - WS-ARCH-001-CP04 is proposed and non-executable. - WS-ARCH-001-CP05 is proposed and non-executable. - WS-ARCH-001-CP06 is proposed and non-executable. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md index 8ae52ad44..a74cb1697 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md @@ -23,8 +23,8 @@ | `WS-ARCH-001-CP01C` | AUTH adapter-binding fact correction | L1 | Complete on merge; corrects unavailable facts before CON behavior | | `WS-ARCH-001-CP02` | CON hidden adapter-binding behavior | L1 | Complete on merge; route-unreachable and deny-default while actions remain unavailable | | `WS-ARCH-001-CP03` | Adapter-binding activation coordination parent | L1 | Planned split into CP03A/CP03B; non-executable | -| `WS-ARCH-001-CP03A` | Closed adapter target identity and PROJECTS/ACTORS owner eligibility | L1 | Executable contract complete on merge; implementation next | -| `WS-ARCH-001-CP03B` | AUTH exact Finance Authority adapter-binding activation | L1 | Executable contract complete on merge; follows merged CP03A | +| `WS-ARCH-001-CP03A` | Closed adapter target identity and PROJECTS/ACTORS owner eligibility | L1 | Planned executable contract; implementation next | +| `WS-ARCH-001-CP03B` | AUTH exact Finance Authority adapter-binding activation | L1 | Planned executable contract; follows merged CP03A | | `WS-ARCH-001-CP04` | CON hidden ContributionPolicy behavior | L1 | Proposed skeleton after merged CP03B evidence | | `WS-ARCH-001-CP05` | AUTH exact ContributionPolicy activation | L1 | Proposed skeleton after CP04 evidence | | `WS-ARCH-001-CP06` | CON guide-activation/revision policy-validation port | L1 | Proposed skeleton after CP05 | diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md index b2fc6f05b..3c9aba842 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md @@ -84,6 +84,9 @@ owner eligibility while actions remain unavailable. CP03B's executable contract then installs and proves exact Finance Authority activation without adding a route or adjacent compensation authority. +- WS-ARCH-001-CP03A is planned with an executable implementation contract. +- WS-ARCH-001-CP03B is planned with an executable implementation contract after + merged CP03A. - WS-ARCH-001-CP04 is proposed: hidden ContributionPolicy behavior. - WS-ARCH-001-CP05 is proposed: exact ContributionPolicy activation. - WS-ARCH-001-CP06 is proposed: CON policy-validation port. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md index 190fae100..46b2a7891 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md @@ -2,8 +2,8 @@ ## Merge state -- Contract outcome on merge: `executable contract complete; implementation next` -- Implementation outcome on merge: `complete; binding actions remain unavailable` +- Outcome on merge: `planned` +- Future implementation target: complete while binding actions remain unavailable. ## Parent initiative diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md index ed9905dac..2cbcb959a 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md @@ -2,8 +2,8 @@ ## Merge state -- Contract outcome on merge: `executable contract complete; implementation next` -- Implementation outcome on merge: `complete` +- Outcome on merge: `planned` +- Future implementation target: complete. ## Parent initiative From 32e2e729949751e317194c4216c553dc517274c9 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Sat, 15 Aug 2026 14:12:18 +0100 Subject: [PATCH 4/7] fix(plan): enforce owner public boundaries --- .../RISKS.md | 4 +-- .../WS-ARCH-001-CP02-con-binding-behavior.md | 24 +++++++------ .../WS-ARCH-001-CP03A-owner-eligibility.md | 35 +++++++++++++++---- .../WS-ARCH-001-CP03-plan-review-evidence.md | 10 ++++-- 4 files changed, 51 insertions(+), 22 deletions(-) diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md index 7d4b5a889..23ab8171d 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md @@ -32,6 +32,6 @@ | Debt repayment expands a feature beyond a reviewable safety boundary | High | Record exact stranded debt, prove no growth, and create a later owner-sized closure contract rather than mixing product boundaries | | Mechanical quotas reward noisy or cosmetic cleanup | Medium | Use exact edge/finding deltas and behavior ownership; prohibit arbitrary per-PR percentages and cosmetic test splitting | | Overlapping ledgers are added together and misstate debt | Medium | Report general, AUTH, structural, and behavior-ownership measurements separately under their existing owners | -| Adapter-binding resume erases suspension attribution | Critical | CP02 appends one immutable CON lifecycle event per version in the same transaction; CP03 later stages AUTH decision evidence atomically beside it | +| Adapter-binding resume erases suspension attribution | Critical | CP02 appends one immutable CON lifecycle event per version in the same transaction; CP03B later stages AUTH decision evidence atomically beside it | | Unrelated internal service is bound as a compensation adapter | Critical | CP02 requires an injected exact ACTORS eligibility capability; generic service kind and existing ART/REV identities fail closed; CP03A installs the exact target identity/owner rule before CP03B activation | -| CP02 invents a second authorization protocol or imports AUTH internals | Critical | CON defines only a domain-facing opaque prepare/consume/close port; production denies until CP03 adapts the existing AUTH PREP implementation | +| CP02 invents a second authorization protocol or imports AUTH internals | Critical | CON defines only a domain-facing opaque prepare/consume/close port; production denies until CP03B adapts the existing AUTH PREP implementation | diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP02-con-binding-behavior.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP02-con-binding-behavior.md index 1185b9627..ae7476f41 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP02-con-binding-behavior.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP02-con-binding-behavior.md @@ -1,6 +1,6 @@ # Chunk Contract: WS-ARCH-001-CP02 — Hidden Adapter-Binding Behavior -Status: complete on implementation merge; CP03 is the next activation gate. +Status: complete on implementation merge; CP03A then CP03B are the next gates. Risk: L1. ## Goal @@ -9,8 +9,8 @@ Implement CON-owned, route-unreachable create/read/suspend/resume behavior for `ProjectCompensationAdapterBinding` while all four registered AUTH actions remain unavailable. Prove the complete product state machine, public module boundaries, PostgreSQL guards, immutable lifecycle history, and deny-default -authorization seams before CP03 installs real AUTH adapters and activates the -actions. +authorization seams before CP03A installs the target identity and owner +eligibility and CP03B installs real AUTH adapters and activates the actions. ## Why this correction exists @@ -36,9 +36,10 @@ Current main also proves that: - Hidden CON behavior is complete and route-unreachable. - Production composition remains deny-default. - All four actions remain planned/unavailable. -- CP03 becomes the next gate and must install the real AUTH/ACTORS adapters, - approved compensation-adapter identity rule, atomic authorization evidence, - and exact activation before any surface becomes usable. +- CP03A becomes the next gate and must install the approved target identity + plus PROJECTS/ACTORS public owner eligibility while every action remains + unavailable. CP03B then installs atomic AUTH authorization evidence and exact + activation before any surface becomes usable. ## Risk class @@ -196,7 +197,7 @@ close(object) -> None CON neither recognizes nor constructs the concrete object. Production defaults deny. CP02 fakes must enforce identity, action, actor, project, facts, operation, session/transaction, single consumption, replay rejection, and close -invalidation. CP03 later implements this port using the existing AUTH PREP +invalidation. CP03B later implements this port using the existing AUTH PREP machinery; it must not introduce a second authorization protocol. Every object returned by `prepare` is closed exactly once from an unconditional @@ -223,8 +224,10 @@ Create depends on narrow public owner facts rather than foreign repositories: Neither port returns private models. Generic `actor_kind=service` is insufficient. Existing ART, REV, checker, dispatcher, or other internal service -identities must fail. CP03 must not activate create until AUTH/ACTORS has an explicitly -approved compensation-adapter identity rule and real adapter composition. +identities must fail. CP03A must establish the explicitly approved +compensation-adapter target identity and real PROJECTS/ACTORS public owner +composition while all actions remain unavailable; CP03B must not activate +create before that prerequisite is merged. PROJECTS and ACTORS eligibility ports must acquire owner-controlled database row locks or equivalent transaction-scoped eligibility fences in the fixed @@ -517,7 +520,8 @@ No local full-suite run is required on the user's slow machine. - unrelated service identities cannot become adapter bindings. - lifecycle history and authorization evidence are distinct and atomic on eventual activation. -- CP02 remains hidden/unavailable and CP03 is the only activation successor. +- CP02 remains hidden/unavailable; CP03A is the owner-eligibility prerequisite + and CP03B is the only activation successor. ## Stop conditions diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md index 46b2a7891..907df7e2f 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md @@ -13,7 +13,8 @@ WS-ARCH-001 — Modular Monolith Boundaries Register one closed compensation-adapter target identity and implement the real PROJECTS- and ACTORS-owned eligibility adapters required by CP02 create/resume, -without activating any adapter-binding action. +through their owner modules' public APIs and without activating any +adapter-binding action. ## Why this chunk exists @@ -50,10 +51,22 @@ Eligibility requires, under ACTORS-owned transaction-held row locks: - the actor's exact service ActorIdentityLink exists, is active, and has `subject_kind=service`. -PROJECTS independently locks the exact project and accepts only the existing -CP02-approved binding lifecycle states. Both owner adapters flush nothing, -commit nothing, and return only their public immutable facts. CP02 retains the -locks through the caller-owned root transaction. +ACTORS exposes these facts only through +`app.modules.actors.api.CompensationAdapterActorEligibilityPort`; its concrete +implementation remains private to ACTORS. CON consumes that injected public +port. AUTH may register/provision the closed identity through existing public +composition surfaces, but AUTH must not import the ACTORS implementation or +create an AUTH-to-ACTORS domain adapter. + +PROJECTS independently locks the exact project and validates only +PROJECTS-owned binding eligibility through +`app.modules.projects.api.ProjectCompensationBindingEligibilityPort`. PROJECTS +does not inspect or decide a CON binding lifecycle state. CON owns the binding +lifecycle and decides that create and resume require the PROJECTS and ACTORS +eligibility ports, while suspend remains possible after owner ineligibility. +Both owner adapters flush nothing, commit nothing, and return only their public +immutable facts. CP02 retains the locks through the caller-owned root +transaction. ## Allowed files @@ -148,8 +161,16 @@ compatibility support for old identities or deployed rows identity link; human actors, generic service kind, missing/revoked links, inactive profiles, and every existing ART/REV/project/checker identity deny with one concealed unavailable result. -- [ ] PROJECTS locks and validates the exact project under the CP02-approved - lifecycle rule; absent/ineligible/cross-project targets deny. +- [ ] ACTORS exposes and CP02/CON consumes only the immutable public + `CompensationAdapterActorEligibilityPort`; AUTH and CON import no ACTORS + private model, repository, service, or concrete adapter. +- [ ] PROJECTS locks and validates only the exact project's PROJECTS-owned + binding eligibility through the immutable public + `ProjectCompensationBindingEligibilityPort`; absent, ineligible, and + cross-project targets deny, and PROJECTS contains no CON lifecycle rule. +- [ ] CON alone decides that create/resume invoke both owner eligibility ports + and that suspend does not; no owner module interprets binding status or + lifecycle version. - [ ] Owner locks remain held through CP02 authorization and mutation for create/resume; a competing revocation or project-ineligibility commit cannot enter between validation and product transition. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md index 2fa0d98fe..e00e9616f 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md @@ -33,6 +33,10 @@ AUTH read/PREP machinery and activates only read/create/suspend/resume. - Distinguished duplicate-recovery read evidence from mutation PREP/evidence. - Split identity/schema/owner eligibility from action activation. - Added exact PROJECTS/ACTORS owner adapter files and retained-lock/race proof. +- Made ACTORS identity eligibility and PROJECTS project eligibility explicit + public owner APIs consumed by injected CON ports; AUTH imports neither owner + implementation, PROJECTS interprets no CON lifecycle state, and CON alone + decides which lifecycle operations require the ports. - Defined a target-only identity that cannot enter the service action matrix. - Added exact migration, reset fingerprint, fixed-baseline, provisioning, and downgrade-refusal proof for CP03A. @@ -50,12 +54,12 @@ AUTH read/PREP machinery and activates only read/create/suspend/resume. | Track | Result | Remaining blocker | |---|---|---| -| Architecture / senior engineering | pass | none | -| Security / authorization | pass with completed stale-doc condition | none | +| Architecture / senior engineering | pass after exact-head public-owner-boundary correction | none | +| Security / authorization | pass with low evidence-cleanup risk resolved in this document | none | | Product / operations | pass | none | | Reuse / QA / test delta | pass | none | | CI integrity | pass | none | -| Documentation | pass after CP04 dependency wording correction | none | +| Documentation | pass after exact-head evidence and CP02 successor reconciliation | none | ## Deterministic evidence From 5f65e21c3734593846d22855fbdf5351838e640e Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Sat, 15 Aug 2026 14:16:06 +0100 Subject: [PATCH 5/7] fix(plan): preserve atomic chunk history --- .../WS-ARCH-001-CP02-con-binding-behavior.md | 24 ++++++++----------- .../WS-ARCH-001-CP03-plan-review-evidence.md | 9 ++++++- 2 files changed, 18 insertions(+), 15 deletions(-) diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP02-con-binding-behavior.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP02-con-binding-behavior.md index ae7476f41..1185b9627 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP02-con-binding-behavior.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP02-con-binding-behavior.md @@ -1,6 +1,6 @@ # Chunk Contract: WS-ARCH-001-CP02 — Hidden Adapter-Binding Behavior -Status: complete on implementation merge; CP03A then CP03B are the next gates. +Status: complete on implementation merge; CP03 is the next activation gate. Risk: L1. ## Goal @@ -9,8 +9,8 @@ Implement CON-owned, route-unreachable create/read/suspend/resume behavior for `ProjectCompensationAdapterBinding` while all four registered AUTH actions remain unavailable. Prove the complete product state machine, public module boundaries, PostgreSQL guards, immutable lifecycle history, and deny-default -authorization seams before CP03A installs the target identity and owner -eligibility and CP03B installs real AUTH adapters and activates the actions. +authorization seams before CP03 installs real AUTH adapters and activates the +actions. ## Why this correction exists @@ -36,10 +36,9 @@ Current main also proves that: - Hidden CON behavior is complete and route-unreachable. - Production composition remains deny-default. - All four actions remain planned/unavailable. -- CP03A becomes the next gate and must install the approved target identity - plus PROJECTS/ACTORS public owner eligibility while every action remains - unavailable. CP03B then installs atomic AUTH authorization evidence and exact - activation before any surface becomes usable. +- CP03 becomes the next gate and must install the real AUTH/ACTORS adapters, + approved compensation-adapter identity rule, atomic authorization evidence, + and exact activation before any surface becomes usable. ## Risk class @@ -197,7 +196,7 @@ close(object) -> None CON neither recognizes nor constructs the concrete object. Production defaults deny. CP02 fakes must enforce identity, action, actor, project, facts, operation, session/transaction, single consumption, replay rejection, and close -invalidation. CP03B later implements this port using the existing AUTH PREP +invalidation. CP03 later implements this port using the existing AUTH PREP machinery; it must not introduce a second authorization protocol. Every object returned by `prepare` is closed exactly once from an unconditional @@ -224,10 +223,8 @@ Create depends on narrow public owner facts rather than foreign repositories: Neither port returns private models. Generic `actor_kind=service` is insufficient. Existing ART, REV, checker, dispatcher, or other internal service -identities must fail. CP03A must establish the explicitly approved -compensation-adapter target identity and real PROJECTS/ACTORS public owner -composition while all actions remain unavailable; CP03B must not activate -create before that prerequisite is merged. +identities must fail. CP03 must not activate create until AUTH/ACTORS has an explicitly +approved compensation-adapter identity rule and real adapter composition. PROJECTS and ACTORS eligibility ports must acquire owner-controlled database row locks or equivalent transaction-scoped eligibility fences in the fixed @@ -520,8 +517,7 @@ No local full-suite run is required on the user's slow machine. - unrelated service identities cannot become adapter bindings. - lifecycle history and authorization evidence are distinct and atomic on eventual activation. -- CP02 remains hidden/unavailable; CP03A is the owner-eligibility prerequisite - and CP03B is the only activation successor. +- CP02 remains hidden/unavailable and CP03 is the only activation successor. ## Stop conditions diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md index e00e9616f..a19cee759 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md @@ -59,7 +59,7 @@ AUTH read/PREP machinery and activates only read/create/suspend/resume. | Product / operations | pass | none | | Reuse / QA / test delta | pass | none | | CI integrity | pass | none | -| Documentation | pass after exact-head evidence and CP02 successor reconciliation | none | +| Documentation | pass for current entry points and executable contracts | completed CP02 contract retained as historical exact-change evidence by the atomic-state gate | ## Deterministic evidence @@ -72,3 +72,10 @@ AUTH read/PREP machinery and activates only read/create/suspend/resume. No runtime code, action availability, service identity, schema, route, or product behavior changes in this planning PR. + +The merged CP02 contract retains its then-current umbrella `CP03` wording as +historical exact-change evidence. Editing that completed contract in this +planning PR would combine a `complete` outcome with the planned CP03/CP03A/CP03B +outcomes and is rejected by the atomic chunk-state gate. Current implementation +authority is instead explicit in `CURRENT_STATE.md`, the initiative maps and +statuses, and the executable CP03A/CP03B contracts. From 5e03c0df939277faa3c92a23262b1a5b247e7540 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Sat, 15 Aug 2026 14:38:16 +0100 Subject: [PATCH 6/7] fix(plan): expose actor identity contract --- .../WS-ARCH-001-CP03A-owner-eligibility.md | 22 ++++++++++++++++++- .../WS-ARCH-001-CP03-plan-review-evidence.md | 6 ++++- .../WS-ARCH-001-CP03-pr-trust-bundle.md | 5 +++-- 3 files changed, 29 insertions(+), 4 deletions(-) diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md index 907df7e2f..38cfc6f3c 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md @@ -56,7 +56,11 @@ ACTORS exposes these facts only through implementation remains private to ACTORS. CON consumes that injected public port. AUTH may register/provision the closed identity through existing public composition surfaces, but AUTH must not import the ACTORS implementation or -create an AUTH-to-ACTORS domain adapter. +create an AUTH-to-ACTORS domain adapter. ACTORS also exposes the closed +`ServiceIdentity` vocabulary and immutable identity collections through +`app.modules.actors.api`; AUTH catalogue, request-schema, provisioning, and API +composition code must import that public contract rather than +`app.modules.actors.service_identities`. PROJECTS independently locks the exact project and validates only PROJECTS-owned binding eligibility through @@ -72,6 +76,7 @@ transaction. ```text backend/app/modules/actors/service_identities.py +backend/app/modules/actors/api/service_identities.py backend/app/modules/actors/models.py (constraint parity only) backend/app/modules/actors/compensation_adapter.py backend/app/modules/actors/api/compensation_adapter.py (fact/port parity only) @@ -105,7 +110,9 @@ backend/scripts/run_test_lanes.py .ci/behavior-ownership/partition.v1.json .ci/behavior-ownership/actors/compensation-adapter-eligibility.json .ci/behavior-ownership/projects/compensation-binding-eligibility.json +.ci/module-boundaries/private-edge-debt.v1.json (remove only the corrected three AUTH-module edges and API-composition edge to ACTORS service identities) .agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json (generated parity only) +.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/IMPORT_LEDGER.md (remove only the corrected three AUTH-module service-identity entries; it does not inventory API composition) .agent-loop/CURRENT_STATE.md .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md @@ -164,6 +171,18 @@ compatibility support for old identities or deployed rows - [ ] ACTORS exposes and CP02/CON consumes only the immutable public `CompensationAdapterActorEligibilityPort`; AUTH and CON import no ACTORS private model, repository, service, or concrete adapter. +- [ ] ACTORS exposes `ServiceIdentity`, `SERVICE_IDENTITIES`, and any required + immutable closed-identity values through `app.modules.actors.api` without + duplicating or translating the vocabulary. AUTH `catalogue.py`, + `service_actor_schemas.py`, `service_actor_service.py`, and API composition + `app/api/deps/authorization.py` consume only that public API and have no + direct `actors.service_identities` import. +- [ ] The module-boundary debt ledger and human-readable import ledger remove + exactly their respective corrected private edges: the machine ledger + removes the three AUTH-module edges plus the API-composition edge, while + the AUTH outbound ledger removes only its three inventoried AUTH-module + entries. CP03A adds no new private edge and does not claim unrelated + existing AUTH-to-ACTORS debt as repaired. - [ ] PROJECTS locks and validates only the exact project's PROJECTS-owned binding eligibility through the immutable public `ProjectCompensationBindingEligibilityPort`; absent, ineligible, and @@ -191,6 +210,7 @@ compatibility support for old identities or deployed rows (cd backend && .venv/bin/python -m pytest -q tests/test_authorization.py -k "service_actor or service_identity or service_action_matrix") (cd backend && .venv/bin/python -m scripts.test_structure_boundary validate --policy ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_POLICY.md --ledger ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json) (cd backend && .venv/bin/python -m scripts.module_boundaries validate --protected-base origin/main) +! rg -n "app\.modules\.actors\.service_identities" backend/app/modules/authorization/catalogue.py backend/app/modules/authorization/service_actor_schemas.py backend/app/modules/authorization/service_actor_service.py backend/app/api/deps/authorization.py python3 scripts/check_stale_authorization_docs.py python3 scripts/check_chunk_state_sync.py --base-ref origin/main python3 scripts/check_markdown_links.py diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md index a19cee759..ba738f8c2 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md @@ -37,6 +37,10 @@ AUTH read/PREP machinery and activates only read/create/suspend/resume. public owner APIs consumed by injected CON ports; AUTH imports neither owner implementation, PROJECTS interprets no CON lifecycle state, and CON alone decides which lifecycle operations require the ports. +- Required ACTORS to expose its unchanged closed `ServiceIdentity` contract + through `actors.api`, moved the three CP03A-touched AUTH consumers and the + touched API-composition consumer to that public surface, and scoped each + boundary ledger to retire exactly the edges it inventories. - Defined a target-only identity that cannot enter the service action matrix. - Added exact migration, reset fingerprint, fixed-baseline, provisioning, and downgrade-refusal proof for CP03A. @@ -54,7 +58,7 @@ AUTH read/PREP machinery and activates only read/create/suspend/resume. | Track | Result | Remaining blocker | |---|---|---| -| Architecture / senior engineering | pass after exact-head public-owner-boundary correction | none | +| Architecture / senior engineering | pass after closed-identity public-API and exact-ledger correction | none | | Security / authorization | pass with low evidence-cleanup risk resolved in this document | none | | Product / operations | pass | none | | Reuse / QA / test delta | pass | none | diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md index b94bfa8b2..ec1ff85a8 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md @@ -52,8 +52,9 @@ were corrected. The detailed dispositions are in ## Human review focus Confirm the linear CP03A-before-CP03B dependency, target-only identity with no -matrix authority, owner-module lock custody, exact Finance Authority principal, -no public route, and complete exclusion of adjacent compensation behavior. +matrix authority, ACTORS-owned public identity contracts with no AUTH private +import, owner-module lock custody, exact Finance Authority principal, no public +route, and complete exclusion of adjacent compensation behavior. Only an authorized human may merge the planning PR. CP03A implementation must not start until this plan merges. From 5d928fa9bb3cd97afbd545e97409a874ecd58779 Mon Sep 17 00:00:00 2001 From: Abiorh001 Date: Sat, 15 Aug 2026 15:51:52 +0100 Subject: [PATCH 7/7] fix(plan): reconcile review findings --- .../RISKS.md | 2 +- .../STATUS.md | 10 ++++----- .../WS-ARCH-001-CP03A-owner-eligibility.md | 16 ++++++++------ ...-ARCH-001-CP03B-auth-binding-activation.md | 11 +++++++++- .../WS-ARCH-001-CP03-plan-review-evidence.md | 21 ++++++++++--------- .../WS-ARCH-001-CP03-pr-trust-bundle.md | 2 ++ .../AUTHORIZATION_HANDOFF.md | 4 +++- .../CONFORMANCE_MATRIX.md | 4 ++-- docs/roadmap_status.md | 5 +++-- docs/spec_authorization_service.md | 3 ++- docs/spec_contribution_compensation.md | 5 +++-- 11 files changed, 52 insertions(+), 31 deletions(-) diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md index 23ab8171d..4e0828277 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md @@ -25,7 +25,7 @@ | Review decision commits without mandatory contribution consequences | Critical | Stable REV schema precedes CON-03C/07; every decision atomically creates reviewer ContributionRecord/awards and accept additionally creates FinalAcceptance plus submitter record/awards | | Composition root absorbs domain decisions | High | Composition opens the unit of work and wires transaction-bound ports only; TASK command owns Submission sequencing and each target port enforces its own invariants | | Policy behavior starts before exact AUTH registration | Critical | CP01A and CP01B register their separate typed unavailable authority before CP02/CP04 behavior; CP03B/CP05 activate only after their hidden proof and exact prerequisites | -| Binding management inherits retirement, fulfillment, callback, or delivery authority | Critical | CP01A through CP03 exclude retirement actions plus fulfillment, callback, and delivery action IDs, permissions, identities, routes, evaluators, and service-matrix rows entirely | +| Binding management inherits retirement, fulfillment, callback, or delivery authority | Critical | CP01A through CP03 exclude all action-bearing identities and authority for retirement, fulfillment, callback, and delivery; CP03A adds only the closed target-only `workstream.compensation.adapter` identity with no action, permission, route, evaluator, or service-matrix row | | CON writes PROJECT or TASK aggregates | Critical | CP06 returns immutable validation facts only; CP07 and CP08 own their respective writes | | Consolidated v0.1 schema gains fake compatibility debt | High | CP09 performs a clean current-baseline cut and forbids aliases, dual paths, and invented backfills | | Legacy debt becomes a blanket blocker for v0.1 delivery | High | Block new debt and require directly touched debt to shrink; never require unrelated frozen debt in a bounded feature PR | diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md index 3c9aba842..ebaafd027 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md @@ -79,11 +79,11 @@ match exact binding identity and lifecycle generation without a unit alias. - WS-ARCH-001-CP02 is complete on merge: hidden, route-unreachable adapter-binding behavior while its AUTH actions remain unavailable. -- WS-ARCH-001-CP03 is a planned split/non-executable parent. CP03A's executable contract first - installs the closed compensation-adapter target identity and PROJECTS/ACTORS - owner eligibility while actions remain unavailable. CP03B's executable - contract then installs and proves exact Finance Authority activation without - adding a route or adjacent compensation authority. +- WS-ARCH-001-CP03 is a planned split/non-executable parent. CP03A's executable + contract specifies the closed compensation-adapter target identity and + PROJECTS/ACTORS owner eligibility while actions remain unavailable. CP03B's + executable contract specifies and requires proof of exact Finance Authority + activation without adding a route or adjacent compensation authority. - WS-ARCH-001-CP03A is planned with an executable implementation contract. - WS-ARCH-001-CP03B is planned with an executable implementation contract after merged CP03A. diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md index 38cfc6f3c..3898d3436 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md @@ -110,7 +110,7 @@ backend/scripts/run_test_lanes.py .ci/behavior-ownership/partition.v1.json .ci/behavior-ownership/actors/compensation-adapter-eligibility.json .ci/behavior-ownership/projects/compensation-binding-eligibility.json -.ci/module-boundaries/private-edge-debt.v1.json (remove only the corrected three AUTH-module edges and API-composition edge to ACTORS service identities) +.ci/module-boundaries/private-edge-debt.v1.json (remove only its corrected API-composition edge to ACTORS service identities) .agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json (generated parity only) .agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/IMPORT_LEDGER.md (remove only the corrected three AUTH-module service-identity entries; it does not inventory API composition) .agent-loop/CURRENT_STATE.md @@ -179,10 +179,10 @@ compatibility support for old identities or deployed rows direct `actors.service_identities` import. - [ ] The module-boundary debt ledger and human-readable import ledger remove exactly their respective corrected private edges: the machine ledger - removes the three AUTH-module edges plus the API-composition edge, while - the AUTH outbound ledger removes only its three inventoried AUTH-module - entries. CP03A adds no new private edge and does not claim unrelated - existing AUTH-to-ACTORS debt as repaired. + removes its one inventoried API-composition edge, while the AUTH outbound + ledger removes its three inventoried AUTH-module entries. CP03A adds no + new private edge and does not claim unrelated existing AUTH-to-ACTORS + debt as repaired. - [ ] PROJECTS locks and validates only the exact project's PROJECTS-owned binding eligibility through the immutable public `ProjectCompensationBindingEligibilityPort`; absent, ineligible, and @@ -204,7 +204,7 @@ compatibility support for old identities or deployed rows ## Verification commands ```bash -(cd backend && .venv/bin/python -m ruff check app/modules/actors/service_identities.py app/modules/actors/compensation_adapter.py app/modules/projects/compensation_binding.py app/modules/authorization/catalogue.py tests/actors/test_compensation_adapter_eligibility.py tests/projects/test_compensation_binding_eligibility.py tests/compensation/test_adapter_binding_owner_fences.py tests/test_auth.py tests/test_authorization.py tests/test_alembic.py tests/test_database_reset.py) +(cd backend && .venv/bin/python -m ruff check app/modules/actors/service_identities.py app/modules/actors/api/service_identities.py app/modules/actors/models.py app/modules/actors/compensation_adapter.py app/modules/actors/api/compensation_adapter.py app/modules/actors/api/__init__.py app/modules/projects/compensation_binding.py app/modules/projects/api/compensation_binding.py app/modules/projects/api/__init__.py app/modules/authorization/service_actor_schemas.py app/modules/authorization/service_actor_service.py app/modules/authorization/catalogue.py app/modules/compensation/service.py app/api/deps/authorization.py app/main.py alembic/env.py alembic/versions/0005_compensation_adapter_identity.py scripts/behavior_ownership.py scripts/run_test_lanes.py tests/actors/test_compensation_adapter_eligibility.py tests/projects/test_compensation_binding_eligibility.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_authorization_integration.py tests/test_auth.py tests/test_authorization.py tests/test_alembic.py tests/test_database_reset.py tests/conftest.py) (cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/actors/test_compensation_adapter_eligibility.py tests/projects/test_compensation_binding_eligibility.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_authorization_integration.py tests/test_alembic.py tests/test_database_reset.py --cov=app.modules.actors.compensation_adapter --cov=app.modules.projects.compensation_binding --cov-fail-under=90) (cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/test_auth.py -k service_actor) (cd backend && .venv/bin/python -m pytest -q tests/test_authorization.py -k "service_actor or service_identity or service_action_matrix") @@ -212,6 +212,7 @@ compatibility support for old identities or deployed rows (cd backend && .venv/bin/python -m scripts.module_boundaries validate --protected-base origin/main) ! rg -n "app\.modules\.actors\.service_identities" backend/app/modules/authorization/catalogue.py backend/app/modules/authorization/service_actor_schemas.py backend/app/modules/authorization/service_actor_service.py backend/app/api/deps/authorization.py python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_stale_workstream_wording.py python3 scripts/check_chunk_state_sync.py --base-ref origin/main python3 scripts/check_markdown_links.py git diff --check @@ -221,6 +222,9 @@ gh pr checks --watch Hosted GitHub Actions owns the full PostgreSQL matrix and repository coverage. The local machine must not run the full suite. +Sub-agent session closure is verified by the executing agent at completion; it +is orchestration state, not a repository command. + ## Required reviewers Architecture, security/auth, product/operations, QA, test delta, CI integrity, diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md index 2cbcb959a..4315e66dc 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03B-auth-binding-activation.md @@ -266,11 +266,12 @@ Project Manager, Operator, Access Administrator, Audit Authority, project-role, ## Verification commands ```bash -(cd backend && .venv/bin/python -m ruff check app/modules/authorization/api/adapter_bindings.py app/modules/authorization/runtime.py app/modules/authorization/domain/adapter_bindings.py app/modules/authorization/domain/prepared_adapter_bindings.py app/modules/authorization/adapter_binding_authorization.py app/adapters/auth/adapter_bindings.py tests/authorization/test_adapter_binding_activation.py tests/authorization/test_adapter_binding_authorization.py tests/compensation/test_adapter_binding_authorization_integration.py tests/compensation/test_adapter_binding_authorization_failures.py tests/compensation/test_adapter_binding_recovery.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_service.py tests/compensation/test_adapter_binding_database_guards.py tests/compensation/test_adapter_binding_persistence.py tests/architecture/test_authorization_boundary.py tests/test_authorization.py tests/test_audit.py) +(cd backend && .venv/bin/python -m ruff check app/modules/authorization/api/adapter_bindings.py app/modules/authorization/api/__init__.py app/modules/authorization/catalogue.py app/modules/authorization/runtime.py app/modules/authorization/prepared.py app/modules/authorization/kernel.py app/modules/authorization/domain/adapter_bindings.py app/modules/authorization/domain/prepared_adapter_bindings.py app/modules/authorization/adapter_binding_authorization.py app/adapters/auth/adapter_bindings.py app/adapters/auth/__init__.py app/api/deps/authorization.py app/main.py app/modules/compensation/api/adapter_bindings.py app/modules/compensation/service.py tests/authorization/test_adapter_binding_activation.py tests/authorization/test_adapter_binding_authorization.py tests/compensation/test_adapter_binding_authorization_integration.py tests/compensation/test_adapter_binding_authorization_failures.py tests/compensation/test_adapter_binding_recovery.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_service.py tests/compensation/test_adapter_binding_database_guards.py tests/compensation/test_adapter_binding_persistence.py tests/architecture/test_authorization_boundary.py tests/test_authorization.py tests/test_audit.py) (cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/authorization/test_adapter_binding_activation.py tests/authorization/test_adapter_binding_authorization.py tests/compensation/test_adapter_binding_authorization_integration.py tests/compensation/test_adapter_binding_authorization_failures.py tests/compensation/test_adapter_binding_recovery.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_service.py tests/compensation/test_adapter_binding_database_guards.py tests/compensation/test_adapter_binding_persistence.py tests/architecture/test_authorization_boundary.py tests/test_authorization.py tests/test_audit.py --cov=app.modules.authorization.adapter_binding_authorization --cov=app.modules.authorization.api.adapter_bindings --cov=app.modules.authorization.domain.adapter_bindings --cov=app.modules.authorization.domain.prepared_adapter_bindings --cov=app.adapters.auth.adapter_bindings --cov-fail-under=90) (cd backend && .venv/bin/python -m scripts.test_structure_boundary validate --policy ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_POLICY.md --ledger ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json) (cd backend && .venv/bin/python -m scripts.module_boundaries validate --protected-base origin/main) python3 scripts/check_stale_authorization_docs.py +python3 scripts/check_stale_workstream_wording.py python3 scripts/check_chunk_state_sync.py --base-ref origin/main python3 scripts/check_markdown_links.py git diff --check @@ -280,6 +281,14 @@ gh pr checks --watch Hosted GitHub Actions owns the full PostgreSQL matrix and repository-wide coverage run. The local machine must not run the full suite. +The focused coverage command measures the materially changed AUTH +adapter/evaluator modules. Existing catalogue, kernel, PREP, package-export, +composition-root, and CON injection files receive exact behavioral assertions +in the listed tests plus GitHub's repository-wide coverage gate; adding those +large parity surfaces to one combined focused percentage would obscure rather +than prove the new boundary. Sub-agent session closure is verified by the +executing agent at completion, not by an invented repository command. + ## Required reviewers - architecture diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md index ba738f8c2..0ea93b97d 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-plan-review-evidence.md @@ -2,7 +2,7 @@ ## Result -Pass after correction. +pass ## Reviewed intent @@ -40,7 +40,8 @@ AUTH read/PREP machinery and activates only read/create/suspend/resume. - Required ACTORS to expose its unchanged closed `ServiceIdentity` contract through `actors.api`, moved the three CP03A-touched AUTH consumers and the touched API-composition consumer to that public surface, and scoped each - boundary ledger to retire exactly the edges it inventories. + boundary ledger to retire exactly the edges it inventories: three in the + AUTH outbound ledger and one composition edge in the machine ledger. - Defined a target-only identity that cannot enter the service action matrix. - Added exact migration, reset fingerprint, fixed-baseline, provisioning, and downgrade-refusal proof for CP03A. @@ -56,14 +57,14 @@ AUTH read/PREP machinery and activates only read/create/suspend/resume. ## Reviewer results -| Track | Result | Remaining blocker | -|---|---|---| -| Architecture / senior engineering | pass after closed-identity public-API and exact-ledger correction | none | -| Security / authorization | pass with low evidence-cleanup risk resolved in this document | none | -| Product / operations | pass | none | -| Reuse / QA / test delta | pass | none | -| CI integrity | pass | none | -| Documentation | pass for current entry points and executable contracts | completed CP02 contract retained as historical exact-change evidence by the atomic-state gate | +| Track | Result | Notes | Remaining blocker | +|---|---|---|---| +| Architecture / senior engineering | pass | Closed-identity public API and exact ledger scope corrected | none | +| Security / authorization | pass | Low evidence-cleanup risk resolved in this document | none | +| Product / operations | pass | — | none | +| Reuse / QA / test delta | pass | — | none | +| CI integrity | pass | — | none | +| Documentation | pass | Current entry points and executable contracts are consistent; completed CP02 remains historical exact-change evidence under the atomic-state gate | none | ## Deterministic evidence diff --git a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md index ec1ff85a8..c2fbe4f8c 100644 --- a/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md +++ b/.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03-pr-trust-bundle.md @@ -44,6 +44,8 @@ coverage commands plus GitHub's full distributed backend suite. ## Reviewer result +Result: `pass`. + Architecture, security, product/operations, reuse/QA/test-delta, CI-integrity, senior-engineering, and documentation plan reviews passed after the contracts were corrected. The detailed dispositions are in diff --git a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md index e2e40630b..cf3e4f94d 100644 --- a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md +++ b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md @@ -7,7 +7,9 @@ prepared-mutation, project-guide, policy-mutation, and REV-readiness foundations plus merged REV PLAN4, ART foundations, and CP02 hidden CON adapter-binding behavior. The old `0052_legacy_intake_removal` identifier is historical merge evidence. Current main ends at -`0004_compensation_adapter_binding_lifecycle`. CP02's four binding actions +`0004_compensation_adapter_binding_lifecycle`, whose tracked predecessor is +`0003_submission_lineage`. No later numbered migration is part of the active +tracked graph. CP02's four binding actions remain unavailable. CP03 is split: CP03A installs the target identity and owner eligibility while actions stay unavailable; CP03B activates only the four exact Finance Authority boundaries. No public CON route, ContributionPolicy diff --git a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md index 7f7602c8f..68d5c0404 100644 --- a/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md +++ b/.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md @@ -3,9 +3,9 @@ | Family | Owning chunks | Required proof | Final gate | |---|---|---|---| | Canonical policy model | 01,03B,CP04/CP05 | ContributionPolicy/version/rules/definitions; explicit unpaid; immutable publish; one active policy; NUMERIC(38,18) decimal-string bounds; ISO 4217 money units; project-scoped points units; stable binding references | CON-11 | -| Adapter binding | 03A,CP02/CP03A/CP03B,10B | one active binding per project/instrument; exact target identity and owner eligibility; policy definitions and awards reference a binding with matching project/instrument identity while the binding stores no policy/award identifiers; non-secret route; suspend/resume and existing-award callback/replay behavior; retirement refuses active policy, unfinished frozen work, or unfulfilled award dependencies | CON-11 + joint live drill | +| Adapter binding | 03A,CP02/CP03A/CP03B,03D/08B,10B | CP02 proves the four hidden read/create/suspend/resume behaviors; CP03A proves exact target identity and owner eligibility; CP03B owns only exact human Finance Authority activation proof for those four actions; policy definitions and awards reference matching project/instrument identity while the binding stores no policy/award identifiers; 03D/08B own existing-award callback/replay proof; 10B owns retirement refusal for active policy, unfinished frozen work, or unfulfilled award dependencies | CON-11 + joint live drill | | Legacy clean cut | CP09 after WS-ARCH-001-03C activation | zero semantic consumers before schema removal; clean current-baseline parity; no alias/fallback/backfill | CON-11 | -| Authorization | AUTH + each feature | current AUTH actor/grant/fixed-service/PREP and REV-readiness foundations, with current repository migrations through ART-owned `0050`; provisioning grants no service execution; CON mappings, identities, and static rows are absent on current main; every future artifact requires exact AUTH-owned registration and activation evidence, exact grant/static row, fixed-service admission, prepared handle bound to session/action/actor-ref/idempotency/request digest with substitution non-consumption, planned denial, and no local role logic | AUTH activation + CON-11 | +| Authorization | AUTH + each feature | current AUTH actor/grant/fixed-service/PREP and REV-readiness foundations, with the active tracked migration graph through `0004_compensation_adapter_binding_lifecycle` (`0003_submission_lineage` predecessor); older ART `0050` references are historical pre-baseline evidence, not an active graph head; provisioning grants no service execution; CON mappings, identities, and static rows are absent on current main; every future artifact requires exact AUTH-owned registration and activation evidence, exact grant/static row, fixed-service admission, prepared handle bound to session/action/actor-ref/idempotency/request digest with substitution non-consumption, planned denial, and no local role logic | AUTH activation + CON-11 | | Final acceptance | REV + 03C,07 | accept creates one immutable FinalAcceptance per task/Review/Submission; needs_revision/reject create none; no create API/action, reopen, replacement, or adjudication path | joint live drill | | Contribution cardinality | 03C,07 + REV | one completed_review per valid Review with direct Review/lease lineage; one accepted_submission per FinalAcceptance with assignment lineage; mutually exclusive sources; revision Reviews distinct; automated outcomes create none | joint live drill | | Policy lock and human revision rebase | CP06-CP08, ARCH-03B,07 + PROJECT/TASK/REV | one guide-bound version; exact `WorkstreamTask.locked_contribution_policy_version_id`, `TaskAssignment.submitter_contribution_policy_version_id`, `Submission.contribution_policy_version_id`, and `ReviewLease.reviewer_contribution_policy_version_id` lineage; no claim-time lookup or publication-time drift; human needs_revision keeps/rebases/blocks the complete next-task context atomically and preserves completed history | joint live drill | diff --git a/docs/roadmap_status.md b/docs/roadmap_status.md index 912657fbf..9c0bc6fc3 100644 --- a/docs/roadmap_status.md +++ b/docs/roadmap_status.md @@ -138,8 +138,9 @@ review. Their presence does not change the implemented-on-`main` list above. unavailable binding facts before CP02. CP02 is complete on merge with hidden, route-unreachable adapter-binding behavior and immutable lifecycle history. CP03 is split with executable CP03A/CP03B contracts complete on merge. The - remaining order is CP03A target identity/owner eligibility, CP03B Finance - Authority activation, CP04 hidden ContributionPolicy behavior, + remaining order is CP03A target identity/owner eligibility, CP03B activation + for an authenticated human Finance Authority covering the exact project, + CP04 hidden ContributionPolicy behavior, then CP05 ContributionPolicy activation; expose CON validation; then bind one exact published, complete, binding-valid ContributionPolicyVersion at guide activation, and diff --git a/docs/spec_authorization_service.md b/docs/spec_authorization_service.md index a4ffbb557..0209b9b0d 100644 --- a/docs/spec_authorization_service.md +++ b/docs/spec_authorization_service.md @@ -277,7 +277,8 @@ WS-ARCH-001-CP03 is split after merged CP02 hidden behavior. CP03A adds only the closed target identity `workstream.compensation.adapter` and real PROJECTS/ACTORS eligibility adapters; it adds no service-matrix membership and keeps all four binding actions unavailable. CP03B then installs the exact -Finance Authority read/PREP adapter and activates only those four actions. +read/PREP adapter for an authenticated human Finance Authority covering the +exact project and activates only those four actions. AUTH-10A added five project-role read/manage rows; AUTH-10B owns and activates the three reads, while AUTH-10C owns and activates the two reason-bound, idempotent project-role mutations. AUTH-11A adds eleven diff --git a/docs/spec_contribution_compensation.md b/docs/spec_contribution_compensation.md index 2851d9ee2..697bc3ede 100644 --- a/docs/spec_contribution_compensation.md +++ b/docs/spec_contribution_compensation.md @@ -786,8 +786,9 @@ the closed target-only `workstream.compensation.adapter` service identity and installs PROJECTS/ACTORS owner-held eligibility adapters; it grants that target no action or service-matrix membership, and all four binding actions remain unavailable. CP03B then installs the AUTH read/PREP adapter and activates only -the four exact Finance Authority binding actions. Neither child adds a public -route, provider behavior, or ContributionPolicy authority. +the four exact binding actions for an authenticated human Finance Authority +covering the exact project. Neither child adds a public route, provider +behavior, or ContributionPolicy authority. | ActionId | PermissionId | Principal / target | Protocol | Feature owner | |---|---|---|---:|---|