WS-ARCH-001-CP03A: install adapter target owner eligibility

.agent-loop/CURRENT_STATE.md

@@ -28,10 +28,10 @@ authority; these records do not grant or withhold it.
 
 | Initiative | Durable state on `main` | Remaining boundary |
 |---|---|---|
-| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H`; CP01A-CP02 establish unavailable authority facts and hidden CON adapter-binding behavior; CP03 is split with executable CP03A/CP03B contracts complete on merge; PLAN4 planned incremental debt retirement | Implement CP03A owner identity/eligibility, then CP03B exact Finance Authority activation; PLAN4 keeps debt retirement delivery-coupled without blocking features on unrelated frozen debt; the wider PLAN2 path still targets durable `allow_review`, and `02I` remains later |
+| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H`; CP01A-CP02 establish unavailable authority facts and hidden CON adapter-binding behavior; PLAN4 planned incremental debt retirement | CP03A is complete on merge with exact target identity and owner eligibility; after that merge, implement CP03B exact Finance Authority activation; PLAN4 keeps debt retirement delivery-coupled without blocking features on unrelated frozen debt; the wider PLAN2 path still targets durable `allow_review`, and `02I` remains later |
 | [WS-ART-001](initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md) | Active delivery initiative; verified ready-admission publication, hidden preparation, consumption and binding are merged through ARCH-02H | Implement exact post-submit materialization only after the unified guide/checker and PLAN2 public contracts are executable; live cutover remains later |
 | [WS-AUTH-001](initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md) | Active delivery initiative; project-policy authority and unified compilation authorization are merged through `12I` | POL-03B consumes 12I next; remaining AUTH activation chunks wait for their exact hidden owner behavior |
-| [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; CP02 is merged with hidden adapter-binding lifecycle behavior; CP03 is split with executable CP03A/CP03B contracts complete on merge; ContributionPolicy persistence, shared lifecycle audit, and unavailable AUTH registrations are merged | Implement CP03A target identity/owner eligibility, then CP03B exact Finance Authority activation; later complete guide-activation validation/persistence before task readiness, preserving immutable attempt lineage through Submission and ReviewLease |
+| [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; CP02 hidden adapter-binding behavior, ContributionPolicy persistence, shared lifecycle audit, and unavailable AUTH registrations are merged | CP03A target identity and owner eligibility are complete on merge; after that merge, implement CP03B exact Finance Authority activation; later complete guide-activation validation/persistence before task readiness, preserving immutable attempt lineage through Submission and ReviewLease |
 | [WS-AUTH-003](initiatives/WS-AUTH-003-module-boundary-recovery/STATUS.md) | AUTH boundary foundation and first public-capability proof through POL-03A are merged | Repair each touched AUTH capability through `authorization.api` and shrink the canonical AUTH ledger |
 | [WS-POL-003](initiatives/WS-POL-003-unified-project-guide-compilation/STATUS.md) | Active delivery initiative; hidden compilation custody and AUTH-12I activation are merged | Implement POL-03B authorized compilation persistence, then continue the reviewed dependency order |
 | [WS-REV-001](initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md) | Independent foundations through queue admission and reviewer-lease persistence are merged through `03A2`; schema/packet foundations may continue behind their own gates | Live admission/claim requires canonical 04E `allow_review`; ReviewLease copies the admitted Submission's immutable attempt policy version, and the first Review commit requires CON-03C/07 atomic contribution/award behavior |
@@ -116,7 +116,8 @@ non-executable until their current-main contracts are expanded.
   exact lifecycle history, and deny-default production composition.
 - WS-ARCH-001-CP03 is a planned split/non-executable parent. CP03A and CP03B have executable
   contracts complete on merge and are the next ordered bounded boundaries.
-- WS-ARCH-001-CP03A is planned with an executable implementation contract.
+- WS-ARCH-001-CP03A is complete on merge with exact target identity and owner
+  eligibility while all four actions remain unavailable.
 - WS-ARCH-001-CP03B is planned with an executable implementation contract after
   merged CP03A.
 - WS-ARCH-001-CP04 is proposed and non-executable.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md

@@ -23,7 +23,7 @@
 | `WS-ARCH-001-CP01C` | AUTH adapter-binding fact correction | L1 | Complete on merge; corrects unavailable facts before CON behavior |
 | `WS-ARCH-001-CP02` | CON hidden adapter-binding behavior | L1 | Complete on merge; route-unreachable and deny-default while actions remain unavailable |
 | `WS-ARCH-001-CP03` | Adapter-binding activation coordination parent | L1 | Planned split into CP03A/CP03B; non-executable |
-| `WS-ARCH-001-CP03A` | Closed adapter target identity and PROJECTS/ACTORS owner eligibility | L1 | Planned executable contract; implementation next |
+| `WS-ARCH-001-CP03A` | Closed adapter target identity and PROJECTS/ACTORS owner eligibility | L1 | Complete on merge; actions remain unavailable |
 | `WS-ARCH-001-CP03B` | AUTH exact Finance Authority adapter-binding activation | L1 | Planned executable contract; follows merged CP03A |
 | `WS-ARCH-001-CP04` | CON hidden ContributionPolicy behavior | L1 | Proposed skeleton after merged CP03B evidence |
 | `WS-ARCH-001-CP05` | AUTH exact ContributionPolicy activation | L1 | Proposed skeleton after CP04 evidence |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md

@@ -79,12 +79,14 @@
   match exact binding identity and lifecycle generation without a unit alias.
 - WS-ARCH-001-CP02 is complete on merge: hidden, route-unreachable
   adapter-binding behavior while its AUTH actions remain unavailable.
-- WS-ARCH-001-CP03 is a planned split/non-executable parent. CP03A's executable
-  contract specifies the closed compensation-adapter target identity and
-  PROJECTS/ACTORS owner eligibility while actions remain unavailable. CP03B's
-  executable contract specifies and requires proof of exact Finance Authority
-  activation without adding a route or adjacent compensation authority.
-- WS-ARCH-001-CP03A is planned with an executable implementation contract.
+- WS-ARCH-001-CP03 is a planned split/non-executable parent. CP03A implements
+  the closed compensation-adapter target identity and PROJECTS/ACTORS owner
+  eligibility while actions remain unavailable. CP03B's executable contract
+  specifies and requires proof of exact Finance Authority activation without
+  adding a route or adjacent compensation authority.
+- WS-ARCH-001-CP03A is complete on merge: the closed target-only identity and
+  PROJECTS/ACTORS owner eligibility are implemented while all binding actions
+  remain unavailable.
 - WS-ARCH-001-CP03B is planned with an executable implementation contract after
   merged CP03A.
 - WS-ARCH-001-CP04 is proposed: hidden ContributionPolicy behavior.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP03A-owner-eligibility.md

@@ -2,8 +2,8 @@
 
 ## Merge state
 
-- Outcome on merge: `planned`
-- Future implementation target: complete while binding actions remain unavailable.
+- Outcome on merge: `complete`
+- Binding actions remain unavailable; CP03B is the next activation boundary.
 
 ## Parent initiative
 
@@ -87,6 +87,7 @@ backend/app/modules/projects/api/__init__.py
 backend/app/modules/authorization/service_actor_schemas.py (closed identity parity only)
 backend/app/modules/authorization/service_actor_service.py (provisioning admission parity only)
 backend/app/modules/authorization/catalogue.py (separate target-only identities from action-bearing fixed services)
+backend/app/modules/authorization/kernel.py (target-only service identity fail-closed lookup only)
 backend/app/modules/compensation/service.py (owner-adapter injection only)
 backend/app/api/deps/authorization.py (composition only; no route)
 backend/app/main.py (composition only; no route)
@@ -98,7 +99,11 @@ backend/tests/compensation/test_adapter_binding_owner_fences.py
 backend/tests/compensation/test_adapter_binding_authorization_integration.py
 backend/tests/test_auth.py (controlled provisioning parity only)
 backend/tests/test_authorization.py (closed identity/matrix separation only)
+backend/tests/authorization/test_adapter_binding_registration.py (target-only kernel denial only)
+backend/tests/authorization/guide_compilation/test_migration_contract.py (current-head parity only)
+backend/tests/projects/guide_compilation/test_migration_contract.py (current-head parity only)
 backend/tests/test_alembic.py
+backend/tests/migrations/test_compensation_adapter_identity.py
 backend/tests/test_database_reset.py
 backend/tests/conftest.py (exact current-schema fingerprint/reset parity only)
 backend/alembic/baseline/v01_approved_manifest_delta.json (generated current-head parity only; do not rewrite 0001)
@@ -108,8 +113,8 @@ backend/alembic/baseline/v01_schema.sql (generated current-head parity only; do
 backend/scripts/behavior_ownership.py
 backend/scripts/run_test_lanes.py
 .ci/behavior-ownership/partition.v1.json
-.ci/behavior-ownership/actors/compensation-adapter-eligibility.json
-.ci/behavior-ownership/projects/compensation-binding-eligibility.json
+.ci/behavior-ownership/shared/compensation-adapter-eligibility.json
+.ci/behavior-ownership/lifecycle/compensation-binding-eligibility.json
 .ci/module-boundaries/private-edge-debt.v1.json (remove only its corrected API-composition edge to ACTORS service identities)
 .agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json (generated parity only)
 .agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/IMPORT_LEDGER.md (remove only the corrected three AUTH-module service-identity entries; it does not inventory API composition)
@@ -128,6 +133,7 @@ backend/scripts/run_test_lanes.py
 .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md
 .agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md
 .agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md
+.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md
 .agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md
 docs/architecture_data_model.md
 docs/spec_authorization_service.md
@@ -158,6 +164,10 @@ compatibility support for old identities or deployed rows
       identities are explicit separate sets. The target identity belongs only
       to the former; catalogue import succeeds without an empty or invented
       matrix row, and runtime service-action admission rejects it.
+- [ ] Every AUTH kernel service-matrix lookup treats a closed target-only
+      identity with no matrix row as permission-not-granted; it never raises a
+      missing-key exception or creates denial/allowed evidence outside the
+      existing canonical decision path.
 - [ ] Migration `0005_compensation_adapter_identity` updates only the closed
       ActorProfile service-identity constraint and refuses downgrade without
       mutation when the new identity is referenced.
@@ -204,8 +214,8 @@ compatibility support for old identities or deployed rows
 ## Verification commands
 
 ```bash
-(cd backend && .venv/bin/python -m ruff check app/modules/actors/service_identities.py app/modules/actors/api/service_identities.py app/modules/actors/models.py app/modules/actors/compensation_adapter.py app/modules/actors/api/compensation_adapter.py app/modules/actors/api/__init__.py app/modules/projects/compensation_binding.py app/modules/projects/api/compensation_binding.py app/modules/projects/api/__init__.py app/modules/authorization/service_actor_schemas.py app/modules/authorization/service_actor_service.py app/modules/authorization/catalogue.py app/modules/compensation/service.py app/api/deps/authorization.py app/main.py alembic/env.py alembic/versions/0005_compensation_adapter_identity.py scripts/behavior_ownership.py scripts/run_test_lanes.py tests/actors/test_compensation_adapter_eligibility.py tests/projects/test_compensation_binding_eligibility.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_authorization_integration.py tests/test_auth.py tests/test_authorization.py tests/test_alembic.py tests/test_database_reset.py tests/conftest.py)
-(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/actors/test_compensation_adapter_eligibility.py tests/projects/test_compensation_binding_eligibility.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_authorization_integration.py tests/test_alembic.py tests/test_database_reset.py --cov=app.modules.actors.compensation_adapter --cov=app.modules.projects.compensation_binding --cov-fail-under=90)
+(cd backend && .venv/bin/python -m ruff check app/modules/actors/service_identities.py app/modules/actors/api/service_identities.py app/modules/actors/models.py app/modules/actors/compensation_adapter.py app/modules/actors/api/compensation_adapter.py app/modules/actors/api/__init__.py app/modules/projects/compensation_binding.py app/modules/projects/api/compensation_binding.py app/modules/projects/api/__init__.py app/modules/authorization/service_actor_schemas.py app/modules/authorization/service_actor_service.py app/modules/authorization/catalogue.py app/modules/authorization/kernel.py app/modules/compensation/service.py app/api/deps/authorization.py app/main.py alembic/env.py alembic/versions/0005_compensation_adapter_identity.py scripts/behavior_ownership.py scripts/run_test_lanes.py tests/actors/test_compensation_adapter_eligibility.py tests/projects/test_compensation_binding_eligibility.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_authorization_integration.py tests/migrations/test_compensation_adapter_identity.py tests/authorization/test_adapter_binding_registration.py tests/test_auth.py tests/test_authorization.py tests/test_alembic.py tests/test_database_reset.py tests/conftest.py)
+(cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/actors/test_compensation_adapter_eligibility.py tests/projects/test_compensation_binding_eligibility.py tests/compensation/test_adapter_binding_owner_fences.py tests/compensation/test_adapter_binding_authorization_integration.py tests/migrations/test_compensation_adapter_identity.py tests/test_alembic.py tests/test_database_reset.py --cov=app.modules.actors.compensation_adapter --cov=app.modules.projects.compensation_binding --cov-fail-under=90)
 (cd backend && export WORKSTREAM_TEST_DATABASE_URL="${WORKSTREAM_TEST_DATABASE_URL:?set WORKSTREAM_TEST_DATABASE_URL}" && .venv/bin/python -m pytest -q tests/test_auth.py -k service_actor)
 (cd backend && .venv/bin/python -m pytest -q tests/test_authorization.py -k "service_actor or service_identity or service_action_matrix")
 (cd backend && .venv/bin/python -m scripts.test_structure_boundary validate --policy ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_POLICY.md --ledger ../.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json)

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03A-external-review-response.md

@@ -0,0 +1,32 @@
+# WS-ARCH-001-CP03A External Review Response
+
+## Comments addressed
+
+- CodeRabbit's current-state finding was valid. CP03A is now described as
+  complete on merge in the remaining boundary, not as durable behavior already
+  present on `main`.
+- CodeRabbit's migration-head finding was valid. Current `main` remains scoped
+  to `0004_compensation_adapter_binding_lifecycle` until CP03A merges, while the
+  CP03A branch advances the graph to `0005_compensation_adapter_identity` on
+  merge. Historical `0050`, `0053`, and `0055` identifiers are not active graph
+  heads.
+
+## Comments deferred
+
+None.
+
+## Human decisions needed
+
+None beyond the repository-required approval and merge decision.
+
+## Commands rerun
+
+- `python3 scripts/check_stale_workstream_wording.py`
+- `python3 scripts/check_stale_authorization_docs.py`
+- `python3 scripts/check_markdown_links.py`
+- `python3 scripts/check_chunk_state_sync.py`
+- `git diff --check`
+
+## Remaining risks
+
+None introduced by these documentation-only merge-awareness corrections.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/reviews/WS-ARCH-001-CP03A-implementation-review-evidence.md

@@ -0,0 +1,53 @@
+# WS-ARCH-001-CP03A Implementation Review Evidence
+
+## Scope reviewed
+
+The complete CP03A implementation: ACTORS-owned closed identity vocabulary and
+adapter eligibility, PROJECTS-owned project eligibility, target-only AUTH
+matrix handling, migration `0005`, focused PostgreSQL and unit proof, boundary
+ledgers, semantic-lane ownership, and canonical state/documentation updates.
+
+## Deterministic evidence
+
+- touched-code Ruff: pass;
+- 32 focused ACTORS/PROJECTS/kernel tests: pass;
+- 11 focused service identity/matrix tests: pass;
+- isolated PostgreSQL migration, real owner-fence, committed-ineligibility,
+  identity-link revocation, and controlled provisioning proof: pass;
+- canonical semantic-lane collection: pass;
+- module-boundary, behavior-ownership, and test-structure gates: pass;
+- stale authorization/workstream wording, Markdown links, chunk-state sync,
+  and diff checks: pass.
+
+GitHub Actions owns the complete PostgreSQL matrix and repository coverage. The
+local machine does not run the full suite.
+
+## Findings fixed
+
+Review found and fixed the migration naming-convention expansion, stale schema
+fingerprint, missing semantic-lane assignments, missing referenced-identity
+downgrade proof, incomplete real owner-lock evidence, missing controlled target
+provisioning proof, missing exact identity-link race proof, stale wording, and
+one allowed-file mismatch. No CI threshold, test selection, action availability,
+or authorization rule was weakened.
+
+## Internal review disposition
+
+- Architecture: pass with low transitional re-export risk.
+- Security/authorization: pass after real profile/link/project fence proof.
+- Product/operations: pass; the target is not the Finance Authority caller.
+- QA: pass after migration, fingerprint, scope, and PostgreSQL corrections.
+- Test delta: pass; no skip, xfail, removal, or assertion weakening.
+- CI integrity: pass after semantic-lane reconciliation.
+- Senior engineering: pass after stale wording and real-fence correction.
+- Reuse/dedup: pass with low intra-PROJECTS query reuse risk.
+- Documentation: pass after canonical action-bearing/target-only identity
+  wording and state reconciliation.
+
+## Residual risk
+
+`app.modules.actors.service_identities` remains a transitional private
+re-export for untouched frozen imports. New and touched consumers must use
+`app.modules.actors.api`. CP03B must add the real AUTH read/PREP composition and
+activate only the four Finance Authority binding actions; CP03A grants no
+action to the adapter target.