Plan bounded ContributionPolicy behavior

.agent-loop/CURRENT_STATE.md

@@ -28,10 +28,10 @@ authority; these records do not grant or withhold it.
 
 | Initiative | Durable state on `main` | Remaining boundary |
 |---|---|---|
-| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H`; CP01A-CP03B establish hidden CON adapter-binding behavior and exact Finance Authority activation; PLAN4 continues incremental debt retirement | Prepare CP04's executable hidden ContributionPolicy behavior contract; PLAN4 keeps debt retirement delivery-coupled without blocking features on unrelated frozen debt; the wider PLAN2 path still targets durable `allow_review`, and `02I` remains later |
+| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H`; CP01A-CP03B establish hidden CON adapter-binding behavior and exact Finance Authority activation; CP04 is split into executable contracts | Implement CP04A hidden ContributionPolicy read/create/update-draft behavior; CP04B then owns publish/retire, and the wider PLAN2 path still targets durable `allow_review` |
 | [WS-ART-001](initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md) | Active delivery initiative; verified ready-admission publication, hidden preparation, consumption and binding are merged through ARCH-02H | Implement exact post-submit materialization only after the unified guide/checker and PLAN2 public contracts are executable; live cutover remains later |
 | [WS-AUTH-001](initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md) | Active delivery initiative; project-policy authority and unified compilation authorization are merged through `12I` | POL-03B consumes 12I next; remaining AUTH activation chunks wait for their exact hidden owner behavior |
-| [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; CP03B completes hidden adapter-binding behavior and exact Finance Authority activation; ContributionPolicy persistence and shared lifecycle audit foundations are merged | Prepare CP04 hidden ContributionPolicy behavior; later complete guide-activation validation/persistence before task readiness, preserving immutable attempt lineage through Submission and ReviewLease |
+| [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; CP03B completes hidden adapter-binding behavior and exact Finance Authority activation; ContributionPolicy persistence and shared lifecycle audit foundations are merged | Implement CP04A hidden policy draft behavior, then CP04B publication/retirement; later complete guide-activation validation/persistence before task readiness |
 | [WS-AUTH-003](initiatives/WS-AUTH-003-module-boundary-recovery/STATUS.md) | AUTH boundary foundation and first public-capability proof through POL-03A are merged | Repair each touched AUTH capability through `authorization.api` and shrink the canonical AUTH ledger |
 | [WS-POL-003](initiatives/WS-POL-003-unified-project-guide-compilation/STATUS.md) | Active delivery initiative; hidden compilation custody and AUTH-12I activation are merged | Implement POL-03B authorized compilation persistence, then continue the reviewed dependency order |
 | [WS-REV-001](initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md) | Independent foundations through queue admission and reviewer-lease persistence are merged through `03A2`; schema/packet foundations may continue behind their own gates | Live admission/claim requires canonical 04E `allow_review`; ReviewLease copies the admitted Submission's immutable attempt policy version, and the first Review commit requires CON-03C/07 atomic contribution/award behavior |
@@ -101,8 +101,8 @@ AUTH unavailable registration, hidden CON binding/policy behavior, exact AUTH
 activations, CON validation, PROJECT guide binding, TASK attempt lineage, and
 clean v0.1 legacy economic-path removal in that order. CP02 and CP03A are
 merged, and CP03B is complete with the four exact hidden Finance Authority
-actions active. Later CP04-CP09 children remain
-non-executable until their current-main contracts are expanded.
+actions active. CP04A/CP04B now have executable contracts; later CP05-CP09
+remain non-executable until their current-main contracts are expanded.
 
 - WS-ARCH-001-PLAN3 is planned; its planning merge changed no runtime behavior.
 - WS-ARCH-001-CP01 is a planned split and non-executable.
@@ -123,7 +123,10 @@ non-executable until their current-main contracts are expanded.
   consume the public AUTH API and same-owner private wiring is confined to the
   exact AUTH adapter root. No compensation delivery or fulfillment behavior is
   activated.
-- WS-ARCH-001-CP04 is proposed and non-executable.
+- WS-ARCH-001-CP04 is a planned non-executable parent. CP04A and CP04B have
+  executable contracts; CP04A is the next implementation boundary.
+- WS-ARCH-001-CP04A is planned and is the next hidden policy-draft boundary.
+- WS-ARCH-001-CP04B is planned after CP04A for hidden publication/retirement.
 - WS-ARCH-001-CP05 is proposed and non-executable.
 - WS-ARCH-001-CP06 is proposed and non-executable.
 - WS-ARCH-001-CP07 is proposed and non-executable.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md

@@ -25,7 +25,9 @@
 | `WS-ARCH-001-CP03` | Adapter-binding activation coordination parent | L1 | Planned split into CP03A/CP03B; non-executable |
 | `WS-ARCH-001-CP03A` | Closed adapter target identity and PROJECTS/ACTORS owner eligibility | L1 | Merged through PR #340; actions remain unavailable |
 | `WS-ARCH-001-CP03B` | AUTH exact Finance Authority adapter-binding activation | L1 | Complete; four exact hidden actions active through public ports, with private wiring confined to the AUTH adapter root |
-| `WS-ARCH-001-CP04` | CON hidden ContributionPolicy behavior | L1 | Proposed skeleton after merged CP03B evidence |
+| `WS-ARCH-001-CP04` | Hidden ContributionPolicy behavior coordination parent | L1 | Planned split into CP04A/CP04B; non-executable |
+| `WS-ARCH-001-CP04A` | CONTRIBUTIONS public API and hidden read/create/update-draft behavior | L1 | Planned executable contract; first CP04 implementation |
+| `WS-ARCH-001-CP04B` | Hidden ContributionPolicy publish/retire behavior | L1 | Planned executable contract after merged CP04A |
 | `WS-ARCH-001-CP05` | AUTH exact ContributionPolicy activation | L1 | Proposed skeleton after CP04 evidence |
 | `WS-ARCH-001-CP06` | CON guide-activation/revision policy-validation port | L1 | Proposed skeleton after CP05 |
 | `WS-ARCH-001-CP07` | PROJECT guide-bound ContributionPolicyVersion persistence | L1 | Proposed skeleton after CP06 |
@@ -52,8 +54,9 @@ feature contract crosses more than one reviewable mutation boundary. The
 02A-02I sequence is the executable split of parent 02, subject to plan review
 and human approval.
 
-CP04-CP09 and chunks 03A-04F are non-executable planning skeletons. Before implementation,
-each must be replaced with a current-main contract that names exact allowed and
+CP04 is a non-executable split parent; CP04A and CP04B are executable contracts.
+CP05-CP09 and chunks 03A-04F are non-executable planning skeletons. Before implementation,
+each remaining skeleton must be replaced with a current-main contract that names exact allowed and
 not-allowed files, migration head, runnable commands, reviewers, and the public
 types it extends. Their sequencing is approved here; their current text does
 not authorize code changes. CP03 is split/non-executable; CP03A and CP03B are

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/DECISIONS.md

@@ -158,3 +158,18 @@ authorization; create/suspend/resume use one domain-specific opaque
 prepare/consume/close port backed by AUTH only in CP03B. CP03A owns the exact
 adapter target identity and PROJECTS/ACTORS eligibility prerequisite. CON never
 imports AUTH internals or translates the CON-owned `instrument_type` value.
+
+## D20: CP04 splits editable drafts from irreversible publication
+
+`app.modules.contributions` owns ContributionPolicy lifecycle truth;
+`app.modules.compensation` owns adapter-binding and instrument identity. CP04A
+introduces the contributions public API, hidden read/create/update-draft
+behavior, and shared mutation recovery. CP04B adds publish and retire after
+CP04A merges. All actions remain unavailable until CP05 and neither child adds
+a route.
+
+Draft updates replace one complete two-rule graph. Publication authorizes only
+the digest recomputed from locked server-owned rows and exact active
+unit/binding facts. Retirement affects future selection without rewriting
+previously frozen lineage. No compatibility or alternate economic-policy path
+is introduced.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/DISCOVERY.md

@@ -202,3 +202,55 @@ remain non-executable until refreshed against current `main`.
   repository evidence requiring a compatibility alias, deployed-history
   backfill, or guessed legacy-row conversion.
 - No open pull request currently owns this sequence.
+
+## CP04 current-main discovery after CP03B
+
+Observations:
+
+- Policy persistence is owned by `app.modules.contributions`, not the
+  adapter-binding `app.modules.compensation` module. The existing policy,
+  version, rule, and award-definition ORM graph has no public contributions
+  API, repository, or lifecycle service.
+- Database guards already enforce complete two-rule publication, explicit
+  unpaid/compensated shapes, immutable published/retired content,
+  project/unit/binding ownership, exact numeric bounds, and one active policy
+  per project. Existing tests manipulate ORM rows directly; they do not prove
+  application commands, authorization ordering, idempotent recovery, or
+  concealed cross-project denial.
+- CP01B registered exactly five typed AUTH actions and fact digests: read,
+  create draft, update draft, publish, and retire. They remain unavailable; no
+  additional policy action or permission is required.
+- `contributions/schemas.py` imports the private
+  `compensation.schemas.CompensationInstrumentType`. CP04 touches this edge and
+  must expose the closed enum through COMPENSATION's public API, then remove the
+  private import without transferring behavior ownership.
+- No durable policy mutation-operation reservation or immutable lifecycle event
+  currently supports unknown-commit recovery. Final-row uniqueness alone
+  cannot stop concurrent requests from both consuming authorization.
+
+Resolved design:
+
+- CP04 is a non-executable parent split into CP04A and CP04B. CP04A owns the
+  public policy API, read/create/update-draft behavior, and shared durable
+  operation/event foundation. CP04B owns publish and retire.
+- A project has at most one open draft version. Draft creation creates a new
+  aggregate/version when none is reusable, or the next version on the current
+  non-retired aggregate. Exact duplicate recovery returns the immutable result
+  only after current read authorization.
+- Draft update replaces the complete two-rule graph atomically. It never
+  patches published content and never creates ContributionRecords or awards.
+- Publish first acquires the operation fence and checks immutable replay
+  recovery; only a new operation then locks the aggregate, version, rules,
+  definitions, units, and adapter bindings, recomputes canonical digest/binding
+  facts from server-owned rows, consumes/closes PREP before mutation, and makes
+  the exact version current. Exact recovery returns the immutable event result
+  and performs no row mutation or second AUTH consumption.
+- Retire targets the exact current published version and prevents future
+  selection without rewriting any frozen downstream history.
+
+Implementation-time unknowns:
+
+- the next Alembic revision identifier;
+- the exact boundary/structural debt entries on then-current main;
+- whether existing baseline guards need a narrow correction in addition to the
+  required operation/event persistence.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/INTENT.md

@@ -66,3 +66,10 @@ compatibility or invented historical migration work.
 
 PLAN3 changes planning only. It does not register an action, activate a route,
 write policy behavior, mutate schema, or start a runtime child.
+
+CP04 planning succeeds when editable draft behavior and irreversible
+publication are separately reviewable, every mutation is replay-safe and
+transaction-bound, publication authority is derived only from locked
+server-owned graph facts, and production remains deny-default until CP05.
+It does not authorize a route, guide/task/review write, contribution/award
+creation, fulfillment, or compatibility path.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md

@@ -369,3 +369,26 @@ adapter-binding registration. CON validates policy facts; PROJECTS owns guide
 writes; CP08 supplies TASK-owned persistence/public facts; ARCH-03B alone owns
 Task readiness, claim, assignment, and Submission command writes; REV later
 copies only the immutable Submission policy stamp.
+
+CP04 is split at the irreversible lifecycle boundary:
+
+```text
+CP04A public API + read/create/update-draft + mutation recovery foundation
+-> CP04B publish/retire + immutable lifecycle proof
+-> CP05 exact AUTH activation
+```
+
+Both children remain hidden, route-unreachable, and production deny-default
+because all five actions stay unavailable until CP05. Every mutation uses one
+ordering:
+
+```text
+root transaction -> request digest -> operation fence -> recovery check
+-> owner and eligibility locks -> prepare -> consume -> close in finally
+-> product mutation + immutable event -> flush without commit
+```
+
+No policy row is staged before successful consumption and closure. Publish
+recomputes the complete graph digest after locking server-owned rules,
+definitions, units, and bindings. Retire disables future selection only and
+never rewrites frozen downstream lineage.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/RISKS.md

@@ -25,6 +25,10 @@
 | Review decision commits without mandatory contribution consequences | Critical | Stable REV schema precedes CON-03C/07; every decision atomically creates reviewer ContributionRecord/awards and accept additionally creates FinalAcceptance plus submitter record/awards |
 | Composition root absorbs domain decisions | High | Composition opens the unit of work and wires transaction-bound ports only; TASK command owns Submission sequencing and each target port enforces its own invariants |
 | Policy behavior starts before exact AUTH registration | Critical | CP01A and CP01B register their separate typed unavailable authority before CP02/CP04 behavior; CP03B/CP05 activate only after their hidden proof and exact prerequisites |
+| Policy mutation consumes AUTH before an operation race is fenced | Critical | CP04A installs one transaction-scoped operation fence and immutable recovery event used by every CP04 mutation; recovery requires current read authorization and creates no second effect/evidence |
+| Publication authorizes caller-supplied economic content | Critical | CP04B locks the complete graph and referenced unit/binding rows, recomputes canonical facts from server-owned state, and consumes PREP before mutation |
+| Draft update races publication or leaves a partial graph | Critical | CP04A replaces the complete two-rule graph atomically; CP04B holds the same custody through publication and database guards reject incomplete/mixed state |
+| Retirement rewrites active work or historical awards | Critical | Retirement disables future selection only; frozen guide/task/assignment/Submission/ReviewLease/contribution/award lineage remains immutable |
 | Binding management inherits retirement, fulfillment, callback, or delivery authority | Critical | CP01A through CP03 exclude all action-bearing identities and authority for retirement, fulfillment, callback, and delivery; CP03A adds only the closed target-only `workstream.compensation.adapter` identity with no action, permission, route, evaluator, or service-matrix row |
 | CON writes PROJECT or TASK aggregates | Critical | CP06 returns immutable validation facts only; CP07 and CP08 own their respective writes |
 | Consolidated v0.1 schema gains fake compatibility debt | High | CP09 performs a clean current-baseline cut and forbids aliases, dual paths, and invented backfills |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md

@@ -57,8 +57,8 @@
   registered/unavailable. CP02 is merged with hidden CON behavior
   while its AUTH actions remain unavailable; CP03 is split, CP03A is merged,
   and CP03B is complete with four exact hidden Finance Authority actions
-  active, while CP04-CP09 remain
-  non-executable skeletons.
+  active. CP04 is split into executable CP04A/CP04B contracts, while CP05-CP09
+  remain non-executable skeletons.
 - [WS-ARCH-001-PLAN4](chunks/WS-ARCH-001-PLAN4-incremental-debt-retirement.md) is planned
   and changes no runtime. It makes the existing incremental strangler
   operational: unrelated frozen debt cannot block delivery, new debt is
@@ -93,7 +93,12 @@
   actions are active only for covered human Finance Authority, nested adapters
   consume the public AUTH API, and private wiring remains at the AUTH adapter
   root without delivery or fulfillment behavior.
-- WS-ARCH-001-CP04 is proposed: hidden ContributionPolicy behavior.
+- WS-ARCH-001-CP04 is a planned non-executable parent split into CP04A hidden
+  read/create/update-draft behavior and CP04B hidden publish/retire behavior.
+- WS-ARCH-001-CP04A is planned with an executable hidden policy-draft contract
+  and is next.
+- WS-ARCH-001-CP04B is planned with an executable hidden publish/retire
+  contract after CP04A.
 - WS-ARCH-001-CP05 is proposed: exact ContributionPolicy activation.
 - WS-ARCH-001-CP06 is proposed: CON policy-validation port.
 - WS-ARCH-001-CP07 is proposed: PROJECT guide binding.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-CP04-con-policy-behavior.md

@@ -1,17 +1,19 @@
 # Chunk Contract: WS-ARCH-001-CP04 — Hidden ContributionPolicy Behavior
 
-Status: proposed non-executable skeleton after merged CP03B evidence. Risk: L1.
+Status: planned non-executable parent after merged CP03B evidence. Risk: L1.
 
-CON implements hidden ContributionPolicy read/draft/update/publish/retire
-behavior using the existing persistence aggregate, exact binding lifecycle, and
-opaque PREP protocol. Explicit unpaid and compensated rules remain distinct.
-Routes remain absent and policy actions unavailable. PROJECT guide activation,
-TASK readiness, claim, assignment, Submission, REV, awards, and AUTH edits are
-excluded.
+CONTRIBUTIONS implements hidden ContributionPolicy behavior through two bounded
+children using the existing persistence aggregate, COMPENSATION-owned binding
+lifecycle, and opaque PREP protocol. CP04A owns the public API, shared mutation
+recovery, read, create draft, and complete draft replacement. CP04B owns
+publication and retirement against the locked graph.
 
-After hidden proof merges, a separate AUTH activation chunk activates only the
-exact policy actions.
+Routes remain absent and policy actions unavailable. PROJECT guide activation,
+TASK readiness/claim/assignment/Submission, REV, ContributionRecord,
+CompensationAward creation, fulfillment, and AUTH edits are excluded. CP05
+activates only the five registered actions after both children merge.
 
 ## Merge state
 
 - Outcome on merge: `planned`
+- This is a split parent; no implementation targets it directly.