Implement hidden ContributionPolicy draft behavior

.agent-loop/CURRENT_STATE.md

@@ -28,10 +28,10 @@ authority; these records do not grant or withhold it.
 
 | Initiative | Durable state on `main` | Remaining boundary |
 |---|---|---|
-| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H`; CP01A-CP03B establish hidden CON adapter-binding behavior and exact Finance Authority activation; CP04A's executable contract has atomic owner/proof/custody mapping | Implement CP04A hidden ContributionPolicy read/create/update-draft behavior; CP04B then owns publish/retire, and the wider PLAN2 path still targets durable `allow_review` |
+| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H`; CP01A-CP03B establish adapter-binding behavior/activation; CP04A completes hidden policy read/create/update-draft behavior with durable operation/event custody | Implement CP04B hidden publish/retire behavior; CP05 later activates the proven policy actions, and PLAN2 still targets durable `allow_review` |
 | [WS-ART-001](initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md) | Active delivery initiative; verified ready-admission publication, hidden preparation, consumption and binding are merged through ARCH-02H | Implement exact post-submit materialization only after the unified guide/checker and PLAN2 public contracts are executable; live cutover remains later |
 | [WS-AUTH-001](initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md) | Active delivery initiative; project-policy authority and unified compilation authorization are merged through `12I` | POL-03B consumes 12I next; remaining AUTH activation chunks wait for their exact hidden owner behavior |
-| [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; CP03B completes hidden adapter-binding behavior and exact Finance Authority activation; ContributionPolicy persistence and shared lifecycle audit foundations are merged | Implement CP04A hidden policy draft behavior, then CP04B publication/retirement; later complete guide-activation validation/persistence before task readiness |
+| [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; CP03B completes adapter-binding activation and CP04A completes hidden ContributionPolicy draft behavior; shared lifecycle audit foundations are merged | Implement CP04B publication/retirement; later activate policy actions and complete guide-activation validation/persistence before task readiness |
 | [WS-AUTH-003](initiatives/WS-AUTH-003-module-boundary-recovery/STATUS.md) | AUTH boundary foundation and first public-capability proof through POL-03A are merged | Repair each touched AUTH capability through `authorization.api` and shrink the canonical AUTH ledger |
 | [WS-POL-003](initiatives/WS-POL-003-unified-project-guide-compilation/STATUS.md) | Active delivery initiative; hidden compilation custody and AUTH-12I activation are merged | Implement POL-03B authorized compilation persistence, then continue the reviewed dependency order |
 | [WS-REV-001](initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md) | Independent foundations through queue admission and reviewer-lease persistence are merged through `03A2`; schema/packet foundations may continue behind their own gates | Live admission/claim requires canonical 04E `allow_review`; ReviewLease copies the admitted Submission's immutable attempt policy version, and the first Review commit requires CON-03C/07 atomic contribution/award behavior |
@@ -124,9 +124,10 @@ remain non-executable until their current-main contracts are expanded.
   exact AUTH adapter root. No compensation delivery or fulfillment behavior is
   activated.
 - WS-ARCH-001-CP04 is a planned non-executable parent. CP04A and CP04B have
-  executable contracts; CP04A is the next implementation boundary.
-- WS-ARCH-001-CP04A is planned and is the next hidden policy-draft boundary.
-- WS-ARCH-001-CP04B is planned after CP04A for hidden publication/retirement.
+  executable contracts; CP04B is the next implementation boundary.
+- WS-ARCH-001-CP04A is complete with hidden policy read/create/update-draft
+  behavior; it exposes no route and activates no policy action.
+- WS-ARCH-001-CP04B is planned next for hidden publication/retirement.
 - WS-ARCH-001-CP05 is proposed and non-executable.
 - WS-ARCH-001-CP06 is proposed and non-executable.
 - WS-ARCH-001-CP07 is proposed and non-executable.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md

@@ -26,7 +26,7 @@
 | `WS-ARCH-001-CP03A` | Closed adapter target identity and PROJECTS/ACTORS owner eligibility | L1 | Merged through PR #340; actions remain unavailable |
 | `WS-ARCH-001-CP03B` | AUTH exact Finance Authority adapter-binding activation | L1 | Complete; four exact hidden actions active through public ports, with private wiring confined to the AUTH adapter root |
 | `WS-ARCH-001-CP04` | Hidden ContributionPolicy behavior coordination parent | L1 | Planned split into CP04A/CP04B; non-executable |
-| `WS-ARCH-001-CP04A` | CONTRIBUTIONS public API and hidden read/create/update-draft behavior | L1 | Planned executable contract strengthened with atomic owner/proof/custody mapping; first CP04 implementation |
+| `WS-ARCH-001-CP04A` | CONTRIBUTIONS public API and hidden read/create/update-draft behavior | L1 | Complete; hidden route-unreachable behavior, public owner ports, operation recovery, and immutable event custody merged while policy actions remain unavailable |
 | `WS-ARCH-001-CP04B` | Hidden ContributionPolicy publish/retire behavior | L1 | Planned executable contract after merged CP04A |
 | `WS-ARCH-001-CP05` | AUTH exact ContributionPolicy activation | L1 | Proposed skeleton after CP04 evidence |
 | `WS-ARCH-001-CP06` | CON guide-activation/revision policy-validation port | L1 | Proposed skeleton after CP05 |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md

@@ -2,7 +2,9 @@
 
 - Initiative state: active; boundary foundation complete
 - Runtime behavior changed: hidden CON adapter-binding behavior plus exactly four
-  Finance Authority actions; no public route
+  Finance Authority actions, and hidden ContributionPolicy read/create-draft/
+  update-draft behavior; all five policy actions remain unavailable and no
+  public route exists
 - Canonical target: nine business modules and three supporting modules
 - Recovery model: freeze exact debt, prohibit growth, repair touched
   capabilities incrementally
@@ -57,7 +59,7 @@
   registered/unavailable. CP02 is merged with hidden CON behavior
   while its AUTH actions remain unavailable; CP03 is split, CP03A is merged,
   and CP03B is complete with four exact hidden Finance Authority actions
-  active. CP04 is split into executable CP04A/CP04B contracts, while CP05-CP09
+  active. CP04A is complete and CP04B remains executable, while CP05-CP09
   remain non-executable skeletons.
 - [WS-ARCH-001-PLAN4](chunks/WS-ARCH-001-PLAN4-incremental-debt-retirement.md) is planned
   and changes no runtime. It makes the existing incremental strangler
@@ -95,11 +97,12 @@
   root without delivery or fulfillment behavior.
 - WS-ARCH-001-CP04 is a planned non-executable parent split into CP04A hidden
   read/create/update-draft behavior and CP04B hidden publish/retire behavior.
-- WS-ARCH-001-CP04A is planned with an executable hidden policy-draft contract
-  strengthened by exact public-owner composition and atomic named proof
-  custody; it is next.
+- WS-ARCH-001-CP04A is complete: CONTRIBUTIONS owns hidden read/create/update
+  draft behavior, public owner ports preserve COMPENSATION and PROJECTS
+  boundaries, PostgreSQL operation/event custody is durable, and all five
+  policy actions remain unavailable.
 - WS-ARCH-001-CP04B is planned with an executable hidden publish/retire
-  contract after CP04A.
+  contract and is the next policy-behavior boundary after CP04A.
 - WS-ARCH-001-CP05 is proposed: exact ContributionPolicy activation.
 - WS-ARCH-001-CP06 is proposed: CON policy-validation port.
 - WS-ARCH-001-CP07 is proposed: PROJECT guide binding.