test(auth): audit admin access lifecycle proof

.ci/auth-boundaries/TEST_STRUCTURE_DEBT.json

@@ -194,11 +194,11 @@
     },
     {
       "capability": "unassigned_legacy_auth",
-      "content_sha256": "cfaf237be44f3060b9c9a0d026dde3c0cdba96d67034f14c838101a51dc38d47",
-      "end_line": 5822,
+      "content_sha256": "6f7d6f8a812cc289196a9468527159cf344650290f880bd5cfcb9e3a7f613ce9",
+      "end_line": 3877,
       "hard_limit": 1200,
       "kind": "test_file",
-      "observed_lines": 5822,
+      "observed_lines": 3877,
       "path": "backend/tests/test_auth.py",
       "qualified_symbol": null,
       "removal_chunk": "WS-AUTH-003-CLOSE",
@@ -396,113 +396,77 @@
       "removal_chunk": "WS-AUTH-003-CLOSE",
       "start_line": 1104
     },
-    {
-      "capability": "unassigned_legacy_auth",
-      "content_sha256": "44b9858d132d384cd10c6b8b8fae096ade7c3fced6780cc2c142e59b4162d97d",
-      "end_line": 2253,
-      "hard_limit": 120,
-      "kind": "test_function",
-      "observed_lines": 280,
-      "path": "backend/tests/test_auth.py",
-      "qualified_symbol": "test_actor_admin_reads_hold_caller_and_grant_locks_through_disclosure",
-      "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 1974
-    },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "9df08af6d7d3193c9112ac885fbe242b0f6ef072dfe9536f91980a61d14a7b4c",
-      "end_line": 5802,
+      "end_line": 3857,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 879,
       "path": "backend/tests/test_auth.py",
       "qualified_symbol": "test_actor_identity_link_lifecycle_real_postgres_concurrency",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 4924
+      "start_line": 2979
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "15c7147c11fa1802f43480b38a3678ac1a2586320ae2f0013622f1d63b2a3806",
-      "end_line": 4479,
+      "end_line": 2534,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 535,
       "path": "backend/tests/test_auth.py",
       "qualified_symbol": "test_actor_identity_link_lifecycle_real_postgres_matrix",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 3945
+      "start_line": 2000
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "188db6b76b3f6dbe4077dbbb724bc9fe7529058b099cc7409bc5a443686a096a",
-      "end_line": 4921,
+      "end_line": 2976,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 440,
       "path": "backend/tests/test_auth.py",
       "qualified_symbol": "test_actor_profile_lifecycle_real_postgres_concurrency",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 4482
+      "start_line": 2537
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "eca9eeff229ee37c103188f9a31e278773a69e96f2fd354662723f840cf8f16a",
-      "end_line": 3942,
+      "end_line": 1997,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 482,
       "path": "backend/tests/test_auth.py",
       "qualified_symbol": "test_actor_profile_lifecycle_real_postgres_matrix",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 3461
-    },
-    {
-      "capability": "unassigned_legacy_auth",
-      "content_sha256": "e1fd679295947e120c6da520bd138a78a8e133e44f8dde91010de29354e88f5b",
-      "end_line": 1971,
-      "hard_limit": 120,
-      "kind": "test_function",
-      "observed_lines": 485,
-      "path": "backend/tests/test_auth.py",
-      "qualified_symbol": "test_admin_bootstrap_replay_and_cross_revoke_are_concurrency_safe",
-      "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 1487
+      "start_line": 1516
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "8ea087b906726103295a019967f8c38e42b55deb4e912fda3a41289fda23f35d",
-      "end_line": 2978,
+      "end_line": 1033,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 647,
       "path": "backend/tests/test_auth.py",
       "qualified_symbol": "test_controlled_service_actor_provisioning_includes_project_setup_and_is_atomic",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 2332
+      "start_line": 387
     },
     {
       "capability": "unassigned_legacy_auth",
       "content_sha256": "d26732dd125f8c2062b5a4b45b59fbccd283ee04939a9da7be1576235524292f",
-      "end_line": 3389,
+      "end_line": 1444,
       "hard_limit": 120,
       "kind": "test_function",
       "observed_lines": 409,
       "path": "backend/tests/test_auth.py",
       "qualified_symbol": "test_service_actor_provisioning_failure_and_authority_races_are_atomic",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 2981
-    },
-    {
-      "capability": "unassigned_legacy_auth",
-      "content_sha256": "a7e36b433ed775ab82e7ff92c013aab3a1cee14fbbed6f4ddace351ab936e24c",
-      "end_line": 1371,
-      "hard_limit": 120,
-      "kind": "test_function",
-      "observed_lines": 1041,
-      "path": "backend/tests/test_auth.py",
-      "qualified_symbol": "test_signed_tokens_bootstrap_and_admin_grant_lifecycle",
-      "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 331
+      "start_line": 1036
     },
     {
       "capability": "unassigned_legacy_auth",

.commitrail/initiatives/WS-QUAL-003/OVERVIEW.md

@@ -21,12 +21,15 @@
 - AUTH cleanup: [12 — projection proof and staged AUTH audit](WS-QUAL-003-12.md).
   The human expanded this change to use reviewed commit checkpoints in one PR;
   projection proof is its first stage, not its completion boundary.
-- After 12's intended merge outcome: inventory the remaining AUTH lifecycle
-  families before further decomposition; do not repeat the selected actor and
-  authentication proof audit. The full suite audit remains open.
+- AUTH admin-access slice: [13 — lifecycle proof audit](WS-QUAL-003-13.md).
+- After 13's intended merge outcome: inventory the remaining service-actor
+  provisioning and profile/link lifecycle families, then remaining AUTH owners.
+  Do not repeat the selected actor, authentication or admin-access audit.
+  The full suite audit remains open.
 - Preserve: intended production semantics, public boundaries, real database/isolation/
   concurrency proof, current coverage floors, full hosted execution, human merge.
-- Product work: POL-04A2 remains planned; this initiative does not implement it.
+- Product work: POL-04A2 hidden finalization is delivered; its next AUTH-12B2
+  activation boundary proceeds independently. This initiative implements neither.
 
 ## Baseline and honest audit coverage
 
@@ -119,7 +122,15 @@ No fixed reduction percentage or same-day completion claim overrides safety.
   same change audits all 34 actor-registry tests and 51 authentication tests,
   removes the actor monolith, repairs real lock/rotation/rollback evidence and
   maps every original assertion. Its exact limits live in record 12; remaining
-  AUTH lifecycle families are unaudited.
+  AUTH lifecycle families beyond the selected slices are unaudited.
+- AUTH slice 13 audits eight mixed bootstrap/admin-access tests and preserves
+  all 203 original assertion spans in named survivors. It retains the real
+  signed-token API journey, replaces arrival-only races with exact database
+  blocker proof, and checks actual staged state before injected commit failure.
+  A missing-owner-lock negative control calibrates the race proof. Fresh read
+  cases keep database triggers enabled instead of resetting shared lifecycle
+  rows. Three oversized functions are removed without moving them into helpers;
+  the remaining fifteen monolith test bodies are unchanged.
 - PROJECT slice 07 replaces the remaining mixed diagnostic composer tests with
   exact facts/digests and owner selectors. Each invalid-parent case now starts
   with a valid record, so a pre-existing missing target cannot hide a broken