feat(reviews): authorize scoped first-contribution lifecycle control

.ci/auth-boundaries/TEST_STRUCTURE_DEBT.json

@@ -2,11 +2,11 @@
   "entries": [
     {
       "capability": "oversized_authorization_structure",
-      "content_sha256": "67cde79d416c7999c859e183516f4a4e9ed17201bcd47ff3767f8ee0997a1835",
-      "end_line": 1347,
+      "content_sha256": "e9f5a282cf016d7d6aeff32a6cbb978b033f5d6f7799b0d661396f5a4b191cb7",
+      "end_line": 1319,
       "hard_limit": 1200,
       "kind": "production_file",
-      "observed_lines": 1347,
+      "observed_lines": 1319,
       "path": "backend/app/modules/authorization/kernel.py",
       "qualified_symbol": null,
       "removal_chunk": "WS-AUTH-003-CLOSE",
@@ -26,51 +26,39 @@
     },
     {
       "capability": "oversized_authorization_structure",
-      "content_sha256": "2f9f25aad00519e3715ac3a12144aff6d1d08da1ab1ff7f6da20700286adca02",
-      "end_line": 1243,
+      "content_sha256": "bb866814258a7e8d17572e5c46102313e71b29a02c1acb3e0b6e5261ac951997",
+      "end_line": 1201,
       "hard_limit": 1200,
       "kind": "production_file",
-      "observed_lines": 1243,
+      "observed_lines": 1201,
       "path": "backend/app/modules/authorization/runtime.py",
       "qualified_symbol": null,
       "removal_chunk": "WS-AUTH-003-CLOSE",
       "start_line": 1
     },
     {
       "capability": "oversized_authorization_structure",
-      "content_sha256": "3a02a5b9ede4304b1fd126a51794324d78028448a0f7d1af860f1c8eed7eeec4",
-      "end_line": 526,
+      "content_sha256": "695afd40f7e2504c32f3fc7a5309c8677baff352acb6488bc63cf208ff83a161",
+      "end_line": 498,
       "hard_limit": 100,
       "kind": "production_function",
-      "observed_lines": 155,
+      "observed_lines": 123,
       "path": "backend/app/modules/authorization/kernel.py",
       "qualified_symbol": "AuthorizationService._prepare_prelocked",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 372
+      "start_line": 376
     },
     {
       "capability": "oversized_authorization_structure",
       "content_sha256": "ca3ded1b5b0ffa0dfa405485bb880ae03de6f7ed643d05aa4325d87533dcbd33",
-      "end_line": 898,
+      "end_line": 870,
       "hard_limit": 100,
       "kind": "production_function",
       "observed_lines": 115,
       "path": "backend/app/modules/authorization/kernel.py",
       "qualified_symbol": "AuthorizationService._require_prelocked",
       "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 784
-    },
-    {
-      "capability": "oversized_authorization_structure",
-      "content_sha256": "e70030fa8e350cfb2d5a98205612cc4c7364e13e2fc3ac5fbb3c065550249fd7",
-      "end_line": 938,
-      "hard_limit": 100,
-      "kind": "production_function",
-      "observed_lines": 118,
-      "path": "backend/app/modules/authorization/prepared.py",
-      "qualified_symbol": "PreparedAuthorizationService._binding",
-      "removal_chunk": "WS-AUTH-003-CLOSE",
-      "start_line": 821
+      "start_line": 756
     },
     {
       "capability": "oversized_authorization_structure",

.ci/behavior-ownership/partition.v1.json

@@ -564,6 +564,10 @@
       "group": "auth",
       "target": "backend/app/modules/authorization/domain/guide_proposals.py"
     },
+    {
+      "group": "auth",
+      "target": "backend/app/modules/authorization/domain/lifecycle.py"
+    },
     {
       "group": "auth",
       "target": "backend/app/modules/authorization/domain/outbox_dispatch.py"
@@ -656,6 +660,10 @@
       "group": "auth",
       "target": "backend/app/modules/authorization/kernel.py"
     },
+    {
+      "group": "auth",
+      "target": "backend/app/modules/authorization/lifecycle_authorization.py"
+    },
     {
       "group": "auth",
       "target": "backend/app/modules/authorization/lifecycle_schemas.py"
@@ -700,6 +708,14 @@
       "group": "auth",
       "target": "backend/app/modules/authorization/prepared.py"
     },
+    {
+      "group": "auth",
+      "target": "backend/app/modules/authorization/prepared_admin_authority.py"
+    },
+    {
+      "group": "auth",
+      "target": "backend/app/modules/authorization/prepared_lifecycle_replay.py"
+    },
     {
       "group": "auth",
       "target": "backend/app/modules/authorization/prepared_post_submit_replay.py"
@@ -1396,6 +1412,10 @@
       "group": "lifecycle",
       "target": "backend/app/modules/reviews/lifecycle/models.py"
     },
+    {
+      "group": "lifecycle",
+      "target": "backend/app/modules/reviews/lifecycle/service.py"
+    },
     {
       "group": "lifecycle",
       "target": "backend/app/modules/reviews/models.py"
@@ -1713,7 +1733,7 @@
       "target": "backend/scripts/validate_test_lane_evidence.py"
     }
   ],
-  "authority_digest": "ef9821de8c9f801b8883d9d485e320cae5283e7ae5abd9bac3ad2ab31042731a",
+  "authority_digest": "eeba7e6c4053f1f0aa9e2fb5aaae44537b4dc44b4bbbbce01225aac39c4b9eb1",
   "protected_base_commit": "7676ce4347db0c9694962a9b587a20765e16eac6",
   "schema": "workstream.behavior-ownership-partition.v1"
 }

.commitrail/INDEX.md

@@ -11,11 +11,11 @@ for current product capability.
 | [WS-CLI-001](initiatives/WS-CLI-001/OVERVIEW.md) | Planned | Public Go CLI self-service, inspection, task browsing/claim/start, governing context, project creation/declaration, original upload and setup diagnostic inspection delivered through WS-CLI-001-11; PILOT-13 assigned-guide listing/download is delivered; approval/activation, further public journeys and binary distribution remain; hidden submission is not exposed |
 | [WS-ARCH-001](initiatives/WS-ARCH-001/OVERVIEW.md) | Planned | Source storage, inert AUTH contracts, TASK request reservation, hidden exact AUTH preparation and the REV-04C hidden FinalAcceptance/TASK/CON participant are delivered; TASK-before-CHECKERS reservation/current-read custody and ordered admission INSERTs are delivered by 04E1B-B1; 04E1B-B2 adds exact source preparation without publication; 04E1B-B3 retains inspected ZIP metadata and B4 binds Submission text to checked packet custody and B5 validates bounded evaluation content before durable admission; B6 commits initial Submission/dispatch and exact replay; B7 adds hidden request delivery; completion routing is next under the [first-layer sequence](initiatives/WS-ARCH-001/planning/PLAN.md#first-complete-contributor-milestone), ending in a public contributor drill before live human review/revision. True admission remains independent of shared acceptance; false activation still requires exact AUTH receipt custody, database complete-set enforcement, currentness race proof and atomic routing activation. |
 | [WS-ART-001](initiatives/WS-ART-001/OVERVIEW.md) | Planned | Exact checker input/output custody and packet foundations are delivered; routing integration, remediation and public intake remain. |
-| [WS-AUTH-001](initiatives/WS-AUTH-001/OVERVIEW.md) | Planned | AUTH-19A commitments, TASK request reservation, ARCH-04E2-A hidden strict PREP matching and the REV-04C hidden FinalAcceptance/TASK/CON participant are delivered; the action remains unavailable, with mandatory exact AUTH receipt input, database closure, audit/outbox and scoped activation still required for the automated path. |
-| [WS-CON-001](initiatives/WS-CON-001/OVERVIEW.md) | Planned | Contribution/award storage, CON-07 participation and REV-04C hidden FinalAcceptance/TASK/CON composition are delivered; production consumption still requires genuine authority, database complete-set enforcement, currentness race proof, shared audit/outbox, fulfillment-root ordinals and lifecycle activation. |
-| [WS-AUTH-003](initiatives/WS-AUTH-003/OVERVIEW.md) | Planned | Canonical source facts and disabled lifecycle fencing are delivered; exact lifecycle activation remains tied to the governed consequence. |
+| [WS-AUTH-001](initiatives/WS-AUTH-001/OVERVIEW.md) | Planned | AUTH-19A commitments, TASK request reservation, ARCH-04E2-A hidden strict PREP matching and the REV-04C hidden FinalAcceptance/TASK/CON participant are delivered; routing remains unavailable; REV-12A4A supplies internal Operator lifecycle control, while mandatory routing AUTH receipt input, database closure and audit/outbox remain required for the automated path. |
+| [WS-CON-001](initiatives/WS-CON-001/OVERVIEW.md) | Planned | Contribution/award storage, CON-07 participation and REV-04C hidden FinalAcceptance/TASK/CON composition are delivered; production consumption still requires genuine authority, database complete-set enforcement, currentness race proof, shared audit/outbox and production manifest readiness on the delivered REV-12A4A controller. |
+| [WS-AUTH-003](initiatives/WS-AUTH-003/OVERVIEW.md) | Planned | Canonical source facts and scoped Operator lifecycle control are delivered; exact acceptance activation remains tied to the governed consequence. |
 | [WS-POL-003](initiatives/WS-POL-003/OVERVIEW.md) | Planned | Locked policy configuration, inert source commitments and the REV-04C hidden false/pass acceptance participant are delivered; false-policy activation remains gated by exact AUTH receipt custody, database closure, currentness proof, remediation and scoped lifecycle authority. |
-| [WS-REV-001](initiatives/WS-REV-001/OVERVIEW.md) | Planned | Packet and Review storage plus REV-04C hidden source-neutral FinalAcceptance/TASK/CON composition are delivered; ARCH-04E1B-B6 atomic Submission/dispatch is delivered; B7 adds hidden request delivery; completion routing remains next, while authority/evidence closure and human review/revision remain separately gated. |
+| [WS-REV-001](initiatives/WS-REV-001/OVERVIEW.md) | Planned | Packet and Review storage plus REV-04C hidden source-neutral FinalAcceptance/TASK/CON composition are delivered; ARCH-04E1B-B6 atomic Submission/dispatch is delivered; B7 adds hidden request delivery; completion routing remains next, while REV-12A4A supplies scoped lifecycle control; acceptance authority/evidence closure and human review/revision remain separately gated. |
 | [WS-QUAL-002](initiatives/WS-QUAL-002/OVERVIEW.md) | Planned | Populate subsystem ownership before changed-line mutation work |
 | [WS-QUAL-003](initiatives/WS-QUAL-003/OVERVIEW.md) | Planned | Audit and prune test proof, add missing safety cases, decompose oversized test modules |
 | [WS-XINT-002](initiatives/WS-XINT-002/OVERVIEW.md) | Planned | Remaining ART/AUTH activation edges only |

.commitrail/initiatives/WS-ARCH-001/OVERVIEW.md

@@ -1,5 +1,7 @@
 # WS-ARCH-001 — Modular monolith boundaries
 
+[REV-12A4A](../WS-REV-001/WS-REV-001-12A4A.md) adds internal Operator-controlled lifecycle transitions and current-generation terminal replay. New acceptance effects require LIVE; source AUTH custody and production routing remain unavailable. Conditional award facts stay atomic, while fulfillment admission, payment delivery and their root/cutoff machinery remain deferred until a successor manifest enables them.
+
 [ARCH-04E1B-B5](WS-ARCH-001-04E1BB5.md) delivers shared bounded evaluation content and rejects unrepresentable ZIP input before durable admission. ARCH-04E1B-B6 reuses this projection in atomic Submission/dispatch creation with exact AUTH receipts and select-only replay. B7 adds hidden request delivery with exact invocation fencing; completion routing is next. Production registration remains unavailable.
 
 Delivery priority: [first complete contributor milestone](planning/PLAN.md#first-complete-contributor-milestone). Use its nine-step order and end-to-end exit proof when selecting the next bounded change; live human review/revision and external integration are later work.
@@ -26,7 +28,7 @@ CON-07 hidden submitter participation and complete frozen award-set staging/repl
 [REV-04C](../WS-REV-001/WS-REV-001-04C.md) now composes FinalAcceptance, TASK terminal effects and CON participation
 inside one hidden caller-owned transaction. Mandatory exact AUTH receipt input,
 database complete-set enforcement, currentness race proof, shared audit/outbox,
-fulfillment-root ordinal custody and scoped lifecycle activation remain
+the reviewed scoped lifecycle manifest remain
 required before production consumption. Neither phase may
 commit a standalone allow. The first durable receipt must commit with its full
 governed consequence. Hidden handlers and activation follow as 04E1B-B/04E2-B,

.commitrail/initiatives/WS-ARCH-001/planning/CHUNK_MAP.md

@@ -24,8 +24,7 @@ PREP while the action remains planned/unavailable. CON-07 hidden submitter
 participation and complete frozen award-set staging/replay are delivered. REV-04C
 adds the hidden FinalAcceptance/TASK/CON participant. Remaining 04E1B-B work begins with atomic initial
 Submission/dispatch and B7 hidden request delivery before completion routing. Mandatory exact same-input AUTH receipt, database complete-set enforcement,
-TASK-before-CHECKERS race proof, shared audit/outbox, fulfillment-root ordinal
-custody and scoped lifecycle activation remain required
+TASK-before-CHECKERS race proof, shared audit/outbox, the reviewed scoped lifecycle manifest remain required
 before production consumption. Neither phase may
 commit a standalone allow. The first durable receipt must commit with its full
 governed consequence. Hidden handlers and activation follow as 04E1B-B/04E2-B,
@@ -76,7 +75,7 @@ currentness proof stay within 04E1B-B, before activation and live composition.
 | [WS-ARCH-001-04D1](../WS-ARCH-001-04D1.md) | Canonical terminal ART material custody | L1 | Complete; valid retained history preserved; invalid upgrades refused |
 | [WS-ARCH-001-04D2](../WS-ARCH-001-04D2.md) | AUTH exact fixed-service post-submit activation (replaces XINT-06B) | L1 | Complete: exact input, execute and finalize authority; output write/bind remains unavailable |
 | [WS-ARCH-001-04E1A](../WS-ARCH-001-04E1A.md) | Route-neutral immutable source schema and shared accepted-effects types | L1 | Complete; REV-04C uses a bounded exact-source verifier, with no general routing publication writer/reader, routing authority or current pointer; its hidden effects participant does not make false routing available |
-| [WS-ARCH-001-04E](chunks/WS-ARCH-001-04E-canonical-allow-review.md) | TASK current routing: true to canonical `allow_review`, false/pass to shared acceptance | L1 | Both branches: delivered 04E1A/04D2/OUTBOX-02, request reservation 04E1B-A and AUTH preparation 04E2-A; exact source preparation [04E1B-B2](../WS-ARCH-001-04E1BB2.md) -> verified ZIP metadata [04E1B-B3](../WS-ARCH-001-04E1BB3.md) -> checked packet custody [04E1B-B4](../WS-ARCH-001-04E1BB4.md) -> bounded evaluation content [04E1B-B5](../WS-ARCH-001-04E1BB5.md) -> atomic Submission/dispatch [04E1B-B6](../WS-ARCH-001-04E1BB6.md) -> hidden request delivery [04E1B-B7](../WS-ARCH-001-04E1BB7.md) -> completion/currentness proof 04E1B-B -> authority/evidence closure and activation 04E2-B -> live 04E3. False uses delivered REV-04C participation and additionally needs mandatory exact receipt/database/audit closure, fulfillment-root ordinal custody and scoped lifecycle activation; true does not depend on CON. False guide activation also requires 04F remediation |
+| [WS-ARCH-001-04E](chunks/WS-ARCH-001-04E-canonical-allow-review.md) | TASK current routing: true to canonical `allow_review`, false/pass to shared acceptance | L1 | Both branches: delivered 04E1A/04D2/OUTBOX-02, request reservation 04E1B-A and AUTH preparation 04E2-A; exact source preparation [04E1B-B2](../WS-ARCH-001-04E1BB2.md) -> verified ZIP metadata [04E1B-B3](../WS-ARCH-001-04E1BB3.md) -> checked packet custody [04E1B-B4](../WS-ARCH-001-04E1BB4.md) -> bounded evaluation content [04E1B-B5](../WS-ARCH-001-04E1BB5.md) -> atomic Submission/dispatch [04E1B-B6](../WS-ARCH-001-04E1BB6.md) -> hidden request delivery [04E1B-B7](../WS-ARCH-001-04E1BB7.md) -> completion/currentness proof 04E1B-B -> authority/evidence closure and activation 04E2-B -> live 04E3. False uses delivered REV-04C participation and additionally needs mandatory exact receipt/database/audit closure, the reviewed scoped lifecycle manifest; true does not depend on CON. False guide activation also requires 04F remediation |
 | [WS-ARCH-001-03D](../WS-ARCH-001-03D.md) | Exact activated historical guide through hidden durable intake; obsolete lookup removed | L1 | Complete; hidden exact post-submit materialization, ARCH-04B2 output custody, ARCH-04C execution, ARCH-04D1/04D2 custody/authority and ARCH-04E1A source-only facts/types delivered; public cutover remains deferred |
 | [WS-ARCH-001-04F](chunks/WS-ARCH-001-04F-checker-remediation.md) | Contributor-correctable checker failures and same-lineage admission-backed replacement Submission | L1 | Planned from required hidden 04E result/handler contracts; before false-policy activation and public 02I, without requiring live human review |