Adopt Workstream authorization service baseline

.agent-loop/LOOP_STATE.md

@@ -2,29 +2,25 @@
 
 ## Current State
 
-- Active initiative: none
+- Active initiative: `WS-AUTH-001` - Workstream Authorization Service
 - Active planning chunk: none
-- Active implementation chunk: none
-- Branch: `codex/ws-pol-002-03-post-merge-memory`
-- Status: `WS-POL-002-03` merged through PR #90 on 2026-07-11.
-- Last reviewed implementation SHA: `0e59873`
-- Final merged branch head: `1e20b79`
-- Last merge commit: `a7aa474`
-- Current gate: post-merge memory update; stop after memory review.
-- Next chunk: `WS-POL-002-04` remains inactive until a separate explicit user
-  start signal.
-- Checkpointed initiative: `WS-AUTH-001` - Workstream Authorization Service
-- Checkpointed planning artifact: `WS-AUTH-001-PLAN`
-- Status: WS-AUTH-001 planning merged through PR #91 and post-merge memory
-  merged through PR #92. Its separate implementation worktree owns any later
-  authorization activity; this WS-POL memory update does not modify that work.
-- Reconciliation note: WS-AUTH planning references to the earlier WS-POL pause
-  are point-in-time decision records. Any current-state reconciliation belongs
-  to the WS-AUTH worktree after it updates from `main`.
-- Current gate: explicit durable human approval of D4-D10 before any
-  authorization implementation chunk starts.
-- Next authorization chunk: `WS-AUTH-001-01` remains proposed until D4-D10
-  approval and a separate implementation start signal.
+- Active implementation chunk: `WS-AUTH-001-01`
+- Branch: `codex/ws-auth-001-01-adopt-authorization-baseline`
+- Worktree: `/home/abiorh/flow/workstream-auth-001-01`
+- Status: PR #93 is published. Contributor terminology, CodeRabbit feedback, and
+  latest-main integration passed all required internal reviewer tracks at
+  `2164e3b`. The stale CI assertion repair passed at `be0b836`, and its final
+  scope evidence passed at `b7dafb3`; evidence rebind remains before the next
+  push.
+- Last merged implementation SHA: `1e20b79`
+- Last merge commit: `b1270d7`
+- Current gate: bind final local review evidence, push PR #93, observe external
+  checks, and stop for human review.
+- Next chunk: `WS-AUTH-001-02` remains proposed and must not start
+  automatically.
+- Parallel initiative: `WS-POL-002-03` merged through PR #90 as `a7aa474`; its
+  post-merge memory merged through PR #94 as `b1270d7`. `WS-POL-002-04` remains
+  inactive pending the authorization foundation and a separate explicit start.
 
 ## Operating Rule
 

.agent-loop/REVIEW_LOG.md

@@ -1,5 +1,27 @@
 # Review Log
 
+## WS-AUTH-001-01
+
+Status: PR #93 published; latest-main merge, CodeRabbit repairs, CI assertion
+repair, and required internal re-review complete locally; evidence rebind,
+push, external checks, and human review pending.
+
+Reviewed implementation SHA: `be0b836`
+
+Result: PASS after fixes across senior engineering, QA/test, security/auth,
+product/ops, architecture, docs, reuse/dedup, CI integrity, and test delta.
+
+Scope: canonical authorization ADR/spec/runbook, active-document and diagram
+reconciliation, stale-authorization scanner/tests, additive Agent Gates step,
+latest-main/PR #90 reconciliation, and terminology-only prompt/test wording.
+
+Evidence: `.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-01-internal-review-evidence.md`
+
+Trust bundle: `.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-01-pr-trust-bundle.md`
+
+Next chunk: `WS-AUTH-001-02` remains inactive pending merge, memory update, and
+an explicit user start.
+
 ## WS-POL-002-03
 
 Status: merged through PR #90 on 2026-07-11 as `a7aa474`.
@@ -35,8 +57,8 @@ Trust bundle: `.agent-loop/initiatives/WS-POL-002-post-submit-checker-foundation
 
 External review response: `.agent-loop/initiatives/WS-POL-002-post-submit-checker-foundation/reviews/WS-POL-002-03-external-review-response.md`
 
-Next chunk: `WS-POL-002-04` remains inactive until a separate explicit user
-start signal.
+Next chunk: `WS-POL-002-04` remains inactive until the authorization foundation
+is proven and the user provides a separate explicit start signal.
 
 Parallel-work note: stale point-in-time WS-POL pause wording in WS-AUTH planning
 artifacts is owned by the separate WS-AUTH worktree and was deliberately not
@@ -673,3 +695,21 @@ Evidence: `.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/
 Next gate: explicit durable human approval of D4-D10 and a separate
 `WS-AUTH-001-01` start signal. Create a fresh worktree/branch from the latest
 merged `main`; do not implement chunk 01 in the planning worktree.
+
+## 2026-07-11 - WS-AUTH-001-01 Started
+
+The user explicitly approved D4-D10 and started only `WS-AUTH-001-01` by saying
+"ok start" after the planning and post-merge memory PRs merged.
+
+Branch: `codex/ws-auth-001-01-adopt-authorization-baseline`
+
+Worktree: `/home/abiorh/flow/workstream-auth-001-01`
+
+Scope: authorization ADR, canonical repository documentation, deterministic
+stale-authorization documentation gate, operations runbook, and durable loop
+state. Backend runtime, migrations, tests, dependencies, review, contribution,
+compensation, frontend, and later authorization chunks remain inactive.
+
+Next gate: implement and verify only the WS-AUTH-001-01 contract, run all
+required internal reviewer tracks, prepare the trust bundle, and stop for human
+review.

.agent-loop/WORK_QUEUE.md

@@ -2,20 +2,14 @@
 
 ## In Progress
 
-None.
-
-## Planned Next
-
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
-| `WS-POL-002-04` | Locked Runtime Execution And Routing Hardening | L1 | Inactive until a separate explicit user start is given |
-| `WS-AUTH-001-01` | Adopt Authorization Baseline And Repository Contracts | L1 | Proposed after D4-D10 approval and explicit start |
+| `WS-AUTH-001-01` | Adopt Authorization Baseline And Repository Contracts | L1 | Active in dedicated worktree after D4-D10 approval |
 
-## Human Checkpoints
+## Planned Next
 
-| Gate | Initiative | Risk | Status |
-|---|---|---:|---|
-| D4-D10 approval | `WS-AUTH-001` | L0 | Stopped at human checkpoint; explicit D4-D10 approval required before implementation |
+No next chunk is active. Start requires the current chunk's human checkpoint,
+memory update, and an explicit user signal.
 
 ## Completed
 
@@ -48,10 +42,11 @@ None.
 
 ## Proposed Next
 
-Do not start `WS-POL-002-04` until a separate explicit user start signal.
-Stop at the WS-AUTH-001 planning human checkpoint. Do not activate
-`WS-AUTH-001-01` before explicit D4-D10 approval and a separate start signal.
-Future WS-POL work after PR #90 also requires a separate start signal.
+Execute only `WS-AUTH-001-01` in its dedicated worktree. Rebind evidence after
+the latest-main merge, push PR #93, observe external checks, and stop for human
+review; do not start `WS-AUTH-001-02` or `WS-POL-002-04`. PR #90 and its PR #94
+memory update are merged; this worktree only reconciles them with the active
+authorization baseline.
 
 ## Blocked
 

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md

@@ -12,7 +12,7 @@ stopped.
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
 | `WS-AUTH-001-PLAN` | Authorization Service Planning | L0 | Merged through PR #91 as `ad6d644` |
-| `WS-AUTH-001-01` | Adopt Authorization Baseline And Repository Contracts | L1 | Proposed |
+| `WS-AUTH-001-01` | Adopt Authorization Baseline And Repository Contracts | L1 | Active |
 | `WS-AUTH-001-02` | Verified Issuer Token And JWKS Boundary | L1 | Proposed |
 | `WS-AUTH-001-03` | Legacy Actor Classification Preflight | L1 | Proposed |
 | `WS-AUTH-001-04` | Request, Error, And API Control Foundation | L1 | Proposed |
@@ -65,11 +65,13 @@ WS-AUTH-001-PLAN
 - Chunks 11-15 migrate bounded complete product/system surfaces.
 - Chunk 16 proves the complete initiative; it does not backfill missing audit
   or idempotency evidence.
-- `WS-POL-002-03` remains paused until the relevant project authorization
-  cutover is complete and the user explicitly resumes it.
+- `WS-POL-002-03` merged separately through PR #90 as `a7aa474`. This initiative
+  does not own it; post-merge memory completed through PR #94. `WS-POL-002-04`
+  remains inactive until the relevant project authorization cutover is complete
+  and the user explicitly starts it.
 
 ## Stop condition
 
-After planning review, stop. `WS-AUTH-001-01` does not become active without
-explicit human approval of D4-D10 plus an implementation start signal under the
-repository engineering loop.
+After WS-AUTH-001-01 review and PR preparation, stop. Do not start
+`WS-AUTH-001-02` or `WS-POL-002-04`; this worktree only reconciles the already
+merged PR #90 behavior with the authorization baseline.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md

@@ -17,25 +17,27 @@ specification's `/v1` examples will be reconciled during the baseline-adoption
 chunk. Workstream will not expose two versioned route trees as permanent
 aliases.
 
-## D3: Prioritize auth before WS-POL-002-03
+## D3: Prioritize authorization foundation
 
 Status: accepted by the user on 2026-07-11.
 
-`WS-POL-002` is paused after merged chunk 02. New post-submit approval APIs must
-not be built on authority rules that have been declared obsolete.
+Authorization remains the priority before later locked runtime hardening. The
+user separately directed and merged `WS-POL-002-03` through PR #90 as
+`a7aa474`; that completed approval API does not activate `WS-POL-002-04` or
+change the authorization priority.
 
 ## L0 human approval boundary
 
 The user explicitly approved the authorization direction, source precedence,
-API namespace, and priority recorded in D1-D3 on 2026-07-11. The remaining
-architecture and data-model choices in D4-D10 are proposed planning decisions,
-not autonomous implementation authority. Their explicit human approval must be
-recorded durably before `WS-AUTH-001-01` becomes active. Every bounded
-implementation chunk is then L1 and retains its own human PR/merge checkpoint.
+API namespace, and priority recorded in D1-D3 on 2026-07-11. On 2026-07-11,
+after the planning and post-merge memory PRs merged, the user said "ok start" in
+direct response to the recorded D4-D10 approval and separate chunk-start gate.
+That response approves D4-D10 and starts only `WS-AUTH-001-01`. Every bounded
+implementation chunk remains L1 and retains its own human PR/merge checkpoint.
 
 ## D4: No dual canonical authority
 
-Status: planning decision derived from the adopted contract.
+Status: accepted by the user on 2026-07-11.
 
 Token roles may be retained as non-authoritative diagnostic input during a
 bounded migration only. A protected command must never accept either a token
@@ -44,7 +46,7 @@ authorization for complete resource surfaces and remove the old check.
 
 ## D5: Preserve historical actor identifiers where classification is safe
 
-Status: planning decision.
+Status: accepted by the user on 2026-07-11.
 
 Existing `ActorIdentity.actor_id` values for externally verified callers are
 UUID5 strings and are referenced throughout tasks, submissions, checker runs,
@@ -58,7 +60,7 @@ not actor IDs, and never become canonical profile IDs.
 
 ## D6: Existing typed profiles do not become grants
 
-Status: planning decision.
+Status: accepted by the user on 2026-07-11.
 
 Observed or active `worker`, `reviewer`, `admin`, or `project_manager` profile
 rows do not create `AdminRoleGrant` or `ProjectRoleGrant` records. Skills and
@@ -67,15 +69,15 @@ metadata model only when required by an existing workflow.
 
 ## D7: Internal workers use explicit system authority
 
-Status: planning decision.
+Status: accepted by the user on 2026-07-11.
 
 Project setup, pre-review gating, reconciliation, and repair work use fixed
 Workstream system principals and registered system permissions. They do not
 receive fabricated human admin roles and do not become normal ActorProfiles.
 
 ## D8: Production issuer details remain configuration
 
-Status: planning decision.
+Status: accepted by the user on 2026-07-11.
 
 The token adapter will require explicit issuer, audience, JWKS URL, algorithm,
 scope, clock-skew, and cache configuration and will fail closed when incomplete.
@@ -84,7 +86,7 @@ deterministic adapter implementation with local JWKS fixtures.
 
 ## D9: Authority evidence is foundational
 
-Status: planning repair after internal review.
+Status: accepted by the user on 2026-07-11 after internal review repair.
 
 Request/correlation context, canonical idempotency records, and the shared
 append-only authority-event writer are introduced before canonical actor
@@ -95,7 +97,7 @@ or backfill the evidence model.
 
 ## D10: Legacy classification uses a versioned supported manifest
 
-Status: planning repair after internal review.
+Status: accepted by the user on 2026-07-11 after internal review repair.
 
 Non-empty legacy registries require a versioned JSON classification manifest
 processed by a supported management/preflight tool. Entries bind exact legacy
@@ -104,3 +106,34 @@ duplicates, stale/missing rows, mismatches, unknown fields, and unsupported
 kinds; supports dry-run; emits a checksum-bound report; and never writes grants.
 The schema migration consumes only validated staged classification evidence or
 fails closed. Manual SQL is not a supported path.
+
+## D11: Contributor is the human product term
+
+Status: accepted by the user on 2026-07-11.
+
+Contributor is the umbrella term for a human participating in Workstream. A
+contributor has an exact-project `submitter`, `reviewer`, or `both` grant.
+Celery, checker, setup, and reconciliation workers are internal services and
+background jobs, not human product roles. Existing human-role
+values using the old term are migration inputs to remove, not target product
+vocabulary or authority concepts.
+
+The field cutover is explicitly owned as follows:
+
+- `WS-AUTH-001-13` renames assignment ownership from legacy `worker_id` to
+  `contributor_id` across storage, models, services, schemas, audits, and tests.
+- `WS-AUTH-001-14` renames submission ownership/attestation and checker-result
+  visibility fields from legacy `worker_*` names to their `contributor_*`
+  equivalents across storage, models, services, schemas, audits, and tests. It
+  also renames the submission-policy JSON field `worker_facing_fix` to
+  `contributor_facing_fix` across derivation schemas, prompts, persistence, and
+  compatibility tests.
+- Revision replay is not implemented yet and must begin with
+  `contributor_claim_status`; it must not introduce the legacy name.
+- Contribution and payment records are owned by WS-CON and must begin with
+  `contributor_id`; no new legacy column is permitted.
+
+Each owning migration preserves values and immutable attribution, uses only a
+bounded transitional storage compatibility layer inside the migration chunk,
+exposes no legacy public API alias, and removes the old column/name before that
+chunk completes.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/INTENT.md

@@ -60,7 +60,7 @@ authorization as an alternate path.
 
 Implementation is split into PR-sized chunks. Token verification and canonical
 actor resolution precede grants. Grants precede centralized permission
-evaluation. Existing project, task, submission, checker, and worker surfaces
+evaluation. Existing project, task, submission, checker, and contributor surfaces
 move to the new authorization service in bounded cutover chunks.
 
 ## Alternatives considered
@@ -118,7 +118,8 @@ namespace and remains canonical.
 - Existing task lifecycle behavior except the explicit, audited release of an
   exclusive assignment when its actor/link/project authority is invalidated.
 - CI, test, documentation, and internal-review gates.
-- `WS-POL-002-03` remains paused until the authorization foundation is ready.
+- `WS-POL-002-03` remains independently owned by PR #90; this initiative does
+  not activate `WS-POL-002-04` before authorization proof and a separate start.
 
 ## How this will be proven
 
@@ -140,11 +141,8 @@ Resolved:
 - `WS-AUTH-001` is authoritative and supersedes the token-role bootstrap.
 - `/api/v1` remains the canonical API namespace.
 - `WS-AUTH-001` is prioritized before `WS-POL-002-03`.
-
-Pending before `WS-AUTH-001-01` activation:
-
-- Explicit human approval of proposed L0 architecture and data-model decisions
-  D4-D10 in `DECISIONS.md`. Planning review does not imply that approval.
+- D4-D10 were explicitly approved and `WS-AUTH-001-01` was started by the user
+  on 2026-07-11 after planning and post-merge memory closed.
 
 External deployment details such as issuer URL, JWKS URL, approved algorithms,
 claim names, and introspection policy are configuration inputs. Their absence
@@ -153,7 +151,6 @@ block the production live-token proof.
 
 ## Initial risk class
 
-L0 for initiative direction, auth model, and data-model strategy. D1-D3 are
-human-approved; D4-D10 remain at the explicit human approval gate above.
-Subsequent bounded implementation chunks are L1 and require their own chunk
-contracts, evidence, reviewer fanout, and human checkpoints.
+L0 for initiative direction, auth model, and data-model strategy. D1-D10 are
+human-approved. Subsequent bounded implementation chunks are L1 and require
+their own chunk contracts, evidence, reviewer fanout, and human checkpoints.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/PLAN.md

@@ -55,8 +55,9 @@ its old token-role authorization. No command accepts token role or local grant
 as alternate sufficient proof.
 
 Project configuration moves first because it is required to create project
-grants and later resume `WS-POL-002-03`. Task/submission/checker access follows
-after exact-project contributor grants and resource loaders exist.
+grants and to prove authorization before separately starting `WS-POL-002-04`.
+This initiative does not own or advance PR #90. Task/submission/checker access
+follows after exact-project contributor grants and resource loaders exist.
 
 Chunk 06 preserves task claim/start/submission operability through an explicitly
 named `LegacyWorkflowEligibilityCompatibility` adapter. It reads only

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/RISKS.md

@@ -2,9 +2,8 @@
 
 ## Classification
 
-- Initiative direction/auth/data-model strategy: L0, human-led; D1-D3 approved
-  by the user on 2026-07-11, D4-D10 require explicit recorded approval before
-  `WS-AUTH-001-01` activation
+- Initiative direction/auth/data-model strategy: L0, human-led; D1-D10 approved
+  by the user on 2026-07-11 before `WS-AUTH-001-01` activation
 - Bounded implementation chunks: L1 after the L0 planning gate
 - SLA: P1
 - Work type: architecture, authentication, authorization, migration, audit
@@ -28,7 +27,7 @@
 | A11 | API namespace forks | Client and documentation drift | Adopt `/api/v1` only and update references together | Route/OpenAPI and stale-reference scan |
 | A12 | Existing intake regresses | Project/task/checker pipeline stops | Run full current suite and API drill after actor migration and each cutover surface | Existing backend suite and live drill |
 | A13 | Auth initiative becomes one oversized PR | Review failure and hidden coupling | Sixteen bounded implementation chunks, one active at a time | Circuit-breaker and PR-size evidence |
-| A14 | WS-POL work resumes on obsolete auth | Rework and inconsistent authority | Keep WS-POL-002-03 paused in durable loop state | Loop-memory gate |
+| A14 | Later WS-POL work resumes on obsolete auth | Rework and inconsistent authority | Keep WS-POL-002-04 inactive until PR #90 merges, auth proof exists, and the user starts it | Loop-memory gate |
 | A15 | Authority mutation ships before durable evidence | Missing provenance cannot be reconstructed | Introduce correlation/idempotency/shared audit with canonical actor persistence | Atomic state+idempotency+event tests in every authority chunk |
 | A16 | Identity-link revocation strands final administrator | Administrative lockout despite active grant row | Apply AuthorityControl lock to link revoke plus grant/profile changes | Mixed concurrent link/grant/profile final-admin tests |
 | A17 | Canonical actor migration deletes typed-profile workflow eligibility before task/submission cutover | An intermediate merged release cannot claim, start, or submit work | Bounded non-authoritative workflow-eligibility adapter in chunk 06; remove task consumers in 13 and final consumer plus adapter in 14 | Full suite/API drill after chunks 06, 13, 14, and scanner proof in 15 |