feat(auth): register project setup service foundation by Abiorh001 · Pull Request #227 · Flow-Research/workstream

Abiorh001 · 2026-07-30T13:10:36Z

Chunk

WS-AUTH-001-12B — Fixed Project Setup Service Foundation

Goal and approved intent

Register workstream.project.setup as the eighth closed fixed-service identity with exactly four planned project-setup actions. Activate nothing, seed no actor or identity link, and leave runtime/PREP/project/Celery behavior unchanged.

What changed

Added the closed service identity and its exact four static matrix memberships.
Added migration 0043_project_setup_service after merged ART migration 0042_guide_extraction; it widens only the database identity constraint and refuses downgrade while the new identity is in use.
Preserved the historical 0023 seven-identity mapping contract instead of allowing the live registry to widen historical tooling.
Added migration, all-pairs denial, planned-handle denial, controlled provisioning, exact issuer/subject, and zero-grant proofs.
Updated the combined schema fingerprint and authorization planning/operations/specification docs.

Design and scope control

The existing fixed-service matrix and controlled provisioning route are reused. No new authorization protocol, runtime path, human/project grant, service actor seed, generic setup authority, route activation, Celery cutover, or prepared-handle serialization was added. Later chunks 12E/12F/12G own product-action activation; 12B2 owns final service cutover.

Acceptance proof

Local Ruff and py_compile: pass.
Focused authorization/mapping tests: 35 passed.
Combined isolated PostgreSQL route after ART 0042 and AUTH 0043: passed.
AUTH 0043 direct round-trip/downgrade tests: 2 passed.
Coverage: catalogue/identity/models 97.10%; migration tool 93.79%; migration 0043 100% (23/23 statements).
Alembic has one linear head: 0042_guide_extraction → 0043_project_setup_service.
Stale authorization docs, stale wording, Markdown links, and diff checks: pass.
No tests removed/skipped; no CI, dependency, runner, or coverage-threshold changes.

Internal review

Architecture PASS; security PASS; QA PASS; product/ops PASS; CI integrity PASS; docs PASS; reuse/dedup PASS WITH LOW RISKS; test delta PASS; senior engineering PASS WITH LOW RISKS. Post-main merge architecture, QA, and CI integrity re-reviews pass. All valid findings were repaired and no reviewer sessions remain open.

External review

CodeRabbit completed its substantive review; its migration-coverage finding was fixed and resolved. A previous full Backend run passed, then the documentation repair exact-head run exposed an unrelated existing lifecycle-concurrency flake; its unchanged retry passed. The current merged-main head b220b15f is running fresh Backend, Agent Gates, and incremental CodeRabbit checks.

Remaining risks and follow-up

Migration 0043 briefly takes ACCESS EXCLUSIVE on actor_profiles; this is documented and the migration is constraint-only. The four actions remain deliberately unavailable until their owning activation chunks.

Human review focus

Confirm exact identity/matrix cardinality, zero activation/zero seed, frozen 0023 isolation, linear ART-0042/AUTH-0043 migration custody, and downgrade safety. Human merge ownership remains with the user; this PR must not be merged without explicit approval.

Summary by CodeRabbit

New Features
- Added support for the workstream.project.setup service identity.
- Added planned authorization actions for project setup without enabling runtime authority.
- Added a database migration to recognize the new service identity and safely prevent downgrade while it is in use.
Documentation
- Updated authorization specifications, operational guidance, and workstream status records to reflect the new migration and catalogue totals.
Tests
- Expanded coverage for service identity provisioning, authorization matrices, migration behavior, and schema validation.

coderabbitai · 2026-07-30T13:10:44Z

📝 Walkthrough

Walkthrough

Adds the workstream.project.setup service identity, four planned authorization actions, migration 0043_project_setup_service, related tests, and updated AUTH-12B documentation and status records.

Changes

Project setup service registration

Layer / File(s)	Summary
Identity and authorization matrix `backend/app/modules/actors/*`, `backend/app/modules/authorization/catalogue.py`, `backend/tests/test_actor_migration_tools.py`, `backend/tests/test_authorization.py`, `docs/spec_authorization_service.md`	Registers `PROJECT_SETUP`, adds four planned actions and metadata, and updates registry and matrix assertions.
Identity constraint migration `backend/alembic/versions/0043_project_setup_service.py`, `backend/tests/test_alembic.py`, `backend/tests/conftest.py`	Adds migration `0043`, updates the service-identity constraint under lock, prevents downgrade when the identity is in use, and updates schema/reset validation.
Provisioning validation `backend/tests/test_auth.py`	Extends controlled service-actor provisioning coverage to verify project setup persistence, redaction, and zero project grants.
Operational records and chunk definition `.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/`, `.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/`, `docs/operations_authorization_service.md`	Updates AUTH-12B migration references, verification commands, custody totals, and chunk statuses.

Estimated code review effort: 3 (Moderate) | ~30 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ProvisioningTest
  participant ServiceActorProvisioning
  participant Database
  ProvisioningTest->>ServiceActorProvisioning: Provision PROJECT_SETUP actor
  ServiceActorProvisioning->>Database: Persist service identity state
  Database-->>ProvisioningTest: Return identity and grant counts
  ProvisioningTest->>ProvisioningTest: Assert redaction and zero project grants

Possibly related PRs

Flow-Research/workstream#132: Established the fixed service identity registry and matrix infrastructure extended by this change.
Flow-Research/workstream#186: Hardened the schema fingerprint and resettable-table contracts updated here.
Flow-Research/workstream#210: Modified the fixed service-action matrix and indexing logic extended by this change.

Suggested reviewers: abiorh-claw

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 51.72% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and matches the main change: registering the project setup service foundation.
Description check	✅ Passed	The description covers goal, changes, scope, proof, reviews, and risks, with only some template fields left implicit.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/ws-auth-001-12b-project-setup-service

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Abiorh001 · 2026-07-30T13:10:56Z

@coderabbitai review

coderabbitai · 2026-07-30T13:11:02Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Abiorh001 · 2026-07-30T13:24:21Z

@coderabbitai review

coderabbitai · 2026-07-30T13:24:28Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Abiorh001 · 2026-07-30T13:27:48Z

@coderabbitai review

coderabbitai · 2026-07-30T13:27:55Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
@.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-12B-project-setup-service.md:
- Around line 124-134: Update the project setup service coverage commands to
explicitly measure backend migration 0042, `0042_project_setup_service.py`, with
the existing 90% threshold, or document the hosted coverage check that verifies
it. Ensure the acceptance workflow actually validates coverage for this changed
migration module.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 61c00667-4a9e-4777-b8be-103fa17485a6

📥 Commits

Reviewing files that changed from the base of the PR and between 64dd9c9 and 7f25a9e.

📒 Files selected for processing (16)

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md
.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md
.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md
.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-12B-project-setup-service.md
.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-12B2-project-setup-service-cutover.md
backend/alembic/versions/0042_project_setup_service.py
backend/app/modules/actors/service_identities.py
backend/app/modules/actors/service_identity_migration.py
backend/app/modules/authorization/catalogue.py
backend/tests/conftest.py
backend/tests/test_actor_migration_tools.py
backend/tests/test_alembic.py
backend/tests/test_auth.py
backend/tests/test_authorization.py
docs/operations_authorization_service.md
docs/spec_authorization_service.md

…-project-setup-service # Conflicts: # backend/tests/conftest.py # backend/tests/test_alembic.py

feat(auth): register project setup service foundation

7f25a9e

Abiorh001 marked this pull request as ready for review July 30, 2026 13:11

coderabbitai Bot reviewed Jul 30, 2026

View reviewed changes

Comment thread ...WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-12B-project-setup-service.md

Abiorh001 added 2 commits July 30, 2026 14:41

docs(auth): enforce migration coverage proof

5fb253a

Merge remote-tracking branch 'origin/main' into codex/ws-auth-001-12b…

b220b15

…-project-setup-service # Conflicts: # backend/tests/conftest.py # backend/tests/test_alembic.py

abiorh-claw self-requested a review July 30, 2026 15:08

abiorh-claw approved these changes Jul 30, 2026

View reviewed changes

abiorh-claw merged commit 57c6711 into main Jul 30, 2026
5 checks passed

abiorh-claw deleted the codex/ws-auth-001-12b-project-setup-service branch July 30, 2026 16:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(auth): register project setup service foundation - #227

feat(auth): register project setup service foundation#227
abiorh-claw merged 3 commits into
mainfrom
codex/ws-auth-001-12b-project-setup-service

Abiorh001 commented Jul 30, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

Abiorh001 commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

Abiorh001 commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

Abiorh001 commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Abiorh001 commented Jul 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Chunk

Goal and approved intent

What changed

Design and scope control

Acceptance proof

Internal review

External review

Remaining risks and follow-up

Human review focus

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

Abiorh001 commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Abiorh001 commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Abiorh001 commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Abiorh001 commented Jul 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading