WS-XINT-003-01: reconcile review authorization contracts - #237
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThis documentation-only change establishes canonical REV-AUTH custody, reconciles policy persistence under XINT-003-02, splits XINT-002-07 into 07A and 07B, updates ownership boundaries, and records review evidence. No runtime action or availability is activated. ChangesREV-AUTH reconciliation
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Collaborator
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
@.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md:
- Around line 3-5: Remove or relabel the stale WS-AUTH-001-REV-REG and
WS-AUTH-001-REV-LIFECYCLE future-gate entries in CHUNK_MAP.md. Use the canonical
WS-XINT-003-08R, WS-XINT-003-08A, and WS-XINT-003-08B identifiers from
ACTION_CUSTODY.md, or explicitly mark the AUTH identifiers as historical aliases
linking to those chunks.
In
@.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/RISKS.md:
- Around line 3-5: Reword the REV controls statement in RISKS.md to describe
XINT-003-02, XINT-002-07A, and XINT-002-07B as planned custody rules rather than
active runtime protections. State that runtime protection begins only when the
named activation gates are enabled, without implying this PR currently activates
those controls.
In
@.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-03P-review-revision-policy-persistence.md:
- Around line 19-26: Clarify the policy persistence design so all external
mutations enter ProjectPolicyMutationService.replace_review_policy() or
replace_revision_policy(), including authorization preparation, grant checks,
and decision evidence. Define ProjectRepository.add_review_policy_version() and
add_revision_policy_version() as internal append-only persistence primitives
invoked only by that service, not as caller-facing mutation APIs.
In @.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md:
- Around line 15-17: Update the WS-XINT-002-08 dependency entry in the chunk map
to reference 03-07B instead of 03-07, and retain the existing 05A-D dependency
suffix so response-slot evaluation is included before conformance begins.
In
@.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-07-human-revision-activation.md:
- Around line 42-44: Update the XINT-002-07B description to match PLAN.md: state
that it extends the active binding evaluator to response slots and introduces
response-slot evaluation, while preserving that it changes no ActionId
availability and blocks CheckerRun-rooted remediation. Remove the claim that the
ART response-slot evaluator is already active.
In @.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DISCOVERY.md:
- Around line 156-158: Update the canonical ART reference list in DISCOVERY.md
to point to both current contracts, WS-XINT-002-07A and WS-XINT-002-07B, instead
of only WS-XINT-002-07-review-artifact-activation.md; alternatively, explicitly
mark the old reference as historical. Ensure the list reflects the split
ownership defined in this section and does not direct implementers to the
superseded contract.
In @.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/STATUS.md:
- Around line 23-27: Update the XINT-002-07 summary in STATUS.md to state that
07A is the planned reviewer-finding packet/evidence-binding availability
transition, while 07B is evaluator-only and cannot change ActionId availability;
keep the wording consistent with Line 6 and the detailed chunk contract.
- Around line 29-32: Update the “Next step” section in STATUS.md to remove the
obsolete “Open the chunk-01 PR” action and state the required hosted exact-head
gates, external review, human merge, and stopping before runtime policy work in
WS-XINT-003-02.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2f252e20-301e-4340-b45d-46c121950db8
📒 Files selected for processing (36)
.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/PLAN.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/RISKS.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-12D2-guide-bound-policy-mutations.md.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CHUNK_MAP.md.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DECISIONS.md.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/RISKS.md.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-03P-review-revision-policy-persistence.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07-review-artifact-activation.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07A-reviewer-artifact-activation.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07B-response-artifact-extension.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/ACTION_CUSTODY.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/CHUNK_MAP.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DECISIONS.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DISCOVERY.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/REVIEW_LOG.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/RISKS.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/STATUS.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-01-contract-reconciliation.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-04-review-context-activation.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-07-human-revision-activation.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-08A-review-recovery-activation.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-01-internal-review.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-01-pr-trust-bundle.mddocs/operations_authorization_service.mddocs/operations_roles_permissions.mddocs/spec_artifact_storage_service.mddocs/spec_authorization_service.mddocs/spec_review_lifecycle.md
Collaborator
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
Abiorh001
force-pushed
the
codex/ws-xint-003-rev-auth-end-to-end
branch
from
August 1, 2026 05:15
85c94f0 to
f94bc17
Compare
Abiorh001
force-pushed
the
codex/ws-xint-003-01-contract-reconciliation
branch
from
August 1, 2026 05:16
7a37376 to
e568d97
Compare
Abiorh001
force-pushed
the
codex/ws-xint-003-01-contract-reconciliation
branch
from
August 1, 2026 05:27
e568d97 to
7ef2fac
Compare
abiorh-claw
self-requested a review
August 1, 2026 10:49
abiorh-claw
previously approved these changes
Aug 1, 2026
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md (1)
10-11: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winName XINT-003-02 as the sole policy writer.
The plan promises one persistence path but does not identify the sole append-only writer. This leaves the boundary between REV-03P, AUTH-12D2, and legacy paths open to duplicate writers, which can violate immutable-version and active-policy invariants. State explicitly that XINT-003-02 is the only policy-writer path, while REV-03P owns semantics and validation and AUTH-12D2 owns authorization, PREP consumption, and evidence.
Proposed wording
- REV owns semantics; AUTH-12D2 owns authorization and PREP consumption. + XINT-003-02 is the sole append-only policy-writer path. REV owns + immutable/versioned semantics and validation; AUTH-12D2 owns authorization, + PREP consumption, and authorization evidence. ... - AUTH-12D2 protects the two mutation routes and supplies authorization evidence. + AUTH-12D2 authorizes the two mutation routes and supplies authorization + evidence; no legacy or feature-owned path writes policy rows.Also applies to: 79-83
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md around lines 10 - 11, Update the policy cutover statements in PLAN.md to explicitly designate XINT-003-02 as the sole append-only policy-writer path. Preserve REV-03P ownership of policy semantics and validation, and state that AUTH-12D2 owns authorization, PREP consumption, and evidence; exclude duplicate writes from legacy and other paths.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/ACTION_CUSTODY.md:
- Around line 58-59: Reconcile the artifact.submission_bundle.prepare assignment
in ACTION_CUSTODY.md with ACTIVATION_CUSTODY.md: confirm the upstream contract
and update both custody documents consistently, or explicitly change the
upstream assignment if WS-XINT-002-05D is authoritative. Before modifying the
adjacent submission.create row, verify and preserve its separate activation wave
assignment.
In @.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md:
- Around line 27-29: Update step 8 in the plan to state that it only records
future planned work for the four privileged lifecycle/recovery actions;
explicitly preserve the 08R registration boundary by specifying that runtime
registration and activation occur in 08R.
In
@.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-01-pr-trust-bundle.md:
- Around line 33-36: Clarify the references to 07A in the trust-bundle document
so they describe planned or metadata activation only, not runtime activation or
availability. Update both the 33-36 and 54-57 statements to explicitly preserve
that runtime behavior and ActionId activation remain unavailable, while keeping
the distinction that 07B extends response evaluation.
- Around line 59-91: Add the exact reviewed PR HEAD commit SHA to the
trust-bundle document near the execution or review metadata. Verify that the
recorded SHA matches the final code state covered by the listed checks and
external review before human merge.
---
Outside diff comments:
In @.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md:
- Around line 10-11: Update the policy cutover statements in PLAN.md to
explicitly designate XINT-003-02 as the sole append-only policy-writer path.
Preserve REV-03P ownership of policy semantics and validation, and state that
AUTH-12D2 owns authorization, PREP consumption, and evidence; exclude duplicate
writes from legacy and other paths.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: da81d271-c748-4651-b128-ce9c29fe8cf9
📒 Files selected for processing (36)
.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/PLAN.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/RISKS.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-12D2-guide-bound-policy-mutations.md.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CHUNK_MAP.md.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DECISIONS.md.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/RISKS.md.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md.agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-03P-review-revision-policy-persistence.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07-review-artifact-activation.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07A-reviewer-artifact-activation.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07B-response-artifact-extension.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/ACTION_CUSTODY.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/CHUNK_MAP.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DECISIONS.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DISCOVERY.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/REVIEW_LOG.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/RISKS.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/STATUS.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-01-contract-reconciliation.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-04-review-context-activation.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-07-human-revision-activation.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-08A-review-recovery-activation.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-01-internal-review.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-01-pr-trust-bundle.mddocs/operations_authorization_service.mddocs/operations_roles_permissions.mddocs/spec_artifact_storage_service.mddocs/spec_authorization_service.mddocs/spec_review_lifecycle.md
🚧 Files skipped from review as they are similar to previous changes (33)
- .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md
- .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07B-response-artifact-extension.md
- .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/RISKS.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/CHUNK_MAP.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DECISIONS.md
- .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md
- .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07-review-artifact-activation.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-08A-review-recovery-activation.md
- .agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/RISKS.md
- .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07A-reviewer-artifact-activation.md
- .agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/DECISIONS.md
- .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-12D2-guide-bound-policy-mutations.md
- docs/operations_roles_permissions.md
- docs/spec_review_lifecycle.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/RISKS.md
- .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-01-internal-review.md
- docs/spec_artifact_storage_service.md
- .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md
- .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/STATUS.md
- .agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/CHUNK_MAP.md
- .agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/DISCOVERY.md
- docs/operations_authorization_service.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-07-human-revision-activation.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-04-review-context-activation.md
- .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/PLAN.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/chunks/WS-XINT-003-01-contract-reconciliation.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/REVIEW_LOG.md
- docs/spec_authorization_service.md
- .agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/PLAN.md
- .agent-loop/initiatives/WS-REV-001-review-revision-lifecycle/chunks/WS-REV-001-03P-review-revision-policy-persistence.md
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
@.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-01-external-review-response.md:
- Around line 21-24: Update the “Human decisions needed” section to avoid
claiming that no decisions are needed. Record approval evidence and scope for
action completeness, policy-writer boundaries, ART ownership, and activation
sequencing if those decisions are complete; otherwise state that this response
does not close the required human review.
- Around line 13-15: Update the review record for commit
8250adf3ac52bc4bfee69fd5299dd70f21fb3ad1 to include pass/fail results for every
required command and check, plus immutable GitHub check-run identifiers attached
to that exact PR head. Complete this evidence in the required commands/checks
section before marking the response final.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 404efa74-f86f-494a-9468-ac4fefe43d96
📒 Files selected for processing (5)
.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/ACTION_CUSTODY.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/REVIEW_LOG.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-01-external-review-response.md.agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-01-pr-trust-bundle.md
🚧 Files skipped from review as they are similar to previous changes (4)
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/PLAN.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/reviews/WS-XINT-003-01-pr-trust-bundle.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/ACTION_CUSTODY.md
- .agent-loop/initiatives/WS-XINT-003-rev-auth-end-to-end/REVIEW_LOG.md
abiorh-claw
self-requested a review
August 1, 2026 12:29
abiorh-claw
approved these changes
Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Trust Bundle: WS-XINT-003-01
Chunk
WS-XINT-003-01— REV-AUTH Contract Reconciliation.Goal
Settle complete action custody, the sole review/revision policy writer path,
and the safe ART finding/response activation order before runtime work.
Intent and result
Reconcile the complete review/revision authorization contract before runtime
work. The result is one canonical custody inventory, one future policy writer,
and one safe ART evidence-binding activation sequence. No behavior is active.
Scope
Planning/canonical Markdown only. No backend code, Alembic migration, catalogue
mapping, runtime
ActionOwner, service provisioning, route, job, or productlifecycle behavior changed.
Design
review.*actions stay registered planned.authorization, and decision evidence.
will introduce the sole append-only writer and retire the four named legacy
callable mutation/construction paths.
WS-XINT-002-07. Planning sub-wave 07A aloneactivates packet/finding binding; 07B only extends response evaluation.
follows both.
Proof
The canonical table contains 25 local human/privileged/service rows, four
externally owned shared actions, and 29 matching hidden-feature dependency
rows. It fixes exact principals, scopes, resources, owners, waves, identities,
static membership, forbidden principals, and audit/provenance facts.
Acceptance criteria proof
two policy actions, and four XINT-002 shared actions are classified.
an exact identity, membership, mode/scope, forbidden principals, and audit
facts.
path plus the exact legacy mutators to retire.
WS-XINT-002-07; 07A alone changes availability,and 07B is evaluator-only after hidden REV obligation/preparation behavior.
unregistered.
Commands run
python3 scripts/check_stale_authorization_docs.pypython3 scripts/check_stale_artifact_contracts.pypython3 scripts/check_stale_workstream_wording.pypython3 scripts/check_markdown_links.pygit diff --checkTest delta
No test, skip, exclusion, or assertion changed. The hosted Backend semantic-
lane suite and coverage gate run on the exact PR head.
CI integrity
No workflow, dependency, test runner, Ruff rule, coverage threshold, or package
script changed. Agent Gates and Backend must pass on the exact final head.
Deterministic stale-doc, artifact-contract, Workstream wording, Markdown-link,
and whitespace checks pass. No tests or CI configuration were changed or
weakened. Hosted exact-head Agent Gates and Backend CI remain required.
Review
Architecture, security/auth, product/operations, QA/test, docs, and
reuse/dedup passed. Senior engineering passed with low stale-wording risks,
which were corrected. The remaining filename observation is documented in the
internal review and does not create duplicate identifiers or behavior.
External review
CodeRabbit is required. Every valid comment must be fixed or explicitly
resolved before human merge.
Remaining risks
This PR defines future enforcement but activates none. Each later runtime chunk
must refresh exact current-main symbols, migration head, hidden feature
manifest, and denial/concurrency proof before activation.
Follow-up work
After human merge and a separate explicit request, refresh WS-XINT-003-02. Do
not begin runtime policy work automatically.
Human review focus
Confirm action completeness, the sole policy writer boundary, ART runtime owner
versus sub-wave distinction, the 07B-before-human-activation order, and absence
of runtime activation.
Human merge ownership
Only the human may merge this PR.
Summary by CodeRabbit
Documentation
Chores