Plan ART-AUTH end-to-end authorization contract - #209
Merged
Conversation
📝 WalkthroughWalkthroughThis change redirects ART/AUTH dependency planning to WS-XINT-002 and adds its end-to-end contract documents. The contract defines catalogue reconciliation, PREP boundaries, activation and submission chunks, review artifact behavior, risks, status, and conformance requirements. ChangesART-AUTH end-to-end planning
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 12
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
@.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/AUTH_HANDOFF.md:
- Around line 97-100: The drift rule in AUTH_HANDOFF.md must explicitly require
deleting the six obsolete upload-session ActionIds/PermissionIds, with no
compatibility aliases or unavailable catalogue rows, and reference the exact
reconciliation contract. In
.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/DECISIONS.md lines 3-5,
enumerate the exact six IDs or link to the authoritative deletion list so the
retirement is mechanically verifiable.
In
@.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md:
- Around line 3-8: Reconcile the trusted-main baseline before defining the
activation reconciliation delta: in
.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md
lines 3-8, identify one exact baseline commit and update the preserved
PermissionId/ActionId counts; in
.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/DISCOVERY.md lines 5-14,
use that same commit and counts or explicitly document the intended snapshot
difference.
In
@.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-01-catalogue-reconciliation.md:
- Around line 35-39: Update the planned review-packet materialization mapping in
the catalogue reconciliation document to name the distinct new PermissionId
explicitly, rather than using artifact.review_packet.materialize as both action
and permission. Preserve the existing submission and binding mappings, and use
the requirement’s actual PermissionId for review-packet materialization.
- Around line 40-46: Make the reconciliation plan around the upload-session
removal explicitly enumerate all six ActionIds, all six PermissionIds, the
scheduler-expiry membership, and the expected closed-count/static-matrix
changes. Reference the reviewed catalogue artifact containing these exact
identifiers and evidence requirements, so reviewers can verify removal across
routes, commands, audits, idempotency, tests, migrations, and documentation.
- Around line 21-24: Restrict the recursive initiative-wide allowances in
.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-01-catalogue-reconciliation.md:21-24
to the exact catalogue-reconciliation artifacts. Also update
.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-02-prepared-feature-boundaries.md:26
to allow only the exact PREP-boundary artifacts and required evidence files.
In
@.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-02-prepared-feature-boundaries.md:
- Around line 55-59: The prepared feature-boundaries contract must define a
mechanism that permanently burns a single-use handle even when the caller
transaction rolls back, or explicitly change the transaction model to provide
that guarantee. Update the consumption semantics and related PostgreSQL
coverage, including a test that retries the same handle after a denial or
participant failure rollback and verifies it cannot be reused.
In
@.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-05B-submission-binding-consumption.md:
- Around line 5-6: Rename the transaction in the chunk summary from a
“ready-admission transaction” to a “Submission/binding transaction.” Clarify
that it consumes the durable ready admission created by WS-XINT-002-05A while
creating the immutable Submission and fixed artifact binding exactly once,
without re-admitting the work.
In
@.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-05C-checker-remediation-submission.md:
- Around line 35-40: Clarify the 05C remediation flow by naming the exact
preparation actions reused from 05A, the Submission creation/binding actions
reused from 05B, and the admission/context consumed during routing. Explicitly
require atomic commit of the final CheckerRun binding, immutable
remediation_source_checker_run_id, predecessor binding, locked task context,
assignment, allow_review state, and Submission creation/binding.
In
@.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-05D-human-review-revision.md:
- Around line 39-42: Update the revision lifecycle wording to describe a
revision-scoped context whose durable needs_revision obligation remains open
until atomic successor creation succeeds. Ensure the text does not imply the
obligation is closed before successor creation, preserving retry and concurrency
behavior.
In
@.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-08-conformance.md:
- Around line 54-67: Update the Verification block to explicitly cover every
conformance criterion, including Generated parity, full migration-matrix
validation, the exact stale authorization and artifact scanner categories, and
generated contract/documentation parity. Add the appropriate verification
commands where missing, or clearly map each criterion to the existing required
pass gates, including Backend / test and Agent Gates / agent-gates.
In @.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/DECISIONS.md:
- Around line 12-13: Update the decision entry describing artifact materializer
and binding identities to record the complete membership delta: add the two
review memberships and remove the scheduler-expiry membership, while preserving
that no new service identity is introduced.
In @.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md:
- Around line 41-54: Replace every `same` entry in the service-action table with
the explicit permission identifier matching its corresponding `ActionId`, while
preserving the existing overridden `artifact.binding.create` and
`artifact.checker_input.materialize` mappings.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 8f1caf38-0170-489f-93be-2bbe21378bc2
📒 Files selected for processing (21)
.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/AUTH_HANDOFF.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/DECISIONS.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/DISCOVERY.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/INTENT.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/PLAN.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/RISKS.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-01-catalogue-reconciliation.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-02-prepared-feature-boundaries.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-03-internal-worker-activation.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04-guide-activation.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-05A-initial-submission-preparation.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-05B-submission-binding-consumption.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-05C-checker-remediation-submission.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-05D-human-review-revision.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-06-checker-activation.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-07-review-artifact-activation.md.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-08-conformance.md
Collaborator
Author
|
External review update: all 12 CodeRabbit findings from head |
abiorh-claw
self-requested a review
July 27, 2026 06:34
abiorh-claw
approved these changes
Jul 27, 2026
This was referenced Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Chunk
WS-XINT-002-PLAN — ART-AUTH end-to-end planning amendment.
Goal
Freeze the complete v0.1 ART-to-AUTH dependency before ART implementation resumes.
Why this exists
The dependency had been discovered per ART chunk. This plan closes the catalogue, prepared-capability, service-matrix, submission, checker, review, recovery, and activation surfaces end to end.
What changed
Design chosen
One closed catalogue reconciliation and one reusable PREP extension merge first with all new actions unavailable. Narrow activation chunks follow only after exact hidden feature evidence exists. AUTH owns authority and evidence; ART owns bytes; product modules own lifecycle truth and typed fact composition.
Not in scope
No application code, migration, action activation, grant, provider behavior, or ART-03A implementation change.
Tests and evidence
Test delta
Planning-only Markdown change. No production or test code changed. Future contracts contain exact PostgreSQL, coverage, migration, and hosted verification requirements.
External review response
All twelve initial CodeRabbit comments were addressed on repair head
834ff13b. Product/ops corrected one overbroad suggestion so remediation reruns the checker spine before a newallow_reviewcan route it.Remaining risks
Implementation reviews must enforce forbidden-change lists despite some broad module globs. Baseline counts must be reconfirmed from then-current main before implementation.
Human review focus
Catalogue completeness, mandatory legacy deletion, permanent handle burn, human/service separation, and evidence-ordered activation.
Merge ownership
Human-owned. Do not merge without explicit approval for PR #209.