feat(artifacts): add bounded guide text extraction

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DECISIONS.md

@@ -408,9 +408,14 @@ The v0.1 extraction-policy limits are fixed, not caller-selectable:
 |---|---:|---|---|
 | parser input per item | 32 MiB | 03B3A framework before dispatch | `limit_exceeded` |
 | canonical output per item | 4 MiB | 03B3A streaming output collector | `limit_exceeded` |
+| subprocess CPU time per item | 30 seconds | 03B3A OS resource limit | `limit_exceeded` |
 | aggregate agent material | 12 MiB | 03B4 input assembler | `limit_exceeded` |
 | subprocess wall time per item | 60 seconds | 03B3A process supervisor | `limit_exceeded` |
 | subprocess address space | 512 MiB | 03B3A OS isolation boundary | `limit_exceeded` |
+| subprocess output file | 4 MiB | 03B3A OS file-size limit | `limit_exceeded` |
+| subprocess open descriptors | 32 | 03B3A OS descriptor limit | `limit_exceeded` |
+| subprocess children/core dumps | 0 | 03B3A OS process/core limits | `parser_failure` |
+| JSON container depth | 64 | 03B3A JSON adapter | `limit_exceeded` |
 | container entries | 2,000 | 03B2 container inspector | `limit_exceeded` |
 | decompressed container bytes | 128 MiB | 03B2 container inspector | `limit_exceeded` |
 | container nesting depth | 8 | 03B2 container inspector | `limit_exceeded` |
@@ -429,14 +434,30 @@ termination, and executor-loss tests are mandatory. Executor loss leaves no
 successful extraction usage record; a current-generation retry starts from
 fresh materialization and authority.
 
+03B3A accepts only UTF-8 text-family input with at most one leading UTF-8 BOM,
+normalizes CRLF/CR to LF, and rejects NUL or controls other than tab/LF.
+Markdown is bounded text, not rendered markup. JSON rejects duplicate keys and
+non-finite numbers and uses sorted-key compact UTF-8 serialization. CSV uses the
+fixed strict Python `excel` dialect and serializes exact row arrays as compact
+UTF-8 JSON. After trusted imports, the Linux extraction child installs a
+default-deny libseccomp filter with an explicit descriptor-only syscall
+allowlist. Parsing then uses only pre-opened standard descriptors; unavailable
+isolation fails closed. An exact-lineage durable budget permits the initial
+materialization plus at most one fresh-authority retry for `parser_failure` or
+current-lineage cancellation. Deterministic terminal outcomes replay without
+another materialization. Failed attempts may retain
+bounded status evidence, but never canonical output payload, successful usage,
+or a report.
+
 ## D43 - Canonical Extraction Records, Not Implicit Provider Writes
 
-v0.1 persists an immutable content-derived extraction representation in
-PostgreSQL keyed by original content, format, extractor/version, and policy
-version, with output digest, omission facts, status, and bounded error code. A
-separate immutable usage record binds it to the exact guide binding, source
-item, setup run, and generation. AUTH-04B grants read and binding only, so ART
-does not use read authority to create a provider object.
+v0.1 persists bounded immutable attempt evidence with status/error separately
+from the successful content-derived representation. Successful content is
+keyed by original content, format, extractor/version, and policy version and
+stores canonical output, its digest, and omission facts without an error code.
+A separate immutable usage record binds that success to the exact guide
+binding, source item, setup run, and generation. AUTH-04B grants read and
+binding only, so ART does not use read authority to create a provider object.
 
 ## D44 - Sufficiency Consumes Complete Verified Material
 

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/REVIEW_LOG.md

@@ -203,3 +203,15 @@
   the passing repository-owned hosted docstring gate.
 - Senior-engineering, security, and QA repair-delta re-reviews pass with no
   blockers before the repaired PR head is published.
+
+## WS-ART-001-03B3A
+
+- Implemented the hidden default-deny extraction framework and standard-library
+  text, Markdown, JSON, and CSV canonicalization slice.
+- Initial L1 review found blocking sandbox, provenance, concurrency, workspace,
+  retry, terminal replay, schema-proof, and test-surface issues.
+- Repairs added exact guide/content locks, classification predicates, durable
+  two-slot retry custody, extracted-attempt usage fencing, cleanup recovery,
+  fixture-only resource probes, and expanded boundary/migration evidence.
+- Architecture, security, senior engineering, product/ops, QA, docs, reuse,
+  CI-integrity, and test-delta repair reviews pass with no blockers.

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-03B3A-extraction-framework-text.md

@@ -26,10 +26,33 @@ and standard-library text, Markdown, JSON, and CSV extraction.
 
 - no-network subprocess enforces input/output, CPU/time/memory, row/cell,
   encoding, nesting, cancellation, and cleanup limits;
+- after trusted standard-library imports, the Linux child installs a
+  default-deny libseccomp filter with an explicit syscall allowlist before
+  parsing. Network/process creation, new file opens, filesystem mutation, and
+  kernel-introspection surfaces return `EPERM`. Parsing is
+  descriptor-only over pre-opened stdin/stdout/stderr; missing filter support
+  fails closed as `parser_failure`. Launch uses `shell=False`, closed
+  extraneous file descriptors, one scratch-owned working directory, and a minimal
+  allowlisted environment containing no provider, proxy, database, OpenAI, or
+  authorization secrets;
 - the framework rejects parser input above 32 MiB, canonical output above
-  4 MiB, execution beyond 60 seconds, or address-space use above 512 MiB;
+  4 MiB, CPU use beyond 30 seconds, wall execution beyond 60 seconds,
+  address-space use above 512 MiB, output files above 4 MiB, more than 32 open
+  descriptors, any child process, or any core dump. Numeric resource breaches
+  record `limit_exceeded`; prohibited process creation, unavailable isolation,
+  or abnormal child termination records `parser_failure`;
   CSV rejects more than 100,000 rows, 1,000,000 cells, or 32,768 characters in
-  one cell; every breach deterministically records `limit_exceeded`;
+  one cell; every CSV numeric breach records `limit_exceeded`;
+- text-family input accepts UTF-8 only, permits at most one leading UTF-8 BOM,
+  normalizes CRLF and CR to LF, rejects NUL and control characters other than
+  tab/LF, and otherwise preserves text exactly. Markdown uses the same rules
+  without rendering or parsing;
+- JSON rejects duplicate object keys, non-finite numbers, invalid UTF-8, and
+  nesting deeper than 64 containers; it canonicalizes with recursively sorted
+  keys, compact separators, UTF-8 characters unescaped where JSON permits, and
+  no trailing newline. CSV uses the fixed Python `excel` dialect with strict
+  quoting, preserves empty/ragged cells, and canonicalizes to compact UTF-8 JSON
+  containing the exact row arrays;
 - tests cover each exact boundary and one-over boundary, timeout and memory
   termination, cancellation, executor loss, scratch cleanup, and retry through
   fresh materialization and fresh authority with no partial durable output;
@@ -38,13 +61,24 @@ and standard-library text, Markdown, JSON, and CSV extraction.
   and policy; separate usage records name item, binding, run, and generation;
 - text/Markdown/JSON/CSV canonicalization and error statuses are deterministic;
 - unsupported raw input never reaches an agent or provider write;
+- failed attempts may persist one bounded status/error record, but only an
+  `extracted` current-generation result may retain canonical output and create a
+  usage record; failure, cancellation, or executor loss creates no successful
+  usage, report, or partial output payload;
+- transient failure evidence is attempt-scoped and cannot occupy or poison the
+  deterministic successful content key; a later fresh-authority/materialization
+  retry may publish the one immutable successful content record;
+- a durable exact-lineage budget reserves at most the initial materialization
+  and one retry. Only `parser_failure` or current-lineage cancellation may use
+  the second slot; deterministic terminal outcomes replay without another
+  provider read;
 - changed subsystem coverage is at least 90%; repository coverage stays 78%.
 
 ## Verification
 
 ```bash
 (cd backend && .venv/bin/python -m ruff check app tests scripts)
-(cd backend && WORKSTREAM_TEST_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/workstream_test .venv/bin/pytest tests/test_alembic.py tests/test_guide_extraction.py -q --cov=app --cov-report=term-missing --cov-fail-under=0)
+(cd backend && WORKSTREAM_TEST_DATABASE_URL=postgresql+asyncpg://workstream:workstream@localhost:5433/workstream_test .venv/bin/pytest tests/test_alembic.py tests/test_guide_bindings.py tests/test_guide_extraction.py -q --cov=app --cov-report=term-missing --cov-fail-under=0)
 (cd backend && .venv/bin/coverage report --precision=2 --fail-under=78)
 (cd backend && .venv/bin/coverage report --include='app/modules/artifacts/*,app/core/config.py,app/interfaces/artifacts.py' --precision=2 --fail-under=90)
 python3 scripts/check_stale_artifact_contracts.py
@@ -53,6 +87,14 @@ python3 scripts/test_agent_gates.py
 git diff --check
 ```
 
+Architecture/security tests must also prove that 03B3A introduces no direct
+provider read/write, concrete adapter import, public raw-extraction route,
+in-process untrusted parser, plugin discovery, production parser dependency,
+agent invocation, AUTH availability edit, secret-bearing child environment, or
+cross-lineage extraction lookup. A real child probe must fail DNS/socket access.
+The same probe must fail reads of a known outside-scratch file and writes both
+inside and outside scratch after the descriptor-only filter is installed.
+
 The exact PR head must pass hosted `Backend / test` and `Agent Gates / agent-gates`.
 Every changed production module, including repository, schema, migration-owned
 service, and composition surfaces, must be included in a dedicated retained

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-03B3A-external-review-response.md

@@ -0,0 +1,99 @@
+# External Review Response: WS-ART-001-03B3A
+
+## Comments addressed
+
+- Made cancellation evidence persistence resistant to repeated cancellation and
+  bounded by a five-second timeout while preserving cancellation as the caller
+  result.
+- Made concurrent extracted-content publication deterministic with PostgreSQL
+  `ON CONFLICT DO NOTHING`, locked reload, and exact-output comparison.
+- Added durable TTL-bearing extraction-workspace custody to the canonical
+  scratch ledger and stale crash cleanup before ownership release.
+- Added a real outside-scratch write denial probe.
+- Normalized relative imports in the extraction architecture boundary test.
+- Repaired hosted database tests that inserted dependent extraction rows before
+  their classification was flushed and invoked synchronous Alembic from an
+  active event loop.
+- Rebased onto merged AUTH-12A and moved guide extraction to Alembic revision
+  `0042_guide_extraction`, preserving the AUTH project-mutation evidence head.
+- Made successful replay selection deterministic and replaced duplicated policy
+  literals with the canonical extraction-policy constant.
+- Moved extraction workspace ownership behind a public
+  `ArtifactScratchManager` context manager, made cleanup recursively bounded and
+  descriptor-relative, and made every ledger mutation preserve explicit
+  workspace custody without hidden write-time backfill.
+- Added nested parser-residue cleanup coverage and made request fixtures use
+  explicit lineage fields.
+- Scoped successful replay to the current extraction policy on both the attempt
+  and canonical content, with PostgreSQL regression coverage for obsolete-policy
+  success evidence.
+- Prevented a second materialization slot from being claimed unless a current-
+  policy `parser_failure` or `cancelled` attempt durably proves retry authority.
+- Serialized the remaining retry slot with a PostgreSQL row lock and added a
+  concurrent-claim regression proving exactly one request receives slot two.
+- Made unresolved seccomp syscall names fail as `isolation_unavailable`, made
+  CSV's parser ceiling subordinate to the policy cell limit, validated every
+  child error envelope before persistence, and made worker result writes
+  short-write safe.
+- Scoped failed-attempt numbering to the current extraction policy, replaced
+  the large-text control scan with the equivalent bounded control-range regex,
+  and repaired the final stale refused-downgrade head assertion.
+
+## Comments deferred
+
+- The suggestion to add compat and x32 ABIs to the libseccomp allow-list was not
+  adopted. The native-only libseccomp filter rejects an architecture mismatch;
+  adding alternate architectures would expand the accepted syscall surface.
+  Failure to install or load the native filter remains
+  `isolation_unavailable`.
+- The suggestion to return successful extracted content when workspace cleanup
+  fails was not adopted. An uncertain cleanup result is a scratch-custody
+  failure, so the operation remains fail closed while the workspace stays in
+  the manager-owned pending-cleanup set.
+- The suggestion to let a claimed slot with no durable attempt authorize slot
+  two was not adopted. The reviewed contract permits slot two only after a
+  durable current-policy `parser_failure` or `cancelled` attempt; process death
+  before that evidence is an intentionally fail-closed custody outcome.
+- The suggestion to replace the pinned descriptor workspace path with a real
+  pathname was not adopted. Extraction is deliberately process-local and
+  descriptor-scoped; converting it back to a name-resolved path would weaken
+  the containment boundary. Cleanup failure also intentionally remains the
+  visible result rather than publishing output while scratch custody is
+  uncertain.
+
+## Human decisions needed
+
+None.
+
+## Commands rerun
+
+- `ruff format` and `ruff check` on every repair file.
+- Focused extraction isolation, workspace lifecycle, stale cleanup, and
+  architecture tests: 6 passed.
+- After rebasing onto `64dd9c98`, changed-file Ruff format/check, Alembic
+  single-head inspection, diff integrity, Markdown links, and stale-wording
+  checks pass. The earlier 37-test focused run passed before the rebase repair;
+  the refreshed PostgreSQL and focused proof is delegated to hosted CI because
+  this worktree's incomplete local test environment resolves a conflicting
+  global pytest plugin. Hosted checks must be refreshed on the new exact PR
+  head.
+- The final worker/protocol repair slice passed 10 focused synchronous tests;
+  direct probes also confirmed a 200,000-byte CSV cell is classified as
+  `limit_exceeded/csv_cell_size_limit` and non-string child output as
+  `parser_failure/invalid_executor_output`.
+
+## Remaining risks
+
+The full PostgreSQL, schema-fingerprint, and repository coverage proof remains
+delegated to the hosted Backend gate. No CI threshold or test assertion was
+weakened.
+
+The first reconciled-head Backend run migrated successfully through
+`0042_guide_extraction` and observed the expected changed public-schema
+fingerprint, then failed closed because the committed custody constant still
+described the pre-extraction schema. The constant is updated only from that
+hosted isolated-database observation; the next exact head must rerun every lane.
+The next hosted run passed 2,280 tests across the other lanes and exposed one
+new obsolete-policy replay fixture whose classification dependency had not been
+flushed before its attempt insert. The fixture now flushes the classification
+first; this is test setup ordering, not a production-path relaxation.

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/reviews/WS-ART-001-03B3A-internal-review-evidence.md

@@ -0,0 +1,78 @@
+# Internal Review Evidence: WS-ART-001-03B3A
+
+Reviewed against trusted main: `64dd9c98`
+
+Reviewed at: `2026-07-29`
+
+## Candidate
+
+Hidden, bounded extraction framework for verified guide text, Markdown, JSON,
+and CSV with exact provenance, deterministic successful content, and no agent,
+provider-write, Celery, submission, or AUTH activation behavior.
+
+## Deterministic Evidence
+
+- changed-file Ruff, mapper configuration, Python compilation, and
+  `git diff --check`: PASS;
+- the pre-rebase candidate's focused extraction plus architecture suite passed
+  41 tests; refreshed focused and PostgreSQL proof remains delegated to hosted
+  CI for the reconciled head;
+- real default-deny seccomp probes deny network, file opens, filesystem writes,
+  and process creation after trusted imports;
+- real child probes cover CPU, wall, memory, and abnormal executor outcomes;
+- schema-contract coverage includes successful extraction/usage, extracted-
+  attempt fencing, retry outcomes, and populated downgrade refusal;
+- stale artifact-contract and Markdown-link scans: PASS;
+- exact hosted Backend and Agent Gates remain required on the PR head.
+
+## Reviewer Results
+
+| Reviewer | Result | Blocking findings |
+|---|---|---|
+| senior engineering | PASS WITH LOW RISKS | none |
+| architecture | PASS WITH LOW RISKS | none |
+| QA/test | PASS WITH LOW RISKS | none |
+| security/auth | PASS WITH LOW RISKS | none |
+| product/ops | PASS WITH LOW RISKS | none |
+| reuse/dedup | PASS WITH LOW RISKS | none |
+| CI integrity | PASS WITH LOW RISKS | none |
+| test delta | PASS WITH LOW RISKS | none |
+| docs | PASS | none |
+
+The pre-rebase CodeRabbit/hosted-CI repair delta was re-reviewed by senior engineering,
+architecture/reuse, QA/test-delta, security, product/ops, and CI/docs. All
+tracks pass after one valid legacy-ledger compatibility blocker was repaired
+with exact prior-v2 normalization and restart coverage.
+The final worker-coverage test delta separately passed security, QA/test-delta,
+and CI/docs review; it leaves every real subprocess isolation probe intact.
+The AUTH-12A rebase and final external-review repair delta passed refreshed
+senior, architecture/reuse, QA/test-delta, security, product/ops, and CI/docs
+review after policy replay and concurrent retry-custody findings were repaired.
+The subsequent hosted schema-fingerprint and CodeRabbit worker/protocol delta
+also passed focused QA, security, senior/reuse, and CI/docs re-review.
+
+## Material Repairs
+
+- replaced default-allow syscall denial with a default-deny allowlist;
+- serialized guide generation and shared-content publication through canonical
+  row locks;
+- revalidated digest, size, media type, detector, binding, run, and generation;
+- fenced successful usage to an exact `extracted` attempt in PostgreSQL;
+- added cleanup-tracked scratch workspaces and post-launch child reaping;
+- added a durable two-slot exact-lineage materialization budget so only
+  executor failure or current-lineage cancellation may retry;
+- scoped deterministic success replay to the current extraction policy and
+  denied second-slot claims without durable current-policy retry evidence;
+- moved destructive resource probes out of the production worker.
+
+## Accepted Low Risks
+
+- A later complex-format chunk should make the registry explicitly table-driven.
+- The existing and extraction lineage queries remain similar but not yet
+  identical enough to justify a shared selector.
+- Hosted PostgreSQL concurrency and repository coverage gates remain the final
+  publication proof.
+
+Valid findings addressed: yes
+
+Open sub-agent sessions: none