docs(artifacts): split complex format extractor work

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/AUTH_HANDOFF.md

@@ -17,7 +17,8 @@ activation custody, and availability.
    exact resource/guard/surface manifest.
 3. AUTH activates only that exact action through a separately reviewed AUTH
    contract after consuming ART evidence.
-4. ART-03B1, 03B2, 03B3A, 03B3B, and 03B4 implement hidden authoritative binding, exact setup
+4. ART-03B1, 03B2, 03B3A, 03B3B1, 03B3B2, 03B3B3A, 03B3B3B,
+   03B3B3C, 03B3B3D, 03B3B4, and 03B4 implement hidden authoritative binding, exact setup
    generation, verified materialization, bounded extraction, and Celery
    sufficiency continuation. `artifact.guide_source.binding.create` maps to
    fixed permission `artifact.binding.create`; `artifact.guide_source.read`

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/CHUNK_MAP.md

@@ -21,8 +21,14 @@ Each chunk is one PR. No later chunk starts automatically.
 | `WS-ART-001-03B1` | Add authoritative verified guide-source bindings and an exact setup-generation fence while fixed-service binding remains unavailable. | L1 | Proposed after 03A and AUTH-04A |
 | `WS-ART-001-03B2` | Add fixed-reader verified materialization, artifact incidents, and canonical format detection in bounded ART scratch. | L1 | Proposed after 03B1 |
 | `WS-ART-001-03B3A` | Add the isolated extraction framework, canonical records, and text/Markdown/JSON/CSV extractors. | L1 | Proposed after 03B2 |
-| `WS-ART-001-03B3B` | Add explicitly approved PDF/OOXML/image-metadata extractors on the proven framework. | L1 | Proposed after 03B3A and dependency approval |
-| `WS-ART-001-03B4` | Feed only complete same-generation canonical extracted material into the existing Celery sufficiency pipeline. | L1 | Proposed after 03B3B |
+| `WS-ART-001-03B3B1` | Approve the exact pinned complex-parser dependency allowlist and deterministic CI gate without installing packages or changing runtime code. | L1 | Proposed after 03B3A |
+| `WS-ART-001-03B3B2` | Install only the approved PDF dependency and add bounded PDF text extraction. | L1 | Proposed after 03B3B1 approval |
+| `WS-ART-001-03B3B3A` | Add shared bounded OOXML container/security capabilities without document extraction. | L1 | Proposed after 03B3B1 approval |
+| `WS-ART-001-03B3B3B` | Add bounded DOCX extraction on the approved OOXML capability. | L1 | Proposed after 03B3B3A |
+| `WS-ART-001-03B3B3C` | Add bounded PPTX extraction on the approved OOXML capability. | L1 | Proposed after 03B3B3A |
+| `WS-ART-001-03B3B3D` | Add bounded XLSX extraction on the approved OOXML capability. | L1 | Proposed after 03B3B3A |
+| `WS-ART-001-03B3B4` | Install only the approved image dependency and add PNG/JPEG/WebP structural metadata extraction. | L1 | Proposed after 03B3B1 approval |
+| `WS-ART-001-03B4` | Feed only complete same-generation canonical extracted material into the existing Celery sufficiency pipeline. | L1 | Proposed after 03B3B2, 03B3B3B, 03B3B3C, 03B3B3D, and 03B3B4 |
 | `WS-ART-001-03C` | Remove legacy guide-source identity and add exact same-generation setup continuation. | L1 | Proposed after 03B1-03B4 and AUTH-04B |
 | `WS-ART-001-04A` | Accept one outer ZIP in bounded scratch, safely inspect its tree, normalize executable intent, produce canonical identities, and reject unchanged work before provider I/O. | L1 | Proposed after 03C and AUTH planned action registration |
 | `WS-ART-001-04B` | Run mandatory platform and locked Project Guide pre-submit checks against the same scratch-bound tree and executable semantics without durable storage. | L1 | Proposed after 04A |
@@ -50,8 +56,16 @@ OBJECT-STORAGE-AMENDMENT
 -> 03B1 authoritative guide binding/setup generation
 -> 03B2 verified materialization/format detection
 -> 03B3A isolated extraction framework/text formats
--> 03B3B approved complex document/image-metadata extractors
--> 03B4 same-generation Celery sufficiency integration
+-> 03B3B1 pinned dependency approval and CI gate
+-> 03B3B1 branches to:
+   -> 03B3B2 approved PDF extractor
+   -> 03B3B3A shared OOXML security capability
+      -> 03B3B3B DOCX
+      -> 03B3B3C PPTX
+      -> 03B3B3D XLSX
+   -> 03B3B4 approved image metadata
+-> 03B4 same-generation Celery sufficiency integration only after 03B3B2,
+   03B3B3B, 03B3B3C, 03B3B3D, and 03B3B4 complete
 -> AUTH activation for exact 03B actions
 -> 03C guide-source clean cut/continuation
 -> AUTH planned registration of `artifact.submission_bundle.prepare`

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DECISIONS.md

@@ -400,7 +400,11 @@ under fixed input, output, container, time, memory, and document limits using
 only scratch-manager paths. Parser crash, malformed input, macros, external
 relationships, embedded executables, cancellation, timeout, and executor loss
 have bounded outcomes and cleanup. Production parser dependencies require
-explicit human approval before implementation.
+explicit human approval before implementation. Complex-format delivery is
+split after 03B3A: 03B3B1 records the exact pinned dependency decision and
+deterministic gate without installing packages; 03B3B2 delivers PDF, 03B3B3A
+owns shared OOXML security, 03B3B3B delivers DOCX, 03B3B3C delivers PPTX,
+03B3B3D delivers XLSX, and 03B3B4 delivers image metadata.
 
 The v0.1 extraction-policy limits are fixed, not caller-selectable:
 
@@ -420,14 +424,14 @@ The v0.1 extraction-policy limits are fixed, not caller-selectable:
 | decompressed container bytes | 128 MiB | 03B2 container inspector | `limit_exceeded` |
 | container nesting depth | 8 | 03B2 container inspector | `limit_exceeded` |
 | compression ratio | 100:1 | 03B2 container inspector | `limit_exceeded` |
-| PDF pages | 500 | 03B3B PDF adapter | `limit_exceeded` |
-| PPTX slides | 300 | 03B3B PPTX adapter | `limit_exceeded` |
-| XLSX sheets | 100 | 03B3B XLSX adapter | `limit_exceeded` |
-| table rows per item | 100,000 | 03B3A CSV / 03B3B XLSX adapter | `limit_exceeded` |
-| table cells per item | 1,000,000 | 03B3A CSV / 03B3B XLSX adapter | `limit_exceeded` |
+| PDF pages | 500 | 03B3B2 PDF adapter | `limit_exceeded` |
+| PPTX slides | 300 | 03B3B3C PPTX adapter | `limit_exceeded` |
+| XLSX sheets | 100 | 03B3B3D XLSX adapter | `limit_exceeded` |
+| table rows per item | 100,000 | 03B3A CSV / 03B3B3D XLSX adapter | `limit_exceeded` |
+| table cells per item | 1,000,000 | 03B3A CSV / 03B3B3D XLSX adapter | `limit_exceeded` |
 | characters per cell | 32,768 | CSV/XLSX adapter | `limit_exceeded` |
-| image pixels | 40 megapixels | 03B2 header inspector and 03B3B adapter | `limit_exceeded` |
-| image width or height | 16,384 pixels | 03B2 header inspector and 03B3B adapter | `limit_exceeded` |
+| image pixels | 40 megapixels | 03B2 header inspector and 03B3B4 adapter | `limit_exceeded` |
+| image width or height | 16,384 pixels | 03B2 header inspector and 03B3B4 adapter | `limit_exceeded` |
 
 Exact-boundary, one-over-boundary, cleanup, cancellation, timeout, memory-
 termination, and executor-loss tests are mandatory. Executor loss leaves no

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DISCOVERY.md

@@ -154,7 +154,7 @@ bounded canonical extraction record and provenance in PostgreSQL; a future
 derived provider artifact requires a separately planned action and activation.
 
 No document-parsing production dependencies are installed. Any new production
-dependency requires explicit human approval before 03B3B implementation. OOXML ZIP
+dependency requires explicit human approval through 03B3B1 before format implementation. OOXML ZIP
 containers must pass one bounded classifier that distinguishes DOCX, PPTX, and
 XLSX by internal markers. Audio/video transcription and OCR are not required by
 current v0.1 setup and remain unsupported. PNG/JPEG/WebP classification and

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/PLAN.md

@@ -477,7 +477,7 @@ ART-03A upload remains a byte-custody request: authorize before intake, compute
 the server digest and size, admit once, store opaque bytes, and verify them. It
 does not parse content or wait for contributor submission checkers.
 
-The expanded ART-03B work is delivered as five hidden PR-sized subchunks before
+The expanded ART-03B work is delivered as eleven hidden PR-sized subchunks before
 AUTH-04B activates fixed-service binding/read:
 
 1. `03B1` creates an authoritative one-item/one-content guide binding tied to
@@ -490,9 +490,14 @@ AUTH-04B activates fixed-service binding/read:
 3. `03B3A` installs the isolated no-network extraction framework, immutable
    content/usage provenance, and text, Markdown, JSON, and CSV extractors
    without new parser dependencies.
-4. `03B3B` adds explicitly approved PDF, DOCX, PPTX, XLSX, and PNG/JPEG/WebP
-   metadata extractors on that proven framework.
-5. `03B4` adds `setup_generation` to the identifier-only Celery payload,
+4. `03B3B1` selects the exact pinned parser dependency allowlist and adds its
+   deterministic CI gate without changing packages or runtime code.
+5. `03B3B2` installs only the approved PDF dependency and adds PDF extraction.
+6. `03B3B3A` adds shared bounded OOXML container and security capabilities.
+7. `03B3B3B`, `03B3B3C`, and `03B3B3D` separately add DOCX, PPTX, and XLSX.
+8. `03B3B4` installs only the approved image dependency and adds PNG, JPEG, and
+   WebP structural metadata extraction without OCR.
+9. `03B4` adds `setup_generation` to the identifier-only Celery payload,
    reloads current state, assembles all required canonical extracted sources,
    invokes sufficiency, and persists exact provenance.
 
@@ -552,9 +557,9 @@ every terminal current-generation failure above. API, Operator, and Project
 Manager projections use only the exact redacted mapping and remediation table.
 None is a guide-insufficiency decision.
 
-Any production parser dependency in 03B3B requires explicit human approval. Candidate
+Any production parser dependency requires explicit human approval through 03B3B1. Candidate
 libraries must undergo current security, maintenance, license, transitive-
-dependency, malformed-input, and cancellation review before `03B3B` may add
+dependency, malformed-input, and cancellation review before a later format chunk may add
 them; no runtime plugin discovery or parser fallback is permitted.
 
 1. Guide-source delivery is split into hidden byte ingest, AUTH activation,

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/RISKS.md

@@ -55,6 +55,7 @@
 | Caller metadata or excerpt reaches the sufficiency agent instead of verified bytes | Critical | Resolve exact ART bindings, fully rehash provider reads, extract under a versioned policy, and assemble agent input only from same-generation canonical extraction records. |
 | DOCX/PPTX/XLSX is confused with an arbitrary ZIP | Critical | Use one bounded container classifier with required internal-marker checks; ambiguous or ordinary ZIP is unsupported and never sent raw to an agent. |
 | Malicious document exploits a parser or extraction runtime | Critical | Typed extractor registry, isolated no-network subprocess, fixed CPU/time/memory/output/container limits, external-reference and macro rejection, cancellation, and scratch-owned cleanup. |
+| One PR introduces several unrelated parser dependency graphs and becomes unreviewable | Critical | 03B3B1 approves the exact pinned allowlist without installation; PDF, OOXML, and image metadata then land in separate implementation PRs with format-specific lock, security, fixture, and coverage evidence. |
 | Artifact corruption is reported as guide insufficiency | Critical | Digest/size mismatch, missing/truncated objects, and provider failures create ART incident outcomes and stop setup before the sufficiency agent. |
 | Extraction output silently changes across deployments | High | Persist content-derived format/extractor/policy identity and digest separately from exact binding/run/generation usage provenance; never rewrite prior output. |
 | Read authority is reused to write a derived provider artifact | Critical | v0.1 stores only bounded extraction records in PostgreSQL; any derived provider write requires a separate action and AUTH activation. |

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md

@@ -61,6 +61,12 @@ same-generation sufficiency continuation are separate PR-sized contracts.
 `WS-ART-001-03B1` is the first proposed
 implementation successor; this planning change contains no implementation.
 
+After 03B3A merged, the original complex-format chunk was found too broad for
+one dependency and parser-security review. It is replaced by 03B3B1 dependency
+approval, 03B3B2 PDF, 03B3B3A shared OOXML security, separate 03B3B3B DOCX,
+03B3B3C PPTX, and 03B3B3D XLSX adapters, and 03B3B4 image metadata. No dependency is
+installed until the human owner approves 03B3B1's exact pinned allowlist.
+
 AUTH `WS-XINT-002-04B` follows the complete hidden split-03B series and
 activates only fixed-service binding and guide read. ART-03C then removes the
 legacy identity/excerpt path and makes the verified pipeline authoritative.

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/chunks/WS-ART-001-03B-guide-source-binding-materialization.md

@@ -15,7 +15,12 @@ implementation contracts.
 - `WS-ART-001-03B1`: authoritative binding and setup generation;
 - `WS-ART-001-03B2`: verified materialization, incidents, and classification;
 - `WS-ART-001-03B3A`: isolated framework and low-complexity extraction;
-- `WS-ART-001-03B3B`: approved complex document/image-metadata extractors;
+- `WS-ART-001-03B3B1`: pinned dependency approval and CI gate;
+- `WS-ART-001-03B3B2`: PDF extraction;
+- `WS-ART-001-03B3B3A`: shared OOXML container security;
+- `WS-ART-001-03B3B3B`, `WS-ART-001-03B3B3C`, and
+  `WS-ART-001-03B3B3D`: separate DOCX, PPTX, and XLSX extraction;
+- `WS-ART-001-03B3B4`: image metadata extraction;
 - `WS-ART-001-03B4`: same-generation Celery and sufficiency integration.
 
 Each subchunk is one PR. AUTH `WS-XINT-002-04B` activates fixed binding/read