AUTH-12F3: activate fixed-service policy derivation

[Abiorh001]

PR Trust Bundle: WS-AUTH-001-12F3

Chunk

WS-AUTH-001-12F3 — Fixed-Service Policy Derivation (L1).

Goal

Activate submission-policy derivation only for workstream.project.setup, run
it through fresh fixed-service PREP in Celery, and remove public inline agent
derivation.

Human-approved intent

Complete AUTH-12F3 end to end without weakening authorization, tests, or CI;
use GitHub Actions for the full suite and coverage proof.

What changed

• Activated only project.submission_artifact_policy.derive for the fixed
  project-setup service.
• Removed the public derive endpoint and role-based product-service seam.
• Added exact setup/lineage/provenance validation, fresh pre-I/O and final PREP,
  total lock ordering, atomic decision/product evidence, and exact replay.
• Added a DB-enforced reserved -> pending -> committed execution-claim state
  machine so process loss cannot repeat material or agent I/O.
• Made warning-acknowledgement replay retry a failed same-generation enqueue
  without rerunning sufficiency.
• Updated migration parity, schema fingerprint, tests, specifications, and ops
  guidance.

Why it changed

Automatic setup derivation needed a closed fixed-service boundary, exact
transactional evidence, and crash-safe replay before it could be activated.

Design chosen

Reuse the opaque PreparedAuthorizationHandle protocol and fixed-service
composition. Commit only a deterministic reserved execution claim before
external I/O; after I/O, reload and lock the complete lineage, consume fresh
transaction-bound authority, then atomically bind and complete replay with the
policy and setup output.

Alternatives rejected

• Public or human inline agent invocation.
• Raw authorization context, serialized handles, or an ART-local evaluator.
• Advisory locking alone; it cannot survive process loss.
• Deleting durable reservations during downgrade.

Scope control

No approval/effective/pre-submit mutation, post-submit policy activation, ART
behavior, generic service authority, frontend work, or CI changes are included.

Product behavior

An authoritative same-generation sufficiency result permits only the fixed
setup service to derive one immutable draft. Exact committed redelivery returns
that draft without external I/O. A failed post-reservation execution remains
durably fenced. Project Managers may create manual drafts but cannot invoke the
derivation agent inline.

Acceptance criteria proof

• Fixed service/action isolation and PREP integrity: authorization tests.
• Exact running/completed custody and stale-output denial: focused project tests.
• Real commit, immutable provenance/defaults, exact replay, durable failure
  reservation, and zero-I/O redelivery: PostgreSQL integration test.
• Migration upgrade/downgrade and single-head integrity: isolated Alembic test.
• Removed route: OpenAPI/import-reachability project tests.

Tests/checks run

• Ruff and Python compile checks passed.
• AUTH selector: 2 passed.
• Worker/replay/custody selector: 8 passed.
• CI lane integrity: 33 passed.
• PostgreSQL service/replay/crash test: 1 passed.
• Isolated Alembic round trip: 1 passed.
• Stale authorization wording, Markdown links, and git diff --check passed.
• Full repository coverage is intentionally delegated to hosted GitHub Actions.

Test delta

Added fixed-service PREP, worker composition, stale custody, exact completed
replay, real PostgreSQL success/replay/crash recovery, route removal, catalogue
activation, migration-head, provenance, immutable-manual-update, and default
policy-floor assertions. No tests were skipped or weakened.

CI integrity

No workflow, lane, lint, coverage, or package-script changes. Repository-wide
78% and changed-subsystem 90% requirements remain intact.

Reviewer results

Architecture, security, QA, senior engineering, product/ops, test-delta, reuse,
docs, and CI-integrity reviews passed after findings were fixed.

External review

Pending CodeRabbit and exact-head GitHub Actions checks.

Remaining risks

Low: execution-fence and worker composition scaffolding parallels sufficiency;
extract a shared helper only if a third boundary establishes a stable pattern.

Follow-up work

After human merge, reassess and start WS-AUTH-001-12F4 as its own bounded
chunk. Do not start it automatically from this PR.

Human review focus

Review migration 0059's one-way guards, the pre-I/O commit boundary, final
atomic PREP/evidence transaction, exact completed replay, and fixed-service-only
catalogue activation.

Human merge ownership

Only the user may authorize merge of the specific PR.

[coderabbitai]

Warning

Review limit reached

@Abiorh001, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 10 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 95183ae0-a811-4549-9b1f-4e84a47bfd20

📥 Commits

Reviewing files that changed from the base of the PR and between 6097b56 and 63fc6e1.

📒 Files selected for processing (24)

• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-12F3-submission-policy-service-derivation.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-12F3-external-review-response.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-12F3-pr-trust-bundle.md
• backend/alembic/versions/0059_submission_policy_execution_claim.py
• backend/app/modules/authorization/catalogue.py
• backend/app/modules/projects/models.py
• backend/app/modules/projects/router.py
• backend/app/modules/projects/service.py
• backend/app/modules/projects/submission_policy_mutation_repository.py
• backend/app/modules/projects/submission_policy_mutation_service.py
• backend/app/modules/projects/sufficiency_mutation_service.py
• backend/app/workers/project_setup.py
• backend/scripts/api_contract_e2e.py
• backend/tests/conftest.py
• backend/tests/test_alembic.py
• backend/tests/test_api_controls.py
• backend/tests/test_audit.py
• backend/tests/test_authorization.py
• backend/tests/test_projects.py
• docs/operations_authorization_service.md
• docs/spec_authorization_service.md
• docs/spec_chunk_3_project_guide_foundation.md

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/ws-auth-001-12f3-service-derivation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}