WS-AUTH-001-11: split project read hard cutover

[Abiorh001]

WS-AUTH-001-11 PR Trust Bundle

Chunk

WS-AUTH-001-11 — Project Read Cutover Planning Parent

Merge intent: .agent-loop/merge-intents/WS-AUTH-001-11.json

Goal and human-approved intent

Replace token-role authority on the project read surface with local grants as a
hard cutover. The user explicitly rejected backward compatibility and approved
starting AUTH-11. Signed explicit-start workflow run 30167274426 succeeded.

What changed and why

• D34 makes AUTH-11 planning-only and assigns one complete surface family to
  each of 11A, 11B, 11C1, and 11C2.
• The inventory matches all ten current project GET routes and the deferred
  self authorization-context route, including project/guide/child bindings.
• 11A registers eleven actions and adds two read-only permissions plus role and
  evidence parity in migration 0035, without route activation.
• 11B cuts over project identity and self authorization context.
• 11C1 cuts over six setup/draft diagnostic reads.
• 11C2 cuts over three effective-policy/active-guide reads.

Design chosen

Project identity continues to use project.read. Setup diagnostics and
effective policy receive distinct read-only permissions so Project Manager,
system Operator, and covered Audit Authority can inspect through safe API
projections without gaining mutations. Finance Authority, Access Administrator,
and contributors do not receive those sensitive permissions. Contributors may
receive only minimal exact-project identity unless 11C2 later proves a safe
active-guide schema.

Alternatives rejected

• One combined runtime cutover was too broad for L1 review.
• Token-role fallback or dual authorization would violate the hard cutover.
• Mapping sensitive reads to generic project.read would overexpose data.
• Reusing management permissions for inspection would conflate reads and writes.
• Denying Operator/Audit inspection would force unsupported database access.

Scope and product behavior

This PR changes planning/process artifacts and one merge intent only. It adds no
runtime behavior, migration, route, action activation, test, workflow, or
dependency. Signed automation remains canonical live state.

Acceptance criteria proof

The plan records literal routes, exact ActionIds, resource targets, permission
mappings, role/scope projections, concealment requirements, migration custody,
coverage floors, documentation ownership, child sequencing, and stop rules.
Only 11A is named as successor, and it remains inactive.

Tests/checks run

• Merge-intent validator: local PASS.
• Stale authorization and Workstream wording scans: local PASS after wording
  repair; the original hosted stale-authorization run failed.
• Markdown link scan: local PASS for twelve changed Markdown files.
• Agent gates: 100 local tests PASS; repaired hosted rerun remains required.
• Diff integrity: local PASS.

No local four-hour backend suite was run for this documentation-only parent.
Every runtime child requires the hosted GitHub Backend / test full suite,
semantic lanes, API E2E, 78 percent repository coverage, and applicable 90
percent subsystem reports before merge.

Test delta and CI integrity

No tests, workflows, package scripts, dependencies, skips, or thresholds
changed. QA and test-delta reviewers confirmed that future role, scope,
cross-project, cross-guide, child-binding, concealment, OpenAPI, migration, and
live API proof is explicit.

Reviewer results and external review

All nine required internal tracks passed the repaired exact planning SHA
81e470306f81edafb8cb592dd53d036ee07ba7e7 after fixes: senior engineering,
QA/test, security/auth, product/ops, architecture, CI integrity, docs,
reuse/dedup, and test delta. GitHub Agent Gates then identified stale legacy
authorization vocabulary in the new prose; the wording was repaired without
changing design or weakening the scanner, and the response is recorded in
WS-AUTH-001-11-external-review-response.md. CodeRabbit and repaired hosted
checks remain external gates.

Remaining risks and follow-up

The principal risk is accidental projection broadening during runtime work.
Each child therefore needs a separate signed start and exact-head L1 review.
11A must land before 11B; 11B before 11C1; and 11C1 before 11C2.

Human review focus and merge ownership

Review the eleven-action inventory, two read-only permissions, Operator/Audit
inspection boundary, contributor minimal projection, literal resource binding,
and absence of token-role fallback. The user retains final approval authority
for this specific PR and merge.

[coderabbitai]

📝 Walkthrough

Walkthrough

AUTH-11 is restructured as a planning-only parent with four sequential child chunks covering catalogue foundations, identity and actor context, setup diagnostics, and effective-policy/active-guide reads. Supporting decisions, status, review evidence, and explicit-start merge intent are added.

Changes

AUTH-11 planning and authorization cutover

Layer / File(s)	Summary
AUTH-11 decomposition and authorization decisions .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/{CHUNK_MAP.md,DECISIONS.md,DISCOVERY.md,STATUS.md}	AUTH-11 is split into sequential children 11A, 11B, 11C1, and 11C2 with defined read permissions, surface ownership, and token-role removal boundaries.
Planning parent contract .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-11-project-read-cutover.md	The parent contract becomes planning-only and documents exact project-read actions, child sequencing, scope restrictions, acceptance criteria, verification, and stop conditions.
Child cutover contracts .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-11{A,B,C1,C2}-*.md	New contracts define catalogue registration, identity and actor-context reads, setup diagnostics, and effective-policy/active-guide reads with scoped authorization and verification requirements.
Review evidence and merge intent .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/*, .agent-loop/merge-intents/WS-AUTH-001-11.json	Planning review evidence, validation results, remaining gates, and an explicit-start merge intent for successor chunk 11A are recorded.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AUTH11 as AUTH-11
  participant AUTH11A as AUTH-11A
  participant AUTH11B as AUTH-11B
  participant AUTH11C1 as AUTH-11C1
  participant AUTH11C2 as AUTH-11C2
  AUTH11->>AUTH11A: start catalogue foundation
  AUTH11A->>AUTH11B: start identity and actor context
  AUTH11B->>AUTH11C1: start setup diagnostics
  AUTH11C1->>AUTH11C2: start effective policy and active guide reads

Loading

Possibly related PRs

• Flow-Research/workstream#91: Earlier refinement of the same WS-AUTH-001 planning artifacts.
• Flow-Research/workstream#140: Related AUTH-11 planning-boundary and project-read contract updates.

Suggested reviewers: abiorh-claw

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately summarizes the PR's main change: splitting the project read hard cutover.
Description check	✅ Passed	The description covers the required trust-bundle sections, including intent, changes, alternatives, scope, tests, risks, and reviewer results.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/ws-auth-001-11-project-read-cutover

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
@.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md:
- Around line 163-166: Update the parent chunk 11 description in CHUNK_MAP.md so
token-role authority removal applies only to runtime children 11B, 11C1, and
11C2. Explicitly exempt planning-only child 11A, which only registers actions
and evidence and activates no surface; preserve the hard-cutover wording for the
runtime children.

In
@.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-11-internal-review-evidence.md:
- Around line 27-34: The review artifacts contain stale PASS claims that
contradict the actual pipeline results. Regenerate both artifacts from fresh
gate execution: update the wording, agent-gate results, and
changed-Markdown-file count in
.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-11-internal-review-evidence.md
(lines 27-34), then update the repeated PASS claims in
.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-11-pr-trust-bundle.md
(lines 58-64) to match those results.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 751e8480-af74-4a4e-97b4-7222db2509ca

📥 Commits

Reviewing files that changed from the base of the PR and between 03a05ee and 0088197.

📒 Files selected for processing (12)

• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DISCOVERY.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-11-project-read-cutover.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-11A-project-read-catalogue-foundation.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-11B-project-identity-actor-context.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-11C1-project-setup-diagnostic-reads.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-11C2-effective-policy-active-guide-reads.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-11-internal-review-evidence.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-11-pr-trust-bundle.md
• .agent-loop/merge-intents/WS-AUTH-001-11.json