AUTH: transfer ART activation custody

[Abiorh001]

WS-AUTH-001-ART-CUSTODY PR Trust Bundle

Goal

Transfer exactly 25 planned ART action-owner labels to eight exact AUTH
activation custodians without changing permission mappings, availability, or
ART behavior.

Changes And Design

• Removes seven historical ART ActionOwner enum values and adds eight exact
  AUTH activation-custodian values.
• Changes only the owner field of the 25 canonical ART definitions and the
  matching closed fixed-service metadata expectations.
• Preserves 74 PermissionIds, 65 ActionIds, 17 active and 48 planned actions,
  every ActionId-to-PermissionId pair, all non-ART owners, and the exact
  seven-identity/eleven-membership service matrix.
• Adds literal independent catalogue truth, exact documentation parity, and
  all-25 real-kernel denial proof.

Scope Control

No migration, database or audit rewrite, availability change, evaluator,
resource composer, route, command, grant, service provisioning, identity,
matrix membership, or ART runtime behavior is included. OPERATOR denotes
future activation custody only and creates no entitlement. Verification retry
remains planned and independently gated.

Proof And CI Integrity

• Ruff passed for app and tests.
• 45 focused catalogue/kernel/documentation tests passed.
• Stale wording, stale authorization docs, Markdown links, loop-memory state,
  merge intent, Alembic-head/no-migration, and diff checks passed.
• No tests or assertions were removed or weakened; no skips, xfails,
  deselection, exclusions, workflows, scripts, or thresholds changed.
• GitHub Backend remains the authoritative full-suite gate for global coverage
  at or above 78 percent and authorization coverage at or above 90 percent.

Internal Review

Final reviewed SHA a20ab6b2004e2f7a13e1e0d600595f0af7d67985, containing
reviewed implementation abb3fb1a035f544f5ee07b7d725451dfa2d90864, against
trusted main 42a89b2deac8fc7672556a567a6124f8a4e5d423 passes senior engineering,
QA/test, security/auth, product/ops, architecture, CI integrity, docs,
reuse/dedup, and test-delta review after all valid proof findings were repaired.
The final CI repair preserves four authored trusted-main status fixtures
byte-for-byte rather than weakening their gate; all 88 agent-gate regression
tests pass. Canonical live state remains automation-owned.

Remaining Risk And Follow-up

Hosted Backend CI, Agent Gates, CodeRabbit, and human review remain. The merge
intent names only WS-AUTH-001-REV-CUSTODY, which remains inactive until this
PR merges, signed memory succeeds, and the user explicitly starts it.

Human Review Focus

Verify the exact 25-row/eight-custodian owner-only delta, unchanged non-ART and
REV owners, unchanged mappings/counts/matrix/availability, custody-only
OPERATOR meaning, independent retry gating, and absence of a migration.

Human Merge Ownership

The agent may publish and repair this branch but may not merge it. Only the
human may approve this PR for merge. Trusted-main automation owns post-merge
schema-v2 memory generation when the workflow succeeds.

[coderabbitai]

Warning

Review limit reached

@Abiorh001, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 48 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 35e6d866-cfa2-4022-ad3d-a45d35c9cdd0

📥 Commits

Reviewing files that changed from the base of the PR and between f19c561 and 2cbce2d.

📒 Files selected for processing (2)

• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-ART-CUSTODY-internal-review-evidence.md
• .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-ART-CUSTODY-pr-trust-bundle.md

📝 Walkthrough

Walkthrough

The PR transfers 25 planned ART actions to AUTH custody owners, splits the 02D owner, preserves mappings and availability, updates catalogue validation, adds documentation-parity and fail-closed runtime tests, and records the ART custody review state.

Changes

ART custody contract and rollout state

Layer / File(s)	Summary
Custody contract and rollout state .agent-loop/..., docs/spec_authorization_service.md, docs/operations_authorization_service.md	Defines the 25-row, eight-custodian transfer, owner semantics, unchanged mappings and availability, no-migration constraint, rollout state, merge intent, and review requirements.

Authorization catalogue remapping

Layer / File(s)	Summary
Authorization catalogue remapping backend/app/modules/authorization/catalogue.py	Replaces ART owner identifiers, splits 02D into internal and operator owners, updates planned action definitions, and aligns service-matrix expectations.

Catalogue, runtime, and review validation

Layer / File(s)	Summary
Catalogue, runtime, and review validation backend/tests/test_authorization.py, .agent-loop/.../reviews/*	Centralizes ART custody expectations, validates documentation parity and owner counts, verifies planned actions deny before runtime dispatch, and records internal review evidence and trust-bundle checks.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• Flow-Research/workstream#126: Updates overlapping authorization catalogue mappings and planned-action validation.
• Flow-Research/workstream#131: Modifies the same ActionOwner and ACTION_DEFINITIONS catalogue structures.
• Flow-Research/workstream#132: Shares the service-to-action validation and matrix expectations updated here.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 8.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	⚠️ Warning	The description covers the goal and key risks, but it omits most required template sections and the required chunk/intent/evidence structure.	Restructure the PR description to match the template and add the missing chunk, intent, evidence, criteria, test-delta, and review sections.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title succinctly and accurately names the main change: transferring ART activation custody.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/ws-auth-001-art-custody

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}