AUTH-12E: activate guide sufficiency mutations

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/ACTIVATION_CUSTODY.md

@@ -67,9 +67,11 @@ gated `artifact.verification_job.retry`
 remains planned and
 cannot be activated by read/status proof. The historical transfer added no
 migration because owner and availability are typed metadata. WS-XINT-002-01
-reconciles PostgreSQL parity through migration `0036`; the live catalogue has
-71 PermissionIds, 100 ActionIds, 45 active actions, and 55 planned actions, with
-fourteen fixed-service identities and twenty-two matrix memberships.
+reconciles PostgreSQL parity through migration `0036`. The post-12E-merge
+expected catalogue has 71 PermissionIds, 100 ActionIds, 48 active actions, and
+52 planned actions, with fourteen fixed-service identities and twenty-two
+matrix memberships; until 12E is human-merged, trusted `main` retains its prior
+45 active and 55 planned counts.
 
 ## REV custody transfer
 

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md

@@ -62,12 +62,12 @@ stopped.
 | `WS-AUTH-001-11C2` | Effective Policy And Active Guide Read Cutover | L1 | Merged in PR #221 as `3fc323d7` |
 | `WS-AUTH-001-12` | Project Mutation Cutover Planning Parent | L1 | Split before runtime implementation after failed L1 review |
 | `WS-AUTH-001-12A` | Project Mutation Catalogue And PREP Foundation | L1 | Merged as PR #226 with AUTH `0041`; zero activation |
-| `WS-AUTH-001-12B` | Fixed Project Setup Service Foundation | L1 | Internal review complete; hosted checks pending; identity/matrix registration only, zero activation |
+| `WS-AUTH-001-12B` | Fixed Project Setup Service Foundation | L1 | Merged through PR #227; identity/matrix registration only, zero activation |
 | `WS-AUTH-001-12B2` | Project Setup Service Runtime Cutover | L1 | Proposed after 12E, 12F, and 12G |
-| `WS-AUTH-001-12C` | Project Creation Cutover | L1 | Proposed after 12B |
-| `WS-AUTH-001-12D` | Draft Guide And Source Metadata Cutover | L1 | Proposed after 12C |
-| `WS-AUTH-001-12D2` | Review And Revision Policy Mutation Separation | L1 | Proposed after 12D; economic policy remains CON-owned |
-| `WS-AUTH-001-12E` | Guide Sufficiency Mutation Cutover | L1 | Proposed after 12D2 |
+| `WS-AUTH-001-12C` | Project Creation Cutover | L1 | Merged through PR #229 |
+| `WS-AUTH-001-12D` | Draft Guide And Source Metadata Cutover | L1 | Merged through PR #232 |
+| `WS-AUTH-001-12D2` | Review And Revision Policy Mutation Separation | L1 | Superseded by merged XINT-003-02A/02B; economic policy remains CON-owned |
+| `WS-AUTH-001-12E` | Guide Sufficiency Mutation Cutover | L1 | Active contract refresh after merged 12D and XINT-003-02A/02B |
 | `WS-AUTH-001-12F` | Submission Artifact Policy Mutation Cutover | L1 | Proposed after 12E |
 | `WS-AUTH-001-12G` | Post-Submit Checker Policy Mutation Cutover | L1 | Proposed after 12F |
 | `WS-AUTH-001-12H` | Guide Activation Cutover | L1 | Proposed after 12B2 and the owning CON clean cut |
@@ -145,7 +145,7 @@ WS-AUTH-001-PLAN
 -> WS-AUTH-001-12B
 -> WS-AUTH-001-12C
 -> WS-AUTH-001-12D
--> WS-AUTH-001-12D2
+-> XINT-003-02A/02B (supersedes WS-AUTH-001-12D2)
 -> WS-AUTH-001-12E
 -> WS-AUTH-001-12F
 -> WS-AUTH-001-12G

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DISCOVERY.md

@@ -445,3 +445,73 @@ need an independently reviewable contract and production-code budget.
   identity plus self context; admin-only setup diagnostics; and effective
   policy/active-guide projection. Each runtime child hard-removes token-role
   authority from every surface it owns.
+
+## WS-AUTH-001-12E current-main refresh — 2026-08-03
+
+## Observed merged baseline
+
+- Trusted `main` is merge `3479ee71`. AUTH-12C and AUTH-12D are merged, and
+  XINT-003-02A/02B replaced the old 12D2 dependency with immutable
+  ReviewPolicy/RevisionPolicy lineage plus the sole authorized mutation path.
+- `project.guide_sufficiency_report.create`, `project.guide_sufficiency.run`,
+  and `project.guide_sufficiency.warnings.acknowledge` are registered under
+  `AUTH_12E`, mapped to `project.guide.manage`, and remain planned.
+- `ProjectGuideSufficiencyMutationResourceContext` already closes the three
+  target kinds and separates human execution from exact
+  `workstream.project.setup` custody. `PreparedAuthorizationService` can derive
+  project scope through the canonical project-mutation map, but does not yet
+  retain and compare sufficiency-specific final facts. 12E must add those
+  bindings; project scope plus a request digest is insufficient.
+- Public sufficiency mutations in `projects/router.py` still resolve the legacy
+  `ActorContext`; `ProjectService` still authorizes them with
+  the former role-claim helper, owns commits, and records no canonical AUTH decision
+  provenance.
+- ART-03B4 already merged the verified guide-material pipeline and migration
+  `0046_guide_sufficiency`. It owns extraction/source-usage provenance. AUTH-12E
+  must reuse that behavior and must not create another materialization or
+  extraction path.
+- The discovery head was `0049_rev_auth_readiness`; after later merged ART and
+  compensation migrations, 12E allocates `0054_guide_sufficiency_authority`
+  after `0053_compensation_bindings`, rather than reusing or editing 0046.
+
+## Exact 12E implementation gap
+
+- Add one sufficiency-mutation orchestration service and one replay-only
+  repository. The request/service command owns the root transaction and commit.
+- Reuse the AUTH-owned service context/revalidation path for the fixed setup
+  identity; do not copy ART-private service-resolution helpers. Extract the
+  current ART-material mapping, prompt-digest, report-construction, and
+  source-usage staging blocks into pure shared helpers rather than duplicating
+  them in the orchestrator.
+- Extend the existing prepared binding—not the protocol—with explicit project,
+  guide/version, snapshot/hash, report, setup generation, target/execution kind,
+  setup-service custody, stale-output/material digest, operation, and request
+  facts, and compare them against the final typed resource at consume time.
+- Add an idempotency ledger for the three actions and additive authorization
+  provenance for report creation and warning acknowledgement. Historical rows
+  remain nullable/readable; exact new writes are complete and constrained.
+- Replace the three public legacy role checks with resolved human actor plus
+  canonical PREP. 12E changes only Celery worker admission and the authorized
+  command boundary for guide sufficiency; 12B2 owns the complete setup-service
+  call-graph cutover.
+- For agent execution, cheap authority must deny before material/provider/agent
+  work. No prepared handle crosses rollback, agent execution, ART
+  materialization, session, or transaction. Final persistence prepares and
+  consumes fresh authority after locking the exact current lineage and
+  recomputing server-owned output facts.
+- Existing report uniqueness is not sufficient replay custody: it cannot detect
+  changed idempotency input, identity-link substitution, or action reuse.
+
+## Risks and proof focus
+
+- A denial after provider/agent work would violate side-effect ordering.
+- Reusing the legacy `created_by` or warning-role strings as authority would
+  preserve a second authorization path.
+- Human and fixed-service execution must remain disjoint even though both may
+  use `project.guide_sufficiency.run`.
+- Concurrent exact replay must produce one report/acknowledgement and a stable
+  response; changed reuse, revoked authority, stale snapshot/setup generation,
+  wrong transaction/session, and copied handles must deny without partial
+  product state or allowed audit evidence.
+- ART source-usage rows and material digests must remain ART-owned facts; AUTH
+  binds their identifiers/digests but does not interpret extracted content.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md

@@ -124,17 +124,17 @@ setup-run binding findings were repaired.
 
 ## Active implementation chunk
 
-`WS-AUTH-001-12A`; the user started the bounded catalogue, typed resource,
-PREP-scope, and PostgreSQL evidence foundation on 2026-07-29. All eighteen new
-actions remain planned and unavailable; no product mutation is activated.
-Initial architecture and product review found missing setup-service custody and
-operation-kind bindings. Those defects were repaired, focused proof passes,
-and all nine required internal reviewer tracks now pass. Hosted Backend,
-Agent Gates, and external review remain before merge readiness.
+`WS-AUTH-001-12E`; the user started the current-main guide-sufficiency
+authorization cutover after PR #257 merged REV-AUTH readiness. AUTH-12B, 12C,
+and 12D are merged. XINT-003-02A/02B supplied the immutable policy lineage and
+authorized mutation path that supersede the old 12D2 dependency. The 12E
+contract and preimplementation review are complete. Runtime implementation is
+under deterministic proof; its three actions become active only with this
+bounded merge.
 
 ## Current review branch
 
-`codex/ws-auth-001-12a-project-mutation-catalogue`.
+`codex/ws-auth-001-12e-guide-sufficiency`.
 
 ## Chunk status
 
@@ -177,12 +177,12 @@ Agent Gates, and external review remain before merge readiness.
 | `WS-AUTH-001-11C2` | Merged | `codex/ws-auth-001-11c2-effective-policy-active-guide-reads` | #221 | Effective-policy and active-guide read cutover merged as `3fc323d7` on 2026-07-29. |
 | `WS-AUTH-001-12` | Planning repair | `codex/ws-auth-001-12-project-mutation-cutover` | - | Combined runtime contract rejected; planning parent split into 12A-12H plus 12B2/12D2 before code. |
 | `WS-AUTH-001-12A` | Merged | `codex/ws-auth-001-12a-project-mutation-catalogue` | #226 | Exact 18-action planned catalogue, typed resource/PREP scope, and migration `0041`; merged as `64dd9c98` with zero activation. |
-| `WS-AUTH-001-12B` | Internal review complete; hosted checks pending | `codex/ws-auth-001-12b-project-setup-service` | - | Fixed project-setup service identity and planned matrix only; zero activation and no actor/link seed. |
+| `WS-AUTH-001-12B` | Merged | `codex/ws-auth-001-12b-project-setup-service` | #227 | Fixed project-setup service identity and planned matrix only; zero activation and no actor/link seed. |
 | `WS-AUTH-001-12B2` | Proposed | - | - | Final Celery call-graph cutover after exact product actions activate. |
-| `WS-AUTH-001-12C` | Proposed | - | - | System-scoped project creation cutover. |
-| `WS-AUTH-001-12D` | Proposed | - | - | Draft guide and source metadata mutation cutover. |
-| `WS-AUTH-001-12D2` | Proposed | - | - | Separate review/revision authority; retired economic policy remains CON-owned. |
-| `WS-AUTH-001-12E` | Proposed | - | - | Guide sufficiency mutation cutover. |
+| `WS-AUTH-001-12C` | Merged | `codex/ws-auth-001-12c-project-create` | #229 | System-scoped project creation cutover merged as `67f2c14b`. |
+| `WS-AUTH-001-12D` | Merged | `codex/ws-auth-001-12d-guide-draft-source` | #232 | Draft guide and source metadata mutation cutover merged as `99dc0b34`. |
+| `WS-AUTH-001-12D2` | Superseded | - | #248 | XINT-003-02A/02B own immutable review/revision policy lineage and the sole authorized mutation path; 02B merged as `25fc27c4`. |
+| `WS-AUTH-001-12E` | Implementation and proof | `codex/ws-auth-001-12e-guide-sufficiency` | - | Three guide-sufficiency actions plus fixed setup-service run PREP are under review. |
 | `WS-AUTH-001-12F` | Proposed | - | - | Submission artifact policy mutation/provenance cutover. |
 | `WS-AUTH-001-12G` | Proposed | - | - | Post-submit checker policy approval/correction cutover. |
 | `WS-AUTH-001-12H` | Proposed | - | - | Terminal guide activation after 12B2 and the owning CON clean cut. |