ART 04B2: execute default pre-submit checks

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/AUTH_HANDOFF.md

@@ -144,6 +144,15 @@ Each fixed service action retains its canonical provisioned service identity,
 matrix row, resource facts, terminal reauthorization, and separate activation
 evidence. No human grant supplies fixed service authority.
 
+04B2 defines the pre-submit materializer facts as task, assignment, project,
+effective submission-artifact-policy ID, pre-submit checker-policy ID,
+process-local prepared generation, effective-plan hash, catalogue-manifest hash,
+archive SHA-256/byte count, and semantic-manifest hash. The fixed
+`workstream.artifact.materializer` capability must be consumed before any
+prepared-byte read, ZIP open, workspace reservation, or checker result. ART
+ships only a deny-by-default adapter while the action is planned; XINT-06A owns
+the later activation after 04B3.
+
 ## Fail-Closed Rule
 
 An ART implementation contract stops if its required AUTH registration or

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/CHUNK_MAP.md

@@ -30,8 +30,8 @@ they cross multiple L1 boundaries.
 | `WS-ART-001-04A2` | Add bounded one-outer-ZIP intake and archive-safety inspection in private scratch. | L1 | Merged PR #266 |
 | `WS-ART-001-04A3` | Add canonical semantic manifest, executable normalization, and unchanged-work gate. | L1 | Merged PR #268 |
 | `WS-ART-001-04A4` | Former early removal of the legacy independently invocable caller-owned submission-precheck route and contract. | L1 | Superseded by PLAN5; complete removal belongs to 05B |
-| `WS-ART-001-04B1` | Add the single versioned checker catalogue and compile one effective execution plan from platform defaults plus locked project policy. | L1 | Active implementation |
-| `WS-ART-001-04B2` | Materialize the sealed manifest tree once and execute the mandatory platform/default catalogue phases. | L1 | Proposed after 04B1 |
+| `WS-ART-001-04B1` | Add the single versioned checker catalogue and compile one effective execution plan from platform defaults plus locked project policy. | L1 | Merged PR #276 |
+| `WS-ART-001-04B2` | Materialize the sealed manifest tree once and execute the mandatory platform/default catalogue phases. | L1 | Active implementation |
 | `WS-ART-001-04B3` | Execute locked project-policy rules through the same plan and persist one bounded immutable evidence set. | L1 | Proposed after 04B2 |
 | `WS-ART-001-04C1` | Reauthorize and atomically persist capacity plus durable put intent, then write the checked ZIP once. | L1 | Proposed after XINT-06A |
 | `WS-ART-001-04C2` | Reuse verification/recovery to publish one capacity-charged ready admission and compose the hidden continuous endpoint. | L1 | Proposed after 04C1 |

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/DISCOVERY.md

@@ -278,3 +278,90 @@ embedded in the compiled `PreSubmitCheckerPolicy`. The existing task-locked
 compiled-bundle hash therefore commits to the exact default snapshot without a
 second task-lock field; runtime derives and records the effective-plan hash from
 that same snapshot plus the locked project rules.
+
+## 2026-08-05 ART-04B2 Default Checker Execution Discovery
+
+Observations on merged `main` at `bb77ff4a`:
+
+- `ArtifactPreparationService` already owns the one process-local
+  `PreparedArtifact`, its server-computed archive commitment, a read-only
+  anonymous second-pass stream, deadline enforcement, and idempotent release.
+  `PreparedArtifact.inspect()` is therefore the only acceptable outer-ZIP read
+  seam for 04B2.
+- `ArtifactScratchManager.extraction_workspace()` already provides the bounded,
+  private, crash-recoverable workspace required for a projected checker tree.
+  04B2 must extend this existing custody path; it must not create another scratch
+  manager or use direct temporary paths.
+- Its current recursive cleanup incorrectly reuses `maximum_files` (default 8),
+  while archive admission permits 2,000 entries, and workspace expansion is not
+  charged as a separate byte/entry reservation. 04B2 must repair that shared
+  quota contract before projecting any untrusted tree.
+- `SubmissionArchiveInspector` is the canonical 04A2 ZIP implementation and
+  returns normalized paths, entry types, per-file SHA-256/size, and normalized
+  executable intent. `SubmissionManifest` is the sole 04A3 semantic identity.
+  Materialization must reuse those exact facts and reject any projected mismatch
+  before exposing the tree to checker adapters.
+- `PreparedBundleMaterializationRequest` and
+  `ArtifactMaterializationPort.materialize_prepared_bundle()` already reserve
+  the hidden fixed-service seam. The AUTH catalogue maps
+  `artifact.pre_submit.checker_input.materialize` exclusively to
+  `workstream.artifact.materializer`; `AUTH_ART_04B` is its catalogue custodian,
+  while XINT-06A is the later planned activation point after hidden 04B3.
+- ART-04B1 now owns the single immutable catalogue and effective execution plan.
+  No execution module exists yet. The platform/default executor must consume the
+  exact plan identity and ordered entries rather than reconstructing checker
+  names, dependencies, classifications, or enabled state.
+- The legacy checker runner consumes mutable pre-Submission/task ORM objects and
+  caller-shaped packet manifests. Its small pure validation helpers may inform
+  behavior, but its registry/context is not the authoritative 04B2 boundary and
+  must not become a second catalogue or a dependency of the sealed tree.
+- No `SealedSubmissionTree`, bounded catalogue-result type,
+  `test_checker_materialization.py`, or
+  `test_default_pre_submit_execution.py` exists on current main.
+
+Implementation constraints derived from current code:
+
+- Add one canonical projection capability alongside the canonical ZIP inspector,
+  so structural validation and extraction cannot drift into separate ZIP
+  implementations. Projection re-reads each member once, compares the exact 04A
+  entry facts, writes with no-follow/exclusive semantics, and seals fixed modes
+  before returning a process-local capability.
+- A sealed-tree capability may expose bounded trusted reads to checker adapters,
+  but it may not expose a serializable scratch path, execute a submitted file, or
+  outlive its `ArtifactScratchManager` workspace.
+- The implementation uses callback-scoped ownership: the prepared-artifact owner
+  authorizes first, reserves an expanded-byte/entry workspace, projects and seals
+  the tree, dispatches adapters, then cleans the workspace before returning only
+  bounded results. This removes any optional-close or escaped-path lifetime.
+- Execute only custody, identity, materialization, and default-policy entries in
+  04B2. Project-policy entries remain untouched for 04B3, and no result becomes
+  durable in this chunk.
+- Default-policy configuration is not read back from the merged project policy.
+  Each adapter's closed Workstream-default semantics are versioned by the exact
+  catalogue entry ID/version and catalogue-manifest hash already committed into
+  the effective plan. Changing those semantics requires a definition-version and
+  catalogue-version decision rather than an untracked runtime constant change.
+- Custody and identity adapters validate the already-produced 04A typed facts;
+  they do not perform a third archive inspection or compute a competing identity.
+  The materialization entry is the gate after which default-policy adapters may
+  receive the sealed-tree capability.
+- Result envelopes must be fixed-size, path-redacted, plan-bound, and explicit
+  about pass, blocking failure, advisory warning, or advisory-disabled state.
+  Dependency failure stops dependent dispatch; a disabled mandatory definition
+  is infrastructure-unavailable and can never be emitted as success.
+- Prepared authorization is consumed through the existing opaque handle at the
+  hidden fixed-service composition seam before any prepared-byte read, ZIP open,
+  workspace reservation, or checker fact. Until XINT-06A activates the action
+  owned in the catalogue by `AUTH_ART_04B`, production composition remains fail
+  closed. Because AUTH intentionally has not activated this action, tests use a
+  typed, bounded protocol double and opaque handle sentinel; the denial path
+  uses production `DenyPreSubmitMaterializationAuthorization`. Live AUTH proof
+  remains owned by XINT-06A.
+
+Plan-review correction: the canonical projection must be a method of
+`SubmissionArchiveInspector` or use a private traversal shared solely inside
+`submission_archive.py`. The 04B2 executor accepts a closed phase slice and
+rejects or ignores no entries: encountering a project-policy or policy-primitive
+entry in its dispatch set is a caller/plan error, while the normal complete plan
+is sliced deterministically before dispatch. Tests must also prove the legacy
+checker registry and standalone precheck path are not consulted.

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md

@@ -124,18 +124,14 @@ supersedes 04A4, makes 04B1 the next implementation chunk, and assigns complete
 legacy route/public-service/internal-guard/caller-package removal to the 05B
 admission-backed Submission cutover.
 
-`WS-ART-001-04B1` is active on its bounded worktree. It owns only the immutable
-typed catalogue, startup-fixed availability validation, migration of the
-existing compiler away from parallel primitive maps, and pure composition of
-one lineage-bound effective plan. It performs no ZIP read, scratch
-materialization, checker execution, durable write, route exposure, or AUTH
-activation.
-
-The implementation and deterministic evidence are complete in draft PR #276.
-All required internal reviewer tracks ran successfully after their valid
-findings were repaired. CodeRabbit completed substantive review and its two
-actionable threads were repaired and resolved. The ready PR now waits only for
-the final hosted Backend rerun on the repaired head.
+`WS-ART-001-04B1` merged through PR #276 and supplies the immutable typed
+catalogue plus lineage-bound effective plan. `WS-ART-001-04B2` is implemented
+and internally reviewed on its bounded branch; hosted PR gates and human merge
+remain pending. It owns only fixed-service authorization before byte access,
+quota-reserved callback-scoped sealed ZIP projection, platform/default phase
+execution, bounded non-durable results, and cleanup. It performs no
+project-policy execution, durable evidence/admission/Submission write, route
+exposure, provider I/O, or AUTH activation.
 
 ## Gate