feat(auth): add submission policy authority foundation

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md

@@ -184,7 +184,7 @@ bounded merge.
 | `WS-AUTH-001-12D2` | Superseded | - | #248 | XINT-003-02A/02B own immutable review/revision policy lineage and the sole authorized mutation path; 02B merged as `25fc27c4`. |
 | `WS-AUTH-001-12E` | Merged | `codex/ws-auth-001-12e-guide-sufficiency` | #263 | Three guide-sufficiency actions plus fixed setup-service run PREP merged as `b510bc4f`. |
 | `WS-AUTH-001-12F` | Planning split | `codex/ws-auth-001-12f-submission-artifact-policy` | - | Combined contract failed required L1 pre-start review; parent now activates nothing and delegates to 12F1-12F4. |
-| `WS-AUTH-001-12F1` | Proposed | - | - | Submission-policy PREP, replay, and provenance foundation; zero activation. |
+| `WS-AUTH-001-12F1` | External review | `codex/ws-auth-001-12f1-submission-policy-foundation` | - | Submission-policy PREP, replay, provenance, and audit custody foundation complete; zero activation; hosted CI and CodeRabbit pending. |
 | `WS-AUTH-001-12F2` | Proposed | - | - | Governed Project Manager manual-draft create/update cutover. |
 | `WS-AUTH-001-12F3` | Proposed | - | - | Fixed setup-service derivation and asynchronous executor cutover. |
 | `WS-AUTH-001-12F4` | Proposed | - | - | Project Manager approval and atomic effective/pre-submit policy chain. |

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-12F1-submission-policy-authority-foundation.md

@@ -19,10 +19,14 @@ backend/app/modules/projects/repository.py
 backend/app/modules/authorization/kernel.py
 backend/app/modules/authorization/prepared.py
 backend/app/modules/authorization/runtime.py
+backend/app/modules/audit/schemas.py
 backend/alembic/versions/<then-current-next>_submission_policy_authority.py
 backend/tests/test_authorization.py
 backend/tests/test_projects.py
 backend/tests/test_alembic.py
+backend/tests/conftest.py
+backend/tests/test_review_lease_persistence.py
+.github/workflows/backend.yml
 docs/spec_authorization_service.md
 docs/operations_authorization_service.md
 .agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/**
@@ -51,14 +55,17 @@ mutation, post-submit behavior, or edits to historical migrations.
   response and exact target IDs once. The append-only authorization decision
   stream remains separate audit evidence. A unique constraint owns the human
   namespace `(actor_profile_id, idempotency_key)`; a second unique constraint
-  owns `(service_actor_profile_id, setup_run_id, setup_generation,
+  owns `(actor_profile_id, setup_run_id, setup_generation,
   setup_task_id, correlation_id, action_id)`. Reserve/find/complete and rollback
   locate the same row by operation UUID, and changed namespace facts never
   attach to an existing reservation.
 - Add nullable local provenance columns and closed constraints for draft
   policy, effective policy, and pre-submit policy. Historical bootstrap rows
-  remain readable and are never backfilled or rewritten. Newly authorized rows
-  require complete actor/link/grant-or-service/scope/action/decision evidence.
+  and rows still written by the uncut legacy routes remain readable in the
+  all-null unattributed shape and are never backfilled or rewritten. Only rows
+  written through the new 12F orchestrator use the complete authorized shape;
+  those rows require complete actor/link/grant-or-service/scope/action/decision
+  evidence. 12F2-12F4 own removal of the unattributed write paths.
 - The new orchestrator is flush-only. Route/Celery owners commit or roll back;
   no wrapper calls a legacy self-committing mutation method.
 - Reuse the merged `PreparedAuthorizationService`/runtime context and the 12E
@@ -67,6 +74,9 @@ mutation, post-submit behavior, or edits to historical migrations.
   second authorization protocol, replay state machine, UUID parser, or locking
   protocol; shared dependencies are extracted when their semantics are exact.
 - The catalogue remains planned and database/runtime parity remains exact.
+  `backend/app/modules/authorization/catalogue.py` is out of scope: 12F1 may
+  neither change action ownership/availability nor make the existing planned
+  fixed-service membership usable.
 
 ## Acceptance and proof
 
@@ -79,8 +89,9 @@ mutation, post-submit behavior, or edits to historical migrations.
 - Fault injection proves product rows, replay completion, allowed decision
   evidence, and local provenance roll back together.
 - Seeded historical rows survive upgrade unchanged; populated authorized
-  evidence blocks downgrade, empty downgrade succeeds, and re-upgrade restores
-  the schema. Migration allocation is taken only from then-current main.
+  evidence or any replay reservation row, including `pending`, blocks
+  downgrade; empty downgrade succeeds, and re-upgrade restores the schema.
+  Migration allocation is taken only from then-current main.
 - No action becomes active and no route behavior changes.
 
 ## Verification commands

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-12F1-internal-review-evidence.md

@@ -0,0 +1,44 @@
+# WS-AUTH-001-12F1 Internal Review Evidence
+
+## Scope reviewed
+
+Zero-activation submission-policy PREP binding, human/fixed-service replay
+custody, nullable historical provenance, migration 0057, audit evidence shape,
+deferred database custody, and focused coverage enforcement.
+
+## Reviewer results
+
+- Architecture: PASS after full replay namespace completion and exact
+  policy/effective/pre-submit lineage and digest binding were added.
+- Security/auth: PASS WITH LOW RISKS after kernel, typed audit input, database
+  audit vocabulary, project target, and custody trigger evidence were aligned.
+- QA: PASS WITH LOW RISKS. Full writer rollback proof remains assigned to the
+  first activating writer chunks, 12F2-12F4.
+- Senior engineering: PASS WITH LOW RISKS. Operation identity, provenance
+  immutability, and typed completion targets are closed.
+- Test delta: PASS. Real PostgreSQL convergence, migration replay guards,
+  downgrade blockers, and AUTH evidence mapping are covered.
+- CI integrity: PASS. The new repository and service have an explicit hosted
+  per-file 90 percent gate; local focused coverage is 93.75 percent.
+- Documentation: PASS WITH LOW RISKS; all valid wording findings were fixed.
+- Reuse/dedup: PASS. Existing PREP, resource digest, setup custody, and replay
+  conventions are reused without a second authorization protocol.
+- Product/operations: PASS WITH LOW RISKS after approval and generated-output
+  provenance became immutable once attributed; zero activation is preserved.
+
+## Repairs driven by review
+
+- Added the complete immutable catalogue/compiler projection and JSON-safe
+  canonicalization.
+- Made operation UUID and every human/service namespace fact exact across
+  reserve, conflict lookup, and completion.
+- Derived replay JSON and digest only from the typed authorization context.
+- Added typed committed policy, effective-policy, and pre-submit-policy IDs.
+- Added deferred replay/product/audit custody with exact project, guide,
+  snapshot, policy, output hash, grant/service, and decision evidence checks.
+- Preserved all-null historical rows while blocking downgrade on replay,
+  attributed provenance, or submission-policy authorization audit evidence.
+- Kept all four submission-policy actions planned and unavailable.
+
+All internal reviewer sessions completed. Hosted database tests, aggregate
+coverage, Agent Gates, and CodeRabbit remain required on the exact pushed head.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-12F1-pr-trust-bundle.md

@@ -0,0 +1,87 @@
+# Workstream PR Trust Bundle
+
+## Chunk
+
+`WS-AUTH-001-12F1` - Submission Policy Authority Foundation
+
+## Goal
+
+Install exact PREP, replay, provenance, audit, and transaction custody needed by
+12F2-12F4 without activating any submission-policy mutation action or changing
+route, worker, or product behavior.
+
+## What changed
+
+- Extended the typed submission-policy authorization context with exact
+  operation, request, policy, setup, compiler, catalogue, and output facts.
+- Added whole-context PREP equality and canonical resource-digest binding.
+- Added flush-only human/fixed-service replay reservation and typed completion.
+- Added migration 0057 nullable provenance, replay constraints, immutable
+  completion, deferred product/evidence custody, and guarded downgrade.
+- Aligned kernel, audit schema, and database evidence vocabulary for the future
+  exact submission-policy mutation resource.
+- Added focused unit, PostgreSQL convergence, migration, audit, documentation,
+  and per-file coverage proof.
+
+## Scope and behavior
+
+- No action is activated.
+- No API route, Celery worker, agent call, or product-policy writer changes.
+- Historical product rows remain readable with all authority provenance null.
+- 12F2 owns manual create/update, 12F3 owns fixed-service derive, and 12F4 owns
+  approval plus effective/pre-submit output creation.
+
+## Evidence
+
+```text
+Ruff app/tests/scripts: passed
+AUTH exact selector: 3 passed
+Replay/service unit selector: 2 passed
+CI lane contract: 33 passed
+Focused per-file coverage: repository 92.31%, service 94.74%, total 93.75%
+Semantic collection: 3,277 tests
+Stale authorization docs: passed
+Markdown links: passed
+git diff --check: passed
+```
+
+PostgreSQL and Alembic selectors require `WORKSTREAM_TEST_DATABASE_URL` and are
+delegated to the hosted Backend matrix rather than the user's slow local host.
+
+## Acceptance proof
+
+- [x] All submission-policy mutation actions remain planned/unavailable.
+- [x] PREP binds the exact typed context and computed resource digest.
+- [x] Human and fixed-service replay namespaces are disjoint and exact.
+- [x] Completion uses operation UUID plus the complete immutable namespace.
+- [x] Product provenance, replay completion, and allowed evidence are linked by
+      deferred database custody.
+- [ ] Historical null provenance survives upgrade and empty roundtrip (hosted
+      Backend result pending on the corrected exact head).
+- [ ] Pending replay and admitted audit evidence block downgrade (hosted
+      Backend result pending on the corrected exact head).
+- [x] New subsystem files have a non-weakened hosted 90 percent coverage gate.
+
+## Internal review
+
+Architecture, security, QA, senior engineering, test delta, CI integrity,
+documentation, and reuse/dedup completed with no blocking findings. Product/ops
+review passed after approval/output provenance immutability was added.
+
+## Remaining risk and follow-up
+
+- Hosted PostgreSQL migration/custody tests and repository-wide aggregate
+  coverage must pass on the exact pushed head.
+- Full real-writer fault injection is intentionally proved in 12F2-12F4 because
+  this foundation activates no product writer.
+
+## Human review focus
+
+- Zero activation and absence of route/worker behavior changes.
+- Full human/service replay namespace and single completion transition.
+- Deferred custody across policy/effective/pre-submit rows and AUTH evidence.
+- Historical all-null provenance and downgrade refusal predicates.
+
+## Human merge ownership
+
+- [ ] The user explicitly approved this specific PR for merge.

.github/workflows/backend.yml

@@ -459,6 +459,23 @@ jobs:
             coverage report --include="${source}" --precision=2 --fail-under=90
           done
 
+      - name: Submission policy authority foundation per-file coverage
+        working-directory: backend
+        shell: bash
+        env:
+          PYTEST_DISABLE_PLUGIN_AUTOLOAD: "1"
+        run: |
+          set -euo pipefail
+          coverage run --append -m pytest -q -p pytest_asyncio.plugin \
+            tests/test_projects.py \
+            -k 'submission_artifact_policy_replay_repository or submission_artifact_policy_authority_service'
+          for source in \
+            app/modules/projects/submission_policy_mutation_repository.py \
+            app/modules/projects/submission_policy_mutation_service.py
+          do
+            coverage report --include="${source}" --precision=2 --fail-under=90
+          done
+
       - name: API controls coverage
         working-directory: backend
         run: >-