WS-ARCH-001-02D: expose ART preparation public boundary

.agent-loop/CURRENT_STATE.md

@@ -28,7 +28,7 @@ authority; these records do not grant or withhold it.
 
 | Initiative | Durable state on `main` | Remaining boundary |
 |---|---|---|
-| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Boundary foundation and TASK, PROJECT, and CHECKER public facts are merged through PR #320; no product behavior was activated | `02D`, the ART hidden-preparation public API and private-edge migration, is the next durable boundary |
+| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Boundary foundation and TASK, PROJECT, CHECKER, and ART hidden-preparation public facts are complete through `WS-ARCH-001-02D`; no product behavior was activated | `WS-ARCH-001-02E` is the ART ready-admission consumption and binding public capability |
 | [WS-ART-001](initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md) | Active delivery initiative; verified ready-admission publication and hidden preparation are merged through `04C2` | Replace the non-executable 05-wave XINT/ART contracts with WS-ARCH-001 split public-API contracts before activation, Submission consumption, or live cutover |
 | [WS-AUTH-001](initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md) | Active delivery initiative; project-policy authority and unified compilation authorization are merged through `12I` | POL-03B consumes 12I next; remaining AUTH activation chunks wait for their exact hidden owner behavior |
 | [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; policy persistence and shared lifecycle audit are merged | Complete hidden services, contribution records, conditional awards, fulfillment, and reconciliation after named AUTH and REV gates |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md

@@ -8,8 +8,8 @@
 | `WS-ARCH-001-02A` | TASKS task/assignment/predecessor and Submission public facts/ports | L1 | Merged PR #314 |
 | `WS-ARCH-001-02B` | PROJECTS locked guide and submission-policy public facts/ports | L1 | Merged PR #315 |
 | `WS-ARCH-001-02C` | CHECKERS effective pre-submit plan and bounded execution-result public facts/ports | L1 | Merged PR #320; no contributor preparation action or public route activated |
-| `WS-ARCH-001-02D` | ART hidden preparation public API and private-edge migration | L1 | Next durable boundary |
-| `WS-ARCH-001-02E` | ART ready-admission consumption and binding public capability | L1 | Proposed after 02D |
+| `WS-ARCH-001-02D` | ART hidden preparation public API and private-edge migration | L1 | Complete; production remains deny-only |
+| `WS-ARCH-001-02E` | ART ready-admission consumption and binding public capability | L1 | Next durable boundary |
 | `WS-ARCH-001-02F` | TASK-owned immutable Submission command and hidden composed transaction | L1 | Proposed after 02E |
 | `WS-ARCH-001-02G` | AUTH contributor preparation activation after the complete hidden path | L1 | Proposed after 02F |
 | `WS-ARCH-001-02H` | AUTH human/fixed-service consumption activation | L1 | Proposed after 02G |

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/INTENT.md

@@ -12,7 +12,9 @@ module and every cross-module call must use a typed public API.
 - The nine business modules and three supporting modules have one canonical
   ownership map.
 - Cross-module runtime imports use only the target module's `api` package.
-- Concrete implementations meet only in the application composition root.
+- Concrete implementations meet only in the application composition root or
+  the exact same-owner `backend/app/adapters/<owner>/__init__.py` composition
+  root; nested adapters and cross-owner private imports remain prohibited.
 - Existing private-import debt is frozen as exact source-to-target edges.
 - Every feature chunk repairs the capabilities and debt edges it touches.
 - No debt count grows, and final closure requires an empty private-import

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md

@@ -22,7 +22,10 @@ canonical module map
    opaque capability Protocols, and ports—not implementation.
 4. The caller supplies server-owned canonical facts; it never receives the
    target's ORM model or repository.
-5. Concrete implementations meet only in the application composition root.
+5. Concrete implementations meet only in the application composition root or
+   the exact same-owner `backend/app/adapters/<owner>/__init__.py` composition
+   root. That adapter root constructs typed public ports; the exception never
+   extends to nested adapter files or cross-owner private imports.
 6. The application composition root opens the SQLAlchemy transaction/unit of
    work and constructs transaction-bound public-port implementations. The
    owning application command coordinates those injected ports without

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md

@@ -18,8 +18,13 @@
 - WS-ARCH-001-02C merged through PR #320. It exposes CHECKER-owned
   effective-plan and bounded execution-result contracts without activating the
   contributor preparation route.
-- Next durable boundary: WS-ARCH-001-02D only, the ART hidden-preparation public
-  API and private-edge migration. Open pull requests show transient ownership.
+- WS-ARCH-001-02D is complete in this change. It moves the hidden preparation
+  route to delivery composition, exposes the bounded ART request/result/command
+  API, consumes TASK/PROJECT/CHECKER public capabilities, keeps AUTH handles
+  opaque, and preserves deny-only availability.
+- Next durable boundary: WS-ARCH-001-02E only, the ART
+  ready-admission consumption and binding public capability. Open pull requests
+  show transient ownership.
 - Repository housekeeping after PR #315 found no competing clean-up
   initiative: WS-ARCH-001 remains the general boundary owner, WS-AUTH-003 owns
   AUTH-specific debt, and test-structure repairs remain incremental with the

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-02D-art-preparation-public-api.md

@@ -26,6 +26,10 @@ edges are removed and final authority remains transaction-bound.
 
 L1
 
+## Merge state
+
+- Outcome on merge: `complete`
+
 ## SLA
 
 P1
@@ -39,22 +43,73 @@ PROJECT, and CHECKER public fact manifests.
 
 ```text
 backend/app/modules/artifacts/api/**
+backend/app/modules/artifacts/authorization.py
+backend/app/modules/artifacts/preparation.py
+backend/app/modules/artifacts/router.py
+backend/app/modules/artifacts/pre_submit_evidence.py
 backend/app/modules/artifacts/submission_admission.py
 backend/app/modules/artifacts/submission_authorization.py
+backend/app/modules/artifacts/submission_materialization.py
 backend/app/modules/artifacts/schemas.py
+backend/app/modules/checkers/api/__init__.py
+backend/app/modules/checkers/api/pre_submit.py
+backend/app/modules/checkers/pre_submit_execution.py
 backend/app/adapters/artifacts/__init__.py
+backend/app/adapters/checkers/__init__.py
+backend/app/adapters/projects/__init__.py
+backend/app/adapters/tasks/__init__.py
+backend/app/api/deps/authorization.py
 backend/app/interfaces/artifact_operations.py
 backend/app/modules/tasks/router.py
+backend/app/api/router.py
+backend/app/api/routes/artifact_submissions.py
 backend/tests/architecture/test_module_boundaries.py
+backend/scripts/module_boundaries.py
+backend/scripts/behavior_ownership.py
+backend/tests/test_behavior_ownership.py
+backend/scripts/run_test_lanes.py
+backend/tests/test_artifact_architecture.py
 backend/tests/test_submission_bundle_admission.py
 backend/tests/test_default_pre_submit_execution.py
+backend/tests/test_effective_pre_submit_execution.py
+backend/tests/test_authorization.py
+backend/tests/test_pre_submit_evidence_relock.py
+backend/tests/pre_submit_test_helpers.py
 .ci/module-boundaries/private-edge-debt.v1.json
+.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/IMPORT_LEDGER.md
+.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json
 .ci/behavior-ownership/**
+.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/TEST_STRUCTURE_DEBT.json
 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/chunks/WS-ARCH-001-02D-art-preparation-public-api.md
+.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md
+.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md
+.agent-loop/CURRENT_STATE.md
 .agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/evidence/WS-ARCH-001-02D-resource-manifest.md
 docs/spec_artifact_storage_service.md
+.agent-loop/policies/architecture-boundaries.md
+.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/INTENT.md
+.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/PLAN.md
+docs/architecture_lockdown.md
+docs/operations_backend_testing.md
+backend/app/adapters/README.md
 ```
 
+## Public and private contract split
+
+- `artifacts.api` owns only dependency-safe route-facing request/result/error
+  values and capability ports. It does not re-export private ART scratch,
+  inspection, custody, manifest, pass-capability, repository, session, or
+  provider types.
+- Process-local sealed preparation and materialization values move out of the
+  repository-global `app.interfaces.artifact_operations` surface and remain
+  ART-private with one physical definition.
+- AUTH handles remain opaque `object` values at ART seams. ART does not import,
+  reconstruct, serialize, or inspect AUTH's private handle class; the concrete
+  transaction-bound AUTH adapter owns validation and consumption.
+- The composition root may import concrete TASK, PROJECT, CHECKER, AUTH, and
+  ART implementations to construct public ports. Route-facing and product
+  module code may depend only on owner public APIs.
+
 ## Not allowed
 
 Action activation; public OpenAPI exposure; Submission creation/binding;
@@ -63,21 +118,33 @@ cross-module imports; serialized prepared handles; compatibility facades.
 
 ## Acceptance criteria
 
-- [ ] The route and composition code depend on `artifacts.api`; ART depends on
-      owner public APIs only.
-- [ ] The public port shape places preflight before byte acceptance and final
+- [x] The route and composition code depend on `artifacts.api`; ART depends on
+      owner public APIs only. The composition root may instantiate concrete
+      implementations but may not hide a service locator or second factory
+      behind the public API.
+- [x] The public port shape places preflight before byte acceptance and final
       prepared-authority consumption in the durable-intent transaction before
       capacity, put attempt, or provider I/O, but production remains deny-only
       and no successful prepared handle is issued or consumed in this chunk.
-- [ ] Planned-action denial, concealment, exact replay, stale lineage, and
+- [x] Planned-action denial, concealment, exact replay, stale lineage, and
       cross-resource attempts preserve zero partial effect and zero provider I/O.
-- [ ] `artifact.submission_bundle.prepare` remains planned/unavailable and the
+- [x] `artifact.submission_bundle.prepare` remains planned/unavailable and the
       route remains hidden.
-- [ ] Every touched private edge is removed.
-- [ ] Submission-preparation types in
-      `app.interfaces.artifact_operations` migrate to `artifacts.api`; no
-      parallel legacy/public ART contract remains.
-- [ ] Record the exact preparation resource/port manifest in
+- [x] Every touched private edge is removed.
+- [x] Route-facing submission-preparation types in
+      `app.interfaces.artifact_operations` migrate to `artifacts.api`.
+      Process-local sealed types become ART-private; no parallel legacy/public
+      ART contract remains.
+- [x] After byte materialization and before evidence persistence, ART re-locks
+      TASK assignment/predecessor facts and PROJECT locked-policy facts through
+      their public ports and compares them with the original CHECKER plan
+      lineage. Stale lineage fails before durable evidence or provider I/O.
+- [x] CHECKER execution is injected at the composition root and returns only
+      public CHECKER result facts. ART constructs and retains its own custody
+      facts; neither module imports the other's private implementation.
+- [x] `artifacts.api` imports no private module and exposes no ORM, session,
+      repository, provider, scratch path, byte buffer, or serialized handle.
+- [x] Record the exact preparation resource/port manifest in
       `.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/evidence/WS-ARCH-001-02D-resource-manifest.md`.
 
 ## Verification commands

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/evidence/WS-ARCH-001-02D-resource-manifest.md

@@ -0,0 +1,74 @@
+# WS-ARCH-001-02D ART Preparation Resource Manifest
+
+## Public entry capability
+
+`app.modules.artifacts.api.SubmissionBundlePreparationCommand.prepare` accepts
+one `SubmissionBundlePreparationRequest` and returns one
+`SubmissionBundlePreparationResult`.
+
+The request carries only:
+
+- dependency-safe `ActorIdentityFacts`;
+- request and correlation identifiers;
+- task, assignment, predecessor, and idempotency identifiers;
+- bounded packet text and media type;
+- the request-local asynchronous byte source.
+
+It carries no authorization context, prepared handle, database session, ORM
+row, provider coordinate, scratch path, inspection result, custody value, or
+durable pass capability. The route remains hidden from OpenAPI and the
+production contributor authority remains deny-only.
+
+## Owner ports consumed by ART
+
+| Owner | Public capability | Facts used by ART |
+|---|---|---|
+| TASK | `TaskSubmissionContextPort.lock_submission_context` | Exact task, assignment, contributor, lifecycle kind/status, predecessor version, and task-stamped project-policy references |
+| PROJECT | `ProjectLockedPolicyContextPort.lock_locked_policy_context` | Exact guide/source lineage, effective artifact policy, compiled pre-submit policy, statuses, and canonical policy JSON |
+| CHECKER | `EffectivePreSubmissionPlanningPort.compile_effective_plan` | Immutable effective plan and plan identity |
+| CHECKER | `PreSubmissionExecutionFacts` | Bounded ordered result facts only; ART retains its own byte and scratch custody |
+| AUTH | `ActorIdentityFacts` plus ART-private opaque authorization port | Active actor and identity-link references; process-local prepared handles remain opaque `object` values and are never serialized |
+
+## Lock and authority order
+
+1. Contributor preflight occurs before the runtime opens or request bytes are
+   read.
+2. TASK and then PROJECT facts are locked through their public ports, and the
+   CHECKER plan is compiled from those exact facts.
+3. ART prepares and inspects bytes in bounded scratch.
+4. Fixed-service materialization authority is consumed before workspace byte
+   access or checker execution.
+5. After execution and scratch cleanup, contributor authority is revalidated,
+   then TASK and PROJECT facts are locked again in the evidence transaction.
+6. Evidence persists only if assignment, predecessor, guide, policy, plan,
+   byte, manifest, and result facts remain exact.
+7. Fresh final contributor authority is prepared and consumed in the durable
+   put-intent transaction before capacity reservation, put-attempt creation,
+   or provider I/O.
+
+## Private custody retained by ART
+
+These values are deliberately not public contracts:
+
+- `PreparedBundleMaterializationRequest`;
+- prepared artifact and generation binding;
+- archive inspection and semantic manifest;
+- scratch workspace and reader;
+- `PreSubmitExecutionCustody`;
+- `PreSubmitPassCapability`;
+- durable put and ready-admission internals.
+
+## Composition
+
+Delivery code lives in `app.api.routes.artifact_submissions`. Owner adapter
+packages bind TASK, PROJECT, CHECKER, and ART implementations to public ports.
+The boundary gate permits an owner adapter to import only its own module's
+private implementation; cross-owner private imports remain ledgered debt and
+new debt remains prohibited against the protected base.
+
+## Denial guarantees
+
+Unavailable authority, changed TASK/PROJECT lineage, mismatched plans or
+results, copied/replayed/wrong opaque handles, and invalid media types fail
+without publishing a successful preparation. Authority handles do not enter
+request schemas, Celery payloads, provider contracts, logs, or persistence.

.agent-loop/initiatives/WS-AUTH-003-module-boundary-recovery/IMPORT_LEDGER.md

@@ -66,14 +66,6 @@ backend/app/modules/artifacts/service.py
   app.modules.authorization.catalogue
   app.modules.authorization.prepared
   app.modules.authorization.runtime
-backend/app/modules/artifacts/submission_admission.py
-  app.modules.authorization.prepared
-backend/app/modules/artifacts/submission_authorization.py
-  app.modules.authorization.prepared
-  app.modules.authorization.runtime
-backend/app/modules/artifacts/submission_materialization.py
-  app.modules.authorization.catalogue
-  app.modules.authorization.prepared
 backend/app/modules/projects/authorization_reads.py
   app.modules.authorization.catalogue
   app.modules.authorization.kernel
@@ -115,8 +107,6 @@ backend/app/modules/projects/sufficiency_mutation_service.py
   app.modules.authorization.runtime
 backend/app/workers/project_setup.py
   app.modules.authorization.prepared
-backend/app/modules/tasks/router.py
-  app.modules.authorization.runtime
 ```
 
 The ledger validator decodes numeric Markdown entities before comparing exact