plan(auth): split guide activation gates

[Abiorh001]

Intent

Remove the retired signed-loop blocker and correct the guide-activation plan before implementation.

What changed

• Split WS-XINT-002-04 into 04A guide ingest and 04B guide read/binding at the ART-03A/03B evidence boundary.
• Require ART-03A to merge on the opaque transaction-bound PREP seam before AUTH activates ingest.
• Explicitly reject raw AuthorizationContext or an ART-local alternate authority protocol as durable mutation authority.
• Narrow allowed files and record merged XINT-02/03 status.

Why

The preserved ART-03A worktree is uncommitted and still uses a raw-context/local-authority seam that is incompatible with merged XINT-02. Treating it as activation evidence would create a dual authorization path. Current guide actions remain planned and fail closed.

Evidence

• Architecture: PASS
• Security: PASS
• Product/operations: PASS
• Senior engineering: PASS
• Documentation: PASS
• Markdown links: PASS
• Authorization stale scan: PASS
• Artifact contract stale scan: PASS
• git diff --cached --check: PASS

Human review focus

Confirm the 04A/04B evidence split, opaque PREP-only entry gate, manager-only ingest ordering, and that ART-03A must merge before runtime activation.

Summary by CodeRabbit

• Documentation
  • Split guide authorization activation into two clearly defined stages: guide ingest, followed by guide binding and read access.
  • Added acceptance criteria, verification checklists, and review requirements for each stage.
  • Clarified sequencing, prerequisites, authorization boundaries, and scenarios that must be denied.
  • Updated project status and planning guidance to reflect the staged activation process.
  • Removed the superseded combined guide activation contract.

[coderabbitai]

Warning

Review limit reached

@Abiorh001, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c1e47cf1-a145-453d-b9cd-270572e10758

📥 Commits

Reviewing files that changed from the base of the PR and between 5cadec3 and 794c175.

📒 Files selected for processing (2)

• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04A-guide-ingest-activation.md
• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04B-guide-read-binding-activation.md

📝 Walkthrough

Walkthrough

The WS-XINT-002 guide activation plan is split into 04A for PREP-gated guide ingest and 04B for ART-03B-gated fixed-service binding/read, with updated status, sequencing, scope, acceptance, and verification contracts.

Changes

Guide activation

Layer / File(s)	Summary
Activation plan and sequencing .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md, .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md, .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-03-pr-trust-bundle.md	The guide wave is divided into 04A after ART-03A and 04B after ART-03B, with corresponding durable status and next-gate updates.
Guide ingest activation contract .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04A-guide-ingest-activation.md	Defines PREP-gated activation for artifact.guide_source.ingest, including atomic denial, locked facts, scope restrictions, and verification requirements.
Guide binding and read activation contract .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04B-guide-read-binding-activation.md	Defines ART-03B-gated fixed-service binding and read authorization, denial cases, prohibited scope, and verification requirements.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Flow-Research/workstream#209: Earlier planning for the WS-XINT-002 guide-activation chunk that this PR splits into 04A and 04B.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers intent, changes, why, evidence, and review focus, but omits many required template sections and fields.	Add the missing template sections: Chunk, Goal, Design Chosen, Alternatives Rejected, Scope Control, Evidence commands/results, Test Delta, reviewer tables, CI checks, risks, follow-up, and merge ownership.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: splitting guide activation gates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/ws-xint-002-04-guide-activation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
@.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04A-guide-ingest-activation.md:
- Around line 21-32: Replace the recursive allowed-file globs in
.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04A-guide-ingest-activation.md
lines 21-32 with an explicit manifest listing only the permitted implementation,
test, and evidence files. Apply the same explicit scope boundary in
.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04B-guide-read-binding-activation.md
lines 18-28, ensuring contract files cannot be modified by the implementation
PR.

In
@.agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04B-guide-read-binding-activation.md:
- Around line 36-46: Update the acceptance criteria for
artifact.guide_source.binding.create and artifact.guide_source.read to require
prepared-authority validation and consumption before any provider read or
binding write. Ensure stale, replayed, revoked, mismatched, or otherwise
unauthorized authority fails before I/O, while successful binding state and
evidence commit atomically.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: beee1ece-9ea5-46b6-b269-7f9e893192e5

📥 Commits

Reviewing files that changed from the base of the PR and between 4336664 and 5cadec3.

📒 Files selected for processing (6)

• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/CHUNK_MAP.md
• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/STATUS.md
• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04-guide-activation.md
• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04A-guide-ingest-activation.md
• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04B-guide-read-binding-activation.md
• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/reviews/WS-XINT-002-03-pr-trust-bundle.md

💤 Files with no reviewable changes (1)

• .agent-loop/initiatives/WS-XINT-002-art-auth-end-to-end/chunks/WS-XINT-002-04-guide-activation.md