feat(auth): cut over project identity reads

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md

@@ -52,8 +52,8 @@ stopped.
 | `WS-AUTH-001-10B2` | Privacy-Safe Project Role Grant Reads | L1 | Proposed after 10B1 |
 | `WS-AUTH-001-10C` | Project Role Grant Mutations | L1 | Proposed after 10B2 |
 | `WS-AUTH-001-11` | Project Read Cutover Planning Parent | L1 | Signed start run `30167274426`; planning split authored, no runtime implementation |
-| `WS-AUTH-001-11A` | Project Read Catalogue And Projection Foundation | L1 | Proposed successor; migration `0035`, no active surface |
-| `WS-AUTH-001-11B` | Project Identity And Actor Context Cutover | L1 | Proposed after 11A |
+| `WS-AUTH-001-11A` | Project Read Catalogue And Projection Foundation | L1 | Merged in PR #208; migration `0035`, no active surface |
+| `WS-AUTH-001-11B` | Project Identity And Actor Context Cutover | L1 | Implementation after merged 11A |
 | `WS-AUTH-001-11C1` | Project Setup Diagnostic Read Cutover | L1 | Proposed after 11B |
 | `WS-AUTH-001-11C2` | Effective Policy And Active Guide Read Cutover | L1 | Proposed after 11C1 |
 | `WS-AUTH-001-12` | Project Policy And Setup Mutation Cutover | L1 | Proposed |

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md

@@ -157,8 +157,8 @@ None.
 | `WS-AUTH-001-PREP` | Merged | `codex/ws-auth-001-prep` | #162 | Merged as `c559d556` on 2026-07-21; adds no feature consumer or activation. |
 | `WS-AUTH-001-10` | Proposed | - | - | Project contributor grants. |
 | `WS-AUTH-001-11` | Planning split authored | `codex/ws-auth-001-11-project-read-cutover` | - | Exact hard-cutover inventory split into 11A, 11B, 11C1, and 11C2; signed automation remains the live-state authority. |
-| `WS-AUTH-001-11A` | Proposed | - | - | Project-read action catalogue and migration `0035`; no activation. |
-| `WS-AUTH-001-11B` | Proposed | - | - | Project identity and self authorization-context cutover. |
+| `WS-AUTH-001-11A` | Merged | `codex/ws-auth-001-11a-project-read-catalogue` | #208 | Registered the project-read catalogue and migration `0035`; no activation. |
+| `WS-AUTH-001-11B` | Implementation | `codex/ws-auth-001-11b-project-identity-context` | - | Project identity and self authorization-context hard cutover. |
 | `WS-AUTH-001-11C1` | Proposed | - | - | Setup and draft diagnostic read cutover. |
 | `WS-AUTH-001-11C2` | Proposed | - | - | Effective policy and active-guide read cutover. |
 | `WS-AUTH-001-12` | Proposed | - | - | Project policy/setup mutation cutover. |
@@ -168,8 +168,9 @@ None.
 | `WS-AUTH-001-16` | Proposed | - | - | Conformance and live proof. |
 
 Feature-gated registration and activation chunks are enumerated in
-`CHUNK_MAP.md` and `ACTIVATION_CUSTODY.md`. They remain inactive until exact
-merged feature manifests and separate human starts exist.
+`CHUNK_MAP.md` and `ACTIVATION_CUSTODY.md`. Actions remain inactive until their
+bounded implementation and required evidence are reviewed and human-merged;
+planning artifacts do not activate or lock work.
 
 ## Blockers
 

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-11B-project-identity-actor-context.md

@@ -2,7 +2,9 @@
 
 ## Status
 
-Proposed and inactive after 11A. Requires a separate signed explicit start.
+Authorized for implementation after AUTH-11A merged in PR #208. Work follows
+the repository's simple engineering loop; planning artifacts do not activate or
+lock execution.
 
 ## Goal
 
@@ -17,23 +19,35 @@ L1 / P1
 ## Allowed files
 
 ```text
-backend/app/modules/projects/**
+backend/app/modules/projects/router.py
+backend/app/modules/projects/schemas.py
+backend/app/modules/projects/service.py
+backend/app/modules/projects/repository.py
+backend/app/api/deps/authorization.py
 backend/app/api/routes/auth.py
-backend/app/api/router.py
-backend/app/modules/actors/**
-backend/app/modules/authorization/**
-backend/app/modules/audit/**
+backend/app/modules/actors/schemas.py
+backend/app/modules/actors/service.py
+backend/app/modules/authorization/catalogue.py
+backend/app/modules/authorization/kernel.py
+backend/app/modules/authorization/read_service.py
+backend/app/modules/authorization/repository.py
+backend/app/modules/authorization/runtime.py
 backend/tests/test_projects.py
 backend/tests/test_auth.py
+backend/tests/test_actors.py
 backend/tests/test_authorization.py
+backend/tests/test_api_controls.py
 backend/scripts/api_contract_e2e.py
 .github/workflows/backend.yml
 docs/operations_authorization_service.md
 docs/operations_roles_permissions.md
 docs/operations_project_operating_manual.md
 docs/spec_authorization_service.md
-.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/**
-.agent-loop/merge-intents/WS-AUTH-001-11B.json
+.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md
+.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md
+.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-11B-project-identity-actor-context.md
+.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-11B-internal-review-evidence.md
+.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-11B-pr-trust-bundle.md
 ```
 
 ## Not allowed
@@ -50,15 +64,55 @@ project collection/list API
 - Activate only `project.read` and `actor.authorization_context.read`.
 - Resolve the canonical project before authorization; unknown, cross-project,
   unauthorized, inactive-grant, and out-of-scope requests are concealed by the
-  action-aware public denial contract.
+  action-aware public denial contract. Both 11B actions use the shared denial
+  translator and preserve their authorization evidence before returning the
+  identical public not-found envelope.
 - Eligible scoped admin grants receive the registered project identity view.
+  This means Operator system scope and effective system/project-scoped Project
+  Manager, Finance Authority, and Audit Authority grants. Access Administrator
+  alone is denied because its registered permission set excludes
+  `project.read`. All four eligible admin roles share the existing registered
+  `ProjectResponse` fields: id, name, slug, description, lifecycle status,
+  created_at, and updated_at; 11B does not expose setup, guide, policy, task,
+  submission, compensation, or reputation data through this route.
   Active exact-project submitter, reviewer, and adjudicator grants independently
-  receive only the minimal project identity projection.
+  receive only the minimal project identity projection: project id, name, and
+  lifecycle status. Contributor responses omit slug, description, and
+  timestamps. A caller with both kinds of authority receives the registered
+  admin projection; response selection is server-owned.
+- Admin and contributor projections use distinct strict response schemas; the
+  minimal contributor projection cannot validate or serialize the omitted
+  admin-only fields.
 - The context response is self-only, exact-project, derived from current local
   grants and action availability, and cannot advertise planned/inactive actions.
+  A caller with no effective local authority for that project receives the same
+  concealed not-found response rather than an empty context that confirms the
+  project exists.
+  It returns the caller actor-profile id and status, the exact project id,
+  effective active admin-role names and independent project-role names for that
+  project, and the sorted active action ids those grants currently permit. It
+  exposes neither grant ids nor identity-link data. Action ids are evaluated
+  for the exact canonical project target and limited to active, route-backed
+  project actions currently executable there; system, actor-administration,
+  and unrelated project actions are excluded.
+- Contributor project visibility and context derivation revalidate the current
+  human ActorProfile and exact ActorIdentityLink in the request transaction;
+  suspension, deactivation, or link revocation denies a stale bearer token even
+  while a project-role grant remains active.
 - Routers declare one primary ActionId and target; policy stays in the kernel or
   feature policy layer. Both routes use local grants as their sole product-
   authority source after cutover.
+- `project.read` uses one typed exact-project resource context and the central
+  authorization decision/evidence path. Allowed decisions distinguish a
+  matched admin-role grant from a matched project-role grant and persist the
+  matched grant plus project scope; no service-layer boolean role check may
+  bypass or duplicate the kernel.
+- `actor.authorization_context.read` uses a distinct typed self-plus-project
+  resource context. An AUTH-owned read projection service derives its strict
+  response from canonical grant and catalogue state; actor service remains
+  limited to actor-profile behavior and the kernel is not used as a read model.
+  Capability derivation does not call `require` once per candidate action or
+  stage synthetic per-action decision events.
 - Exact-project allow, cross-project deny, role revocation independence,
   minimal-field, concealed-not-found, audit, invalidation, and live API tests
   pass.
@@ -70,16 +124,23 @@ project collection/list API
 
 ```bash
 (cd backend && .venv/bin/python -m ruff check app tests scripts)
-(cd backend && WORKSTREAM_DATABASE_URL=<test-db> .venv/bin/python -m pytest -q tests/test_authorization.py tests/test_auth.py tests/test_projects.py --cov=app.modules.authorization --cov=app.modules.actors --cov=app.modules.projects --cov-report=term-missing --cov-fail-under=90)
+(cd backend && WORKSTREAM_DATABASE_URL=<test-db> .venv/bin/python -m pytest -q tests/test_authorization.py tests/test_auth.py tests/test_actors.py tests/test_projects.py tests/test_api_controls.py --cov=app.modules.authorization --cov=app.modules.actors --cov=app.modules.projects --cov-report=term-missing)
 (cd backend && WORKSTREAM_DATABASE_URL=<test-db> .venv/bin/python scripts/api_contract_e2e.py)
-python3 scripts/test_agent_gates.py
+python3 scripts/check_stale_workstream_wording.py
+python3 scripts/check_stale_authorization_docs.py
+python3 scripts/check_markdown_links.py
+python3 -m unittest -v scripts.test_lightweight_agent_gates
 git diff --check
 ```
 
 Hosted `Backend / test` is mandatory before merge and must preserve the full
 semantic lanes, API E2E, repository-wide 78 percent floor, and applicable
 actor/authorization subsystem 90 percent floors. This child adds a protected
-`app/modules/projects/*` 90 percent coverage report to that hosted gate.
+authorization-boundary test delta for every new project-read path; it does not
+claim that the pre-existing broad project subsystem has reached the dedicated
+90 percent uplift milestone. The full suite and coverage run in GitHub Actions;
+local verification is limited to focused tests, lint, API contract, and
+deterministic repository checks.
 
 ## Required reviewers
 

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-11C1-project-setup-diagnostic-reads.md

@@ -69,16 +69,17 @@ token-role fallback or dual authorization
 
 ```bash
 (cd backend && .venv/bin/python -m ruff check app tests scripts)
-(cd backend && WORKSTREAM_DATABASE_URL=<test-db> .venv/bin/python -m pytest -q tests/test_authorization.py tests/test_projects.py --cov=app.modules.authorization --cov=app.modules.projects --cov-report=term-missing --cov-fail-under=90)
+(cd backend && WORKSTREAM_DATABASE_URL=<test-db> .venv/bin/python -m pytest -q tests/test_authorization.py tests/test_projects.py --cov=app.modules.authorization --cov-report=term-missing --cov-fail-under=90)
 (cd backend && WORKSTREAM_DATABASE_URL=<test-db> .venv/bin/python scripts/api_contract_e2e.py)
 python3 scripts/test_agent_gates.py
 git diff --check
 ```
 
 Hosted `Backend / test` is mandatory before merge and must preserve the full
 semantic lanes, API E2E, repository-wide 78 percent floor, and applicable
-authorization subsystem 90 percent floor. The protected
-`app/modules/projects/*` 90 percent report introduced by 11B remains mandatory.
+authorization subsystem 90 percent floor. New project-read branches require
+focused behavior coverage; the pre-existing broad project subsystem remains
+under the repository-wide floor until its dedicated coverage uplift.
 
 ## Required reviewers
 

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-11C2-effective-policy-active-guide-reads.md

@@ -67,16 +67,17 @@ token-role fallback or dual authorization
 
 ```bash
 (cd backend && .venv/bin/python -m ruff check app tests scripts)
-(cd backend && WORKSTREAM_DATABASE_URL=<test-db> .venv/bin/python -m pytest -q tests/test_authorization.py tests/test_projects.py --cov=app.modules.authorization --cov=app.modules.projects --cov-report=term-missing --cov-fail-under=90)
+(cd backend && WORKSTREAM_DATABASE_URL=<test-db> .venv/bin/python -m pytest -q tests/test_authorization.py tests/test_projects.py --cov=app.modules.authorization --cov-report=term-missing --cov-fail-under=90)
 (cd backend && WORKSTREAM_DATABASE_URL=<test-db> .venv/bin/python scripts/api_contract_e2e.py)
 python3 scripts/test_agent_gates.py
 git diff --check
 ```
 
 Hosted `Backend / test` is mandatory before merge and must preserve the full
 semantic lanes, API E2E, repository-wide 78 percent floor, and applicable
-authorization subsystem 90 percent floor. The protected
-`app/modules/projects/*` 90 percent report introduced by 11B remains mandatory.
+authorization subsystem 90 percent floor. New project-read branches require
+focused behavior coverage; the pre-existing broad project subsystem remains
+under the repository-wide floor until its dedicated coverage uplift.
 
 ## Required reviewers
 

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-11B-internal-review-evidence.md

@@ -0,0 +1,48 @@
+# WS-AUTH-001-11B Internal Review Evidence
+
+## Scope
+
+Project identity and self authorization-context hard cutover to current local
+grants. Review covered the complete branch diff against the corrected 11B
+contract.
+
+## Plan review
+
+| Track | Result | Resolution |
+|---|---|---|
+| Architecture | PASS | AUTH owns the context projection; project and contributor response schemas remain distinct. |
+| Security/auth | PASS | Exact actor/link revalidation, project scope, concealment, and route/action/evidence binding are explicit. |
+| QA/test | PASS | Role matrix, denial cases, API controls, E2E, and focused project-read coverage are required. |
+| Product/ops | PASS | Admin and contributor projections and role precedence are explicit. |
+| Senior engineering | PASS | Exact manifests and the central decision/evidence path are explicit. |
+| CI integrity | PASS WITH CONDITIONS | Preserve all existing lanes and floors; prove every new project-read branch without misrepresenting legacy project coverage. |
+
+## Implementation review
+
+| Track | Final result | Findings resolved |
+|---|---|---|
+| Architecture | PASS WITH LOW RISKS | Missing-project decisions now use AUTH evidence; unrelated roles are filtered; project lifecycle projection shares the kernel guard. |
+| Security/auth | PASS | Both reads use human/rate admission; decisions retain matched grant/project evidence; matched grants remain locked through projection. |
+| QA/test | PASS WITH LOW RISKS | Added contributor, cross-project, revocation, suspension, link-revocation, rate, nonhuman, missing-project, and archived-project proof. |
+| Product/ops | PASS | Context includes active AUTH-10B/10C/11B project actions and excludes planned 11C actions. |
+| Senior engineering | PASS WITH LOW RISKS | Restored scope-specific denial evidence and public service exports. |
+| CI integrity | PASS WITH LOW RISKS | No established gate weakening; hosted full-suite, global 78%, and actor/authorization 90% floors remain required. |
+
+## Local evidence
+
+- `ruff check app tests scripts`: passed.
+- Focused kernel, context projection, rate-admission, and nonhuman tests: passed.
+- `tests/test_api_controls.py`: 27 passed.
+- Catalogue activation test: passed.
+- Python compile and docstring gate: passed.
+- Stale wording, stale authorization docs, Markdown links, lightweight agent
+  gates, and `git diff --check`: passed.
+- Hosted Backend run `30360376315` passed the database-backed route tests, four
+  semantic lanes, independent custody validation, API E2E, full-suite 78%
+  coverage floor, and every established subsystem coverage floor.
+
+## Residual review focus
+
+The manual `_PROJECT_CONTEXT_ACTIONS` inventory must be updated by future
+project-action activation chunks. A later catalogue metadata grouping may
+replace it; no additional abstraction is required for 11B.