Add bounded actor and identity-link administration reads

.agent-loop/LOOP_STATE.md

@@ -16,42 +16,43 @@
 - AUTH-09B merged through PR #143 as `053242b`; it adds controlled service
   actor provisioning and leaves service runtime admission plus feature actions
   inactive.
-- Active ART implementation chunk: `WS-ART-001-02A3` on
-  `codex/ws-art-001-02a3-artifact-store-v2-local-clean-cut`.
-- Parallel AUTH, REV, and CON worktrees remain independently owned. This ART
-  branch consumes their merged handoff contracts without editing or activating
-  their runtime behavior.
-- Start basis: PR #129 merged ART-02A2 into `main` as `9a04434`, and PR #139
-  then merged the cross-initiative boundary reconciliation as `5d353b6`.
+- PR #141 merged `WS-ART-001-02A3` into `main` as `a10d901` on
+  2026-07-18; ART-02B1 remains inactive pending a separate explicit start.
+- Active implementation chunk: `WS-AUTH-001-09C` on
+  `codex/ws-auth-001-09c-actor-identity-admin-reads`.
+- AUTH-09C is bounded to two exact administrative read routes and activates
+  only `actor.profile.read` and `actor.identity_link.read`. AUTH-09D remains
+  inactive.
+- Start basis: trusted `main` at `a10d901` after PR #141.
 - PR #119 merged `WS-AUTH-001-05B` as `ad71c7e`.
 - PR #120 merged `WS-ART-001-OBJECT-STORAGE-AMENDMENT` as `4408256`.
 - PR #122 merged the first automated post-merge memory implementation as
   `fc89fb6`; its schema-v1 cross-initiative next pointer is superseded by the
   schema-v2 initiative-local clean cut.
-- Current gate: publish PR #141 for GitHub Actions, CodeRabbit, and explicit
-  human review after reconciling merged AUTH-09B and rebinding exact-SHA ART
-  evidence. No later ART chunk starts automatically.
+- Current gate: PR #146's original Backend, Agent Gates, and CodeRabbit checks
+  passed. All five valid CodeRabbit proof findings are repaired at `c64bcc7`,
+  trusted `main` through PR #141 is integrated, and focused unit, real
+  PostgreSQL, and Agent Gates proof passes. All required exact integrated-head
+  internal repair tracks pass at `c47d627`; push and replacement external
+  checks remain. No service caller becomes executable before AUTH-09E.
 - Scope checkpoint: AWS S3 is the only v0.1 production provider; MinIO is
   local/CI S3 protocol proof; LocalStorage is focused development/test; R2 and
   Flow Node are deferred. Product modules receive narrow artifact capabilities,
   and AWS cannot instantiate in production without release-bound live proof.
 - Authorization checkpoint: merged main contains 74 PermissionIds and 65
-  ActionIds, with the two actor-self and seven AUTH-08 administrative actions
-  active, plus the AUTH-09B `actor.service.provision` action. Merged AUTH-09A
-  defines seven fixed artifact
+  ActionIds, with the two actor-self actions, seven AUTH-08 administrative
+  actions, and AUTH-09B `actor.service.provision` active. Merged AUTH-09A defines
+  seven fixed artifact
   service identities and eleven exact planned static matrix memberships. ART
   feature chunks supply hidden canonical behavior/resource composition. Merged
   AUTH planning requires availability-neutral ART custody transfer, fixed-service
   admission, prepared mutation authority, and exact AUTH-only activation chunks;
   neither reconciliation PR activates feature behavior.
-- Parallel artifact checkpoint: ART-02A1 merged through PR #127 as `f64a8e5`
-  and ART-02A2 merged through PR #129 as `9a04434`. ART-02A3 completed
-  merged-main deterministic repair, deterministic proof, and exact-SHA internal
-  review. PR #141 is open; refreshed evidence, external checks, and explicit
-  human merge approval remain. ART-02B1 remains inactive.
-- Authorization checkpoint: AUTH-07B, AUTH-08, and AUTH-09A merged through PRs
-  #130, #131, and #132; AUTH-09B merged through PR #143 as `053242b`.
-  AUTH-09C remains inactive until a separate explicit user start.
+- Parallel artifact checkpoint: ART-02A1, ART-02A2, and ART-02A3 merged through
+  PRs #127, #129, and #141. ART-02B1 remains inactive.
+- Authorization checkpoint: AUTH-07B through AUTH-09B merged through PRs #130,
+  #131, #132, and #143. Signed memory stopped after 09B, and the user explicitly
+  started AUTH-09C.
 - Parallel coverage work: `WS-QUAL-001-01B2` remains paused. Its last official
   whole-app result is `6466/8159` statements (`79.249908%`); no replacement
   evidence exists.

.agent-loop/REVIEW_LOG.md

@@ -1,5 +1,40 @@
 # Review Log
 
+## 2026-07-18 - WS-AUTH-001-09C External Repair Evidence Passed
+
+PR #146's original Backend, Agent Gates, and CodeRabbit checks passed.
+CodeRabbit then identified five valid proof gaps: exact transition-backend lock
+correlation, exact self-target timestamp payloads, exact authorization-kernel
+facts, both missing-resource rollback routes, and both project-scoped Audit
+Authority denials. Test-only repair `c64bcc7` closes all five. Trusted `main`
+through PR #141 at `a10d901` is integrated, including migration `0025`; 10
+focused unit tests, 2 fresh real PostgreSQL lifecycle/race tests, Ruff, and all
+Agent Gates pass. All required exact integrated-head internal repair tracks pass
+at `c47d627`; replacement external checks remain. AUTH-09D is inactive.
+
+## 2026-07-18 - WS-AUTH-001-09C Internal Review Passed
+
+Current `main` at `e118e33` is integrated without reverting WS-CON. Every
+required implementation review track passes at exact SHA `4331a6a` after
+repairing self-target response freshness, stage-specific rollback evidence,
+deterministic PostgreSQL lock-wait proof, exact persisted request evidence, and
+log-privacy canaries. Focused actor and authorization branch coverage remain
+91.06 and 92.04 percent. PR publication, external checks, and explicit human
+merge approval remain; AUTH-09D is inactive.
+
+## 2026-07-18 - WS-AUTH-001-09C Deterministic Evidence Passed
+
+PR #143 merged AUTH-09B as `053242b`, signed memory stopped, and the user
+explicitly started AUTH-09C. The repaired L1 contract passed every required
+preimplementation review track at exact SHA `76c5427`. The bounded
+implementation activates only `actor.profile.read` and
+`actor.identity_link.read` for exact targets under effective system authority.
+Real PostgreSQL lifecycle, two-session disabling races, rollback/privacy tests,
+and the live HTTP contract drill pass. Focused branch coverage is 91.06 percent
+for actors and 92.04 percent for authorization. Exact-head implementation
+review, PR publication, external checks, and explicit human merge approval
+remain; AUTH-09D is inactive.
+
 ## 2026-07-17 - WS-AUTH-001-09B Coverage Repair Internal Review Passed
 
 PR #143's replacement Backend run passed all 1,242 tests and measured 84.92

.agent-loop/WORK_QUEUE.md

@@ -4,7 +4,7 @@
 
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
-| `WS-ART-001-02A3` | ArtifactStore v2 Local Clean Cut | L1 | Internal review and deterministic evidence passed; external checks pending |
+| `WS-AUTH-001-09C` | Actor And Identity-Link Administration Reads | L1 | PR #146 open; all valid CodeRabbit findings repaired; integrated exact-head review passed; replacement external checks pending |
 
 Live post-merge state remains read from signed `automation/loop-memory`
 output. This authored queue records the separately approved parallel chunks.
@@ -14,7 +14,7 @@ output. This authored queue records the separately approved parallel chunks.
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
 | `WS-QUAL-001-01B2` | Baseline Evidence And CI Ratchet | L1 | Paused for AUTH priority; no valid replacement baseline yet |
-| `WS-AUTH-001-09C` | Actor And Identity-Link Administration Reads | L1 | Inactive until 09B merge/memory and explicit user start |
+| `WS-AUTH-001-09D` | Actor And Identity-Link Lifecycle Mutations | L1 | Inactive until 09C merge/memory and explicit user start |
 | `WS-QUAL-001-02` | Project Service Coverage | L1 | Inactive until 01B2 merge/memory plus explicit user start |
 | `WS-POL-002-04` | Locked Runtime Execution And Routing Hardening | L1 | Inactive pending relevant authorization proof and a separate explicit user start |
 | `WS-ART-001-02B1` | S3-Compatible MinIO And AWS | L1 | Inactive until 02A3 merge and explicit user start |
@@ -70,10 +70,13 @@ output. This authored queue records the separately approved parallel chunks.
 | `WS-AUTH-001-07A` | Closed Permission And Action Catalogue | L1 | Merged through PR #126 as `e9d72a1` on 2026-07-15 |
 | `WS-AUTH-001-07B` | Deny-By-Default Kernel And Self-Action Cutover | L1 | Merged through PR #130 as `90eca12` on 2026-07-15 |
 | `WS-AUTH-001-08` | Bootstrap Access Administrator Grant | L1 | Merged through PR #131 as `aa0fdcd` on 2026-07-16 |
+| `WS-AUTH-001-09A` | Fixed Service Identity Foundation | L1 | Merged through PR #132 as `299363a` on 2026-07-17 |
+| `WS-AUTH-001-09B` | Controlled Service Actor Provisioning | L1 | Merged through PR #143 as `053242b` on 2026-07-17 |
 | `WS-XINT-001-PLAN` | Lifecycle Boundary Reconciliation | L1 | Merged through PR #139 as `5d353b6` on 2026-07-17 |
 | `WS-ART-001-OBJECT-STORAGE-AMENDMENT` | AWS-First Object Storage Planning Amendment | L1 | Merged through PR #120 as `4408256` on 2026-07-14 |
 | `WS-ART-001-02A1` | External Service Adapter Foundation | L1 | Merged through PR #127 as `f64a8e5` on 2026-07-15 |
 | `WS-ART-001-02A2` | Committed Source And Local Preparation | L1 | Merged through PR #129 as `9a04434` on 2026-07-16 |
+| `WS-ART-001-02A3` | ArtifactStore v2 Local Clean Cut | L1 | Merged through PR #141 as `a10d901` on 2026-07-18 |
 | `WS-AUTH-001-XINT` | Lifecycle Boundary Plan Reconciliation | L1 | Merged through PR #140 as `d541521` on 2026-07-17 |
 | `WS-ENG-001-02` | Automated Post-Merge Memory | L1 | Merged through PR #122 as `fc89fb6`; schema-v1 output superseded by WS-ENG-001-03 |
 
@@ -85,17 +88,16 @@ AUTH-06 merged through PR #124 as `f599551`. AUTH-07A, AUTH-07B, and AUTH-08
 merged through PRs #126, #130, and #131. WS-XINT planning merged through PR #139,
 and its AUTH owner reconciliation merged through PR #140 as `d541521`.
 AUTH-09A merged through PR #132 as `299363a`, and signed schema-v2 memory
-stopped. AUTH-09B merged through PR #143 as `053242b`. Do not start AUTH-09C or
+stopped. AUTH-09B merged through PR #143 as `053242b`; the user then explicitly
+started AUTH-09C, whose PR #146 is in external repair. Do not start AUTH-09D or
 POL-002-04 automatically.
 
 Coverage R10 merged through PR #108. Do not start 01B2, chunk 02, or another
 coverage implementation chunk from this worktree.
 
-`WS-ART-001-01`, the AWS-first planning amendment, `02A1`, and `02A2` are
-merged. R2 and Flow Node are deferred. The user explicitly started `02A3` on
-2026-07-16. Its merged-main deterministic proof and exact-SHA internal review
-are complete; external checks remain pending and `02B1` must not start
-automatically.
+`WS-ART-001-01`, the AWS-first planning amendment, `02A1`, `02A2`, and `02A3`
+are merged; PR #141 merged `02A3` as `a10d901`. R2 and Flow Node are deferred.
+`02B1` remains inactive until a separate explicit user start.
 
 Coverage work proceeds independently in its own worktree and is not owned by
 this AUTH queue update.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md

@@ -30,8 +30,8 @@ stopped.
 | `WS-AUTH-001-XINT` | Lifecycle Boundary Plan Reconciliation | L1 | Merged through PR #140 as `d541521` |
 | `WS-AUTH-001-09` | Actor State, Identity Revocation, And Service Actors | L1 | Split before runtime implementation |
 | `WS-AUTH-001-09A` | Fixed Service Identity Foundation | L1 | Merged through PR #132 as `299363a` |
-| `WS-AUTH-001-09B` | Controlled Service Actor Provisioning | L1 | Active after explicit user start from signed 09A memory |
-| `WS-AUTH-001-09C` | Actor And Identity-Link Administration Reads | L1 | Inactive until 09B merge/memory and explicit start |
+| `WS-AUTH-001-09B` | Controlled Service Actor Provisioning | L1 | Merged through PR #143 as `053242b` |
+| `WS-AUTH-001-09C` | Actor And Identity-Link Administration Reads | L1 | Active after explicit user start from signed 09B memory |
 | `WS-AUTH-001-09D` | Actor And Identity-Link Lifecycle Mutations | L1 | Inactive until 09C merge/memory and explicit start |
 | `WS-AUTH-001-09E` | Fixed Service Runtime Admission | L1 | Inactive until 09D merge/memory and explicit start |
 | `WS-AUTH-001-ART-CUSTODY` | ART Activation Custody Transfer | L1 | Inactive until 09E merge/memory and explicit start |
@@ -188,5 +188,7 @@ through PR #131 as `aa0fdcd`. Parent AUTH-09 was split before implementation.
 PR #140 merged the required XINT planning reconciliation as `d541521`. PR #132
 then merged seven identities, eleven static matrix memberships, eight planned
 actions, and migration `0023` as `299363a`; signed memory stopped. The user
-explicitly started AUTH-09B. It must pass exact-head review and checks, then
-stop for human merge. Do not start AUTH-09C or POL-002-04 automatically.
+explicitly started AUTH-09B. PR #143 merged it as `053242b`; signed memory
+stopped, and the user explicitly started AUTH-09C. It must pass exact-head
+review and checks, then stop for human merge. Do not start AUTH-09D or
+POL-002-04 automatically.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md

@@ -88,26 +88,33 @@ tracks at `cbe7c6c`; bounded AUTH-08 implementation later merged through PR #131
 as `aa0fdcd`. AUTH-09 was split before runtime implementation. PR #140 merged
 the authoritative AUTH XINT reconciliation as `d541521`; PR #132 then merged
 AUTH-09A as `299363a`. Signed memory stopped, and the user explicitly started
-AUTH-09B from that trusted head. Its bounded implementation and external-review
-repair passed every required internal reviewer track. PR #143's next Backend
-run passed all 1,242 tests, then the new authorization coverage gate reported
-89.75 percent. A behavior-test-only repair passes every required track at exact
-SHA `127615fde8f1b5583acf9dbbb3c606db514a455d` and projects 90.31 percent on
-the unchanged 1,600-statement denominator. Replacement external checks and
-evidence rebinding are pending. No service caller or feature action is active.
+AUTH-09B from that trusted head. Its bounded implementation, external-review
+repair, coverage repair, and required checks passed before PR #143 merged as
+`053242b`. Signed memory stopped, and the user explicitly started AUTH-09C.
+Its bounded implementation activates only the exact actor-profile and
+identity-link administrative reads. Deterministic proof passes, including the
+live HTTP drill and focused actor and authorization branch coverage above 90
+percent. Every required implementation review track passes at exact SHA
+`6791381ceb9cb0c7f6ba163d4525c6c770c02ca6`. PR #146's original external checks
+passed. All five valid CodeRabbit proof findings are repaired at `c64bcc7`, and
+trusted `main` through PR #141 at `a10d901` is integrated. Focused unit, fresh
+real PostgreSQL, Ruff, and Agent Gates proof passes on the integrated candidate;
+all required exact integrated-head repair tracks pass at `c47d627`. Replacement
+external checks remain. No service caller or feature action is active.
 
 ## Active planning chunk
 
 None. `WS-AUTH-001-XINT` merged through PR #140.
 
 ## Active implementation chunk
 
-`WS-AUTH-001-09B` - Controlled Service Actor Provisioning. This chunk activates
-one human-administrator route and no service admission or feature action.
+`WS-AUTH-001-09C` - Actor And Identity-Link Administration Reads. This chunk
+activates two system-authority read routes and no lifecycle mutation, service
+admission, or feature action.
 
 ## Current review branch
 
-`codex/ws-auth-001-09b-controlled-service-provisioning`
+`codex/ws-auth-001-09c-actor-identity-admin-reads`
 
 ## Chunk status
 
@@ -132,8 +139,8 @@ one human-administrator route and no service admission or feature action.
 | `WS-AUTH-001-XINT` | Merged | `codex/ws-auth-001-xint-reconciliation` | #140 | Merged as `d541521`; signed schema-v2 memory passed. |
 | `WS-AUTH-001-09` | Split | - | - | Split into 09A through 09E before runtime implementation. |
 | `WS-AUTH-001-09A` | Merged | `codex/ws-auth-001-09-actor-state-service-actors` | #132 | Merged as `299363a`; signed memory passed. |
-| `WS-AUTH-001-09B` | In progress | `codex/ws-auth-001-09b-controlled-service-provisioning` | #143 | Coverage-gate behavior repair internally reviewed; replacement checks pending. |
-| `WS-AUTH-001-09C` | Proposed | - | - | Actor and identity-link administrative reads. |
+| `WS-AUTH-001-09B` | Merged | `codex/ws-auth-001-09b-controlled-service-provisioning` | #143 | Merged as `053242b`; signed memory passed. |
+| `WS-AUTH-001-09C` | In review | `codex/ws-auth-001-09c-actor-identity-admin-reads` | #146 | Original external checks passed; all valid CodeRabbit findings repaired; integrated exact-head review passed; replacement checks pending. |
 | `WS-AUTH-001-09D` | Proposed | - | - | Actor and identity-link lifecycle mutations. |
 | `WS-AUTH-001-09E` | Proposed | - | - | Fixed service runtime admission after 09D. |
 | `WS-AUTH-001-ART-CUSTODY` | Proposed | - | - | Availability-neutral 25-row ART owner transfer after 09E. |
@@ -153,12 +160,14 @@ merged feature manifests and separate human starts exist.
 
 ## Blockers
 
-AUTH-09B, its external-review repair, and the coverage-gate behavior repair
-passed exact-head L1 internal review, atomic PostgreSQL behavior proof, and
-privacy tests. Replacement GitHub Backend coverage, Agent Gates, CodeRabbit,
-and explicit human merge approval remain. It must not add service grants,
-dynamic assignments, token-role authority, service admission, or
-feature-action activation.
+AUTH-09C passed deterministic PostgreSQL behavior, concurrency, rollback,
+privacy, live HTTP, and focused 90 percent coverage proof. The original
+exact-head L1 internal and external checks passed. CodeRabbit's five valid proof
+findings are repaired, trusted `main` at `a10d901` is integrated, and focused
+integrated evidence passes. All required exact integrated-head internal tracks
+pass at `c47d627`; replacement GitHub checks and explicit human merge approval
+remain. It must not add lifecycle mutation, service grants, dynamic assignments,
+token-role authority, service admission, or feature-action activation.
 
 The four proposed REV lifecycle actions and review-evidence binding action are
 blocked on complete feature-owned typed manifests. REV fixed services are also