Add actor profile lifecycle and evidence repair

.agent-loop/LOOP_STATE.md

@@ -16,25 +16,29 @@
 - AUTH-09B merged through PR #143 as `053242b`; it adds controlled service
   actor provisioning and leaves service runtime admission plus feature actions
   inactive.
+- AUTH-09C merged through PR #146 as `0ffdabf`; signed schema-v2 memory at
+  `eeb3dc2` recorded its two administrative reads and stopped.
 - PR #141 merged `WS-ART-001-02A3` into `main` as `a10d901` on
   2026-07-18; ART-02B1 remains inactive pending a separate explicit start.
-- Active implementation chunk: `WS-AUTH-001-09C` on
-  `codex/ws-auth-001-09c-actor-identity-admin-reads`.
-- AUTH-09C is bounded to two exact administrative read routes and activates
-  only `actor.profile.read` and `actor.identity_link.read`. AUTH-09D remains
-  inactive.
-- Start basis: trusted `main` at `a10d901` after PR #141.
+- Active implementation chunk: `WS-AUTH-001-09D-A`. The explicitly started parent
+  `WS-AUTH-001-09D` failed required preimplementation review and was split
+  before runtime edits into `WS-AUTH-001-09D-A` and `WS-AUTH-001-09D-B`.
+- Active branch: `WS-AUTH-001-09D-A` on
+  `codex/ws-auth-001-09d-actor-identity-lifecycle`. It owns lifecycle evidence
+  repair plus three exact profile lifecycle mutations. `WS-AUTH-001-09D-B`
+  remains inactive until 09D-A merge, signed memory, and explicit user start.
+- Start basis: trusted `main` at `0ffdabf` after PR #146.
 - PR #119 merged `WS-AUTH-001-05B` as `ad71c7e`.
 - PR #120 merged `WS-ART-001-OBJECT-STORAGE-AMENDMENT` as `4408256`.
 - PR #122 merged the first automated post-merge memory implementation as
   `fc89fb6`; its schema-v1 cross-initiative next pointer is superseded by the
   schema-v2 initiative-local clean cut.
-- Current gate: PR #146's original Backend, Agent Gates, and CodeRabbit checks
-  passed. All five valid CodeRabbit proof findings are repaired at `c64bcc7`,
-  trusted `main` through PR #141 is integrated, and focused unit, real
-  PostgreSQL, and Agent Gates proof passes. All required exact integrated-head
-  internal repair tracks pass at `c47d627`; push and replacement external
-  checks remain. No service caller becomes executable before AUTH-09E.
+- Current gate: PR #148 external repair aligns database lifecycle-reason
+  whitespace with the API and repairs stale reviewer evidence. PostgreSQL proof
+  plus required exact-head internal review pass at `7c33e64`; canonical evidence
+  is refreshed against that SHA after repairing the Backend fixture cascade.
+  Replacement external checks and explicit human approval remain. No service
+  caller becomes executable before AUTH-09E.
 - Scope checkpoint: AWS S3 is the only v0.1 production provider; MinIO is
   local/CI S3 protocol proof; LocalStorage is focused development/test; R2 and
   Flow Node are deferred. Product modules receive narrow artifact capabilities,
@@ -50,9 +54,9 @@
   neither reconciliation PR activates feature behavior.
 - Parallel artifact checkpoint: ART-02A1, ART-02A2, and ART-02A3 merged through
   PRs #127, #129, and #141. ART-02B1 remains inactive.
-- Authorization checkpoint: AUTH-07B through AUTH-09B merged through PRs #130,
-  #131, #132, and #143. Signed memory stopped after 09B, and the user explicitly
-  started AUTH-09C.
+- Authorization checkpoint: AUTH-07B through AUTH-09C merged through PRs #130,
+  #131, #132, #143, and #146. Signed memory stopped after 09C, and the user
+  explicitly started AUTH-09D; required review split it before runtime edits.
 - Parallel coverage work: `WS-QUAL-001-01B2` remains paused. Its last official
   whole-app result is `6466/8159` statements (`79.249908%`); no replacement
   evidence exists.

.agent-loop/REVIEW_LOG.md

@@ -1,5 +1,85 @@
 # Review Log
 
+## 2026-07-18 - WS-AUTH-001-09D-A External Repair Review Passed
+
+- PR #148 CodeRabbit correctly found an API/database normalization mismatch:
+  one-argument PostgreSQL `btrim` allowed tab and newline padding rejected or
+  normalized by the public lifecycle schema.
+- The repair applies one explicit whitespace contract to both lifecycle
+  tables, migration `0026` dirty-row refusal, and installed constraints.
+  Direct-write and previous-head migration behavior tests pass.
+- CodeRabbit and GitHub checks also correctly rejected stale internal-review
+  evidence. All required tracks pass the repaired exact head `efc4e6c`; the
+  evidence now requires canonical rows and that exact reviewed SHA.
+  Replacement external checks and human approval remain required.
+
+## 2026-07-18 - WS-AUTH-001-09D-A Exact-Head Internal Review Passed
+
+- Senior engineering, QA/test, security/auth, product/ops, architecture,
+  migration/data integrity, CI integrity, docs, reuse/dedup, and test delta pass
+  exact integrated head `cc7e6cc` against trusted main `f18b620`.
+- All valid findings are repaired. Exact owner parity is 65 actions, 15 active,
+  and 50 planned; identity-link mutations remain inactive under 09D-B.
+- Internal evidence and the PR trust bundle record the behavior, migration,
+  coverage, CI-integrity, and reviewer proof. Ready PR #148 is open; external
+  checks and explicit human merge approval are the current gate.
+
+## 2026-07-18 - WS-AUTH-001-09D-A Deterministic Evidence Repaired
+
+- Initial exact-head QA/test-delta review rejected `43192d` because lifecycle
+  denial rows retained matched-grant IDs, database guards permitted missing or
+  stale reactivation provenance, the service/failure matrix was incomplete,
+  and ordered races did not observe a PostgreSQL waiter.
+- Candidate `b025460` removes matched-grant internals from lifecycle denials,
+  requires fresh complete profile/link reactivation provenance, covers a fixed
+  service target and nine injected transaction stages, and observes every
+  ordered second request in PostgreSQL `wait_event_type='Lock'`.
+- A second exact-head architecture/migration review rejected `e1ea98f` because
+  code-owned activation custody still named the retired 09D parent and the
+  migration tests did not exercise every upgrade/downgrade refusal branch.
+- Candidate `3d68933` assigns profile actions to exact owner 09D-A and inactive
+  link actions to 09D-B, then proves partial attribution, padded and multibyte
+  reason refusal, profile/link success evidence, and both link-denial tokens.
+- The next exact-head review found four historical Alembic catalogue assertions
+  still using the removed parent owner. Candidate `e64b03f` clean-cuts all four
+  to the two child owners; the three affected migration tests pass in 199.52
+  seconds and still assert exactly eight AUTH-09 definitions.
+- All five exact migration proofs pass in 181.50 seconds. The expanded real
+  PostgreSQL matrix passes in 100.36 seconds and the blocker-controlled race
+  proof passes in 140.69 seconds. No timing sleeps establish race order.
+- Focused branch coverage passes at 90.70 percent for actors and 91.78 percent
+  for authorization; the clean authorization selection passes all 110 tests and
+  the new lifecycle service is 100 percent branch-covered.
+- Ruff, the real HTTP API contract, stale scans, Markdown links, 87 Agent
+  Gates, merge-intent validation, and diff integrity pass. Exact-head internal
+  review remains before PR publication. External checks and explicit human
+  merge approval follow.
+  `WS-AUTH-001-09D-B` and `WS-AUTH-001-09E` remain inactive.
+
+## 2026-07-18 - WS-AUTH-001-09D-A Preimplementation Review Passed
+
+- Exact reviewed contract SHA: `7f941a53b4a30e6116d9a13fce6246f7aa943ac3`.
+- Senior, security/auth, product/ops, QA/test, test-delta, architecture,
+  migration, CI integrity, docs, and reuse/dedup tracks passed after three
+  bounded repair rounds.
+- Runtime implementation may begin for 09D-A only. 09D-B and 09E remain
+  inactive behind separate merge, signed-memory, and explicit-start gates.
+
+## 2026-07-18 - WS-AUTH-001-09D Preimplementation Review Failed And Split
+
+- Basis: trusted `main` at `0ffdabf` after PR #146 and signed memory
+  `eeb3dc2`.
+- Result: the combined lifecycle contract failed required L1 review before any
+  runtime edit. It mixed profile and identity-link mutations, omitted required
+  forward migration ownership, conflicted with canonical reserve-first and
+  singleton/caller-first ordering, and did not close reactivation evidence,
+  provenance, conflict, response, or final-admin concurrency semantics.
+- Repair: split the parent into active contract-review child
+  `WS-AUTH-001-09D-A` and inactive child `WS-AUTH-001-09D-B`. The first child
+  owns migration `0026`, lifecycle evidence repair, and only profile suspend,
+  reactivate, and terminal deactivate. Runtime implementation remains gated on
+  exact repaired-contract review.
+
 ## 2026-07-18 - WS-AUTH-001-09C External Repair Evidence Passed
 
 PR #146's original Backend, Agent Gates, and CodeRabbit checks passed.

.agent-loop/WORK_QUEUE.md

@@ -4,7 +4,7 @@
 
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
-| `WS-AUTH-001-09C` | Actor And Identity-Link Administration Reads | L1 | PR #146 open; all valid CodeRabbit findings repaired; integrated exact-head review passed; replacement external checks pending |
+| `WS-AUTH-001-09D-A` | Profile Lifecycle And Evidence Repair | L1 | PR #148 external repair and exact-head review pass at `efc4e6c`; canonical evidence refresh pending |
 
 Live post-merge state remains read from signed `automation/loop-memory`
 output. This authored queue records the separately approved parallel chunks.
@@ -14,7 +14,7 @@ output. This authored queue records the separately approved parallel chunks.
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
 | `WS-QUAL-001-01B2` | Baseline Evidence And CI Ratchet | L1 | Paused for AUTH priority; no valid replacement baseline yet |
-| `WS-AUTH-001-09D` | Actor And Identity-Link Lifecycle Mutations | L1 | Inactive until 09C merge/memory and explicit user start |
+| `WS-AUTH-001-09D-B` | Identity-Link Lifecycle And Race Closure | L1 | Inactive until 09D-A merge/memory and explicit user start |
 | `WS-QUAL-001-02` | Project Service Coverage | L1 | Inactive until 01B2 merge/memory plus explicit user start |
 | `WS-POL-002-04` | Locked Runtime Execution And Routing Hardening | L1 | Inactive pending relevant authorization proof and a separate explicit user start |
 | `WS-ART-001-02B1` | S3-Compatible MinIO And AWS | L1 | Inactive until 02A3 merge and explicit user start |
@@ -89,8 +89,11 @@ merged through PRs #126, #130, and #131. WS-XINT planning merged through PR #139
 and its AUTH owner reconciliation merged through PR #140 as `d541521`.
 AUTH-09A merged through PR #132 as `299363a`, and signed schema-v2 memory
 stopped. AUTH-09B merged through PR #143 as `053242b`; the user then explicitly
-started AUTH-09C, whose PR #146 is in external repair. Do not start AUTH-09D or
-POL-002-04 automatically.
+started AUTH-09C. PR #146 merged it as `0ffdabf`; signed memory at `eeb3dc2`
+stopped. The user explicitly started AUTH-09D, and required review split it
+before runtime edits. Only 09D-A implementation is active after exact-SHA
+preimplementation review passed. Do not start 09D-B,
+09E, or POL-002-04 automatically.
 
 Coverage R10 merged through PR #108. Do not start 01B2, chunk 02, or another
 coverage implementation chunk from this worktree.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/CHUNK_MAP.md

@@ -31,9 +31,11 @@ stopped.
 | `WS-AUTH-001-09` | Actor State, Identity Revocation, And Service Actors | L1 | Split before runtime implementation |
 | `WS-AUTH-001-09A` | Fixed Service Identity Foundation | L1 | Merged through PR #132 as `299363a` |
 | `WS-AUTH-001-09B` | Controlled Service Actor Provisioning | L1 | Merged through PR #143 as `053242b` |
-| `WS-AUTH-001-09C` | Actor And Identity-Link Administration Reads | L1 | Active after explicit user start from signed 09B memory |
-| `WS-AUTH-001-09D` | Actor And Identity-Link Lifecycle Mutations | L1 | Inactive until 09C merge/memory and explicit start |
-| `WS-AUTH-001-09E` | Fixed Service Runtime Admission | L1 | Inactive until 09D merge/memory and explicit start |
+| `WS-AUTH-001-09C` | Actor And Identity-Link Administration Reads | L1 | Merged through PR #146 as `0ffdabf` |
+| `WS-AUTH-001-09D` | Actor And Identity-Link Lifecycle Mutations | L1 | Split before runtime implementation into 09D-A and 09D-B |
+| `WS-AUTH-001-09D-A` | Profile Lifecycle And Evidence Repair | L1 | Implementation and deterministic proof passed; exact-head internal review pending |
+| `WS-AUTH-001-09D-B` | Identity-Link Lifecycle And Race Closure | L1 | Inactive until 09D-A merge/memory and explicit start |
+| `WS-AUTH-001-09E` | Fixed Service Runtime Admission | L1 | Inactive until 09D-B merge/memory and explicit start |
 | `WS-AUTH-001-ART-CUSTODY` | ART Activation Custody Transfer | L1 | Inactive until 09E merge/memory and explicit start |
 | `WS-AUTH-001-REV-CUSTODY` | REV Activation Custody Transfer | L1 | Inactive until 09E merge/memory and explicit start |
 | `WS-AUTH-001-PREP` | Prepared Mutation Authorization Protocol | L1 | Inactive until 09E merge/memory and explicit start |
@@ -93,7 +95,8 @@ WS-AUTH-001-PLAN
 -> WS-AUTH-001-09A
 -> WS-AUTH-001-09B
 -> WS-AUTH-001-09C
--> WS-AUTH-001-09D
+-> WS-AUTH-001-09D-A
+-> WS-AUTH-001-09D-B
 -> WS-AUTH-001-09E
 -> WS-AUTH-001-ART-CUSTODY and WS-AUTH-001-REV-CUSTODY
 -> WS-AUTH-001-PREP
@@ -189,6 +192,9 @@ PR #140 merged the required XINT planning reconciliation as `d541521`. PR #132
 then merged seven identities, eleven static matrix memberships, eight planned
 actions, and migration `0023` as `299363a`; signed memory stopped. The user
 explicitly started AUTH-09B. PR #143 merged it as `053242b`; signed memory
-stopped, and the user explicitly started AUTH-09C. It must pass exact-head
-review and checks, then stop for human merge. Do not start AUTH-09D or
-POL-002-04 automatically.
+stopped, and the user explicitly started AUTH-09C. PR #146 merged it as
+`0ffdabf`; signed memory at `eeb3dc2` stopped. The user explicitly started
+AUTH-09D. Required preimplementation review rejected the combined lifecycle
+contract before runtime edits, so it is split into 09D-A and 09D-B. Only 09D-A
+may proceed after its repaired contract passes exact review. Do not start
+09D-B, 09E, or POL-002-04 automatically.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DECISIONS.md

@@ -457,7 +457,7 @@ idempotency hashes the requested role; revoke derives the role from the locked
 grant. Same key/different role mismatches, new-key duplicate same-role issue is
 a stable audited conflict, and replay reauthorizes before disclosure.
 
-AUTH-10 replaces current typed and PostgreSQL validators in migration `0026`
+AUTH-10 replaces current typed and PostgreSQL validators in migration `0027`
 without editing `0018`, `0019`, or `0022`. It fails closed if obsolete combined
 or replacement evidence exists and refuses an unsafe downgrade rather than
 converting or deleting evidence. Only issued and revoked success events remain.
@@ -574,8 +574,8 @@ PermissionId mapping, canonical target, principal class, candidates, guards,
 surface, and revalidation rule before runtime edits. Each owning migration
 updates current typed and PostgreSQL audit validation; no chunk may promise an
 active surface whose ActionId is absent. AUTH-11 therefore owns migration
-`0027`, and later migration reservations shift through AUTH-15 as recorded in
-D29. AUTH-16 aggregates proof; it does not discover or backfill missing
+`0028`, and later migration reservations shift through AUTH-15 as superseded
+by D30. AUTH-16 aggregates proof; it does not discover or backfill missing
 registrations.
 
 ## D28: Service provisioning records an unverified issuer binding
@@ -632,3 +632,29 @@ AUTH-15 owns `0031`.
 This decision supersedes only the future migration-number allocations in D15,
 D27, and D28. It does not modify any merged migration, action ownership,
 authorization behavior, or feature activation boundary.
+
+## D30: Split lifecycle mutations and repair evidence before activation
+
+Status: accepted preimplementation repair on 2026-07-18.
+
+Required L1 review rejected the combined AUTH-09D contract before runtime
+edits. The parent is split semantically: AUTH-09D-A owns lifecycle evidence
+repair plus profile suspend, reactivate, and terminal deactivate; AUTH-09D-B
+later owns identity-link revoke/reactivate plus the mixed profile/link/grant
+race closure. Each child requires its own explicit gate, review, merge intent,
+PR, merge, and signed-memory stop.
+
+The existing database and typed lifecycle evidence force every non-admin
+transition from effective to ineffective. That is false for profile and link
+reactivation, and ActorProfile lacks durable reactivation provenance. AUTH-09D-A
+therefore owns forward migration `0026_actor_profile_lifecycle`; historical
+migrations remain immutable. AUTH-10 through AUTH-15 shift to `0027` through
+`0032`. This supersedes only D29's future inactive reservations.
+
+Lifecycle routes reserve idempotency before authorization, retain the canonical
+singleton/caller-first authorization locks, and disclose target existence only
+after an exact permission match. The singleton serializes every lifecycle or
+grant path that can remove the final effective Access Administrator, so no
+target-first alternate lock path is introduced. Profile and link reactivation
+invalidate from ineffective to effective; loss transitions invalidate from
+effective to ineffective.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/DISCOVERY.md

@@ -26,8 +26,9 @@ mutations, service admission, and concurrency. Required L1 review split it into
 09A through 09E before runtime implementation. AUTH-09A takes migration `0023`;
 09B requires forward migration `0024` so provisioned service links remain
 unverified until a token is actually verified. ART owns `0025` for the
-ArtifactStore v2 clean cut. AUTH-10 through AUTH-15 therefore shift to `0026`
-through `0031`, without allocating migrations to the
+ArtifactStore v2 clean cut. AUTH-09D-A requires `0026` for lifecycle evidence
+and profile reactivation provenance repair. AUTH-10 through AUTH-15 therefore
+shift to `0027` through `0032`, without allocating migrations to the
 availability-neutral custody or PREP chunks.
 
 ## Current behavior
@@ -303,7 +304,7 @@ need an independently reviewable contract and production-code budget.
   `replaced_grant_id`, replacement events, and replacement reasons.
 - Migration `0022_bootstrap_admin_grants.py` recreates current PostgreSQL audit
   and linked-idempotency validators with the same combined/replacement values.
-  Historical migrations remain immutable; AUTH-10 `0026` must replace current
+  Historical migrations remain immutable; AUTH-10 `0027` must replace current
   validators and fail closed on incompatible evidence.
 - The current kernel has request-scoped `require()` but no AUTH-first prepared
   mutation handle. Cross-module mutations therefore lack the merged lock,

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/PLAN.md

@@ -86,8 +86,10 @@ Every cutover chunk enumerates its exact ActionIds before implementation and
 updates current typed/PostgreSQL audit mapping validation in its own migration.
 After AUTH-09A migration `0023`, AUTH-09B uses `0024` for service-link
 verification timestamp semantics and ART owns `0025` for the ArtifactStore v2
-clean cut. Core reservations are AUTH-10 `0026`, AUTH-11 `0027`, AUTH-12
-`0028`, AUTH-13 `0029`, AUTH-14 `0030`, and AUTH-15 `0031`.
+clean cut. AUTH-09D-A uses `0026` to repair lifecycle evidence and profile
+reactivation provenance. Core reservations are therefore AUTH-10 `0027`,
+AUTH-11 `0028`, AUTH-12 `0029`, AUTH-13 `0030`, AUTH-14 `0031`, and AUTH-15
+`0032`.
 Blocked cross-initiative additions allocate the next trusted-main migration head
 only when their complete feature contracts become executable. No migration
 number is reserved or allocated while the work remains blocked.