Add S3-compatible artifact storage with MinIO proof

.agent-loop/LOOP_STATE.md

@@ -19,44 +19,41 @@
 - AUTH-09C merged through PR #146 as `0ffdabf`; signed schema-v2 memory at
   `eeb3dc2` recorded its two administrative reads and stopped.
 - PR #141 merged `WS-ART-001-02A3` into `main` as `a10d901` on
-  2026-07-18; ART-02B1 remains inactive pending a separate explicit start.
-- Active implementation chunk: `WS-AUTH-001-09D-A`. The explicitly started parent
-  `WS-AUTH-001-09D` failed required preimplementation review and was split
-  before runtime edits into `WS-AUTH-001-09D-A` and `WS-AUTH-001-09D-B`.
-- Active branch: `WS-AUTH-001-09D-A` on
-  `codex/ws-auth-001-09d-actor-identity-lifecycle`. It owns lifecycle evidence
-  repair plus three exact profile lifecycle mutations. `WS-AUTH-001-09D-B`
-  remains inactive until 09D-A merge, signed memory, and explicit user start.
-- Start basis: trusted `main` at `0ffdabf` after PR #146.
+  2026-07-18; the user then explicitly started ART-02B1.
+- Active ART implementation chunk: `WS-ART-001-02B1` on
+  `codex/ws-art-001-02b1-s3-compatible-minio-aws`.
+- The ART worktree consumes merged AUTH, REV, and CON contracts without
+  editing or activating their independently owned runtime behavior.
+- AUTH-09D-A merged through PR #148 as `99ae4c9`; AUTH-09D-B remains inactive
+  until signed memory and an explicit human start.
+- ART integration basis: trusted `main` at `99ae4c9` after PR #148.
 - PR #119 merged `WS-AUTH-001-05B` as `ad71c7e`.
 - PR #120 merged `WS-ART-001-OBJECT-STORAGE-AMENDMENT` as `4408256`.
 - PR #122 merged the first automated post-merge memory implementation as
   `fc89fb6`; its schema-v1 cross-initiative next pointer is superseded by the
   schema-v2 initiative-local clean cut.
-- Current gate: PR #148 external repair aligns database lifecycle-reason
-  whitespace with the API and repairs stale reviewer evidence. PostgreSQL proof
-  plus required exact-head internal review pass at `7c33e64`; canonical evidence
-  is refreshed against that SHA after repairing the Backend fixture cascade.
-  Replacement external checks and explicit human approval remain. No service
-  caller becomes executable before AUTH-09E.
+- Current ART gate: integrate trusted `main`, complete deterministic 02B1
+  proof, and pass all nine exact-SHA internal reviewer tracks before opening
+  the ART PR. No later ART chunk starts automatically.
 - Scope checkpoint: AWS S3 is the only v0.1 production provider; MinIO is
   local/CI S3 protocol proof; LocalStorage is focused development/test; R2 and
   Flow Node are deferred. Product modules receive narrow artifact capabilities,
   and AWS cannot instantiate in production without release-bound live proof.
 - Authorization checkpoint: merged main contains 74 PermissionIds and 65
-  ActionIds, with the two actor-self actions, seven AUTH-08 administrative
-  actions, and AUTH-09B `actor.service.provision` active. Merged AUTH-09A defines
+  ActionIds, with 12 active actions: the two actor-self actions, seven AUTH-08
+  administrative actions, AUTH-09B `actor.service.provision`, and AUTH-09C
+  `actor.profile.read` plus `actor.identity_link.read`. Merged AUTH-09A defines
   seven fixed artifact
   service identities and eleven exact planned static matrix memberships. ART
   feature chunks supply hidden canonical behavior/resource composition. Merged
   AUTH planning requires availability-neutral ART custody transfer, fixed-service
   admission, prepared mutation authority, and exact AUTH-only activation chunks;
   neither reconciliation PR activates feature behavior.
 - Parallel artifact checkpoint: ART-02A1, ART-02A2, and ART-02A3 merged through
-  PRs #127, #129, and #141. ART-02B1 remains inactive.
-- Authorization checkpoint: AUTH-07B through AUTH-09C merged through PRs #130,
-  #131, #132, #143, and #146. Signed memory stopped after 09C, and the user
-  explicitly started AUTH-09D; required review split it before runtime edits.
+  PRs #127, #129, and #141. ART-02B1 is active and adds real MinIO protocol
+  proof plus a fail-closed, runtime-ineligible native AWS profile.
+- Authorization checkpoint: AUTH-07B through AUTH-09D-A merged through PRs
+  #130, #131, #132, #143, #146, and #148. AUTH-09D-B remains inactive.
 - Parallel coverage work: `WS-QUAL-001-01B2` remains paused. Its last official
   whole-app result is `6466/8159` statements (`79.249908%`); no replacement
   evidence exists.

.agent-loop/WORK_QUEUE.md

@@ -4,7 +4,7 @@
 
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
-| `WS-AUTH-001-09D-A` | Profile Lifecycle And Evidence Repair | L1 | PR #148 external repair and exact-head review pass at `efc4e6c`; canonical evidence refresh pending |
+| `WS-ART-001-02B1` | S3-Compatible MinIO And AWS | L1 | Active after explicit user start; implementation repair and exact-head internal review in progress |
 
 Live post-merge state remains read from signed `automation/loop-memory`
 output. This authored queue records the separately approved parallel chunks.
@@ -17,7 +17,6 @@ output. This authored queue records the separately approved parallel chunks.
 | `WS-AUTH-001-09D-B` | Identity-Link Lifecycle And Race Closure | L1 | Inactive until 09D-A merge/memory and explicit user start |
 | `WS-QUAL-001-02` | Project Service Coverage | L1 | Inactive until 01B2 merge/memory plus explicit user start |
 | `WS-POL-002-04` | Locked Runtime Execution And Routing Hardening | L1 | Inactive pending relevant authorization proof and a separate explicit user start |
-| `WS-ART-001-02B1` | S3-Compatible MinIO And AWS | L1 | Inactive until 02A3 merge and explicit user start |
 | `WS-ART-001-02C1` | Admission And Put-Attempt Foundation | L1 | Inactive until 02B1 merge and explicit user start |
 | `WS-ART-001-02C2` | Verification Publication And Fencing | L1 | Inactive until 02C1 merge and explicit user start |
 | `WS-ART-001-02C3` | Recovery Attempt And Idempotency Chain | L1 | Inactive until 02C2 merge and explicit user start |
@@ -27,6 +26,8 @@ output. This authored queue records the separately approved parallel chunks.
 
 | Chunk | Title | Risk | Status |
 |---|---|---:|---|
+| `WS-AUTH-001-09D-A` | Profile Lifecycle And Evidence Repair | L1 | Merged through PR #148 as `99ae4c9` on 2026-07-18 |
+| `WS-AUTH-001-09C` | Actor And Identity-Link Administration Reads | L1 | Merged through PR #146 as `0ffdabf` on 2026-07-18 |
 | `WS-ENG-001-01` | Codex-native zero-trust loop bootstrap | L1 | Merged through PR #23 on 2026-06-20 |
 | `EXAMPLE-TERMINAL-BENCHMARK` | Terminal Benchmark example drill | L3 | Merged through PR #25 on 2026-06-21 |
 | `WS-POL-001-PLAN` | Submission Artifact Policy Foundation planning | L1 | Merged through PR #26 on 2026-06-27 |
@@ -90,17 +91,17 @@ and its AUTH owner reconciliation merged through PR #140 as `d541521`.
 AUTH-09A merged through PR #132 as `299363a`, and signed schema-v2 memory
 stopped. AUTH-09B merged through PR #143 as `053242b`; the user then explicitly
 started AUTH-09C. PR #146 merged it as `0ffdabf`; signed memory at `eeb3dc2`
-stopped. The user explicitly started AUTH-09D, and required review split it
-before runtime edits. Only 09D-A implementation is active after exact-SHA
-preimplementation review passed. Do not start 09D-B,
-09E, or POL-002-04 automatically.
+stopped. Required review split AUTH-09D before runtime edits, and AUTH-09D-A
+merged through PR #148 as `99ae4c9`. Do not start 09D-B, 09E, or POL-002-04
+automatically.
 
 Coverage R10 merged through PR #108. Do not start 01B2, chunk 02, or another
 coverage implementation chunk from this worktree.
 
 `WS-ART-001-01`, the AWS-first planning amendment, `02A1`, `02A2`, and `02A3`
 are merged; PR #141 merged `02A3` as `a10d901`. R2 and Flow Node are deferred.
-`02B1` remains inactive until a separate explicit user start.
+The user explicitly started `02B1` on 2026-07-18. `02C1` remains inactive
+until `02B1` merges and receives a separate explicit start.
 
 Coverage work proceeds independently in its own worktree and is not owned by
 this AUTH queue update.

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/CHUNK_MAP.md

@@ -9,8 +9,8 @@ Each chunk is one PR. No later chunk starts automatically.
 | `WS-ART-001-OBJECT-STORAGE-AMENDMENT` | Make AWS S3 the v0.1 production provider with MinIO local/CI protocol proof; keep optional providers outside v0.1. | L1 | Merged through PR #120 as `4408256` |
 | `WS-ART-001-02A1` | Install only ADR 0014's small typed external-service adapter/factory foundation without migrating a capability. | L1 | Merged through PR #127 as `f64a8e5` |
 | `WS-ART-001-02A2` | Add bounded committed-source preparation and inactive scratch-cleanup mechanics without changing the active v1 port. | L1 | Merged through PR #129 as `9a04434` on 2026-07-16 |
-| `WS-ART-001-02A3` | Replace ArtifactStore v1 with byte-only v2, activate API-startup and Celery Beat scratch cleanup, migrate schema/callers/factory, and remove `flow_node` in one atomic clean cut. | L1 | Internal review and deterministic evidence passed; external checks pending |
-| `WS-ART-001-02B1` | Implement the S3-compatible adapter, MinIO integration, and AWS S3 production profile. | L1 | Proposed after 02A3 |
+| `WS-ART-001-02A3` | Replace ArtifactStore v1 with byte-only v2, activate API-startup and Celery Beat scratch cleanup, migrate schema/callers/factory, and remove `flow_node` in one atomic clean cut. | L1 | Merged through PR #141 as `a10d901` on 2026-07-18 |
+| `WS-ART-001-02B1` | Implement the S3-compatible adapter, MinIO integration, and AWS S3 production profile. | L1 | Active after 02A3 merged through PR #141 and explicit user start |
 | `WS-ART-001-02C1` | Add the generic durable-byte admission ledger and durable put-attempt state foundation without provider execution. | L1 | Proposed after 02B1 |
 | `WS-ART-001-02C2` | Add put resolution, verification publication, complete-object observation, immutable receipts, and PostgreSQL execution fencing without recovery attempts or routes. | L1 | Proposed after 02C1 |
 | `WS-ART-001-02C3` | Add the recovery-attempt model and exact idempotent source-job to retry-job chain without public or Operator routes. | L1 | Proposed after 02C2 |

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/PLAN.md

@@ -89,14 +89,18 @@ mode `aws_workload_identity` selects exactly one allowlisted method:
 constrains the pinned credential resolver to the selected provider before any
 provider is loaded, verifies the resolved method, and rejects explicit
 credentials, ambient access keys, file/process/login/SSO sources, legacy
-EC2/Boto sources, and every unselected workload provider. Chunk 02B1 pins
+EC2/Boto sources, and every unselected workload provider. For the selected
+method, startup accepts only that method's exact closed `AWS_*` environment
+allowlist and rejects every other `AWS_*` or `BOTOCORE_*` SDK control before
+constructing a session. Chunk 02B1 pins
 `aiobotocore==3.7.0` and `botocore==1.43.0`; SDK upgrades require an explicit
 dependency and credential-behavior review. MinIO static credentials are
 local/CI only. The endpoint is omitted for native AWS S3 and explicit for
 MinIO. AWS requires an explicit region and production requires HTTPS, a
 non-local resolved endpoint, and backend `s3_compatible`. Secrets and resolved
-credentials are never persisted or retained by errors. Cloudflare R2 has no
-v0.1 runtime profile, credential service, or configuration path.
+credentials are never persisted or retained by errors. Object and credential
+metadata transports explicitly ignore ambient HTTP proxy variables. Cloudflare
+R2 has no v0.1 runtime profile, credential service, or configuration path.
 
 ## Immutable Object Identity
 

.agent-loop/initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md

@@ -5,14 +5,17 @@
 Original planning merged through PR #97, artifact/LocalStorage foundation
 merged through PR #101, the AWS-first object-storage amendment merged through
 PR #120 as `4408256`, the external-service adapter foundation merged through
-PR #127 as `f64a8e5`, and committed-source preparation merged through PR #129
-as `9a04434` on 2026-07-16. The user explicitly started
-`WS-ART-001-02A3` on 2026-07-16.
+PR #127 as `f64a8e5`, committed-source preparation merged through PR #129 as
+`9a04434`, and the ArtifactStore v2 Local clean cut merged through PR #141 as
+`a10d901` on 2026-07-18. The user explicitly started `WS-ART-001-02B1` on
+2026-07-18.
 
 The planning-only cross-initiative boundary reconciliation merged through
 PR #139 as `5d353b6`, and AUTH's owner reconciliation merged through PR #140 as
 `d541521`. ART now consumes AUTH's canonical activation-custody and prepared
 mutation contracts without editing or activating AUTH runtime behavior.
+AUTH-09D-A merged through PR #148 as `99ae4c9` and is integrated into the ART
+candidate; AUTH-09D-B remains inactive.
 
 The Flow Node-focused amendment candidate `6cc422d` passed deterministic checks
 but failed internal review on recovery/API completeness. Before repair, the user
@@ -31,29 +34,29 @@ approval or reusable evidence. Its source remains on branch
 
 ## Current Work
 
-`WS-ART-001-02A3` implementation and merged-main deterministic repair are
-complete. PR #141 is open. Exact-SHA review found and repaired a residual
-LocalStorage startup race, typed-factory startup mismatch, and vague Operator
-resource vocabulary. Fresh deterministic coverage and all required internal
-reviewer tracks passed; external checks are now pending. Its approved
-boundary atomically replaces ArtifactStore v1 with byte-only v2, migrates
-LocalStorage and the empty pre-production artifact schema, installs the
-immutable storage-namespace fence,
-removes dormant `flow_node` configuration, and activates startup plus periodic
-scratch cleanup. It does not activate product ingest, durable admission,
-put-attempt resolution, verification jobs, or recovery.
+`WS-ART-001-02B1` is active. It adds one `S3CompatibleArtifactStore`, runs the
+shared ArtifactStore v2 vectors against real digest-pinned MinIO, and validates
+an isolated native-AWS workload-identity profile. MinIO is runtime-eligible
+only in local/development/test after the PostgreSQL namespace claim. Native AWS
+remains runtime-ineligible and fails with
+`artifact_provider_live_proof_required` before factory construction,
+credential resolution, namespace claim, or provider I/O. No product ingest,
+durable admission, put-attempt resolution, verification job, recovery route,
+or optional-provider runtime is activated. R2 and Flow Node remain deferred.
 
 ## Next Proposed Chunk
 
-`02B1` owns the S3-compatible adapter, MinIO proof, and AWS S3 profile after
-`02A3` merges and receives a separate explicit start. There is no active R2 or
-Flow Node chunk.
+`02C1` owns generic durable-byte admission and put-attempt state only after
+`02B1` merges and receives a separate explicit start. Neither R2 nor Flow Node
+has a v0.1 chunk.
 
 ## Gate
 
-All reviews before the latest repairs are retained as history, not reused as
-final provenance. Deterministic proof and exact-SHA internal review have passed.
-The current gate is GitHub Actions, CodeRabbit, and explicit human review.
-Durable admission, put attempts, verification publication, and recovery remain
-in their later owning chunks. No
-later artifact chunk starts automatically, and only the user may approve merge.
+The reviewed implementation recorded: "The current gate is deterministic 02B1
+proof followed by all nine exact-SHA internal reviewer tracks." After integrating
+latest `main`, including merged REV planning, that gate passed again at
+`9cd5620e` after addressing all four valid CodeRabbit findings, with no ART
+runtime or ownership drift. The remaining gate is the post-fix GitHub Actions
+and CodeRabbit rerun plus explicit human review. Durable admission, put attempts,
+verification publication, and recovery remain in later owning chunks. No later
+artifact chunk starts automatically, and only the user may approve merge.