Add shared transactional outbox persistence

.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/ACTIVE_DOC_INVENTORY.md

@@ -27,6 +27,50 @@ the controlled `actor.service.provision` route. Historical review artifacts
 retain their exact earlier SHAs and observations. No AUTH runtime file is
 changed by this CON reconciliation.
 
+Before CON-02A review, trusted main advanced through ART PR #141 and AUTH-09C
+PR #146 to `0ffdabf`. The live catalogue is now
+74-permission/65-action/12-active/53-planned because AUTH-09C activates only
+`actor.profile.read` and `actor.identity_link.read`; it adds no CON/outbox
+identifier or migration. Historical CON-01 evidence above remains exact.
+Trusted main then advanced to `b2b9016` through REV-01 PR #145, which publishes
+the canonical review specification without changing the backend migration head
+or the CON-02A outbox boundary.
+REV-02 PR #147 then advanced trusted main to `f18b620` with planning-only chunk
+decomposition and no backend, migration, or 02A boundary change.
+AUTH-09D-A PR #148 then advanced trusted main to `99ae4c96`, activated only
+three actor-profile lifecycle actions, and added AUTH-owned
+`0026_actor_profile_lifecycle`. CON-02A therefore rebases its linear migration
+to `0027_shared_transactional_outbox`; the merge adds no CON/outbox action,
+permission, evaluator, service identity, or runtime admission.
+REV PLAN2 PR #150 then advanced trusted main to `983b9e53` with a
+planning/specification-only runtime-readiness refresh. It preserves the
+FinalAcceptance-sourced submitter contribution, reviewer contribution on all
+three decisions, REV-owned single commit, and shared outbox staging. Its split
+future REV child gates are reconciled in CON planning; it changes no backend,
+migration, AUTH catalogue, or CON-02A implementation.
+ART-02B1 PR #151 then advanced trusted main to `1b5422fc` with the
+S3-compatible ArtifactStore adapter, real MinIO integration, inactive AWS
+profile support, dependency pins, CI changes, and substantial tests. It adds no
+migration or outbox seam and does not change CON-02A behavior, but it requires
+fresh repository-wide evidence on the combined tree.
+AUTH-09D-B PR #152 then advanced trusted main to `93dd3924`, activating only
+identity-link revoke/reactivate and expanding AUTH lifecycle proof. It adds no
+migration, CON/task-claim identifier, fixed-service admission, or outbox seam;
+at that historical point the contributor foundation and AUTH-09E remained
+later gates.
+Contributor-foundation PR #153 then advanced trusted main to `8d5eb15b`. It
+clean-cuts TaskAssignment and Submission attribution to canonical human
+`contributor_id`, adds writer revalidation, and owns
+`0027_contributor_foundation`. It adds no CON/outbox identifier, service
+admission, dispatcher, review lifecycle, or authority change. CON-02A is now
+the linear `0028_shared_transactional_outbox` child; AUTH-09E remains a later
+gate.
+ART-02C1 PR #154 then advanced trusted main to `44f2467c`. It owns
+`0028_artifact_admission` and adds durable artifact-admission and prepared-put
+state without changing the generic outbox boundary. CON-02A is therefore the
+linear `0029_shared_transactional_outbox` child; ART remains absent from the
+outbox append path.
+
 ## Inspected and already aligned
 
 The following active documents already describe ContributionPolicy,

.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/AUTHORIZATION_HANDOFF.md

@@ -2,11 +2,19 @@
 
 ## Current baseline
 
-Trusted `main` is `053242b` from merged AUTH-09B PR #143, layered on merged REV
-PR #128, AUTH-09A/AUTH PR #140, and the earlier WS-XINT PR #139 boundary. The
-runtime catalogue contains 74 PermissionIds and 65 ActionIds: ten active and 55
-planned. AUTH-09B activates only `actor.service.provision`; no WS-CON-specific
-or task-claim ActionId below is registered. PR #140 still defines the
+Trusted `main` is `8d5eb15b` after contributor-foundation PR #153, AUTH-09D-B PR #152, ART-02B1 PR #151,
+planning-only REV PLAN2 PR #150, AUTH-09D-A PR #148, REV-02 PR #147 and
+REV-01 PR #145, layered on AUTH-09C PR #146, ART PR #141, AUTH-09B PR #143,
+merged REV planning PR #128, AUTH-09A/AUTH PR #140, and the earlier WS-XINT PR
+#139 boundary. The runtime catalogue contains 74 PermissionIds and 65 ActionIds:
+17 active and 48 planned. AUTH-09B activates only `actor.service.provision`;
+AUTH-09C activates only `actor.profile.read` and `actor.identity_link.read`;
+AUTH-09D-A activates only the three actor-profile lifecycle actions;
+AUTH-09D-B activates only identity-link revoke/reactivate. PR #153 changes
+TaskAssignment/Submission attribution and canonical-human writer validation
+only; it adds no action, permission, grant, evaluator, availability,
+fixed-service admission, or review runtime. No
+WS-CON-specific or task-claim ActionId below is registered. PR #140 still defines the
 prepared/custody plan; it does not implement AUTH-PREP, transfer ART/REV custody,
 register a CON action, or activate a CON feature action.
 

.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CHUNK_MAP.md

@@ -14,13 +14,13 @@ availability writer. Optional evidence chunks are not part of the core order.
 | `WS-CON-001-PLAN` | Contribution And Compensation Planning | L0 | None | Complete; unpublished |
 | `WS-CON-001-PLAN2` | Final Acceptance Reconciliation | L0 | Human FinalAcceptance/no-adjudication direction | Complete; unpublished |
 | `WS-CON-001-PLAN3` | AUTH/REV Current-Main Reconciliation | L0/L1 | Merged AUTH PR #140 plus AUTH-09A and REV PR #128 at `0302bcf` | Complete; unpublished |
-| `WS-CON-001-01` | Canonical Contract Adoption And Architecture Decision | L0/L1 | Reconciled plan and human decisions approved | Complete; awaiting human review |
-| `WS-CON-001-02A` | Shared Transactional Outbox Persistence | L1 | 01; event ownership approved | Proposed |
+| `WS-CON-001-01` | Canonical Contract Adoption And Architecture Decision | L0/L1 | Reconciled plan and human decisions approved | Complete; merged in PR #144 |
+| `WS-CON-001-02A` | Shared Transactional Outbox Persistence | L1 | 01 merged at `e118e33`; trusted head refreshed through contributor-foundation PR #153 and ART-02C1 PR #154 at `44f2467c`; explicitly started by human | Reconciled as `0029` after ART `0028`; bounded proof, exact-SHA review, and GitHub full-suite pending |
 | `WS-CON-001-02B` | Shared Outbox Dispatcher And Recovery | L1 | 02A; AUTH registers `outbox.dispatch`, approved `workstream.outbox.dispatcher` ServiceIdentity/static row, AUTH-09E admission, prepared protocol; dispatcher remains disabled until AUTH activation | Proposed |
 | `WS-CON-001-02C` | Shared Lifecycle Audit Participant | L1 | 02B; current AuditEvent contract refreshed | Proposed |
 | `WS-CON-001-03A` | Project Compensation Adapter-Binding Persistence | L1 | 02C; migration head refreshed | Proposed |
 | `WS-CON-001-03B` | Contribution Policy Persistence | L1 | 03A; legacy-data rule; must precede REV-03 ReviewLease FK | Proposed |
-| `WS-CON-001-03C` | Contribution And Award Persistence | L1 | 03B; merged REV-04 runtime FinalAcceptance/Review/ReviewLease FK targets | Proposed |
+| `WS-CON-001-03C` | Contribution And Award Persistence | L1 | 03B; merged REV-04B runtime FinalAcceptance/Review/ReviewLease FK targets | Proposed |
 | `WS-CON-001-03D` | Delivery, Receipt, And Status Persistence | L1 | 03C; immutable fulfillment root ordinal/generation contract | Proposed |
 | `WS-CON-001-04A` | Hidden Adapter-Binding Service | L1 | 03A; planned AUTH binding actions/contexts/prepared protocol; callback ServiceIdentity/action/static row approved but inactive | Proposed |
 | `WS-CON-001-04B` | Hidden Contribution-Policy Service | L1 | 03B, 04A; binding activation merged; planned `contribution.policy.*` actions/contexts/prepared protocol | Proposed |
@@ -58,9 +58,12 @@ separate human approval -> refreshed ART/AUTH handoff -> 09A -> 09B
 AUTH registration -> CON hidden behavior -> AUTH activation -> later consumer/release
 ```
 
-- AUTH-09A/09B are merged; AUTH-09B activates only the human administrative
-  provisioning route and grants no service execution. AUTH-09C through 09E must
-  still precede protected fixed-service execution. New CON
+- AUTH-09A through 09D-B are merged; AUTH-09B activates only the human
+  administrative provisioning route, AUTH-09C activates only actor/profile
+  administrative reads, AUTH-09D-A activates only actor-profile lifecycle, and
+  AUTH-09D-B activates only identity-link revoke/reactivate. None grants
+  service execution. The contributor foundation is merged; AUTH-09E must still precede protected
+  fixed-service execution. New CON
   ServiceIdentity/static-row additions require separate reviewed AUTH contracts
   before provisioning; no existing ART identity or provisioning result may be
   reused as CON authority.
@@ -87,17 +90,19 @@ AUTH registration -> CON hidden behavior -> AUTH activation -> later consumer/re
   REV-owned FinalAcceptance. REV stages shared audit/outbox rows, owns the
   single commit, and supplies stabilized artifact-hash lineage; no ART call is
   made.
-- Merged REV PR #128 is planning authority, not runtime readiness. CON-03B must
-  precede REV-03; CON-02A/02C precede REV-04; REV-04 precedes CON-03C; CON-06
-  precedes REV-06; REV-09B plus CON-03C/07 precede REV-10; and CON-11's exact
-  obligation hooks/ordinal/drain manifest precedes REV-12A.
+- Merged REV PR #128 plus PLAN2 PR #150 are planning authority, not runtime
+  readiness. CON-03B precedes REV-03A; CON-02A/02C precede REV-04B; REV-04B
+  precedes CON-03C; CON-06 precedes REV-06A; REV-09B plus CON-03C/07 precede
+  REV-10; the CON-02B dispatcher/handler registry precedes REV-12P1; CON's
+  03D/08A/08B/10B/11 hooks precede REV-12A3; and CON-11 precedes REV-13C.
 - CON-08A/B and 10C cannot reuse outbox dispatcher authority for delivery,
   callback, reconciliation, or rebuild execution.
 - CON-10A owns core PostgreSQL contribution/award reads directly; it does not
   wait for optional evidence reads.
 - CON-11 has no ART or evidence-projection prerequisite. It hands mandatory
   obligation-writer, dispatch, callback, maximum-ordinal, and drain-observation
-  seams to REV-12A's single shared lifecycle controller and registers no route.
+  seams to REV-12A1/12A3's single shared lifecycle controller and registers no
+  route.
 - AUTH PR #140's complete ART and REV activation-custody transfer contracts are
   consumed by reference to AUTH/WS-XINT handoffs. The runtime transfers remain
   upstream gates; WS-CON does not define partial subsets.

.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/CONFORMANCE_MATRIX.md

@@ -5,7 +5,7 @@
 | Canonical policy model | 01,03B,04B | ContributionPolicy/version/rules/definitions; explicit unpaid; immutable publish; one active policy; NUMERIC(38,18) decimal-string bounds; ISO 4217 money units; project-scoped points units; stable binding references | CON-11 |
 | Adapter binding | 03A,04A,10B | one active binding per project/instrument; policy definitions and awards reference a binding with matching project/instrument identity while the binding stores no policy/award identifiers; non-secret route; suspend/resume and existing-award callback/replay behavior; retirement refuses active policy, unfinished frozen work, or unfulfilled award dependencies | CON-11 + joint live drill |
 | Legacy clean cut | 05A,05B | zero semantic consumers before schema removal; deterministic row treatment; no alias/fallback; migration upgrade/downgrade | CON-11 |
-| Authorization | AUTH + each feature | current 74-65-10-55 baseline after AUTH-09B; only `actor.service.provision` was newly activated; provisioning grants no service execution or admission; all CON mappings/identities/static rows remain unregistered; full ART/REV custody referenced; one future AUTH custodian; planned denial; exact grant/static row; AUTH-09E; prepared handle bound to session/action/actor-ref/idempotency/request digest with substitution non-consumption; no local role logic | AUTH activation + CON-11 |
+| Authorization | AUTH + each feature | current 74 PermissionId / 65 ActionId / 17 active / 48 planned baseline after AUTH-09D-B; contributor-foundation PR #153 changes human attribution and write revalidation only; provisioning grants no service execution or admission; all CON mappings/identities/static rows remain unregistered; full ART/REV custody referenced; one future AUTH custodian; planned denial; exact grant/static row; AUTH-09E; prepared handle bound to session/action/actor-ref/idempotency/request digest with substitution non-consumption; no local role logic | AUTH activation + CON-11 |
 | Final acceptance | REV + 03C,07 | accept creates one immutable FinalAcceptance per task/Review/Submission; needs_revision/reject create none; no create API/action, reopen, replacement, or adjudication path | joint live drill |
 | Contribution cardinality | 03C,07 + REV | one completed_review per valid Review with direct Review/lease lineage; one accepted_submission per FinalAcceptance with assignment lineage; mutually exclusive sources; revision Reviews distinct; automated outcomes create none | joint live drill |
 | Policy freeze | 05A,06 + task/REV | exact submitter/reviewer fields; published version; no drift; publish/suspend races both orders | joint live drill |

.agent-loop/initiatives/WS-CON-001-contribution-compensation-boundary/DECISIONS.md

@@ -221,14 +221,24 @@ contribution type, branch, action, readiness check, or initiative dependency.
 
 ## D16 - AUTH Planning And Provisioning Do Not Activate CON
 
-**Status:** accepted by merged AUTH PR #140 and AUTH-09B PR #143 on 2026-07-17.
-
-Trusted main `053242b` after AUTH-09B has 74 PermissionIds, 65 ActionIds, ten
-active actions, and 55 planned actions, with no registered CON or task-claim
+**Status:** accepted by merged AUTH PR #140, AUTH-09B PR #143, AUTH-09C PR
+#146, AUTH-09D-A PR #148, AUTH-09D-B PR #152, and contributor-foundation PR
+#153 through current main `8d5eb15b`; REV PLAN2 PR #150 and ART-02B1 PR #151 change no AUTH catalogue
+fact.
+
+Trusted main `8d5eb15b` after contributor-foundation PR #153 has 74
+PermissionIds, 65 ActionIds, 17
+active actions, and 48 planned actions, with no registered CON or task-claim
 ActionId. AUTH-09B activates only `actor.service.provision`; its controlled
 human-administrator route can create the ActorProfile/ActorIdentityLink for an
 already-approved closed ServiceIdentity but grants no service execution,
-runtime admission, role, grant, or database action assignment. PR #140 supplies
+runtime admission, role, grant, or database action assignment. AUTH-09C
+activates only administrative `actor.profile.read` and
+`actor.identity_link.read`. AUTH-09D-A activates only the three actor-profile
+lifecycle actions; AUTH-09D-B activates only identity-link revoke/reactivate.
+The contributor foundation is merged and changes attribution/write identity
+validation without changing authorization availability. Fixed-service
+admission remains planned. PR #140 supplies
 the exact prepared protocol, complete ART/REV custody maps, and feature-manifest
 activation rule; those runtime implementations remain upstream work.
 
@@ -266,8 +276,9 @@ the request route or service command commits once.
 
 **Status:** accepted from merged REV PR #128 on 2026-07-17.
 
-REV-12A owns the sole PostgreSQL `JointLifecycleReleaseControl` and shared
-`JointLifecycleMutationFence`. CON creates no parallel phase/controller. Every
+REV-12A1 owns the sole PostgreSQL `JointLifecycleReleaseControl`, and REV-12A3
+composes CON against the shared `JointLifecycleMutationFence`. CON creates no
+parallel phase/controller. Every
 fulfillment-obligation root creation, requeue, successor, and repair writer
 must acquire that fence before it allocates one immutable, monotonically
 increasing root ordinal or locks obligation rows.
@@ -297,3 +308,19 @@ credentials, URLs, markup, or metadata are never persisted, logged, emitted,
 exported, or returned. The bounded receipt identifiers are not authentication
 tokens and may appear only in their canonical receipt/status fields. Unknown
 provider failures map to the closed generic failure code before persistence.
+
+## D20 - Repository-Wide Runtime Proof Runs In GitHub CI
+
+**Status:** accepted by human direction for CON-02A and later runtime chunks.
+
+Repository-wide tests and repository coverage run in the existing GitHub
+Backend full-suite job after a full PR is pushed. Agents do not run the
+multi-hour repository suite locally. Local proof remains bounded to the active
+chunk's focused real-service tests, subsystem coverage floor, Ruff, migration
+head, documentation links, stale-contract scans, and agent-loop gates.
+
+This changes execution location, not proof strength. GitHub must still run the
+unchanged full test selection with isolated PostgreSQL, real MinIO where
+required, and the repository 78 percent coverage floor. A focused local pass
+cannot waive a missing or failing GitHub result, and the subsystem 90 percent
+coverage floor remains required.