feat(auth): add privacy-safe project role reads

.agent-loop/REVIEW_LOG.md

@@ -2818,3 +2818,29 @@ the independent checker against its unchanged 90 percent floor. The repair adds
 focused malformed-selection and exact-Git-identity cases; the identical command
 now passes 206 tests at 90.18 percent branch coverage. Exact-SHA internal repair
 review and fresh hosted checks remain.
+
+## 2026-07-22 - WS-AUTH-001-10B2 Internal Implementation Review
+
+AUTH-10B2 exact implementation SHA
+`6c7108251829c3c2853fc384bd8cc0668381ac7b` activates exactly three
+privacy-safe project candidate/grant reads after the durable authorization-read
+gate. Two internal repair cycles closed dependency-order, nonhuman concealment,
+cursor replay/pre-query, no-count SQL, service filtering, OpenAPI, hosted shape,
+and documentation proof gaps. Senior engineering, architecture, reuse/dedup,
+security/auth, QA/test, test delta, product/ops, docs, and CI integrity all pass
+with no open finding. Focused and isolated PostgreSQL evidence passes; GitHub
+full CI/coverage, hosted API E2E, CodeRabbit, and human review remain.
+
+## 2026-07-22 - WS-AUTH-001-10B2 External Review Reconciliation
+
+The first GitHub run found two valid integration gaps: hosted E2E used an actor
+without project-scoped Project Manager authority, and the closed audit fixture
+omitted the three activated actions. Repair SHA `95c3ecf7` provisions a
+distinct reader through the public grant API and restores exact audit parity;
+all nine internal tracks pass that repair. Fresh Backend run `29892395881`
+passes preflight, hosted E2E, all four shards, and aggregate coverage, and Agent
+Gates passes. CodeRabbit's refreshed description check passes and it has no
+inline finding. Its unexplained 37.61 percent docstring warning is
+non-actionable because the unchanged repository gate independently passes the
+same head at 87.6 percent against the 80 percent floor. Human review and
+explicit approval of PR #178 remain.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/chunks/WS-AUTH-001-10B2-project-role-grant-reads.md

@@ -43,8 +43,11 @@ backend/app/core/config.py
 backend/app/main.py
 backend/tests/test_actors.py
 backend/tests/test_authorization.py
+backend/tests/test_api_controls.py
+backend/tests/test_audit.py
 backend/tests/test_projects.py
 backend/tests/test_config.py
+backend/tests/conftest.py
 backend/scripts/api_contract_e2e.py
 docs/operations_authorization_service.md
 docs/spec_authorization_service.md
@@ -104,9 +107,11 @@ principals deny before product-row lookup.
   mismatches, and lifecycle concealment do not fabricate authorization-denial
   evidence except candidate terminal/archived status, which is an evidenced
   kernel resource-guard denial after canonical project load. Tests prove each path.
-- A composed human-only prelookup dependency rejects fixed services before
-  `ProjectRepository.get_project`; agent and Space kinds remain rejected by the
-  existing actor-resolution boundary. Because no canonical project exists at
+- A composed human-only prelookup dependency rejects every verified nonhuman
+  subject kind before `ProjectRepository.get_project`. This includes fixed
+  services and the currently unsupported agent and Space kinds, and intentionally
+  fails earlier than the general actor-resolution boundary for these three
+  privacy-sensitive routes. Because no canonical project exists at
   this point, this prelookup rejection does not fabricate an action decision or
   authority audit event. It returns the same public 404 and tests prove zero
   project/candidate/grant query. It never constructs a canonical context from
@@ -116,7 +121,10 @@ principals deny before product-row lookup.
   `(created_at, actor_profile_id)`; executes no count; and returns only ID plus
   nullable display name. Active-link eligibility uses `EXISTS`, not a
   multiplicative join, so each profile occurs once even if bad/legacy data
-  exposes multiple eligible links; regression proof covers uniqueness. Only
+  exposes multiple eligible links. Current PostgreSQL also enforces the existing
+  one-link-per-profile unique constraint, so regression proof binds that
+  structural constraint plus the defensive `EXISTS` query rather than inserting
+  an impossible second link. Only
   draft, active, and paused projects qualify.
 - Grant list/detail remain readable in every existing project state. List
   applies optional status/role before keyset and `limit + 1`, orders ascending
@@ -176,9 +184,13 @@ principals deny before product-row lookup.
   project-state behavior, strict fields/no totals, and the unchanged
   no-migration/no-PREP/no-mutation boundary.
 - Hosted `api_contract_e2e.py` provisions an isolated cursor secret and exercises
-  all three real routes, practical 429/503 mappings, identical 404 concealment,
-  OpenAPI action IDs, strict shapes, and absence of extra surfaces. The merge
-  intent names only 10B2 and its successor 10C.
+  all three real routes, identical 404 concealment, OpenAPI action IDs, strict
+  shapes, and absence of extra surfaces. Deterministic ASGI dependency tests own
+  practical 429/`Retry-After` and retryable 503 injection because making the
+  isolated hosted database unavailable would also destroy the server and its
+  cleanup boundary; they exercise the real nested rate dependency and prove the
+  failure precedes project SQL. The merge intent names only 10B2 and its
+  successor 10C.
 
 ## Verification commands
 
@@ -204,6 +216,49 @@ integrity, docs, reuse/dedup, and test delta.
 Review rate-before-lookup, canonical scope, identical audited concealment,
 filter-before-keyset behavior, minimal fields, cursor binding, and exact activation.
 
+## Preimplementation plan-review resolution
+
+- Dependency precedence is exact: verified token, one `authorization_read`
+  consumption, actor resolution plus human-only admission, canonical project
+  load, kernel authorization, cursor validation, then row query. For every
+  verified token, exhausted 429 or private retryable 503 therefore precedes the
+  identical nonhuman 404. Tests cover human, service, agent, Space, concealed,
+  missing-resource, and invalid-cursor paths at this ordering.
+- Candidate project-state eligibility remains a typed resource guard inside the
+  single `AuthorizationService.require` decision. Grant list/detail deliberately
+  carry no project-state guard.
+- Cursor-secret parsing and redaction land before route activation and startup
+  validates the required canonical Base64 32-byte value. There is no default,
+  test compatibility value, auth/rate-secret fallback, or serialization path.
+  Coordinated rotation intentionally invalidates outstanding cursors and requires
+  quiescence plus restart across replicas. The shared pytest harness explicitly
+  provisions an isolated test-only value because startup validation applies to
+  every application fixture; this is environment provisioning, not a Settings
+  default or compatibility fallback.
+- Permission/scope and candidate lifecycle denials retain dependency-owned
+  rollback, bounded denial restaging, commit, and identical 404 translation.
+  Evidence persistence failure maps to private retryable 503. Missing project or
+  grant, project/grant mismatch, and nonhuman prelookup rejection create no
+  fabricated decision or audit row; routes neither catch `AuthorizationDenied`
+  nor commit.
+- Activation is atomic with the complete route boundary: exactly the three
+  existing `ActionOwner.AUTH_10B` rows and three OpenAPI operations become
+  active. AUTH-10C remains planned. No CI workflow, threshold, skip, xfail, or
+  fixture-scope workaround is permitted; any required file outside the contract
+  is a stop for contract amendment.
+- Final architecture review confirmed that rejecting every verified nonhuman
+  token immediately after the durable rate gate is the smaller route-specific
+  boundary: it avoids actor-registry and product SQL and emits no fabricated
+  action decision. The earlier fixed-service-only wording is superseded;
+  general actor resolution remains unchanged for every other route.
+- The existing exact OpenAPI inventory gate must move from 62 to 65 routes and
+  record precisely these three actions. `backend/tests/test_api_controls.py` is
+  allowed only for that strengthened manifest regression; no inventory
+  assertion may be removed or loosened.
+- The existing action-aware audit registry test must add the same exact three
+  active actions. `backend/tests/test_audit.py` is allowed only for that closed
+  active-set parity assertion; no audit validation may be weakened.
+
 ## Stop conditions
 
 Stop on client project truth, authorization after row query, count leakage,

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-10B2-external-review-response.md

@@ -0,0 +1,51 @@
+# External Review Response: WS-AUTH-001-10B2
+
+## Comments addressed
+
+- The first GitHub Backend run exposed two valid integration gaps: the hosted
+  reader lacked project-scoped Project Manager authority, and the closed audit
+  active-action fixture omitted the three newly activated reads. Repair SHA
+  `95c3ecf77afed2746a66f314d05eb547cfa15f3c` provisions a distinct reader
+  through the existing public grant API and restores exact audit parity.
+- CodeRabbit warned that the PR description omitted trust-bundle sections. The
+  live PR description now follows the repository template, and CodeRabbit's
+  refreshed Description check passes.
+
+## Comments deferred
+
+- None.
+
+## Non-actionable findings
+
+- CodeRabbit reports 37.61 percent docstring coverage without identifying a
+  file or symbol. The repository's unchanged authoritative docstring command
+  passes the same head at 87.6 percent against its 80 percent floor. GitHub
+  preflight independently passes that gate. Adding unscoped docstrings merely
+  to match an unexplained external calculation would expand the reviewed diff
+  without improving the repository-defined evidence.
+- GitHub's Node.js 20 action-runtime annotations concern unchanged pinned
+  workflow dependencies and are outside this no-workflow chunk.
+
+## Human decisions needed
+
+- Human review and explicit approval remain required before PR #178 may merge.
+
+## Commands rerun
+
+```text
+GitHub Backend run 29892395881:
+- preflight: pass
+- api_e2e: pass
+- shards 1-4: pass
+- aggregate test and coverage: pass
+
+GitHub Agent Gates: pass
+CodeRabbit refreshed Description check: pass
+```
+
+## Remaining risks
+
+- CodeRabbit did not perform an inline code review because its review allowance
+  was rate-limited; it posted no unresolved actionable code comment.
+- Authorization/privacy remains L1 and therefore still requires the recorded
+  human review focus before explicit merge approval.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-10B2-internal-review-evidence.md

@@ -0,0 +1,97 @@
+# Internal Review Evidence: WS-AUTH-001-10B2
+
+## Chunk And Reviewed Code
+
+`WS-AUTH-001-10B2` — Privacy-Safe Project Role Grant Reads. Risk: L1
+authorization/privacy. Trusted main is `14fa4316f7d984f2176657bfafd2a2dae56f944e`.
+
+Reviewed code SHA: `041c0455379dab73d044d9f952f259a9afc17983`
+Reviewed at: 2026-07-23T00:18:30Z
+Reviewer run IDs: /root/auth10b1_final_core, /root/auth10b1_final_security_qa, /root/auth10b1_final_ops_docs_ci
+
+Runtime repair SHA `95c3ecf77afed2746a66f314d05eb547cfa15f3c`
+was reviewed by the same tracks before the evidence-only descendants.
+Prior post-start reconciliation SHA
+`2b7c5a83d8871b05266ee3c0a9991ca4bc686e12` integrated main
+`afde967d56914cdc6a941aa17b3ff0e98b2e9c64` without an AUTH runtime,
+contract, test, or evidence-content change. Latest main
+`9033a97a4be6d762cae4b210018ef81a079395c2` was then reconciled at the
+reviewed SHA above. AUTH production runtime and contract are unchanged; the
+trusted-main shared test/reset changes were conflict-resolved and reverified.
+Prior latest-main conflict-resolution SHA
+`649069f38e2eb374a4302ea859a70a842e81215d` remains historical evidence.
+Latest main `93c14181f8a14c88c2cbfb2f2ea886c8d46deec8` was integrated at the
+reviewed SHA above. AUTH production runtime and contract remain unchanged;
+the inherited artifact operator routes and workflow coverage strengthening
+were integrated and reverified.
+
+## Implemented Contract
+
+- Activates exactly three AUTH-10B project candidate/grant read actions/routes;
+  AUTH-10C remains planned.
+- Orders one durable rate consumption, nonhuman concealment, project load,
+  kernel authorization, cursor validation, then private row SQL.
+- Adds strict count-free responses and HMAC-SHA256 keysets bound to normalized
+  action, project, filters, limit, order, timestamp, and UUID.
+- Requires an independent canonical Base64 32-byte startup key with no default,
+  fallback, serialization, or authentication/rate-key reuse.
+- Adds no migration and changes no PREP, issue, revoke, or mutation behavior.
+
+## Deterministic Evidence
+
+```text
+148 passed — complete configuration test file
+42 passed, 218 deselected — cursor/rate/nonhuman/kernel/read-service row
+1 passed — exact OpenAPI inventory and protected-action manifest
+2 passed — OpenAPI plus one-link structural candidate constraint
+2 passed in 53.82s — isolated PostgreSQL candidate/grant keysets, filters,
+service exclusion, project binding, limit+1, and no-COUNT SQL
+Ruff app/tests/scripts — passed
+Python compileall app/hosted drill — passed
+Docstring coverage — 87.6% against 80% floor
+Markdown links and stale wording/authorization scans — passed
+git diff --check — passed
+```
+
+The repository-wide suite is GitHub-owned because this workstation previously
+required about four hours and a broader local run hit SQLAlchemy process
+instability. GitHub must prove all shards, hosted API E2E, the 78% repository
+floor, and the 90% authorization-subsystem floor.
+
+## Integrity And Review
+
+No test was deleted, skipped, xfailed, or weakened. AUTH-10B2 itself
+strengthens the exact OpenAPI inventory from 62 to 65 routes and 60 to 63
+protected operations. Composed with latest main, the reviewed tree contains 74
+routes with hash
+`f0076e4145d8fe68365912a6e5bc047dece3ae2ac1e69619018b5119a9710c09`
+and 72 protected operations with hash
+`b05ebbca27a538958af6c122403ccf3997ab08326943150f6c763ce9c321eec5`.
+AUTH changed no workflow, dependency, command, shard, threshold, or coverage
+setting; latest main's inherited workflow change strengthens router coverage.
+
+| Reviewer | Result | Blocking findings |
+|---|---|---|
+| Senior engineering | PASS | none |
+| Architecture | PASS | none |
+| Reuse/dedup | PASS | none |
+| Security/auth | PASS | none |
+| QA/test | PASS | none |
+| Test delta | PASS | none |
+| Product/ops | PASS | none |
+| Docs | PASS | none |
+| CI integrity | PASS | none |
+
+Exact-SHA reviewers: `/root/auth10b1_final_core`,
+`/root/auth10b1_final_security_qa`, and `/root/auth10b1_final_ops_docs_ci`.
+Two repair cycles closed every valid finding. Open reviewer sessions: none.
+
+Open sub-agent sessions: none
+Valid findings addressed: yes
+
+## Internal Repair Re-review
+
+All nine internal tracks pass repair SHA
+`95c3ecf77afed2746a66f314d05eb547cfa15f3c` with no open finding. External
+GitHub and CodeRabbit findings, repairs, and final statuses are recorded only in
+`WS-AUTH-001-10B2-external-review-response.md`.

.agent-loop/initiatives/WS-AUTH-001-workstream-authorization-service/reviews/WS-AUTH-001-10B2-pr-trust-bundle.md

@@ -0,0 +1,61 @@
+# PR Trust Bundle: WS-AUTH-001-10B2
+
+## Chunk And Goal
+
+`WS-AUTH-001-10B2` exposes privacy-safe contributor candidates and immutable
+project-role grant history through three exact authenticated, rate-controlled
+read actions. Risk is L1 authorization/privacy.
+
+## Human-Approved Intent
+
+The user explicitly started this signed successor after 10B1 merged and requires
+end-to-end safety before 10C. Signed loop memory binds it to main `14fa4316`.
+
+## Change, Design, And Scope
+
+- Added signed keyset cursors and a required independent startup secret.
+- Added candidate and grant-history repository reads with exact filters,
+  project binding, `limit + 1`, no count, and timestamp/UUID progression.
+- Added typed contexts, kernel guard, action-aware concealment, minimal schemas,
+  and exactly three `/api/v1/projects/...` GET routes.
+- Strengthened PostgreSQL, OpenAPI, config, focused, and hosted API proof.
+- Documented provisioning, rotation, disclosure, authority, state, and errors.
+- Added one merge intent naming 10C as an explicit-start successor.
+
+Authorization precedes cursor/row lookup. Candidate lifecycle remains inside the
+kernel; grant history remains readable in every project state. All verified
+nonhumans are rate-gated then concealed before actor/product SQL. Sensitive
+absence and denials share one 404.
+
+All files are contract-allowed. There is no migration, workflow/dependency edit,
+PREP change, mutation activation, frontend work, or AUTH-10C surface. Responses
+never expose totals, identity-link facts, issuer/subject, contact, claims, or keys.
+
+## Proof And Review
+
+Focused evidence passes: 148 config tests; 42 cursor/rate/kernel/service tests;
+exact OpenAPI inventory; and two isolated PostgreSQL candidate/grant tests.
+Ruff, compileall, docstrings, links, stale scans, and diff hygiene pass. Hosted
+E2E provisions a cursor key and checks all routes, strict nonempty nested shapes,
+stable concealment, exact actions, and 10C/context absence.
+
+No test or CI threshold was weakened. All nine internal tracks pass exact SHA
+`95c3ecf77afed2746a66f314d05eb547cfa15f3c` with no open finding.
+
+## External Review, Risk, And Human Focus
+
+GitHub Backend run `29892395881` passes preflight, hosted API E2E, all four
+isolated shards, and aggregate coverage. Agent Gates passes. CodeRabbit has no
+inline code finding; its refreshed description check passes. Its remaining
+37.61 percent docstring warning conflicts with the unchanged authoritative
+repository gate, which passes at 87.6 percent, and identifies no file or symbol.
+The external-response artifact records this as non-actionable rather than
+expanding the reviewed diff to satisfy an unexplained external calculation.
+The first hosted run exposed missing project-scoped reader authority and one
+stale exact audit action set. Repair SHA `95c3ecf7` provisions a distinct reader
+through the public project-scoped AdminRoleGrant API and adds only the three
+activated actions to audit parity; all internal tracks pass the repair.
+Human review should focus on ordering, PM/Audit scope and lifecycle boundaries,
+cursor binding, response minimization, identical concealment, and the exact
+three-action activation. The user retains merge ownership; do not merge without
+explicit approval of the specific PR.

.agent-loop/merge-intents/WS-AUTH-001-10B2.json

@@ -0,0 +1,9 @@
+{
+  "chunk_id": "WS-AUTH-001-10B2",
+  "chunk_title": "Privacy-Safe Project Role Grant Reads",
+  "initiative_id": "WS-AUTH-001",
+  "next_chunk_id": "WS-AUTH-001-10C",
+  "next_chunk_title": "Project Role Grant Mutations",
+  "next_requires_explicit_start": true,
+  "schema_version": 2
+}