WS-ARCH-001-CP04B: implement hidden policy publication lifecycle

.agent-loop/CURRENT_STATE.md

@@ -28,10 +28,10 @@ authority; these records do not grant or withhold it.
 
 | Initiative | Durable state on `main` | Remaining boundary |
 |---|---|---|
-| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H`; CP01A-CP03B establish adapter-binding behavior/activation; CP04A completes hidden policy read/create/update-draft behavior with durable operation/event custody | Implement CP04B hidden publish/retire behavior; CP05 later activates the proven policy actions, and PLAN2 still targets durable `allow_review` |
+| [WS-ARCH-001](initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md) | Complete through `WS-ARCH-001-02H`; CP01A-CP03B establish adapter-binding behavior/activation; CP04A-CP04B complete hidden policy behavior with durable custody | Prepare CP05 to activate only the proven policy actions; PLAN2 still targets durable `allow_review` |
 | [WS-ART-001](initiatives/WS-ART-001-immutable-artifact-storage/STATUS.md) | Active delivery initiative; verified ready-admission publication, hidden preparation, consumption and binding are merged through ARCH-02H | Implement exact post-submit materialization only after the unified guide/checker and PLAN2 public contracts are executable; live cutover remains later |
 | [WS-AUTH-001](initiatives/WS-AUTH-001-workstream-authorization-service/STATUS.md) | Active delivery initiative; project-policy authority and unified compilation authorization are merged through `12I` | POL-03B consumes 12I next; remaining AUTH activation chunks wait for their exact hidden owner behavior |
-| [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; CP03B completes adapter-binding activation and CP04A completes hidden ContributionPolicy draft behavior; shared lifecycle audit foundations are merged | Implement CP04B publication/retirement; later activate policy actions and complete guide-activation validation/persistence before task readiness |
+| [WS-CON-001](initiatives/WS-CON-001-contribution-compensation-boundary/STATUS.md) | Active delivery initiative; CP03B completes adapter-binding activation and CP04A-CP04B complete hidden ContributionPolicy behavior; shared lifecycle audit foundations are merged | Prepare CP05 policy activation, then complete guide-activation validation/persistence before task readiness |
 | [WS-AUTH-003](initiatives/WS-AUTH-003-module-boundary-recovery/STATUS.md) | AUTH boundary foundation and first public-capability proof through POL-03A are merged | Repair each touched AUTH capability through `authorization.api` and shrink the canonical AUTH ledger |
 | [WS-POL-003](initiatives/WS-POL-003-unified-project-guide-compilation/STATUS.md) | Active delivery initiative; hidden compilation custody and AUTH-12I activation are merged | Implement POL-03B authorized compilation persistence, then continue the reviewed dependency order |
 | [WS-REV-001](initiatives/WS-REV-001-review-revision-lifecycle/STATUS.md) | Independent foundations through queue admission and reviewer-lease persistence are merged through `03A2`; schema/packet foundations may continue behind their own gates | Live admission/claim requires canonical 04E `allow_review`; ReviewLease copies the admitted Submission's immutable attempt policy version, and the first Review commit requires CON-03C/07 atomic contribution/award behavior |
@@ -102,7 +102,7 @@ AUTH unavailable registration, hidden CON binding/policy behavior, exact AUTH
 activations, CON validation, PROJECT guide binding, TASK attempt lineage, and
 clean v0.1 legacy economic-path removal in that order. CP02 and CP03A are
 merged, and CP03B is complete with the four exact hidden Finance Authority
-actions active. CP04A/CP04B now have executable contracts; later CP05-CP09
+actions active. CP04A/CP04B are complete; later CP05-CP09
 remain non-executable until their current-main contracts are expanded.
 
 - WS-ARCH-001-PLAN3 is planned; its planning merge changed no runtime behavior.
@@ -124,12 +124,12 @@ remain non-executable until their current-main contracts are expanded.
   consume the public AUTH API and same-owner private wiring is confined to the
   exact AUTH adapter root. No compensation delivery or fulfillment behavior is
   activated.
-- WS-ARCH-001-CP04 is a planned non-executable parent. CP04A and CP04B have
-  executable contracts; CP04B is the next implementation boundary.
+- WS-ARCH-001-CP04 is a planned non-executable parent. CP04A and CP04B are
+  complete; CP05 is the next planning boundary.
 - WS-ARCH-001-CP04A is complete with hidden policy read/create/update-draft
   behavior; it exposes no route and activates no policy action.
-- WS-ARCH-001-CP04B is planned next for hidden publication/retirement.
-- WS-ARCH-001-CP05 is proposed and non-executable.
+- WS-ARCH-001-CP04B is complete with hidden publication/retirement.
+- WS-ARCH-001-CP05 is next and remains non-executable pending its contract.
 - WS-ARCH-001-CP06 is proposed and non-executable.
 - WS-ARCH-001-CP07 is proposed and non-executable.
 - WS-ARCH-001-CP08 is proposed and non-executable.

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/CHUNK_MAP.md

@@ -27,7 +27,7 @@
 | `WS-ARCH-001-CP03B` | AUTH exact Finance Authority adapter-binding activation | L1 | Complete; four exact hidden actions active through public ports, with private wiring confined to the AUTH adapter root |
 | `WS-ARCH-001-CP04` | Hidden ContributionPolicy behavior coordination parent | L1 | Planned split into CP04A/CP04B; non-executable |
 | `WS-ARCH-001-CP04A` | CONTRIBUTIONS public API and hidden read/create/update-draft behavior | L1 | Complete; hidden route-unreachable behavior, public owner ports, operation recovery, and immutable event custody merged while policy actions remain unavailable |
-| `WS-ARCH-001-CP04B` | Hidden ContributionPolicy publish/retire behavior | L1 | Planned executable contract after merged CP04A |
+| `WS-ARCH-001-CP04B` | Hidden ContributionPolicy publish/retire behavior | L1 | Complete; hidden and deny-default |
 | `WS-ARCH-001-CP05` | AUTH exact ContributionPolicy activation | L1 | Proposed skeleton after CP04 evidence |
 | `WS-ARCH-001-CP06` | CON guide-activation/revision policy-validation port | L1 | Proposed skeleton after CP05 |
 | `WS-ARCH-001-CP07` | PROJECT guide-bound ContributionPolicyVersion persistence | L1 | Proposed skeleton after CP06 |
@@ -54,7 +54,7 @@ feature contract crosses more than one reviewable mutation boundary. The
 02A-02I sequence is the executable split of parent 02, subject to plan review
 and human approval.
 
-CP04 is a non-executable split parent; CP04A and CP04B are executable contracts.
+CP04 is a non-executable split parent; CP04A and CP04B are complete.
 CP05-CP09 and chunks 03A-04F are non-executable planning skeletons. Before implementation,
 each remaining skeleton must be replaced with a current-main contract that names exact allowed and
 not-allowed files, migration head, runnable commands, reviewers, and the public

.agent-loop/initiatives/WS-ARCH-001-modular-monolith-boundaries/STATUS.md

@@ -3,8 +3,8 @@
 - Initiative state: active; boundary foundation complete
 - Runtime behavior changed: hidden CON adapter-binding behavior plus exactly four
   Finance Authority actions, and hidden ContributionPolicy read/create-draft/
-  update-draft behavior; all five policy actions remain unavailable and no
-  public route exists
+  update-draft/publish/retire behavior; all five policy actions remain
+  unavailable and no public route exists
 - Canonical target: nine business modules and three supporting modules
 - Recovery model: freeze exact debt, prohibit growth, repair touched
   capabilities incrementally
@@ -59,7 +59,7 @@
   registered/unavailable. CP02 is merged with hidden CON behavior
   while its AUTH actions remain unavailable; CP03 is split, CP03A is merged,
   and CP03B is complete with four exact hidden Finance Authority actions
-  active. CP04A is complete and CP04B remains executable, while CP05-CP09
+  active. CP04A and CP04B are complete, while CP05-CP09
   remain non-executable skeletons.
 - [WS-ARCH-001-PLAN4](chunks/WS-ARCH-001-PLAN4-incremental-debt-retirement.md) is planned
   and changes no runtime. It makes the existing incremental strangler
@@ -101,9 +101,9 @@
   draft behavior, public owner ports preserve COMPENSATION and PROJECTS
   boundaries, PostgreSQL operation/event custody is durable, and all five
   policy actions remain unavailable.
-- WS-ARCH-001-CP04B is planned with an executable hidden publish/retire
-  contract and is the next policy-behavior boundary after CP04A.
-- WS-ARCH-001-CP05 is proposed: exact ContributionPolicy activation.
+- WS-ARCH-001-CP04B is complete: hidden publish/retire behavior uses
+  immutable transition custody while all five actions remain unavailable.
+- WS-ARCH-001-CP05 is next: exact ContributionPolicy activation.
 - WS-ARCH-001-CP06 is proposed: CON policy-validation port.
 - WS-ARCH-001-CP07 is proposed: PROJECT guide binding.
 - WS-ARCH-001-CP08 is proposed: TASK/Assignment/Submission lineage persistence