GEWU/docs/acceptance/2026-10-14-project-lifecycle.md

Project registry lifecycle evidence

Status: local FR-P1 implementation acceptance. This does not establish protected owner authorization, a named production owner, native-client behavior, or pilot acceptance.

Contract

• Project IDs are lowercase hyphen-separated slugs and are immutable.
• The canonical entry is projects/<project_id>/project.md with strict ProjectRecord YAML frontmatter. Its matching initial AutoAcceptPolicy is committed alongside it at policies/<sha256(policy_id)>.yaml.
• Project creation requires a named owner, active status, a matching policy, supported-assessment enforcement, and default includes that resolve to a registered project or shared. Project and policy publish in one expected-head commit.
• Only an authenticated non-agent administrator can access the HTTP control routes. Browser-session writes require same-origin and CSRF checks. The streamed create body is capped at 64 KiB. These control-plane operations do not appear in the MCP agent catalog and do not bypass proposal validation.
• Archive is idempotent and one-way through this API. It writes a new canonical project revision, retains prior records/citations, and makes the project read-only. Paused and archived projects stay readable but cannot accept new changes. Shared cannot be created or archived as a project.
• Lifecycle writes use the same authority lock as proposal publication, so an archive cannot race an acceptance decision.

Evidence

tests/api/test_project_admin.py verifies unauthenticated and viewer denial, denial when an identity combines admin and agent, authorized create/list/ archive, duplicate conflict, missing CSRF, wrong Origin, browser-session success, and a 413 response above the body limit. tests/application/test_registry.py verifies the project frontmatter and policy are read into validation context, archive advances canonical revision and remains idempotent, the legacy JSON project entry is promoted by canonical archive, and the shared writer lock excludes an archive while held. tests/domain/test_validation.py verifies paused and archived projects cannot auto-accept a proposal. Contract tests cover the paused enum and slug IDs. The generated schema, OpenAPI, TypeScript contract, agent contract snapshot and GEWU pack 0.7.0 manifest are regenerated and verified.

Latest full local run: 153 backend tests, Ruff, mypy over 36 source files, boundaries, 13 frontend tests, production web build, two Chromium flows, schema and API-type generation, pack manifest verification, and both workspace whitespace checks passed on Linux/Python 3.14.7/Node 26.8.1.

The owners field is recorded as project metadata; this flow does not verify the owner's identity or implement owner challenges/grants. First-owner bootstrap, owner-only project intent/policy changes, Windows/macOS behavior and live remote deployment remain open.