Add bounded Workspace project discovery read contract

[pcvantol]

Scope

HOB-EP01 / L2-WORKSPACE-PROJECT-DISCOVERY-READ-V1-20261012, JOIN L2-L4-HOB-EP01-VERIFIED-LINK-V1-20261012, authorized forge#142 decision6161548467. R34 remains CLOSED.

Add only bounded authenticated GET project discovery/selected topology over real existing B8R/CENTRAL, separate finite revocable Workspace READ grants, owner CLI parity, closed schema/docs/Postman mapping. No project creation/onboarding execution, shared admin/submission bearer, scanner, paths/secrets, live deployment, signing or new writer.

Evidence and gates

Same branch/base/history. Candidate6a7037e589ee0b9f32758e537fa88a367cedb8ad / treede3bbc77e121280c271e32c7a3606d91f22c7b2e / EP2.3.120; official clean noneditable wheel SHA256863c4fe4cc4ba5876a0f84538f4603990073fc64e02424ab2b604e594954d474. One integrated correction booked; original failure logs/reviews retained. Targeted Q/S findings admitted, not full final review.

37 installed package/real localhost HTTP/schema tests PASS;12 historical upgrade tests PASS. Additional owning populated agent/attachment/pairing-credential74→75 preservation/rollback2PASS; real supported-journal owner revocation commit/publication barrier1PASS. First ordinary installed init/B8R/owner-issue/start/discovery→topology/wrongscope/revoke/source-loss/refault/stop chain PASS under original source39a8567; preserved as that pin, not rewritten as candidate6a7037e final proof. Source records in owning forge#142.

Remaining required before merge: complete exact-candidate independent Quality/Security, full installed behavior/strict production coverage and owning CI, authority/version/projection/Postman/security/TDE gates. Protected exact-head source, nonempty Finalization and NEW exact-final-main installed/readback/cleanup plus immutable L4 handoff remain OPEN. No tests/thresholds or branch protection bypass.

[pcvantol]

HOB-EP01 — immutable kandidaat3; volledige gates actief

HEAD c218460 / tree a74597dbf76fa83c1de4535ab611034de9a41505 / EP2.3.120; zelfde branch/writer/base en PR355. Officiële schone wheel/install SHA256 6f11b9e3d658c6af7f995346b578815803e3fe6b91d830884ce3f83312209f53. Echte Python3.14.8 noneditable site-packages en child-PATH/importbinding gecontroleerd; 40 actuele installed contract/HTTP/migratie/lifecycle-regressies PASS, rawlog behouden.

Complete onafhankelijke Quality en Security lezen alle23base→headfiles en controleren ieder afzonderlijk195productbron/wheel/currentinstalledbytebindings. SOURCE_AND_TARGETED_ARTIFACT_ADMITTED, geen open materiële bevinding; GEEN volledige gate-/merge-/installedfinalmainacceptatie vooruit geclaimd. Immutable private reporthashes: Quality 3dc7c2f88091a391b842538715dc489264399aa4956a4c4a2ff7ee7bc8e43255; Security ed6efece13efbc392461e50b37d7d0b8f1803f40e7e79c50c7183f0899b21e58.

Correctie2 blijft eenmaal verbruikt. Werkelijk automatische owning kwalificatie op f43/run38545862893 als volledige cyclus2 eenmaal administratief bijgeschreven, niet verzwegen/reset. Alle4normale browsershards en JScoverage SUCCESS; na benodigde onafhankelijk gevonden helperlifecyclecorrectie expliciet superseded/cancelled, volledige f43geenPASS. Runninglogdownload404/parentnotready blijft oorspronkelijke poging; terminale coverage-joblog nu behouden in f43-coverage-cancelled-original.log; cancelstatus daadwerkelijk teruggelezen. Geen afgezwakte controles/losseretries als sluitingsbewijs.

Volledige cyclus3 precies eenmaal vóór normale nieuwepushgeboekt; owningrun38547636168 op exacte c218 kandidaat. Alle strikte drempels/matrix en bestaande browsergates behouden. Actuele source/tests/WIP schoon na commit, geen tweede writer. CI/corecoverage nog actief; daarna numeriek onafhankelijke finale checks, protected exact-head merge, gewone nietlege NO_BUMP Finalization en NIEUW exact-final-main installed HTTP/readback/cleanup plus gekwalificeerde JOIN-handoff. R34/GP/r43/r44 gesloten, geen live EP/provider/signing. Originele browserkleurfailure oorzaak UNKNOWN behouden, huidige normale gateuitkomst alleen bij zijn eigen kandidaat.

[pcvantol]

Final independent current-source gate closure on exact c218460 / tree a74597dbf76fa83c1de4535ab611034de9a41505.

Quality APPROVE: immutable report SHA256 69393f7abcb8eb5b9371293da0971b766fe966539c78f55e1ba1b221a768f16d.
Security APPROVE: immutable report SHA256 b0e0bf6f2e6672474dfff1d67926fb70e57ada1c71035a44562400d5f2caf7b6.

All 11 owning CI jobs on 38547636168 completed SUCCESS, including full coverage, validate, all four browser shards, exact JS coverage, Postman and downstream evidence. Canonical versioning, CodeQL, security baseline and normal Trusted Delivery/Owner Authorization checks SUCCESS; existing Golden Regression baseline SKIPPED, not PASS. Original local installed full suite2559/3619.624s/OK/Macskip1/natural0; all166 modules at existing thresholds, allfour changed executable-line percentages strictly>80.2 independently recomputed. TDE separately remains underlying FAILED observe-only; no waiver, suppression or green-workflow qualification claim.

This approves normal protected exact-head IMPLEMENTATION merge only. Ordinary nonempty NO_BUMP Finalization and NEW exact-final-main installed/readback/cleanup/qualified JOIN handoff remain required. R34 remains CLOSED; same writer and preserved source history.