trueppm-api 0.4.0b2__py3-none-any.whl

trueppm_api/apps/projects/calendar_settings.py

@@ -0,0 +1,180 @@
+"""Project → Program → Workspace working-calendar resolution (ADR-0441, #1987).
+
+The *working calendar* (working-day mask, hours-per-day, timezone, holiday/shutdown
+exceptions) that CPM uses can be set at three scopes. The *effective base calendar* a
+project schedules against is resolved here, computed-on-read (ADR-0108) — there is no
+stored/denormalized effective column to keep in sync. Clients (web, mobile, MCP) read
+the serializer's ``effective_calendar`` / ``calendar_source``; they never re-implement
+this precedence, and neither does the CPM seam (``scheduling.calendars`` calls
+:func:`resolve_effective_base_calendar` to seed the composed mask).
+
+Precedence (most specific wins):
+
+    project.calendar → program.calendar → workspace.calendar → system default
+
+``None`` at every scope means "system default" — the code-level Mon-Fri/8h/UTC fallback
+in ``build_sched_calendar(None)`` remains the single source of the system default; we do
+**not** materialize a system-default ``Calendar`` row.
+
+This is Shape A (NULL-means-inherit), mirroring ``iteration_label`` / ``sharing_settings``
+/ ``attachment_policy``: each scope's column is nullable and ``NULL`` = inherit. The base
+calendar it resolves still composes with the project's ``ProjectCalendarLayer`` overlays
+(ADR-0251) — inheritance picks the base; overlays stack on top of it unchanged.
+
+``ENFORCE`` (a workspace admin locking the calendar so a program/project cannot override
+it) is an Enterprise capability. OSS ships the neutral hook below and registers no
+provider, so ``ENFORCE`` degrades to ``SUGGEST`` (no lock). trueppm-enterprise registers a
+provider in its ``AppConfig.ready()`` — the integrations-registry idiom (ADR-0029/0049),
+mirroring ``iteration_label.register_terminology_enforcement_provider``. OSS never imports
+enterprise.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Literal
+
+from trueppm_api.core.extension_providers import guard_single_provider
+
+if TYPE_CHECKING:
+    from trueppm_api.apps.projects.models import Calendar, Program, Project
+    from trueppm_api.apps.workspace.models import Workspace
+
+#: Where the resolved base calendar came from. ``system_default`` means nothing up the
+#: chain set a calendar, so CPM uses the Mon-Fri/8h/UTC backstop.
+CalendarSource = Literal["project", "program", "workspace", "system_default"]
+
+# Enterprise registers a zero-arg predicate that returns True when calendar-override
+# enforcement is licensed/active. OSS leaves it None → enforcement inactive, so a
+# workspace ENFORCE policy never locks downstream overrides in the community edition.
+_ENFORCEMENT_PROVIDER: Callable[[], bool] | None = None
+
+
+def register_calendar_enforcement_provider(provider: Callable[[], bool] | None) -> None:
+    """Register (or clear) the calendar-enforcement provider. Enterprise calls this."""
+    global _ENFORCEMENT_PROVIDER
+    _ENFORCEMENT_PROVIDER = guard_single_provider(
+        _ENFORCEMENT_PROVIDER, provider, "calendar enforcement"
+    )
+
+
+def calendar_enforcement_active() -> bool:
+    """True only when an enterprise provider is registered AND reports active.
+
+    OSS has no provider → always False, so a workspace ``ENFORCE`` policy never locks
+    downstream calendar overrides in the community edition.
+    """
+    return _ENFORCEMENT_PROVIDER is not None and bool(_ENFORCEMENT_PROVIDER())
+
+
+def calendar_override_locked(workspace: Workspace) -> bool:
+    """Whether per-scope calendar overrides are locked to the workspace calendar.
+
+    True under ``INHERIT`` (always — the affordance is hidden by design) or under
+    ``ENFORCE`` *with* an active enterprise provider. ``SUGGEST`` (and OSS ``ENFORCE``
+    with no provider) returns False, so the per-scope override is honored and editable.
+    This is the single predicate the serializer and the write-permission gate both
+    consult, so resolution and enforcement can never drift apart.
+    """
+    from trueppm_api.apps.workspace.models import TermOverridePolicy
+
+    policy = workspace.calendar_override_policy
+    if policy == TermOverridePolicy.INHERIT:
+        return True
+    if policy == TermOverridePolicy.ENFORCE:
+        return calendar_enforcement_active()
+    return False
+
+
+def _program_of(obj: Program | Project) -> Program | None:
+    """The owning program of a project, or None for a program/standalone project."""
+    from trueppm_api.apps.projects.models import Program
+
+    if isinstance(obj, Program):
+        return None
+    return obj.program if obj.program_id else None
+
+
+def resolve_effective_base_calendar(
+    obj: Program | Project, *, workspace: Workspace | None = None
+) -> Calendar | None:
+    """Resolve the base ``Calendar`` a program or project schedules against.
+
+    Returns ``None`` when nothing up the chain sets a calendar — the caller then uses
+    the system default (Mon-Fri/8h/UTC). ``workspace`` may be passed to avoid re-loading
+    the singleton per object when resolving a list; otherwise it is loaded here.
+    """
+    from trueppm_api.apps.projects.models import Program
+    from trueppm_api.apps.workspace.models import Workspace
+
+    if workspace is None:
+        workspace = Workspace.load()
+
+    if calendar_override_locked(workspace):
+        # INHERIT / active ENFORCE: the workspace calendar wins regardless of any
+        # lower-scope override.
+        return workspace.calendar
+
+    own = None if isinstance(obj, Program) else obj.calendar
+    program = _program_of(obj)
+    program_calendar = program.calendar if program else None
+    if own is not None:
+        return own
+    if isinstance(obj, Program):
+        return obj.calendar or workspace.calendar
+    return program_calendar or workspace.calendar
+
+
+def resolve_inherited_base_calendar(
+    obj: Program | Project, *, workspace: Workspace | None = None
+) -> Calendar | None:
+    """Base calendar ``obj`` would schedule against if its own override were cleared.
+
+    Drives the settings "Inherited from {scope}" affordance — it skips ``obj``'s own
+    value and resolves from the parent scope up. A Program's parent is the workspace; a
+    Project's parent is its program (whose own value resolves up to the workspace) or,
+    standalone, the workspace. Under an active lock the inherited value is the (mandatory)
+    workspace calendar.
+    """
+    from trueppm_api.apps.projects.models import Program
+    from trueppm_api.apps.workspace.models import Workspace
+
+    if workspace is None:
+        workspace = Workspace.load()
+
+    if calendar_override_locked(workspace):
+        return workspace.calendar
+
+    if isinstance(obj, Program):
+        return workspace.calendar
+    program = _program_of(obj)
+    program_calendar = program.calendar if program else None
+    return program_calendar or workspace.calendar
+
+
+def resolve_calendar_source(
+    obj: Program | Project, *, workspace: Workspace | None = None
+) -> CalendarSource:
+    """Which scope supplied :func:`resolve_effective_base_calendar` for ``obj``.
+
+    The breadcrumb an integration or the settings UI reads to explain *why* a schedule
+    uses the calendar it does, without re-deriving the precedence (ADR-0441, VoC/Nadia).
+    """
+    from trueppm_api.apps.projects.models import Program
+    from trueppm_api.apps.workspace.models import Workspace
+
+    if workspace is None:
+        workspace = Workspace.load()
+
+    locked = calendar_override_locked(workspace)
+    if not locked and not isinstance(obj, Program) and obj.calendar_id:
+        return "project"
+    if not locked and isinstance(obj, Program) and obj.calendar_id:
+        return "program"
+    if not locked:
+        program = _program_of(obj)
+        if program and program.calendar_id:
+            return "program"
+    if workspace.calendar_id:
+        return "workspace"
+    return "system_default"

trueppm_api/apps/projects/ceremony_views.py

@@ -0,0 +1,244 @@
+"""Views for Program Settings → Cadence & ceremonies (ADR-0079, issue #528).
+
+CeremonyTemplate is a program-scoped CRUD resource; PhaseGateConfig is a
+singleton (1:1) per program, exposed via a thin retrieve/update view that
+lazy-creates the row on first GET.
+
+Both surfaces are gated by program membership: VIEWER+ may read,
+ADMIN+ may write. The 5-role matrix is enforced through the existing
+``IsProgramMember`` and ``IsProgramAdmin`` permission classes — no new
+permission infrastructure is introduced here.
+"""
+
+from __future__ import annotations
+
+from django.db import transaction
+from django.db.models import QuerySet
+from django.shortcuts import get_object_or_404
+from rest_framework import mixins, status, viewsets
+from rest_framework.exceptions import PermissionDenied
+from rest_framework.generics import RetrieveUpdateAPIView
+from rest_framework.permissions import BasePermission, IsAuthenticated
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.serializers import BaseSerializer
+
+from trueppm_api.apps.access.models import Role
+from trueppm_api.apps.access.permissions import (
+    IsProgramAdmin,
+    IsProgramMember,
+    IsProgramNotClosed,
+    IsProjectMember,
+    IsProjectMemberWrite,
+    IsProjectNotArchived,
+    _membership_role,
+)
+from trueppm_api.apps.idempotency.mixins import IdempotencyMixin
+from trueppm_api.apps.projects.models import (
+    COMPOSITION_GUARDRAIL_RULES,
+    CeremonyTemplate,
+    GuardrailLevel,
+    PhaseGateConfig,
+    Program,
+    Project,
+    ProjectGuardrailPolicy,
+)
+from trueppm_api.apps.projects.serializers import (
+    CeremonyTemplateSerializer,
+    PhaseGateConfigSerializer,
+    ProjectGuardrailPolicySerializer,
+)
+
+
+class CeremonyTemplateViewSet(
+    IdempotencyMixin,
+    mixins.ListModelMixin,
+    mixins.CreateModelMixin,
+    mixins.RetrieveModelMixin,
+    mixins.UpdateModelMixin,
+    mixins.DestroyModelMixin,
+    viewsets.GenericViewSet[CeremonyTemplate],
+):
+    """CRUD for program-level ceremony templates.
+
+    URL: ``/api/v1/programs/<program_pk>/ceremonies/[<pk>/]``
+
+    Permission matrix (ADR-0079):
+      list / retrieve         — IsProgramMember (Viewer+)
+      create / update / destroy / enable toggle — IsProgramAdmin (Project Manager+)
+    """
+
+    serializer_class = CeremonyTemplateSerializer
+
+    def get_permissions(self) -> list[BasePermission]:
+        if self.action in ("list", "retrieve"):
+            return [IsAuthenticated(), IsProgramMember(), IsProgramNotClosed()]
+        return [IsAuthenticated(), IsProgramAdmin(), IsProgramNotClosed()]
+
+    def get_queryset(self) -> QuerySet[CeremonyTemplate]:
+        # ``program_pk`` is guaranteed by the URL pattern; cast to str so the
+        # ORM lookup type-checks against the UUID/str union mypy expects.
+        program_pk = str(self.kwargs["program_pk"])
+        return (
+            CeremonyTemplate.objects.filter(
+                program_id=program_pk,
+                is_deleted=False,
+            )
+            .select_related("created_by")
+            .order_by("name")
+        )
+
+    def perform_create(self, serializer: BaseSerializer[CeremonyTemplate]) -> None:
+        program_pk = self.kwargs["program_pk"]
+        program = get_object_or_404(Program, pk=program_pk, is_deleted=False)
+        # DRF skips ``has_object_permission`` on create — enforce the program
+        # admin gate against the resolved program before saving.
+        self.check_object_permissions(self.request, program)
+        serializer.save(program=program, created_by=self.request.user)
+
+    def perform_destroy(self, instance: CeremonyTemplate) -> None:
+        # Soft-delete so the sync protocol can ship a tombstone to clients
+        # rather than the row vanishing silently. The partial unique
+        # constraint on (program, name) excludes deleted rows so a name can
+        # be reused after deletion.
+        instance.soft_delete()
+
+
+class PhaseGateConfigView(IdempotencyMixin, RetrieveUpdateAPIView[PhaseGateConfig]):
+    """Singleton phase-gate calendar config per program.
+
+    URL: ``/api/v1/programs/<program_pk>/phase-gate-config/``
+
+    GET — IsProgramMember (Viewer+). Lazy-creates the row with defaults
+    (``enabled=False``, ``invite_template=""``) on first request so existing
+    programs do not require a data migration.
+
+    PATCH — IsProgramAdmin (Project Manager+).
+    """
+
+    serializer_class = PhaseGateConfigSerializer
+    http_method_names = ["get", "patch", "head", "options"]  # noqa: RUF012
+
+    def get_permissions(self) -> list[BasePermission]:
+        if self.request.method in ("GET", "HEAD", "OPTIONS"):
+            return [IsAuthenticated(), IsProgramMember(), IsProgramNotClosed()]
+        return [IsAuthenticated(), IsProgramAdmin(), IsProgramNotClosed()]
+
+    def get_object(self) -> PhaseGateConfig:
+        program_pk = self.kwargs["program_pk"]
+        program = get_object_or_404(Program, pk=program_pk, is_deleted=False)
+        # Membership / role enforcement uses the program as the target object
+        # for the configured permission classes (they read program_pk from
+        # ``self.kwargs`` via has_permission, then enforce on the object).
+        self.check_object_permissions(self.request, program)
+        config, _ = PhaseGateConfig.objects.get_or_create(program=program)
+        return config
+
+    def get_queryset(self) -> QuerySet[PhaseGateConfig]:
+        # Required by DRF's GenericAPIView contract even though we override
+        # get_object — the OpenAPI generator inspects this for schema output.
+        program_pk = str(self.kwargs["program_pk"])
+        return PhaseGateConfig.objects.filter(program_id=program_pk)
+
+
+class ProjectGuardrailPolicyView(IdempotencyMixin, RetrieveUpdateAPIView[ProjectGuardrailPolicy]):
+    """Singleton sprint/phase/WBS guardrail policy per project (ADR-0101 §3).
+
+    URL: ``/api/v1/projects/<project_pk>/guardrail-policy/``
+
+    GET — IsProjectMember (Viewer+). Lazy-creates the row with default (all-WARN)
+    on first request so existing projects need no data migration.
+
+    PATCH — IsProjectMemberWrite (Team Member+): a Viewer must not be able to
+    weaken an existing guardrail (downgrade a BLOCK to WARN) or toggle
+    ``acknowledged_by_team``. Escalating a *composition* rule to BLOCK
+    additionally requires ``role >= Role.OWNER`` (the sprint-sovereignty rule:
+    only the team's own Owner may turn a sprint-composition guardrail into a
+    wall). Lowering to WARN, and toggling ``acknowledged_by_team``, need only
+    member write — acknowledging an external policy is the team's call.
+    """
+
+    serializer_class = ProjectGuardrailPolicySerializer
+    http_method_names = ["get", "patch", "head", "options"]  # noqa: RUF012
+
+    def get_permissions(self) -> list[BasePermission]:
+        # Safe methods stay Viewer+; unsafe methods (PATCH) require Team Member+
+        # so a Viewer cannot weaken a guardrail. The Owner-only escalation gate
+        # for composition BLOCK is enforced separately in ``perform_update``.
+        if self.request.method in ("GET", "HEAD", "OPTIONS"):
+            return [IsAuthenticated(), IsProjectMember(), IsProjectNotArchived()]
+        return [IsAuthenticated(), IsProjectMemberWrite(), IsProjectNotArchived()]
+
+    def get_object(self) -> ProjectGuardrailPolicy:
+        project_pk = self.kwargs["project_pk"]
+        project = get_object_or_404(Project, pk=project_pk, is_deleted=False)
+        self.check_object_permissions(self.request, project)
+        policy, _ = ProjectGuardrailPolicy.objects.get_or_create(project=project)
+        return policy
+
+    def get_queryset(self) -> QuerySet[ProjectGuardrailPolicy]:
+        project_pk = str(self.kwargs["project_pk"])
+        return ProjectGuardrailPolicy.objects.filter(project_id=project_pk)
+
+    def perform_update(self, serializer: BaseSerializer[ProjectGuardrailPolicy]) -> None:
+        """Apply the level map with the sovereignty gate.
+
+        A request that newly sets any composition rule to BLOCK is rejected with
+        403 unless the caller is Owner+. The gate is checked against the *incoming*
+        levels, merged onto the existing map so a partial PATCH that touches one
+        rule doesn't silently clear the others.
+
+        Broadcasts ``guardrail_policy_updated`` on commit (#3773) so a second Owner
+        or Admin with Project Settings → Guardrails open concurrently sees the
+        change without a reload — the same sovereignty-gated path this view exists
+        for. The payload carries only the policy id, never the levels map: the
+        broadcast rides the project's board group, which every recipient already
+        had to be a project member to join, so there is no wider audience than the
+        GET this event tells them to re-issue — but keeping the payload
+        signal-only avoids relying on that as the only reason it's safe.
+        """
+        instance = self.get_object()
+        validated = serializer.validated_data
+        incoming_levels = validated.get("levels")
+        if incoming_levels is not None:
+            escalates_composition_block = any(
+                rule in COMPOSITION_GUARDRAIL_RULES and level == GuardrailLevel.BLOCK
+                for rule, level in incoming_levels.items()
+            )
+            if escalates_composition_block:
+                role = _membership_role(self.request, self.kwargs["project_pk"])
+                if role is None or role < Role.OWNER:
+                    raise PermissionDenied(
+                        "Only the project Owner can set a sprint-composition guardrail to block."
+                    )
+            # Merge onto the existing map so a partial update is non-destructive.
+            merged = dict(instance.levels)
+            merged.update(incoming_levels)
+            instance.levels = merged
+        if "acknowledged_by_team" in validated:
+            ack = validated["acknowledged_by_team"]
+            instance.acknowledged_by_team = ack
+            if ack and instance.acknowledged_at is None:
+                from django.utils import timezone
+
+                instance.acknowledged_at = timezone.now()
+        instance.save()
+        # Re-bind so the response reflects the persisted state.
+        serializer.instance = instance
+
+        # Snapshot to plain strings before the closure (broadcast-check H-1) —
+        # the view's mutable request/kwargs state must not be captured live.
+        project_id = str(self.kwargs["project_pk"])
+        policy_id = str(instance.id)
+        from trueppm_api.apps.sync.broadcast import broadcast_board_event
+
+        transaction.on_commit(
+            lambda: broadcast_board_event(project_id, "guardrail_policy_updated", {"id": policy_id})
+        )
+
+    def update(self, request: Request, *args: object, **kwargs: object) -> Response:
+        # RetrieveUpdateAPIView.update returns the serialized instance; our
+        # perform_update does the merge + gate. PATCH only (enforced by
+        # http_method_names), so this is always partial.
+        response = super().update(request, *args, **kwargs)
+        return Response(response.data, status=status.HTTP_200_OK)

trueppm_api/apps/projects/commit_moment.py

@@ -0,0 +1,204 @@
+"""The commit moment: draft → active, and baseline v1 (#2963).
+
+Nothing in the product marked *"this is the plan we agreed to."* A steering
+committee could be shown today's plan but never *committed vs. actual*, because
+there was no anchor to subtract from.
+
+Committing is one transaction that does two things, and the design is explicit
+that it is **not a lock**:
+
+1. flips ``lifecycle`` draft → active, so the project joins the aggregates it was
+   excluded from (#2962);
+2. captures **baseline v1 automatically**, freezing the working calendar it was
+   computed against (ADR-0845), superseding any baseline the draft already
+   carried.
+
+Authoring continues afterwards. What changes is that the plan starts having a
+past — a structural edit to committed work carries a reason from here on
+(``amend.py``, #2964), which is live: :func:`amend.is_amendable` keys on
+``lifecycle == ACTIVE`` and ``TaskViewSet.perform_update`` records the reason and
+notifies the people whose work moved.
+
+**Two acts this module does not perform, and did claim to.** This docstring
+previously listed four, adding "commits the sprints in range" and "tells the
+people who have work in it". Neither has ever had a code path here: no sprint is
+read or written, and no notification row is created (contrast ``amend.notify_amend``,
+which does exactly that on the *edit* side using the same ``TaskResource``
+audience). They are removed rather than softened — a module docstring that
+inventories a transaction's effects is read as the contract, and #3129 found the
+permission rationale on ``ProjectCommitView`` had already been written on top of
+the notification half of this fiction. Committing plans to tell the assigned team
+is a real gap and belongs to a notifications issue, not to a docstring.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+from django.db import transaction
+from django.db.models import DateField
+from django.db.models.functions import Coalesce
+
+if TYPE_CHECKING:
+    # Unquoted in the signature below on purpose: `from __future__ import
+    # annotations` makes every annotation lazy, so this stays type-only — and a
+    # QUOTED annotation makes ruff think the import is unused and delete it,
+    # which it did once already.
+    from django.contrib.auth.models import User
+
+from .models import (
+    Baseline,
+    BaselineTask,
+    Project,
+    ProjectLifecycle,
+    Task,
+)
+
+
+class AlreadyCommitted(Exception):
+    """The project is already active.
+
+    Raised rather than silently re-committing: a second commit would capture a
+    *second* v1 and quietly move the anchor every variance number is measured
+    from, which is the one thing a baseline must never do.
+    """
+
+
+@dataclass
+class CommitResult:
+    baseline: Baseline
+    task_count: int
+    #: Everyone with a resource assignment in the plan. Named for what it is —
+    #: the audience a commit *concerns* — not for a delivery that does not
+    #: happen (#3129). See :func:`_assigned_resource_ids`.
+    assigned_resource_ids: list[str]
+
+
+def _calendar_snapshot(project: Project) -> dict[str, object]:
+    """The working-calendar fields that affect date arithmetic (ADR-0845).
+
+    Snapshotted by value, never by reference. Calendars are editable, so storing
+    an id would let a later edit reshape a baseline that is supposed to be the
+    fixed side of every variance subtraction.
+    """
+    calendar = project.calendar
+    if calendar is None:
+        return {}
+    return {
+        "calendar_id_at_capture": calendar.id,
+        "calendar_working_days": calendar.working_days,
+        "calendar_hours_per_day": calendar.hours_per_day,
+    }
+
+
+@transaction.atomic
+def commit_project(project: Project, *, user: User | None) -> CommitResult:
+    """Take the project from draft to active, capturing baseline v1.
+
+    Atomic on purpose. A commit that flipped the lifecycle but failed to capture
+    the baseline would leave a project claiming to be committed with nothing to
+    measure against — worse than not committing at all, because the claim is
+    visible and the gap is not.
+    """
+    # Re-read under the row lock: two clients pressing Commit at once must not
+    # both pass the check and capture two "v1"s.
+    locked = Project.objects.select_for_update().get(pk=project.pk)
+    if locked.lifecycle != ProjectLifecycle.DRAFT:
+        raise AlreadyCommitted(str(locked.pk))
+
+    live_tasks = list(
+        Task.objects.filter(project_id=locked.pk, is_deleted=False)
+        .annotate(_span_start=Coalesce("scheduled_start", "early_start", output_field=DateField()))
+        .values(
+            "id",
+            "name",
+            "early_start",
+            "early_finish",
+            "duration",
+            "actual_start",
+            "actual_finish",
+            "story_points",
+            "_span_start",
+        )
+    )
+    has_cpm_dates = bool(live_tasks) and all(t["early_start"] is not None for t in live_tasks)
+
+    # Stand down any incumbent active baseline before laying down v1 (#3129).
+    #
+    # A draft is fully writable, and `BaselineViewSet` is not lifecycle-gated, so
+    # a project can already carry an active baseline by the time anyone commits
+    # it. `Baseline` has a partial unique constraint on (project) WHERE is_active,
+    # so creating a second active row raised IntegrityError — a 500 on the only
+    # transition that can take a project out of draft at all (#3127 made
+    # `lifecycle` read-only), which is unrecoverable from the client.
+    #
+    # Deactivated, never deleted: the incumbent is somebody's captured snapshot
+    # and baseline history is kept forever. This is the same "deactivate the rest,
+    # then activate mine" sequence `BaselineActivateView` runs, and it is inside
+    # this function's `@transaction.atomic` so the two writes cannot interleave
+    # with a concurrent activate — the row lock taken above is on the project.
+    Baseline.objects.filter(project=locked, is_active=True).update(is_active=False)
+
+    baseline = Baseline.objects.create(
+        project=locked,
+        name="Baseline v1",
+        created_by=user if user is not None and user.is_authenticated else None,
+        is_active=True,
+        has_cpm_dates=has_cpm_dates,
+        **_calendar_snapshot(locked),
+    )
+    BaselineTask.objects.bulk_create(
+        [
+            BaselineTask(
+                baseline=baseline,
+                task_id=t["id"],
+                task_name=t["name"],
+                start=t["_span_start"],
+                finish=t["early_finish"],
+                duration=t["duration"],
+                actual_start=t["actual_start"],
+                actual_finish=t["actual_finish"],
+                story_points=t["story_points"],
+            )
+            for t in live_tasks
+        ]
+    )
+
+    locked.lifecycle = ProjectLifecycle.ACTIVE
+    locked.save(update_fields=["lifecycle", "server_version"])
+
+    return CommitResult(
+        baseline=baseline,
+        task_count=len(live_tasks),
+        assigned_resource_ids=_assigned_resource_ids(locked),
+    )
+
+
+def _assigned_resource_ids(project: Project) -> list[str]:
+    """Everyone with a resource assignment in the plan.
+
+    Deliberately ``TaskResource``, not ``Task.assignee``: capacity, utilization
+    and every sprint-capacity number sums ``TaskResource.units``, and a bare
+    assignee is zero load that may never reach the person at all. Addressing
+    ``assignee`` would name the wrong set of people as having work in the plan.
+
+    This is the audience a commit *concerns*, and the caller may say so — it is
+    not a record of anyone having been told. Nothing here notifies (#3129).
+
+    ``.active()`` (#3572): by its own reasoning above this is a capacity read —
+    it counts who is carrying load in the plan — so a deactivated person, whose
+    assignment rows are retained only for audit, is not in it. That is the line
+    against the notification audiences in ``config_notice`` and ``amend``, which
+    stay unfiltered: those decide who *receives* something, which is an access
+    question and belongs to #3584.
+    """
+    from trueppm_api.apps.resources.models import TaskResource
+
+    return [
+        str(rid)
+        for rid in TaskResource.objects.active()
+        .filter(task__project_id=project.pk, task__is_deleted=False)
+        .values_list("resource_id", flat=True)
+        .distinct()
+    ]