# AGENT-PROMPT-v5-P1-1b — O10 amendment 2: second-reject remediation, minimal-surface discipline, third reviewed implementation

**Date:** 2026-08-06
**Follows:** `docs/AGENT-PROMPT-v5-P1-1b-o10-amendment.md`, `docs/p1-1b-status.md` (the O10
step-4 Reject / stop record at `3f86eb17d74537d5fd3085d953a41b2e2c14024a`),
`docs/p1-1b-o10-independent-review.md`, `docs/PROJECT-STATE.md`
**Authority:** Miguel. This amendment accepts the second independent review's findings on
rejected `57f0f023…` **in full**, converts all seven findings and the four missing-coverage
items into binding remediation requirements, imposes a minimal-surface discipline that the two
rejections have proven necessary, and authorizes **one** fresh reviewed re-implementation of
the O10 amendment's step 3, followed by the Scope 1 restart. **It authorizes zero prototype
writes.** It reopens nothing: O9-P, O9-D1…D5, and O10-D1/D2 remain closed and govern
unchanged; the expected baselines remain 119 / 119 / 52 / 221 / **2,787** plus the two
`Routine` rows importing verbatim. Both rejected commits — `b324a3e…` and `57f0f023…` — stay
neutralized: they are evidence of what failed, never code to resurrect or cherry-pick, and the
five original remediation requirements of the first amendment remain binding alongside the
seven below.

## Minimal-surface discipline — new, binding, and the lesson of both rejections

Both rejected implementations failed partly by doing more than they were asked: re-owning
accepted objects, replacing accepted constraints, inventing defaults. Therefore, binding on
this third implementation:

- The migration is **strictly additive against the accepted P1-1a catalog**. It must not
  alter, drop, re-own, or replace any object the accepted schema created — table, constraint,
  index, function, role, ownership, or ACL — unless a numbered requirement below or in the two
  standing amendments explicitly demands that exact change by name.
- If the implementation appears to *need* to touch an accepted object that no requirement
  names, that is a design contradiction: **stop and report**, do not adapt.
- `Down` removes exactly and only what `Up` added, restoring the accepted catalog byte-exactly.
- No DTO, validator, command, or fixture may invent a value, default, or provenance marker
  that no governing decision authored.

## Binding remediation of the seven second-review findings

Each item needs its own explicit test evidence in the disposable suite; green build and
aggregate green tests are, for the third time, not semantic proof.

| # | Binding requirement | Required proof |
|---:|---|---|
| **R1 — fail-closed role provisioning** | The migration must never adopt a pre-existing role: it grants ownership, DML, or `SECURITY DEFINER` reachability only to roles it creates itself in the same migration. If any expected role name already exists, `Up` fails closed with a clear error. | Disposable test creates a hostile pre-existing role with an expected name and proves `Up` refuses; the normal path proves the roles are created, not reused. |
| **R2 — exactly-inverse `Down`** | `Down` performs no `DROP OWNED`, changes no ownership of any object it did not create (explicitly including `WaiveDOCFLG`), and restores any accepted function it must recreate to the accepted definition byte-exactly. | An Up/Down catalog-equivalence test: a recorded snapshot of the relevant `pg_catalog` state (objects, owners, ACLs, constraint and index names, function definitions) before `Up` equals the state after `Down`; plus the Up/Down/Up cycle. |
| **R3 — assignment/import serialization** | The governed `AssignDOCEFLItemClass`-shaped command and the importer serialize on the parent DOCEFL rule (row lock on `EFCode` or equivalent), so no instance snapshot can remain `NULL` after its rule's assignment without being part of the audited completion count. | Two concurrency tests, one per ordering (assign committed before import row lands; import in flight while assignment runs), each proving no unaudited NULL snapshot survives and the audited count is exact. |
| **R4 — provenance integrity** | `RegistryFieldProvenance` rows are constraint-enforced: FK to their target row, company agreement with the target, and exact cardinality — a governed snapshot member has exactly one provenance row, `absent` provenance exists only where the value is NULL, and orphan or contradictory rows are impossible. | Tests proving missing, orphan, wrong-company, and value/provenance-contradiction rows are each rejected by the schema, not merely by application code. |
| **R5 — no invented validator values** | Validator/DTO surfaces preserve NULL as NULL and require explicit values elsewhere; the invented `false` / `Verified` / `Annotation` defaults are removed. | Round-trip tests proving NULL survives unchanged and an unspecified member is an error, not a silent default. |
| **R6 — accurate audit scope and content** | An assignment affecting instances of several companies audits every affected company (per-company rows or an explicit complete company list) with the exact per-company completion counts; the evidence-append audit records the governed value/hash it appended. | A multi-company assignment test proving the audit enumerates all affected companies and counts; an evidence-append test proving the audited content includes the value/hash. |
| **R7 — accepted uniqueness untouched** | The accepted `ImportEvidenceRow` uniqueness constraints remain exactly as accepted — names, definitions, semantics. Nothing replaces them with partial indexes or any other structure. | A post-`Up` catalog assertion that the accepted constraint names and definitions are unchanged. |

**Required coverage (the review's Low items), also binding:** unknown non-null DOCFLG snapshot
`ItemClass` fails closed on both imported and non-imported rows; the hostile pre-existing role
case (R1); the exact post-Down catalog (R2); both concurrency orderings (R3).

## Ordered execution

1. **Preflight — stop and report if any fails.** Sibyla clean on `feature/p1-1b` at the
   pushed stop-record tip `3f86eb17d74537d5fd3085d953a41b2e2c14024a` or a descendant, in sync
   with its remote. Prototype read-only check (metadata and `git show` only): local `HEAD`,
   local `origin/main`, and live `refs/heads/main` all still equal the immutable pin
   `b91768513fc638381fbde91f0b576b08220a98f6`; 49/49 roster blobs resolve; the direct
   `Editor/Data` surface is exactly the 48 rostered files.

2. **Governed records commit (one commit, push before code).** Record this amendment's
   acceptance of the seven findings, the R1–R7 requirements, and the minimal-surface
   discipline in `docs/p1-1b-status.md`; update `docs/PROJECT-STATE.md` (header, P1-1b phase
   row, changelog — O10 stays closed, O5 stays the only open item); update the current-facing
   evolution page state; track this prompt file if not already tracked. No baseline changes:
   the six named findings and their expected counts are untouched.

3. **Third step-3 implementation, fresh from the stop-record tip.** One additive corrective
   migration (`P11bImportContractAlignment` shape) carrying exactly the content scope the O10
   amendment defined — the three O9 nullability relaxations, the six-literal `ReviewPriority`
   CHECK, the company-scoped terminal-evidence predicate, the O10-D1 snapshot nullability +
   plain `EFCode` FK + prospective CHECK, the O10-D2 governed completion semantics under the
   server-side `session_user` principal, and the validator scoping with the six named findings
   and the identity-class vocabulary gate — now satisfying the first amendment's five
   requirements **and** R1–R7 under the minimal-surface discipline. The accepted P1-1a
   migration stays untouched; the accepted fixture moves from historical `EF0000046` to
   `EF0000053` before seeding. TDD first; build 0 warnings; ordinary, focused, and disposable
   suites green including every proof named above; 0 residual containers; commit and push.
   Before submitting for review, the status record must map test evidence item-by-item to the
   five standing requirements, R1–R7, and the four coverage items — an unmapped item is an
   unfinished item.

4. **Independent review gate — mandatory, before any restart.** A fresh independent
   adversarial review round with an explicit Accept/Reject verdict recorded in the repository.
   On Reject: neutralize fail-closed at the branch tip exactly as before, record the findings,
   stop and report — a third Reject additionally stops all further re-implementation until
   Miguel reviews the pattern itself. On Accept: record the verdict and proceed.

5. **Restart Scope 1 at its preflight** against the unchanged pin `b917685…` and run the
   ordered Scopes 1–6 of the standing prompt as amended by O8, O9, O10, and this amendment —
   disposable rehearsal first, live pass only after green plus a verified fresh backup.
   Expected baselines 119 / 119 / 52 / 221 / **2,787**, plus the two `Routine` rows verbatim;
   measured deltas are recorded findings, not stops. Identity-class conflicts still stop the
   scope.

6. **Scopes 7–8** stay behind their own review gates, exactly as before.

## What this amendment does not authorize

Any prototype write. Resurrecting or cherry-picking `b324a3e…` or `57f0f023…`. Authoring any
of the 52 `ItemClass` values. Overwriting any non-null snapshot, ever. Altering, dropping, or
re-owning any accepted object beyond what a numbered requirement names. Editing the accepted
P1-1a migration or any P1-0 draft beyond the governed records in step 2. Weakening any
identity-class control. Any shared/live database write before the complete disposable
rehearsal passes and a verified fresh backup exists. Production go-live (O5 remains open, and
remains the only open item). P1-2+ work under this prompt — the separate O5-prep assignment
runs under its own authority on its own disjoint branch and file surface. History rewrite in
either repository. If the source, the roster, the counts, or the accepted schema differ in any
way this amendment does not govern: stop and report, never adapt.

## Report at the end

Commit hashes per stage including the review verdict record; the evidence map from step 3
(five standing requirements + R1–R7 + four coverage items, each to its test); the data-quality
register with expected vs measured counts; per-table import controls (*Initial + Expected =
Result*) once Scope 1 runs; validator results; parity outcome or deferral; join-test numbers;
and the exact list of what still separates the project from P1-1 acceptance.