# AGENT-PROMPT-v5-P1-1b — O9 amendment: govern the import contract, import honestly, track residuals as data quality

**Date:** 2026-08-06
**Follows:** `docs/AGENT-PROMPT-v5-P1-1b.md` (the standing prompt),
`docs/AGENT-PROMPT-v5-P1-1b-o8-amendment.md`, `docs/p1-1b-status.md` (the O9 stop record),
`docs/PROJECT-STATE.md`
**Authority:** Miguel. This amendment records the five Miguel-owned decisions that close **O9**,
plus one standing policy, and authorizes the one additive corrective migration they require,
followed by the Scope 1 restart. **It authorizes zero prototype writes.** The P1-1b prompt's
prototype-write prohibition, fail-closed identity rules, and every stop-and-report rule not
explicitly re-scoped here remain fully in force.

## Standing policy — O9-P: historical conformance gaps are data quality, not blockers

The five O9 contradictions share one shape: the pinned historical source honestly lacks a value
that the accepted target schema demands. From this amendment forward, that shape is **never again
a Scope 1 stop**. The two classes are now explicit:

- **Identity class — still fails closed, no change.** Permanent-code conflicts or reassignment,
  unknown vocabulary literals (a value present in source but absent from the governed closed
  vocabulary), natural-key collisions without a decided tiebreaker, roster blob drift, an
  unrostered source surface, or a source row that cannot import without inventing a permanent
  code. These are corruption risks; the answer remains stop and report.
- **Completeness class — imports honestly and is measured.** A source field that is absent,
  blank, or ungoverned on an imported historical row imports as honest SQL `NULL` with
  provenance `absent` (never empty string, never a sentinel, never a backfill), and the gap is
  counted as a **named data-quality finding** in the validator's warning output and in the
  status record. Remediation is incremental, over time, through governed audited commands —
  exactly the D7/O7 grandfathering logic, generalized.

If, during import, a *new* completeness-class gap appears that this amendment did not enumerate
and the accepted schema (as corrected below) rejects it, that specific finding is reported with
its count and the affected rows are **excluded from the import with an explicit per-table
exclusion record** — the import of everything else proceeds. Only identity-class findings stop
the scope.

## The decisions (O9-D1 … O9-D5)

**O9-D1 — ENTMST `DirectDebit`: the provenance register was wrong; the column becomes nullable.**
The register in `docs/p1-0-schema-mapping.md` declares `DirectDebit` a source column, but no such
property exists on any of the 119 rows at pin `b917685…`. That is a register defect of the
P1-0c category-error class, not a source defect. Correct the register: `DirectDebit` is
**target-only, nullable, no default**. The corrective migration drops the NOT NULL constraint.
All imported rows carry `NULL`/`absent`. A later governed value, when set through an audited
command, carries `authored` provenance. Data-quality finding: `ENTMST.DirectDebit absent`
(expected initial count 119).

**O9-D2 — ENTMST `TaxIdVerificationStatus`: mirror O7.** The column becomes **nullable** via the
corrective migration. Imported historical rows carry honest `NULL`/`absent`. Every **new
Sibyla-era entity row** must supply a governed value at creation time (deterministic gate,
enforced when the entity-maintenance path lands). The validator warning is scoped to
non-imported rows only; the imported-row NULL count is reported as the data-quality finding
`ENTMST.TaxIdVerificationStatus unverified` (expected initial count 119), to be worked down over
time through the governed verification flow. No `Unverified` sentinel is invented — absence is
recorded as absence.

**O9-D3 — DOCEFL `ItemClass`: nullable now, governed assignment over time.** The column becomes
**nullable** via the corrective migration. All 52 imported source rows carry `NULL`/`absent`;
the authored sentinel `EF0000000` and Monthly-gap `EF0000053` keep their recorded
`authored`/`absent` markers unchanged. Assignment happens only through a new governed command
(`AssignDOCEFLItemClass`-shaped: atomic, audited, actor-stamped, value restricted to the closed
D8 ItemClass vocabulary, provenance `authored`), implemented with its own tests in this phase but
exercised over time, not as an import precondition. Data-quality finding:
`DOCEFL.ItemClass unassigned` (expected initial count 52; the two authored rows count only if
their recorded state is `absent`).

**O9-D4 — `ReviewPriority`: the annex table is normative; the CHECK is completed to six.** By
the recorded precedence rules, `docs/p1-0-vocabularies.md` is normative for every literal, and
its table contains six exact literals — `Before Posting`, `High`, `Immediate`, `Informational`,
`Periodic Review`, `Routine`. The accepted five-literal CHECK was derived from the annex's
formerly defective prose and is the defective artifact. The corrective migration **replaces the
CHECK with the six-literal set, exact strings, no translation**. The two pinned rows using
`Routine` then import verbatim. This is a completion of the CHECK to the already-normative
vocabulary, not a vocabulary change; record the reconciliation in the annex history.

**O9-D5 — terminal DOCFLG `ResolutionEvidence`: the CHECK is re-scoped to non-imported rows.**
221 terminal rows honestly lack evidence; requiring it retroactively would force invention
(copying notes into evidence is explicitly forbidden). The corrective migration re-scopes the
terminal-state non-blank CHECK so it binds only rows that are not imported historical rows
(`Imported = true` rows are exempt; use the existing import marker, not a new flag). Imported
terminal rows carry `NULL`/`absent` — never empty string. Every Sibyla-era terminal transition
still requires non-blank evidence, unchanged. A governed, audited evidence-append command may
enrich historical rows over time without rewriting their history. Data-quality finding:
`DOCFLG terminal without ResolutionEvidence` (expected initial count 221).

## The corrective migration

One new migration (name shaped `20260806…_P11bImportContractAlignment`), in its own commit, TDD
first, containing exactly: the three NOT NULL relaxations (O9-D1/D2/D3), the six-literal
`ReviewPriority` CHECK replacement (O9-D4), the terminal-evidence CHECK re-scope (O9-D5), and
the governed assignment/append command surfaces with their authority checks following the
accepted server-side `RuntimePrincipal` pattern. The accepted P1-1a migration
`20260805180000_P11aFdrSchema` is **immutable and untouched**; `Down` reverses only what this
migration adds or changes. This migration does **not** require a separate pre-application
independent review round — it is covered by TDD, the full disposable suite, and the end-of-phase
review; the hash-swap review requirement (standing prompt, item 7) is unchanged and applies only
to the hash swap. Validator scoping changes (O7-style imported-row exemptions and the named
data-quality findings above) are additive P1-1b work with their own tests.

## Ordered execution

1. **Preflight — stop and report if any fails.** Sibyla clean on `feature/p1-1b` at the pushed
   records tip or a descendant, in sync with its remote. Prototype read-only check (metadata and
   `git show` only): after `git fetch --prune origin`, local `HEAD`, local `origin/main`, and
   live `refs/heads/main` all still equal the immutable pin
   `b91768513fc638381fbde91f0b576b08220a98f6`; all **49 of 49** rostered paths resolve to their
   recorded blobs; the direct `Editor/Data` surface is exactly the 48 rostered JSON files. Any
   drift → stop; the premise of this amendment is the O9 stop record's exact measurements.

2. **Governed records commit (one commit, push before code).** Record O9-P and O9-D1…D5 in
   `docs/p1-1b-status.md`; correct the `DirectDebit` register entry in
   `docs/p1-0-schema-mapping.md` (target-only, nullable, with a note citing this amendment — the
   frozen historical claim is not silently erased, it is corrected with provenance); record the
   annex/CHECK reconciliation for `ReviewPriority`; close **O9** in `docs/PROJECT-STATE.md`
   (open-items table — leaving only O5 — phase table, changelog); update `docs/project-todo.md`
   with the four named data-quality findings as tracked improvement items, not blockers; include
   this prompt file in the commit.

3. **Corrective migration + validator scoping, TDD.** Build 0 warnings; ordinary suite green;
   focused registry tests green; disposable `P11aDatabase` suite green through the mandatory
   runner; 0 residual containers. Also complete, before seeding, the already-instructed update of
   the accepted P1-1a fixture/test record from historical `EF0000046` to O8-authorized
   `EF0000053`.

4. **Restart Scope 1 at its preflight** against the unchanged pin `b917685…` and run the ordered
   Scopes 1–6 of the standing prompt exactly as written, as amended by O8 (manifests) and this
   amendment (contract): disposable rehearsal first; per-table *Initial + Expected = Result*
   controls; honest NULLs; the identity class fails closed; the completeness class imports and is
   measured. The five O9 counts (119 / 119 / 52 / 2-now-importing / 221) are **expected
   baselines**: if a measured data-quality count differs, record the measured value and flag the
   delta — that is a finding to report, not a stop.

5. **Scopes 7–8** stay behind their own review gates, exactly as before. The live pass still
   requires the complete green disposable rehearsal and the verified fresh backup first.

## What this amendment does not authorize

Any prototype write, edit, or cleanup. Inventing, backfilling, translating, or defaulting any
value on any imported row — absence stays absent. Editing the accepted P1-1a migration or any
P1-0 draft beyond the governed register/annex corrections in step 2. Weakening any
identity-class control: permanent codes, closed vocabularies, natural keys, roster and pin
verification all keep their exact fail-closed semantics. Any shared/live database write before
the complete disposable rehearsal passes and a verified fresh backup exists. Production go-live
(O5 remains open). History rewrite in either repository. If the source, the roster, or the
counts differ from the O9 stop record in any way this amendment does not govern, the answer is
stop and report, never adapt.

## Report at the end

Everything the standing prompt requires, plus: the data-quality register — the four named
findings with expected vs measured counts and any per-table exclusion records under O9-P — the
corrective-migration commit hash and its test evidence, and the exact list of what still
separates the project from P1-1 acceptance.