# AGENT-PROMPT-v5-P1-1b — Piece B go-ahead: provenance integrity as a database-enforced invariant **Date:** 2026-08-06 **Follows:** `docs/AGENT-PROMPT-v5-P1-1b-o10-amendment-3.md` (Piece B content, pre-authorized), `docs/AGENT-PROMPT-v5-P1-1b-o10-amendment-5.md` (checklist discipline, proof-pattern annex, test-plan gate, remediation basis), `docs/p1-1b-o10-independent-review.md` (Piece A attempt #2 **Accept**), `docs/p1-1b-status.md`, `docs/PROJECT-STATE.md` **Authority:** Miguel. Piece A has a recorded Accept, so per amendment 3 this document is Piece B's own go-ahead — its content was pre-authorized by amendment 3; this starts it. It reopens no decision. The five baselines remain 119 / 119 / 52 / 221 / **2,787**; the two `Routine` rows still import verbatim; the pin remains `b91768513fc638381fbde91f0b576b08220a98f6`. Monolithic rejects `b324a3e…`, `57f0f023…`, `7ea6c0f…` remain neutralized evidence only, never resurrected. **O5-prep note:** the parallel O5-prep green-light is **deferred by Miguel's decision** — the implementer works solely on Piece B; O5-prep starts in a later window under its own prompt. ## Scope, restated from amendment 3 `RegistryFieldProvenance` alone — its constraints, triggers, and every governed write path that touches it. **Additive base:** the accepted P1-1a catalog **plus accepted Piece A** (`f6f297b…`). No roles, no `SECURITY DEFINER` functions, no governed commands — those are Piece C. No importer, no Scope 1, no prototype access beyond the amendment-4 preflight. **On `WaiveDOCFLG`:** checklist item 8 must hold on every path of the accepted terminal command, but the intent is closure **by construction at the schema level** (constraints and triggers on Piece B's own objects), leaving the accepted `WaiveDOCFLG` definition untouched. If the test-plan analysis concludes item 8 cannot be closed without altering the accepted function, that is a **stop-and-report at the test-plan gate**: report the exact change needed and wait for Miguel's named authorization — do not adapt silently. ## The Piece B consolidated checklist — exhaustive, per amendment 5 The implementer's evidence map and the reviewer's disposition key to this list and to nothing else. A standing requirement found missing from it is a stop-and-report, never silently satisfied or skipped. **Preflight and surface** 1. Amendment-4 reformulated preflight checks 1–5 pass fresh and read-only; check 6 records the live tip and post-pin commits by hash and subject only; no post-pin content read or adopted. 2. Exact base-to-candidate surface: only `RegistryFieldProvenance` constraints/triggers, their EF model/snapshot surface, tests, and the two records files. No Piece C/D role, ACL, function, command, importer, or live-action path. Accepted P1-1a **and Piece A** migration files byte-identical (blob-ID assertion). 3. Minimal-surface discipline: strictly additive against the additive base; no accepted object altered, dropped, re-owned, or replaced unless an item below names that exact change; an apparent need is a stop-and-report. **R4 closed by construction — the core of the piece** 4. Every provenance row has a **FK to its target row**; orphan provenance is impossible at the schema. 5. **Company agreement** between every provenance row and its target is schema-enforced; wrong-company provenance is impossible. 6. **Exact cardinality**: a governed snapshot member has exactly one provenance row — enforced on every path: `INSERT`, `UPDATE`, **`DELETE` (no early trigger return without a cardinality recheck)**, and **moving a provenance row to a new target (the old target is rechecked too)**. DOCEFL insertion gets its **own exact-one cardinality trigger**. 7. **`absent` agrees with the value**: `absent` provenance exists only where the governed value is genuinely SQL `NULL`; a value/provenance contradiction (non-null value with `absent` marker, or `absent` with a non-null hash, per the governed shape) is impossible at the schema. On target updates the trigger re-checks the provenance rows' `absent` state and hash against the new governed values — not merely that two rows exist. 8. **The accepted terminal command and the invariant agree on every path**: `WaiveDOCFLG` cannot populate `ResolutionEvidence` while stale `absent` provenance with a NULL hash survives — closed by construction per the scope note above. **Standing guarantees carried into this piece** 9. **R7 direct assertion (pattern 4):** the accepted `ImportEvidenceRow` uniqueness constraints are untouched — proven by the A-R4-shaped direct test: capture all four accepted UNIQUE definitions by exact `pg_get_constraintdef` text plus every `pg_indexes` definition, run Piece B's `Up`, assert identity. (Re-verified again in Piece D.) 10. **Generated columns exactly as generated, store type included (pattern 3):** every column Piece B adds — the generated `DOCEFLCode` / `DOCFLGFlagInstanceID` targets if used, and any other — gets the full A-R2 three-test shape: contract `GetColumnType()` assertions, snapshot-versus-runtime-model comparison, and the disposable EF-versus- `information_schema.columns` comparison (store type and generated flag both) for every column the piece adds or alters. No invented defaults anywhere (amendment-2 discipline). 11. **Closed vocabularies close twice (pattern 5), where they exist on this surface:** if Piece B's objects carry a closed marker vocabulary (e.g. the governed provenance marker set `extracted | authored | absent`), it is enforced by a database CHECK **and**, where the validator observes those rows, by a fail-closed validator gate with unknown-value tests. If the validator does not observe provenance rows, the record states that explicitly and the closure is at the database alone — claims equal assertions (pattern 1). 12. **Exact `Down`:** removes exactly and only what Piece B's `Up` added, restoring the additive base byte-exactly; no `DROP OWNED`; no ownership change of any object the piece did not create. Up/Down/Up catalog stability asserted over the widened `PieceACatalogSnapshot`-style surface (columns with store types, indexes, constraints, triggers) for every table Piece B touches. **Required schema-level rejection proofs (amendment 3, verbatim — schema, not application code)** 13. A **missing** provenance row is rejected. 14. An **orphan** provenance row is rejected. 15. A **wrong-company** provenance row is rejected (this is also the piece's pattern-2 cross-company negative; include a positive same-company control). 16. A **value/provenance-contradiction** row is rejected. 17. A **delete that would break cardinality** is rejected. 18. A **move that leaves the old target inconsistent** is rejected. 19. **`WaiveDOCFLG` cannot leave stale `absent` provenance with a NULL hash** — proven on the accepted command's real path in the disposable database, not by inspection. **Proof honesty** 20. **Claims equal assertions (pattern 1):** the status record claims exactly what the tests assert — no projected counts, no overstated catalog surface, measured figures only. The two honest-scope statements that served Piece A well (explicit "not asserted here" notes) are the model. ## Ordered execution 1. **Governed records commit (push before code).** Record this go-ahead's acceptance in `docs/p1-1b-status.md` and update `docs/PROJECT-STATE.md` **in the same commit** (the amendment-5 rule); track this file. 2. **Test-plan gate.** Record the checklist→test mapping — every numbered item above to its exact test method(s) or verification command, labelled New / Strengthened / Existing regression and by surface — and stop for Miguel's explicit approval. Report ambiguities as observations with a proposed resolution, exactly as Piece A's mapping did; do not resolve them silently. The `WaiveDOCFLG` closure analysis (scope note above) is resolved at this gate. 3. **Implement, TDD first**, from the pushed tip after approval: disposable suite green including every rejection proof above; ordinary and focused suites green; build 0 warnings; 0 residual containers; status evidence map keyed to the checklist item by item; commit and push. 4. **Full independent adversarial review** (first attempt of this piece — full depth, fresh session), explicit Accept/Reject verdict recorded. On Accept: stop and report — Piece C needs its own go-ahead. On Reject with 0 Critical and an enumerated disposition table, the amendment-5 remediation basis applies: findings become binding B-R items, a remediation test-plan goes through the gate, and one remediation attempt follows. A second Reject stops and escalates to Miguel per amendment 3. ## What this go-ahead does not authorize Piece C, Piece D, or Scope 1. Roles, `SECURITY DEFINER` functions, or governed commands (Piece C's surface). Altering the accepted `WaiveDOCFLG` definition without the named authorization path above. Any prototype write or post-pin read. Reopening any closed decision or changing any baseline. Resurrecting any part of the three named monolithic rejects. Any shared/live database write. Production go-live (O5 remains the only other open item; its prep is deferred, not cancelled). History rewrite in either repository. ## Report Commit hashes per stage; the evidence map item by item against the checklist; the review verdict in full; build/test/container evidence; confirmation that `PROJECT-STATE.md`, `p1-1b-status.md`, and the review record are mutually consistent; and the statement of what remains: Piece C go-ahead, Piece D integration gate, then the Scope 1 restart with its re-pin checkpoint.