# AGENT-PROMPT-v5-P1-1b — Piece C go-ahead: governed commands — roles, company-scoped authorization, concurrency **Date:** 2026-08-06 **Follows:** `docs/AGENT-PROMPT-v5-P1-1b-o10-amendment-3.md` (Piece C content, pre-authorized), `docs/AGENT-PROMPT-v5-P1-1b-o10-amendment-5.md` (checklist discipline, proof-pattern annex, test-plan gate, remediation basis), `docs/AGENT-PROMPT-v5-P1-1b-piece-b-remediation-approval.md`, `docs/p1-1b-o10-independent-review.md` (Piece B B-R1 remediation **Accept**, `256da9c…`), `docs/p1-1b-status.md`, `docs/PROJECT-STATE.md` **Authority:** Miguel. Piece B has a recorded Accept (its remediation `7059809…`, reviewed and accepted at `256da9c…`), so per amendment 3 this document is Piece C's own go-ahead — its content was pre-authorized by amendment 3; this starts it. It reopens no decision. The five baselines remain 119 / 119 / 52 / 221 / **2,787**; the two `Routine` rows still import verbatim; the pin remains `b91768513fc638381fbde91f0b576b08220a98f6`. Monolithic rejects `b324a3e…`, `57f0f023…`, `7ea6c0f…` and piece candidates `6f86023d…` (Piece A Reject #1) and `b8fa033…` (Piece B Reject #1) remain neutralized evidence only, never resurrected — the accepted implementations are Piece A `f6f297b…` and Piece B `7059809…` alone. **O5-prep note:** the parallel O5-prep green-light remains **deferred by Miguel's decision** — the implementer works solely on Piece C; O5-prep starts in a later window under its own prompt. ## Scope, restated from amendment 3 `AssignDOCEFLItemClass` (O10-D2's atomic snapshot-completion command) and the evidence-append command, plus whatever roles and `SECURITY DEFINER` surface they need — and nothing else. **Additive base:** the accepted P1-1a catalog **plus accepted Piece A (`f6f297b…`) plus accepted Piece B (`7059809…`)**. No importer, no Scope 1, no prototype access beyond the amendment-4 preflight. This piece must not touch `WaiveDOCFLG` at all (amendment 3's R2 names it explicitly), nor any Piece A/B object: the commands *use* Piece B's provenance invariant, they do not modify it. **On the Piece B co-update contract:** B-R1's accepted resolution means the value/provenance co-update is validated by `DEFERRABLE INITIALLY DEFERRED` constraint triggers at `COMMIT`, and **both natural statement orderings succeed** (approval on record: R-1 option (b)). Piece C's commands therefore perform the plain two-statement co-update inside one transaction and rely on the deferred validation — they must **not** use, reintroduce, or depend on the rejected candidate's delete-update-insert sequence, and must not `SET CONSTRAINTS ... IMMEDIATE` to change the accepted timing. ## The Piece C consolidated checklist — exhaustive, per amendment 5 The implementer's evidence map and the reviewer's disposition key to this list and to nothing else. A standing requirement found missing from it is a stop-and-report, never silently satisfied or skipped. **Preflight and surface** 1. Amendment-4 reformulated preflight checks 1–5 pass fresh and read-only (fresh cell-by-cell 49/49 roster measurement, per the review-correction precedent); check 6 records the live tip and post-pin commits by hash and subject only; no post-pin content read or adopted. 2. Exact base-to-candidate surface: only the two governed commands, the roles/ACL/ `SECURITY DEFINER` surface they need, their EF/model/test surface, and the two records files. No importer, Piece D, or live-action path. Accepted P1-1a, Piece A, **and Piece B** migration files byte-identical (blob-ID assertion); `WaiveDOCFLG`, `RejectTerminalDOCFLGMutationFn`, and every Piece B trigger function byte-identical via `pg_get_functiondef` before/after. 3. Minimal-surface discipline: strictly additive against the additive base; no accepted object altered, dropped, re-owned, or replaced unless an item below names that exact change; an apparent need is a stop-and-report. **O10-D2 command semantics — the core of the piece** 4. `AssignDOCEFLItemClass` assigns a governed `DOCEFL.ItemClass` from the **closed D8 vocabulary** (`Annotation`, `Decision`, `Status`) only, failing closed on any other literal — closed twice (pattern 5): at the command boundary and by the accepted schema/validator gates, with an unknown-literal rejection test at the command level. 5. Assignment **atomically completes NULL snapshots only**: every affected DOCFLG row whose snapshot `ItemClass` is SQL `NULL` is completed to the assigned value in the same transaction (`NULL`→value); a non-null snapshot is **never modified** — proven by a test where a pre-existing non-null snapshot survives an assignment unchanged. 6. Provenance moves with the value through Piece B's accepted invariant: the target update and its provenance update (`absent`→`authored`, hash per the governed shape) are a plain co-update in one transaction, validated at `COMMIT` by the accepted deferred triggers — with a test asserting the command's transaction contains no `DELETE`/re-`INSERT` of provenance rows and no `SET CONSTRAINTS` timing change. 7. The audit row states the rule, assigned value, actor, and the **exact completion count**; the `DOCFLG snapshot ItemClass absent` finding (baseline 2,787) and the `DOCEFL.ItemClass unassigned` finding (baseline 52) each reduce by exactly the audited counts, proven by before/after validator measurement in the same disposable run. 8. The evidence-append command appends `ResolutionEvidence` to imported terminal DOCFLG rows under O9-D5's governed-append semantics — append-only, never overwriting a non-absent value — and its audit records the governed value/hash it appended. **Authorization, roles, and concurrency (R1 · R6 · R3 · round-1 principal boundary)** 9. **Server-side principal only:** authorization derives from the server-side trusted principal keyed by `session_user` / the application principal chain, exactly as the accepted P1-1a commands do; caller-set `sibyla.actor`/`sibyla.authorities` GUCs grant nothing — proven by a forged-GUC denial test and a non-owner-role execution test for **each** new command. 10. **R1, fail-closed role provisioning:** the migration never adopts a pre-existing role; it grants ownership, DML, or `SECURITY DEFINER` reachability only to roles it creates itself in this piece's migration. A disposable test creates a hostile pre-existing role with an expected name and proves `Up` fails closed with a clear error; a normal-path test proves the roles are created fresh. 11. **R6, accurate and complete company scope:** `AssignDOCEFLItemClass` touches a global rule's DOCFLG rows across potentially many companies; the command proves authority for **every** company it writes — failing closed for unauthorized companies or requiring explicit elevated multi-company authority — and audits **every** affected company, including inactive ones, with exact per-company completion counts. Proof: a multi-company test with a principal authorized for only a subset of affected companies, and a test where an inactive affected company still receives its audit row. The cross-company negative includes a positive same-company control (pattern 2). 12. **R3, genuine concurrency, both orderings:** the assignment command and the importer serialize on the parent DOCEFL rule (row lock on `EFCode` or equivalent). Two genuinely concurrent tests (not sequential-with-mocked-timing): assignment committed before an in-flight import lands, and import in flight while an assignment runs — each proving no unaudited NULL snapshot survives and the audited count is exact. **Standing guarantees carried into this piece** 13. **R7 direct assertion (pattern 4):** the accepted `ImportEvidenceRow` uniqueness constraints are untouched — the A-R4-shaped direct test (all four accepted UNIQUE definitions by exact `pg_get_constraintdef` text plus every `pg_indexes` definition) re-run over this piece's `Up`. (Re-verified again in Piece D.) 14. Every column or generated column this piece adds (if any) gets the full A-R2 three-test shape — contract `GetColumnType()`, snapshot-versus-runtime-model, and disposable EF-versus-`information_schema.columns` (store type and generated flag) — and no invented defaults anywhere (amendment-2 discipline). If the piece adds no columns, the record states that explicitly (pattern 1). 15. **R2, scoped `Down`:** `Down` performs no `DROP OWNED`, drops exactly and only the roles, functions, grants, and objects this piece's `Up` created, changes no ownership of any object it did not create, and restores the additive base byte-exactly. Up/Down/Up catalog stability asserted over the widened catalog-snapshot surface (columns with store types, indexes, constraints, triggers, functions, roles, ACLs) for every surface this piece touches. 16. Closed vocabularies close twice wherever they exist on this surface (pattern 5); where a validator does not observe a surface, the record states it explicitly. **Required rejection proofs (schema/command level, not application code)** 17. An assignment naming an unknown or non-D8 `ItemClass` literal is rejected (item 4's test). 18. An assignment attempting to modify a non-null snapshot is rejected or provably a no-op for that row, with the audit count excluding it (item 5's test). 19. An unauthorized-company write and a forged-GUC invocation are each rejected fail-closed (items 9/11's tests). **Proof honesty** 20. **Claims equal assertions (pattern 1):** the status record claims exactly what the tests assert — no projected counts, no overstated catalog surface, measured figures only; the exact role/function/grant roster is fixed when `Up` is authored during TDD and reported item by item in the evidence map, per the shape convention already approved for Pieces A/B. ## Ordered execution 1. **Governed records commit (push before code).** Record this go-ahead's acceptance in `docs/p1-1b-status.md` and update `docs/PROJECT-STATE.md` **in the same commit** (the amendment-5 rule); track this file. 2. **Test-plan gate.** Record the checklist→test mapping — every numbered item above to its exact test method(s) or verification command, labelled New / Strengthened / Existing regression and by surface — and stop for Miguel's explicit approval. Report ambiguities as observations with a proposed resolution, exactly as Pieces A and B did; do not resolve them silently. Expected observation surface includes at least: the exact elevated multi-company authority shape for R6 (new authority literal versus per-company set), and the evidence- append command's precise name and argument shape — commit to shape now, exact DDL at TDD. 3. **Implement, TDD first**, from the pushed tip after approval: disposable suite green including every proof above; ordinary and focused suites green; build 0 warnings; 0 residual containers; status evidence map keyed to the checklist item by item; commit and push. 4. **Full independent adversarial review** (first attempt of this piece — full depth, fresh session), explicit Accept/Reject verdict recorded. On Accept: stop and report — Piece D's integration gate needs its own go-ahead. On Reject with 0 Critical and an enumerated disposition table, the amendment-5 remediation basis applies: findings become binding C-R items, a remediation test-plan goes through the gate, and one remediation attempt follows. A second Reject stops and escalates to Miguel per amendment 3. ## What this go-ahead does not authorize Piece D or Scope 1. Any importer or import execution. Touching `WaiveDOCFLG`, any Piece A/B object, or any accepted P1-1a object. Using or testing through the rejected delete-update-insert sequence, or changing the accepted deferred-trigger timing. Any prototype write or post-pin read. Reopening any closed decision or changing any baseline. Resurrecting any part of the three monolithic rejects or the two rejected piece candidates. Any shared/live database write. Production go-live (O5 remains the only other open item; its prep is deferred, not cancelled). History rewrite in either repository. ## Report Commit hashes per stage; the evidence map item by item against the checklist; the review verdict in full; build/test/container evidence; confirmation that `PROJECT-STATE.md`, `p1-1b-status.md`, and the review record are mutually consistent; and the statement of what remains: Piece D's integration gate, then the Scope 1 restart with its confirm-pin-or-re-pin checkpoint.