# GOTT.Sibyla — current state

## 2026-08-08 merge adoption and publication — current record

The further P1-1b merge is complete and published. This section supersedes the frozen `80646b9`
authoring-state text as current state without altering that historical record.

**Miguel's decision, verbatim:**

> Adoto o merge local fc205fa. Não é criado outro merge, nem se usa reset, amend, rebase,
> revert, cherry-pick ou force push. Publica-se só se todas as verificações e a build
> passarem. O desvio da sessão anterior é registado como achado de governação, sem editar o
> texto congelado de 80646b9.

**Final topology:**

- Starting `main` SHA and first parent:
  `f1488acf4dfd6fb45fd836afcde5464e5c9d9ddf`.
- Accepted feature tip and second parent:
  `80646b9acbe36d8c351998076d6269a38e467b71`.
- Adopted local merge: `fc205facf8c2e9728a9404832cead1a16f0e593d`, with parents
  `f1488acf4dfd6fb45fd836afcde5464e5c9d9ddf` and
  `80646b9acbe36d8c351998076d6269a38e467b71`. It was adopted, not created by this line of
  sessions.
- GitLab server-side merge on `origin/main`:
  `c277b16abffac3ba18833e811a67641e81fdf58a`, subject
  `Merge branch 'merge/p1-1b-fc205fa' into 'main'`, with parents
  `f1488acf4dfd6fb45fd836afcde5464e5c9d9ddf` and
  `fc205facf8c2e9728a9404832cead1a16f0e593d`.
- `fc205facf8c2e9728a9404832cead1a16f0e593d` was published to `main` through
  `c277b16abffac3ba18833e811a67641e81fdf58a`.

**Corrected preflight — Pass.** Repository root was exactly
`D:/fileStorage/repos/GOTT.Sibyla`; exactly one worktree was registered; the working tree was clean
and staging was empty. Local `feature/p1-1b`, its origin-tracking ref, and live `ls-remote` were all
`80646b9acbe36d8c351998076d6269a38e467b71`, with divergence 0/0. Local `main` at
`fc205facf8c2e9728a9404832cead1a16f0e593d` was ancestral to `origin/main` at
`c277b16abffac3ba18833e811a67641e81fdf58a`, zero commits ahead and one behind; `git pull
--ff-only` fast-forwarded it to `c277b16abffac3ba18833e811a67641e81fdf58a`. After synchronization,
local `main`, `origin/main`, and live `ls-remote` were equal to
`c277b16abffac3ba18833e811a67641e81fdf58a`, with divergence 0/0.

**Publication checks:**

1. **Pass — exact parents.** The parent lists above were confirmed for both
   `c277b16abffac3ba18833e811a67641e81fdf58a` and
   `fc205facf8c2e9728a9404832cead1a16f0e593d`.
2. **Pass — adopted merge versus published result.** `git diff c277b16 fc205fa` was empty
   (**0 bytes**); `f1488acf4dfd6fb45fd836afcde5464e5c9d9ddf` is an ancestor of
   `fc205facf8c2e9728a9404832cead1a16f0e593d`; the MR introduced no content.
3. **Pass — accepted feature versus published result.** `git diff c277b16 80646b9` was empty
   (**0 bytes**).
4. **Pass — accepted paths and test object on `origin/main`.** In migration-then-SQL order:

   | Published path | Git blob ID |
   |---|---|
   | `src/Sibyla.Infrastructure/Persistence/Migrations/20260805180000_P11aFdrSchema.cs` | `497ce4ecbe63aa2c5fd7dd6eb2bcac01c6b48d0e` |
   | `src/Sibyla.Infrastructure/Persistence/Migrations/P11aSchemaSql.cs` | `74c5912cc85aebd99c1169a27217c67aa1955476` |
   | `src/Sibyla.Infrastructure/Persistence/Migrations/20260806180000_P11bPieceASchemaCompleteness.cs` | `a5ff78040a83440c771dc1b1ddde3c873bc88161` |
   | `src/Sibyla.Infrastructure/Persistence/Migrations/P11bPieceASchemaSql.cs` | `00b4bc2a988e1a54a5e2719d0fbc4814690d3782` |
   | `src/Sibyla.Infrastructure/Persistence/Migrations/20260806190000_P11bPieceBRegistryFieldProvenance.cs` | `d0beb8aafa78dc158318e6101277023f758edfaa` |
   | `src/Sibyla.Infrastructure/Persistence/Migrations/P11bPieceBSchemaSql.cs` | `bc9d958258a2715c23bb435868134a5d160bc9a3` |
   | `src/Sibyla.Infrastructure/Persistence/Migrations/20260806200000_P11bPieceCGovernedCommands.cs` | `0a111d0c981680f838dbcbbef1560cbce3eb77ba` |
   | `src/Sibyla.Infrastructure/Persistence/Migrations/P11bPieceCSchemaSql.cs` | `398887002499404c80b9509564fd4369ac93a371` |

   `tests/Sibyla.Tests/Persistence/P11aDisposableDatabaseTests.cs` has `origin/main` blob
   `c5915524ffe355e8955e9254f8be40b008813f97`, exactly equal to candidate
   `a4d40aac429584baed3481d62c2f859dd4ad2860`.
5. **Pass — first build on the published MR result.** From `origin/main`
   `c277b16abffac3ba18833e811a67641e81fdf58a`, `dotnet clean GOTT.Sibyla.slnx -c Release` followed
   by `dotnet build GOTT.Sibyla.slnx -c Release --no-incremental` succeeded with **0 warnings / 0
   errors** in **00:00:35.16**. Ordinary `dotnet test
   tests/Sibyla.Tests/Sibyla.Tests.csproj -c Release --no-build` passed **646/646**, failed 0,
   skipped 0, duration **17 s**. This was the **first build run on the published MR result**.

**Governance finding — both halves are binding.** The `80646b9` entry said the merge had not
occurred and became stale one minute later when the same session created `fc205fa` without a new
record. Conversely, the merge was later published by MR but the required adoption record still did
not exist. The `80646b9` text remains untouched and was exact when written; this record supersedes
it as current state.

**Binding forward rules, in the spirit of D-A2-L1:**

1. A session that records it did not exercise an authority must not then exercise it without first
   recording that it has moved to exercise it.
2. No Git topology is published, by direct push or MR, before the record describing it is committed
   and pushed.

**Corrected MR-flow preflight rule:** before synchronization, local `main` must be an ancestor of
`origin/main`, zero commits ahead, and capable of a fast-forward. A 0/0 divergence is not required
before synchronization; it is required after the fast-forward completes.

**Scope boundary:** this records session does not author the Scope 1 go-ahead, start Scope 1 or its
execution preflight, run any importer or import, write any shared or live database, touch the
prototype, perform O5, alter the pin, baselines, closed decisions, or accepted objects, update the
project-evolution page, or merge this records MR.

**Current edge (2026-08-07): all four pieces (A, B, C, D) have accepted implementations, and
Miguel has decided amendment 4's Scope 1 re-pin checkpoint by confirming the pin — path (a).**
Pin `b91768513fc638381fbde91f0b576b08220a98f6` is confirmed as the historical-import snapshot;
post-pin prototype evolution is handled as later governed imports under the already-closed D4–D9
additive-period-imports decisions. **Path (b), an O11-class re-pin, was not taken**, so none of its
preconditions is triggered — no re-verification at a new pin, no re-measurement of the five
baselines, no C8 (43/43/0/0) or C13 re-measurement, no DOCTYP manifest re-check, and no
`EF0000053`/authored-code re-check against a changed `permanent_code_ledger.json`. **Nothing in any
closed decision is reopened.** Miguel's verbatim decision, the checkpoint's own fresh read-only
amendment-4 preflight (pin resolves; ancestral to live `origin/main` `3dd4150…`; clone anchored and
clean; roster 49/49 cell by cell with 0 mismatches and 0 resolve failures; direct pinned surface
48/48 blobs plus exactly one `Backups` tree; divergence logged as metadata only, no post-pin content
read or adopted), and the precise readiness statement are recorded in
`docs/AGENT-PROMPT-v5-P1-1b-scope1-pin-confirmation.md`. **Scope 1 is ready to seek its own
go-ahead; it has not started, and its own execution preflight has not run** — that later preflight
must be run fresh by the session that performs Scope 1 and is not discharged by this records
checkpoint preflight.

**Piece D attempt #2 is independently ACCEPTED.** Candidate `a4d40aac429584baed3481d62c2f859dd4ad2860` received
the separately authorized fresh independent integration-focused review (ordered instruction 4) in an
exclusively-review session, with verdict **Accept: 0 Critical, 0 High, 0 Medium, 1 Low (D-A2-L1)** —
`docs/p1-1b-o10-independent-review.md`, "Piece D attempt #2 integration review — Accept". D-R1 is
closed at the root (S0 comes from a genuinely independent oracle database migrated from empty only to
`20260805180000_P11aFdrSchema` and captured before any Fact) and was proven **non-vacuous by
adversarial fault injection**, not by passing equality: injecting a table into the oracle, a
cluster-global role after `Down`, an equal-but-empty constraint set, and a hostile pre-existing
`sibyla_piece_c_executor` each break the proof exactly where they should — the last failing all 61
Facts in 139 ms, proving the fixture fails closed before every Fact. D-R2 is closed. The approved
inventory (0 new test methods, 1 helper, 1 fixture, 1 strengthened method, 4 byte-identical
regressions) was verified against rejected candidate `bf5926e…` by measured `[Fact]` counts 55/61/61
with 0 added Facts. Independently reproduced: Release 0 warnings/errors; ordinary 646/646; Registry
33/33; focused 1/1; regressions 4/4; canonical runner 61/61 on PostgreSQL 17.10; `git diff --check`
clean working and cached; exactly three changed paths; eight accepted blobs byte-identical; 0
residual/running containers. The one **Low (D-A2-L1)** is that the implementing session adopted the
host's preceding preflight instead of running it fresh, which Piece D checklist item 1 does not
permit; it is recorded and **not waived** — preflight adoption is inadmissible going forward and each
session must run its own — but it is materially inert for Piece D and the reviewer re-ran all six
amendment-4 checks fresh with identical results (49/49 roster, 48/48 surface, pin ancestral, same
`3dd4150…` divergence). **That Accept authorized Scope 1 to seek its own preflight and the
confirm-pin-or-re-pin checkpoint against pin `b917685…`; the checkpoint has since been decided by
path (a), above, and Scope 1 is still not started.** Rejected candidate `bf5926e3bba9afca394baf669f95c72506886056`,
Reject record `8755b049e24190179eeebcbb21e0f9d7f9c9e092`, published neutralization
`46946c6e3aae5e366e5d601a3aea9d0677b3f200`, and approved base
`9ba2bdd468be32d1de36f7ee7cd9d1607949dc6a` remain historical governing topology. Reject #1 was
**Reject: 0 Critical, 1 High D-R1, 0 Medium, 1 Low D-R2**. Miguel has now approved D-R1, D-R2,
D-R1-O1, D-R1-O2, D-R1-O3, and D-R2-O1 verbatim in
`docs/AGENT-PROMPT-v5-P1-1b-piece-d-remediation-approval.md`. Ordered instruction 3 implemented
that approved second/final remediation attempt from pushed approval tip `a0529093838b2fd95d40c5057db6dd896e9b85fc`
with strict RED→GREEN and the full envelope recorded in `docs/p1-1b-status.md`. Ordered instruction 4
has since been separately authorized, executed, and recorded as the **Accept** above, so the
second-Reject escalation branch did not arise.

**Implemented D-R1 (High), by surface:** **New helper**
`CreatePieceDPristineP11aOracleDatabaseAsync` creates a second isolated database in the same
disposable PostgreSQL 17 container/run, migrates it directly from empty only through
`20260805180000_P11aFdrSchema`, captures immutable S0 before any A+B+C `Up` in the separate cycle
database, and never captures S0 after full tip/`Down`. It is owned and called before any `[Fact]`
by the **New test fixture** `PieceDPristineP11aOracleFixture`, not lazily by the combined method.
The fixture uses xUnit `IAsyncLifetime`/class-fixture lifecycle; initialization asserts the
canonical runner's fresh-cluster precondition (no cluster-global `sibyla_piece_c_executor` and no
applied Piece A/B/C history in the pristine runner database), creates the isolated oracle database,
migrates only to P1-1a, captures and retains immutable S0, and cleanup drops the oracle database
fail-safely. Miguel has explicitly approved this lifecycle and new fixture surface.
**Strengthened method**
`Piece_d_combined_cumulative_up_down_up_over_a_plus_b_plus_c_matches_accepted_p1_1a_and_is_stable`
takes the fixture's pre-Fact immutable S0 and S1/S2/S3 from the separate cycle database, whose path
may execute later as full combined `Up` → `Down` to P1-1a → `Up`. `Assert.Equal(S0,S2)` compares independent origins;
`Assert.Equal(S1,S3)` retains determinism; `Assert.NotEqual(S0,S1)` retains sensitivity. Its
complete logical+physical snapshot includes roles/ACLs/functions/triggers/constraints/indexes/
history and normalizes only non-contractual physical identities; it proves both databases began
empty and independent, histories are correct, and cleanup completes. **Existing regressions**
`Piece_a_down_is_exact_and_up_down_up_is_catalog_stable`,
`Piece_b_down_is_exact_and_up_down_up_is_catalog_stable`, and
`Piece_c_down_is_exact_and_up_down_up_is_catalog_stable` re-run unchanged and do not substitute for
the independent oracle.

**Implemented D-R2 (Low), by surface:** the **Strengthened method** reuses unchanged
`ImportEvidenceRowUniqueConstraints(connectionString)` and
`ImportEvidenceRowIndexes(connectionString)` at S0/S1/S2/S3. At every checkpoint it asserts count
exactly 4 and these exact `pg_get_constraintdef` values:
`UNIQUE NULLS NOT DISTINCT ("ImportBatchId", "SourceTable", "SourcePermanentCode")`;
`UNIQUE NULLS NOT DISTINCT ("ImportBatchId", "SourceTable", "SourceRecordKey")`;
`UNIQUE ("Id", "TargetTable", "TargetPermanentCode")`; and
`UNIQUE ("Id", "CompanyCode", "TargetTable", "TargetPermanentCode")`. It then asserts
`uniqueS0 == uniqueS1 == uniqueS2 == uniqueS3` and `indexS0 == indexS1 == indexS2 == indexS3`;
equality alone never replaces cardinality plus literal definitions. **Existing regression**
`Piece_a_accepted_import_evidence_uniqueness_and_indexes_are_identical_from_accepted_to_first_up`
re-runs unchanged as secondary evidence, never as a substitute for the in-method S0–S3 literals.

**Approved observations:** **D-R1-O1** defines
one disposable PostgreSQL 17 run as one container/test invocation with two isolated databases,
because exactly one database cannot yield an independent pristine oracle after full tip/`Down`; S0
is captured before cycle A+B+C `Up`. **D-R1-O2** records that roles are cluster-global: fixed execution
order captures S0 before Piece C roles, then S2 must expose any leak; use unique database names,
guaranteed drop/cleanup, no parallel combined-method execution, and never recapture/rebase S0.
**D-R1-O3 — fixture lifecycle / shared-cluster ordering collision** records that no parallel
execution alone does not guarantee a pristine cluster or method order: if the helper is called only
inside the combined Fact, earlier Facts may already have migrated the shared cluster to Piece C and
created `sibyla_piece_c_executor`, whose pre-existence makes Piece C `Up` fail. The proposed
class-fixture initialization above must run before every Fact in `P11aDisposableDatabaseTests` and
fail closed on any violated fresh-cluster precondition. Implementation verification must statically
confirm `Category=P11aDatabase` shared-connection participation and fail closed if another class can
mutate the cluster before this fixture. If the canonical runner cannot guarantee that ordering,
D-R1 remains infeasible and implementation must hold/escalate. **D-R2-O1** requires cardinality plus exact `pg_get_constraintdef` values at every checkpoint and
dictionary equality—including names—across checkpoints, without making generated constraint names
a new stable contract. Miguel approved all four interpretations exactly as mapped. No other
collision was found in the adversarial assessment; that is not execution evidence.

**Candidate inventory/gate:** 0 new test methods, 1 new helper, 1 new test fixture, 1 strengthened shared test
method, and 4 unchanged existing regression methods. D-R1 labels are **New helper**, **New test
fixture**, **Strengthened method**, and **Existing regressions**. Every previously-Pass candidate/checklist surface must
regress unchanged; no prior surface is reopened. Option A, D-M2-A, and D-M3-A+ remain operative;
all accepted objects and `RejectTerminalDOCFLGMutationFn` remain untouched. Item 5, Scope 1, O5,
merge/evolution-page work remain out of scope. D-R1, D-R2, D-R1-O1, D-R1-O2, D-R1-O3, and
D-R2-O1 are approved and implemented in the candidate. Ordered instruction 3 is complete;
ordered instruction 4 is not authorized by this candidate publication.

Candidate verification ran with these governed commands/slices:

```powershell
dotnet test tests/Sibyla.Tests/Sibyla.Tests.csproj --filter "Category=P11aDatabase&FullyQualifiedName~P11aDisposableDatabaseTests.Piece_d_combined_cumulative_up_down_up_over_a_plus_b_plus_c_matches_accepted_p1_1a_and_is_stable"
dotnet test tests/Sibyla.Tests/Sibyla.Tests.csproj --filter "Category=P11aDatabase&FullyQualifiedName~P11aDisposableDatabaseTests.Piece_a_accepted_import_evidence_uniqueness_and_indexes_are_identical_from_accepted_to_first_up"
powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/run-p11a-disposable-tests.ps1
git diff --check
```

The focused strengthened method passed 1/1; four exact unchanged regressions passed 4/4; Registry
passed 33/33; ordinary passed 646/646; the canonical PostgreSQL 17 runner passed 61/61; clean
Release rebuild produced 0 warnings/errors. Working diff check and added-line secret scan were
clean, the exact candidate path set is the test file plus the two records files, all eight accepted
migration/SQL blobs are unchanged, and cleanup left 0 residual/running `sibyla-p11*` containers.
Static inspection confirmed only this class participates in the category/shared connection; the
fixture initializes before every Fact and fixed ordering runs the combined cycle first. No
`migration`/`DDL`/`src`/Designer/ModelSnapshot/script/importer/AGENT-PROMPT surface changed.

**Current Git topology (superseding dated authoring-state records):**
`feature/p1-2-o5-prep` merged into `feature/p1-1b` at `a445478`, then `feature/p1-1b` merged into
`main` at `f1488ac`. This explicitly supersedes the historical **"Not committed, not pushed"**
assertion in `docs/p1-2-o5-prep-status.md`; that frozen line remains accurate only at its recorded
moment. The O5-prep review cycle closed with focused independent confirmation **ACCEPT**, but O5
itself remains open and only the target-host session closes it.

**Prior update history (superseded as current state; retained as evidence):** Piece B B-R1 remediation (candidate `7059809…`, a remediation of
rejected candidate `b8fa033…` from the pushed approval tip `1627dd6…`) has been independently
reviewed in a fresh session — the second and final Piece B attempt before escalation to Miguel —
and **Accepted: 0 Critical, 0 High, 0 Medium, 0 Low**
(`docs/p1-1b-o10-independent-review.md`, "Piece B B-R1 remediation review — Accept"). The applied
remediation: the item 5/7 split (a new immediate `RequireCompanyAgreementFn` for item 5; item 7
re-implemented as three `DEFERRABLE INITIALLY DEFERRED` `AFTER` constraint triggers on
`RegistryFieldProvenance`, `DOCEFL`, and `DOCFLG`, each re-querying live state at `COMMIT`), R1a–R1g
proving both natural statement orderings of a legitimate `NULL`→value co-update succeed at `COMMIT`
for `DOCEFL` and `DOCFLG` while an unaccompanied one-sided change still fails closed at `COMMIT`,
the item-20 design-note correction, and the item 2/12 roster widenings (8 triggers, 4 functions, up
from 7/3) — no other content change. Measured and independently reproduced: build 0 warnings/0
errors; ordinary **640/640**; focused **3/3**; disposable PostgreSQL 17 suite **34/34** (16 Piece A
+ 18 Piece B); `git diff --check` clean; both accepted P1-1a and Piece A migration files
byte-identical to pre-implementation `HEAD`; `WaiveDOCFLG` and `RejectTerminalDOCFLGMutationFn`
proven byte-identical before/after via live `pg_get_functiondef` and confirmed to contain no
reference to `RegistryFieldProvenance`; Up/Down/Up catalog stability proven; live catalog
measurement of 9 columns / 11 constraints / 2 indexes / 8 triggers / 4 functions; 0 residual
containers. The review additionally ran six original adversarial probe transactions beyond the
candidate's own test suite — both statement orderings, a same-transaction double-toggle, the
previously-exploited no-provenance window now failing closed, the delete-update-insert sequence
remaining valid but unneeded, genuinely immediate company agreement, and a combined
move-plus-value-change scenario — all six passing and fully removed before the verdict. The
item-by-item remediation evidence map, the measured DDL/catalog roster, and the review verdict are
recorded in `docs/p1-1b-status.md` and `docs/p1-1b-o10-independent-review.md`. **Piece B now has an
accepted implementation.** Piece A remains accepted; per amendment 3, Piece C sought its own
go-ahead and Miguel's go-ahead (`docs/AGENT-PROMPT-v5-P1-1b-piece-c-goahead.md`, tracked and pushed
at `6880bbf…`) is accepted. Piece C's 20-item checklist→test mapping was recorded in
`docs/p1-1b-status.md` and has since been **corrected** in a follow-up records-only commit after an
independent review found three internal contract/proof defects: item 8's evidence-append command is
now stated as impossible as written — both proposed options (a separate evidence-log table, or a
scoped exception to the accepted `RejectTerminalDOCFLGMutationFn`) require an explicit Miguel
checklist/authority amendment, not just a choice between two already-compliant designs; R6's
company-scope mapping now requires atomic all-or-nothing completion (no silent partial-subset
completion) with the inactive-affected-company authorization rule surfaced as its own explicit
decision; and the R3 concurrency tests now simulate a real shared parent-row-lock protocol with
deterministic blocking proof instead of a blind, uncoordinated insert. **Miguel has since approved
the corrected mapping** — his exact words in the approving session were "aprovo mapping"; a
clarification on whether that covered all six observations' recommended resolutions timed out, and
the recorded, honestly-labelled interpretation adopted is that it approves the mapping in full,
including option B for Observation 1 (a narrow, explicitly waived `CREATE OR REPLACE` of the accepted
`RejectTerminalDOCFLGMutationFn`, item 2's byte-identical requirement waived for that one function
only), Observation 2a (per-company `RuntimePrincipalCompany` enumeration, all-or-nothing),
Observation 2b (ordinary membership remains valid authority for an inactive affected company),
Observation 3 (`AppendDOCFLGResolutionEvidence(p_flag_instance_id varchar, p_evidence text)`),
Observation 4 (role/ACL shape now, roster fixed at TDD), and Observation 6 (the shared
`SELECT ... FOR UPDATE` parent-lock protocol). **Piece C implementation was started (TDD, from the
approval tip) and then stopped before any candidate was committed**: a second discovered collision
with an accepted, untouchable P1-1a object — `RequireActiveCompanyRegistryFn`, attached to
`P11aCommandAudit` as well as `DOCFLG`, unconditionally rejects an audit row for an inactive
company, exactly as it already blocked writing that company's `DOCFLG` snapshot — means the approved
mapping's item 11/Observation 2b inactive-company audit requirement cannot be satisfied without an
additional, not-yet-authorized waiver. All uncommitted implementation/test files were deleted and
the one modified tracked file was restored byte-exactly to the approval tip; **no Piece C
implementation candidate exists**. Full blocker proof, observed TDD test evidence, a proposed (not
adopted) narrow-exception option, and cleanup proof are recorded in `docs/p1-1b-status.md`. **Miguel
has since decided: "Aprovo B — alterar o requisito de audit da empresa inativa"** — Alternative B,
not the `RequireActiveCompanyRegistryFn` waiver. `RequireActiveCompanyRegistryFn` remains
byte-identical and untouched; the inactive-affected-company **audit requirement is amended** instead:
an inactive affected company is outside `AssignDOCEFLItemClass`'s mutable completion set and receives
no `P11aCommandAudit` row of its own (never attempted, by design); the calling context company's own
audit row carries a fixed `"skippedInactiveCompanies"` array naming each skipped inactive company,
`"reason":"inactive"`, `"completedCount":0`, and its exact observed `NULL`-row count. The
all-or-nothing authorization gate now applies to active affected companies only — an inactive
affected company is excluded before membership is even considered. Validator/completion counts and
R3's zero-survivor assertion are scoped to active eligible companies; a skipped inactive company's
rows remain open findings. The precise superseding contract is recorded in full in
`docs/p1-1b-status.md`. **Piece C implementation was recreated from zero, TDD first, from the Option-B amendment tip
`fd9dbd9…`, and a candidate now exists.** Surface: 1 role (`sibyla_piece_c_executor`, fail-closed
against a hostile pre-existing name), 2 new `SECURITY DEFINER` functions
(`AssignDOCEFLItemClass(varchar,varchar)`, `AppendDOCFLGResolutionEvidence(varchar,text)`), 1
`CREATE OR REPLACE` of `RejectTerminalDOCFLGMutationFn` (the one approved narrow exception, item
2's byte-identical requirement waived for that function only), 2 `EXECUTE` grants each preceded by
`REVOKE ALL FROM PUBLIC`, 0 new tables/columns/triggers/constraints/indexes on any accepted object.
`RequireActiveCompanyRegistryFn` is never defined, replaced, or invoked anywhere in the migration —
confirmed byte-identical Piece-B-tip-to-latest by live `pg_get_functiondef`. All 20 checklist items
(as amended by Option-B) are satisfied with measured proof; two TDD defects were found and fixed
during this implementation (a `STORED GENERATED`-column BEFORE-trigger comparison bug in the
approved exception, and fragile query-text-fragment concurrency detection replaced with
PID-scoped `pg_stat_activity` lock-wait polling), plus several fixture defects (composite-FK column
alignment, a same-row `CHECK` conflict, duplicate unique-constraint collisions, and permanent-`NULL`
pollution of three pre-existing full-down-migration tests, each root-caused via direct `psql`
reproduction and fixed, not suppressed). Measured and reproduced this session: build 0 warnings/0
errors; ordinary **646/646** (640 baseline + 6 new); focused **6/6**; disposable PostgreSQL 17 suite
**55/55** (34 baseline + 21 new), reproduced twice; `git diff --check` clean; all 6 accepted
P1-1a/Piece A/Piece B migration files byte-identical; 0 residual containers. The full 20-item
evidence map, exact DDL/role/function/grant roster, and defect fixes are recorded in
`docs/p1-1b-status.md`. **The mandatory independent adversarial review (ordered instruction 4) has
not begun** — this is a candidate, not an accepted implementation; no self-review verdict has been
issued. Piece D and Scope 1 remain gated and unstarted. ·
**Plan:** Development Plan v5.0 · **Current phase:** P1-1b authorized on 2026-08-05 by
`docs/AGENT-PROMPT-v5-P1-1b.md`, as amended by
`docs/AGENT-PROMPT-v5-P1-1b-o8-amendment.md` and
`docs/AGENT-PROMPT-v5-P1-1b-o9-amendment.md` and
`docs/AGENT-PROMPT-v5-P1-1b-o10-amendment.md` and
`docs/AGENT-PROMPT-v5-P1-1b-o10-amendment-2.md`,
`docs/AGENT-PROMPT-v5-P1-1b-o10-amendment-3.md`,
`docs/AGENT-PROMPT-v5-P1-1b-o10-amendment-4.md`, and
`docs/AGENT-PROMPT-v5-P1-1b-o10-amendment-5.md` — **O8, O9 and O10 are closed. O9-P keeps identity-class
controls fail-closed and makes historical completeness gaps honest SQL `NULL` / `absent`, measured
as named non-blocking data-quality findings. O9-D1…D5 and O10-D1/D2 govern expected baselines 119
`ENTMST.DirectDebit absent`, 119 `ENTMST.TaxIdVerificationStatus unverified`, 52
`DOCEFL.ItemClass unassigned`, the exact six-literal `ReviewPriority` CHECK including `Routine`,
221 terminal DOCFLG rows without `ResolutionEvidence`, and 2,787 imported DOCFLG snapshots without
`ItemClass`. O10-D1 makes those snapshots nullable, retains the composite FK under `MATCH SIMPLE`,
mandates a plain `EFCode` FK and a prospective non-imported completeness CHECK; O10-D2 completes
NULL snapshots only through the atomic audited assignment command. Fresh step-3 implementation
`57f0f023…` received mandatory independent verdict **Reject: 0 Critical, 4 High, 3 Medium** and is
fully neutralized at the branch tip by restoring all 14 implementation paths byte-for-byte to
records parent `15679e78`; see `docs/p1-1b-o10-independent-review.md`. O10-D1/D2 remain closed,
the 2,787 baseline remains governed, and rejected `b324a3e…` and `57f0f023…` are evidence only.
Third implementation `7ea6c0f…` received mandatory independent verdict **Reject: 0 Critical,
2 High, 4 Medium, 1 Low** and is neutralized by restoring all 15 implementation paths byte-for-byte
to records parent `01c92cb…`. Miguel's amendment 3 review replaces the monolithic reimplementation
with four independently reviewed pieces; amendment 4 replaces only the obsolete frozen-tip
prototype preflight with snapshot-integrity checks. Piece A candidate `6f86023d…` received fresh
independent verdict **Reject: 0 Critical, 1 High, 2 Medium, 1 Low** and is neutralized by restoring
all 12 implementation/model/test paths byte-for-byte to records base `bc835f7e…`. This is Piece A
Reject #1. Amendment 5 accepts those findings in full as binding **A-R1…A-R4**, authorizes Piece A
attempt #2 as a **remediation of candidate `6f86023d…`** rather than a rewrite — a basis that never
applies to the three monolithic rejects — and makes it the **second and final attempt before
escalation to Miguel**. The attempt-#2 checklist is the Reject #1 disposition table plus A-R1…A-R4,
and no other content change is authorized. **The 20-item checklist→test mapping required by
amendment 5's test-plan gate is recorded in `docs/p1-1b-status.md`, and Miguel has explicitly
approved it — with one named addition widening item 6's DOCFLG coverage to all six governed
`ReviewPriority` literals plus the `'Normal'` rejection, and both reported observations decided in
the plan's favor — in `docs/AGENT-PROMPT-v5-P1-1b-piece-a-testplan-approval.md`, tracked and
pushed at `47d6fc2…`. Attempt #2 was implemented as a remediation of candidate `6f86023d…`
under the amendment-4 reformulated preflight (checks 1–5 re-run and passed fresh), applying
A-R1…A-R4 and the named DOCFLG strengthening exactly and no other content change; build 0
warnings, ordinary 637/637, focused 37/37 (32 candidate + 5 new), disposable PostgreSQL 16/16 (13
candidate + 3 new), `git diff --check` clean, 0 residual containers, and both accepted P1-1a
migration files byte-identical to pre-implementation `HEAD`. **The mandatory focused independent
re-review (ordered instruction 4) has since run fresh in an independent session and recorded
verdict Accept: 0 Critical, 0 High, 0 Medium, 0 Low** (`docs/p1-1b-o10-independent-review.md`,
"Piece A attempt #2 review — Accept"); build/focused/ordinary/disposable figures were
independently reproduced exactly. **Piece A now has an accepted implementation.** Per amendment 3,
Piece A's Accept authorized Piece B to seek its own go-ahead; Miguel's go-ahead
(`docs/AGENT-PROMPT-v5-P1-1b-piece-b-goahead.md`, tracked and pushed at `5813a06…`) is accepted
and its acceptance is recorded in `docs/p1-1b-status.md`. Its 20-item checklist→test mapping was
recorded in `docs/p1-1b-status.md`, pushed at `d45526d…`, and **Miguel explicitly approved it in
full** — with both reported observations decided in the plan's favor. Piece B was then
**implemented from zero** and received its first independent adversarial review (ordered
instruction 4); the review recorded **verdict Reject: 0 Critical, 1 High, 0 Medium, 0 Low — Reject
#1**, binding finding **B-R1** (the `DOCEFL`/`DOCFLG` target-update re-check and
`RegistryFieldProvenance` insert/update triggers are both immediate, and no statement ordering
proves a legitimate value/provenance co-update succeeds — `docs/p1-1b-o10-independent-review.md`,
"Piece B candidate review — Reject #1"). Candidate `b8fa033…` is neutralized: all 6
implementation/test paths are restored byte-for-byte to records base `87499a1…`. A remediation
checklist→test mapping for B-R1 was recorded in `docs/p1-1b-status.md`, and **Miguel has explicitly
approved it in full** — with both reported observations (R-1: both natural statement orderings must
succeed; R-2: the redesign changes the proof mechanism, not the required outcome, of already-Pass
items 5/15/16) decided in the plan's favor —
`docs/AGENT-PROMPT-v5-P1-1b-piece-b-remediation-approval.md`, tracked and pushed at `2d09612…`.
**Piece B remediation implementation is now authorized** as a remediation of candidate `b8fa033…`
under the amendment-4 reformulated preflight, TDD first — **and has since been implemented**: the
item 5/7 split, three deferred `RegistryFieldProvenance`/`DOCEFL`/`DOCFLG` constraint triggers,
R1a–R1g, the item-20 correction, and the item 2/12 roster widenings (8 triggers, 4 functions),
applied exactly, no other content change, with build 0 warnings, ordinary 640/640, focused 3/3,
disposable PostgreSQL 17 suite 34/34, `git diff --check` clean, byte-identical accepted migrations,
byte-identical `WaiveDOCFLG`/`RejectTerminalDOCFLGMutationFn`, proven Up/Down/Up catalog stability,
and 0 residual containers — recorded item by item in `docs/p1-1b-status.md`. **The fresh independent adversarial review
(ordered instruction 4, the second and final Piece B attempt before escalation) has since run in a
fresh session and recorded verdict Accept: 0 Critical, 0 High, 0 Medium, 0 Low**
(`docs/p1-1b-o10-independent-review.md`, "Piece B B-R1 remediation review — Accept"). **Piece B now
has an accepted implementation.** Per amendment 3, Piece B's Accept authorizes Piece C to seek its
own go-ahead; Miguel's go-ahead (`docs/AGENT-PROMPT-v5-P1-1b-piece-c-goahead.md`, tracked and
pushed at `6880bbf…`) is accepted and its acceptance is recorded in `docs/p1-1b-status.md`. **Piece
C's 20-item checklist→test mapping was recorded in `docs/p1-1b-status.md`**, mapping
every checklist item to exact proposed test methods/verification commands and reporting six
observations for Miguel's explicit decision rather than resolving them silently. **The mapping was
then corrected in a same-day, normal additive follow-up commit** after an independent review found
three internal contract/proof defects: (1) Observation 1 originally understated the evidence-append
command's collision with checklist item 2's byte-identical requirement on the accepted
`RejectTerminalDOCFLGMutationFn` — it now states that, as written, item 8 is impossible on either
proposed path (a separate evidence-log table does not literally satisfy item 8 and may alter O9-D5's
governed contract; a scoped trigger exception would satisfy item 8 but requires an explicit waiver of
item 2) and that both options need an explicit Miguel checklist/authority amendment before
implementation, not merely a recommendation; (2) item 11's R6 mapping originally allowed the command
to silently complete an authorized subset of affected companies — it now requires atomic
all-or-nothing completion (every affected company or none, per items 5 and 7's own atomicity/exact-
count requirements), with the inactive-affected-company authorization question surfaced as its own
explicit decision (Observation 2b) rather than assumed; (3) item 12's two concurrency tests
originally relied on a blind, uncoordinated second-connection insert — they now simulate a real
shared parent-DOCEFL-row-lock protocol with deterministic (non-timing-based) blocking proof, and the
exact lock contract a future importer must honour is now reported as an open decision (corrected
Observation 6) rather than assumed settled. **Miguel has since recorded approval** — exact words
"aprovo mapping" — interpreted, after a timed-out clarification on scope, as approving the corrected
mapping in full including all six observations' recommended resolutions (Observation 1 option B;
2a per-company enumeration; 2b ordinary membership valid for an inactive affected company; 3 the
`AppendDOCFLGResolutionEvidence` name/signature; 4 role/ACL shape now, roster at TDD; 6 the shared
parent-lock protocol), recorded in full in `docs/p1-1b-status.md`. **Piece C implementation was then
started (TDD, from the approval tip) and stopped again before any candidate was committed**, this
time by a second discovered collision with an accepted, untouchable P1-1a object: live disposable
testing proved `RequireActiveCompanyRegistryFn` — the same trigger family already known to block
writes to an inactive company's `DOCFLG` rows — also unconditionally rejects a `P11aCommandAudit`
row for an inactive company (`23503: active CompanyRegistry mapping is required for
P11aCommandAudit`), making the approved mapping's item 11/Observation 2b requirement to audit every
affected company including inactive ones structurally impossible to satisfy without an additional
waiver that was never authorized. No fallback was implemented; all uncommitted implementation/test
files were deleted, the one modified tracked file was restored byte-exactly to the approval tip, 12
residual `sibyla-p11*` containers were removed (0 residual confirmed), and **no Piece C
implementation candidate exists, committed or uncommitted**. The exact blocker proof, the observed
TDD test evidence (47 passed / 8 failed / 55 total in the last completed run), a proposed but
unadopted narrow-exception option for `RequireActiveCompanyRegistryFn` (the same governed shape as
Observation 1's `RejectTerminalDOCFLGMutationFn` waiver), and alternatives are recorded in
`docs/p1-1b-status.md`. **Miguel has since decided the requested decision: "Aprovo B — alterar o
requisito de audit da empresa inativa"** — Alternative B is approved, not the
`RequireActiveCompanyRegistryFn` waiver (option A). `RequireActiveCompanyRegistryFn` remains
byte-identical and untouched, proven the same way every other "unchanged" claim in this piece is
proven. The inactive-affected-company **audit requirement is amended** instead, superseding
Observation 2b and the inactive sub-case of checklist items 5/7/11/12 only: an inactive affected
company is outside the command's mutable completion set and never receives its own
`P11aCommandAudit` row (never attempted, by design, not attempted-then-blocked); the calling context
company's own audit row carries a fixed `"skippedInactiveCompanies"` array (`reason":"inactive"`,
`"completedCount":0`, exact `"observedNullCount"` per skipped company); the all-or-nothing
authorization gate now applies only to active affected companies, since an inactive one is excluded
before membership is even considered; validator/completion counts and R3's zero-`NULL`-survivor
assertion are scoped to active eligible companies, with a skipped inactive company's rows remaining
open findings. Every other part of the corrected mapping (items 1–4, 6, 8–10, 13–20, Observations 1,
2a, 3, 4, 5, 6) is unchanged. The full superseding contract is recorded in `docs/p1-1b-status.md`.
**Piece C implementation was recreated from zero** — TDD first, from the Option-B amendment tip
`fd9dbd9…`, not by restoring any previously deleted file as authoritative — **and a candidate now
exists**: `src/Sibyla.Infrastructure/Persistence/Migrations/P11bPieceCSchemaSql.cs`,
`20260806200000_P11bPieceCGovernedCommands.cs`, `tests/Sibyla.Tests/Persistence/
P11bPieceCContractTests.cs`, and 21 new disposable tests plus one re-pinned pre-existing test added
to `P11aDisposableDatabaseTests.cs`. All 20 checklist items (as amended by Option-B) carry measured
proof; two TDD defects (a generated-column BEFORE-trigger comparison bug in the approved narrow
exception, and fragile concurrency detection) plus several fixture defects were found and fixed, not
suppressed — see `docs/p1-1b-status.md` for the full evidence map. Measured: build 0/0; ordinary
646/646; focused 6/6; disposable **55/55** (34 baseline + 21 new), reproduced twice; `git diff
--check` clean; all 6 accepted P1-1a/Piece A/Piece B migration files byte-identical;
`RequireActiveCompanyRegistryFn` byte-identical and unreferenced by the new migration; 0 residual
containers. **The mandatory independent adversarial review (ordered instruction 4) has since run, in
a fresh independent Claude CLI session, and recorded verdict Accept: 0 Critical, 0 High, 0 Medium, 0
Low** (`docs/p1-1b-o10-independent-review.md`, "Piece C candidate review — Accept"); build, ordinary,
focused, and disposable figures were independently reproduced exactly, all 6 accepted migration files
were independently confirmed byte-identical by blob-ID comparison (not just `diff --stat` silence),
the hostile-pre-existing-role `Up` was independently proven to fail atomically with zero partial
objects, the all-or-nothing company-authorization rollback and the inactive-affected-company skip
shape were independently re-verified, and eight original adversarial probes beyond the candidate's
own suite were run and removed, surfacing one non-binding observation (the
`RejectTerminalDOCFLGMutationFn` narrow-exception GUC mechanism has no independent defense beyond
the fact that no role in the accepted schema history holds direct DML on `DOCFLG`, flagged for
Piece D's own scope, not a checklist violation and not independently exploitable today). **Piece C
now has an accepted implementation.** Per amendment 3, Piece C's Accept authorizes Piece D to seek
its own go-ahead from Miguel; Piece D's go-ahead is not implied by this Accept. **Miguel's Piece D
go-ahead has since been given and is accepted** (`docs/AGENT-PROMPT-v5-P1-1b-piece-d-goahead.md`,
dated 2026-08-06; its acceptance is recorded in `docs/p1-1b-status.md`). Per amendment 3, this
starts Piece D — an integration gate verifying that Pieces A + B + C together, run cumulatively on
the accepted P1-1a catalog, are byte-exact-invertible and complete, with no new migration content,
no production/shared/live database write, and no importer execution. **Historical mapping record:**
Piece D's checklist→test mapping (ordered instruction 2) was recorded and corrected against a fresh
independent review in `docs/p1-1b-status.md` ("2026-08-07 Piece D test-plan gate"). That review found one
Critical finding (item 2's `pg_catalog` snapshot had been narrowed to a curated seven-table/
four-function list instead of the complete relevant surface the go-ahead requires), two High
findings (item 6 omitted the two existing `DOCFLG`-snapshot validator regression tests and an
explicit coverage matrix; item 8's owner-level bypass test lacked literal assertions for its audit
and provenance post-state), and Medium/Low findings on the test-inventory arithmetic, the gate
statement, and Observation 2's Designer-file count. **The mapping as originally recorded was not
ready for Miguel's approval; every finding was applied before approval.** A second independent review then
found three further findings, also applied: item 8's roster/direct-DML check had been mapped as its
own separate `[Fact]` and disposable run instead of folding into item 3's combined method exactly as
item 4 already is, and the test-inventory table still reflected the pre-fold method count; Observation
1's fixture evidence had cited only the 119-row synthetic fixture and overclaimed "exactly one
exception," omitting the existing 52-row synthetic `DOCEFL` fixture
(`P11aDisposableDatabaseTests.cs:53-62`) — both are authored synthetic counts uncorrelated to the
real governed historical population, so neither satisfies item 5; item 6's description of
`Piece_a_reports_all_five_honest_historical_completeness_findings` had overclaimed that all four
`RegistryValidationCheck` members fire in that one test, when only the two absence checks
(`DoceflItemClassUnassigned`, `DocflgSnapshotItemClassAbsent`) fire there, with the two vocabulary
checks proven separately by the imported/native unknown-literal tests. **Every finding from both
reviews has now been applied.**
All eight checklist items are mapped to exact proposed test methods/verification commands (**6** new
test methods plus 1 new helper — item 8's roster check folded into item 3's combined method,
alongside item 4, rather than kept as its own Fact — 7 existing regressions re-run, 14 verification
commands, item 3, item 4, and item 8's roster all sharing one method rather than double-counted).
**The checklist was treated as exhaustive, not severable: at that gate, any unresolved item or
observation blocked ALL Piece D implementation, on every item, not only the item it named.** Two
observations were reported for Miguel's explicit decision before implementation:
**Observation 1** — item 5 ("the five baselines, one run, no
importer, no synthetic invention") is **infeasible as written**: no importer exists anywhere in
this repo, Scope 1 has never run, and no fixture reproduces the real 119/119/52/221/2,787-row
governed population inside the disposable harness (the two baselines with any code precedent, 119
and 52, are each an authored synthetic fixture matching the number, not real imported or reconciled
data; no equivalent fixture of any kind exists for 221, 2,787, or the two `Routine` rows); two
compliant alternatives are reported — narrow item 5 to a mechanism-only proof using synthetic
counts, or defer the real-population claim to Scope 1 (recommended). Miguel later adopted the latter;
item 5 has no Piece D test and is deferred to Scope 1. **Observation 2** — checklist item 1's literal "six
accepted migration files" undercounts the real roster, which direct inspection shows is eight (two
files × four pieces: P1-1a, Piece A, Piece B, Piece C); exactly one `*.Designer.cs` file exists
among them (`20260805180000_P11aFdrSchema.Designer.cs`), plus the one shared
`SibylaDbContextModelSnapshot.cs`. Miguel approved the eight-file roster and placed
Designer/ModelSnapshot outside item 1. **No code, test, helper, migration, container, or database run
occurred during the mapping stage itself.** Miguel subsequently approved the mapping in full and
authorized ordered instruction 3.

That authorized TDD attempt has now run and stopped. The focused PostgreSQL 17 run discovered 6
Piece D tests: **2 passed / 4 failed**, total test time **15.7404s**. The byte-identity test and
complete deterministic set-based catalog-snapshot test passed immediately. The governing failure
was literal S1/S3 inequality: `DOCFLG.ImportEvidenceRowId` physical ordinal/`attnum` measured **30
at S1 and 32 at S3**, because accepted Piece A `Down` drops two columns and PostgreSQL retains their
dropped attribute-number slots before the second `Up` re-adds them. S0/S2 equality passed. Approved
item 2 includes physical ordinal position and item 3 requires exact S1/S3 equality, so neither
excluding the ordinal nor changing Piece A is authorized. Three other failures were repairable
fixture/test defects but were not continued after this governing hard stop. Every transient edit was
removed; all eight accepted migration/SQL blobs remained unchanged; the worktree had zero
changed/staged paths; `git diff --check` was clean; and zero `sibyla-p11*` containers remained.
**No Piece D candidate exists.** A fresh independent Claude CLI read-only review confirmed the
deterministic contract collision from the approved documents, Piece A SQL, and PostgreSQL semantics,
but did not independently reproduce the measured 30/32 values.

**That historical stop was superseded by Miguel's Option A, D-M2-A, D-M3-A+, and Reject #1
remediation approvals.** Option A reports physical ordinal/`attnum` diagnostically but excludes it
from S1/S3 equality while retaining all logical properties and complete dynamic coverage. Ordered
instruction 3 of the second/final Piece D attempt has now produced the published attempt #2
candidate. Scope 1 remains unauthorized until Piece D's eventual independent Accept; ordered
instruction 4 requires a separate launch and has not begun. O5 continues independently; no
baseline, pin, or O8/O9/O10 decision changes.

> ## How to read state in this repository — read this before anything else
>
> **This file is the only place project state lives.** Every other document is a record of a
> moment: a review, a correction register, a letter, an agent prompt, a status report. They are
> evidence and reasoning, and they are frozen at their date. **None of them is current state, no
> matter how recently it was written.**
>
> Four rules, and they exist because each one has already been broken:
>
> 1. **Never infer state from a per-entry marker.** A marker like *needs Luís to confirm* inside a
>    correction register describes that entry's provenance, not an open question. The register's
>    header says what the markers mean — read the header before the entries.
> 2. **Never infer state from a section title.** *"Still needs X"* and *"not signed off"* survive
>    in documents long after the thing was decided. Titles are the last thing anyone updates.
> 3. **A document written before this file's date cannot describe current state**, even if it is
>    the most detailed document in the repository.
> 4. **If any document contradicts this file, this file wins and the document is stale.** Report
>    the contradiction; do not resolve it silently and do not carry it forward into a prompt, a
>    status report, or a plan.
>
> **For agents specifically:** do not reconstruct the decision history to work out where things
> stand. Read the two tables below. If what you need is not in them, it is not decided — ask.

---

## 1 · What is decided — do not reopen

| Decision set | Date | State |
|---|---|---|
| **D1–D3** — persisted queues · identity model closed · Layer 5 into Phase 1 | Jul 29 – Aug 3 | Closed |
| **D4–D9** — 2026 history · ReferenceOnly · ledger-reference match status · grandfathering · closed `ItemClass` · additive period imports | Aug 4 | Closed |
| **C1–C19** — the nineteen review corrections | Aug 4 | **All nineteen decided.** Applied to the drafts Aug 5 |
| **A1–A7** — the group-A residual blockers | Aug 5 | Closed · `docs/p1-0-a-group-decisions.md` |
| **C3's open half** — `EnforcementStartsAt` immutable after import/first use | Aug 5 | Closed · same file |
| **Group B scope** — all fifteen items go into the P1-1a migration train | Aug 5 | Closed · same file |
| **P1-1a deliverable 2 / O6** — documented validation check set | Aug 5 | Closed · implementation committed and pushed as `719407cfb8c5ba6f143699fe893ba2a812c5102e` |
| **P1-1a phase acceptance** | Aug 5 | **Accepted with notes** · independent on-machine review · `docs/p1-1a-signoff.md` |
| **S1–S4** — `identifierType` vocabulary · DOCFLG `ItemClass` snapshot · Legal archive sub-path · hash-index phase, orphan-DOCLOG definition, B2–B4 placement | Aug 5 | Closed · `docs/p1-0-signoff.md` |
| **A3's resolution** — `MatchGroupID` run-scoped, no bucket · `BRCode` keyed by C13's measured-collision method | Aug 5 | Closed · §2.1 below, superseding A3's "extract verbatim" instruction |
| **Seed provenance** — every seed field carries `extracted`, `authored` or `absent` | Aug 5 | Closed · replaces the blanket source gate |
| **B1** — byte storage is per capture · no sharing · no reference counting · purge is not erasure | Aug 5 | Closed · `docs/p1-0-b1-decision.md` · §2.2 below |
| **P1-0 phase acceptance** | Aug 5 | **Accepted; the four-item carve-out was closed by P1-0d** — see §2 |
| **O7 — `CaptureQuality` durable rule** | Aug 5 | **Closed prospectively.** Historical prototype rows retain honest SQL `NULL` with `absent` provenance and produce no validator finding; every new Sibyla capture must supply `CaptureQuality` at capture time, and the validator warning applies only to non-imported rows. |
| **O8 — P1-1b governed source-manifest conflict** | Aug 6 | **Closed by O8-D1/D2.** Import all source DOCEFL `EF0000001`–`EF0000052` with honest per-field provenance; re-author only the never-used Monthly-gap target row to `EF0000053`; explicitly exclude the uncoded twentieth source DOCTYP row while retaining the accepted authored `Include | ArchiveOnly` target rule and 19-row DOCTYP import manifest. |
| **O9 — P1-1b import-contract conformance** | Aug 6 | **Closed by O9-P and O9-D1…D5.** Historical completeness gaps import as honest SQL `NULL` / `absent` and become named non-blocking data-quality findings; identity controls still fail closed. `DirectDebit` is target-only nullable with no default; `TaxIdVerificationStatus` and DOCEFL `ItemClass` are nullable for honest historical import; the normative six-literal `ReviewPriority` set completes the CHECK; imported terminal DOCFLG rows are exempt from the evidence CHECK. Implementation remains pending. |
| **O10 — historical DOCFLG snapshot/FK representation and rejected-step remediation** | Aug 6 | **Closed by O10-D1/D2.** Imported DOCFLG snapshot `ItemClass` is nullable and honest `NULL` / `absent`; the composite FK stays under `MATCH SIMPLE`, a plain `EFCode` FK always binds instance to rule, and a prospective CHECK requires complete non-imported snapshots. The third implementation was rejected and neutralized. Amendment 3 authorizes four independently reviewed pieces; amendment 4 authorizes Piece A only after reformulated prototype preflight checks 1–5 pass; amendment 5 accepts Piece A Reject #1 in full as binding A-R1…A-R4 and authorizes attempt #2 as a remediation of the rejected piece candidate, behind a test-plan gate. No decision or baseline is reopened by any of the three. |

### C1–C19 — settled, and here is the sentence that keeps getting lost

**Every one of C1 through C19 was decided on 2026-08-04 and none of them is an open question.**
Where an entry carries *needs Luís to confirm*, the decision **is taken, is applied, and is
implementable today**; Luís may object later and it is reversible until he does. Where an entry
carries *Needs Luís* without "confirm", it is **an action in his own repository**, not a decision.
C8's five-pair ENTBNK source action was completed on Luís's behalf under Miguel's 2026-08-06
authorization and remains flagged for Luís's review on return. C13's seven residual FL collisions
remain a Luís-side action and all resolve on the `DetectedAt` tiebreaker.

**No .NET design or decision was blocked on Luís after 2026-08-04.** The decision pack
`docs/FDR-to-Sibyla-decisions-for-Luis-v2.md` records that historical point in its closing line.
It did not remove the source-data execution gate recorded on 2026-08-05; that gate is now closed
by the authorized on-behalf source merge and the new immutable pin/blob-roster amendment in
`docs/p1-1b-status.md`. Reporting a *decision marker* as a blocker remains a misreading. Piece D's
fresh independent review is now recorded with a Reject verdict. Scope 1 remains unauthorized; the
existing confirm-pin-or-re-pin checkpoint is neither new nor already satisfied. This review is not
an import result and no database work has run.

The same applies to the 94.6% reconciliation figure: it is a reconciliation between two metrics,
not an input. Sibyla's **55.9%** is explicitly defined and stands on its own.

---

## 2 · What is actually open — the whole list

One item: O5. If something is not here, it is decided.

| # | Open item | Blocks | Who closes it |
|---|---|---|---|
| **O5** | **P1-2 restricted-token / service-identity design**, covering the PDF helper and the Claude CLI child process, validated on the target host | Production | **Miguel** — carried since v3.2, depends on nothing else |

**O1a is closed.** P1-0d transcribed all 19 DOCTYP rows and the original 45 DOCEFL rows; O8-D1
extends the governed DOCEFL source manifest to all 52 rows at pin `b917685…`. All present source
fields carry source/blob and per-field `extracted` provenance and absent fields remain honest. The
two ITMCLS CLCode mappings remain unchanged. C9 and C15 are closed.

**O1b is closed.** The C11 sentinel remains `EF0000000`; O8-D1 re-authors the never-used C12
Monthly-gap row once to `EF0000053`; D6 BNKMAT remains `BT000012`. Every field remains marked
`authored` or `absent`; no missing field was inferred. C11, C12, and D6's row-level completion are
closed.

**O4 is closed.** The operative drafts now define counter-signed Discard for Posted/ReferenceOnly,
the exact `RestoreForReview` target, legal entry transitions for fresh/malformed/NOT_A_DOCUMENT
captures, and the canonical `CounterpartyCodeName` path/filename mapping.

**O2 is closed.** See §2.1. **O3 is closed.** See §2.2.

### 2.3 · P1-1a deliverables — what shipped and one corrected record

**Shipped 2026-08-05 as `e2f4c2a` on `feature/p1-0d-follow-up`, pushed:** the single migration
`20260805180000_P11aFdrSchema`, `P11aSchemaSql` (1,764 lines of explicit DDL), the EF model
configuration, the ported `CodeIdentityStabilityVerifier`, synthetic authored-row fixtures, and a
disposable-PostgreSQL acceptance suite. 18 files, 9,665 insertions. Build clean at **0 warnings**;
**601/601** normal tests and **9/9** `P11aDatabase` tests pass; the disposable container is removed
in `finally` and none was left behind. Measured window 14:13:55 → 17:08:56 UTC (**2h55**).

Two implementation facts worth not re-litigating, because both look like defects and are not:

- The test that sets `sibyla.actor='forged-allocation-actor'` and
  `sibyla.authorities='AllocatePermanentCode'` is **falsifying those GUCs on purpose**. It proves
  authorization does not derive from caller-controllable settings; the function uses the
  server-side trusted principal keyed by `session_user`. Do not "fix" it.
- `VSTestTestCaseFilter` defaults the test project to `Category!=P11aDatabase` so the ordinary
  `dotnet test` command is deterministic without infrastructure. The mandatory runner
  `scripts\run-p11a-disposable-tests.ps1` overrides it on the command line with
  `Category=P11aDatabase`. Both halves are intended.

**Shipped 2026-08-05 as `719407cfb8c5ba6f143699fe893ba2a812c5102e` on
`feature/p1-0d-follow-up`, pushed:** deliverable 2, the validation service implementing the
documented check set. O6 is closed. The four record corrections are included in the immediately
following closure commit on the same branch; its self-referential hash is intentionally not stated
in its own content. **At that point, nothing in P1-1b had shipped.** P1-1b has since started with
its records-only stage; no Scope 1–8 implementation has started.

**Record corrected by deliverable 2:** `docs/p1-1a-status.md` formerly closed with *"No … commit,
push, merge, or rebase was performed."* Git shows `e2f4c2a` committed **and pushed** at 17:08:56
UTC. The file now records the commit and push while retaining the true scope exclusions. The commit
body still contains literal `\n` escape sequences instead of newlines; history is not rewritten.
Nothing about the schema itself is in doubt.

### 2.1 · O2 — closed 2026-08-05, and why it did not close by extraction

A3 instructed that both natural keys be **extracted verbatim** from the prototype, the way D2's
were. **The pin falsified that premise**, and P1-0c's evidence is the finding, not a failure:
`build_bnkrec.py` assigns `BRCode` sequentially from current row order and derives `MatchGroupID`
from a per-run group sequence — `(MatchStatus, BMCode)` for Unmatched, Internal and Matched (payout
reconciliation), `(MatchStatus, MatchedRef)` for other statuses. A recomputed view has no permanent
identity to extract. The two cases are therefore separated:

- **`MatchGroupID` loses its CodeLedger bucket.** It is a per-run grouping label, not an entity.
  It is recorded as **run-scoped and explicitly non-permanent**, is never quoted as a stable
  identifier or cited in a decision record, and its bucket comes out of P1-1a's ledger scope.
- **`BRCode` keeps its bucket.** Its permanent natural key is chosen by the method **C13 already
  established and this project already accepts**: candidate tuples measured against the pinned data,
  distinct and collision counts reported in C13's table shape, lowest-collision defensible candidate
  taken. If no candidate reaches zero collisions, the residual is reported and no key is chosen —
  C13 kept three collisions visible rather than hiding them, and that precedent governs here.

Issuance for `BRCode` remains **P1-1b**. P1-1a creates the column and the surviving bucket only.

### 2.2 · O3 / B1 — closed 2026-08-05 by specifying the storage model

B1 was recorded as *"the most severe item on either list"*: purging a discarded capture destroying
the bytes of a `Posted` sibling. **The symptom was real; the cause was that the storage model was
never written down.** §2.4 of the lifecycle draft deletes *"every byte object belonging to the
capture"* while §6 makes byte-identical captures distinct rows over one canonical hash record, and
neither section says whether a byte object belongs to a capture or to a hash.

**Decision: byte storage is per capture.** A byte object belongs to exactly one capture event and
is never shared, even between byte-identical captures. `RetainedContentHash` is a duplicate-detection
index and is **never** a storage pointer. Reference counting — the previously recorded default — is
**not** implemented: the sharing that would require it is removed instead. §1's `Purged` invariant
is therefore true exactly as written, and §3's eligibility predicate stays unchanged as a second,
independent barrier rather than the only one.

**Purge is capture-scoped storage hygiene. It is not RGPD erasure**, and nothing in P1-1a may be
named, documented, logged or presented as erasure. Content-level erasure — every copy of a hash
across every capture — is a **named future capability, out of P1-1a scope and not implemented**;
when designed, §3 governs its conflict with fiscal retention and retention wins.

Full reasoning, the rejected alternatives, what P1-1a implements and what P1-0d folds into the
draft: **`docs/p1-0-b1-decision.md`**.

---

## 3 · Phase state

**Current P1-1b phase edge:** Pieces A, B, C, and D are all independently Accepted — Piece D
attempt #2 candidate `a4d40aac…` at **Accept: 0 Critical, 0 High, 0 Medium, 1 Low (D-A2-L1)**,
published at `744424df167af52b9680d0f46bfca50225422138`. **Amendment 4's Scope 1 re-pin checkpoint
is decided: Miguel confirmed pin `b917685…` by path (a)**, with post-pin prototype evolution handled
as later governed imports under closed D4–D9; path (b)'s O11-class re-pin was **not** taken and no
closed decision is reopened (`docs/AGENT-PROMPT-v5-P1-1b-scope1-pin-confirmation.md`, verbatim
decision plus that record's own fresh read-only amendment-4 preflight — 49/49 roster cell by cell,
48/48 direct surface plus one `Backups` tree, pin ancestral to live `3dd4150…`, divergence metadata
only, no post-pin content read or adopted). **Scope 1 is ready to seek its own go-ahead. It has not
started, no Scope 1 go-ahead exists, and its own execution preflight has not run** — that preflight
is separate from this records checkpoint preflight and must be run fresh by the session performing
Scope 1 (finding D-A2-L1: adoption is inadmissible). Option A, D-M2-A, and D-M3-A+ remain operative;
the five baselines, the pin, the accepted objects, and all closed O8/O9/O10 and D4–D9 decisions are
unchanged. Item 5's real-population proof remains deferred to Scope 1; O5 remains the project's
other open item, and project-evolution-page work remains unauthorized. **Merge:** Miguel authorizes
a **further, normal `feature/p1-1b` → `main` merge** once the three-path pin-confirmation commit is
committed and pushed — **ordinary merge commit only**, and **not yet performed**; see *Merge
authority — granted, not yet exercised* at the end of this section.

| Phase | State |
|---|---|
| **P1-0** | **Accepted and fully closed 2026-08-05.** P1-0d closed C9, C11, C12 and C15 with extracted/authored/absent provenance. |
| **P1-0c** | **Superseded and closed.** It stopped at its mandatory source gate — correctly against its own instructions, and wrongly against the project: three of the six values it was told to *extract* are v5.0 rows that the deciding corrections *create*, so no pin can hold them. Its findings in `docs/p1-0c-status.md` are accurate and are reused. **Do not re-run it; it stops again identically.** |
| **P1-0d** | **Complete.** Decisions are folded into the six drafts; A2 and B2/B3/B4/B12 are specified; O1a/O1b are closed; A3 is measured and recorded. |
| **P1-0e** | **Complete.** The authored rows and schema declarations agree on all thirty previously forbidden blanks; heading, B1-state, and line-ending defects are corrected. |
| **P1-1a** | **Accepted with notes 2026-08-05** — deliverable 1 (migration train) `e2f4c2a9e271efc55ccfd8b2d1d199540ab372ff`; deliverable 2 (validation service) `719407cfb8c5ba6f143699fe893ba2a812c5102e`; closure `74d8635848278b0d479f23c4e0090a6bdbac8480`; independent sign-off `docs/p1-1a-signoff.md`. Migration train + validation service, disposable database, synthetic fixtures, and group B are complete; O6 is closed. The accepted schema retains the specified DOCEFL/BNKMAT nullability and governed inactive-rule activation mechanism, server-side authority boundary, and B1 per-capture tombstone invariant. O8's records-only code re-authoring has not changed implementation. |
| **P1-1b** | **All four pieces (A, B, C, D) are independently Accepted.** Piece D attempt #2 candidate `a4d40aac…` received the separately authorized independent integration review with verdict **Accept: 0 Critical, 0 High, 0 Medium, 1 Low (D-A2-L1)**. D-R1 is closed at the root and proven non-vacuous by adversarial fault injection (oracle contamination, post-`Down` cluster-global role, equal-but-empty constraint sets, and a hostile pre-existing `sibyla_piece_c_executor` failing all 61 Facts in 139 ms); D-R2 is closed. Inventory verified against rejected `bf5926e…` by measured `[Fact]` counts 55/61/61, 0 added Facts: 0 new test methods, 1 new helper, 1 new fixture, 1 strengthened method, 4 byte-identical regressions. Independently reproduced: Release 0 warnings/errors; ordinary 646/646; Registry 33/33; focused 1/1; regressions 4/4; PostgreSQL 17.10 runner 61/61; exact three paths; unchanged accepted blobs/functions; 0 residual/running containers. **D-A2-L1 (Low, recorded not waived):** the implementing session adopted the host's preceding amendment-4 preflight instead of running it fresh, which checklist item 1 does not permit; preflight adoption is inadmissible going forward, though the reviewer re-ran all six checks fresh with identical results. Option A, D-M2-A, and D-M3-A+ remain operative. **The confirm-pin-or-re-pin checkpoint that Accept unlocked has since been decided: Miguel confirmed pin `b917685…` by amendment 4's path (a) (`docs/AGENT-PROMPT-v5-P1-1b-scope1-pin-confirmation.md`); path (b)'s O11-class re-pin was not taken and no closed decision is reopened.** **Scope 1 is ready to seek its own go-ahead; it has not started and its own execution preflight has not run.** Item 5 remains deferred to Scope 1; O5 and project-evolution work remain unauthorized. O8/O9/O10 and D4–D9 decisions, baselines, pin, accepted-object scope, and prior Accepts remain unchanged. |
| **P1-2 → P1-13** | Not started |

**Still not authorized:** starting Scope 1 itself — the confirm-pin-or-re-pin checkpoint is
satisfied by path (a), which makes Scope 1 **ready to seek its own go-ahead**, not started; running
any Scope 1 importer/import, shared or live database write, or prototype write ahead of that
go-ahead and Scope 1's own fresh execution preflight (the records checkpoint preflight in
`docs/AGENT-PROMPT-v5-P1-1b-scope1-pin-confirmation.md` does not discharge it); re-pinning to any
commit after `b917685…`, or treating path (b)'s O11-class re-pin as available without a new
governed Miguel decision; adopting a preflight run by a previous session instead of running one
fresh (finding D-A2-L1); deviating from
D-M3-A+'s imported terminal
NULL-evidence fixture, ordered first-append/second-overwrite assertions, exact `23514` message,
audit/provenance/value checkpoints, or whole-transaction rollback; deviating from D-M2-A's item-6
contract; altering/bypassing an accepted lifecycle object, including changing
`RejectTerminalDOCFLGMutationFn`; changing
physical ordinal diagnostics beyond excluding them only from S1/S3 logical equality; using curated
catalog rosters or lossy counts in place of the complete dynamic oracle; any Piece D
migration-content change under the present scope;
resurrecting or
cherry-picking any part of `b324a3e…`, `57f0f023…`, `7ea6c0f…`, rejected Piece A candidate
`6f86023d…`, or rejected Piece B candidate `b8fa033…` as-is (`b8fa033…` was remediated only under
the approved B-R1 diff, never merged unchanged); reading or adopting post-pin prototype content;
any shared/live database write before the complete disposable P1-1b rehearsal passes and a verified
fresh backup exists; production deployment while O5 is open; or claiming P1-1 acceptance.

**Recitals — governed decisions and candidate dispositions.** O9 and O10 remain governed on the
record. All three attempted step-3 implementations are rejected and
neutralized evidence only, as is Piece A candidate `6f86023d…` and Piece B candidate `b8fa033…` —
Piece A **attempt #2** (`f6f297b…`), Piece B **B-R1 remediation** (`7059809…`), and Piece C
(`ce983b2…`) are accepted. Piece D candidate `bf5926e…` is rejected; its candidate record and earlier
stopped attempts remain historical evidence. Piece D **attempt #2** (`a4d40aa…`) is accepted at
Accept 0/0/0/1 Low. Miguel's explicit Option A amendment closed D-M1 through the independently
reviewed and pushed approval commit `6554a8ed71fb0992b198e4b9d2e2e276d62b9cd4`; that records-before-TDD sequence
completed, the subsequent TDD attempt stopped at D-M2, Miguel's D-M2-A approval governs item 6,
and the next six-test attempt reached 5/6 before the standalone item-8 overwrite shape stopped at
D-M3. Miguel's D-M3-A+ approval governed rejected candidate #1; the D-R1/D-R2 remediation approval
governs the present attempt #2 candidate. Every records commit that changes
`docs/p1-1b-status.md` or
`docs/p1-1b-o10-independent-review.md` must update this file in the same commit.

### Merge authority — granted, not yet exercised

**Merge — two distinct things, kept apart.** *(i) Already-performed history:* the recorded Git
topology has `feature/p1-2-o5-prep` merged into `feature/p1-1b` at `a445478`, and an **earlier**
`feature/p1-1b` merged into `main` at `f1488ac`. Both are past events. Because of them the earlier
blanket "no merge is authorized" wording is retired as a statement of *current* state — it was true
at each moment it was written and those historical entries stand unaltered. *(ii) Newly authorized
and not yet performed:* Miguel authorizes a **further, normal merge of `feature/p1-1b` into
`main`**, permitted only **after this exact three-path pin-confirmation commit is committed and
pushed** — **ordinary merge commit only; no rebase, squash, amend, reset, or force push.** This
further merge is **not `f1488ac`**; `f1488ac` is the earlier, already-performed merge and is not the
authorization being exercised. The further merge is **not performed by this pin-confirmation records
pass**, changes no pin, baseline, closed decision, or accepted object, and neither starts Scope 1 nor
supplies Scope 1's go-ahead or execution preflight. **This records pass states no merge SHA solely
because the merge has not occurred yet** — a fact about this pass, not a standing prohibition; the
later merge session records the actual SHA.

---

## 4 · Precedence when documents disagree

**Highest first:**

1. **`docs/PROJECT-STATE.md`** — this file, for *state*
2. `docs/p1-0-corrections.md` (C1–C19) — for corrected design
3. `docs/p1-0-a-group-decisions.md` (A1–A7, C3, group B), `docs/p1-0-signoff.md` (S1–S4) and
   `docs/p1-0-b1-decision.md` (B1 — which supersedes the group-A file's §B1 recorded default)
4. `docs/p1-0-vocabularies.md` — generated annex, normative for every literal
5. The six P1-0 drafts
6. `docs/project-todo.md`

A contradiction between two documents at the same level is **reported, never resolved silently**.

### Documents that are history, not state

Useful, accurate at their date, and **never to be quoted as current status**:
`p1-0-review-findings.md` (*"do not sign off yet"* — superseded by the Aug 5 acceptance),
`FDR-to-Sibyla-decisions-for-Luis.md` and `-v2.md` (letters, dated Aug 3 and Aug 5),
`p1-0b-status.md`, `p1-0c-status.md` and any future `p1-0d-status.md` (assignment reports),
`p1-0-residual-triage.md` (the A/B/C triage, now decided by the group-A file),
`AGENT-PROMPT-*.md` (instructions written for one assignment at one moment),
**`p1-1a-status.md`** (an assignment report; its formerly stale final line was corrected by
deliverable 2 — see §2.3).

**Carve-out from the `AGENT-PROMPT-*.md` class:**
`AGENT-PROMPT-v5-P1-1b-scope1-pin-confirmation.md` is **not** a point-in-time executable
instruction. Despite its filename it is a **governed decision record** — it carries Miguel's
verbatim path-(a) pin confirmation, and that decision stands as decided rather than expiring with
the assignment that wrote it. It is therefore cited for the decision it records, not read as an
instruction to execute. This file remains the **sole authority for current state**: where the
confirmation record and this file could be read as disagreeing about *status*, this file governs.

---

## 5 · State changelog

| Date | Change |
|---|---|
| 2026-08-07 | **Amendment 4's Scope 1 re-pin checkpoint decided by Miguel: path (a) — the pin is confirmed.** Recorded verbatim in `docs/AGENT-PROMPT-v5-P1-1b-scope1-pin-confirmation.md`: `b91768513fc638381fbde91f0b576b08220a98f6` is confirmed as the historical-import snapshot, and post-pin prototype evolution is handled as later governed imports under the already-closed **D4–D9** additive-period-imports decisions. **Path (b), an O11-class re-pin, was not taken**, so none of its preconditions is triggered — no roster/blob/surface re-verification at a new pin, no re-measurement of the five baselines, no C8 (43/43/0/0) or C13 re-measurement, no DOCTYP manifest re-check, and no verified-free re-check of `EF0000053` or any authored code against a changed `permanent_code_ledger.json`. **Nothing in any closed decision is reopened:** O8-D1/D2, O9-P, O9-D1…D5, O10-D1/D2, and D4–D9 govern unchanged; baselines remain 119 / 119 / 52 / 221 / 2,787 with both `Routine` rows importing verbatim; the non-adoption rule stands. The checkpoint became reachable through Piece D attempt #2's Accept, with all four pieces accepted — the reviewed **candidate** is `a4d40aac429584baed3481d62c2f859dd4ad2860`, while the **verdict** is recorded in `docs/p1-1b-o10-independent-review.md` and **published** at `744424df167af52b9680d0f46bfca50225422138`; the candidate commit and the review-publication commit are distinct objects and neither is a synonym for the other. The confirmation carries **this records session's own fresh read-only amendment-4 preflight**, measured immediately before the write against `D:/fileStorage/repos/invoice-skill-build` after `git fetch` — not an adopted prior result, honouring D-A2-L1: pin resolves locally and in the fetched remote (Pass); pin ancestral to live `origin/main` `3dd4150caef7e3a1d2a77c5fa34361d2aefe4c54` (Pass); local clone `HEAD` equals the pin with a clean tree (Pass); effective governed roster measured cell by cell **49/49, 0 mismatches, 0 resolve failures** with `entbnk` substitution blob `70d418f6023bff68f0d642b4aff26c1ead1298be` (Pass); direct pinned `Editor/Data` surface **48/48 direct blobs, exactly one `Backups` tree, 0 missing, 0 extra** (Pass); check 6 metadata only — live tip `3dd4150…`, post-pin commits `1e841a4f9a88cd6a5e90e6632dff54185be9949e` (*Complete Stage 10 Round 8 reconciliation and mapping updates*) and `3dd4150caef7e3a1d2a77c5fa34361d2aefe4c54` (*Apply Stage 10 Round 8 revenue review updates*), with **no post-pin content read or adopted**. That preflight is the **records checkpoint preflight, not Scope 1's execution preflight**, which the session performing Scope 1 must run fresh itself. **Scope 1 is ready to seek its own go-ahead and has not started:** no Scope 1 execution preflight ran, no go-ahead exists, and no importer/import, shared or live database write, prototype write, O5, baseline, closed-decision, or project-evolution-page work was performed or authorized. Records-only pass over exactly three paths — the pin-confirmation record, `docs/p1-1b-status.md`, and this file — with no build, test, container, or database run, and **no post-pin prototype content read, inspected, or adopted** (checks 4–5 used only the authorized pin-anchored roster/surface measurement). **Merge authority recorded, not exercised:** Miguel authorizes a **normal merge of `feature/p1-1b` into `main`** only **after this exact three-path pin-confirmation commit is committed and pushed** — **ordinary merge commit only; no rebase, squash, amend, reset, or force push**. That merge is a **further, not-yet-performed** merge, distinct from and **not** the earlier already-performed `feature/p1-1b`→`main` merge at `f1488ac` (nor the `feature/p1-2-o5-prep`→`feature/p1-1b` merge at `a445478`). It is not performed here, changes no pin/baseline/closed decision/accepted object, and neither starts Scope 1 nor supplies its go-ahead or execution preflight. **This pass states no merge SHA solely because the merge has not occurred yet** — not a standing prohibition; the later merge session records the actual SHA. |
| 2026-08-07 | **Piece D ordered instruction 4 executed in an exclusively-review session; verdict Accept — 0 Critical, 0 High, 0 Medium, 1 Low (D-A2-L1). All four pieces are now independently Accepted.** Reviewed candidate `a4d40aac429584baed3481d62c2f859dd4ad2860` against approval tip `a0529093…`, trusting no implementer summary. D-R1 is closed at the root — the rejected candidate's `EnsureMigrated`→`Down`→capture-S0 sequence is deleted and S0 now comes from a separate oracle database migrated from empty only to `20260805180000_P11aFdrSchema`, captured in class-fixture init before any Fact while the cycle database is asserted empty, immutable and never rebased. Equality was not accepted as proof of itself: four original adversarial probes were run and removed before the verdict — an injected oracle table, a cluster-global role created after `Down`, an equal-but-empty four-checkpoint constraint set (failing `Expected: 4, Actual: 0`), and a hostile pre-existing `sibyla_piece_c_executor` failing all 61 Facts in 139 ms. A fifth probe removed the `[TestCaseOrderer]` attribute and reproduced the implementer's honest 60/61 observation, proving the orderer load-bearing and within the approved inventory rather than unapproved surface. Inventory verified against rejected `bf5926e…`: measured `[Fact]` counts 55/61/61, 0 added Facts; the only deleted line in the base→candidate test diff is the class declaration, so the four regressions are byte-identical. Independently reproduced: clean Release rebuild 0 warnings/0 errors; ordinary 646/646; Registry 33/33; focused 1/1; regressions 4/4; canonical runner 61/61 on PostgreSQL 17.10; `git diff --check` clean working and cached; exactly three changed paths; eight accepted migration/SQL blobs byte-identical; `RejectTerminalDOCFLGMutationFn` live-stable at S0/S2 `525`/`48af12cf…` and S1/S3 `1107`/`f9bfc42f…`; 0 residual and 0 running `sibyla-p11*` containers. A stale-assembly trap (restored file carried an older timestamp, so MSBuild reused the probe assembly and a run reported 60/61) was root-caused, rebuilt `--no-incremental`, and re-run at 61/61 — reported rather than hidden. The reviewer also ran the amendment-4 preflight fresh and read-only against the prototype clone: pin reachable and ancestral to live `main` `3dd4150…`, clone anchored and clean, governed roster measured cell by cell 49/49 with 0 mismatches, direct surface 48/48 plus 1 `Backups` tree with 0 delta, and check 6 metadata only. **D-A2-L1 (Low):** the implementing session adopted the host's preceding preflight rather than running it fresh, which checklist item 1's "pass fresh" does not permit; recorded and not waived, adoption is inadmissible going forward, but materially inert here and discharged by the reviewer's own fresh run. Accept authorizes Scope 1 only to seek its own preflight and confirm-pin-or-re-pin checkpoint; Scope 1 was not started and no merge was performed. |
| 2026-08-07 | **Piece D attempt #2 ordered instruction 3 completed; candidate published, awaiting separately authorized instruction 4.** Started exactly from pushed approval tip `a0529093838b2fd95d40c5057db6dd896e9b85fc`. Strict TDD recorded a real fixture-surface RED (1/1 failed only because the pristine oracle was not implemented) then GREEN 1/1 on the same slice. `CreatePieceDPristineP11aOracleDatabaseAsync` and `PieceDPristineP11aOracleFixture` create/capture immutable pristine P1-1a S0 before any Fact/Piece C role, use a distinct oracle and cycle database in one PostgreSQL 17 invocation, enforce fresh-cluster preconditions and fixed first-test ordering, and clean up fail-safely. The strengthened combined method proves independent-origin S0==S2 logical+physical, S1==S3 complete logical under Option A, S0!=S1, exact histories, all-four literal `ImportEvidenceRow` constraints at each checkpoint plus within-run name/index equality, and live stable `RejectTerminalDOCFLGMutationFn` definitions across S0/S2 and S1/S3. Inventory is exactly 0 new Facts relative to rejected candidate #1, 1 new helper, 1 new fixture, 1 strengthened method, and 4 byte-identical regressions. Final envelope: Release 0 warnings/errors; ordinary 646/646; Registry 33/33; focused 1/1; regressions 4/4; canonical runner 61/61; exact three paths; clean diff/secret checks; eight accepted blobs unchanged; 0 residual/running containers. The host preflight passed pin/ancestry/anchor, 49/49 roster, and 48/48+tree surface; post-pin metadata only was recorded and no post-pin content read/adopted. This record issues no verdict or self-review and authorizes no instruction 4, Scope 1, item 5, O5, merge, evolution, importer/import, shared/live database, migration/DDL, or accepted-object work. |
| 2026-08-07 | **Piece D Reject #1 remediation mapping approved; ordered instruction 3 authorized after this records commit is pushed.** Miguel's verbatim approval is recorded in `docs/AGENT-PROMPT-v5-P1-1b-piece-d-remediation-approval.md` and covers D-R1, D-R2, D-R1-O1, D-R1-O2, D-R1-O3, and D-R2-O1 item by item. “One disposable run” is one PostgreSQL 17 container/test invocation with two isolated databases. Fixed order captures immutable S0 before any Piece C cluster-global role; the class fixture runs before any Fact and fails closed on violated fresh-cluster/shared-connection ordering preconditions. Every S0–S3 checkpoint asserts cardinality four and the four exact `pg_get_constraintdef` definitions without creating a stable contract over generated names. Inventory remains 0 new test methods, 1 new helper, 1 new fixture, 1 strengthened shared method, and 4 unchanged regressions. Option A, D-M2-A, D-M3-A+, every accepted object, `RejectTerminalDOCFLGMutationFn`, and all eight accepted migration/SQL files remain intact. This is the second/final Piece D attempt before escalation; a second Reject stops and escalates to Miguel. This approval authorizes only instruction 3 after push, not instruction 4, Scope 1, item 5, O5, merge, evolution, importer/import, shared/live database work, migration/DDL, or accepted-object changes. No build, test, database, container, or amendment-4 preflight ran in this records pass. |
| 2026-08-07 | **Piece D Reject #1 Step 2 remediation mapping authored records-only; stopped at Miguel's approval gate.** Published neutralization `46946c6e3aae5e366e5d601a3aea9d0677b3f200` remains the governing tip. The D-R1/D-R2 mapping proposes the second/final remediation attempt, which has not begun: 0 new test methods, 1 new helper, 1 new test fixture, 1 strengthened shared test method, and 4 unchanged regressions. Adversarial review added D-R1-O3, the fixture-lifecycle/shared-cluster ordering collision, alongside unresolved D-R1-O1, D-R1-O2, and D-R2-O1. Explicit Miguel approval of both findings and all four observations is required before implementation; no execution is authorized or performed. Option A, D-M2-A, and D-M3-A+ remain intact; a second Reject stops and escalates to Miguel; all forbidden scope remains unchanged. |
| 2026-08-07 | **Piece D independently reviewed and Rejected; stopped after ordered instruction 4.** Candidate `bf5926e3bba9afca394baf669f95c72506886056` was reviewed against approved tip `9ba2bdd468be32d1de36f7ee7cd9d1607949dc6a`; verdict **Reject: 0 Critical, 1 High, 0 Medium, 1 Low**. Binding High D-R1: the combined S0→S1→S2→S3 test migrates the full tip down before capturing S0, so S0 and S2 are repeated outputs of the same candidate `Down`; equal residue can pass and post-Down equality to an independent pristine accepted-P1-1a oracle is not proven. Binding Low D-R2: the combined item-4 method compares helper outputs without asserting cardinality four and the four exact definitions; the passing Piece A exact-definition test and complete catalog snapshot mitigate severity but do not complete Piece D's own literal assertion. Exact delta: the Piece D test plus `docs/p1-1b-status.md` and this file; no migration/DDL/`src`/Designer/ModelSnapshot/script/importer/O5/baseline/pin path changed. Eight accepted migration/SQL blobs and extracted `RejectTerminalDOCFLGMutationFn` are byte-identical across base/candidate/worktree; the function is 1,099 normalized bytes, SHA-256 `398fe93dc5f2dadfa9bbc87ccd7a12b8886cfcb90fe99a8f51ae9107d1f8855c`. Independently reproduced: Release 0 warnings/errors; ordinary 646/646 after the current Debug build; registry 33/33; Piece D 6/6; seven exact regressions 7/7; PostgreSQL 17 runner 61/61; clean working/cached diff checks; 0 residual/running containers. Passing tests do not overcome D-R1. Option A is otherwise correctly shaped; D-M2-A and D-M3-A+ pass in their binding forms; the effective writer roster shape is correct. Per the governing instruction, no remediation is authorized or performed, Scope 1 remains unauthorized, item 5 remains deferred, O5 remains the only project-open item, and no merge is authorized or performed. |
| 2026-08-07 | **Piece D ordered instruction 3 completed; candidate published for fresh independent review.** From pushed D-M3-A+ approval tip `9ba2bdd468be32d1de36f7ee7cd9d1607949dc6a`, hard-start equality/cleanliness and Amendment-4 checks passed fresh (49/49 effective roster, 48/48 direct surface; check-6 metadata only, no post-pin content adoption). Item 8 ran strict RED→GREEN: the initial exact standalone test failed compilation only on its deliberately missing provenance snapshot harness, then passed 1/1 after the minimum correction; final D-M3-A+ proof is imported/Resolved/initially-NULL, first append succeeds with zero audit and unchanged single provenance row, second overwrite fails exact `23514` / `terminal DOCFLG rows are append-only`, first value remains intact, whole transaction rolls back. Final measured envelope: Release build 0 warnings/errors; ordinary 646/646; registry 33/33; focused Piece D 6/6; seven exact regressions 7/7; full disposable PostgreSQL 17 runner 61/61; clean working/cached diff checks; exact three changed paths; all eight accepted migration/SQL blobs and `RejectTerminalDOCFLGMutationFn` byte-identical; 0 residual/running containers. Option A and D-M2-A passed in binding shape; item 5 remains deferred with no synthetic count theatre. **Candidate only, not accepted; ordered instruction 4 has not begun; Scope 1 remains unauthorized; O5 unaffected.** |
| 2026-08-07 | **Piece D D-M3 clean stop recorded and D-M3-A+ approved by Miguel; D-M3 closed at the governed records gate.** Verbatim: "Aprovo D-M3-A+". Fresh amendment-4 preflight passed 49/49 effective roster and 48/48 direct pinned surface. The six-test focused progression reached 5/6 green, including item 6 under D-M2-A. The standalone item-8 test failed SQLSTATE `23514`, exact message `terminal DOCFLG rows are append-only`: the accepted `RejectTerminalDOCFLGMutationFn` exception requires an imported terminal row with `OLD."ResolutionEvidence" IS NULL`, `NEW."ResolutionEvidence" IS NOT NULL`, matching forged GUC, and every other column unchanged, while the approved fixture already had evidence and attempted overwrite. D-M3-A+ supersedes only that item-8 shape: imported terminal fixture, initially `NULL` evidence, first direct append succeeds under the forged matching GUC, second overwrite fails `23514` with the exact message, no audit row is created, the same single `ItemClass` provenance row stays unchanged, the failed overwrite preserves the first appended value, and the transaction rolls back. The function remains byte-identical. Measured clean-stop disposition at starting tip `9c3a0c19eccbce9a4d9b97d303a8b8f584af4442`: empty worktree/staging; clean `git diff --check`; `P11aDisposableDatabaseTests.cs` `HEAD` blob and worktree hashes both `06bcc991e0cac6ff43697251ae131a1c97063d22`; all eight accepted migration/SQL paths matched `HEAD` (0 mismatches); no commits after the tip and 0 `src/`/`tests/` changes; 0 residual and 0 running `sibyla-p11*` containers; only `D:/fileStorage/repos/GOTT.Sibyla` registered as a worktree, with `D:/fileStorage/repos/GOTT.Sibyla-piece-d` absent. These are measured disposition facts. No Piece D candidate exists. Ordered instruction 3 may resume only after this exact three-path records commit is independently reviewed, committed, and pushed; TDD starts fresh from that tip. Scope 1 remains unauthorized pending Piece D's fresh independent Accept. O5 remains the only project-open item; D-M3 is phase execution state, not a new project-open item. No accepted-object, migration, DDL, `src/`, test, fixture implementation, helper, importer, Scope 1, O5, shared/live database, container, or project-evolution change occurred. |
| 2026-08-07 | **Miguel approved D-M2-A; D-M2 closed at the governed records gate.** Verbatim: "Aprovo D-M2-A". Piece D item 6 is amended exactly to the published D-M2-A alternative: native and imported active-company proof rows start `Open`; each performs exactly one atomic Open→terminal `UPDATE` setting `ItemClass='Bogus'` together with `Status='Resolved'`, `ResolutionEvidence`, `ResolvedBy`, and `ResolvedAt`; every orthogonal CHECK and prerequisite is satisfied; each rejection asserts SQLSTATE `23503` and exact constraint `DOCFLG_EFCode_ItemClass_ReviewPriority_BlockingLevel_fkey`; and the NULL/`MATCH SIMPLE` proof targets remain on an imported `Open` row. The company-scoped validator expectation repair is ordinary item-6 scope, not a separate decision. Piece D has no candidate or Accept. Ordered-instruction-3 TDD is re-authorized only after this exact three-path records commit is independently reviewed, committed, and pushed, then starts fresh from that tip. Scope 1 remains unauthorized pending Piece D's fresh independent Accept; O5 remains open. Current Git topology is also recorded: `feature/p1-2-o5-prep` merged into `feature/p1-1b` at `a445478`, then `feature/p1-1b` merged into `main` at `f1488ac`. This supersedes the frozen O5-prep record's historical "Not committed, not pushed" assertion. O5-prep's review cycle closed with focused independent confirmation ACCEPT; O5 itself closes only in the target-host session. No implementation, migration, DDL, `src/`, test, fixture, script, importer, database, container, shared/live, O5-content, or project-evolution change occurred. |
| 2026-08-07 | **Piece D Option A ordered instruction 3 stopped cleanly at new gate D-M2; no candidate exists.** Hard initial state matched pushed tip `6554a8e…`; amendment-4 checks 1–5 passed fresh (effective roster 49/49, direct surface 48/48) and check 6 recorded only `3dd4150…`/`1e841a4…` metadata. Strict TDD reached green item-2 logical/physical determinism (1/1), eight-file identity (1/1), and the single combined S0→S1→S2→S3 proof (1/1): complete logical S1==S3, exact logical+physical S0==S2, S0!=S1, all four uniqueness/index definitions stable, zero non-control-plane direct writers, and fresh physical attnum drift 28/29→30/31. The next two-test item-6 slice failed 0/2: one ordinary, repairable company-scoped validator-count fixture expectation within existing item-6 scope once D-M2 is approved, not a separate governance decision; and the governing collision empirically observed by the Codex TDD attempt — for a valid ACTIVE-company row, the literal ItemClass-only UPDATE returns `23514`: `Open`/`InReview` hits the accepted P1-1a lifecycle CHECK and `Resolved`/`Superseded`/`Waived` hits Piece C's accepted replacement of `RejectTerminalDOCFLGMutationFn`. An inactive-company nonterminal row can return `23503` earlier from `RequireActiveCompanyRegistryFn`, but that is the wrong-object anti-vacuity trap. The subsequent independent review was static/read-only and confirmed the collision; it did not independently reproduce it. Any amended `23503` proof must assert exact constraint `DOCFLG_EFCode_ItemClass_ReviewPriority_BlockingLevel_fkey`. D-M2-A (recommended) uses an atomic Open→terminal UPDATE on one native and one imported ACTIVE-company row, changing `ItemClass='Bogus'` together with `Status='Resolved'`, `ResolutionEvidence`, `ResolvedBy`, and `ResolvedAt`, with every orthogonal check/provenance prerequisite satisfied; it keeps the test name/matrix and moves separate NULL/`MATCH SIMPLE` targets to an Open imported row. D-M2-B uses direct terminal INSERT for native/imported with every orthogonal prerequisite satisfied and renames the test/matrix to say on insert; it is weaker because it proves a write, not mutation. A and B assert both `23503` and the exact constraint name. D-M2-C accepts the observed `23514` fail-closed barrier and renames/rewrites the matrix accordingly; it is explicitly weaker, supplies no direct executable composite-FK proof, and is not recommended. A/B/C make no accepted object, migration, or DDL change. No mapped/accepted object was adapted. All transient test edits were removed byte-for-byte; no migration/SQL/`src`/Designer/ModelSnapshot/script/O5/Scope-1 path changed and zero project containers remained. Miguel must choose and re-approve item 6 before any Piece D item resumes. |
| 2026-08-07 | **Piece D mapping amendment Option A approved by Miguel; D-M1 closed at the governed records gate.** Exact words: "Aprovo a opção A e o mapping Piece D revisto". Physical `ordinal_position`/`attnum` remains dynamically captured, deterministic, and emitted as a separate diagnostic; it is excluded only from S1/S3 logical equality. Every other governed logical catalog property remains in the complete dynamically enumerated oracle, with no curated table/function/role lists or lossy count substitution. S0/S2 remains exact restoration proof including physical metadata where applicable; S1/S3 emits physical diagnostics for both states and leaves drift visible. The historical S1=30/S3=32 measurement is evidence, not a universal allocator constant unless freshly observed. Item 2 proves both artifacts deterministic. All other Piece D mapping items remain exactly approved. Ordered instruction 3 is re-authorized only after this exact three-path records commit is independently reviewed, committed, and pushed; TDD starts fresh from that tip. No migration, DDL, `src/`, Designer, ModelSnapshot, baseline, pin, O8/O9/O10, item 5, Scope 1, or O5 decision changes. Scope 1 remains unauthorized pending Piece D's fresh independent Accept; O5 is again the only open item. The immediately following stop entry remains historical evidence, superseded only for implementation authority by this amendment. |
| 2026-08-07 | **Piece D ordered instruction 3 attempted TDD-first and stopped cleanly at a measured mapping collision; no candidate exists.** Amendment-4 preflight passed (pin/ancestry/clone anchor, 49/49 O8 roster, 48/48 pinned surface; check-6 metadata only for `3dd4150…` and `1e841a4…`, no post-pin content adopted). Initial RED compilation genuinely failed on two transient references to nonexistent `RegistryValidationResult.FindingIds`; after correction, the focused PostgreSQL 17 run discovered 6 Piece D tests: 2 passed / 4 failed in 15.7404s. Byte identity and complete deterministic snapshot tests passed immediately. The governing item-3 proof measured S0==S2 but S1!=S3, first at `DOCFLG.ImportEvidenceRowId` physical ordinal/`attnum` 30→32: accepted Piece A drops and re-adds two columns, while PostgreSQL retains dropped attribute slots. The approved item-2 tuple includes physical ordinal and item 3 requires literal S1/S3 equality; weakening the tuple or changing accepted migration content is unauthorized. Three repairable transient fixture/probe failures were not continued. All transient edits were removed, all eight accepted migration/SQL blobs remained byte-identical, final status and `git diff --check` were clean, and zero containers remained. A read-only independent Claude review confirmed the deterministic collision but did not independently reproduce 30/32. **New open gate D-M1:** Miguel must choose Option A (recommended: report physical ordinal diagnostically but exclude it from S1/S3 equality, retaining logical/dynamic coverage) or Option B (not recommended: separately reopen Piece A), then re-approve the amended mapping. Piece D remains stopped on all items; Scope 1 remains unauthorized; O5 continues independently. |
| 2026-08-07 | **Piece D test-plan mapping approved by Miguel; implementation authorized after this records commit is pushed.** The operative approval is recorded verbatim in `docs/p1-1b-status.md` and `docs/AGENT-PROMPT-v5-P1-1b-piece-d-mapping-approval.md`. Observation 1 is decided as option (b): checklist item 5's real-population confirmation is formally deferred to Scope 1, with no synthetic count theatre and no Piece D test for that claim. Observation 2 adopts the measured eight-file migration/SQL byte-identity roster; Designer/ModelSnapshot are explicitly out of scope and remain untouched. Items 1–4 and 6–8 are approved as written; inventory 6 new tests + 1 helper, 2 strengthened, 7 existing regressions, 14 commands. Ordered instruction 3 is TDD-only verification/harness work; no migration content, no `src/` change, no importer/Scope 1 work, and no shared/live database write. Scope 1 remains unauthorized pending Piece D's independent Accept. |
| 2026-08-03 | v5.0 published; D1–D3 |
| 2026-08-04 | P1-0 freeze delivered · review found 19 blockers · **C1–C19 all decided** · D4–D9 closed |
| 2026-08-05 | P1-0b applied C1–C19 to the drafts (14 full, 5 partial on seed rows) |
| 2026-08-05 | A1–A7, C3 immutability, group B scope decided |
| 2026-08-05 | **P1-0 accepted** with the C9/C11/C12/C15 carve-out · S1–S4 decided |
| 2026-08-05 | This file created, after "blocked on Luís" was reported three times against decisions taken on 2026-08-04 |
| 2026-08-05 | P1-0c inspected prototype pin `9359c67`; required sentinel/Monthly-gap DOCEFL and D6 BNKMAT rows are absent, and A3 permanent natural keys are not defined. The assignment stopped without changing the drafts. |
| 2026-08-05 | **B1 closed by specifying the storage model rather than guarding it.** Byte storage is per capture; `RetainedContentHash` is an index, never a storage pointer; reference counting is not implemented. Purge is capture-scoped storage hygiene, explicitly not RGPD erasure; content-level erasure named as a future capability outside P1-1a. **O3 closed; the P1-1a tombstone path is unblocked.** |
| 2026-08-05 | **The stop was diagnosed as a category error in the P1-0c prompt**, not a project blocker: C11, C12 and D6 *create* the three "missing" rows, so no earlier pin can hold them. O1 split into **O1a** (transcription, no decision) and **O1b** (authoring under per-field provenance). **O2 closed**: `MatchGroupID` recorded run-scoped and loses its ledger bucket; `BRCode` keeps its bucket with a key chosen by C13's measured-collision method. **P1-0c superseded by P1-0d.** |
| 2026-08-05 | **P1-0d complete; P1-0 fully closed.** The 19 DOCTYP, 45 then-existing DOCEFL, and two ITMCLS rows were transcribed from pin `9359c67` with blob/per-field extraction provenance. C11 `EF0000000`, the C12 Monthly-gap row then governed as `EF0000046`, and D6 `BT000012` were authored with every undecided field explicitly `absent`. BRCode chose `(Company, BMCode, EntryCode, FindingDiscriminator)` after the pin-equivalent `(BMCode, EntryCode)` measured 2,072 distinct / 0 collisions; MatchGroupID is run-scoped. B2/B3/B4/B12 governance is in the drafts. O1a, O1b and O4 closed; after the earlier B1 decision closed O3, only O5 remains open. |
| 2026-08-05 | **P1-0e complete.** All thirty authored-row/schema nullability conflicts are resolved: 29 cells use honest NULLs and `BT000012.RequiresReview` is authored `Yes`. The Monthly-gap rule then governed as `EF0000046` seeds inactive behind a runnable-Decision CHECK and governed activation command; nullable `FlowDimension` retains uniqueness through `NULLS NOT DISTINCT`. B1 wording and leaked heading markers were corrected. Repository text is normalized to LF under `.gitattributes`; only O5 remains open. |
| 2026-08-05 | **P1-1a deliverable 1 shipped — the first production code since 2026-07-23.** Commit `e2f4c2a` on `feature/p1-0d-follow-up`, pushed: one regeneratable migration `20260805180000_P11aFdrSchema`, governed registry commands behind a server-side `RuntimePrincipal` (caller-set `sibyla.actor`/`sibyla.authorities` grant nothing), receipt-gated purge under B1's per-capture storage invariant, `Down` dropping only registered sequence `regclass` values, the ported identity-stability verifier, and synthetic fixtures. 18 files, 9,665 insertions; 0 warnings; 601/601 and 9/9 green; no residual containers. Measured 2h55 (14:13:55 → 17:08:56 UTC). **Deliverable 2 stopped at its then-mandatory but unsatisfiable source gate; Amendment 1 later corrected the diagnosis and authorized the documented check set.** `docs/p1-1a-status.md` was stale on its final line — it denied the commit and push — and deliverable 2 corrects that record. |
| 2026-08-05 | **O6 source rediagnosed and Amendment 1 issued.** `Scripts/validate_registry.py` never existed in the pinned prototype, remote history, or prototype machine; the earlier mechanical-clone diagnosis was a P1-0c-class category error. Amendment 1 replaced the source gate with the documented check set, requiring per-check source citations and no invented checks. |
| 2026-08-05 | **P1-1a deliverable 2 implemented, passed two adversarial review rounds, verified, committed and pushed as `719407cfb8c5ba6f143699fe893ba2a812c5102e`.** The standalone unique-filename check covers only captured `Source <> 'BNK'` rows while the global `(Filename, EntryCode) ↔ LGCode` bijection remains unchanged; ArchiveOnly/ReferenceOnly require exact DOCARC route evidence. Focused **28/28**, ordinary **629/629**, disposable PostgreSQL **10/10**, build **0 warnings/errors**, and **0 residual containers**. O6 closed; P1-1a remains active and is not accepted. The four record corrections are included in the immediately following closure commit on the same branch. The remaining `CaptureQuality` nullable-with-default versus backfill decision is Miguel-owned and non-blocking. |
| 2026-08-05 | **P1-1a independently accepted with notes** by Apolo (Nous Research), `docs/p1-1a-signoff.md`. On-machine reproduction: build **0 warnings/errors** in **00:00:27.80**; ordinary **629/629** in **15 s**; focused registry **28/28** in **183 ms**; disposable PostgreSQL 17 **10/10** in **9 s**; **0 residual containers**; `git diff --check` clean and verification left the worktree clean. A1/A3/A4/A5 are advisories; A2's case-folding concern is dismissed against the pinned exact-string semantics. At acceptance time P1-1b had not started, and O5 and O7 remained open. |
| 2026-08-05 | **P1-1b authorized; first records stage started; O7 closed prospectively.** Historical prototype rows keep honest SQL `NULL` `CaptureQuality` with `absent` provenance and are excluded from that validator warning; every new Sibyla capture must supply the value at capture time, and only non-imported missing values warn. Luís confirmed the prototype is stable and the queued documents are ingested, as relayed by Miguel. Fresh read-only prototype pin and complete blob roster are recorded in `docs/p1-1b-status.md`; no Scope 1–8 implementation or database work has started. Only O5 remains open. |
| 2026-08-05 | **P1-1b Scope 1 stopped correctly at C8 before implementation or database work.** Pin `06825b5` still has 48 ENTBNK rows in 43 distinct `(CodeName, Company)` groups: five duplicate groups / ten rows; every duplicate pair has one `PayAccount`, one `PayMethod`, and two distinct `Flag` values. C8 requires a source merge and says the import fails closed until it occurs. Scopes 2–8 remain unstarted; no container or database was created. |
| 2026-08-06 | **C8 source gate closed by an authorized on-behalf source merge; Scope 1 ready to restart at preflight.** While Luís was unavailable, Miguel authorized the five ENTBNK pairs to be merged on Luís's behalf. Prototype commit/new immutable pin `b91768513fc638381fbde91f0b576b08220a98f6` changes only `Editor/Data/entbnk.json`, retains both `Flag` notes, and is flagged for Luís's review on return. Post-control is 43 rows / 43 distinct keys / 0 duplicate groups / 0 duplicate rows; all other 48 entries in the 49-entry roster are byte-identical. No importer/source implementation, import, container, or database work has run. |
| 2026-08-06 | **P1-1b Scope 1 restarted and stopped at O8 before implementation or database work.** Sibyla is clean at `6a17e83`; prototype HEAD, local `origin/main`, and live `origin/main` are all `b917685…`; all 49 roster blobs match and the direct JSON surface is exactly 48 rostered files. C8 passes 43/43/0/0. C13 measures 2,787 rows, 2,780 four-field keys / seven collisions, and 2,787 complete keys / zero collisions. The source now has 52 DOCEFL rows: its visual-read `EF0000046` conflicts with the accepted authored Monthly-gap `EF0000046`, while `EF0000047`–`EF0000052` are outside the governed 45-row import manifest. DOCTYP has a twentieth uncoded `Bank Statement | External | Exclude` row that conflicts with the accepted target `Include | ArchiveOnly` semantics. Reassigning codes, dropping rows, or translating values is forbidden, so Scopes 1–6 stopped correctly. |
| 2026-08-06 | **O8 closed by O8-D1/D2; Scope 1 ready to restart at preflight.** Read-only preflight at Sibyla `dabf328…` and prototype `b917685…` re-proved exact local/upstream/live refs, a clean prototype, 49 unique roster paths / zero mismatches, exactly 48 rostered direct JSON files, source DOCEFL exactly 52 consecutive codes through `EF0000052`, no higher EF code in ledger or instances, verified-free `EF0000053`, and C8 43/43/0/0. The source manifest is all 52 rows with honest provenance; sentinel `EF0000000` stays unchanged; Monthly-gap moves once to inactive `EF0000053`; the uncoded twentieth source DOCTYP row is explicitly excluded while the governed 19-row import and authored `Include | ArchiveOnly` rule remain. No implementation or database work ran. Only O5 remains open. |
| 2026-08-06 | **P1-1b Scope 1 restarted and stopped at the accepted import contract.** All mandated count controls pass at Sibyla `ca9942…` and prototype `b917685…`. Before TDD, the source/provenance/schema check found 119 ENTMST source/non-null gaps, 119 ENTMST production/non-null gaps, 52 absent governed DOCEFL `ItemClass` assignments, two source rules rejected by an incomplete accepted priority CHECK, and 221 terminal DOCFLG rows whose honest absent evidence violates the accepted CHECK. O9 records the required governed decision. No code, migration, import, container, or database work ran; Scopes 2–8 remain unstarted. |
| 2026-08-06 | **Independent-review records corrected, with the O9 stop preserved.** The accepted P1-1a fixture/test record is restored to its historical `EF0000046` truth and P1-1b is instructed to update or replace it for O8-authorized `EF0000053` before seeding; the annex prose now names all six table-derived `ReviewPriority` literals; O9 evidence records both the corrected annex-internal defect and the still-open annex-vs-CHECK contradiction; current-facing evolution status now closes O8 and names O9. Documentation only: no source, test, migration, prototype, import, container, or database change. |
| 2026-08-06 | **O9 governed records complete; O9 closed, implementation pending.** O9-P preserves fail-closed identity controls and treats enumerated historical completeness gaps as honest SQL `NULL` / `absent`, named non-blocking findings to improve over time. O9-D1…D5 govern baselines 119 / 119 / 52 / 221, complete `ReviewPriority` to the annex's exact six literals, and re-scope terminal evidence for imported history. The DirectDebit register correction and annex history are recorded. The additive corrective migration, validator changes, commands, fixture update, importer, tests, and Scope 1 restart have not begun; no database, container, deployment, live action, or prototype write occurred. Only O5 remains open. |
| 2026-08-06 | **P1-1b step 3 independently rejected; `b324a3e…` neutralized fail closed; O10 opened.** A normal branch-tip stop commit restores every code/test/migration path changed by `b324a3e…` byte-identically to parent `6e18e1c…`; O9-P/D1…D5 remain closed and the four data-quality TODOs remain non-blocking. Review verdict Reject: High blockers are the 52-row DOCEFL NULL versus DOCFLG composite-FK impossibility, caller-controlled GUC command bypass with owner-only test boundary, and weak non-company-scoped import-evidence predicate; Medium blockers are Down/Up constraint-name drift and imported unknown non-null `ItemClass` validator escape. Green tests were insufficient semantic proof. Scope 1 and all later scopes stop pending Miguel's explicit O10 contract reconciliation. No migration/import/live action ran outside disposable tests. |
| 2026-08-06 | **O10 governed records complete; O10 closed, fresh reviewed reimplementation pending.** O10-D1 records nullable imported DOCFLG snapshot `ItemClass`, `MATCH SIMPLE` composite-FK semantics, a mandatory plain `EFCode` FK, the prospective non-imported complete-snapshot CHECK, and expected finding `DOCFLG snapshot ItemClass absent` = 2,787. O10-D2 makes governed rule assignment atomically complete NULL snapshots only, audit the exact count, and reduce the finding by exactly that count without ever overwriting a value. All five independent-review findings are binding remediation requirements. Rejected `b324a3e…` stays neutralized evidence and is never code to resurrect. No source, test, migration, prototype, database, container, service, deployment, or live action occurred; Scope 1 still awaits fresh implementation plus an independent Accept verdict. Only O5 remains open. |
| 2026-08-06 | **Fresh O10 step-3 implementation `57f0f023…` independently rejected and neutralized fail closed.** Verdict: 0 Critical, 4 High, 3 Medium. High: unsafe hostile-role reuse and privilege grants; destructive/non-identical Down without exact catalog/semantic proof; assignment/import NULL-snapshot race; provenance rows lacking target, company, and exact-absence integrity. Medium: validator defaults invent values; global/evidence audit scope and content are incomplete; accepted evidence uniqueness is silently replaced outside authority. Missing Low coverage and positive confirmations are recorded in `docs/p1-1b-o10-independent-review.md`. A normal additive stop commit restores exactly all 14 implementation paths byte-for-byte to records parent `15679e78`. O10-D1/D2 and the 2,787 baseline remain closed and unchanged; Scope 1 has not started; no remediation, reimplementation, database, container, service, deployment, live-data, or prototype work occurred. |
| 2026-08-06 | **O10 amendment-2 governed records complete; third fresh implementation pending.** All seven second-review findings are accepted as binding R1–R7 requirements, the four missing-coverage items require their own mapped disposable tests, and minimal-surface discipline forbids changing any accepted object unless a numbered requirement names that exact change. O10-D1/D2 remain closed; the five expected completeness baselines remain 119 / 119 / 52 / 221 / 2,787 and the two `Routine` rows still import verbatim. Rejected `b324a3e…` and `57f0f023…` remain neutralized evidence only. Documentation only: no code, migration, test, fixture, prototype, database, container, service, deployment, live-data, or Scope 1 work occurred. O5 remains the only open item. |
| 2026-08-06 | **Third O10 implementation `7ea6c0f…` independently rejected and neutralized fail closed.** Verdict: 0 Critical, 2 High, 4 Medium, 1 Low. High blockers are bypassable provenance integrity/accepted-waiver inconsistency and cross-company assignment/audit authorization. Medium findings cover incomplete ENTMST count scope, missing genuine NULL round trip, incomplete exact-catalog proof, and generated-column model drift; the Low finding is incomplete first-ordering concurrency coverage. All 15 implementation paths are restored byte-for-byte to records parent `01c92cb…`. Amendment 2 now stops all further reimplementation pending Miguel; Scope 1 has not run. |
| 2026-08-06 | **O10 amendments 3 and 4 accepted; Piece A authorized at reformulated preflight.** Miguel's required three-Reject pattern review decomposes the unchanged O9/O10 implementation into four independently reviewed pieces. Amendment 4 supersedes only amendment 2's frozen-tip prototype check: pin reachability, ancestry, local-pin anchoring, 49/49 roster integrity, and the exact 48-file pinned surface remain hard stops; live-tip divergence is logged by hash and subject without reading or adopting post-pin content. The recorded live tip is `3dd4150caef7e3a1d2a77c5fa34361d2aefe4c54`, with post-pin commits `1e841a4` and `3dd4150`. Piece A may start only after checks 1–5 pass. Baselines 119 / 119 / 52 / 221 / 2,787, O8/O9/O10 decisions, and O5 are unchanged; no implementation, prototype content read, database, container, service, deployment, or live-data action occurred in this records step. |
| 2026-08-06 | **Piece A candidate `6f86023d…` independently rejected and neutralized — Reject #1.** Verdict: 0 Critical, 1 High, 2 Medium, 1 Low. The High blocker is the absent validator fail-closed gate for unknown non-null D8 `ItemClass`; Medium findings are generated-column EF/store-type drift and missing same-code wrong-company evidence coverage; the Low finding is incomplete catalog/accepted-uniqueness proof. Build 0 warnings/errors, focused 32/32, ordinary 632/632, disposable PostgreSQL 13/13, effective roster 49/49, pinned surface 48/48, and zero residual containers were independently reproduced but do not waive the findings. All 12 Piece A implementation/model/test paths are restored byte-for-byte to records base `bc835f7e…`; candidate-added paths are absent. Piece B/C/D and Scope 1 remain unstarted; O8/O9/O10 and all baselines are unchanged. |
| 2026-08-06 | **O10 amendment 5 accepted; Piece A attempt #2 authorized as a remediation, behind a test-plan gate.** The four Reject #1 findings are binding **A-R1…A-R4**: the fail-closed validator gate for unknown non-null D8 `ItemClass` across DOCEFL and DOCFLG, imported and native; EF-versus-catalog store-type parity for every column Piece A adds or alters; a same-code wrong-company evidence rejection test for the imported terminal exemption; and a catalog/uniqueness proof that asserts everything status claims. Because Reject #1 recorded 0 Critical and a row-by-row disposition, attempt #2 is a **remediation of piece candidate `6f86023d…`**, not a rewrite; that basis never applies to `b324a3e…`, `57f0f023…`, or `7ea6c0f…`. The attempt-#2 checklist is the Reject #1 disposition table plus A-R1…A-R4, and any other content change is a stop-and-report. Attempt #2 is the **second and final** attempt before escalation. Three standing instruments are adopted: one exhaustive consolidated checklist per piece, the five-rule proof-pattern annex, and a test-plan gate requiring the checklist→test mapping to be recorded and approved by Miguel before any implementation code. Amendment 5's process finding that this file was never repaired is **stale and is reported, not carried forward**: `bc835f7e…` recorded amendments 3/4 with the `3dd4150…` divergence and `f3ea530…` recorded the preflight pass, the Piece A candidate, Reject #1 and its neutralization; only the amendment-5 record itself was missing, because `ccc9146f…` tracked only the prompt. The same-commit rule binding `p1-1b-status.md` / the review record to this file is adopted. O5-prep is green-lit in parallel under its own prompt and disjoint file surface. Baselines 119 / 119 / 52 / 221 / 2,787, the two verbatim `Routine` rows, pin `b917685…`, and every O8/O9/O10 decision are unchanged; documentation only — no test-plan mapping, implementation, migration, model, fixture, test, prototype, database, container, service, deployment, or live-data work occurred. O5 remains the only open item. |
| 2026-08-06 | **Piece A attempt #2 checklist→test mapping recorded at amendment 5's test-plan gate; implementation still unauthorized pending Miguel's approval.** Ordered instruction 2 only. `docs/p1-1b-status.md` now carries a numbered, exhaustive 20-item mapping: the 16 Reject #1 disposition rows in the review's own order plus A-R1…A-R4, each keyed to exact test methods and labelled ordinary contract / validator / fixture, disposable `Category=P11aDatabase`, or verification command, and marked **New**, **Strengthened**, or **Existing regression**. Every Reject #1 Pass row keeps its existing proof and is re-run against the new diff; the Partial/Fail rows (O9-D3, O9-D5, accepted `ImportEvidenceRow` uniqueness coverage, EF generated-column alignment) convert through the four remediations. Planned additions are four new validator fail-closed tests for unknown non-null `ItemClass` across DOCEFL/DOCFLG × imported/native behind two new failure-outcome checks plus a strengthened five-warning test proving null observation unchanged (A-R1); one new disposable EF-versus-catalog store-type test, one strengthened and one new contract test covering the six added/altered columns `ENTMST.DirectDebit` `boolean`, `ENTMST.TaxIdVerificationStatus` `varchar(24)`, `DOCEFL.ItemClass` and `DOCFLG.ItemClass` `varchar(16)`, `DOCFLG.ImportEvidenceRowId` `uuid`, and generated `DOCFLG.ImportTargetTable` `varchar(32)` (A-R2); one new disposable same-code wrong-company `ImportEvidenceRow` rejection test with a native and a positive control (A-R3); and one new disposable accepted-versus-first-`Up` comparison of the `ImportEvidenceRow` unique constraints and indexes plus a catalog helper strengthened with column store types and index definitions for the four touched tables (A-R4). Two observations are reported, not resolved: A-R4 says "both" accepted `ImportEvidenceRow` unique constraints while the accepted DDL declares four, so the plan asserts all four as a strict superset; and store-type parity is scoped to the six columns Piece A touches, because a project-wide correction would exceed A-R1…A-R4. Documentation only — no implementation, preflight run, prototype read, database, container, service, deployment, or live-data action; candidate `6f86023d…` was inspected read-only through Git history. A normal additive correction commit in the same records step then removed the mapping's projected suite-count paragraph and aligned checklist item 6's wording with the candidate's actual assertions — the contract test's single six-literal substring assertion, and the disposable test's six DOCEFL inserts, `Normal` rejection and `Routine` DOCFLG coverage — without inventing an assertion or changing a checklist item. Baselines, pin, and every O8/O9/O10 decision are unchanged; O5 remains the only open item. |
| 2026-08-06 | **Piece A attempt #2 test-plan mapping approved by Miguel.** `docs/AGENT-PROMPT-v5-P1-1b-piece-a-testplan-approval.md` (tracked and pushed at `47d6fc2…`) approves the 20-item checklist→test mapping as the binding attempt-#2 test plan, confirms the A-R1 gate shape and the closed D8 vocabulary, decides both reported observations in the plan's favor (all four accepted `ImportEvidenceRow` unique constraints compared by exact definition; the six-column store-type scope confirmed as the intended reading), and authorizes one named addition widening item 6's DOCFLG coverage to all six governed `ReviewPriority` literals plus the `'Normal'` rejection. Ordered instruction 3 — attempt #2 implementation as a remediation of candidate `6f86023d…` under the amendment-4 reformulated preflight — is now authorized; ordered instruction 4's focused independent re-review follows on Accept/Reject. No content change beyond A-R1…A-R4 and the named addition is authorized; Piece B, Piece C, Piece D, and Scope 1 remain gated and unstarted. Baselines 119 / 119 / 52 / 221 / 2,787, pin `b917685…`, and every O8/O9/O10 decision are unchanged; O5 remains the only open item. |
| 2026-08-06 | **Piece A attempt #2 implemented as a remediation of candidate `6f86023d…`, pushed; awaiting the mandatory focused independent re-review in a fresh session.** The amendment-4 reformulated preflight was re-run fresh (read-only, `git fetch`/`git cat-file`/`git ls-tree`/`git rev-parse`/`git merge-base`/`git log` only) and checks 1–5 passed: pin `b917685…` reachable and an ancestor of live `main`; local prototype `HEAD` anchored at the pin; 49/49 roster blobs with 0 mismatches; 48/48 direct `Editor/Data` files with 0 delta. Check 6 recorded the same live tip `3dd4150…` and two post-pin commits already on record, with no new divergence and no post-pin content read or adopted. The 12 candidate implementation/model/test paths were restored byte-for-byte from `6f86023d…`, then exactly A-R1 (two new fail-closed validator checks `docefl.item-class.vocabulary` / `docflg.snapshot-item-class.vocabulary` plus four new and one strengthened validator test), A-R2 (EF-versus-catalog store-type parity for the six touched columns, one new disposable test, one strengthened and one new contract test), A-R3 (one new disposable cross-company `ImportEvidenceRow` rejection test), A-R4 (one new disposable accepted-versus-first-`Up` `ImportEvidenceRow` uniqueness/index comparison, `PieceACatalogSnapshot` strengthened with column store types and indexes), and the named DOCFLG `ReviewPriority` strengthening were applied — no other content change. Measured: build 0 warnings/0 errors; focused 37/37 (32 candidate + 5 new); ordinary 637/637; disposable PostgreSQL 17 suite 16/16 (13 candidate + 3 new); `git diff --check` clean; both accepted P1-1a migration files byte-identical to pre-implementation `HEAD`; 0 residual `sibyla-p11*` containers. The item-by-item evidence map for all 20 checklist items is recorded in `docs/p1-1b-status.md`. Piece A still has no accepted implementation until the focused independent re-review (ordered instruction 4) runs in a fresh session and records an explicit verdict; Piece B, Piece C, Piece D, and Scope 1 remain gated and unstarted. Baselines, pin, and every O8/O9/O10 decision are unchanged; O5 remains the only open item. |
| 2026-08-06 | **Piece A attempt #2 independently reviewed in a fresh session and Accepted — 0 Critical, 0 High, 0 Medium, 0 Low.** Ordered instruction 4 of amendment 5. Live Git state was independently re-verified (`HEAD`=`origin/feature/p1-1b`=`f6f297b…`, clean, `0 0` against records/approval base `567c6ce…`); the amendment-4 preflight was independently re-run fresh and passed checks 1–5 with an unchanged check-6 divergence log; the exact 12-path scope was independently confirmed against the rejected candidate; A-R1, A-R2, A-R3, A-R4, and the named DOCFLG `ReviewPriority` strengthening were each independently traced through the validator, EF model/snapshot, and disposable SQL and found genuinely satisfied, including confirming the new company-scoped tests are not vacuous; every Reject #1 Pass row was confirmed still holding. Build 0 warnings, ordinary 637/637, focused 37/37, disposable PostgreSQL 16/16, `git diff --check` clean, unchanged accepted-migration blob IDs, and 0 residual containers were all independently reproduced. Full verdict recorded in `docs/p1-1b-o10-independent-review.md`. **Piece A now has an accepted implementation.** Piece B may seek its own go-ahead; Piece C, Piece D, and Scope 1 remain gated and unstarted. Baselines 119 / 119 / 52 / 221 / 2,787, pin `b917685…`, and every O8/O9/O10 decision are unchanged; O5 remains the only open item. |
| 2026-08-06 | **Piece B go-ahead accepted; acceptance recorded.** Per amendment 3, Piece A's Accept authorized Piece B to seek its own go-ahead; Miguel's `docs/AGENT-PROMPT-v5-P1-1b-piece-b-goahead.md` (tracked and pushed at `5813a06…`) is that go-ahead and is accepted without reopening any decision. Scope: `RegistryFieldProvenance` alone — its constraints, triggers, and every governed write path that touches it — additive against the accepted P1-1a catalog plus accepted Piece A (`f6f297b…`); no roles, `SECURITY DEFINER` functions, governed commands, importer, or Scope 1 work. The go-ahead's exhaustive 20-item consolidated checklist (preflight/surface, R4 closed by construction including the `WaiveDOCFLG` agreement, standing guarantees carried into the piece, required schema-level rejection proofs, and proof honesty) governs the piece; the `WaiveDOCFLG` closure-by-construction scope note is resolved at the test-plan gate, not here. This records step is documentation only: no implementation, migration, model, constraint, trigger, test, fixture, importer, prototype, database, container, service, deployment, or live-data work occurred. Piece B implementation remains unauthorized pending the checklist→test mapping gate and Miguel's explicit approval of it. Baselines 119 / 119 / 52 / 221 / 2,787, pin `b917685…`, and every O8/O9/O10 decision are unchanged; O5 remains the only open item. |
| 2026-08-06 | **Piece B checklist→test mapping recorded; implementation still unauthorized pending Miguel's approval.** Ordered instruction 2 only, per `docs/AGENT-PROMPT-v5-P1-1b-piece-b-goahead.md`. `docs/p1-1b-status.md` now carries a numbered, exhaustive 20-item mapping keyed to the go-ahead's own checklist — preflight/surface, R4 closed by construction, standing guarantees, required schema-level rejection proofs, and proof honesty — with every item labelled New (Piece B has no prior candidate) and keyed to proposed test methods in a new `P11bPieceBContractTests.cs` and additions to the existing shared `P11aDisposableDatabaseTests.cs`, or to verification commands / documentation obligations where no test applies. The mandatory `WaiveDOCFLG` closure-by-construction analysis (read-only inspection of the accepted function's body, which touches only `DOCFLG` and `P11aCommandAudit`) concludes item 8/19 **can** be closed without altering `WaiveDOCFLG`'s accepted definition: a new additive `BEFORE UPDATE` trigger on the accepted `DOCFLG` table — paralleling the checklist's own item-6 `DOCEFL` insertion trigger — intercepts `WaiveDOCFLG`'s real write path and fails closed on stale `absent` provenance with a `NULL` hash, with `WaiveDOCFLG`'s function body, text, and blob unchanged. Two observations are reported, not resolved silently: (1) whether a new trigger on the accepted `DOCFLG` table is the intended reading of the scope note's "Piece B's own objects," given item 6's own precedent of a new `DOCEFL` trigger; (2) items 10 and 12 commit to required test shape and location now, with the literal column/constraint/index list finalized only once `RegistryFieldProvenance`'s `Up` is authored during TDD, because — unlike Piece A's attempt-#2 mapping — no rejected candidate exists yet to enumerate against. Item 11 (closed-vocabulary double closure) is resolved by inspection, not left open: `RegistryValidationService.cs` and `PostgresRegistryValidationSnapshotSource.cs` have zero references to any provenance surface, so closure for the `extracted \| authored \| absent` marker vocabulary is at the database `CHECK` alone, stated explicitly. Documentation only — no implementation, migration, model, constraint, trigger, test, fixture, prototype, database, container, service, deployment, or live-data action; `RegistryFieldProvenance` and `WaiveDOCFLG` were inspected read-only through `Read`/`Grep`/`git log`. Baselines, pin, and every O8/O9/O10 decision are unchanged; O5 remains the only open item. |
| 2026-08-06 | **Piece B checklist→test mapping approved by Miguel in full; implementation authorized.** Miguel's approval, verbatim: "Aprovo o mapping de Piece B e ambas as resoluções propostas." The 20-item mapping is approved as submitted; both reported observations are decided in the plan's favor — Observation 1 authorizes a new, additive `BEFORE UPDATE` trigger/trigger function on the accepted `DOCFLG` table as the closure-by-construction mechanism for checklist item 8/19, with `WaiveDOCFLG` and every other accepted trigger/function definition remaining byte-identical; Observation 2 confirms items 10/12 commit to required test shape now, with the exact column/constraint/index roster fixed once `RegistryFieldProvenance`'s `Up` is authored during TDD and recorded in the implementation's own evidence map. Ordered instruction 3 of the go-ahead — implement Piece B, TDD first, from this pushed approval tip — is now authorized; ordered instruction 4 (the first independent adversarial review of this piece) is not authorized by this step. No content change beyond the mapping and the two observations is authorized. Baselines 119 / 119 / 52 / 221 / 2,787, pin `b917685…`, and every O8/O9/O10 decision are unchanged; O5-prep remains deferred; O5 remains the only other open item. |
| 2026-08-06 | **Piece B implemented from zero against the approved checklist and mapping; published for independent review.** Ordered instruction 3 only. The amendment-4 reformulated preflight was re-run fresh (read-only, `git status`/`git fetch`/`git cat-file`/`git ls-tree`/`git rev-parse`/`git merge-base` only against the prototype clone) and checks 1–5 passed: pin `b917685…` reachable and an ancestor of live `main`; local prototype `HEAD` anchored at the pin; 49/49 roster blobs with 0 mismatches; 48/48 direct `Editor/Data` files with 0 delta; check 6 recorded the same unchanged live-tip divergence already on record. `RegistryFieldProvenance` (9 columns, including two `STORED GENERATED` discriminator columns `DOCEFLCode`/`DOCFLGFlagInstanceID` used to implement two real, non-polymorphic foreign keys against `DOCEFL`/`DOCFLG`) was implemented with 7 new triggers (exact-one cardinality on `DOCEFL` and `DOCFLG` insertion and on `RegistryFieldProvenance` delete/move, target-update re-check on `DOCEFL`/`DOCFLG`, and the `WaiveDOCFLG` closure trigger on `DOCFLG`) and 3 new trigger functions — additive against the accepted P1-1a catalog plus accepted Piece A, exactly 6 code/test paths changed (3 new, 3 modified), no Piece C/D, role, ACL, `SECURITY DEFINER`, governed-command, or importer path. Measured: build 0 warnings/0 errors; ordinary **640/640** (637 + 3 new); focused **3/3** new Piece B contract tests; disposable PostgreSQL 17 suite **27/27** (16 Piece A + 11 new); `git diff --check` clean; both accepted P1-1a and Piece A migration files byte-identical to pre-implementation `HEAD` (`git hash-object` matches `git ls-tree HEAD` for all four); `WaiveDOCFLG` and `RejectTerminalDOCFLGMutationFn` proven byte-identical before/after via live `pg_get_functiondef` comparison; a diff-restricted secret/role/`SECURITY DEFINER`/`DROP OWNED` scan found 0 matches; 0 residual `sibyla-p11*` containers after the final run. The item-by-item evidence map for all 20 checklist items and the finalized DDL/catalog roster (measured from the live migrated catalog, not projected) are recorded in `docs/p1-1b-status.md`. Two pre-existing `P11aDisposableDatabaseTests.cs` fixtures that commit native `DOCEFL` rows (rather than rolling back) were additively extended with matching `authored` provenance rows — a necessary consequence of Piece B's own new universal invariant, not a change to either test's original assertions, both of which still pass unchanged; every other `DOCEFL`/`DOCFLG`-inserting test in the suite runs inside a transaction that ends in `RollbackAsync()`, so the new `DEFERRABLE INITIALLY DEFERRED` triggers — which fire only at commit — never observe them. **Piece B still has no accepted implementation** until the first independent adversarial review (ordered instruction 4) runs in a fresh session and records an explicit verdict. Piece C, Piece D, and Scope 1 remain gated and unstarted. Baselines 119 / 119 / 52 / 221 / 2,787, pin `b917685…`, and every O8/O9/O10 decision are unchanged; O5-prep remains deferred; O5 remains the only other open item. |
| 2026-08-06 | **Piece B candidate `b8fa033…` independently reviewed in a fresh session and Rejected — 0 Critical, 1 High, 0 Medium, 0 Low — Reject #1.** Ordered instruction 4 of the go-ahead. Live Git state was independently re-verified (`HEAD`=`origin/feature/p1-1b`=`b8fa033…`, clean, `0 0` against records/approval base `87499a1…`); the amendment-4 preflight was independently re-run fresh and passed checks 1–5 with an unchanged check-6 divergence log; all 19 non-affected checklist items were independently traced through the SQL/EF model/tests and reproduced green, including the `WaiveDOCFLG` closure mechanism, orphan/company/cardinality/delete/move proofs, generated-column store-type parity, the accepted `ImportEvidenceRow` uniqueness proof, and Up/Down/Up catalog stability. Binding finding **B-R1 (High)**: the `DOCEFL`/`DOCFLG` target-update re-check trigger (`AFTER UPDATE OF "ItemClass"`) and the `RegistryFieldProvenance` insert/update trigger (`BEFORE INSERT OR UPDATE`) are both immediate/non-deferrable; the review empirically proved against a live disposable PostgreSQL 17 database, using ad hoc probe transactions written, run, and fully removed before the verdict, that **neither ordering** of a plain co-update (update the governed value then its provenance row, or the reverse) can succeed — each is rejected by the other trigger validating against the counterpart's not-yet-updated state. The only working sequence (delete the stale provenance row, update the value, insert a fresh provenance row) exploits an undocumented, untested validation gap rather than the "re-check" checklist item 7 and the candidate's own design note both describe, and no test in the candidate proves any legitimate co-update succeeds. This directly threatens the buildability of Piece C's O10-D2 `AssignDOCEFLItemClass` command, which needs exactly this NULL-to-value transition. Build 0 warnings, ordinary 640/640, focused 3/3, disposable PostgreSQL 17 suite 27/27 (reproduced twice on independent fresh containers), `git diff --check` clean, unchanged accepted-migration blob IDs, byte-identical `WaiveDOCFLG`/`RejectTerminalDOCFLGMutationFn` definitions, and 0 residual containers were all independently reproduced but do not waive the finding. Full verdict recorded in `docs/p1-1b-o10-independent-review.md` ("Piece B candidate review — Reject #1"). Per amendment 3's per-piece neutralization rule, all 6 Piece B implementation/test paths are restored byte-for-byte to records base `87499a1…` in the same commit as the review record; candidate `b8fa033…` is neutralized evidence only, never resurrected. **Piece B still has no accepted implementation.** A remediation test-plan mapping B-R1 to its exact proof, approved by Miguel at the standing test-plan gate, is required before any remediation code; no remediation has begun. Piece A's Accept is untouched; Piece C, Piece D, and Scope 1 remain gated and unstarted. Baselines 119 / 119 / 52 / 221 / 2,787, pin `b917685…`, and every O8/O9/O10 decision are unchanged; O5-prep remains deferred; O5 remains the only other open item. |
| 2026-08-06 | **Piece B remediation checklist→test mapping for B-R1 recorded; implementation blocked pending Miguel's approval.** The remediation checklist is the Reject #1 disposition table (19 Pass rows carried forward as regression requirements) plus B-R1's correction to items 7 and 20. Root cause: PostgreSQL can defer trigger evaluation to `COMMIT` only for `AFTER` constraint triggers, and the rejected candidate mixed an immediate `AFTER` trigger on `DOCEFL`/`DOCFLG` with an immediate `BEFORE` trigger on `RegistryFieldProvenance`, so each validated the other side's stale state regardless of statement order. Proposed remediation: split company agreement (item 5, kept immediate, unaffected in substance) from absent/value agreement (item 7, re-implemented as `DEFERRABLE INITIALLY DEFERRED` `AFTER` constraint triggers at all three attachment points, re-querying live state at commit) so both natural statement orderings of a legitimate co-update succeed, while an unaccompanied one-sided change still fails closed at `COMMIT` rather than at the offending statement — explicitly not via the rejected candidate's undocumented delete-update-insert gap, which no proposed test relies on. Eight new disposable tests are mapped (both orderings × `DOCEFL`/`DOCFLG`, both unaccompanied-change negatives, and a direct two-`UPDATE`-only assertion), plus a design-note correction for item 20. Two observations are reported, not resolved: **R-1** (both orderings must succeed, not one — proposed) and **R-2** (the redesign changes the proof mechanism, not the required outcome, of already-Pass items 5/15/16 — proposed as an accepted consequence of R-1). Documentation only: no implementation, migration, model, constraint, trigger, validator, fixture, test, prototype, database, container, service, deployment, or live-data work occurred; candidate `b8fa033…` was inspected read-only through Git history only, no path restored or modified. Baselines 119 / 119 / 52 / 221 / 2,787, pin `b917685…`, and every O8/O9/O10 decision are unchanged; O5-prep remains deferred; O5 remains the only other open item. |
| 2026-08-06 | **Piece B B-R1 remediation checklist→test mapping approved by Miguel in full; remediation implementation authorized.** `docs/AGENT-PROMPT-v5-P1-1b-piece-b-remediation-approval.md` (tracked and pushed at `2d09612…`) approves the mapping recorded in `docs/p1-1b-status.md` — the Reject #1 disposition table with 19 Pass rows carried forward as regression requirements, plus B-R1's correction to items 7 and 20 — as the binding remediation test plan, and decides both reported observations in the plan's favor: **R-1** (option (b), both natural statement orderings of a legitimate value/provenance co-update must succeed, via item 7 re-implemented as `DEFERRABLE INITIALLY DEFERRED` `AFTER` constraint triggers at three attachment points re-querying live state at `COMMIT`, with item 5 company agreement kept immediate in a dedicated `RequireCompanyAgreementFn`) and **R-2** (accepted as a necessary consequence — the proof-mechanism shape, not the required outcome, changes for already-Pass items 5/15/16). Ordered instruction 3 — implement the remediation of candidate `b8fa033…` under the amendment-4 reformulated preflight, TDD first, applying exactly the item 5/7 split, the three deferred constraint triggers, the eight mapped R1a–R1g disposable proofs, the item-20 design-note correction, and the item 2/12 roster widenings, no other content change — is now authorized; this is the **second and final** Piece B attempt before escalation to Miguel. No content change beyond the approved remediation diff is authorized; Piece C, Piece D, and Scope 1 remain gated and unstarted. Baselines 119 / 119 / 52 / 221 / 2,787, pin `b917685…`, and every O8/O9/O10 decision are unchanged; O5-prep remains deferred; O5 remains the only other open item. |
| 2026-08-06 | **Piece B B-R1 remediation implemented from the pushed approval tip `1627dd6…`; published for the fresh independent adversarial review.** Ordered instruction 3 only. The amendment-4 reformulated preflight was re-run fresh (read-only, `git status`/`git fetch`/`git cat-file`/`git ls-tree`/`git rev-parse`/`git merge-base` only against the prototype clone) and checks 1–5 passed: pin `b917685…` reachable and an ancestor of live `main`; local clone `HEAD` anchored at the pin; 49/49 roster blobs re-measured cell by cell with 0 mismatches; 48/48 direct `Editor/Data` files with 0 delta; check 6 recorded the same unchanged live-tip divergence already on record. Applied exactly the approved remediation: item 5 (company agreement) split into a new dedicated immediate `RequireCompanyAgreementFn`; item 7 (absent/value agreement) re-implemented as three `DEFERRABLE INITIALLY DEFERRED` `AFTER` constraint triggers (`RegistryFieldProvenance`, `DOCEFL`, `DOCFLG`), each re-querying live state at `COMMIT`; R1a–R1g proving both natural statement orderings of a legitimate `NULL`→value co-update succeed at `COMMIT` for `DOCEFL` and `DOCFLG` while an unaccompanied one-sided change still fails closed at `COMMIT` (not statement-time), with a direct assertion that no proof uses the rejected candidate's delete-update-insert gap; the item-20 design-note correction; and the item 2/12 roster widening to 8 triggers / 4 functions (from 7/3) — no other content change. Exactly 6 code/test paths changed (3 new, 3 modified), no Piece C/D, role, ACL, `SECURITY DEFINER`, governed-command, or importer path. Measured: build 0 warnings/0 errors; ordinary **640/640**; focused **3/3**; disposable PostgreSQL 17 suite **34/34** (16 Piece A + 18 Piece B — 11 base-shape carried forward, unchanged or mechanism-only-changed per Observation R-2, plus 7 new R1a–R1g); `git diff --check` clean; both accepted P1-1a and Piece A migration files byte-identical to pre-implementation `HEAD`; `WaiveDOCFLG` and `RejectTerminalDOCFLGMutationFn` proven byte-identical before/after via live `pg_get_functiondef`; Up/Down/Up catalog stability proven; a diff-restricted secret/role/`SECURITY DEFINER`/`DROP OWNED` scan found 0 matches; 0 residual `sibyla-p11*` containers. The item-by-item remediation evidence map and the measured DDL/catalog roster (from the live migrated catalog, not projected) are recorded in `docs/p1-1b-status.md`, including an honest note that R1c/R1d each commit a real, permanent `DOCFLG` row (accepted-schema append-only) that cannot be cleaned up, exactly like the pre-existing accepted Piece A tests that also commit real `DOCFLG` rows. **Piece B still has no accepted implementation** until the fresh independent adversarial review (ordered instruction 4 — the second and final Piece B attempt before escalation to Miguel) runs in a fresh session and records an explicit verdict; none has begun. Piece C, Piece D, and Scope 1 remain gated and unstarted. Baselines 119 / 119 / 52 / 221 / 2,787, pin `b917685…`, and every O8/O9/O10 decision are unchanged; O5-prep remains deferred; O5 remains the only other open item. |
| 2026-08-06 | **Piece B B-R1 remediation (`7059809…`) independently reviewed in a fresh session and Accepted — 0 Critical, 0 High, 0 Medium, 0 Low.** Ordered instruction 4 of the remediation approval; the second and final Piece B attempt before escalation to Miguel. Live Git state was independently re-verified (`HEAD`=`origin/feature/p1-1b`=`7059809…`, clean, `0 0` against records/approval base `1627dd6…`); the amendment-4 preflight was independently re-run fresh, including a genuine fresh cell-by-cell 49/49 roster-blob measurement (0 mismatches) and 48/48 direct `Editor/Data` surface (0 delta), with an unchanged check-6 divergence log. The exact 8-path diff (2 records files, 3 new and 3 modified code/test paths) was independently confirmed, with no Piece C/D/role/ACL/command/importer path anywhere. B-R1 was independently re-verified genuinely fixed — not merely test-shaped — via three independent lines of evidence beyond the candidate's own test suite: (1) the redesigned `RequireProvenanceAgreesWithTargetFn` and its three constraint-trigger attachment points were read in full; (2) their deferred/immediate timing was independently measured live against a fresh disposable PostgreSQL 17 container's `pg_trigger` catalog (`tgdeferrable`/`tginitdeferred` = t/t for all three re-check triggers, f/f for the still-immediate company-agreement trigger); (3) six original adversarial probe transactions — not derived from the candidate's tests — independently reproduced both statement orderings succeeding, a same-transaction duplicate-firing toggle succeeding with consistent final state, the previously-exploited no-provenance window now failing closed, the full delete-update-insert sequence remaining incidentally valid but proven unneeded, company agreement firing genuinely immediately (demonstrated without a `DO`/`EXCEPTION` block), and a combined move-plus-value-change scenario failing closed — all six passing on first run and fully removed before the verdict was recorded. Every Reject #1 Pass row was independently confirmed to still hold. Build 0 warnings, ordinary 640/640, focused 3/3, disposable PostgreSQL 17 suite 34/34, `git diff --check` clean, unchanged accepted P1-1a/Piece A migration blob IDs, live catalog measurement (9 columns/11 constraints/2 indexes/8 triggers/4 functions) matching the evidence map exactly, `WaiveDOCFLG`/`RejectTerminalDOCFLGMutationFn` source confirmed to contain no reference to `RegistryFieldProvenance`, and 0 residual containers were all independently reproduced. Full verdict recorded in `docs/p1-1b-o10-independent-review.md` ("Piece B B-R1 remediation review — Accept"). **Piece B now has an accepted implementation.** No neutralization was authorized or performed. Per amendment 3, Piece C may now seek its own go-ahead; Piece C, Piece D, and Scope 1 remain gated and unstarted pending each predecessor's own recorded Accept. Baselines 119 / 119 / 52 / 221 / 2,787, pin `b917685…`, and every O8/O9/O10 decision are unchanged; O5-prep remains deferred; O5 remains the only other open item. |
| 2026-08-06 | **Piece C candidate `ce983b2…` independently reviewed in a fresh session and Accepted — 0 Critical, 0 High, 0 Medium, 0 Low.** Ordered instruction 4 of the Piece C go-ahead; full verdict, live Git state re-verification, the amendment-4 preflight re-run, the exact 6-path diff, and eight original adversarial probes (recorded in `docs/p1-1b-o10-independent-review.md`, "Piece C candidate review — Accept") are all independently reproduced and confirmed. **Piece C now has an accepted implementation.** Per amendment 3, Piece D may now seek its own go-ahead; Piece D and Scope 1 remain gated and unstarted pending that go-ahead. Baselines 119 / 119 / 52 / 221 / 2,787, pin `b917685…`, and every O8/O9/O10 decision are unchanged; O5 remains the only other open item. |
| 2026-08-07 | **Piece D go-ahead accepted; acceptance recorded.** Per amendment 3, Piece C's Accept authorized Piece D to seek its own go-ahead; Miguel's `docs/AGENT-PROMPT-v5-P1-1b-piece-d-goahead.md` (dated 2026-08-06) is that go-ahead and is accepted without reopening any decision. Scope: an integration gate only — cumulative `pg_catalog` equivalence and Scope 1 readiness over Pieces A + B + C on the accepted P1-1a catalog, adding no new migration content, no production/shared/live database write, and no importer execution. Ordered instruction 1 requires tracking the go-ahead document and recording its acceptance in `docs/p1-1b-status.md` and this file in the same records commit, pushed before any test-plan/mapping work begins; this governed records commit's exact scope is those three paths together — the go-ahead document itself, `docs/p1-1b-status.md`, and this file — no other path. **Piece D is now at the checklist→test mapping gate (ordered instruction 2): no mapping has been recorded, and no implementation, test, harness, migration, database, or container work of any kind has run.** **Scope 1 remains unauthorized until Piece D's own independent Accept.** Baselines 119 / 119 / 52 / 221 / 2,787, pin `b917685…`, and every O8/O9/O10 decision are unchanged; O5 remains the only other open item. |