# P1-1a — independent sign-off **Date:** 2026-08-05 **Review time:** on-machine review; current host time measured 2026-08-05 22:11:30 CUT **Reviewer:** Apolo (Nous Research), fresh independent on-machine review session **Verdict:** **Accepted with notes** **Reviewed set:** - Deliverable 1: `e2f4c2a9e271efc55ccfd8b2d1d199540ab372ff` - Deliverable 2: `719407cfb8c5ba6f143699fe893ba2a812c5102e` - Closure: `74d8635848278b0d479f23c4e0090a6bdbac8480` - Read-only prototype pin: `9359c67c4ef0101218d7e0ffff1986114ba5cc7a` - Pinned `SKILL.md` blob: `72f17dcfa85c78a1c4825355697fe2092379f407` This was an independent re-derivation from the implementation, its specifying records, the pinned prototype sources, and reproduced commands. `docs/p1-1a-remote-review-report.md` was not used as evidence. --- ## Repository and topology evidence Before this sign-off, local `main` and `origin/main` were both `7dc1b66fa3d942c01bbf159eb6c177863396f1cf`, divergence was `0/0`, and the worktree was clean. The live remote advertised only `refs/heads/main` at that SHA. The former `feature/p1-0d-follow-up` remote ref had been deleted after merge; the local historical feature ref remained at the closure commit. This record does not state or imply that the feature remote still exists. The review prompt's feature-branch topology is therefore reconciled with the live repository rather than recreated. The prompt was already versioned in `05a9d69` and merged into `main`; no ref or history was recreated or rewritten. The accepted follow-up is consequently limited to this sign-off and the current-state update on current `main`. The P1-1a implementation range `e2f4c2a..74d8635` is linear and contains no merge. Closure `74d8635848278b0d479f23c4e0090a6bdbac8480` has the single parent `a276ca3dcae4e1c898e6ce48227f7c58795734b0` and touches exactly: - `docs/PROJECT-STATE.md` - `docs/p1-1a-d2-status.md` - `docs/p1-1a-status.md` - `docs/project-todo.md` The `e2f4c2a` commit body retains its recorded literal-backslash-`n` defect. The `719407c` and `74d8635` bodies contain real newlines. History was not rewritten. ### Accepted topology deviation The closure instruction requested one commit, but deliverable 2 had already been pushed as `719407c`; `74d8635` is therefore the immediately following records-only closure. Both status files state that sequence explicitly. Rewriting already-pushed history would have violated the review constraints, so the disclosed two-commit topology is **accepted**. --- ## Reproduced verification The commands were run independently in the required order: 1. `dotnet build GOTT.Sibyla.slnx` — succeeded; 0 warnings, 0 errors; elapsed `00:00:27.80`. 2. `dotnet test tests/Sibyla.Tests/Sibyla.Tests.csproj` — 629 passed, 0 failed, 0 skipped; total 629; duration 15 s. The forward-slash spelling is the exact Windows-path equivalent required by the Git-Bash wrapper; an initial escaped-backslash spelling produced `MSB1009`, a wrapper-syntax error rather than a test regression. 3. Focused filter `FullyQualifiedName~RegistryValidationServiceTests` — 28 passed, 0 failed, 0 skipped; duration 183 ms. 4. `scripts/run-p11a-disposable-tests.ps1` via PowerShell — PostgreSQL 17; 10 passed, 0 failed, 0 skipped; duration 9 s. 5. Residual `docker ps` query — zero output; no `sibyla-p11a-*` containers remained. 6. `git diff --check` — clean; verification left the worktree unchanged and clean. --- ## Deliverable 1 — structural review All required structural checks pass: - There is one regeneratable migration, `20260805180000_P11aFdrSchema`; `Up` and `Down` delegate to `P11aSchemaSql`. - The Up–Down–Up test at `tests/Sibyla.Tests/Persistence/P11aDisposableDatabaseTests.cs:548-581` creates `P11aCode_decoy_unrelated` at line 557, proves at lines 569-577 that it survives `Down`, and then reapplies `Up`. - The forged-GUC allocation test at the same file's lines 927-942 sets `sibyla.actor` and `sibyla.authorities`. Authority instead comes from the server-side `RuntimePrincipal` keyed by `session_user`: allocation without a trusted mapping fails, and the authorized path succeeds. - Receipt-gated purge is implemented at `src/Sibyla.Infrastructure/Persistence/Migrations/P11aSchemaSql.cs:1411-1467`. Only a durable `Deleted` or `AlreadyAbsent` receipt can produce `Purged`; failed and ambiguous receipts remain, and the tombstone aggregates every receipt in order. The disposable storage-receipt flow tests both sides. - Allocation uses `INSERT … ON CONFLICT DO NOTHING RETURNING`, then rereads the winner and compares the full natural key (`P11aSchemaSql.cs:150-187,290-336`). Bootstrap creates each sequence once with `START WITH`; there is no runtime `setval` or `RESTART` path. - `scripts/run-p11a-disposable-tests.ps1:5-48` creates a uniquely named `postgres:17-alpine` container on a random loopback port, uses no named volume, and executes `docker rm -f` in `finally`. No shared or persistent database is touched. --- ## Deliverable 2 — sixteen-check disposition | # | Check and disposition | Independently re-derived evidence | |---:|---|---| | 1 | Authentication — **Pass; failure** | Review prompt non-negotiable/base D2; `RegistryValidationService.cs:152-184,354-375`. | | 2 | Application-principal company authorization — **Pass; failure** | `p1-0-schema-mapping.md:37-67`; PostgreSQL source `:16-34`; one nonblank, unambiguous `sub` preferred then `NameIdentifier`, active `UserProfile`/`Membership`/`CompanyRegistry`, byte-exact `convert_to`, fail closed. | | 3 | Unique captured DOCLOG filename — **Pass; failure** | `project-todo.md:393` plus recorded filename-scope resolution; service `:202-204,312`; captured rows only. | | 4 | Payable `(CodeName, DocumentID)` — **Pass; failure** | Pinned `SKILL.md` §15 line 508 and mapping FDCHDR semantics; service `:205-208,313`. | | 5 | Header/detail reconciliation and nonzero detail — **Pass; failure** | Pinned §15 line 508 and §10 lines 359-369; mapping `:607`; service `:209-219,314`. | | 6 | Referenced CodeName → ENTMST nonblank FiscalNo — **Pass; failure** | Pinned §15; service `:221-227,315`; PostgreSQL source `:53-62` derives only the selected-company transaction population. | | 7 | Exact FX `(Period, From, To=EUR)` — **Pass; failure** | Pinned `Scripts/build_workbook.py::build_lookup_tables` lines 148-203, especially 168-193; service `:229-234,316`. | | 8 | DOCLOG DocumentType nonblank — **Pass; failure** | Pinned §15; service `:236-237,317`. | | 9 | Flag/FlagCategory both or neither — **Pass; failure** | Pinned §15 and §7 line 191; service `:238-240,318`. | | 10 | DOCTYP coverage, captured only — **Pass; failure** | `project-todo.md:393`, taxonomy `:260-264`, pinned §15/§5; service `:242-245,319`. | | 11 | DOCTYP placement, captured only — **Pass; failure** | Taxonomy `:155-165,219-253`; mapping DOCARC `:632-653`; service `:247-254,329-351,320`; target `ProcessingRoute` and exact DOCARC evidence required. | | 12 | Synthetic FiscalNo — **Pass; warning** | Pinned §15 and `Scripts/entity_utils.py:14-19`; service `:256-259,321,390-395`. | | 13 | CaptureQuality — **Pass; warning** | Amendment/`project-todo.md:393`; vocabularies `:15,81-82`; service `:260-261,322`. O7 remains open; no decision is taken. | | 14 | Orphan DOCLOG — **Pass; warning/report-only** | `project-todo.md:394` and amendment; service `:262-264,323`; tests `:385-402`; input is retained. | | 15 | Global pair ↔ LGCode bijection — **Pass; failure** | `project-todo.md:395`; service `:266-272,324`; both directions are global and there is no prohibited one-EntryCode/one-code shortcut. | | 16 | Exact DOCEFL manifest/completeness — **Pass; failure** | Base prompt P1-0d/e addition and mapping 45-row seed; service `:125-135,274-305,325`; exactly `EF0000001`–`EF0000045`, one row each, `Imported=true`, no unexpected imported codes, and all 14 required nullable fields nonblank. | `Source != "BNK"` occurs exactly once, in the `capturedDocLogs` projection, and that projection feeds exactly three checks: filename uniqueness, DOCTYP coverage, and DOCTYP placement. It is used nowhere else. The warning set is exactly synthetic FiscalNo, CaptureQuality, and orphan DOCLOG; all other checks fail on violation. An unavailable or unauthorized source marks all data checks failed. The status file's “Resolved source differences” section is complete: it records the implemented deviations, does not silently invent source authority, and leaves the O7 decision to Miguel. --- ## Findings and A1–A5 disposition ### Blocking None. ### Advisory - **A1 — confirmed.** Case-sensitive `Enum.Parse` of an unknown `Treatment` or `ProcessingRoute` throws and the outer catch fails closed, but the summary labels it as source unavailable (`PostgresRegistryValidationSnapshotSource.cs:106-114`; `RegistryValidationService.cs:170-181`). This is a cosmetic diagnostic classification, not a validation bypass. - **A3 — confirmed.** Header/detail reconciliation scans details per header at `RegistryValidationService.cs:209-219`, giving O(headers × details) work. It is acceptable at the current scale and is a future optimization only. - **A4 — confirmed.** `CorrelationId` is required at `RegistryValidationService.cs:28,354-359` but is not emitted in this service's result or audit. Integration/logging should carry it forward; this does not weaken the checks reviewed here. - **A5 — confirmed.** The production-shaped `RegistryDocLogRow` record defaults `DocumentState="Posted"` and `DocumentId=""` at `RegistryValidationService.cs:47-59` as fixture convenience. The PostgreSQL source always supplies both (`:38-43,90-92`). ### Dismissed - **A2 — dismissed as a mismatch concern.** Pinned `SKILL.md` §15 line 508 requires unique filenames but does not specify case-folding. The pinned runnable assertions use ordinary Python exact-string set semantics, for example `Scripts/fix_stage10_round6_lmdag_filename_collision.py:88` with `len(set(fn))`; the pin labels comparisons case-insensitive where that is intended, such as filesystem/archive matching. `StringComparer.Ordinal` at `RegistryValidationService.cs:203` therefore matches the pinned uniqueness semantics: `Invoice.PDF` and `invoice.pdf` are distinct for this check. --- ## Verdict **Accepted with notes.** The reproduced build, ordinary suite, focused validator suite, disposable PostgreSQL suite, cleanup check, structural review, and sixteen-check source/implementation review all pass. There are no blocking findings. A1, A3, A4, and A5 are accepted advisories; A2 is dismissed; the disclosed two-commit topology deviation is accepted. this sign-off accepts P1-1a as implemented and does not authorize P1-1b imports, shared- or persistent-database migration, production deployment (O5 open), or the O7 decision.