READY-TO-ASSEMBLE-LEGO1-PATCH1 04 — [P1-1] Value Manifest & Deterministic Authority-Backed Resolver — 2026-06-22

Closes Codex P1-1. Gate: REGISTRATION_HOLD · CAN_PROCEED = NO · 0 runtime mutations. Read-only projection only; no rows invented, none created.

---

1. Defect (reconstructed)

Prior files 06/12/13 deferred the actual vocabulary values to build execution while claiming no preparation gap. Codex: this is PREPARATION_INPUT_MISSING; Gate B needs a reviewed, hashed input manifest OR a deterministic authority-backed resolver that yields the exact values + authority references. PATCH1 supplies both.

2. The deterministic authority-backed resolver R_C1

R_C1 is a pure, read-only function over governed source tables — deterministic (same DB state → same output), authority-backed (each value carries its source provenance), and non-inventing (it projects existing governed rows; it does not fabricate values):

R_C1(snapshot_ts) =
  FROM apr_action_types a            -- governed action-type registry (authoritative source)
  WHERE a.status = 'active'
  PROJECT {
    operation_code         := a.action_code,
    governing_authority_ref := a._dot_origin,           -- provenance = governing source
    semantics_frozen       := { "description": a.description },
    act_type               := <governed act-type mapping, reviewed at Gate B>,
    authority_class        := COALESCE(p.requires_president, false)  -- from process_axis_action_vocabulary p
  }
  ORDER BY a.action_code
  → canonical-serialize (cser-v1, file 09) → SHA-256 = manifest_digest

• Source-of-truth: apr_action_types (governed registry, each row has _dot_origin provenance) — related-but-distinct from canonical_operation; R_C1 is the governed mapping from source to the C1 vocabulary, not a claim of identity.
• Authority enrichment: process_axis_action_vocabulary supplies requires_president/mutates_canon so each canonical_operation inherits the correct authority class (canon-mutating ⇒ president-required).
• Gate-B review = governed selection: which candidates are admitted (and their exact act_type mapping) is a governed review/curation act at Gate B; each admission is a governed create_item/staging entry (file 02), carrying the source provenance as governing_authority_ref.

3. Concrete candidate manifest snapshot (live, read-only, 2026-06-22)

The deterministic projection of apr_action_types WHERE status='active' (14 rows), each with provenance — this is the reviewable input manifest (final admission curated at Gate B):

#	operation_code (candidate)	governing_authority_ref (_dot_origin)	semantics (description)
1	activate_event_type	PG:sb1-gov-vocab	Activate a registered governance event type (SB-11)
2	add_field	MIGRATION	Add a new field to a collection schema
3	amend_law	MIGRATION	Amend constitutional law (reserved, pending Dieu38 handler)
4	assign_axis_owner	PG:sb1-gov-vocab	Assign accountable owner of an axis per scope
5	assign_governance_owner	PG:sb1-gov-vocab	Assign accountable governance owner per scope (SB-2)
6	authorize_build_step	PG:sb1-gov-vocab	Issue an L3 governance_build_authorization grant for one build step
7	create_item	MIGRATION	Create a new item in a collection
8	delegate_authority	PG:sb1-gov-vocab	Delegate authority to a TTL-bounded delegated owner (SB-2)
9	enact_nrm	S178-Fix21-P1-V1-td-f21-01	Ban hành NRM — enact law/constitution/regulation
10	grant_governance_exception	PG:sb1-gov-vocab	Record a governed exception owner_kind under approval (SB-2)
11	patch_ops_code	MIGRATION	Patch DOT ops-code (bash/script asset)
12	register_axis	PG:sb1-gov-vocab	Register/activate an axis_registry row
13	register_topic_node	PG:sb1-gov-vocab	Promote a taxonomy topic candidate to a governed node
14	update_item	MIGRATION	Update fields of an existing item

Provenance classes: PG:sb1-gov-vocab (8), MIGRATION (5), S178-Fix21-… (1). Every candidate is authority-backed; none invented. register_dot is not in the source (confirming it is not a default; it would be one admitted value only if/when its governing source exists).

The exact manifest_digest (SHA-256 over the cser-v1 serialization of this projection) is computed at build time from a fresh read-only R_C1 snapshot (file 09 binds it). It is recomputed live because apr_action_types may change; the resolver — not a frozen list — is the durable contract.

4. Why this closes P1-1

• The expected diff is no longer +N (unknown): it is + (count of R_C1-admitted rows), instantiable from the snapshot.
• Tests can be instantiated against named candidate values (file 08).
• Hashes can be precomputed (the manifest_digest binds the exact projected set).
• Authorization can bind to exact effects (each value's governing_authority_ref + the manifest_digest, file 05).
• Residual = Gate-B governed selection/curation (a review act) + authority — not missing preparation input.

5. Boundary attestation

Read-only projection; no rows invented, none created; no DOT executed. REGISTRATION_HOLD retained; CAN_PROCEED = NO; 0 runtime mutations. Supersedes the prior "values determined in build, no manifest" position (files 06/12/13).