P3D Pack 1 Phase 5C2B — Publication Authority Vocab Seed Design

Date: 2026-05-12 Author: Opus (Claude) Authority: GPT directive gpt-directive-opus-p3d-pack1-phase5c2b-authority-vocab-seed-2026-05-12.md Mode: DESIGN ONLY — no execution

---

A. Why 5C2B is needed

Phase 5C2 DIEU-35 pilot migration requires every new IU to have identity_profile.publication_authority_ref set to a non-null value. Probe 5C2A (PASS) confirmed that:

• dot_config has 0 rows matching vocab.publication_authority.*.
• fn_iu_birth_gate_layer1 checks this key — currently WARNING in pilot mode, will BLOCK in production.
• fn_iu_create does not set this key.
• No existing IU has this key in identity_profile.

Without a governed vocab entry, the migration would need to hardcode a magic string — violating §0-AU and no-hardcode discipline. Phase 5C2B seeds the vocab first so 5C2 migration can reference a governed value.

B. Evidence from 5C2A probe

Finding	Value
vocab.publication_authority.* rows	0
tac_publication authority-like columns	owner, approved_by, council_score
approved_by across 3 pubs	NULL, NULL, NULL
council_score across 3 pubs	NULL, NULL, NULL
owner values	S178-FIX23, incomex_council, INCOMEX
IU rows with publication_authority_ref	0/12
Birth gate behavior	checks key presence, WARNING if null, no vocab validation
fn_iu_create authority handling	none — no parameter, no key insertion

Full report: knowledge/dev/laws/dieu44-trien-khai/reports/p3d-pack1-phase5c2a-publication-authority-ref-probe-report.md

C. Locked authority value

GPT decision (Option C):

dot_config.key   = vocab.publication_authority.incomex_council
dot_config.value = incomex_council

Rationale: All 3 pilot publications (Đ35, Đ32, Đ28) are products of the Incomex AI Council governance process. A single authority value reflects this truthfully.

D. Why not use tac_publication.owner

owner values are heterogeneous and semantically inconsistent:

doc_code	owner	Semantic
DIEU-35	S178-FIX23	Sprint operator tag
DIEU-32	incomex_council	Governance body
DIEU-28	INCOMEX	Organization name

Using owner directly would inject non-vocab-bound, operationally-motivated strings into identity_profile — creating tech debt and undermining future vocab validation. The owner column records who last touched the record, not what authority governs the publication.

E. Why not patch fn_iu_create before pilot

Patching fn_iu_create to accept and set publication_authority_ref would:

1. Expand 5C2 scope from "seed + migrate" to "seed + function patch + migrate".
2. Require additional birth gate testing (function signature change).
3. Risk regression on the 12 existing IU rows that use current fn_iu_create.

GPT decision: defer fn_iu_create extension to post-pilot. The 5C2 DRAFT already plans to set publication_authority_ref via direct identity_profile JSON construction within the migration transaction. This is acceptable for pilot; production-scale IU creation will need the function extension later.

F. Seed target and expected row

Table: dot_config

Expected row after seed:

Column	Value
key	vocab.publication_authority.incomex_council
value	incomex_council
description	Publication authority for Incomex AI Council-governed law pilots; introduced by P3D Pack1 Phase5C2B before DIEU-35 migration.
updated_at	now()

Row count change: 0 → 1 row matching vocab.publication_authority.*

G. Safety gates

Gate	Check	Behavior if FAIL
G0 — Schema introspection	dot_config exists with expected columns	STOP, report BLOCKED
G1 — Column resolution	key, value, description, updated_at resolve to expected types	STOP, report BLOCKED
G2 — No existing row	SELECT COUNT(*) FROM dot_config WHERE key = 'vocab.publication_authority.incomex_council' = 0	STOP, report ALREADY_EXISTS (idempotent — not an error, but skip INSERT)
G3 — Advisory lock	pg_try_advisory_lock(hashtext('p3d_pack1_phase5c2b_publication_authority_vocab_seed'))	STOP, report LOCK_CONTENTION
G4 — Post-insert verify	SELECT inserted row, confirm key/value/description match	STOP, report VERIFY_FAIL, recommend rollback

H. Rollback model

Rollback command:

DELETE FROM dot_config
WHERE key = 'vocab.publication_authority.incomex_council';

Exact-key deletion. No LIKE, no wildcard. Only the specific row seeded by 5C2B.

Rollback conditions:

• G4 verify fails (row exists but values wrong).
• 5C2 migration fails and needs full revert.
• GPT/User decides to change authority strategy.

Rollback does NOT cascade: this is a standalone vocab entry; no FK references it. No IU depends on it until 5C2 migration runs.

I. How 5C2 will consume this value

The 5C2 DIEU-35 pilot migration prompt (currently DRAFT) will:

1. Read vocab.publication_authority.incomex_council from dot_config to confirm it exists.
2. For each TAC logical unit being migrated to IU, construct identity_profile JSON including "publication_authority_ref": "incomex_council".
3. The value comes from the vocab lookup, not hardcoded in the migration prompt.
4. Birth gate fn_iu_birth_gate_layer1 will see non-null publication_authority_ref → WARNING clears → pilot proceeds.

This is the chain: 5C2B seeds vocab → 5C2 reads vocab → 5C2 sets identity_profile → birth gate validates.

---

Phase 5C2B Design | Publication Authority Vocab Seed | 2026-05-12