GPT Review — 23-P3C4 Policy + Agent Context Prompt rev2

Date: 2026-05-07
Reviewer: GPT-5.5 Thinking / Incomex Hội đồng AI
Reviewed: knowledge/dev/laws/dieu44-trien-khai/prompts/23-p3c4-iu-policy-and-agent-context-prompt.md rev2

Verdict

Rev2 is close, but do not dispatch yet. Rev3 small patch required.

Opus correctly applied the 9 requested fixes. The remaining issues are small but important because P3C4 changes production behavior.

Accepted rev2 fixes

• Policy UPDATE is rowcount-guarded.
• dot_config key uniqueness is checked.
• Tests use a dedicated P3C4 pilot IU.
• Context pack upload is required.
• Comment test uses explicit draft context.
• Protected count before/after is checked.
• Raw rollback SQL was removed from context pack.
• Final report includes policy_action and switch_status.
• T3 response sample is printed.
• End-to-end reviewer apply test remains included.

Required rev3 fixes

P1 — Add actual rollback if tests fail after policy switch

Rev2 final report says:

cleanup_on_test_fail=rollback_policy_to_auto_apply

but there is no rollback block. This creates a dangerous mismatch: if tests fail after changing policy, production remains require_review while report implies rollback.

Patch:

If POLICY_ACTION=UPDATED_AUTO_APPLY_TO_REQUIRE_REVIEW and TEST_FAIL != 0 or PHASE_STATUS=FAIL, rollback policy to auto_apply with exact rowcount guard:

ROLLBACK_ROWS=$("${PSQL_NOSTOP[@]}" -t -A <<'SQL'
WITH u AS (
  UPDATE dot_config
  SET value='auto_apply'
  WHERE key='iu_edit.policy.default_mode'
    AND value='require_review'
  RETURNING 1
)
SELECT count(*) FROM u;
SQL
)

Require ROLLBACK_ROWS=1; otherwise set PHASE_STATUS=CRITICAL.

If no rollback was needed, report rollback_status=NOT_RUN.

If rollback succeeded, report rollback_status=PASS_POLICY_RESTORED_AUTO_APPLY.

If already require_review at preflight and verify fails, do not rollback to auto_apply; report rollback_status=NOT_RUN_ALREADY_SWITCHED.

P2 — Context pack upload cannot be only echo text

Rev2 still only echoes content and tells Agent to upload. It says Agent must upload, but there is no machine verification.

Patch prompt to require Agent Data create/update call after generating the content, then verify the document exists in KB.

If the execution environment cannot directly call Agent Data from the script, the prompt must still explicitly instruct Agent outside shell:

1. create/update knowledge/dev/laws/dieu44-trien-khai/context-packs/iu-agent-front-door-context.md;
2. then verify by reading/listing it;
3. set/report context_pack_upload=PASS only after verification.

If verification fails, phase_status=FAIL.

P3 — T2 should verify version_seq=1 count exactly one, not only select one seq value

Rev2 does:

SELECT version_seq FROM unit_version WHERE unit_id=(...)

If somehow multiple rows exist, psql may return multiple lines and bash comparison becomes ambiguous. Patch T2 to verify:

• UV count for new IU = 1;
• min(version_seq)=1;
• max(version_seq)=1;
• invariant all_pass=true.

P4 — T3 should require guidance/next_action sample

Rev2 prints T3_FULL but does not assert guidance or next_action. Because the context pack says agents can follow returned guidance, test that require_review response includes at least next_action or guidance.

Patch T3 extraction:

SELECT j->>'status', j->>'draft_id', j->>'policy', j->>'guidance', j->>'next_action', j::text

Require status=draft_created_review_required, draft_id non-empty, UV unchanged, and at least one of guidance/next_action non-empty.

P5 — T6 should assert status=comment_added, not only count +1

Rev2 checks comment count +1 but not the returned status. Patch:

[ "$T6" = "comment_added" ] && [ "$COMMENT_POST" = "$((COMMENT_PRE+1))" ]

P6 — Final phase should fail if context pack upload status is missing

Add CONTEXT_UPLOAD to final gate:

elif [ "$CONTEXT_UPLOAD" != "PASS" ]; then PHASE_STATUS="FAIL"

Only apply this after tests pass / context upload attempted. If preflight fails before context upload, report not-run cleanly.

P7 — Context pack should say actor must be stable

Add one short line to context pack:

Actor nên là định danh ổn định, ví dụ: gpt, opus, agent:codex, reviewer:gpt.

This supports future per-actor watermark/read-state.

Directive to Opus

Patch P3C4 prompt to rev3 with P1–P7.

Path:

knowledge/dev/laws/dieu44-trien-khai/prompts/23-p3c4-iu-policy-and-agent-context-prompt.md

Do not dispatch after patch. Return for GPT/User final review.

Hard boundaries remain

• No dispatch.
• No function changes.
• No table DDL.
• No trigger/gateway changes.
• No vector mutation.
• No notification implementation.
• No cleanup/pilot deletion.
• Only one dot_config key may change.
• Rollback may only restore that same key to previous value if tests fail.
• No raw rollback instructions in Agent context pack.

Summary

P3C4 rev2 is well structured. Rev3 must align report wording with actual rollback behavior, make the context pack upload verifiable, and tighten a few test assertions. After rev3, P3C4 should be dispatch-ready.