dot-iu-cutter v0.5 WS-Q5 — Seed Data Draft (DML, INSERT-only)

Phase: v0_5_WS_Q5_seed_and_privilege_command_authoring · Nature: authoring_only / no_execution · Date: 2026-05-18 Authority (consumed, NOT reopened): GPT closeout …WS-Q5-production-apply-closeout-gpt-review-2026-05-18 (next_phase: v0_5_WS_Q5_seed_and_privilege_command_authoring, nature: authoring_only__no_execution); WS-2 D1/D2/D3/D4/D5/D6; WS-3 report; Q5 verification/rollback master plan; live schema = production-apply-command-package (12 tables LIVE+empty, catalog-verified).

⚠️ GATING BANNER — DO NOT EXECUTE

phase: seed_authoring
dml_executed: none        # QG2 — authored for sovereign command-review, NOT run
insert_only: true ; update: 0 ; delete: 0 ; on_conflict: 0
production_write: none ; grant: none ; directus_mutation: none
execution_authorized: false ; self_advance: PROHIBITED
decision_authority: GPT / User ONLY

Executable-for-review only. Plain INSERT (no ON CONFLICT): the 12 tables were catalog-verified empty at production apply and this is the sole bootstrap — no conflicting row can pre-exist; idempotency is provided by the emptiness pre-gate (verification-plan §1) + the compensation draft, not by ON CONFLICT (QG: ON CONFLICT only if justified — here plain INSERT is the safer, auditable choice). All registered_at/created_at are a single deterministic constant for reproducibility.

---

0. Seed scope & ordering (FK-safe)

deterministic_constant: TS := TIMESTAMPTZ '2026-05-18T00:00:00+00'
principal:              registered_by/created_by := 'ws-q5-seed-bootstrap'
insert_order (parents -> children, FK-safe):
  1 matcher_config_registry        (8 rows)   WS-2 D3 matcher_ref set
  2 address_template_registry      (2 rows)   WS-2 D6 + BR-A1 locked scheme
  3 grammar_profile                (2 rows)   WS-2 D3 Profile A/B
  4 grammar_profile_level          (8 rows)   WS-2 D3 level_definitions[]
  5 grammar_profile_status_marker  (2 rows)   WS-2 D3 status_marker_rules
  6 entity_kind_registry           (5 rows)   WS-2 D5 seed strategy
  7 source_family_registry         (3 rows)   WS-2 D2  [READY subset only]
  8 metadata_key_registry          (1 row)    WS-2 D1 + v0.4 §4
executable_seed_total: 31 rows across 8 tables
intentionally_NOT_seeded (0 rows — flagged §9):
  entity_reference_registry, source_document_registry,
  source_document_version_registry, authority_override

---

1. matcher_config_registry — WS-2 D3 (matcher = config row, NOT inline regex)

-- @authority WS-2 D3: every grammar matcher is a config row (anti-hardcode, NHV-2).
-- matcher_definition = structured descriptor; WS-2 D3 gave matcher_kind +
-- numbering only, NOT a concrete match expression -> see OPEN OD-MC1.
INSERT INTO cutter_governance.matcher_config_registry
  (matcher_ref, matcher_kind, matcher_definition, description, lifecycle, registered_by, registered_at)
VALUES
 ('mc.icx.nguyen_tac','heading-rule','{"matcher_kind":"heading-rule","level":"NGUYEN_TAC","numbering_scheme":"arabic","detection":"DEFERRED_WS2_no_concrete_pattern"}'::jsonb,'Incomex Constitution — 15 Nguyên tắc Nền tảng','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('mc.icx.kien_truc','heading-rule','{"matcher_kind":"heading-rule","level":"KIEN_TRUC_SECTION","numbering_scheme":"letter","detection":"DEFERRED_WS2_no_concrete_pattern"}'::jsonb,'Incomex Constitution — Kiến trúc Hạ tầng A/B/C','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('mc.icx.dieu','structural','{"matcher_kind":"structural","level":"DIEU","numbering_scheme":"arabic","detection":"DEFERRED_WS2_no_concrete_pattern"}'::jsonb,'Incomex Constitution — Mục lục Luật Điều 0..44','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('mc.vn.chuong','heading-rule','{"matcher_kind":"heading-rule","level":"CHUONG","numbering_scheme":"roman","detection":"DEFERRED_WS2_no_concrete_pattern"}'::jsonb,'VN national law — Chương','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('mc.vn.dieu','structural','{"matcher_kind":"structural","level":"DIEU","numbering_scheme":"arabic","detection":"DEFERRED_WS2_no_concrete_pattern"}'::jsonb,'VN national law — Điều','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('mc.vn.khoan','structural','{"matcher_kind":"structural","level":"KHOAN","numbering_scheme":"arabic","detection":"DEFERRED_WS2_no_concrete_pattern"}'::jsonb,'VN national law — Khoản','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('mc.vn.diem','structural','{"matcher_kind":"structural","level":"DIEM","numbering_scheme":"letter","detection":"DEFERRED_WS2_no_concrete_pattern"}'::jsonb,'VN national law — Điểm','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('mc.vn.doan','structural','{"matcher_kind":"structural","level":"DOAN","numbering_scheme":"none","detection":"DEFERRED_WS2_no_concrete_pattern"}'::jsonb,'VN national law — Đoạn','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00');

2. address_template_registry — WS-2 D6 + BR-A1 LOCKED scheme <DOCPREFIX>/<L1>-<L2>-...-<Lk> (QG7)

-- @authority WS-2 D6: docprefix_separator='/', level_separator='-',
-- encodes_status=false (status is metadata, NEVER in address — CAV-3).
-- NOTE: BR-A1 (slash-vs-hyphen final lock) is GPT/User-OPEN; this draft uses
-- the WS-2 D6 RECOMMENDED scheme (option a) as instructed — see OPEN BR-A1 §9.
INSERT INTO cutter_governance.address_template_registry
  (address_template_ref, template_pattern, docprefix_separator, level_separator, encodes_status, description, lifecycle, registered_by, registered_at)
VALUES
 ('at.icx.const.v4','<DOCPREFIX>/<L1>-<L2>-...-<Lk>','/','-',false,'Incomex internal Architecture Constitution v4 address template (BR-A1 locked scheme; status NOT encoded)','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('at.vn.law','<DOCPREFIX>/<L1>-<L2>-...-<Lk>','/','-',false,'Vietnam national law address template (BR-A1 locked scheme; status NOT encoded)','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00');

3. grammar_profile — WS-2 D3 Profile A/B (FK -> address_template_registry)

INSERT INTO cutter_governance.grammar_profile
  (grammar_profile_ref, display, address_template_ref, lifecycle, registered_by, registered_at)
VALUES
 ('incomex-architecture-constitution-v4','Incomex Architecture Constitution v4 (internal law)','at.icx.const.v4','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('vn-national-law','Vietnam National Law (external government law)','at.vn.law','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00');

4. grammar_profile_level — WS-2 D3 level_definitions[] (FK -> grammar_profile, matcher_config_registry)

-- Profile A (3 levels) + Profile B (5 levels). PK(grammar_profile_ref,level_seq);
-- UQ(grammar_profile_ref,level). matcher_ref resolves to §1 rows (NHV-2).
INSERT INTO cutter_governance.grammar_profile_level
  (grammar_profile_ref, level_seq, level, matcher_kind, matcher_ref, numbering_scheme, is_leaf_candidate)
VALUES
 ('incomex-architecture-constitution-v4',1,'NGUYEN_TAC','heading-rule','mc.icx.nguyen_tac','arabic',true),
 ('incomex-architecture-constitution-v4',2,'KIEN_TRUC_SECTION','heading-rule','mc.icx.kien_truc','letter',true),
 ('incomex-architecture-constitution-v4',3,'DIEU','structural','mc.icx.dieu','arabic',true),
 ('vn-national-law',1,'CHUONG','heading-rule','mc.vn.chuong','roman',false),
 ('vn-national-law',2,'DIEU','structural','mc.vn.dieu','arabic',false),
 ('vn-national-law',3,'KHOAN','structural','mc.vn.khoan','arabic',true),
 ('vn-national-law',4,'DIEM','structural','mc.vn.diem','letter',true),
 ('vn-national-law',5,'DOAN','structural','mc.vn.doan','none',true);

5. grammar_profile_status_marker — WS-2 D3 status_marker_rules (Profile A only; B has none)

-- @authority WS-2 D3 Profile A: "✅"=>enacted, "📋"=>controlled_draft.
-- ⚠ OD-SM1: marker holds SEMANTIC Unicode codepoints — U+2705 (✅) and
-- U+1F4CB (📋). Unlike DDL COMMENTs (ASCII-normalized for transport in the
-- apply package), these are DATA and MUST be inserted as exact UTF-8. The
-- execution phase MUST NOT ASCII-normalize them; verification asserts the
-- exact hex codepoints (verification-plan §1.6), not a rendered glyph.
INSERT INTO cutter_governance.grammar_profile_status_marker
  (grammar_profile_ref, marker, maps_to)
VALUES
 ('incomex-architecture-constitution-v4','✅','enacted'),          -- marker hex E2 9C 85 (U+2705)
 ('incomex-architecture-constitution-v4','📋','controlled_draft'); -- marker hex F0 9F 93 8B (U+1F4CB)

6. entity_kind_registry — WS-2 D5 seed strategy (concrete set)

-- @authority WS-2 D5: "Seed strategy entity_kind (ban đầu): sql_entity,
-- code_module, git_file, directus_item, report_path" — seeded verbatim.
-- Task-listed customer/contract/invoice/report/process_step are WS-2 D5
-- illustrative natural_key examples, NOT the authorized entity_kind seed set
-- -> EXCLUDED, see OPEN OD-EK1 §9 (no self-assume — QG1).
INSERT INTO cutter_governance.entity_kind_registry
  (entity_kind, display, description, default_source_system_hint, lifecycle, registered_by, registered_at)
VALUES
 ('sql_entity','SQL entity','Live row/table in a PostgreSQL source system','postgres','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('code_module','Code module','Source code module/unit in a repository','github','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('git_file','Git file','A file path tracked in a git repository','github','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('directus_item','Directus item','An item in a Directus collection','directus','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('report_path','Report path','A stored report artifact addressed by path','knowledge-base','active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00');

7. source_family_registry — WS-2 D2 ⚠ READY subset = 3 of 9 (FK grammar_profile_ref NOT NULL; only 2 profiles authorized)

-- @authority WS-2 D2 attribute table. source_family_registry.grammar_profile_ref
-- is NOT NULL and FK -> grammar_profile. WS-2 D3 concretely authorized ONLY 2
-- grammar profiles. Only the 3 DOCUMENT families bind cleanly to them:
INSERT INTO cutter_governance.source_family_registry
  (source_family, display_vi, display_en, authority_semantics_default, grammar_profile_ref, version_policy, status_policy, default_parser_profile_ref, lifecycle, registered_by, registered_at)
VALUES
 ('internal_incomex_constitution','Hiến pháp Kiến trúc nội bộ','Internal Incomex Architecture Constitution','normative_authority','incomex-architecture-constitution-v4','living_document','enacted_only',NULL,'active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('internal_incomex_law','Luật nội bộ (Điều 0..44)','Internal Incomex Law','normative_authority','incomex-architecture-constitution-v4','living_document','enacted_only',NULL,'active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00'),
 ('external_government_law','Luật nhà nước','External government law','normative_authority','vn-national-law','external_pinned','enacted_only',NULL,'active','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00');

-- ⛔ NOT EXECUTABLE — OPEN OD-SF1 (§9). The remaining 6 WS-2 D2 families
-- (internal_process, sql_entity, code_artifact, report, lesson,
-- architecture_note) have NO WS-2-authorized grammar_profile_ref and CANNOT
-- satisfy the NOT NULL FK. Their WS-2 D2 attributes are preserved below for
-- GPT decision; they are commented out and MUST NOT be run as-is:
-- ('internal_process',  'Quy trình nội bộ','Internal process',          'normative_authority',     <profile?>,'living_document','all',          NULL,'proposed',...),
-- ('sql_entity',        'Thực thể SQL','SQL entity',                      'implementation_authority',<profile?>,'external_pinned','all',         NULL,'proposed',...),
-- ('code_artifact',     'Code đang chạy','Code artifact',                 'implementation_authority',<profile?>,'external_pinned','all',         NULL,'proposed',...),
-- ('report',            'Báo cáo','Report',                              'evidence_authority',      <profile?>,'immutable_snapshot','all',      NULL,'proposed',...),
-- ('lesson',            'Bài học','Lesson',                              'evidence_authority',      <profile?>,'immutable_snapshot','all',      NULL,'proposed',...),
-- ('architecture_note', 'Ghi chú kiến trúc','Architecture note',         'normative_authority',     <profile?>,'living_document','draft_flagged',NULL,'proposed',...);

8. metadata_key_registry — WS-2 D1 + v0.4 §4 (minimal authority-named bootstrap)

-- @authority v0.4 Hybrid §4: "idempotency_key graduate đầu" — the only key
-- explicitly named by authority. WS-2 D1 enumerated NO concrete bootstrap key
-- list -> seed exactly this one; further keys are OPEN OD-MK1 (§9).
INSERT INTO cutter_governance.metadata_key_registry
  (metadata_key, key_namespace, key_type, allowed_values_policy, cardinality_policy, mutability_policy, index_policy, hot_threshold_hint, lifecycle, owner_role, created_by, created_at)
VALUES
 ('idempotency_key','lineage','text','free','single','immutable','promoted_index',NULL,'active','cutter_governance','ws-q5-seed-bootstrap',TIMESTAMPTZ '2026-05-18T00:00:00+00');

9. Open decisions / flags (NOT self-resolved — QG1; route GPT/User)

OD-SF1 (HIGH, blocks full 9-family seed): source_family_registry.grammar_profile_ref
  is NOT NULL FK but WS-2 D3 authorized only 2 grammar profiles. Only 3
  document families seedable now. Options (advisory, NOT decided):
    (a) GPT ratify a WS-2-consistent generic non-hierarchical profile
        (e.g. 'opaque-resource-v1', single OPAQUE level) -> seed all 9;
    (b) separate DDL cycle to make grammar_profile_ref NULLable (schema
        change — OUT OF SCOPE / forbidden this phase);
    (c) seed only the 3 document families now; defer the other 6.
  recommendation (advisory): (a) or (c). Agent does NOT self-resolve.
OD-EK1 (MED): task-listed entity_kinds customer/contract/invoice/report/
  process_step are WS-2 D5 illustrative natural_key examples, not the D5
  authorized seed set. Excluded; GPT confirms whether to add as new kinds.
OD-MC1 (MED): WS-2 D3 gave matcher_kind+numbering but NO concrete match
  expression. matcher_definition uses a descriptor with detection=DEFERRED.
  Concrete matcher internals = later WS-2 / parser-design decision.
OD-MK1 (MED): WS-2 D1 gave no concrete metadata-key bootstrap list. Only
  idempotency_key seeded. Advisory candidate set for GPT (NOT in seed):
  authority_role, source_family, content_checksum, status_marker.
OD-SM1 (MED): status marker rows carry semantic Unicode (U+2705 / U+1F4CB).
  Execution phase MUST insert exact UTF-8 (NO ASCII normalization, unlike
  DDL comments). Verification asserts hex codepoints.
BR-A1 (carried, HIGH, must_resolve_before_dry_run): address separator
  slash-vs-hyphen final lock = GPT/User. Draft uses WS-2 D6 recommended
  `<DOCPREFIX>/<L1>-...` as instructed.
OD-SEQ1 (carried): source_document_registry / _version_registry NOT seeded
  (precedence undecided; no authorized concrete documents). authority_override
  NOT seeded (WS-2 D4: override only for a real misclassified IU — none yet).
  entity_reference_registry NOT seeded (WS-2 D5: real pilot binding only).

10. Statements

• QG1: every seed value traces to WS-2 (D1/D2/D3/D5/D6) / v0.4 §4 authority; non-authority items flagged, not assumed. QG2: nothing executed. No UPDATE/DELETE/ON CONFLICT. QG7: address template = locked separator scheme.
• No GRANT, no Directus, no vector, no CUT/VERIFY, no deploy, no git commit, no self-advance.
• Self-advance PROHIBITED — doc 1 of 6; STOP after package complete → route GPT/User.

Companion: seed-rollback-compensation-draft, privilege-grant-draft, privilege-rollback-draft, seed-privilege-verification-plan, seed-privilege-authoring-report.