05 — P-pub Staged Promotion Path (authority pack)

Goal: a path from "no publication authority enforcement" to "every IU has an authority-backed publication" without an unsafe hard-block. Live-change deferred (touches creation contract + needs council/sovereign for block_all).

1. Live reality (verified this run)

• fn_iu_create(p_canonical_address, p_title, p_body, p_actor, p_unit_kind, p_section_type, p_owner_ref, p_publication_type, p_parent_ref) — has publication_type, no publication_authority_ref param (SECDEF).
• fn_iu_birth_gate_layer1() exists (BEFORE-INSERT trigger fn); P-pub1/P-pub2 are warn-only today.
• Vocab: vocab.publication_authority.incomex_council (1), vocab.publication_type.{law,design_doc} (2). Thin.
• iu_create.ppub.enforcement_mode key does NOT exist — must be created to stage.
• 133/219 IU lack an authority publication; 73 lack a type (per prior survey).

2. Staged enforcement ladder (each stage reversible)

Stage	Behavior	Flag	Safe to apply?	Approval
S0 (now)	warn-only	(no key)	—	—
S1 warn	log a warning + metric on create without authority	iu_create.ppub.enforcement_mode='warn'	YES, safe	operator
S2 block_new	reject NEW creates lacking authority_ref; existing untouched	='block_new'	safe after fn_iu_create gains authority param + vocab expanded	council
S3 backfill	supersede-based backfill of 133 unauthored IU	n/a	governed migration	council
S4 block_all	reject any enact without authority	='block_all'	needs council + sovereign	council + sovereign

3. fn_iu_create signature patch (authority-ready)

Add an optional trailing param so existing callers don't break:

-- new overload / extended signature (additive, default NULL preserves current behavior)
fn_iu_create(..., p_publication_type text, p_parent_ref uuid,
             p_publication_authority_ref text DEFAULT NULL)

Behavior keyed by iu_create.ppub.enforcement_mode:

• warn: if authority NULL → emit warning, proceed.
• block_new: if authority NULL → RAISE (new creates only).
• block_all: also enforced at enact. Gateway note: the canonical_function signature in iu_create.gateway.canonical_function must be updated in lockstep, or the new overload registered as an additional allowed writer.

4. Vocab expansion plan (Đ32 item)

Add authorities: incomex_council (exists), plus domain_admin, company_admin, sovereign, automated_agent (the last marks machine-asserted, never sufficient alone for block_all). Add types: law, design_doc (exist), plus report, protocol, spec, proposal, record. Each as a vocab.publication_* dot_config row.

5. Backfill plan (S3)

• Enumerate the 133 unauthored IU. For each, derive the lawful authority from its owner_ref/lineage; where unknown, route to a council review queue.
• Backfill via supersede (new version carrying authority), never in-place rewrite of enacted rows (Đ30 reversibility, enacted_immut).

6. Rollback

• S1: delete iu_create.ppub.enforcement_mode key (back to warn-only S0).
• S2/S4: set key back to warn; drop the authority param overload if added.

7. Test plan

• Create with authority → pass. Create without authority under block_new → RAISE. Existing enact under block_new → still pass (proves "new only"). Flip to warn → all pass. Confirm gateway still enforced and never-flip intact throughout.

8. Verdict & next macro

AUTHORITY-PACK. Safe live increment available now = S1 (warn key) + vocab expansion (both additive dot_config rows). S2+ needs the fn_iu_create authority param (creation-contract change) + council. Next macro: IU_PPUB_S1_WARN_AND_VOCAB_EXPANSION_LIVE_200000X, then IU_PPUB_S2_BLOCK_NEW_AUTHORITY_CONTRACT_300000X (council-gated).