KB-104C
00 — One-Roof Governance Law Hardening Finalization (Round 4) — Overview & Control (2026-06-01)
12 min read Revision 1
one-roof-governanceround4law-hardeningfinalizationopen-question-closurecount-gt-1open-axisiudieu37-hubread-onlyno-mutationconditional-go2026-06-01
00 — One-Roof Governance Law Hardening Finalization (Round 4) — Overview & Control
Date: 2026-06-01 · Mode: READ-ONLY (KB read + live PG read-only); zero mutation · Class: law/design clause hardening + open-question closure. NO implementation, NO canonical-design patch, NO law enactment, NO version bump, NO approval.
Package: knowledge/dev/reports/architecture/one-roof-governance-law-hardening-finalization-round4-2026-06-01/
Continuation of: Round 1 Decision Pack → Round 2 Clause Review & Hardening → Round 3 Hardening Revision (All Domains / All Axes). This is Round 4, a continuation (state recovered from KB, not a restart).
0.1 Headline verdict
STATUS = PASS. Decision = CONDITIONAL GO (confirmed and tightened).
- GO now — patch the concept / principle-level canonical design docs (One-Roof principle, governed-object contract, anarchy/governance-orphan definition, open-axis model + Axis Registry, IU coverage concept, coverage invariant v2/v3, detection obligations, noise/scale control, Điều 37 hub + §0-GOV hook, the
count > 1relevance rule), each carrying the hardened definitions M-DEF-1..9 + the count>1 rule and each flagging its blockers. - NO-GO — apply / remediation-binding canonical design docs, until the substrate prerequisites land (T1-6a APR action-types + T1-6b object/axis ownership edge + the newly-surfaced SB-AXIS-ENVELOPE at the IU substrate).
- NO-GO until OP-B — IU surface / owner-binding design docs, until the council assigns the IU owner and rules on the
review_decisionapproval adapter. - NO-GO (separate human phase) — any law enactment (
os_proposal_approvals = 0;amend_law/enact_nrmhandlersunimplemented).
What Round 4 adds over Round 3 (true continuation, not restatement): (1) a closed open-question ledger — every one of the 19 Round-2 + ~10 Round-3 + 5 Round-1 open items is now assigned a firm Round-4 disposition (resolved-default / council-decision / human-decision / substrate-blocker / law-drift-blocker / defer-safe) with a recommended default and a risk; (2) a precise, testable count > 1 governance-relevance rule (Branch D); (3) an all-domain coverage proof over ~33 present+future domains showing no hardcoded array is required; (4) final IU open-axis hardening grounded in new live evidence that the substrate currently hardcodes exactly three IU axes (iu_three_axis_envelope); (5) a Điều 37 own/reference/specialize/exclude/defer decision; (6) a specialized-law → Đ37 patch matrix; (7) Red-Team v3 = 64 scenarios (48 rerun + 16 new); (8) correction of three internal Round-3 doc discrepancies.
0.2 Hard Gate 0 — confirmations (this session)
| # | Gate | Result |
|---|---|---|
| 1 | KB read access | ✅ confirmed (all 17 Round-3 docs listed + read) |
| 2 | Live PG read-only access | ✅ query_pg, db directus, role context_pack_readonly, READ ONLY tx, statement_timeout 5s |
| 3 | No PG/Directus/Qdrant/Nuxt mutation | ✅ only SELECT issued (≈22 read-only queries); no INSERT/UPDATE/DELETE/DDL |
| 4 | No canonical law/design patch | ✅ only new report docs uploaded into THIS package path |
| 5 | No law enactment | ✅ none |
| 6 | No version bump | ✅ none |
| 7 | No approval creation / self-approval | ✅ none |
| 8 | Round-4 continuation, not restart | ✅ prior packages read; gaps filled, completed work not redone |
| 9 | Outputs = standalone KB report docs | ✅ 14 docs (00–13) in this package |
| 10 | Broad-coverage responsibility owned here | ✅ Branches A–K executed |
0.3 Live-substrate snapshot (re-verified read-only, 2026-06-01)
| Object | Live truth | Implication |
|---|---|---|
governance_registry |
9 rows: 5 active (GOV-COUNCIL/Đ37, GOV-DOT/Đ35, GOV-KG-SYS/Đ39, GOV-NRM-SYS/Đ38, GOV-SIV/Đ31) + 4 draft mothers (GOV-MOIT/MOT/MOUT/MOW, all by Đ7) | No GOV-IU agency → IU OWNER_GAP by construction (OP-B). capability JSON NULL on all 5 active. |
governance_relations |
8 edges, all agency→law; CHECK source_type,target_type ∈ {law, agency} |
Object/axis ownership edges structurally impossible (T1-6b / I2). |
governance_audit_log |
1 stale row (2026-04-24 codex meta-note, relation_id=null) |
Đ37 §5.5 relation-audit loop not closing — activate, don't replace. |
apr_action_types |
6: add_field, amend_law(unimplemented), create_item, enact_nrm(unimplemented), patch_ops_code, update_item |
No assign_governance_owner / grant_governance_exception / delegate_authority / assign_axis_owner (T1-6a). Law-enact handlers unimplemented. |
approval_requests / apr_approvals / os_proposal_approvals |
requests all DOT-repair/birth_orphan/reclassify/schema; apr_approvals=42 (all S178); os_proposal_approvals=0 |
No governance-coverage/IU/axis approval ever; no sovereign sign-off → COMMIT_FORBIDDEN. |
event_type_registry |
iu.* (16) all active; mother.* governance/proposal (9) all active=false (bare governance.*/proposal.* under domain mother) |
No governance/coverage/axis/orphan/anarchy/island/exception event domain — all NEW (Đ45 register-first). H1 naming defect confirmed. |
system_issues |
template_gap = 182,378 open; orphan types thiếu_quan_hệ(606)+thiếu_mã_định_danh(9); drift sai_lệch_dữ_liệu(2) |
Anti-spam (Branch K) is real at scale. No governance-orphan/anarchic/coverage/axis issue type yet. |
dot_coverage_required |
11 rows (birth.*, collection, governance.approval, monitoring.dot only) | No classification/pivot/governance-coverage/IU/axis coverage row — scanner absent. |
information_unit |
219 (146 enacted + 41 draft law_units + 32 design_doc_sections); owner_ref populated (free-text, NOT an agency FK); conformance_status='open' for all 219 |
IU owner pointer ≠ governance owner (OP-B). IU conformance gate never closes → IU coverage unverified. |
iu_three_axis_envelope |
216 rows; columns hardcode exactly 3 axes (axis_a_*, axis_b_*, axis_c_*); axis_b is a live 5-namespace tag-bag (unit_kind/legal_document/section_type/topic/legal_domain) |
Substrate currently violates "no fixed axis list" — a 4th axis needs DDL. NEW Round-4 blocker SB-AXIS-ENVELOPE. |
dot_iu_command_catalog |
54 standalone rows (command_name, category, mutating, reversible, target_functions) — NOT in dot_tools(309) |
IU DOT island parallel to the Đ35 SSOT (red-team #29). |
iu_relation |
60, all relation_type='contains' |
IU KG currently a thin containment tree. |
normative_registry |
47 enacted; Đ37 enacted (v3.3); Đ44 (IU), Đ45 (Event/Queue), Đ20 (Design), Đ23 (DOT-scan) ABSENT; Đ34 (Workflow) draft | IU's governing law (Đ44) and the event law (Đ45) are un-registered — law-drift/registration blocker. |
vector / sql |
iu_vector_sync_point=152, iu_qdrant_collection_registry=1, iu_sql_link=3, iu_structure_operation=72 |
IU vector/sql/structure machinery live but island-bound. |
0.4 Package map (this package, docs 00–13)
| Doc | Branch | Content |
|---|---|---|
| 00 | — | This overview + control + Hard Gate 0 + live snapshot + 20-question PASS matrix |
| 01 | A | State recovery + Round-3 verification (true-continuation proof; 3 internal discrepancies corrected) |
| 02 | B | Open-question closure ledger — all 19 Round-2 + Round-3 + Round-1 items, each with status + default + risk |
| 03 | C | All-domain coverage proof (~33 present+future domains; no-hardcode demonstration) |
| 04 | D | The count > 1 governance-relevance rule + acceptance tests |
| 05 | E | IU + open-axis final hardening (with SB-AXIS-ENVELOPE evidence) |
| 06 | F | Điều 37 centralization decision (own / reference / specialize / exclude / defer) |
| 07 | G | Specialized-law → Đ37 patch matrix (Đ0-G..Đ45) |
| 08 | H | Live-PG compatibility check — exact substrate blockers |
| 09 | I | Red-Team v3 (64 scenarios) |
| 10 | J | Final hardened law/clause package (consolidated text) |
| 11 | K | GO / NO-GO for next step |
| 12 | — | Next paste-ready prompts (8) |
| 13 | — | Self-review & acceptance |
0.5 Success-Target — all 20 questions answered (mission §4)
| # | Question | Answer (detail in doc) |
|---|---|---|
| 1 | Round-3 resolved all Tier-1 wording blockers except substrate? | YES — T1-1..T1-5, T1-7 folded as wording; T1-6 reclassified deferred→substrate prerequisite. (doc 01) |
| 2 | All Round-2/3 open questions resolved or turned into exact decisions? | YES — closed ledger, 0 vague items. (doc 02) |
| 3 | Covers all current + future domains without hardcoded lists? | YES — shared-truth predicate + Axis/Object registries; ~33-domain proof. (doc 03) |
| 4 | Covers IU + future IU axes without hardcoding the current 3? | YES at concept — generic axis model; substrate blocker SB-AXIS-ENVELOPE flagged. (doc 05) |
| 5 | Covers "anything count > 1" without flooding noise? | YES — count>1 is a candidacy trigger, gated by shared-truth + grain + coalesce. (doc 04) |
| 6 | Defines what is NOT governed? | YES — Class 0 (COUNCIL-owned list) + shared-truth test. (doc 04, 10) |
| 7 | Defines container-grain vs object-grain governance? | YES — governance grain = roots+non-inheriting+containers; M-DEF-7. (doc 04, 10) |
| 8 | Prevents inheritance hiding child policy/action/route/exception gaps? | YES — owner-link-ONLY inheritance; risk-links never inherit. (doc 04, 10) |
| 9 | Accountable owner vs supporting roles without contradicting Đ37? | YES — 6 responsibility scopes, 1 accountable each; reconciles §4.12. (doc 06, 10) |
| 10 | Defines governed exceptions tightly enough? | YES — 11-field record + fingerprint + replacement_plan + max-2-renewals + non-exemptable floors. (doc 10) |
| 11 | Governance-orphan / anarchic distinct from birth-orphan? | YES — birth precedence (M-DEF-4); anarchic=missing authority-critical link (M-DEF-5). (doc 02, 10) |
| 12 | Detection → issue/event/notification without spam? | YES — grain aggregation + coalesce + summary/detail + emit ceiling; proven against 182k template_gap. (doc 08, 09) |
| 13 | How future laws/design docs declare coverage? | YES — §0-GOV hook declarative block. (doc 06, 10) |
| 14 | How specialized laws reference Đ37 without duplicating? | YES — reference pattern + patch matrix. (doc 06, 07) |
| 15 | What must centralize into Đ37? | YES — own/reference/specialize table. (doc 06) |
| 16 | What stays in specialized laws? | YES — same table. (doc 06, 07) |
| 17 | Aligns with live PG substrate? | YES — full read-only verification. (doc 08) |
| 18 | Exact remaining PG substrate gaps? | YES — SB-1..SB-9 list. (doc 08) |
| 19 | Testable acceptance criteria for every key clause family? | YES — each M-DEF + clause carries an acceptance test. (doc 10) |
| 20 | Safe to move to canonical design patching? scope? | CONDITIONAL GO — concept docs yes; apply/IU-surface/enactment no. (doc 11) |
All 20 answered → PASS is admissible. CONDITIONAL GO is a valid PASS outcome.
0.6 Forbidden-action compliance (full detail in doc 13)
No PG/Directus/Qdrant/Nuxt mutation · no route/UI/schema change · no law enactment · no version bump · no status change · no normative_registry/law_catalog/governance_docs update · no approval/self-approval · no event/job/notification emit · no canonical-design-doc patch · no hardcode · no fixed current axes · no hidden local-governance island · no restart from scratch. Net effect on system truth = zero; additive KB reporting only.