21 — SB-1 / SB-2 Next Paste-Ready Prompts

Each prompt is self-contained and begins with the mandatory state-recovery preamble (doc 00 §0.10). All remain design-only / decision-packet-only until the council/human gates in doc 03 §3.5 are met. Pick the next macro per the dependency graph (doc 04). Recommended order: P1 (council C-1/C-2) → then P2 (T7 events) ∥ P3 (T6 scanner); P4 (OP-B) and P5 (auto-approve hardening) in parallel.

---

Shared preamble (paste at the top of every prompt below)

STATE RECOVERY (mandatory): Read, in order:
  1. knowledge/dev/reports/architecture/one-roof-governance-technical-addendum-and-implementation-index-2026-06-01/00-read-me-first-implementation-index.md
  2. …/01-current-state-and-controlling-sources.md
  3. …/03-blocker-register-and-gates.md
  4. …/04-implementation-track-map.md
  5. …/16-sb1-apr-action-types-detailed-technical-design.md
  6. …/17-sb2-object-axis-ownership-detailed-technical-design.md
  7. …/18-sb1-sb2-live-pg-evidence.md
  8. …/20-sb1-sb2-integration-and-implementation-readiness.md
This index controls. Concept canon > pre-patch design. Round-4 law > earlier wording.
Blockers win over ambition. If unclear, STOP and report.
HARD GATE 0: no PG/Directus/Qdrant/Nuxt mutation; no schema/DOT/UI/API; no enactment/
  version-bump/status-change/registry-write; no approval/self-approval; no hardcode;
  no hidden local governance island; no implementation disguised as scaffold.
Write all new docs inside this package. Return doc-00 §0.9 minimum final-report fields.

---

P1 — Council decision packet for C-1 + C-2 (DECISION PACKET ONLY; default = GO)

MISSION: ONE_ROOF_GOVERNANCE_C1_C2_COUNCIL_DECISION_PACKET
[shared preamble]
Produce a COUNCIL DECISION PACKET (draft minutes only; do NOT bind into governance_registry,
do NOT enact, do NOT create approval rows) that asks the council to rule on:
  - C-1: object/axis ownership edge — new `governance_object_ownership` table (doc 17) vs widen
    the relations CHECK. Present the doc-17 §1/§7 analysis; recommended default = NEW TABLE.
  - C-2: the governance APR action-type bundle (doc 16) — register the 4 action-types fail-closed
    (handler_ref='unimplemented', risk='high'); AND rule on the governed-exception store correction
    (doc 16 §6: do NOT use admin_fallback_log as the exception register; use the APR payload + a
    governed-exception register). Recommended default = bundle-of-4 + exception-store correction.
For each: decision, recommended default, risk, alternatives, what it unblocks, what stays blocked.
Re-verify the live evidence read-only before relying on a count. Output the packet as a new doc in
this package (e.g. 23-c1-c2-council-decision-packet.md). No mutation.

P2 — T7 issue/event register-before-emit design (governance event/issue types)

MISSION: ONE_ROOF_GOVERNANCE_T7_ISSUE_EVENT_REGISTER_DESIGN
[shared preamble + also read …/09-…issue-event-notification-scaffold.md]
Design (do NOT register/emit) the register-before-emit taxonomy the SB-1/SB-2 path needs:
  - event_type_registry rows under a GOV-SIV-owned `governance` (or `integrity`) event_domain:
    governance.owner.assigned/.conflict, governance.exception.granted/.expired,
    governance.authority.delegated/.expiring, governance.axis.owner_assigned — with delivery_lane,
    default_severity, event_stream (match the live schema, doc 18 §6.2).
  - system_issues governance issue types (reuse thiếu_quan_hệ=OWNER_GAP, sai_lệch_dữ_liệu=drift;
    new: owner_conflict, axis_unregistered, unratified_exception, governance_schema_drift) with
    coalesce_key/cooldown/emit-ceiling (anti-spam, M-DEF-7; live template_gap scale).
Honor Điều 45 (signal not data; event_subject_table/ref; safe_metadata). No registration, no emit.
Output a new doc in this package. No mutation.

P3 — T6 governance-coverage scanner / DOT family design (now unblocked: T3+T4 design-complete)

MISSION: ONE_ROOF_GOVERNANCE_T6_COVERAGE_SCANNER_DESIGN
[shared preamble + also read …/08-…governance-coverage-scanner-scaffold.md]
Design (do NOT build/register/emit) the 6-layer coverage detector + scan/propose/apply/audit DOT
family that reconciles coverage invariant v3 against SB-2's views (v_object_effective_owner,
v_object_owner_gap) and proposes remediation via SB-1 action-types (assign_governance_owner etc.).
Reuse Đ19 orphan scanner + Đ35 DOT pattern + GOV-SIV; specify dot_coverage_required rows for
governance.coverage/classification/pivot/axis/iu (SB-8); inventory-completeness reconciliation
(governance twin of birth-orphan); anti-spam (coalesce/cooldown/summary/ceiling); audit-loop
activation (SB-7) over registry_changelog/event_outbox. Propose-only; no apply, no emit, no DOT
registration. Output a new doc in this package. No mutation.

P4 — T2 OP-B IU-owner decision packet (unblocks SB-2 IU owner-binding + T5/T10)

MISSION: ONE_ROOF_GOVERNANCE_T2_OPB_IU_OWNER_DECISION_PACKET
[shared preamble + also read …/12-…iu-integration-scaffold.md + the IU foundation design doc]
Produce a COUNCIL DECISION PACKET (draft minutes only; no binding, no enactment, no approval rows)
for OP-B/C-3 (IU family accountable owner per scope) + C-4 (review_decision as governed
approval-adapter exception vs full Đ32). Use the recommended defaults (doc 03 §3.3). Show how the
ruled owners land in governance_object_ownership (SB-2, doc 17) once H-2 ratifies. Re-verify IU live
evidence read-only (219 IUs, owner_ref free-text, conformance all open). Output a new doc in this
package. No mutation. (Unblocks T5 SB-3 and T10 IU integration.)

P5 — Auto-approve hardening + Đ32 quorum-binding note (T11 prerequisite design)

MISSION: ONE_ROOF_GOVERNANCE_AUTOAPPROVE_HARDENING_DESIGN
[shared preamble]
Design (do NOT apply) the hardening of fn_auto_approve_add so it EXCLUDES any APR whose
proposed_action_code maps to risk_level IN ('high','medium') (or to the governance action-type
family) — closing the auto-approve bypass (doc 18 §4.3, doc 16 §3.2). Specify the exact predicate,
a BEGIN..ROLLBACK rehearsal plan (author-mode), and the interim convention (governance APRs use
action='review'). Also document whether a per-action-type quorum config (vs the risk_level model)
is warranted. This is a handler/trigger change → T11-gated; design only. Output a new doc in this
package. No mutation.

---

Notes

• Do not run any of P1–P5 as an implementation. They are design/decision-packet macros under the doc-03 gates.
• C-1 + C-2 (P1) are the critical path — they unblock the Phase-A register of SB-1 and the creation of SB-2's table (both still NO-GO to commit until H-1 + sovereign sign-off).
• T5 (SB-3) stays blocked until OP-B (P4) is ruled; T10 (IU integration) until OP-B + SB-3.