29 — Next Paste-Ready Prompts (state-recover from this package)

Path: knowledge/dev/reports/architecture/one-roof-governance-technical-addendum-and-implementation-index-2026-06-01/ Doc: 29. Successor to doc 21. Each prompt is self-contained, opens with the shared state-recovery preamble + HARD GATE 0, and stays design / decision-packet / author-mode / operator-handoff — none commits, registers, emits, approves, or enacts. None may run as implementation. No gate may be self-approved; a blocked branch records its exact gap and continues other safe branches.

---

Shared preamble (prepend to every prompt below)

STATE RECOVERY (mandatory): Read, in order, from the implementation-index package
knowledge/dev/reports/architecture/one-roof-governance-technical-addendum-and-implementation-index-2026-06-01/ :
  00-read-me-first → 01-current-state → 02-source-map → 03-blocker-register → 04-track-map,
  then 16 (SB-1), 17 (SB-2), 18 (live evidence), 20 (integration/readiness),
  then this bundle: 23 (C-1/C-2 packet), 24 (T7 events), 25 (T6 scanner), 26 (OP-B), 27 (auto-approve), 28 (readiness).
Also read concept canon knowledge/dev/design/one-roof-governance-concepts/ (00–03) and
the constitution knowledge/dev/laws/prompt-muc-tieu-mo-for-claude-code.md.
This index controls. Concept canon > pre-patch design. Round-4 law > earlier wording.
Blockers win over ambition. If unclear, STOP and report.
HARD GATE 0: no PG/Directus/Qdrant/Nuxt mutation; no schema/DOT/UI/API; no enactment/
  version-bump/status-change/registry-write; no approval/self-approval; no hardcode;
  no hidden local governance island; no implementation disguised as design.
Write all new docs inside this package (append after 30). Return doc-00 §0.9 final-report fields.
Re-verify any live count read-only before relying on it.

---

P1 — ONE_ROOF_GOVERNANCE_C1_C2_RULING_INTAKE_AND_BUILD_PREP ★ critical path (conditional)

Gate: requires a recorded C-1 and/or C-2 council ruling (doc 23 §1.5 / §2.6 wording, minuted through the proper channel — NOT self-made).

• If ruled: produce the SB-1/SB-2 build-preparation operator-handoff packet — paste-ready BEGIN..ROLLBACK author-mode SQL (extending doc 19) for: (a) CREATE TABLE governance_object_ownership + governance_responsibility_scope (6-row seed) + the resolution views (doc 17); (b) the Phase-A INSERT of the 4 action-types with handler_ref='unimplemented', risk_level='high' (doc 16). Include a green read-only pre-flight (0 collisions; 6 owner agencies present; both target tables ABSENT), static additivity proof, rollback script, and the operator handoff (ssh contabo → docker exec postgres psql -U workflow_admin). The agent does NOT commit — it authors the packet the operator runs. Still gated on H-1 + sovereign sign-off before the operator applies.
• If NOT yet ruled: STOP at the gate; record "C-1/C-2 ruling outstanding" as the exact blocker; continue any safe branch (e.g. P7 critique). Do not author premature DDL.

Output: new doc (e.g. 31-sb1-sb2-build-prep-operator-handoff.md).

---

P2 — ONE_ROOF_GOVERNANCE_T7_EVENT_REGISTER_PACKET

Also read doc 09 (issue/event scaffold). Finalize doc 24 into a paste-ready register-before-emit packet: the exact event_type_registry rows under a GOV-SIV-owned event_domain='governance' (both lifecycle + detection families, with event_stream/delivery_lane/default_severity matching the live schema, doc 24 §3), and the system_issues bucket conventions (reuse thiếu_quan_hệ/sai_lệch_dữ_liệu; new governance_island/unratified_exception), with the coalesce/cooldown/emit-ceiling values. Author-mode/operator-handoff only — register NOTHING, emit NOTHING. Honor Điều 45 (signal not data). Gated on T7 build authorization + GOV-SIV ownership ruled.

Output: new doc.

---

P3 — ONE_ROOF_GOVERNANCE_T6_SCANNER_BUILD_PREP

Also read doc 08 (scanner scaffold). Turn doc 25 into author-mode DOT specs + read-only SQL skeletons for the scan / detect / propose tiers (the apply DOT stays NO-GO and is specified but not skeletoned for execution), the paired-test specs, and the proposed dot_coverage_required rows packet (SB-8). Inventory must be sourced from registries/config/source-inventory — no hardcoded axis/object list; fail closed on a missing source. Gated on SB-1 Phase-A (propose) + SB-2 views (owner findings); degrade gracefully where not yet live. Register NOTHING, run NOTHING, emit NOTHING.

Output: new doc.

---

P4 — ONE_ROOF_GOVERNANCE_T5_SB3_AXIS_SUBSTRATE_DESIGN (conditional)

Gate: requires a recorded OP-B/C-3 ruling (doc 26 §9).

• If ruled: design (uncommitted) the SB-3 generalization — the Axis Registry as ground truth (M-DEF-9, 9 attributes), a generic iu_axis_value(unit_id, axis_code, value, …) store, and iu_three_axis_envelope demoted to a hot-cache projection; prove a 4th axis becomes data not DDL; rollback + author-mode rehearsal. Show how axis ownership (already decoupled, via SB-1/SB-2) relates to axis value storage (SB-3).
• If NOT ruled: STOP at the gate; record "OP-B ruling outstanding"; continue safe branches.

Output: new doc. Commit NO-GO.

---

P5 — ONE_ROOF_GOVERNANCE_AUTOAPPROVE_HARDENING_REHEARSAL

Turn doc 27 §6/§8 into a paste-ready BEGIN..ROLLBACK author-mode rehearsal + operator handoff for the recommended hardening: H-OPT-4 (apr_action_types.auto_approvable boolean allowlist gating fn_auto_approve_add) + H-OPT-2 (fail-safe action default), with the T-1..T-6 assertions. Document that H-OPT-2 changes submission ergonomics → needs council awareness. Apply NOTHING. T11-gated.

Output: new doc.

---

P6 — ONE_ROOF_GOVERNANCE_L1_L2_LAW_CLEANUP_DRAFT

Design-only law cleanup: DRAFT law-text corrections for L-1 (Đ45 ban_hanh=false leftovers; Đ36 v4.0-vs-v5.0; enacted Đ37 v3.3 text vs live columns gov_type/created_by_law/relation_type/enforcement_role + capability JSON) and DRAFT normative_registry rows for L-2 (Đ20, Đ23, Đ44, Đ45) as a ratification packet. Do NOT write to normative_registry/law_catalog/governance_docs; no enactment; no version-bump; no status-change.

Output: new doc.

---

P7 — ONE_ROOF_GOVERNANCE_BUNDLE_CRITIQUE_REDTEAM (always safe)

Adversarial critique / red-team of docs 23–28: hunt for internal contradictions, hidden island leaks, hardcode, missing gates, coverage-invariant gaps, anti-spam failure modes, routing dead-ends, and any place a design quietly enables a commit. Produce a findings list (caught/uncaught, severity) + a corrections list. Design-only; corrections are proposals, not edits to the ruled packets. Safe to run anytime (no gate).

Output: new doc.

---

Recommended order

1. P1 (critical path; conditional on C-1/C-2 ruling) ∥ P4 (conditional on OP-B ruling) ∥ P7 (critique; always safe).
2. Then P2 (T7 register packet), P3 (T6 scanner build-prep), P5 (auto-approve rehearsal), P6 (law cleanup) — in parallel as authorization/gates allow.
3. T10 (IU integration) only after OP-B (P4 prerequisite ruled) + SB-3 (P4 designed).
4. The SB-1/SB-2 build (operator applies P1's packet) and all event/DOT registration, owner-writes, and enactment remain behind their recorded gates (doc 28 §5).

None of P1–P7 may run as implementation; all are under the doc-03 gates; no gate may be self-approved.