dot:kg — DRY_RUN → REAL_RUN → Split Playbook

2026-06-04 · the runtime promotion ladder for the dot:kg process family.

Current state (live)

• PROC-CAND:dot:kg: correlated_dryrun. Observations: 2 DRY_RUN (one single dryrun-kgexplain, one correlated producer+verifier pair dryrun-pair) + 4 SIMULATED_DRY_RUN.
• REAL_RUN = 0. Not verified (NEEDS_MORE_EVIDENCE — not faked).
• Runtime gate (dot_config): process_dot_runtime.real_run_enabled=false, execute_enabled=false, dry_run_only=true. REAL_RUN is config-gated OFF.
• Executor: incomex-agent-api-executor healthy, loopback 127.0.0.1:8090, read_only/cap_drop, REAL_RUN→403 by policy today.

The ladder (each rung needs the rung below)

1. DRY_RUN (done): real gpt-4o producer + deterministic verifier, correlated by one corr id, is_mock=false, no mutation. Achieved.
2. REAL_RUN enablement (owner/operator): flip process_dot_runtime.real_run_enabled=true (and execute_enabled=true) under authority. This is the gate — not flipped (no authority).
3. REAL_RUN pair: run the same producer/verifier pair with real execution; expect 1 REAL_RUN observation + matched verifier observation sharing a correlation id.
4. Threshold for verified: N successful correlated REAL_RUNs with verifier agreement (define N in policy; suggest ≥3 distinct inputs, 0 verifier mismatches).
5. PROC-OWN-04: president assigns dot:kg family owner + authorizes the 10-process split.
6. 10-process split: decompose dot:kg into its ~10 sub-definitions, each a candidate.
7. PROC-OWN-05: activate the 7 process.* event types (currently 0/7 active).

REAL_RUN enablement checklist (for the operator, post-authority)

• Authority recorded (PROC-OWN-04 or an explicit runtime-enable approval).
• Confirm executor still loopback-only, read_only, cap_drop ALL.
• Set real_run_enabled=true, execute_enabled=true in dot_config.
• Run one REAL_RUN pair; verify process_run_observation gets evidence_type=REAL_RUN.
• Verifier observation correlated and agreeing.
• Capture cost/latency; confirm no unintended writes (executor is no-mutation).

Rollback

Set real_run_enabled=false, execute_enabled=false. Observation rows are append-only audit (birth-free) and can stay as evidence. No canon is written by a REAL_RUN.

Safety invariant

REAL_RUN is not verification by itself; verification needs the verifier-agreement threshold. Until then dot:kg stays correlated_dryrun, owner-gated, not canon.