Macro-4 No-Production-Touch Promotion Firewall — R2-B2 (2026-06-19)

Date: 2026-06-19 · Workstream: R2-B2-MACRO-4-STAGING-WORKBENCH-IO-CONTRACT-TD-ENTRY-GATE-2026-06-19 (Deliverable 48 of 90) · Editorial revision: rev1 Class: promotion firewall · READ-ONLY · NON-ENACTING · NON-AUTHORIZING · NO write performed.

Metadata convention. Editorial revision (rev1) only. Storage revision/content_length authoritative at read time.

---

0. Status and non-authorization

STATUS: PASS — engineering / design-only. The firewall that makes "no production touch" survive even a successful workbench run. Engineering PASS ≠ authority PASS. Default: HOLD.

1. Purpose

Ensure a validated draft cannot become a production write without a separate Owner gate.

2. Sources / evidence read

Pilot-slice staging IO contract §6 (firewall); promotion-forbidden register (18); IO contract promote section (27). Main process, no reader-agents.

3. Accepted baseline (carried)

Staging proves; it never promotes. A validated producer is evidence; turning that into a production write is a distinct, separately-authorized act.

4. Evidence / analysis — firewall rules (PF)

#	Rule
PF-1	No automatic flow from candidate inspect_* to production inspect_*
PF-2	A draft PASS is engineering, never authority (no promote follows)
PF-3	Promotion requires Điều 32 + standing B2 + channel + S2 owner
PF-4	One-directional: production never read into staging as authority
PF-5	The promotion firewall holds across delete-fast (disposal leaves no production residue)

5. Contract / requirement / matrix / result

The firewall is what makes "draft freely, production untouched" true even when a draft passes. Any automatic draft→production step = firewall breach → HOLD. Status this run: NOT triggered (no producer exists; nothing to promote).

6. Owner-gated future work

Designing/executing promotion is Owner-gated; forbidden now.

7. What remains unresolved

The promotion mechanism is intentionally undesigned; it is a future Owner act.

8. Ready for GPT/Codex review

Yes — Codex should confirm a passing draft never auto-promotes and the firewall holds across disposal.