Macro-4 No-Production-Touch Runtime Proof Obligations — R2-B2 (2026-06-19)

Date: 2026-06-19 · Workstream: R2-B2-MACRO-4-STAGING-WORKBENCH-IO-CONTRACT-TD-ENTRY-GATE-2026-06-19 (Deliverable 46 of 90) · Editorial revision: rev1 Class: runtime proof obligations · READ-ONLY · NON-ENACTING · NON-AUTHORIZING · NO write performed.

Metadata convention. Editorial revision (rev1) only. Storage revision/content_length authoritative at read time.

---

0. Status and non-authorization

STATUS: PASS — engineering / design-only. What a runtime check must show to prove no production touch. Engineering PASS ≠ authority PASS. Default: HOLD.

1. Purpose

Define the runtime-level obligations (read-only) that bracket a future workbench run.

2. Sources / evidence read

Pilot-slice staging IO contract §11; bad-input/delete-fast plan §10; r2-readiness §5 (no live inspect_* setter). Main process, no reader-agents.

3. Accepted baseline (carried)

Read-only tooling proves state via DB-captured snapshots and catalog reads; the proof is a before/after comparison.

4. Evidence / analysis — runtime obligations (NPT-RT)

#	Obligation (read-only)
NPT-RT-1	Production inspect_* set-count identical before/after (FRESH: 0 uncertified-with-inspect)
NPT-RT-2	certified count + certified_at set identical (FRESH: 1,402, all 2026-03-21)
NPT-RT-3	canonical_address/owner/jsonb_profile/status unchanged on all rows
NPT-RT-4	No new entity_code/S3 identity attributable to the run
NPT-RT-5	universal_edges provenance unchanged (FRESH: 2,199/0)
NPT-RT-6	No production certify attributable to the run (B4 fired off no staging candidate)
NPT-RT-7	Containment: surface gone after delete-fast; production identical

5. Contract / requirement / matrix / result

These obligations are read-only checks a future run must satisfy; this macro ran exactly these as a baseline read (no run to bracket). No write occurred.

6. Owner-gated future work

Bracketing a real run is Owner-gated; forbidden now.

7. What remains unresolved

The transient app.birth_gate_mode GUC is not readable via query_pg (inherited: warn-mode; CAV-5) — an out-of-band Owner check.

8. Ready for GPT/Codex review

Yes — Codex should confirm the obligations are read-only and bracket all sensitive surfaces.