Phase-1B Runtime Truth & Blocker Decision Packet (2026-06-17, read-only, non-authorizing, NOT remediation, NOT technical design)
Phase-1B Runtime Truth & Blocker Decision Packet
Date: 2026-06-17 · Workstream: Phase-1B (Runtime Truth Refresh & Blocker Decision) · Revision: rev1 Class: planning / decision / scoping · READ-ONLY · NON-ENACTING · NON-AUTHORIZING · NOT remediation · NOT technical design · NOT implementation.
0. Status and non-authorization
STATUS: PASS (decision-bridge complete; nothing enacted, no blocker resolved, no runtime touched).
This packet converts the accepted Phase-1 Read-Only Runtime Blocker Verification (reports/phase1-readonly-runtime-blocker-verification-2026-06-17.md, rev1, STATUS=PARTIAL) into an Owner-facing blocker decision matrix + remediation macro roadmap. It is the bridge:
Phase-1 runtime truth baseline → Owner decision (this packet's matrix) → remediation macro workstreams → later technical design.
Non-authorization (explicit). This document does not, and cannot:
- run any live DB/runtime query, write query, DDL, or DML; patch runtime;
- patch any source law, amendment, rewrite, note, or any prior report (D0 / D1 / E0 / Phase-1);
- create a current corpus or a
current/folder; adopt or enact any draft; resolve any blocker; - write full technical design; create schema/table/registry/index; materialize KG / provenance /
cell_id/dot_role/canonical_fields/ Species Matrix /BIRTH_STAMP/PROMOTE_STAMP; - trigger DOT / KG / promote / birth / repair; run migrations or write-tests;
- change authority order (CONS-004); change the v0.1 baseline; promote v0.2-hardening.
Engineering verification ≠ Authority approval. The Phase-1 verdicts are runtime-truth findings, not closures. Every blocker below remains OPEN. A GPT/Codex PASS on this packet is not an Owner authorization to remediate.
1. Purpose
Answer, for the Owner, ten questions:
- Current runtime truth after Phase-1 — §2.
- Which old documentary assumptions are stale — §3.
- Which blockers remain open — §4, §5 (all of them).
- HIGH / MEDIUM / LOW severity — §4, §5.
- Which blockers stop technical design — §5, §6.
- Which blockers stop implementation — §5.
- Which items require an Owner decision — §5, §9.
- Which remediation packages to open first — §7, §8.
- What can proceed now as limited scoping — §10.
- What remains forbidden — §11.
This packet keeps the macro big enough to save time (it names the five remediation workstreams and a recommended order) but does not merge remediation, technical design, or implementation into itself.
2. Runtime truth baseline
The five blocker surfaces were checked against the live VPS PostgreSQL substrate (directus.public + schema iu_core) with first-hand, read-only SQL on 2026-06-17 (~10:12–10:33 UTC). This was the first run ever to query live runtime — every prior law-revision report (E0 §15, D0, D1) explicitly recorded "no live DB/runtime query; all reads were AgentData KB reads." The live runtime diverges from the documentary KB layer on four surfaces, generally in the safer direction (containments + substrate the KB-only reports could not see). Those divergences are documentary lag, not runtime defects (§3).
Five surface verdicts (accepted as the runtime baseline):
| Surface | Verdict | One-line runtime truth |
|---|---|---|
| RISK-BYPASS | PARTIAL | No active authority bypass: fn_auto_approve_add neutered 2026-06-06; two layered fail-closed quorum guards enabled. Residue (170 unvoted-applied rows) + warn-mode birth gate + latent app.bypass_birth_gate kill-switch remain. |
HOLD-1 iu_staging_* |
LIVE (pilot-exercised) | Tables + views + functions exist and ran a full pending→approved→consumed lifecycle (2026-05-25→27); idle since; downstream fail-closed dry-run. |
| HOLD-2 atomic promote | PARTIAL | fn_iu_enact is atomic + fail-closed + post-write-verified for the IU lineage (contradicts "no real transaction"); but named BIRTH_STAMP/PROMOTE_STAMP are absent and the birth-certify pipeline is stalled since 2026-03-21. |
| Điều 39 KG runtime | REGISTERED_NOT_EXECUTED | 36 KG DOTs, 0 executed; universal_edges=2199 with 0 provenance; kg_quality_log=0; GOV-KG-SYS registered & active (contradicts "unregistered") but inert. |
| Điều 35 production-readiness | NOT_PRODUCTION_READY | 259/309 (83.8%) NULL operation; 148 tier-B unpaired; 218,876 open critical issues (97% description-quality); §10 warn→block config absent; health executor did run today 10:01. |
Headline (verbatim sense from Phase-1): No active authority bypass is confirmed in the current approval path; the substrate is far more built-out than the KB-only layer assumed. The remaining real problems are (1) historical bypass residue not reverted, (2) Điều 39 KG never executed and the provenance-invariant unmet, (3) Điều 35 metadata health failing at scale, (4) a stalled birth-certification pipeline. These keep technical design gated. The query_pg harness is robustly fail-closed (write/DDL/malformed/unsafe-GUC all rejected; 6 adversarial probes all fail-closed).
Caveats carried from Phase-1 (not resolved here): the live value of app.bypass_birth_gate could not be read (harness safe-param allowlist); DOT execution telemetry (dot_tools.last_executed) is unreliable (stale 2026-03-31 yet hc_executor ran today); local checkout is ~7 weeks stale and substrate-free (VPS PG is sole source of truth).
3. Documentary-lag table
These are stale documentary claims, not runtime blockers. They are listed separately from the open blockers (§5) per the Phase-1 boundary. The blockers stay open; only the evidence basis changes. Refreshing the documentary layer (LAW_READING_INDEX rev2 §4 items #5/#6/#10, pointer-layer §9, the notes) is itself a separate Owner-gated documentary step — NOT performed by this packet (this packet patches no index, no pointer layer, no note).
| Surface | OLD documentary claim (KB layer, never live-verified) | LIVE runtime truth (2026-06-17) | Phase-1 ref |
|---|---|---|---|
| RISK-BYPASS | "live fn_auto_approve_add (160 unvoted applies) = active bypass open" (pointer-layer §9; index §4 #10) |
INSERT-path auto-approve vector neutered 2026-06-06; layered fail-closed quorum enforced; residue (170 unvoted-applied rows) remains, not reverted | PH1-C1, §6 |
| Điều 39 owner | "owner unregistered" (index §4 #5; pointer-layer §9) | GOV-KG-SYS registered & active in governance_registry (created_by_law=NRM-LAW-39); but health_dot/primary_collection=NULL → active but inert |
PH1-C2, §9 |
| HOLD-1 | "iu_staging_* liveness unproven / documentary" (pointer-layer §9) |
pilot lifecycle exercised (15 records / 32 payloads; 4 reached consumed); idle since 2026-05-27 |
PH1-C3, §7 |
| HOLD-2 | "atomic promote has no real transaction" (pointer-layer §9) | fn_iu_enact atomic + fail-closed + post-write-verified for the IU lineage; birth/stamp path still blocked (named stamps absent; certify stalled) |
PH1-C4, §8 |
Reading rule: the documentary lag means the KB layer under-described live safety on these four surfaces. It does not mean the blockers are smaller — RISK-BYPASS still has residue + a latent kill-switch; Đ39 is still execution-empty; HOLD-2's canonical-birth construct is still unbuilt; HOLD-1 is still pilot-only. Documentary refresh and blocker resolution are two different, separately-gated acts.
4. Corrected findings register
The Phase-1 findings register (its §12) is carried forward with two corrections applied (the Codex/control caveats this workstream is mandated to apply — see §0 of the execution report). Severity ladder: CRITICAL (active mutation/authority bypass — none observed) · HIGH (TD unsafe without fixing) · MEDIUM (carry with caveat / readiness gap) · LOW · INFO. patch_now: no for every finding (all fixes are separate Owner-gated work).
| id | corrected surface | severity | runtime evidence | why it matters |
|---|---|---|---|---|
| PH1-F1 | Đ39 / KG provenance (corrected — see caveat C-1; was filed under "RISK-BYPASS") | HIGH | universal_edges=2199 active, 0 provenance (Q4) vs Đ39 "Edge PHẢI có provenance. Không provenance = quarantine." |
the KG provenance-or-quarantine invariant is unenforced/unmet on the live edge store; blocks any KG build |
| PH1-F2 | RISK-BYPASS (residue) | MEDIUM | 170 applied rows with 0 votes (146 add + 24 modify), reviewed 2026-03-28→04-20 (Q2) |
historical authority-bypass residue not reverted; pollutes the applied-change ledger |
| PH1-F3 | HOLD-2 / Đ0-G birth-certify | HIGH (birth-dependent TD) / MEDIUM (non-birth scopes) (severity split — caveat C-2) | 1,211,549 uncertified births (99.9%) since 2026-03-21, 0 inspect stamps; 1,402 certified (Q13) | birth-certification "promote" stalled; any design assuming certified births is unsafe → HIGH for birth/canonical-dependent TD; MEDIUM for scopes that do not depend on certified births |
| PH1-F4 | Đ35 metadata/paired-DOT | MEDIUM | 259/309 NULL operation; 148 tier-B unpaired; no fn_dot_enforce_paired (Q5, F3) |
Đ35 §10 success metrics (100% 11/11 NOT NULL; 100% paired + trigger) unmet; paired-DOT enforcement not active |
| PH1-F5 | Đ35 critical backlog | MEDIUM | 218,876 open critical, 97% = heal_description_basic (Q11, Q12) |
§10 "0 new critical for 3 consecutive days" grossly unmet; backlog is mostly quality debt, but readiness still fails |
| PH1-F6 | RISK-BYPASS (approve-time gap) | LOW | fn_apr_quorum_check skips on NULL proposed_action_code/risk_level; mitigated apply-time by fn_apr_block_unimplemented_handler (§6) |
approved-state reachable w/o quorum for null-action, but apply is fail-closed |
| PH1-F7 | RISK-BYPASS (birth-gate policy) | MEDIUM | fn_birth_gate warn-mode default + app.bypass_birth_gate kill-switch; live GUC value unreadable (D4, F4); pg_db_role_setting=0 rows |
governed-table birth/desc gates do not block by default; a latent bypass primitive exists; warn→block criteria undecided |
| PH1-F8 | Đ35 §6.5 accountability | LOW | 1 admin_fallback_log applied w/o retroactive_apr_id, not flipped audit_overdue (Q10) |
1-of-22 Điều 35 §6.5 retroactive-APR accountability gap |
| PH1-F9 | telemetry (all) | INFO | dot_tools.last_executed stale 2026-03-31 yet hc_executor ran today + births live (Q5, F4, Q13) |
execution telemetry unreliable → judge liveness by heartbeats, not last_executed |
| PH1-F10 | scope/process | INFO | local repo HEAD 2026-04-25, 0 governed-substrate artifacts, 0 .sql (A6) |
local tree is not authoritative; VPS PG is SoT for these blockers |
| PH1-C1..C4 | documentary lag | INFO | the four §3 items | documentary refresh (separate, Owner-gated) — not a runtime blocker |
Caveats applied (control corrections):
- C-1 (PH1-F1 surface relabel): PH1-F1 is the
universal_edges0-provenance finding. Phase-1 §12 filed it under "RISK-BYPASS"; its substance is the Điều 39 / KG provenance-or-quarantine invariant, not an authority-approval bypass. Severity stays HIGH; the surface is corrected to Đ39 / KG provenance. (This keeps RISK-BYPASS = the approval/authority path; KG provenance = Đ39.) - C-2 (PH1-F3 severity split): the stalled birth-certify pipeline is HIGH for any birth-dependent / canonical-dependent technical design (designs assuming certified births are unsafe) and MEDIUM for non-birth scopes (it does not, by itself, gate scopes that never touch certified-birth status).
Carried structural blockers (out of Phase-1 runtime scope, still open, gate materialization): CONS-002 (thin 5-field IO contract vs Module-Contract-First), CONS-003 (6-Lớp vs 7-dimension composition), CELL-003/004/007 (cell_id dims unmaterialized), GOV-016/017 (no risk/blast-radius calculator; no fail-closed-on-uncomputable-risk), GOV-REUSE-001. These are not Phase-1 findings; they are carried from E0/D0/D1 and gate any cell_id/dot_role/canonical_fields/Species-Matrix/IO-contract materialization that R1–R3 might otherwise reach. Resolving them is Owner-gated and outside this packet.
5. Blocker decision matrix
Columns: runtime truth · severity · blocks technical design? · blocks implementation? · Owner decision required? · remediation required? · remediation type (READ_ONLY_SCOPING / WRITE_ENABLED_REMEDIATION / DOC_REFRESH / OWNER_DECISION_ONLY) · recommended package · priority.
| id / surface | runtime truth | sev | blocks TD? | blocks impl? | Owner decision? | remediation? | remediation type | package | prio |
|---|---|---|---|---|---|---|---|---|---|
| Đ39 surface | REGISTERED_NOT_EXECUTED (36 DOT/0 exec; GOV-KG-SYS active-inert; kg_quality_log=0) | HIGH | Yes (Đ39) | Yes (Đ39) | Yes | Yes | READ_ONLY_SCOPING → WRITE_ENABLED later | R1 | P1 |
| PH1-F1 | universal_edges 2199, 0 provenance vs "no provenance=quarantine" | HIGH | Yes (Đ39) | Yes (Đ39) | No (design decision) | Yes | READ_ONLY_SCOPING → WRITE_ENABLED later | R1 | P1 |
| HOLD-2 surface | fn_iu_enact atomic for IU lineage; named stamps absent; birth-certify stalled |
PARTIAL | Scoped (birth/stamp-dependent TD = blocked; IU-lineage TD = unblocked) | Scoped | Yes | Yes | READ_ONLY_SCOPING → WRITE_ENABLED later | R2 (birth/stamp) + R5 (IU) | P2 |
| PH1-F3 | 1,211,549 uncertified births (99.9%) since 2026-03-21, 0 inspect stamps | HIGH (birth-dep) / MEDIUM (non-birth) | Yes (birth-dependent) | Yes (birth-dependent) | Yes | Yes | READ_ONLY_SCOPING → WRITE_ENABLED later | R2 | P2 |
| Đ35 surface | NOT_PRODUCTION_READY (83.8% null op; 148 unpaired; 218,876 open critical; §10 config absent) | HIGH (systemic) | Yes (Đ35) | Yes / Scoped | Yes | Yes | READ_ONLY_SCOPING → WRITE_ENABLED later | R3 | P3 |
| PH1-F4 | 259/309 null operation; 148 unpaired; no fn_dot_enforce_paired |
MEDIUM | Yes (Đ35 TD) | Yes | Yes | Yes | READ_ONLY_SCOPING → WRITE_ENABLED later | R3 | P3 |
| PH1-F5 | 218,876 open critical, 97% heal_description_basic |
MEDIUM | Yes (Đ35 TD) | No (mostly quality debt) | No (engineering) | Yes | READ_ONLY_SCOPING → WRITE_ENABLED later | R3 | P3 |
| PH1-F9 | last_executed stale yet hc_executor + births live |
INFO | No | No | No | Yes (instrument real telemetry) | READ_ONLY_SCOPING / DOC_REFRESH | R3 | P3 |
| RISK-BYPASS surface | no active bypass (contained 2026-06-06, layered fail-closed); residue + warn-mode + latent kill-switch remain | PARTIAL | No (carry as caveat) | Scoped (residue disposition) | Yes | Yes | OWNER_DECISION_ONLY + READ_ONLY_SCOPING | R4 | P4 |
| PH1-F2 | 170 applied rows with 0 votes (pre-containment residue) | MEDIUM | No (carry) | No | Yes | Yes (disposition) | OWNER_DECISION_ONLY | R4 | P4 |
| PH1-F7 | birth-gate warn-mode default + app.bypass_birth_gate kill-switch; GUC unreadable |
MEDIUM | No | Scoped | Yes | Yes (confirm GUC out-of-band + set warn→block criteria) | OWNER_DECISION_ONLY + READ_ONLY_SCOPING | R4 | P4 (GUC-confirm = immediate, parallelizable) |
| PH1-F6 | approve-time quorum skips on null action; mitigated apply-time | LOW | No | No | No | Optional (tighten approve-time to match apply-time) | READ_ONLY_SCOPING | R4 | P4 |
| PH1-F8 | 1 admin-fallback applied w/o retroactive APR, not audit_overdue |
LOW | No | No | Yes | Yes (reconcile the 1) | OWNER_DECISION_ONLY | R4 | P4 |
| HOLD-1 surface | LIVE pilot-exercised (4 reached consumed); idle since 2026-05-27; fail-closed dry-run |
LIVE / MEDIUM | Scoped (staging-dependent TD) | Scoped | Yes (to move past pilot) | Yes (productionization) | READ_ONLY_SCOPING → WRITE_ENABLED later | R5 | P5 |
| PH1-F10 | local repo substrate-free; VPS PG = SoT | INFO | No | No | No | No (process note) | DOC_REFRESH | — | — |
| PH1-C1..C4 | documentary lag (4 §3 items) | INFO | No | No | Yes (refresh) | Yes (doc refresh) | DOC_REFRESH | doc-refresh (separate Owner-gated doc step, not a remediation package) | — |
| Carried: CONS-002/003, CELL-003/004/007, GOV-016/017, GOV-REUSE-001 | unresolved; gate cell_id/dot_role/canonical_fields/Species-Matrix/IO-contract materialization |
BLOCKER (carried) | Yes (materialization-dependent TD) | Yes | Yes | Yes (resolve before materialization) | OWNER_DECISION_ONLY | pre-requisite gate to any R1/R2/R3 materialization | gating |
No blocker is marked resolved. Every row is a decision input, not a closure.
6. Technical design gate
Technical design remains GATED. This packet does not lift any gate; it states the gate precisely so a future Owner can scope it.
TD is BLOCKED for:
- Điều 39 (HIGH): provenance-or-quarantine invariant unmet on 2199 live edges + 0 KG execution +
kg_quality_log=0 ("không giải thích = không thực thi"). No KG build/rollout TD until provenance backfill + quarantine gate are designed. - Birth-dependent / canonical-dependent design (HIGH via PH1-F3): the inspect→certify pipeline is stalled (99.9% uncertified). Any TD that assumes certified births,
BIRTH_STAMP/PROMOTE_STAMP, or canonical-at-promote (F4) is unsafe until the pipeline is verified/restarted. - Điều 35 (NOT_PRODUCTION_READY): metadata health, paired-DOT enforcement, and the §10 warn→block machinery are unmet/absent. No "Đ35 governance lane is trusted" TD until these are addressed.
- Any materialization of
cell_id/dot_role/canonical_fields/ Species Matrix / IO-contract: blocked by the carried structural blockers (CONS-002/003, CELL-003/004/007) — independent of Phase-1.
TD is conditionally OPEN (scoped) for:
- IU-lineage promote/rollback —
fn_iu_enact+ thefn_iu_structure_op_apply/verify/rollbackfamily already provide an atomic, fail-closed, post-verified transaction. Scoping/hardening TD that reads this lineage (does not depend on certified births or named F4 stamps) is the least-blocked area — but still gated behind Owner authorization to open R5, and still bounded by HOLD-1 pilot-only posture.
TD may NOT, under any package: create schema/table/registry/index; materialize KG/provenance/cell_id/dot_role/canonical_fields/Species-Matrix/stamps; write migrations; change authority order or the v0.1 baseline. Those are downstream of a separate Owner-authorized, write-enabled workstream.
7. Remediation macro packages
Five macro packages. Each is a future, separate, Owner-gated workstream. None is opened, scoped, or executed by this packet. "Allowed first move" describes only what the first action of that package would be after the Owner opens it — it is not authorized now.
R1 — Điều 39 KG Provenance / Quarantine / Execution Readiness
- Objective: make the live KG edge store Điều-39-compliant (provenance-or-quarantine) and establish whether/how KG DOTs may execute, before any KG build.
- Blockers covered: Đ39 surface (REGISTERED_NOT_EXECUTED), PH1-F1 (HIGH, 0 provenance on 2199 edges),
kg_quality_log=0, GOV-KG-SYS active-but-inert. - Why it matters: Đ39 mandates "Edge PHẢI có provenance. Không provenance = quarantine" and "Không giải thích = không thực thi." The invariant is the lone HIGH runtime finding and gates all KG work; it is narrow and well-bounded (2199 edges, fixed schema columns already present).
- Allowed first move (after Owner opens): read-only scoping of the 2199 edges, the
provenance/valid_time/versioncolumns, the 8kg_*config tables, and the 6kg_auto_approve_rules(fail-closed TBox-human posture); design (not build) a provenance-backfill + quarantine-gate approach honoring TBox-human/ABox-AI. - Forbidden actions: no edge writes; no provenance materialization; no KG DOT execution; no
kg_*schema change; no TBox mutation. - Expected output: a read-only Đ39 runtime-readiness scoping report + a design-direction memo (PENDING_OWNER), enumerating provenance sources and the quarantine gate, with explicit CONS-002/003 + CELL dependencies flagged.
- Write-enabled approval required later? Yes — backfill/quarantine enforcement is a separate write-enabled workstream.
R2 — Birth Certify Pipeline / Canonical Stamp Readiness
- Objective: establish why the inspect→certify pipeline stalled (2026-03-21) and what canonical-birth /
BIRTH_STAMP/PROMOTE_STAMPreadiness requires, so birth-dependent TD can be safely unblocked. - Blockers covered: PH1-F3 (HIGH birth-dependent), HOLD-2 birth/stamp path (named stamps absent;
fn_birth_auto_certifypresent but pipeline stalled), Đ0-G certify chain (PEN/STAMP/GATE). - Why it matters: 99.9% of 1.21M births are uncertified with 0 inspect stamps; births still fire live (last 2026-06-17 10:30) but certification does not follow. Canonical birth at promote (F4) and any design assuming certified births are unsafe until this is understood/restarted.
- Allowed first move (after Owner opens): read-only scoping of
birth_registrycertify state, theinspect_pen/stamp/gateinspector DOTs,fn_birth_auto_certify, and why inspectors stopped setting stamps; design (not build) a restart/verify approach under Owner gate. - Forbidden actions: no birth writes; no certify execution; no
BIRTH_STAMP/PROMOTE_STAMPmaterialization; no Đ0-G schema change; no atomic-promote build. - Expected output: a read-only birth-certify diagnostic + restart-readiness memo (PENDING_OWNER), mapping the named-F4-stamp construct to the live
certified/inspect_*mechanism. - Write-enabled approval required later? Yes — restarting/repairing the certify pipeline mutates
birth_registry.
R3 — Điều 35 DOT Governance Readiness
- Objective: drive Điều 35 toward its §10 production-readiness criteria (metadata completeness, paired-DOT enforcement, critical-backlog drawdown, warn→block machinery).
- Blockers covered: Đ35 surface (NOT_PRODUCTION_READY), PH1-F4 (metadata/paired), PH1-F5 (critical backlog, 97% quality), PH1-F9 (telemetry unreliable).
- Why it matters: Đ35 §10 requires "100% 11/11 fields NOT NULL", "100% DOT B paired + trigger", "0 new critical 3 consecutive days", "14/14 health checks LIVE"; live reads 83.8% NULL
operation, 148 unpaired, nofn_dot_enforce_paired, 218,876 open critical, §10dot_configkeys absent. No Đ35 governance lane is trustworthy until addressed. - Allowed first move (after Owner opens): read-only scoping of
dot_toolsmetadata completeness, the 148 unpaired tier-B DOTs, theheal_description_basicbacklog (is it reclassifiable as non-authority quality debt?), and the §10 config gap; design (not build) the metadata-repair + paired-enforcement + warn→block approach. Reuse the Điều 35 §6.2fix_repair_dotpattern (per the Đ35 compatibility note) — do not import a running governance machine turnkey. - Forbidden actions: no metadata writes; no DOT/health execution; no
fn_dot_enforce_pairedcreation; nodot_configwrites; no auto-fix ofsystem_issues. - Expected output: a read-only Đ35 readiness gap report + remediation-direction memo (PENDING_OWNER), with a backlog-severity reclassification proposal.
- Write-enabled approval required later? Yes — metadata repair, paired-enforcement trigger, and config changes are write-enabled.
R4 — Authority Residue / Birth-Gate Policy
- Objective: decide the disposition of the contained-bypass residue and the warn→block birth-gate policy; close the small accountability gaps. Mostly Owner-decision, low write-footprint.
- Blockers covered: RISK-BYPASS surface (PARTIAL — contained), PH1-F2 (170 unvoted-applied residue), PH1-F7 (warn-mode + latent
app.bypass_birth_gatekill-switch + unreadable GUC), PH1-F6 (approve-time quorum gap, mitigated), PH1-F8 (1 admin-fallback accountability gap). - Why it matters: the active bypass is already contained (no CRITICAL), but the residue is unreverted, the kill-switch is latent with an unread GUC value, and warn→block criteria are undecided. These are accountability/policy decisions, not a build.
- Allowed first move (after Owner opens): immediately/parallel — confirm the live
app.bypass_birth_gate/app.birth_gate_modevalue out-of-band (the harness cannot read it); read-only scoping of the 170 residue rows; Owner decides disposition (audit/annotate/quarantine — do NOT auto-revert) and warn→block criteria per Đ35 §10's 4 AND-conditions. - Forbidden actions: no auto-revert of the residue; no flip of
birth_gate_modetoblockuntil Đ35 §10 criteria are met; no GUC writes; no approval-path code change without separate authorization. - Expected output: an Owner decision record for the residue + the warn→block policy + the 1 admin-fallback reconciliation; an out-of-band GUC confirmation note.
- Write-enabled approval required later? Partial — most is Owner-decision/documentary; any residue annotation or
birth_gate_modeflip is a separate, gated write-enabled action contingent on Đ35 §10 readiness (R3).
R5 — HOLD-1 Staging Production Readiness
- Objective: decide whether and how to move
iu_staging_*from pilot (idle since 2026-05-27) toward production, leveraging the already-atomicfn_iu_enactIU-lineage promote. - Blockers covered: HOLD-1 surface (LIVE pilot), HOLD-2 IU-lineage hardening (the atomic-promote half that does exist).
- Why it matters: the staging substrate exists and ran a real
pending→approved→consumedlifecycle; downstream is fail-closed dry-run (delivery_enabled=false,operator_runtime_enabled=false,structure_ops_enabled=false). It is the least-blocked surface — but still pilot-only and idle. - Allowed first move (after Owner opens): read-only scoping of the
iu_staging_record/payloadlifecycle, thefn_iu_enact+ structure-op family, the two PILOT-ONLYRAISE WARNINGpublication checks ("production sẽ BLOCK"), and the dry-run gates; design (not build) a productionization path. - Forbidden actions: no IU/staging writes; no flip of
delivery_enabled/operator_runtime_enabled/structure_ops_enabled; no promote/cut execution; no flip of pilot-warning checks to blocking. - Expected output: a read-only HOLD-1 productionization-readiness memo (PENDING_OWNER), including the gate-flip checklist.
- Write-enabled approval required later? Yes — enabling delivery/runtime/structure-ops and flipping pilot warnings to blocking are write-enabled.
8. Recommended execution order
Default recommended order (severity-first, technical-design-unblocking-first):
- R1 — Điều 39 KG provenance / quarantine / execution readiness — the lone HIGH runtime finding (PH1-F1); narrow, well-bounded (2199 edges); unblocks all KG TD.
- R2 — Birth certify / canonical stamp readiness — HIGH for birth-dependent TD (PH1-F3); foundational to canonical birth (F4) and named stamps.
- R3 — Điều 35 DOT governance readiness — NOT_PRODUCTION_READY; broad but mostly MEDIUM/quality; needed before any Đ35 lane is trusted.
- R4 — Authority residue + GUC / warn→block policy — contained (no active bypass); mostly Owner-decision; depends on R3 for the warn→block readiness criteria.
- R5 — Staging production readiness — least-blocked, pilot-only, idle; safe to sequence last.
Adjustment notes (evidence-based, recommended):
- R4's GUC-confirmation sub-item (PH1-F7) should run immediately / in parallel. Confirming the live
app.bypass_birth_gatevalue out-of-band is cheap, requires no workstream build, and removes a standing uncertainty in the RISK-BYPASS verdict. The rest of R4 still sequences at P4. - R2 is arguably co-priority with R1 (foundational). The 1.21M uncertified-birth gap is systemically larger and underlies canonical-birth/F4; the Owner may choose to scope R1 and R2 in parallel (both are read-only-scoping first moves with no write footprint). The default keeps R1 first only because it is the single HIGH finding on its own surface and is the more bounded design problem; R2's larger blast radius makes it the natural immediate second.
- CONS-002/003 + CELL must be resolved (Owner-gated) before any R1/R2/R3 reaches materialization. Read-only scoping in R1–R3 can proceed without them; materializing provenance / canonical fields / cell_id / Species-Matrix cannot.
Order is a recommendation, not an authorization. The Owner picks one package to open first.
9. Owner decisions required
| # | Decision | Tied to |
|---|---|---|
| OD-1 | Accept this Phase-1B packet as the agreed blocker decision bridge (after GPT→Codex review). | §0, §12 |
| OD-2 | Authorize a separate, Owner-gated documentary refresh of LAW_READING_INDEX rev2 §4 (#5/#6/#10), pointer-layer §9, and the notes, to match live truth — blockers stay open, only evidence basis changes. | §3, PH1-C1..C4 |
| OD-3 | Choose the first remediation macro package to open (default R1; R1∥R2 parallel scoping is supported). | §7, §8 |
| OD-4 | Decide disposition of the 170 unvoted-applied residue (audit / annotate / quarantine — not auto-revert). | PH1-F2, R4 |
| OD-5 | Confirm the live app.bypass_birth_gate value out-of-band and set the warn→block criteria (per Đ35 §10's 4 AND-conditions). |
PH1-F7, R4 |
| OD-6 | Authorize R2's read-only diagnostic of the stalled birth-certify pipeline (verify, do not restart). | PH1-F3, R2 |
| OD-7 | Reconcile the 1 undocumented admin-fallback (Đ35 §6.5). | PH1-F8, R4 |
| OD-8 | Confirm that CONS-002/003 + CELL-003/004/007 resolution remains a prerequisite to any materialization in R1–R3. | §4 carried, §6 |
Each is a separate, later, Owner-gated step. Engineering/Codex PASS ≠ Owner authorization.
10. What can proceed now
Without any further Owner authorization, only the following may proceed:
- GPT review of this Phase-1B packet → Codex adversarial control review → Owner reads the matrix and picks a first package (the review chain on this document).
- Continued non-enacting, read-only documentary/planning work that creates no current corpus, patches no source, and runs no query.
Explicitly NOT proceeding now (requires Owner to open the package): any R1–R5 "allowed first move" — including read-only Phase-1-style runtime scoping. Phase-1 itself required an explicit Owner gate (Option D / Batch D); the R1–R5 read-only scoping is the same class of act and is not authorized by this packet. The documentary refresh (OD-2) is likewise a separate Owner-gated doc step, not done here.
11. What remains forbidden
Unchanged from the standing law-revision discipline (D0 §12, Phase-1 §2), and reaffirmed here:
- No live DB/runtime query; no write query; no DDL; no DML; no runtime patch.
- No patch to any source law, amendment, rewrite, note, or prior report (D0/D1/E0/Phase-1).
- No current corpus; no
current/folder; no copying/movinglaws/files. - No adoption/enactment of any draft; no declaring any law changed; no putting the Đ37 rewrite in force.
- No full technical design; no schema/table/registry/index creation.
- No materialization of KG / provenance /
cell_id/dot_role/canonical_fields/ Species Matrix /BIRTH_STAMP/PROMOTE_STAMP. - No triggering of DOT / KG / promote / birth / repair; no migrations; no write-tests.
- No blocker resolved. No authority-order (CONS-004) change. No v0.1 baseline change. No v0.2-hardening promotion.
12. Ready for GPT/Codex review
This packet is READY for GPT review, then Codex adversarial control review. It is a decision bridge, not remediation, not technical design, not implementation. Default disposition: HOLD. No blocker is resolved; technical design remains gated; PASS ≠ Owner authorization.
Recommended chain: GPT reviews Phase-1B → if accepted, Codex reviews → Owner chooses the first remediation macro package (default R1; R1∥R2 parallel scoping supported) and decides OD-1…OD-8.
Source baseline: reports/phase1-readonly-runtime-blocker-verification-2026-06-17.md (rev1, PARTIAL), read in full. Navigation: LAW_READING_INDEX.md (rev2), consolidation/current-understanding-pointer-layer-2026-06-17.md (rev1), D1 report (rev1). Audits/planning: E0 audit (rev1, PASS_WITH_MEDIUM_FINDINGS), D0 consolidation packet (rev1). Anchors: 5 amendments, Đ37 rewrite, 6 notes, 10 source laws (constitution v4.6.3, Đ32, Đ35 v5.2, Đ39 v2.3, law-04, law-22, Đ33, Đ38, birth-registry Đ0-G, operating-rules).