R1-R2 Parallel Read-Only Scoping — Execution Report (2026-06-17)
R1-R2 Parallel Read-Only Scoping — Execution Report
Date: 2026-06-17 · Workstream: R1 ∥ R2 (first remediation-scoping macro after Phase-1B) · Revision: rev1 Class: execution report / read-only scoping / Owner-decision-prep READ-ONLY · NON-ENACTING · NON-AUTHORIZING · NOT remediation · NOT technical design · NOT implementation · NO blocker resolved.
0. Status
STATUS: PARTIAL — both R1 and R2 were fully scoped on the PostgreSQL substrate (every required runtime fact was obtained read-only), but each carries one honest, non-blocking gap that sits outside the read-only query_pg PG-catalog surface:
- R1: the KG-runner/preflight/log layer and the provenance source-of-truth for any future backfill were not inspected; Qdrant
entity_embeddingsnot queried (PG-only run). - R2: the root cause of the 2026-03-21 inspection cutover lives in the DOT-runner / cron / log layer (not inspected); the live
app.birth_gate_mode/app.bypass_birth_gateGUC values remain unreadable viaquery_pg's safe-param allowlist.
PARTIAL is the correct disposition (per the task contingency: "Return PARTIAL if either R1 or R2 cannot be fully scoped"). It is not BLOCKED (runtime access was available for both) and not FAIL (no forbidden mutation occurred). This run is the Owner-gated read-only opening of R1∥R2 parallel scoping (OD-3 parallel option + OD-6 verify-only diagnostic); it resolves no blocker and authorizes no write-enabled remediation.
1. Files created
Exactly three files (all new reports; no source/law/draft/note/prior-report patched):
| File | Revision | content_length | Status |
|---|---|---|---|
reports/r1-d39-kg-provenance-quarantine-execution-readiness-scope-2026-06-17.md |
1 | 19493 | created · re-read · verified |
reports/r2-birth-certify-canonical-stamp-readiness-scope-2026-06-17.md |
1 | 19284 | created · re-read · verified |
reports/r1-r2-parallel-readonly-scoping-execution-report-2026-06-17.md |
1 | (this document) | created · re-read |
2. Sources read
Decision baseline: phase1b-runtime-truth-blocker-decision-packet-2026-06-17.md, phase1b-runtime-truth-blocker-decision-execution-report-2026-06-17.md, phase1-readonly-runtime-blocker-verification-2026-06-17.md. Navigation: LAW_READING_INDEX.md (rev2), current-understanding-pointer-layer-2026-06-17.md. R1 anchors: notes/dieu39-knowledge-graph-compatibility-note.md, laws/dieu39-knowledge-graph-law.md, rewrites/dieu37-governance-organization-law-rewrite-draft.md. R2 anchors: notes/dieu4-birth-process-compatibility-note.md, amendments/l4-birth-gate-extension-amendment-draft.md, amendments/dieu38-normative-document-law-v3-amendment-draft.md, architecture/birth-registry-law.md, laws/law-04-birth-process.md. Gate anchors: notes/dieu32-approval-owner-gate-compatibility-note.md, notes/dieu35-dot-governance-compatibility-note.md, laws/dieu32-approval-law.md, laws/dieu35-dot-governance-law.md, ssot/operating-rules.md.
All required sources READ first-hand (via read-only batch_read/get_document through three parallel read-only reader-agents). None NOT_FOUND. Local repo is substrate-free/stale (PH1-F10); the VPS PostgreSQL directus DB is SoT for these runtime blockers.
3. Commands run
All against database directus via the read-only query_pg MCP tool. Read-only proof: AST-validated, READ ONLY transaction, role context_pack_readonly, statement_timeout 5s, hard LIMIT 500, no writes/DDL. SELECT current_user returned context_pack_readonly; session anchor 2026-06-17 14:03:41 UTC; all queries executed in the same session window (~14:03–14:10 UTC).
| ID | Query (abbrev.) | Read-only? | Exit | Pkg |
|---|---|---|---|---|
| L1 | SELECT now(), current_user, current_database() |
yes | success | both (proof) |
| L2 | information_schema.columns ×6 tables |
yes | success (85 rows) | both |
| L3 | information_schema.tables kg\_% |
yes | success (11 rows) | R1 |
| L4 | universal_edges aggregate |
yes | success (1 row) | R1 |
| L5 | kg_auto_approve_rules content |
yes | success (6 rows) | R1 |
| L6 | kg_quality_log count + max |
yes | success (1 row) | R1 |
| L7 | kg_source_authority content |
yes | success (5 rows) | R1 |
| L8 | governance_registry WHERE KG |
yes | success (1 row) | R1 |
| L9 | dot_tools columns |
yes | success (28 rows) | both |
| L10 | dot_tools domain breakdown |
yes | success (35 rows) | R1 |
| L11 | dot_tools domain LIKE 'kg.%' enumeration |
yes | success (36 rows) | R1 |
| L12 | pg_proc prosrc ILIKE '%quarantine%' |
yes | success (1 row) | R1 |
| L13 | pg_proc edges+provenance |
yes | success (1 row) | R1 |
| L14 | birth_registry GROUP BY certified (counts, born_at range, inspect/certified_at set counts) |
yes | success (2 rows) | R2 |
| L15 | pg_proc fn_birth%/certify/inspect/fn_iu_enact |
yes | success (12 rows) | R2 |
| L16 | pg_trigger census birth/certify/inspect |
yes | success (1 row) | R2 |
| L17 | pg_trigger auto_certify/inspect |
yes | success (1 row) | R2 |
| L18 | dot_tools inspect/certif/birth codes |
yes | success (7 rows) | R2 |
| L19 | birth_registry certified certified_at window + distinct days |
yes | success (1 row) | R2 |
| L20 | pg_proc prosrc inspect_pen/stamp/gate |
yes | success (1 row) | R2 |
| (pg_schema ×3) | introspection helper | n/a | tool-error (AmbiguousParameter; not a write) | both |
20 read-only SELECTs succeeded; the only errors were the pg_schema helper tool's own parameter-typing bug, superseded by information_schema SELECTs. No write/DDL/DML/execution call was made or prepared.
4. R1 completion check
- KG substrate inventory captured (8
kg_*base tables + 3 views; edge store columns incl.provenance/valid_time/confidence). ✓ universal_edges: 2199 edges, 0 provenance, 0 valid_time, 100% confidence; edge creation stopped 2026-04-21; 0 quarantined. ✓- KG DOTs: 36 registered across
kg.*, 0 executed (incl.DOT_KG_PROVENANCE_TAG/AUDIT). ✓ kg_quality_log= 0 rows (explainability precondition unmet). ✓GOV-KG-SYS= active but inert (primary_collection/health_dot NULL). ✓kg_auto_approve_rules(6, fail-closed TBox-human) +kg_source_authority(5-tier) captured — readiness asset. ✓- Quarantine mechanism: absent (only
fn_preflight_guardrefs quarantine; onlyfn_iu_kg_edge_audittouches edges+provenance). ✓ - R1 explicit answers all delivered; verdict matches baseline (registered yes / executed no / not provenance-compliant / quarantine not present / backfill unsafe / execution unsafe). ✓
- Open gap → PARTIAL: KG-runner/log layer + provenance source-of-truth not inspected (R1-OD-a).
R1 is fully scoped at the PG-substrate level; STATUS PARTIAL only for the out-of-surface runner/log layer.
5. R2 completion check
birth_registryinventory captured (incl. newstatus/canonical_address/owner/jsonb_profile). ✓- Certified vs uncertified: 1,402 certified / 1,211,557 uncertified (0.1156%); certified all-stamped (last born 2026-03-21 06:29), uncertified zero-stamped (live to 2026-06-17 13:30). ✓
- Inspect pipeline: only
fn_birth_auto_certifyreads inspect_*; no function/trigger writes them; 0 inspect triggers; inspector DOTsDOT-TAC-BIRTH-VERIFY/-GATEregistered, never executed. ✓ - Birth functions (12) + triggers (192 birth / 191 enabled, 1 certify, 0 inspect) inventoried. ✓
- Stall analysis: certification was a single 2026-03-21 06:00–08:00 batch (1 distinct cert-day), never recurred. ✓
- BIRTH_STAMP/PROMOTE_STAMP mapping table to live
certified/certified_at/inspect_*+ IUfn_iu_enactproduced — named stamps are conceptual targets, not artifacts. ✓ - Birth-dependent TD gate stated HIGH/BLOCKED (per C-2). ✓
- R2 explicit answers all delivered; verdict matches baseline. ✓
- Open gap → PARTIAL: root cause of the cutover (runner/cron/log) + live GUC not inspectable (R2-OD-a).
R2 is fully scoped at the PG-substrate level; STATUS PARTIAL only for the out-of-surface runner/log/GUC layer.
6. Forbidden-action check
| Forbidden action | Occurred? |
|---|---|
| write query / DDL / DML (INSERT/UPDATE/DELETE/CREATE/ALTER/DROP/TRUNCATE/GRANT/REVOKE) | No — role context_pack_readonly, READ ONLY txn; all 20 commands SELECT |
| migrations / runtime patch | No |
| patch KB source law/draft/note/report | No — only 3 new reports created |
create current corpus / current/ folder |
No |
| adopt/enact any draft | No |
| write full technical design | No — design-direction items explicitly flagged as gated, not designed |
| implement | No |
| resolve blocker | No — all blockers remain OPEN |
| execute DOT / KG / birth / promote / certify / repair | No |
| backfill provenance / quarantine edges | No |
set inspect_pen/stamp/gate / certified=true |
No |
materialize KG / provenance / BIRTH_STAMP/PROMOTE_STAMP / cell_id/dot_role/canonical_fields |
No |
| create schema/table/registry/index | No |
| change authority order (CONS-004) / v0.1 baseline / promote v0.2-hardening | No |
No NOT_SAFE_TO_TEST action was attempted. No forbidden mutation occurred → not FAIL.
7. Findings summary
12 findings (6 per package); 7 HIGH, 2 MEDIUM, 3 INFO/LOW. No CRITICAL. No active mutation or authority bypass observed.
| ID | Sev | Pkg | Summary | Blocks TD? | Blocks impl? |
|---|---|---|---|---|---|
| R1-F1 | HIGH | R1 | 2199 edges, 0 provenance / 0 valid_time → Đ39 provenance-or-quarantine invariant unmet (=PH1-F1, per C-1) | Yes | Yes |
| R1-F2 | HIGH | R1 | 36 KG DOTs registered, 0 executed | Yes | Yes |
| R1-F3 | HIGH | R1 | kg_quality_log=0 → "no explanation = no execution" unmet |
Yes | Yes |
| R1-F4 | MED | R1 | No built KG-edge quarantine / provenance-writer mechanism | Yes (design gap) | Yes |
| R1-F5 | LOW/asset | R1 | Config layer Đ39-aligned & fail-closed (untested) | No | No |
| R1-F6 | INFO/corr | R1 | universal_edges has no version column (digest correction); GOV-KG-SYS inert |
No | No |
| R2-F1 | HIGH | R2 | 1,211,557 uncertified births (99.88%), 0 inspect stamps (=PH1-F3) | Yes (birth-dep) | Yes |
| R2-F2 | HIGH | R2 | Certification was a single 2026-03-21 batch; never recurred | Yes | Yes |
| R2-F3 | HIGH | R2 | Inspection stage has no live PG producer; inspector DOTs never ran | Yes | Yes |
| R2-F4 | HIGH | R2 | Births fire live today via 192 triggers, default certified=false |
Yes | Yes |
| R2-F5 | MED | R2 | BIRTH_STAMP/PROMOTE_STAMP are conceptual targets, not artifacts | Yes (mapping gap) | Yes |
| R2-F6 | INFO | R2 | birth_registry schema extended (status/canonical_address/owner/jsonb_profile) |
No | No |
Consistency with Phase-1B. Live evidence reconfirms every Phase-1B verdict (Đ39 REGISTERED_NOT_EXECUTED; HOLD-2 PARTIAL; PH1-F1/F3 HIGH). No material contradiction surfaced. Two refinements rather than contradictions: (i) R1-F6 corrects a carried-digest detail (no version column) — not a Phase-1B claim — severity LOW; (ii) R2-F2 sharpens the stall to a single 2026-03-21 batch. The uncertified count grew 1,211,549 → 1,211,557 (+8) since the Phase-1 morning run — expected live drift, confirming the diagnosis, not contradicting it.
8. Non-authorization
This report and its two siblings authorize nothing. No DDL/DML; no runtime write; no KG/DOT execution; no birth/promote/certify execution; no provenance backfill / edge quarantine; no inspect_* / certified set; no stamp/canonical/cell_id/dot_role materialization; no source/draft/note/report patch; no current corpus; no draft adoption; no technical design; no implementation; no blocker resolved; no authority-order (CONS-004) change; no v0.1 baseline change; no v0.2-hardening promotion. The R1 and R2 packages are scoped read-only, not opened for remediation. Engineering/Codex PASS ≠ Owner authorization. CONS-002/003 + CELL-003/004/007 remain prerequisites to any R1/R2 materialization. Default disposition: HOLD.
9. Self-check
| Check | Result |
|---|---|
| SC1 Read Phase-1B? | Yes (packet + exec report) |
| SC2 Read Phase-1 runtime report? | Yes |
| SC3 Ran only read-only commands? | Yes (role context_pack_readonly, 20 SELECTs) |
| SC4 Avoided all DDL/DML? | Yes |
| SC5 Avoided KG/DOT/birth/promote/certify execution? | Yes |
| SC6 Avoided backfill/quarantine/certify/stamp materialization? | Yes |
| SC7 Kept R1 and R2 as scoping only? | Yes |
| SC8 Avoided full technical design? | Yes (design-direction items flagged gated) |
| SC9 Kept all blockers open? | Yes |
| SC10 Created only the three allowed files? | Yes |
| SC11 Re-read all three files after writing? | Yes (R1/R2 re-read full + verified; this report re-read) |
No self-check failed.
10. Ready for GPT/Codex review
Yes. Recommended chain: GPT reviews R1 + R2 + this execution report → if accepted, Codex adversarial control review → Owner decides OD-3 / OD-6 / OD-8 plus the new read-only/design-gated sub-decisions R1-OD-a/b and R2-OD-a/b: whether to open write-enabled remediation for R1, R2, both, or continue read-only scoping (e.g. authorize the read-only runner/log root-cause studies). Default disposition: HOLD; PARTIAL ≠ Owner authorization.