07 — Final decision

VERDICT

APR_APPROVAL_CHANNEL_HOLD_PRIMITIVE_MISSING_DOT_APR_APPROVE_REQUIRED

Co-hold (deployment dimension):

APR_APPROVAL_CHANNEL_HOLD_BOOTSTRAP_REQUIRES_QUORUM

No existing lawful, identity-bound, proposer-excluding, audited channel exists for a real president / ai_council to cast a vote into apr_approvals. The smallest missing primitive is dot-apr-approve, designed in file 05 and staged only — not built, not deployed. Deploying it is itself a high-risk patch_ops_code change that needs the very quorum it would enable (bootstrap paradox).

Why this verdict (not the others)

• Not APR_APPROVAL_CHANNEL_IDENTIFIED_FOR_REAL_APPROVERS: survey (file 02) + decision (file 04) found no lawful channel — every path is wrong-domain, read-only, disabled, or a raw manual write.
• Not APR_0415_QUORUM_READY_FOR_EXECUTION: 0 legitimate votes; quorum_passed('APR-0415')=false.
• Not APR_APPROVAL_CHANNEL_HOLD_HISTORY_INCONCLUSIVE: history was conclusively reconstructed (file 03) — the 42 rows are a batch back-fill; that conclusion is firm, not inconclusive.
• Not APR_APPROVAL_CHANNEL_HOLD_KB_READBACK_FAILED: all 8 files read back from AgentData KB.
• Not any GOVERNED_C1_DRYRUN_REJECT_*: nothing was fabricated, no self-approval, no manual SQL approval, no readiness overclaim was attempted — this is a HOLD on an absent primitive, not a REJECT of a bad act.

Bootstrap: how the channel can be created lawfully (OWNER/OPERATOR decision — not the agent)

To deploy dot-apr-approve you need quorum on its patch_ops_code APR, but quorum needs the channel. Legitimate ways to break the cycle (all owner-side):

1. Sovereign bootstrap exception — the owner/president, as system sovereign, authorizes a one-time governed deployment of dot-apr-approve (analogous to the documented S178 retroactive bootstrap), recorded as an explicit exception. (Note: the lessons addendum forbids casual manual writes; this must be an explicit, logged sovereign act, not an agent convenience.)
2. Provide the authenticated-approver substrate first (per-seat credentials), then have the real president + 2 real council seats approve dot-apr-approve's deploy APR through whatever interim authenticated route the owner controls. The agent cannot perform either; both require real human/owner authority.

State (read-only; before==after)

APR-0415                 pending · quorum_passed=false · president_vote_present=false · 0/3 approvals · payload intact
apr_approvals(415)       0 rows
governed writes          0 · approvals recorded 0 · manual SQL 0 · manual Directus 0 · fabrication 0 · self-approval 0
dot-apr-approve          does not exist (designed/staged only)

Self-check (macro §8)

1. Avoid executing APR-0415? .................................... YES
2. Avoid fabricating approvals? ................................. YES
3. Avoid self-approval? ......................................... YES
4. Avoid manual SQL approval? ................................... YES
5. Reconstruct historical approval paths? ...................... YES (file 03 — batch back-fill)
6. Identify whether a real approval channel exists? ............ YES — it does NOT
7. If channel exists, did only real approvers act? ............. N/A — no channel; 0 votes
8. If no channel, stage only minimal dot-apr-approve? .......... YES — design-only (file 05), not built/deployed
9. Avoid W1→W9 / dry-run / Codex? .............................. YES
10. KB evidence read back? ..................................... YES — 8/8

Remaining owner/council actions

1. Decide the bootstrap path above (sovereign exception vs. authenticated-approver substrate).
2. If building dot-apr-approve: provide per-approver authentication, then govern its birth/admission/ registration/catalog/ledger/rollback per file 05.
3. Only after a lawful channel exists: real president + 2 real council cast APR-0415 votes (packet, file 06), confirm quorum_passed('APR-0415')=true, then a separate owner-authorized macro executes via dot-apr-execute.

Readiness flags

ready for execution ...................... NO (quorum 0/3; no channel)
ready for Claude re-verification ......... NO unless executed
ready for Codex final confirmation ....... NO
ready for governed dry-run ............... NO
ready for production ..................... NO