C1-DRYRUN-EXECUTION 01 — Source Register & Authority/Scope Proof — 2026-06-22

Gate: REGISTRATION_HOLD · CAN_PROCEED = NO · 0 runtime mutations. No subagents used; all reads in the main process.

---

1. Controlling sources read directly (this session)

Source	Where	Reconstructed conclusion
Codex PATCH1 dry-run-readiness HOLD	…/reports/codex/codex-review-ready-to-assemble-lego1-patch1-dry-run-auth-readiness-2026-06-22.md (rev1, len 21336)	NEED_READY_TO_ASSEMBLE_LEGO1_PATCH2; §5.1: "authorization may remain absent; the executable contract may not." Not ready to request/run dry-run.
Claude PATCH2 self-HOLD package	…/reports/ready-to-assemble-lego1-patch2/ (14 files, rev1) + rollup	READY_TO_ASSEMBLE_LEGO1_PATCH2_HOLD_DOT_DIRECTUS_PATH_INCOMPLETE. C1 executable contracts absent; PATCH2 forbidden to create them. Prep gaps B1/B4/B5/B6/B7. NEXT = a separately-authorized Gate-B build-prep authorization to register the C1 executable contracts.
Accepted baseline	…/reports/rs5b-closeout-patch2/, …/reports/ready-to-assemble-lego1/, …/ready-to-assemble-lego1-patch1/	LEGO #1 = C1 canonical_operation vocabulary; readiness-for-plan ≠ readiness-to-write; engineering PASS ≠ authority PASS.
Directus Operating Rules SSOT	v1.2 (via PATCH2 reproduction)	Schema work is DOT-only (dot-schema-*); MCP CRUD → 403; new collection must create a table_registry row; iu_create.gateway.direct_insert_policy=block_after_guard.

This macro supplies exactly the next step PATCH2 named — a build-prep authorization — but scoped to test/sandbox only.

2. Authority actually delegated (verbatim scope)

AUTHORIZED: C1 only; test/sandbox lane only; create or register C1 executable contracts
needed for dry-run (if required); create C1 harness/preflight/evidence (if required);
run C1 dry-run in test/sandbox; run bad-input/adversarial tests; run rollback/dismantle
if test/sandbox state is created; produce before/after/readback/evidence.

NOT AUTHORIZED: production mutation; production registration; activation; current-corpus
adoption; C2–C7 build; broad P2 opening; mega-registry/graph/birth pipeline; unscoped write.

• Authorization source: the user's operational delegation in this macro.
• Token/grant in the governed runtime: none — governance_build_authorization holds 0 rows (live, §file 05). There is no Chairman token, sovereign e-sign, or build-authorization row of any status.
• Expiry/revocation/single-use: N/A — no grant row exists to bear those fields.

3. The decisive distinction: authorization ≠ capability

The user's scope is sufficient as direction. It is not the blocker. The blocker is that the capability/channel to act on that direction does not exist in this environment:

Action the scope permits	Channel it would require	Live status
Create C1 Directus collection + physical table + table_registry	governed DOT_C1_SCHEMA_ENSURE (DOT-only)	primitive absent; MCP CRUD → 403; raw DDL forbidden by macro §4
Register C1 producer/verifier contract rows	write to dot_agent_api_contract	no SQL write tool; query_pg is read-only role
Register value-admit / consume / harness / preflight	new PG functions + views	no write channel; query_pg read-only
Dispatch C1 dry-run	a registered C1 contract via executor …:8090/dispatch	no C1 contract exists; dispatcher raises on REAL_RUN

4. What happens because the channel is missing (macro §0/§5)

"If real credentials, runtime access, or required write channel are missing, do not ask the user. Stop with the precise HOLD state."

The required write channel / runtime is missing. Therefore: stop at C1_DRYRUN_HOLD_TEST_SANDBOX_AUTH_OR_RUNTIME_MISSING, do not claim READY, do not ask the user. The proof of "missing" is the read-only live inventory in file 02 and the contract-creation analysis in file 03.

5. Boundary attestation

Sources read only; scope recorded; no contract registered, no DOT executed, no schema/value/audit written. REGISTRATION_HOLD retained; CAN_PROCEED = NO; 0 runtime mutations.