C1-DRYRUN-EXECUTION 03 — C1 Executable Contract Registration or HOLD — 2026-06-22

Gate: REGISTRATION_HOLD · CAN_PROCEED = NO · 0 runtime mutations.

Macro §3.2 requires exactly one of: A contract already exists (readback); B contract created in test/sandbox under this authorization (readback); C cannot be created because required authority/runtime is missing → HOLD.

Result: Option C.

---

1. Option A — already exists? NO

Live dot_agent_api_contract = {DOT_KG_EXPLAIN, DOT_KG_EXPLAIN_VERIFY} only. DOT_C1_* contracts = 0. C1 table = 0, C1 functions = 0, C1 preflight views = 0 (file 02 C1/C3/C4). No C1 executable contract exists to read back.

2. Option B — create it now in test/sandbox? CANNOT

The C1 executable contract (per PATCH2 file 02 Form-B blueprint) is not one object — it is a set of governed registrations:

1. DOT_C1_SCHEMA_ENSURE (schema-creation DOT) → Directus collection + physical table governance_canonical_operation_vocab + table_registry row.
2. DOT_C1_VOCAB_BUILD / …_VERIFY (producer/verifier pair) → rows in dot_agent_api_contract + dot_tools.
3. DOT_C1_VALUE_ADMIT (governed value-admission handler) → new PG function.
4. Atomic consume handler + state-machine/compensation handlers → new PG functions + a transition table.
5. fn_c1_vocab_harness_run (C1 harness) + v_c1_realrun_preflight (C1 preflight view).

Creating any of these requires a write channel. Each candidate channel is closed:

Required write	Available channel	Blocked by
directus_collections/directus_fields + physical table + table_registry	(would be) DOT_C1_SCHEMA_ENSURE	primitive does not exist; cannot be invoked
same, via MCP CRUD	directus_create	MCP CRUD → 403 for schema/governed (SSOT v1.2); cannot create fields/tables/functions anyway
same, via raw SQL	—	macro §4 forbids raw SQL DDL/DML as authority path; and query_pg is read-only (no DDL possible regardless)
dot_agent_api_contract / dot_tools rows	SQL INSERT	no SQL write tool exists; query_pg read-only
PG functions (admit/consume/compensation/harness) + preflight view	CREATE FUNCTION/CREATE VIEW	no SQL write tool; read-only role

There is no chicken-and-egg escape: the sanctioned primitive (DOT_C1_SCHEMA_ENSURE) that would let me create the schema without raw SQL does not itself exist, and creating it would require the very write channel that is absent. Per the governed model, the only legitimate way to obtain that primitive is a Gate-B build-prep registration capability operating through a real DOT/Directus write path — which is not present in this environment.

3. Why this is a HOLD, not a workaround

• Hand-writing the schema with raw DDL would (a) violate macro §4, (b) be impossible (query_pg read-only), and (c) reproduce the exact P0-1 "raw SQL authority" defect Codex and PATCH1/PATCH2 already rejected.
• Writing a spec file via write_file produces prose, not a registered executable contract — Codex §5.1 is explicit that "spec (Form B) ≠ registered artifact." This was already done in PATCH2 (file 02 §3); repeating it does not advance to an executable surface.
• Therefore the executable contract cannot be created here, which makes the dry-run undispatchable (file 06).

4. Required contract fields (carried, for the future Gate-B channel)

When a governed write channel exists, the contract must carry (PATCH2 blueprint): contract name (DOT_C1_VOCAB_BUILD/_VERIFY); endpoint http://incomex-agent-api-executor:8090/dispatch; payload {manifest_digest, values:[{operation_code, protocol_version, act_type, semantics_frozen, governing_authority_ref}], idempotency_root}; mode=DRY_RUN/VERIFY_ONLY; no_mutation_assertion=true; REAL_RUN blocked unless separately authorized (governed promotion at the executor, not the dispatcher which raises on REAL_RUN); validator with reject codes RAW_SQL_FORBIDDEN/SCHEMA_DIGEST_MISMATCH/TABLE_REGISTRY_MISSING/MANIFEST_DIGEST_MISMATCH/UNGOVERNED_PROVENANCE/DUPLICATE_VERSIONED_VALUE; evidence = post-apply information_schema + directus_fields readback == schema_digest. None of this can be registered until the channel exists.

5. Classification & boundary attestation

EXECUTABLE_CONTRACT_CREATION_BLOCKED — not attempted (no channel; raw path forbidden). Root cause feeds the package verdict C1_DRYRUN_HOLD_TEST_SANDBOX_AUTH_OR_RUNTIME_MISSING. Design/analysis only; nothing registered/created/executed. REGISTRATION_HOLD retained; CAN_PROCEED = NO; 0 runtime mutations.