C1-DRYRUN-EXECUTION — Codex Review Packet — 2026-06-22

For Codex confirmation. Verdict: C1_DRYRUN_HOLD_TEST_SANDBOX_AUTH_OR_RUNTIME_MISSING. Dry-run executed: NO · Contract registered: NO · Ready for production: NO · REGISTRATION_HOLD ACTIVE · CAN_PROCEED=NO · P2/named lane CLOSED · 0 mutations · DO NOT IMPLEMENT.

1. Live evidence (this session, read-only, db directus, VPS contabo)

ID	Probe result	Proves
E1	fn_process_agent_api_dispatch raises on REAL_RUN (true)	dispatcher = validate/observe only
E2	c1_table=0, c1_views=0, c1_functions=0, c1_prefixed_tables=0	no C1 schema/view/handler
E3	dot_agent_api_contract = {DOT_KG_EXPLAIN, DOT_KG_EXPLAIN_VERIFY} only	no DOT_C1_* contract
E4	10 "dryrun" objects, all read-only VIEWS for birth/process_discovery/rp_ai_orphan	dry-run infra exists for other carriers; none for C1; no sandbox lane
E5	governance_build_authorization rows = 0; status domain {draft,active,consumed,expired,revoked}	no grant of any kind; granted impossible
E6	apr=14, pav=12, join=0	resolver namespaces disjoint (R8)
E7	gates: composer_enabled=false, direct_insert_policy=block_after_guard, dry_run_only=true×3, execute_enabled=false, real_run_enabled=false	every execution gate CLOSED
E8	write channels: query_pg read-only; MCP CRUD→403 (SSOT v1.2); no raw-SQL write tool; write_file=spec only; DOT_C1_SCHEMA_ENSURE absent	no governed write channel to create C1 contract

2. Why HOLD, not READY

The user authorized C1 test/sandbox build-prep. But there is no governed, reachable write channel to register the C1 executable contracts, and no C1 contract to dispatch a dry-run against. Creating one would require either a primitive that doesn't exist (DOT_C1_SCHEMA_ENSURE), or a 403'd MCP write, or raw SQL (forbidden by the macro and impossible under the read-only role). Macro §0/§5: missing write channel/runtime ⇒ stop at this exact HOLD, do not ask the user. Internal review (file 10): attacks A1 (no dry-run executed) and A2 (no contract registered) succeed ⇒ READY withheld; no fail-open/overclaim attack succeeds ⇒ HOLD not REJECT.

3. Ask of Codex

Confirm: (a) the live HOLD is real (re-run E1–E8 read-only); (b) the blocker is the missing Gate-B build-prep registration channel, not a dry-run re-attempt; (c) the next gate is a governed capability to register the C1 executable contracts (write path + DOT_C1_SCHEMA_ENSURE), after which dry-run, bad-input, and rollback become executable. 13 files under …/reports/c1-dryrun-execution/ + rollup …/reports/macro-c1-dryrun-execution-2026-06-22.md.

4. Boundary

Nothing registered, executed, flipped, or written to the governed runtime. KB report writes only (additive). REGISTRATION_HOLD retained.