04 — A4 · Fresh BEFORE Snapshot

Method: governed RO query_pg (AST-validated, READ ONLY txn, read-only role, 5s timeout, LIMIT 500), db=directus. No writes possible through this channel.

Snapshot (2026-06-23, captured this run)

Metric	Value
apr_action_types total	14
apr_action_types unimplemented (handler_ref='unimplemented')	10
authorize_build_step.handler_ref	unimplemented
authorize_build_step.risk_level	high
authorize_build_step.status	active
authorize_build_step._dot_origin	PG:sb1-gov-vocab
authorize_build_step.created_at	2026-06-02 06:37:40+00
governance_build_authorization count	0
approval_requests total	230
└ proposed_action_code='authorize_build_step'	0
└ status='approved'	2
dot_tools total	309
└ code LIKE 'dot-c1-%'	0
dot_agent_api_contract count	2
table_registry count	21
directus_collections count	164

VPS git

• branch feat/s177-sprint1-round-a, HEAD bbf9c436…ad8ec88, working tree DIRTY (80 lines)

Interpretation

Exact match to the established 2026-06-23 baseline. The W7 linchpin is unchanged: authorize_build_step handler is unimplemented and has 0 approval requests → the L3 grant cannot be issued/executed until the handler is implemented + bound (the W7 prerequisite) and a quorum approves.

A4 gate: PASS (baseline captured; basis for before==after).