INDEX — Governed DOT C1 Dry-Run P0→P6 — 2026-06-22

Macro: GOVERNED_DOT_C1_DRYRUN_P0_TO_P6 · rev1 · clean-start (target dir was empty; pre-write = 0).

Verdict

C1_DRYRUN_CAPABILITY_LOCKED_OPERATOR_ACTION_REQUIRED

The macro target GOVERNED_C1_DRYRUN_EXECUTED_AND_PROVEN_READY_FOR_CODEX_CONFIRMATION was NOT reached. This is not a forced HOLD: it is the macro's defined outcome when the lawful path is irreducibly blocked by an operator-only capability.

Posture

• REGISTRATION_HOLD = ACTIVE · REGISTRATION_CAN_PROCEED = NO
• P2 / named lane = CLOSED
• 0 governed-runtime mutations (before == after: dot_tools=309, contracts=2, table_registry=21, dot_c1=0, c1_vocab_table=0)
• Secret Manager access = SUCCEEDED · secret values not accessed (no lawful path consumes them here)
• Subagents = NONE · ready-for-Codex = YES · ready-for-governed-dry-run = NO · ready-for-prod = NO

The one-sentence finding

It is not a credential problem. Secret Manager works and Directus/PG admin credentials are present and retrievable — but they unlock no lawful path, because the governed DOT registrar is an on-deploy CLI (bin/dot/dot-dot-register.ts, /opt/incomex/dot/bin/dot-*) with no execution channel reachable from this environment, and using the credentials to register C1 manually (psql DDL/DML, Directus collection creation, raw contract-row insert) is explicitly forbidden by the macro and blocked by DB guard triggers. The blocker is the absence of a governed execution channel for the registrar pipeline, which is operator/deploy-only.

What WAS proven (positively)

• The governed dispatch route is live and in the correct dry-run-only posture (execute_enabled=false, real_run_enabled=false, dry_run_only=true).
• A real DOT (DOT_KG_EXPLAIN) validates through the dispatcher (validated:true, endpoint_present:true, true_dry_run_possible:true).
• The route is fail-closed: every bad input (REAL_RUN, invalid mode, missing correlation_id, unknown/unregistered dot_code incl. DOT_C1_VOCAB_BUILD) is refused with no PASS/digest/seal.

Files in this package

#	File	Purpose
index	this file	Overview + verdict
01	01-source-register-secret-manager-and-authority-scope-2026-06-22.md	Secret Manager discovery (redacted), authority scope
02	02-p0-capability-unlock-and-dot-only-guardrail-proof-2026-06-22.md	P0 capability unlock; DOT-only guardrail; why creds ≠ lawful path
03	03-p1-dot-spec-admission-and-reuse-first-proof-2026-06-22.md	Reuse-first inventory; registrar = on-deploy
04	04-p2-c1-collection-schema-table-registry-ensure-proof-2026-06-22.md	P2 surface ensure — blocked; live DENY
05	05-p3-dot-c1-registration-catalog-and-handbook-proof-2026-06-22.md	P3 registration — no governed registrar function
06	06-p4-c1-grant-ownership-and-authority-binding-proof-2026-06-22.md	P4 grant/ownership — not reachable
07	07-p5-c1-preflight-and-dispatchability-proof-2026-06-22.md	P5 live dispatcher route proof
08	08-p6-c1-governed-dryrun-execution-log-2026-06-22.md	P6 dry-run — route-level refusal, 0 mutations
09	09-p6-bad-input-fail-closed-results-2026-06-22.md	Live bad-input matrix, all fail-closed
10	10-p6-rollback-no-state-clean-evidence-proof-2026-06-22.md	No-state / clean / before==after
11	11-before-after-runtime-and-kb-readback-evidence-2026-06-22.md	Snapshot + KB readback
12	12-dot-manage-updates-and-registry-readback-2026-06-22.md	DOT-manage update; no orphan DOT
13	13-internal-codex-negative-review-2026-06-22.md	A1–A16 adversarial review
14	14-final-decision-2026-06-22.md	Verdict + READY criteria 1–17 + operator action
packet	codex-review-packet-governed-dot-c1-dryrun-p0-p6-2026-06-22.md	One-page for Codex confirmation

Rollup: knowledge/dev/laws-new/reports/macro-governed-dot-c1-dryrun-p0-p6-2026-06-22.md. DOT-manage status: knowledge/dev/laws-new/newlaws/dot-manage/dot-manage-governed-c1-dryrun-p0-p6-status-2026-06-22.md.

Next step (operator)

Run the governed DOT registrar pipeline on the VPS (the on-deploy DOT-REGISTER / DOT_COLLECTION_REGISTER / DOT_SCHEMA_TABLE_REGISTRY_ENSURE scripts) to create the C1 collection + table_registry row, register DOT_C1_* into dot_tools + dot_agent_api_contract with a real no-mutation endpoint_ref on incomex-agent-api-executor:8090, OR provision a governed command-execution capability that can drive /opt/incomex/dot/bin/* under DOT governance. Until then, re-running this macro reproduces the same HOLD. Residual ⇒ GOVERNED-DOT-C1-DRYRUN-P0-P6-PATCH1.