Macro Rollup — Governed DOT C1 Dry-Run P0→P6

Macro: GOVERNED_DOT_C1_DRYRUN_P0_TO_P6 · Date: 2026-06-22 · rev1

Verdict

C1_DRYRUN_CAPABILITY_LOCKED_OPERATOR_ACTION_REQUIRED — the P0–P6 execution attempt is complete. Target GOVERNED_C1_DRYRUN_EXECUTED_AND_PROVEN_READY_FOR_CODEX_CONFIRMATION was not reached. This is the macro's defined outcome when the lawful path is irreducibly blocked by an operator-only capability — not a forced HOLD.

Headline finding (what changed vs. all prior HOLDs)

Prior runs held on "no governed write channel / creds staged." This run retrieved capability from Secret Manager and proved the premise wrong-in-detail and right-in-conclusion:

• Credentials are PRESENT (Secret Manager access succeeded; DIRECTUS_ADMIN_TOKEN, PG_PASSWORD, etc. exist).
• They unlock no lawful path, because the governed registrar (DOT-REGISTER → bin/dot/dot-dot-register.ts, trigger_type=on-deploy; /opt/incomex/dot/bin/dot-*) is an on-deploy CLI with no execution channel here, the DB dispatcher cannot execute/register (its own note), there is no governed registrar function (INSERT INTO dot_agent_api_contract=0 functions) and no registrar Flow (only [DOT-REG] -> AD CDC syncs), and manual use of the creds is forbidden + guard-blocked.
• ⇒ The blocker is precisely an operator/deploy execution channel + a C1 no-mutation executor endpoint, not a missing credential.

Posture

REGISTRATION_HOLD ACTIVE · CAN_PROCEED=NO · P2/named lane CLOSED · 0 governed mutations (before==after: dot_tools=309, contracts=2, table_registry=21, C1=0) · 0 subagents · ready-for-Codex=YES · ready-for-governed-dry-run=NO · ready-for-prod=NO · Secret values never accessed/printed.

What WAS proven (positive)

• Governed dispatch route is live and in dry-run-only posture; DOT_KG_EXPLAIN validates (true_dry_run_possible:true, endpoint incomex-agent-api-executor:8090).
• Route is fail-closed: REAL_RUN, invalid mode, missing correlation_id, unknown/unregistered dot_code (incl. DOT_C1_VOCAB_BUILD) all refused — no PASS/digest/seal.
• Reuse-first plan complete; no orphan DOT; no overclaim (internal Codex A1–A16 → HOLD upheld).

Package (17 files + rollup + DOT-manage status)

knowledge/dev/laws-new/reports/governed-dot-c1-dryrun-p0-p6/: index + 01–14 + codex-review-packet. Rollup: this file. DOT-manage status: …/newlaws/dot-manage/dot-manage-governed-c1-dryrun-p0-p6-status-2026-06-22.md. Clean-start (pre-write=0).

Exact operator action (single blocker)

Run the governed on-deploy registrar to create the C1 collection + table_registry row, deploy a C1 no-mutation endpoint on :8090, register DOT_C1_* into dot_tools+dot_agent_api_contract, mint one C1-scoped single-use dry-run grant — OR provision a governed command-execution capability for /opt/incomex/dot/bin/*. Then re-run ⇒ genuine governed C1 dry-run. Residual ⇒ GOVERNED-DOT-C1-DRYRUN-P0-P6-PATCH1.

Principles

authorization ≠ capability · credential-present ≠ lawful-path-present · governed-registration ≠ manual-write · on-deploy-CLI ≠ runnable-from-here · engineering-route-PASS ≠ authority-PASS · sandbox-logic ≠ governed-runtime.