Macro-RS2-PATCH1 — Existing Registrar Reuse and Atomic Registration Boundary Correction (2026-06-20)
Macro-RS2-PATCH1 — Existing Registrar Reuse and Atomic Registration Boundary Correction (2026-06-20)
Addendum patch to Macro-RS2 (
…/reports/macro-rs2-registration-path-authority-trust-reconciliation-and-proof-obligation-design-2026-06-20.md, rev1 / 53,927). This document does not overwrite RS2 or any Codex report. It repairs the load-bearing registration-control baseline that Codex placed on HOLD. Read-only / KB-design only. Zero substrate mutations (read-onlyquery_pgreads + the KB write of this one report).
1. STATUS
PASS_WITH_CAVEATS
- Engineering/analysis PASS. Authority = NOT_OWNER_AUTHORIZED. Engineering PASS ≠ Authority PASS.
- Registration gate:
REGISTRATION_HOLD·REGISTRATION_CAN_PROCEED = NO(retained from RS2/Codex; PATCH1 does not move it). - Caveat 1 —
S142B_SOURCE_NOT_READ: the primary authorization source for the 142orchestrator-s142bbatch was hunted across the KB and not found; it stays unverified (§11). Per the macro's completion rule this is a contained caveat (the population can still be correctly classified), not a blocker to the patch's purpose. - Caveat 2 — RISK-BYPASS stays packet-level: PATCH1's runtime reads are fresh (2026-06-20) but did not re-read the
fn_auto_approve_add/fn_apr_quorum_checkfunction bodies this cycle. RISK-BYPASS remains as Codex graded it — packet-supported, contained-with-residue, not cleared (§5 items 2–3, §11). - Caveat 3 — design-of-criteria only: every "proof" below is an acceptance criterion for a future authorized macro, not an implementation and not a runtime result.
This is a single bounded 60–90-minute macro. It stays inside one registration block and does not become a mega-system.
2. VERDICT
RS2_PATCH1_READY_FOR_CODEX_REVIEW (with S142B_SOURCE_NOT_READ caveat).
Supporting sub-verdicts:
| Dimension | Verdict |
|---|---|
| Existing registrar reuse | REUSE_REGISTRAR_HARDENABLE_BUT_NOT_READY (dot-dot-register) |
| Transaction boundary | CORRECTED — phase-separated model produced; not HOLD_TRANSACTION_BOUNDARY_INVALID |
| Registrar source | READ (KB + PATCH1-live) — not HOLD_REGISTRAR_SOURCE_NOT_READ |
| 142 S142b | UNVERIFIED_S142B_BATCH_NEEDS_SOURCE_AND_DISPOSITION (S142B_SOURCE_NOT_READ) |
DOT_GOVERNANCE_DOT_ADMISSION |
DEFER / NEED_ONLY_IF_REUSE_FAILS |
| Next macro | RS3-BUNDLE (Owner Resolver + Trusted Snapshot + Validator N07/N12/N16/N22 Closure + Residue Disposition) |
All 11 Codex HOLD items are closed-as-criteria or correctly carried as SOURCE_NOT_READ (§5). RS3 may begin from the corrected transaction map in §7–§8, not the RS2 one.
3. EXECUTIVE SUMMARY
Codex returned RS2 as HOLD / NEED_RS2_PATCH for two structural reasons: (a) RS2's transaction map mixed durable governance prerequisites (Owner grant, APR approval) and gate-activation into the same atomic registration unit, and required a durable audit to survive a rollback — three internal contradictions; and (b) RS2 omitted an existing registrar (dot-dot-register) from the reuse-first analysis. PATCH1 repairs both.
Finding 1 — the registrar exists and is hardenable, not absent. DOT-REGISTER / dot-dot-register (bin/dot/dot-dot-register.ts, op=register, paired DOT-HEALTH-DOT, tier B, status active) is live in dot_tools (PATCH1-live). It is "the only governed registrar": it scans bin/dot-*, registers via the Directus REST API (app layer), requires Directus admin credentials, registers all untracked files (not one admitted artifact), derives metadata heuristically, and there is no deployed-artifact hash anywhere (dot_tools has no hash/baseline column — PATCH1-live). dot-catalog-sync is a separate DOT (DOT-015, domain sync, no operation/paired_dot — PATCH1-live), an on-deploy filesystem→catalog sync, not a single-artifact registrar. Verdict: REUSE_REGISTRAR_HARDENABLE_BUT_NOT_READY — reuse-first is satisfied by hardening this path (and the existing register+verify paired-DOT pattern), not by building a new registry.
Finding 2 — the registration APR lane is genuinely unbuilt. Of 14 apr_action_types (PATCH1-live), there is no DOT-registration action code at all; assign_governance_owner, register_axis, register_topic_node are all high + handler_ref='unimplemented'; the only implemented handlers are add_field/create_item/update_item and the single high-risk patch_ops_code. With governance_object_ownership = 0 (PATCH1-live), no Owner-of-record and no implemented owner-grant handler exist. These are upstream, single-sufficient registration blockers independent of the registrar.
Finding 3 — the contradictions are resolvable by phase separation, reusing existing surfaces. The corrected model has five fail-closed phases: (0) prerequisites outside the transaction; (1) a closed registration transaction that leaves every runtime gate shut; (2) post-commit independent verification by a paired read-only verifier; (3) separate, Owner-gated activation; (4) failure/compensation whose durable failure-audit is written outside the rolled-back transaction. Crucially, the durable-audit and compensation requirements can be met by reusing existing surfaces — event_outbox, iu_route_attempt (attempt-ledger), registry_changelog, governance_audit_log all exist live — so no new ledger is needed.
Finding 4 — the 142 stay unverified. The S142b primary authorization source was hunted and not found; the only reference is an uncited "a sanctioned S142b batch" assertion in the 2026-06-06 back-audit packet, explicitly out of the 26-row ratified ledger. The 142 are reclassified UNVERIFIED_S142B_BATCH_NEEDS_SOURCE_AND_DISPOSITION and kept strictly separate from the 18 auto-apply rows.
Registration remains HOLD. The single next macro is the RS3-BUNDLE addressing the upstream single-sufficient blocker (Owner-of-record = 0) plus the trusted snapshot and validator-closure criteria; the registrar-hardening design follows it (it must consume the resolver/snapshot/executor interfaces this bundle defines).
4. SOURCE REGISTER
Provenance legend: L = PATCH1 fresh live read (read-only query_pg, DB directus, 2026-06-20) · R2 = RS2-reported · CX = Codex-reported correction · 2nd = secondary report.
| # | Source | Rev / len | Read status | Evidence tier | Prov | Used for | Caveat |
|---|---|---|---|---|---|---|---|
| S1 | Codex RS2 review (HOLD) …/codex/codex-review-rs2-registration-path-authority-trust-reconciliation-2026-06-20.md |
rev1 / 18,297 | FULL_READ | SECONDARY_REPORT | CX | The gate; 11 HOLD items (§5) | Non-enacting |
| S2 | RS2 official report | rev1 / 53,927 | FULL_READ (digest) | SECONDARY_REPORT | R2 | Patch target; preserved points | Not overwritten |
| S3 | RS1 official report | rev1 / 46,040 | FULL_READ | SECONDARY_REPORT | 2nd | Blocker + reuse baseline | — |
| S4 | RS1-PATCH1 | rev1 / 23,725 | FULL_READ | SECONDARY_REPORT | 2nd | Source-coverage; RISK-BYPASS KEEP | — |
| S5 | Codex RS1+PATCH1 decision packet | rev1 / 17,335 | FULL_READ | SECONDARY_REPORT | 2nd | Prior gate ACCEPT…PROCEED_TO_RS2 |
— |
| S6 | RP-03 staged registration …/registries-pivot-…-2026-06-03/03-dot-registration-or-staging.md |
rev1 / 3,069 | FULL_READ | SECONDARY_RUNTIME_REPORT | 2nd | Registrar identity + limits | Packet, not live |
| S7 | Filesystem DOT Reconciler …/birth-orphan-dot-filesystem-hardening-macro-2026-06-03/04-filesystem-dot-reconciler.md |
rev1 | FULL_READ | SECONDARY_RUNTIME_REPORT | 2nd | "no baseline hash"; drift views | Packet |
| S8 | registries/meta_catalog/CAT-006 (DOT Tools catalog) |
— | FULL_READ | PRIMARY_RUNTIME_READONLY | 2nd | catalog-sync = dot-catalog-sync, on-deploy, 309 | — |
| S9 | DOT-register rehearsal SQL …/one-roof-nonprod-clone-…-2026-06-02/sql/D_dot_register_rehearsal_rollback_only_clone.sql |
— | FULL_READ | PRIMARY_CODE_OR_SCRIPT | 2nd | register triggers/birth_registry/pg_notify | Clone, rollback-only |
| S10 | Macro-9B contracts + guards + validator rev2 + birth-admission rev9 | rev2/rev2/rev2/rev9 | FULL_READ | PRIMARY_CONTRACT | 2nd | Artifact identity, gates, cardinality | Unregistered |
| S11 | laws-new SSOT set: de-bai-cai-tien / matrix-refactor-implementation-plan / quick-rules / addendum | rev33/rev5/rev8/rev14 | FULL_READ | PRIMARY_LAWS_NEW | 2nd | Reuse-first, anti-mega, LEGO, DOT-only | — |
| S12 | newlaws/LAW_READING_INDEX.md |
rev2 | FULL_READ | PRIMARY_NEWLAWS_POINTER | 2nd | Owner-gate; Engineering≠Authority | Map not decree |
| S13 | Back-audit ratification packet …/authority-p1-hardening-backaudit-…-2026-06-06/04-backaudit-ratification-packet.md |
rev1 | FULL_READ | SECONDARY_REPORT | 2nd | 142 honesty paragraph (§11) | Uncited "sanctioned" |
| S14 | 142 S142b primary authorization | — | SOURCE_NOT_READ | NONE | — | Cannot ratify (§11) | Not found in KB |
| L1 | Live: apr_action_types (14 rows; codes/risk/handler) |
— | FULL_READ | PRIMARY_RUNTIME_READONLY | L | No register-DOT action; owner-grant unimplemented | DB directus 2026-06-20 |
| L2 | Live: counts dot_tools=309 (r2_b2=0), governance_object_ownership=0, dot_agent_api_contract=2, law_dot_enforcement=272, approval_requests=230, apr_action_types=14 |
— | FULL_READ | PRIMARY_RUNTIME_READONLY | L | Blocker counts; artifact unregistered | — |
| L3 | Live: dot_tools columns (28) — no hash/baseline col; has _dot_origin, extra_metadata jsonb |
— | FULL_READ | PRIMARY_RUNTIME_READONLY | L | Deployed-artifact-resolver gap | — |
| L4 | Live: dot_tools 13 triggers |
— | FULL_READ | PRIMARY_RUNTIME_READONLY | L | register side-effects (birth/notify) | — |
| L5 | Live: registrar rows — DOT-REGISTER/dot-dot-register; DOT-015/dot-catalog-sync (separate); register+audit pairs |
— | FULL_READ | PRIMARY_RUNTIME_READONLY | L | Registrar identity + reuse precedent | — |
| L6 | Live: dot_config (119 keys) — gates shut; app.canonical_writer marker |
— | FULL_READ | PRIMARY_RUNTIME_READONLY | L | Gate-closed proof; interface D | — |
| L7 | Live: durable-audit surfaces — event_outbox, registry_changelog, governance_audit_log, entity_audit_queue, iu_route_attempt, birth_registry |
— | FULL_READ | PRIMARY_RUNTIME_READONLY | L | Durable failure-audit reuse | — |
Macro-AB: SOURCE_NOT_READ — not used (consistent with RS2/Codex).
5. CODEX HOLD ITEM CLOSURE MAP
Status legend: CLOSED_AS_CRITERIA (corrected; criterion provided, not implemented) · PARTIAL · SOURCE_NOT_READ · STILL_HOLD · REJECTED_WITH_REASON.
| # | Codex item (RS2 review) | Required correction | PATCH1 result | Evidence | Status |
|---|---|---|---|---|---|
| 1 | R1 — transaction map mixes prerequisites into the atomic unit (Owner grant + APR "pre-resolved" yet inside steps 1–8) | Move Owner grant + APR approval to Phase 0, outside the registration transaction; they have independent durable lifecycles | Phase-0 prerequisites defined; transaction (Phase 1) contains no Owner/APR write (§7, §8) | §8 rows P0-1, P0-2 vs P1-3/4 | CLOSED_AS_CRITERIA |
| 2 | R2 — gate activation inside registration transaction (dot_config flip in write set) |
Registration leaves the gate closed; opening is separate Owner-gated activation | Phase 1 may create a closed dot_config row; opening is Phase 3; gates live-confirmed shut (L6) |
§7 Phase 1/3; §8 P1-5a / P3-5b | CLOSED_AS_CRITERIA |
| 3 | R3 — durable audit emitted by a rolled-back transaction | Durable failure audit must survive rollback via an outside-transaction ledger/outbox or post-rollback writer | Phase-4 durable failure-audit specified outside the txn, reusing live event_outbox / iu_route_attempt / governance_audit_log (L7); success audit stays in-txn |
§7 Phase 4; §8 P4-A; L7 | CLOSED_AS_CRITERIA |
| 4 | R4 — existing registrar omitted from reuse/transaction baseline | Full capability/security/reuse assessment of dot-dot-register, dot-catalog-sync, Directus hooks, single-artifact option |
§6 full 20-capability matrix + 17 questions; registrar live-confirmed; reuse verdict given | §6; S6/S7/L5 | CLOSED_AS_CRITERIA |
| 5 | R5 — transaction map missing deployed-artifact identity | Add deployed executable path/hash/immutability bound to the admitted artifact | Phase-0 deployed-artifact resolver (interface F, §10); proof-obligation P-DAI (§9); live: dot_tools has no hash column (L3) |
§10-F; §9 P-DAI; L3 | CLOSED_AS_CRITERIA |
| 6 | Concurrency / idempotency missing | Retries + two concurrent attempts cannot create duplicates / inconsistent pair-mapping-config | Phase-1 idempotency (unique key on code/file_path) + concurrency (advisory lock / unique-constraint fail-closed); proof P-IDEM, P-CONC (§9) |
§9 P-IDEM/P-CONC | CLOSED_AS_CRITERIA |
| 7 | Durable failure-audit missing | Audit survives rollback without weakening atomicity | Same as item 3 — Phase-4 outside-txn writer reusing existing outbox/attempt-ledger | §7 Phase 4; L7 | CLOSED_AS_CRITERIA |
| 8 | Compensation / ID-conservation missing | Post-commit reversal archives/disables safely; no identity reuse | Phase-4 governed disable/archive (status='archived'); ID conserved (no delete/reuse of dot_tools.id/code); proof P-COMP (§9) |
§7 Phase 4; §9 P-COMP | CLOSED_AS_CRITERIA |
| 9 | Pair cardinality missing | Expected registry rows derived from the paired-DOT contract, not "exactly one" | Cardinality = 1 primary + 4 guard components (Macro-9B Option B; guards register only via primary); postcondition asserts the contract-derived set; proof P-PAIR (§9) | §9 P-PAIR; S10 | CLOSED_AS_CRITERIA |
| 10 | Replay / freshness missing | Owner/APR evidence target-, op-, artifact-, scope-, time-bound; non-replayable | Interface A enhanced (operation register_dot, artifact hash, expiry/revocation, authority chain); proof P-REPLAY (§9) |
§10-A; §9 P-REPLAY | CLOSED_AS_CRITERIA |
| 11 | C1 — 142 rows mislabeled SANCTIONED_BATCH_NEEDS_RATIFICATION |
Reclassify UNVERIFIED_S142B_BATCH_NEEDS_SOURCE_AND_DISPOSITION until primary source read |
Reclassified; primary source hunted and not found | §11; S13/S14 | CLOSED_AS_CRITERIA (with SOURCE_NOT_READ) |
| 12 | C2 — containment is packet-supported, not Codex-live-confirmed | Use RISK_BYPASS_MECHANISMS_PACKET_SUPPORTED_CONTAINED_WITH_RESIDUE; not LIVE_CONFIRMED; overall unresolved |
Adopted; PATCH1 did not re-read function bodies, so packet-level retained (§11) | §11 | CLOSED_AS_CRITERIA |
| 13 | C3 — NULL-mapping not irrelevant to registration | Treat the fn_apr_quorum_check NULL pass-through as an unresolved prerequisite, not an assumed property |
Logged as a Phase-0 prerequisite gate on the Đ32 lane (must close before the registration APR is trusted); proof P-NULLMAP note (§9) | §9 P-QUORUM; §11 | CLOSED_AS_CRITERIA |
| 14 | C4 — quorum_passed not globally "CLEARED" |
Use FAIL_CLOSED_CONTROL_PACKET_SUPPORTED |
Adopted verbatim (§11) | §11 | CLOSED_AS_CRITERIA |
No item is STILL_HOLD or REJECTED. Item 11's underlying primary source is SOURCE_NOT_READ (the classification is closed; the ratification awaits the source).
6. EXISTING REGISTRAR REUSE ASSESSMENT
6.1 Identity (live-resolved)
The existing registrar is DOT-REGISTER / dot-dot-register — live row dot_tools: file_path='bin/dot/dot-dot-register.ts', domain='monitoring.dot', operation='register', paired_dot='DOT-HEALTH-DOT', tier='B', status='active' (L5). Per RP-03 (S6) it is "the only governed registrar: it scans bin/dot-*, and for any file not already in dot_tools.file_path, registers it via the Directus REST API (app layer)" and "authenticates through Directus admin credentials … cannot authenticate non-interactively. This is a real access blocker."
dot-catalog-sync is a different mechanism — live row DOT-015, file_path='bin/dot/dot-catalog-sync', domain='sync', operation=NULL, paired_dot=NULL (L5); CAT-006 names it the on-deploy Sync Script that scans dot/bin/ into dot_tools (309 rows). This resolves RS2's open question: the two are not the same; catalog-sync is a filesystem→catalog reconciler, not a single-artifact registrar.
Reuse precedent (live, L5): the system already runs narrow register+verify paired-DOTs — dot-apr-types-register paired with dot-apr-types-register-audit (operation register/verify; domains infrastructure.schema / governance.audit), and DOT-TAC-COLLECTION-REGISTER paired with DOT-TAC-COLLECTION-VERIFY. A single-artifact governed DOT registrar is therefore a hardening of an established pattern, not a novel build.
6.2 The 17 registrar questions (evidence-backed)
- Registrar?
dot-dot-register(RP-03 "the only governed registrar"; L5). 2. Source read?bin/dot-*filesystem scan (S6; CAT-006). 3. Path? Directus REST API, app layer (S6). 4. Privilege? Directus app/admin (S6). 5. Admin creds? YES — "real access blocker" (S6). 6. All vs one? ALL untrackedbin/dot-*; single-artifact only via manual--dry-run/UI (S6). 7. Metadata? Heuristic from basename:tier='B',domain='general',paired_dot='DOT-HEALTH-DOT',status='active'+ DB triggers (S6; L4). 8. Law mapping? No —law_dot_enforcementis a separate optional manual step (S6; L2 = 272 rows). 9. Config/gate? SOURCE_NOT_READ — no registrardot_configwrite seen. 10. Audit/changelog? PARTIAL — triggers writebirth_registry("twice", S9); no registrar-emitted changelog. 11. Rollback? Manual archive/delete via Directus (S6); DB txn rollback-able (S9). 12. Idempotency? PARTIAL — skip-if-file_path-exists only (S6). 13. Concurrency? SOURCE_NOT_READ — no lock/lease for register. 14. Postcondition verifier? PARTIAL/external — reconciler viewsv_dot_fs_reconciliation(S7), not in-registrar. 15. Durable failure audit? NO — creds-absent simply blocks (S6). 16. Hardenable to single-artifact? PARTIAL — yes, with bounded hardening. 17. Missing capability? single-artifact targeting; admitted-artifact binding; deployed-artifact hash (dot_toolshas none — L3); non-admin scoped executor; durable failure audit; concurrency guard; in-band law/config wiring; built-in verifier; a governed registration APR action code (none exists — L1).
6.3 Capability matrix (20 capabilities)
Meets: YES / NO / PARTIAL / UNKNOWN. Verdict: READY_AS_CRITERIA / HARDENABLE_REUSE_CANDIDATE / NOT_SUFFICIENT / SOURCE_NOT_READ / DEFER.
| Capability | Existing behavior (evidence) | Meets? | Hardening needed | Verdict |
|---|---|---|---|---|
| Single-artifact targeting | "registers all currently-untracked bin/dot-*" (S6) |
NO | enforced --only <code> single target |
HARDENABLE_REUSE_CANDIDATE |
| Admitted-artifact binding | derives from basename; no admission gate (S6) | NO | require prior Macro-9B1 admission record bound | NOT_SUFFICIENT |
| Deployed-artifact identity (hash) | no hash/baseline column in dot_tools (L3; S7) |
NO | hash carrier (extra_metadata jsonb or governed col via DOT) + verify-on-register |
NOT_SUFFICIENT |
| Exact source selection | scans dir; skip-if-file_path-exists (S6) |
PARTIAL | single-path arg | HARDENABLE_REUSE_CANDIDATE |
| Credential boundary | Directus admin creds (S6) | NO | scoped non-admin token | NOT_SUFFICIENT |
| Non-admin / scoped executor | none; writes held by directus + workflow_admin SUPER (S6/S7) |
NO | dedicated minimal-priv registrar role | NOT_SUFFICIENT |
| Metadata correctness | heuristic tier=B/domain=general/paired=DOT-HEALTH-DOT (S6) | PARTIAL | require explicit validated metadata | HARDENABLE_REUSE_CANDIDATE |
| Paired-DOT cardinality | default paired_dot='DOT-HEALTH-DOT' heuristic (S6) |
PARTIAL | enforce real pair = 1 primary + 4 guards (S10) | HARDENABLE_REUSE_CANDIDATE |
| Law mapping | optional manual law_dot_enforcement post-hoc (S6; L2) |
NO | in-band + required in Phase 1 | HARDENABLE_REUSE_CANDIDATE |
| Config closed gate | no dot_config write by registrar; gates exist+shut (L6) |
UNKNOWN→reusable gate | write a closed row in Phase 1; never open | HARDENABLE_REUSE_CANDIDATE |
| agent-api binding exclusion/defer | registrar does not bind; 2 unrelated rows (L2) | n/a | keep deferred to Phase 3 | DEFER |
| Audit success | triggers write birth_registry (S9) |
PARTIAL | explicit success audit row | HARDENABLE_REUSE_CANDIDATE |
| Durable failure audit | none; creds-absent = blocks (S6) | NO | reuse event_outbox/iu_route_attempt outside txn (L7) |
HARDENABLE_REUSE_CANDIDATE |
| Idempotency | skip-if-file_path-exists (S6) |
PARTIAL | unique key on code; true upsert/no-dup |
HARDENABLE_REUSE_CANDIDATE |
| Concurrency | none found | UNKNOWN | advisory lock / unique-constraint fail-closed | SOURCE_NOT_READ |
| Postcondition verifier | external reconciler views (S7) | PARTIAL | paired verifier DOT (reuse register+audit pattern, L5) | HARDENABLE_REUSE_CANDIDATE |
| Rollback / compensation | manual archive/delete (S6); txn rollback (S9) | PARTIAL | built-in compensate; ID-conservation | HARDENABLE_REUSE_CANDIDATE |
| Manual-fallback elimination | doc recommends Directus-UI manual single-register (S6) | NO | remove manual lane; DOT-only | NOT_SUFFICIENT |
| Directus REST boundary | "via the Directus REST API (app layer)" (S6) | YES | keep; psql/manual forbidden | READY_AS_CRITERIA |
| Catalog-sync drift handling | reconciler views; hash-drift "not yet" (S7); catalog-sync separate (L5) | PARTIAL | add hash-drift class; resolve dual-writer | HARDENABLE_REUSE_CANDIDATE |
6.4 Overall reuse verdict
REUSE_REGISTRAR_HARDENABLE_BUT_NOT_READY. A real governed registrar exists with reusable scaffolding — the REST/app-layer boundary (the one READY_AS_CRITERIA capability), the 13 birth/validation triggers, the _dot_origin provenance check, the read-only reconciler for drift, and (decisively) the established register+verify paired-DOT pattern. But as-is it mass-registers all untracked files, requires Directus admin credentials, derives metadata heuristically, has no deployed-artifact hash, no in-band law/config wiring, no durable failure audit, and an unproven idempotency/concurrency story — and there is no governed registration APR action code to bind it to (L1). These are additive hardenings on an existing path, not a ground-up build. Reuse-first is therefore satisfied by hardening, and a new registrar/registry is not justified.
6.5 Key risks for reuse
- Mass-registration blast radius — registers ALL untracked
bin/dot-*; RP-03 itself notes unrelated files were swept in. A single-artifact governed path must invert this default. - Admin-credential requirement — registrar = Directus admin; reconciler/rehearsal =
workflow_adminSUPER. No least-privilege executor → the central blocker (interface C). - No deployed-artifact hash / weak idempotency —
dot_toolshas no baseline hash (L3); skip-if-exists won't detect or repair drift; hash-drift detection is "not yet." - Register side-effects on COMMIT (live, L4): 13 triggers incl.
trg_before_birth_gate_dot_tools,trg_birth_dot_tools/birth_trigger_dot_tools(writebirth_registry),trg_validate_dot_origin_dot_tools,trg_normalize_dot_filepath,trg_auto_code_dot_tools,trg_label_assign_dot_tools,trg_count_dot_tools/trg_refresh_dot_count,trg_refresh_orphan_dot, andtrg_context_pack_dot_registerwhichpg_notifys on COMMIT forstatus='active'ANDtier IN ('A','B','C')(configcontext_pack_dot_register_watch_tiers=["A","B","C"], L6). Since the registrar defaultsstatus='active'/tier='B', every real registration emits a context-pack NOTIFY plus ≥1birth_registrywrite. A governed single-artifact path must insert in a non-active status first or explicitly account for these effects. - Dual-writer ambiguity —
dot-dot-register(register) anddot-catalog-sync(sync) both writedot_tools; their interaction must be resolved before reuse to avoid a drift/dual-writer hazard. - No governed APR action code — none of the 14
apr_action_typesregisters a DOT (L1); reuse cannot be bound to a governed quorum without first defining/implementing one (a Đ32/Đ35 design step, not a new registry).
7. CORRECTED PHASE-SEPARATED REGISTRATION MODEL
Five fail-closed phases. The registration transaction is Phase 1 only. Phases 0/2/3/4 are not inside it. This is the criteria set RS3+ must satisfy; nothing here is implemented.
Phase 0 — Governance prerequisites (OUTSIDE the transaction)
- Inputs: (a) valid KB admission packet (Macro-9B1; gate
HOLD_ADMISSION_MISSING_OR_INVALIDmust pass); (b) deployed-artifact identity proven — executable path + content hash + origin bound to the admitted artifact (interface F); (c) Owner grant already valid — agovernance_object_ownershiprow created by a Đ32 quorum-approvedassign_governance_owner(live: 0 rows, handlerunimplemented— L1/L2); (d) a registration action type whose handler is governed + implemented (live: none exists — L1); (e) registration APR already quorum-approved with the NULL-mapping defect closed (C3); (f) isolated minimal-privilege executor available (notdirectus/workflow_admin); (g) trusted production-untouched snapshot observer available (not caller-supplied — N07). - Writes / no-writes: each prerequisite is its own governed write with its own lifecycle and rollback. None is part of, or rolled back by, the registration transaction.
- Authority: Owner + Đ32 quorum.
- Proof: every prerequisite proven independently before registration starts; authorization is replay/freshness-bound (interface A).
- Failure behavior: any missing prerequisite ⇒ registration must not start (fail-closed at the gate). Nothing written ⇒ nothing to roll back.
- Forbidden shortcut: creating the Owner grant or APR approval inside the registration transaction (Codex R1); treating KB admission as runtime registration; treating engineering/Codex PASS as authority.
Phase 1 — Closed registration transaction (gate stays SHUT)
- Inputs: all Phase-0 prerequisites proven.
- Writes (atomic):
dot_toolsINSERT of the exact intended row(s);law_dot_enforcementpaired mapping; create or verify a CLOSEDdot_configrow (never open it); bind immutable package/deployment hashes (needs a hash carrier — see interface F); write success audit in-transaction; enforce idempotency (unique key oncode/file_path) and concurrency (advisory lock or unique-constraint fail-closed). - No-writes: no runtime gate flip; no
dot_agent_api_contractbinding; no Owner grant; no APR approval. - Authority: the scoped executor acting under the pre-approved APR.
- Proof: in-transaction postconditions — the contract-derived set of rows is present (1 primary + 4 guard components, not "exactly one"); the
dot_configrow exists and is closed; the mapping is present. Commit only if all pass. - Failure behavior: pre-commit failure ⇒ automatic full rollback (entry = exit;
dot_tools/law_dot_enforcement/dot_configat prior counts). Trigger side-effects roll back with the txn;pg_notifyonly fires on COMMIT so a rolled-back attempt emits none. - Forbidden shortcut: opening a gate (Codex R2); emitting the durable failure audit from this txn (it would roll back — Codex R3); assuming "exactly one" registry row (Codex pair-cardinality).
Phase 2 — Post-commit independent verification
- Inputs: committed registration.
- Writes: durable success evidence may be appended to an existing ledger (
registry_changelog/governance_audit_log— L7). - Authority: a paired read-only verifier DOT (reusing the register+verify pattern, e.g. the
dot-apr-types-register-auditanalog — L5). - Proof: the verifier re-reads
dot_tools/law_dot_enforcement/dot_configand asserts the intended end-state, fail-closed; a trusted observer captures the protected surface after and compares to before (no production mutation; provenance-bound, not caller-supplied — N07). - Failure behavior: verification FAIL ⇒ Phase 4 compensation (rollback is no longer available post-commit).
- Forbidden shortcut: the registrar verifying itself; a caller-supplied snapshot.
Phase 3 — Separate activation (NOT implied by registration)
- Inputs: verified registration + an explicit, separate Owner decision.
- Writes: optional
dot_agent_api_contractbinding after the channel decision (R2-D2 undecided); explicit Owner-gated runtime gate opening (flip adot_configgate row — e.g.process_dot_runtime.real_run_enabled, currentlyfalse— L6). - Authority: Owner only; activation is a distinct decision.
- Proof: gate opened only by Owner, explicitly, after Phase-2 verification.
- Failure behavior: default-closed; absent an Owner decision the DOT is registered-but-inert.
- Forbidden shortcut: any activation implied by registration (Codex R2); flipping the gate inside Phase 1.
Phase 4 — Failure and compensation
- Inputs: a failure (pre-commit or post-commit).
- Writes: durable failed-attempt audit recorded OUTSIDE the rolled-back transaction — reuse
event_outbox(transactional outbox) oriu_route_attempt(attempt-ledger) orgovernance_audit_log, written by a separate transaction / post-rollback writer (L7). For post-commit reversal: governed disable/archive (status='archived'via the governed path) or a compensating action. - Authority: the same governance lane.
- Proof: the failure audit exists independently of the registration txn outcome (Codex R3); compensation conserves identity — the
dot_tools.id/codeis archived, never deleted or reused (Codex compensation/ID-conservation). - Failure behavior: this is the failure path; it must itself be fail-closed (no silent swallow).
- Forbidden shortcut: emitting the durable audit from the rolled-back txn; casual delete or identity reuse.
8. CORRECTED DOT-REGISTRATION TRANSACTION MAP
Re-maps RS2's 14 steps (0–13) into the five phases; bold = the correction vs RS2. "In txn?" = inside the Phase-1 atomic unit.
| Step | Phase | Surface | Write? | Prerequisite? | In txn? | Authority | Proof | Rollback / compensation | Status |
|---|---|---|---|---|---|---|---|---|---|
| P0-0 | 0 | Admission packet (KB) | No | Yes | No | Macro-9B1 anti-orphan | admission valid + bound | n/a (KB) | READY_AS_CRITERIA |
| P0-DAI | 0 | Deployed-artifact identity (path+hash+origin) | No (resolve) | Yes | No | deployed-artifact resolver (F) | hash binds KB↔executable; drift-detect | n/a | HOLD (no hash carrier; L3) |
| P0-1 | 0 | Owner → governance_object_ownership |
Yes | Yes | No | Đ32 assign_governance_owner |
owner row via quorum | own lifecycle; not registration rollback | HOLD_OWNER (0 rows; handler unimplemented — L1/L2) |
| P0-2 | 0 | Registration APR / quorum | Yes | Yes | No | Đ32 quorum; non-NULL code | implemented action code + quorum + reject-block | own lifecycle; not registration rollback | HOLD_PATH (no register action code — L1) |
| P1-3 | 1 | dot_tools INSERT |
Yes | No | Yes | Đ35 governed path | contract-derived rows present (not "one") | delete/disable in-txn | HOLD_PATH |
| P1-4 | 1 | law_dot_enforcement mapping |
Yes | No | Yes | Đ35 paired-DOT | mapping in same txn; verifier exists | removed on rollback | HOLD_PATH |
| P1-5a | 1 | dot_config row created CLOSED |
Yes | No | Yes | governed | row exists AND value=closed | re-removed on rollback | CLOSED_AS_CRITERIA |
| P1-7s | 1 | Success audit (in-txn) | Yes | No | Yes | Đ35/Đ32 audit | success row commits with txn | discarded on rollback (correct) | CLOSED_AS_CRITERIA |
| P1-IDEM/CONC | 1 | Idempotency + concurrency guard | n/a | No | Yes | unique key / advisory lock | retry+parallel ⇒ no dup/inconsistency | fail-closed second writer | NEW — CLOSED_AS_CRITERIA |
| P2-8 | 2 | Postcondition verifier (read-only) | No | No | No | paired verifier DOT | re-reads + asserts end-state | n/a | HOLD_PATH |
| P2-9 | 2 | Production-untouched snapshot (after) | No | No | No | trusted observer | before/after, provenance-bound | n/a | HOLD_SNAPSHOT (N07) |
| P3-5b | 3 | dot_config gate OPENED |
Yes (flip) | No | No (separate) | Owner-gated activation | opened only post-verify, by Owner | re-closed by Owner | MOVED OUT of txn (Codex R2) |
| P3-6 | 3 | dot_agent_api_contract binding |
Yes | No | No | channel decision (R2-D2) | only after registration + channel | removed on unbind | DEFER |
| P4-A | 4 | Durable failure audit (outside txn) | Yes | No | No | governed; reuse event_outbox/iu_route_attempt (L7) |
survives rollback; actor/time/run_id | n/a (it is the evidence) | NEW — CLOSED_AS_CRITERIA (Codex R3) |
| P4-C | 4 | Post-commit reversal (disable/archive) | Yes | No | No | governed compensation | ID conserved; archive not delete | compensating action logged | NEW — CLOSED_AS_CRITERIA |
| P1-11 | 1 | Transaction atomicity boundary | n/a | No | Yes | governed atomic txn | steps P1-* succeed-all-or-rollback-all | the boundary IS the rollback | HOLD_ROLLBACK |
| P0-10 | 0 | Isolated executor identity | n/a | Yes | No | minimal-priv role | scoped role; generic create blocked | role grant reversible | HOLD_EXECUTOR |
| P0/3-12/13 | 0/3 | Codex review → one Owner decision | No | Yes | No | independent review → Owner | re-derived proofs; one consolidated decision | n/a | HOLD_OWNER |
Boundary statement (corrected): the atomic unit is P1-3, P1-4, P1-5a, P1-7s, P1-IDEM/CONC only. Owner (P0-1) and APR (P0-2) are durable prerequisites, not transaction members. Gate-open (P3-5b) and agent-api binding (P3-6) are post-registration activation. The durable failure audit (P4-A) is written outside the rolled-back transaction. No atomic registration transaction, no scoped executor, no Owner-of-record, and no implemented registration action code exist today — registration stays HOLD on ≥4 independently-sufficient blockers.
9. REVISED PROOF-OBLIGATION MATRIX
KEPT = present in RS2's 19 · NEW = added per Codex §8 / the macro. Each is an acceptance criterion for a future authorized macro, with a negative test (fail-closed) and the macro that owns it.
| # | Proof obligation | Phase | Why needed | Acceptance criteria | Negative test | Failure state | Future macro |
|---|---|---|---|---|---|---|---|
| P-OWN (KEPT 1) | Owner authority | 0 | binds the write to a real Owner | governance_object_ownership row via quorum-approved assign_governance_owner |
grant for another object/op rejects | HOLD_OWNER | RS3-BUNDLE |
| P-QUORUM (KEPT 2/3/4) | Approval quorum + no self-approval + reject-block | 0 | Đ32 lane integrity | quorum met; self-approve blocked; any reject blocks; NULL-map closed (C3) | NULL code/risk must not pass | HOLD_PATH | RS3-BUNDLE / Đ32 |
| P-RREUSE (NEW) | Existing registrar reuse | 0 | reuse-first before any new tool | dot-dot-register narrowed to single-artifact, scoped-cred, in-band law/config; or proven insufficient with evidence |
a new registry without this proof is rejected | HOLD | RS3B registrar-hardening |
| P-DAI (NEW) | Deployed-artifact identity | 0 | a KB artifact cannot be a runnable DOT without it | executable path + hash + origin bound to admitted artifact; drift-detect | hash mismatch / missing carrier rejects | HOLD (no hash col — L3) | RS3B / interface F |
| P-PKGID (KEPT 5) | DOT package identity | 0 | the package is what was reviewed | package digest matches admission | altered package rejects | HOLD | RS3B |
| P-ADMBIND (KEPT 6) | Admission-packet binding | 0 | anti-orphan | registration refuses without valid admission | missing/invalid admission ⇒ HOLD_ADMISSION… |
gate | (exists) |
| P-DOTPOST (KEPT 7) | dot_tools postcondition |
1/2 | row(s) correct | contract-derived rows present + correct metadata | extra/missing/typo'd row fails | HOLD_PATH | RS3B |
| P-LAWPOST (KEPT 8) | law_dot_enforcement postcondition |
1/2 | mapping correct | mapping rows present, paired | unmapped/mis-mapped fails | HOLD_PATH | RS3B |
| P-CFG (KEPT 9) | dot_config gate proof |
1 | gate created closed | row exists AND closed at commit | created-open or opened-in-txn fails | HOLD | RS3B |
| P-CLOSED (NEW) | Closed-at-registration | 1/3 | registration cannot open a gate | no execute/real_run gate transitions to open during Phase 1 | any in-txn gate-open ⇒ reject | HOLD | RS3B |
| P-AGENTAPI (KEPT 10) | agent-api binding | 3 | only after channel decision | binding only post-registration + channel | bind during registration fails | DEFER | post-R2-D2 |
| P-SNAP (KEPT 11) | Production-untouched snapshot | 0/2 | trusted before/after | trusted observer, provenance-bound (N07) | caller-supplied verdict rejects | HOLD_SNAPSHOT | RS3-BUNDLE |
| P-MANUAL (KEPT 12) | Manual-path-blocked | 0/1 | DOT-only | no psql / docker-exec / Directus-generic lane | manual write path open ⇒ fail | HOLD | RS3B / interface C |
| P-EXEC (KEPT 13) | Isolated executor | 0 | least privilege | scoped non-super, non-BYPASSRLS role; generic create blocked | directus/workflow_admin as executor fails |
HOLD_EXECUTOR | RS3-BUNDLE / C |
| P-GUC (KEPT 14) | Transient-GUC non-bypass | 1 | server-enforced gating | gating independent of caller-settable GUC (app.canonical_writer) |
caller sets marker ⇒ still blocked | UNPROVABLE-from-persisted (interface D) | RS3-BUNDLE |
| P-ROLL (KEPT 15) | Rollback | 1/4 | atomicity | pre-commit fail ⇒ entry=exit | partial residue ⇒ fail | HOLD_ROLLBACK | RS3B |
| P-AUDIT (KEPT 16) | Audit / changelog | 1/2 | provenance | success audit recorded | no audit ⇒ fail | HOLD | RS3B |
| P-FAILAUDIT (NEW) | Durable failure audit | 4 | survives rollback | failure recorded outside the rolled-back txn (reuse event_outbox/iu_route_attempt — L7) |
audit lost on rollback ⇒ fail | HOLD | RS3B |
| P-IDEM (NEW) | Idempotency | 1 | retries safe | unique key on code/file_path; retry ⇒ no duplicate |
second insert duplicates ⇒ fail | HOLD | RS3B |
| P-CONC (NEW) | Concurrency | 1 | parallel attempts safe | advisory lock / unique-constraint; 2 concurrent ⇒ one wins fail-closed | both commit ⇒ fail | HOLD | RS3B |
| P-PAIR (NEW) | Pair cardinality | 1/2 | not "exactly one" | expected count/identity derived from paired-DOT contract (1+4) | wrong cardinality ⇒ fail | HOLD | RS3B |
| P-COMP (NEW) | Compensation / ID-conservation | 4 | safe reversal | disable/archive; identity never deleted/reused | delete or id-reuse ⇒ fail | HOLD | RS3B |
| P-INJECT (NEW) | Failure injection | 1/4 | each step independently safe | each mutating step forced to fail; entry/exit compared | uncompared residue ⇒ fail | HOLD | RS3B |
| P-REPLAY (NEW) | Authorization replay / freshness | 0 | non-replayable authority | Owner/APR evidence target-, op-, artifact-, scope-, time-bound | replayed/older-scope token accepted ⇒ fail | HOLD | RS3-BUNDLE / interface A |
| P-DEL (KEPT 17) | Delete-fast boundary (Macro-9A) | n/a | teardown is separate | teardown not part of registration | teardown bundled ⇒ fail | DEFER | Macro-9A (gated) |
| P-CODEX (KEPT 18) | Codex review | meta | independent re-derivation | Codex re-derives authority/snapshot/txn | unreviewed ⇒ hold | gate | (this cycle) |
| P-OWNDEC (KEPT 19) | Owner decision | meta | one consolidated decision | single Owner decision after Codex | micro-approval chain ⇒ reject | HOLD_OWNER | RS3-BUNDLE |
Registrar-specific obligations (macro §1.3 additions, folded above and here): single-artifact targeting (P-RREUSE), registrar credential-boundary (P-EXEC), registrar metadata correctness (P-DOTPOST), catalog-sync drift (P-RREUSE risk #5/§6.5), Directus-hook boundary (P-MANUAL + the live trg_context_pack_dot_register/birth-trigger side-effects, §6.5/L4).
10. REVISED TRUST INTERFACE SET
Criteria only — NOT implementation. RS2 had five (A–E); PATCH1 adds F (Codex's missing interface) and enhances A/B/C/E per Codex §9.
- A. Owner-reference resolver (enhanced). Resolves an
owner_authorization_refto a verified Owner-of-record + governing grant, or a structured reject. Must be bound to: target object, operation =register_dot, scope, artifact hash, expiry/revocation, authority chain, and replay prevention. Trusted source =governance_object_ownership(live: rich schema —object_ref,scope,owner_kind,owner_gov_code,approval_ref,audit_ref,rollback_ref,effective_from/to,lifecycle_status,supersedes_id— capable of expressing all of this; 0 rows today, L2/L3), populated only via a Đ32 quorum-approvedassign_governance_owner(handlerunimplemented— L1). A valid grant for another object or operation must reject. Closes N07's owner leg. - B. Trusted production-untouched snapshot provider (enhanced). Before/after capture of a bounded protected-surface manifest (
publicprod,inspect_*/birth_registry/canonical, any non-r2_b2_wb_*schema) by a trusted read-only observer (not caller/DOT), as content hashes bound to actor+time+run_id+observer, with a freshness window, completeness proof, monotonic snapshot identity, and same-observer continuity + trust-root verification. Avoid an undefined full-DB content hash. Caller-supplied equality proves equality, not provenance. Closes N07's snapshot leg. - C. Isolated executor / manual-path boundary (enhanced). A dedicated minimal-privilege DOT-executor role scoped to
r2_b2_wb_*+ the governed registration writes only; non-superuser, non-BYPASSRLS, non-owner; controlledSET ROLE; fixedsearch_path; SECURITY DEFINER review; no caller-settable authorization marker. Genericdirectus(schema-create, GAP 2) andworkflow_adminSUPERUSER (GAP 4) forbidden as executor; manual SQL / psql /docker exec psql/ Directus-generic forbidden. Fail-closed absent the scoped role + generic-create block. - D. Transient GUC handling. Writes are gated by session GUC
iu_create.gateway.marker_key = app.canonical_writer(livemode=enforced,direct_insert_policy=block_after_guard— L6). Transient session GUCs are not observable via read-onlyquery_pg, so absence of a transient bypass cannot be proven from persisted state. Future proof must show server-enforced gating independent of any caller-settable GUC (or that an untrusted caller cannot set the marker). - E. Validator closure envelope (enhanced). Macro-9B validator rev2 closed the 7 Codex HOLD findings (64/64 PASS); these stay OPEN: N07 (validator must consume a signed/prevalidated authority-and-snapshot envelope from A + B — issuer, audience, target, artifact hash, run_id, expiry, replay protection — not be the source of owner/snapshot truth, and not perform runtime lookups), N12 (exact
r2_b2_wb_<run_id>token-boundary match, not substring), N16 (encoded identifier length ≤ 63 bytes), N22 (isinstance/dict guard ⇒ deterministic structured reject, never an unhandled raise). - F. Deployed-artifact resolver (NEW — Codex missing interface). Binds KB admission to the governed executable path + content hash + origin, with drift detection, so a KB artifact is only registrable as a runnable DOT once its deployed identity is proven. Live gap:
dot_toolshas no hash/baseline column (L3); a carrier must be designed (reuseextra_metadatajsonb or add a governed column via a DOT — never by hand). Feeds the artifact-hash field consumed by A and E.
11. 142 S142B SOURCE AND DISPOSITION STATUS
Classification (corrected, per Codex C1): UNVERIFIED_S142B_BATCH_NEEDS_SOURCE_AND_DISPOSITION. RS2's label SANCTIONED_BATCH_NEEDS_RATIFICATION is withdrawn — "sanctioned" is not proven.
Source hunt result: S142B_SOURCE_NOT_READ. The 142 orchestrator-s142b rows are referenced in exactly one place in the bypass/back-audit corpus — …/authority-p1-hardening-backaudit-ratification-scanner-apply-control-2026-06-06/04-backaudit-ratification-packet.md (S13): "142 orphan-scanner applies carry reviewed_by=orchestrator-s142b (a sanctioned S142b batch) … out of the bypass-ratification scope, but … surfaced in v_scanner_auto_apply_inventory and recommended for a separate 'confirm-sanctioned' review." Decisive points: (a) "a sanctioned S142b batch" is an assertion, not a citation — no approval-of-record, APR id, run-id, or council sign-off is named; (b) the 26-row ratified back-audit ledger (v_authority_back_audit_ledger) covers only system_auto_approve + auto-apply-function and explicitly excludes orchestrator-s142b; (c) the pointer is a runtime view, not a sanctioning source. Eleven targeted KB searches + a full directory listing surfaced no primary batch-authorization document.
Disposition (criteria, not action): locate the primary batch-authorization source; then ratify or remediate via the governed path; do not merge with the 18; do not call the batch sanctioned until the source is read. Until then the population is unverified, not bypass-lineage.
18 rows (auto-apply-function) — unchanged from RS2/Codex: CONTAINED_WITH_RESIDUE, actual bypass lineage, effects ratify-able, any_quarantine=false, governed retroactive ratification required (needs an Owner row); do not bulk-delete/relabel.
RISK-BYPASS carry (Codex C2/C4, retained): overall RISK_BYPASS_SOURCE_CONFLICT_UNRESOLVED. Mechanisms = RISK_BYPASS_MECHANISMS_PACKET_SUPPORTED_CONTAINED_WITH_RESIDUE (PATCH1 did not re-read function bodies this cycle). quorum_passed = FAIL_CLOSED_CONTROL_PACKET_SUPPORTED (not "CLEARED"). Residue OPEN: approval_requests.action DEFAULT still 'add' (live column present — L3); fn_apr_quorum_check NULL-mapping pass-through (C3, now a Phase-0 prerequisite gate); 160 historical non-quorum applied rows (142 + 18); Đ35 production-readiness not re-verified; Đ32/Đ35 notes + prior Codex still carry the stale "live bypass / 160 unvoted applies" headline. Containment is not clearance; registration HOLD is independent of all of it.
12. REUSE-FIRST DECISION
REUSE_REGISTRAR_HARDENABLE_BUT_NOT_READY — for dot-dot-register (the only governed DOT registrar). It is a hardenable reuse candidate, not ready as-is (§6.4). A new registrar/registry is not justified.
dot-catalog-sync (DOT-015): NOT_SUFFICIENT as a single-artifact registrar — it is a separate on-deploy filesystem→catalog sync/drift tool (domain sync, no operation/paired_dot — L5), not an admitted-single-artifact registrar; its only PATCH1 role is the dual-writer hazard to resolve (§6.5).
Reuse template (decisive): the existing register + paired verifier DOTs — dot-apr-types-register/-audit and DOT-TAC-COLLECTION-REGISTER/-VERIFY (L5) — are the proven pattern a single-artifact governed registrar should be hardened into; plus the existing closed gates (dot_config, L6) and durable-audit surfaces (event_outbox/iu_route_attempt/registry_changelog/governance_audit_log, L7) cover the gate-closed and durable-failure-audit obligations by reuse. This satisfies quick-rules R18/R19 (no new registry if an existing book suffices: dot_tools already is the DOT registry) and the One-Roof ceiling (R20/R21).
13. DECISION ON DOT_GOVERNANCE_DOT_ADMISSION
DEFER (primary) / NEED_ONLY_IF_REUSE_FAILS (conditional). PATCH1 does not author or design it.
Reuse-first reinforces the deferral: dot_tools already is the DOT registry; the register+verify paired-DOT pattern already exists; admission already lives on the existing books (Macro-9B1 + birth_registry + governance_object_ownership). A separate DOT-admission registry would be a mega-island that the anti-bloat (de-bai §VI.7), no-new-registry (quick-rules R19), and One-Roof "no local governance island" (R20; LAW_READING_INDEX §4.1) rules default to rejecting. It is admissible only if the existing registrar + existing registry/APR primitives are proven insufficient under §9's obligations — and only then via the addendum §9 three-condition gate at governance Mức 3 with explicit Owner authorization. That proof does not exist; therefore DEFER.
14. NEXT MACRO RECOMMENDATION
One macro: RS3-BUNDLE — Owner Resolver + Trusted Snapshot Provider + Validator N07/N12/N16/N22 Closure Criteria + Residue Disposition Criteria. Read-only / KB-design only; 60–90 minutes; acceptance-criteria only.
Why this one (single deciding blocker): the upstream, single-sufficient blocker is Owner-of-record — governance_object_ownership = 0 and assign_governance_owner handler unimplemented (L1/L2). Until a trusted Owner resolver (interface A) and trusted snapshot provider (interface B, closing N07) exist as criteria, every downstream step (registration APR binding, registrar-hardening, 18-row ratification, residue closure) is moot. This matches Codex §11's stated post-PATCH1 bundle and RS2's own §14 sequence.
Explicitly deferred to the macro AFTER RS3-BUNDLE: RS3B-REGISTRAR-HARDENING-DESIGN — narrow dot-dot-register into a single-artifact governed registrar (P-RREUSE/P-DAI/P-IDEM/P-CONC/P-PAIR/P-FAILAUDIT/P-COMP). It is sequenced after the bundle because the registrar must consume the resolver (A), snapshot (B), executor (C), and deployed-artifact-resolver (F) interfaces the bundle defines. The registrar-reuse work is parked, not dropped.
Sequence: Codex reviews PATCH1 → one consolidated Owner decision → RS3-BUNDLE → RS3B registrar-hardening design → (RS2B residue/Đ35-health ‖ RS-Validator N07/N12/N16/N22) → RS4 → RS5 → REGISTRATION PACKAGE → Macro-9A (gated).
15. MUST-NOT-DO CONFIRMATION
Confirmed this macro did none of the following (read-only KB-design only):
- No runtime mutation. 2. No DDL/DML. 3. No manual SQL. 4. No psql. 5. No
docker exec psql. 6. No Directus generic create/update/delete. 7. No register/wire/run DOT. 8. No schema creation. 9. Did not open Macro-9A. 10. Did not open Macro-9C. 11. Did not build the B2 producer. 12. Did not author/designDOT_GOVERNANCE_DOT_ADMISSION. 13. No new registry/table/collection. 14. No validator patch. 15. No Đ32/Đ35 patch. 16. No gate flip. 17. No APR created. 18. No APR approved. 19. No Owner-authority claim. 20. Did not use/laws/to overridelaws-new/newlaws. 21. Did not turn PATCH1 into RS3/RS4/RS5 implementation. 22. No whole-system survey. 23. Did not clear RISK-BYPASS. 24. Did not call the 142 S142b "sanctioned." 25. Did not treat live-containment PASS as authority PASS. 26. Did not treat KB admission as runtime registration. 27. Did not open activation together with registration.
The only write is this one KB report. RS2 and all Codex reports are untouched.
16. STOP STATE
READY_FOR_CODEX_REVIEW.
REGISTRATION_HOLD retained. Caveat: S142B_SOURCE_NOT_READ (contained — classification complete; ratification awaits the primary source). Default HOLD; engineering PASS ≠ authority PASS; KB admission ≠ runtime registration.
17. SELF-CHECK
17.1 Macro pre-report checklist (§7 of the brief)
| # | Question | Answer |
|---|---|---|
| 1 | Read Codex RS2 HOLD? | YES — S1, full |
| 2 | Read RS2? | YES — S2, full digest |
| 3 | Found dot-dot-register? |
YES — S6 + live L5 |
| 4 | Found dot-catalog-sync? |
YES — separate, DOT-015, live L5 |
| 5 | Assessed registrar by capability matrix? | YES — §6.3 (20 capabilities) |
| 6 | Separated Owner/APR prerequisites from the transaction? | YES — §7 Phase 0; §8 P0-1/P0-2 |
| 7 | Separated gate activation from the transaction? | YES — §7 Phase 3; §8 P3-5b |
| 8 | Durable failure audit outside the rolled-back txn? | YES — §7 Phase 4; §8 P4-A; reuse L7 |
| 9 | Added deployed-artifact resolver? | YES — interface F (§10) |
| 10 | Added idempotency/concurrency? | YES — P-IDEM/P-CONC (§9) |
| 11 | Added pair cardinality? | YES — P-PAIR (§9) |
| 12 | Added replay/freshness? | YES — P-REPLAY (§9); interface A |
| 13 | Fixed 142 S142b classification? | YES — §11, UNVERIFIED… |
| 14 | Kept DOT_GOVERNANCE_DOT_ADMISSION DEFER? |
YES — §13 |
| 15 | Chose one large next macro? | YES — RS3-BUNDLE (§14) |
| 16 | Kept no-mega-system? | YES — reuse-first; no new registry |
| 17 | Kept DOT-only? | YES — manual/psql/Directus-generic forbidden |
| 18 | Any mutation? | NO — read-only query_pg + this one KB report |
17.2 Verdict self-check
| Check | Result |
|---|---|
| 11 Codex HOLD items addressed | PASS — §5, all CLOSED_AS_CRITERIA / SOURCE_NOT_READ |
| Registrar source read (not assumed) | PASS — KB + live; reuse verdict evidenced |
| Transaction boundary corrected | PASS — 5-phase model; not HOLD_TRANSACTION_BOUNDARY_INVALID |
| 18/142 kept separate | PASS — §11 |
| 142 not called sanctioned | PASS — UNVERIFIED…, S142B_SOURCE_NOT_READ |
| Containment distinguished from clearance | PASS — packet-level; not CLEARED |
| Registration HOLD retained | PASS |
| Reuse-first / anti-mega / LEGO / DOT-only held | PASS — §6/§12/§13 |
| RS2 + Codex reports not overwritten | PASS — new path only |
| Single next macro selected | PASS — RS3-BUNDLE |
| Fresh live reads labeled vs RS2/Codex/secondary | PASS — §4 provenance L/R2/CX/2nd |
17.3 Three declarations
- Permanent / root-cause: the patch corrects the registration control boundary (phase separation) and the reuse decision (harden the existing registrar), not individual rows. The contradictions are structural and now resolved at the criteria level.
- Cannot be mistaken: prerequisites, registration, verification, activation, and compensation are five separate fail-closed phases; KB admission / engineering PASS / Codex PASS cannot substitute for Owner authority; the durable failure audit lives outside the rolled-back transaction.
- 100% automatic: not claimed. Registration stays unproven until the governed path has machine-enforced Owner authority, deployed-artifact identity, idempotency, concurrency, trusted snapshots, rollback, durable failure audit, and an implemented registration action code — none of which exists today.
OR/TD/handoff update: not required — this is a read-only design patch with no operating-rule, runtime, or implementation change.
End of Macro-RS2-PATCH1. Verdict: RS2_PATCH1_READY_FOR_CODEX_REVIEW (caveat S142B_SOURCE_NOT_READ). Stop state: READY_FOR_CODEX_REVIEW. Registration: HOLD. Next: Codex reviews PATCH1 → one Owner decision → RS3-BUNDLE.