Internal Codex-Style Self-Review — READY-TO-ASSEMBLE-LEGO1-PATCH1 — 2026-06-22

Posture: I review PATCH1 as Codex would — distrusting my own report, inspecting actual governed files and planned commands, rejecting raw DDL/DML and overclaim. I may report READY only if every P0/P1/P2 blocker is closed below. If any remains, the verdict is HOLD. Gate: REGISTRATION_HOLD · CAN_PROCEED = NO · 0 runtime mutations.

---

1. Verdict table

Finding	Actual source / section	Bad input / failure mode	Codex PASS or HOLD?	Closure proof	Remaining caveat
P0-1 raw DDL/DML vs DOT-only	base file 06 §3 raw SQL; SSOT v1.2 "DOT-only, MCP→403"; dot_config.block_after_guard	a future plan that runs CREATE TABLE/INSERT → 403 / rule violation	PASS (closed)	PATCH1 file 02: schema via dot_iu_create_collection/dot-schema-* + table_registry; data via staging gateway; dispatcher dual-trigger (plan/apply) + idempotency_root + DRY_RUN→REAL_RUN + paired verify. No raw SQL anywhere.	Authorization of the schema DOT for this collection is a Gate-B check (PF-SCHEMA-DOT), not a design gap.
P0-2 non-versioned identity	base file 04 §1 (operation_code PK); base file 08 §5	same code across versions impossible; rollback hits wrong version; silent re-meaning	PASS (closed)	PATCH1 file 03: PK (operation_code,protocol_version) + surrogate vocab_id; versioned successor; write-once semantics_frozen; constraints (successor exists/no-cycle/monotone-version/lifecycle); versioned rollback target.	Constraints enforced by schema + governed handler; handler logic validated by fixtures (T2–T10), executed at Gate B.
P1-1 value set = prep input	base files 06/12/13	execution invents the operation set; diff +N; no hashable input	PASS (closed)	PATCH1 file 04: deterministic resolver R_C1 over governed apr_action_types (+process_axis_action_vocabulary) with _dot_origin provenance; concrete 14-row hashed candidate snapshot; not invented.	Final admission set is curated by a governed Gate-B review (a governance act); the resolver's projection rule is a reviewable default.
P1-2 auth overclaim + unsafe consume	base file 09 PF5; base file 06 S8	columns ≠ enforcement; two executors pass same preflight; failure leaves writes without consume	PASS (closed)	PATCH1 file 05: exact jsonb verifier (scope+status+esign+digests+expiry+revocation+executor+action set, exactly 1 row); atomic lease (ON CONFLICT DO NOTHING RETURNING) + CAS-consume before writes; replay/concurrency excluded.	Verifier/atomic-consume proven by fixtures T11/T12 at Gate B; no live grant exists yet (PF5=0, expected).
P1-3 no atomic failure model	base file 06 §2; base file 08 §5	partial failure after schema/values/audit; :successor=NULL; non-atomic audit	PASS (closed)	PATCH1 file 06: state machine S0–S7 with idempotency_root, named partial-failure compensations, retry rules, enforced rollback invariants (successor exists/admissible/version-bound/atomic-audit/no-delete/local).	Compensation correctness validated by fixtures T13/T14/T17 at Gate B (DRY_RUN harness).
P1-4 preflight incomplete/untruthful	base file 09 PF5/PF7/PF8	PF7 unrun; PF8 wrong fence; PF5 not exact	PASS (closed)	PATCH1 file 07: PF5 = exact verifier; PF7 run live (v_dotkg_realrun_preflight = REALRUN_BLOCKED_MULTI_GATE); PF8 restated truthfully (DOT-only/403 + block_after_guard + read-only query_pg).	Real-run gates are governed-BLOCK today (expected pre-authority); must re-run live at build.
P1-5 tests not executable	base file 07	weak count>0; missing concurrency/version/partial-failure/forged-auth/serialization/audit-failure	PASS (closed)	PATCH1 file 08: T1–T20 with exact commands + deterministic assertions + output capture incl. all named missing cases.	DEFINED_NOT_EXECUTED; run in DRY_RUN/VERIFY_ONLY at Gate B (runtime-evidence tier).
P1-6 ambiguous hashing	base file 10 §3	delimiter collision; non-portable evidence	PASS (closed)	PATCH1 file 09: cser-v1 canonical JSON (sorted keys, UTF-8 NFC, explicit null, version tag) + SHA-256; full artifact binding chain.	None material; serialization stability asserted by T16.
P2-1 understated blast radius	base file 05 §3; file 06 §6	"no carrier edge"/"blast radius=0" hides operational deps	PASS (closed)	PATCH1 file 10 §1–§2: operational dependency map + truthful bounded non-zero blast-radius; narrowed claim "no proven C2 orphan".	None.
P2-2 overclaim language	base files 02/11/13/rollup	"structurally complete / inventory complete / only authority remains / blast radius zero"	PASS (closed)	PATCH1 file 10 §3: four phrases SUPERSEDED/QUALIFIED with proven-scoped replacements.	The base files still contain the old phrases; PATCH1 governs by supersession (additive). A future consolidation should patch the base text.
§3 caveat — subagents	base file 01	reliance on background agents (project rule)	PASS (addressed)	PATCH1 file 01 §1: no subagents used; all reads direct.	Base file 01's subagent mention stands historically; PATCH1 re-derived facts directly.

2. Independent bad-input probes (beyond Codex)

Probe	Expected	Result
Run any raw CREATE TABLE/INSERT in the plan	rejected by DOT-only/403/block_after_guard	no raw SQL present (file 02) ✓
Admit a value with no governed provenance	rejected (T15)	provenance bound to apr_action_types._dot_origin (file 04) ✓
Two concurrent builds	one winner	lease + CAS single-winner (file 05, T11) ✓
Promote to REAL_RUN today	blocked	v_dotkg_realrun_preflight NO_GO (file 07) ✓
Treat acceptance as authority	rejected	engineering PASS ≠ authority PASS (decision packet) ✓
Claim "only authority remains" absolutely	rejected	qualified to include Gate-B governed review (file 10 §3) ✓

3. Self-review verdict

All P0-1, P0-2, P1-1, P1-2, P1-3, P1-4, P1-5, P1-6, P2-1, P2-2 are closed at the preparation/design level, with each remaining caveat being a Gate-B governance/execution item (grant creation, config flips, owner/president, manifest curation, fixture execution) — not missing preparation. No closure depends on raw DDL/DML; no closure asserts authority. Therefore the internal review permits READY:

INTERNAL VERDICT: READY_TO_ASSEMBLE_LEGO1_PATCH1_READY_FOR_GPT_REVIEW (not forced).

Had any blocker remained open in design (e.g. no compliant DOT path, no deterministic resolver, no exact verifier, no atomic consume), this review would have returned the matching HOLD (…_HOLD_DOT_DIRECTUS_PATH_INCOMPLETE / …_C1_IDENTITY_VERSION_INCOMPLETE / …_VALUE_MANIFEST_MISSING / …_AUTH_ATOMIC_CONSUME_INCOMPLETE / …_ATOMIC_FAILURE_MODEL_INCOMPLETE / …_PREFLIGHT_TESTS_INCOMPLETE / …_EVIDENCE_SERIALIZATION_INCOMPLETE) or …_REJECT_OVERCLAIM.

4. Boundary attestation

Internal review only; no mutation. REGISTRATION_HOLD retained; CAN_PROCEED = NO; 0 runtime mutations.