dot-iu-cutter v0.1 — Governance Closure Execution Checklist

Date: 2026-05-15 Status: CLOSURE EXECUTION CHECKLIST — pending Đ37 governance action Trigger: GPT review of Governance + P0 Planning phase = PASS_WITH_NOTES + 7 User decisions confirmed Baseline: Governance Closure Package (planning) + User Decision Confirmation (closure) Scope: CHECKLIST ONLY. No code, no DDL, no migration, no PG mutation, no implementation planning.

1. Purpose

Cung cấp checklist chính thức cho Đ37 governance để đóng 5 governance gaps của dot-iu-cutter v0.1, theo thứ tự bắt buộc:

G-2 (Backlog custodian)
  ↓
G-1 (Threading roles)  ∥  G-5 (Access-Control Authority)
  ↓
G-3 (Capability-intake reviewer)
  ↓
G-4 (DOT-pair signing authority)

Mỗi gap đóng độc lập theo checklist riêng nhưng phải tôn trọng dependency order. Closure không tạo role mới ngoài Đ37, không tạo notification system song song, không invent vocabulary.

2. Hard Boundaries Honored

no_code: true
no_ddl: true
no_sql: true
no_migration: true
no_pg_mutation: true
no_qdrant_mutation: true
no_ui_build: true
no_implementation_planning: true
no_new_governance_role_outside_dieu37: true
no_parallel_notification_system: true
no_silent_vocabulary_invention: true
no_design_deliverable_modified: true
no_rev5d_modified: true
no_planning_file_modified: true
implementation_blocked: true

3. Closure Order Dependency Graph

                    [START]
                       │
                       ▼
                ┌─────────────┐
                │ G-2         │
                │ Backlog     │
                │ custodian   │
                └──────┬──────┘
                       │
              ┌────────┴────────┐
              ▼                 ▼
       ┌──────────┐      ┌─────────────┐
       │ G-1      │      │ G-5         │
       │ Threading│      │ Access-     │
       │ roles    │      │ Control     │
       └────┬─────┘      └──────┬──────┘
            │                   │
            └─────────┬─────────┘
                      ▼
              ┌──────────────┐
              │ G-3          │
              │ Capability-  │
              │ intake       │
              │ reviewer     │
              └──────┬───────┘
                     │
                     ▼
              ┌──────────────┐
              │ G-4          │
              │ DOT-pair     │
              │ signing      │
              │ authority    │
              └──────┬───────┘
                     │
                     ▼
                  [GATE]
                Implementation
                planning may begin
                (still requires
                Đ44 Family +
                Đ24 vocab +
                P0 migration design
                + Đ32 approval)

4. Universal Closure Prerequisites (apply to every gap)

Before any single gap is marked resolved:

Đ37 role assignment recorded (no parallel role created outside Đ37 SOP).
Decision Backlog Registry entry exists in D5 with full envelope (decision_id, summary, risk class, owner, related_law_or_design, kind = escalation or decision).
Closure rationale recorded per D5 §4.10 closure criteria.
Affected deliverable references cross-linked.
Health-signal hook routed (D3) if applicable.
No new notification system created (criterion 38).
No new vocabulary minted outside Đ24 (criterion 39).
Đ32 risk class confirmed; if Standard+ → Council co-sign required.

5. G-2 — Decision Backlog Custodian

Order: #1 (FIRST — foundational)

Without a backlog custodian, no other gap closure can be tracked / swept / re-surfaced. G-2 MUST close first.

Owner role proposed:

Registry custodian (Đ37 SOP role; likely existing governance-ops function).
Backup: governance-ops deputy designated by council.

Decision needed:

Confirm Registry custodian role exists in current Đ37 SOP, or formally create the SOP entry.
Name the human/Council seat occupying this role.
Confirm authority scope:
- Sweep execution (D5 §4.4 — every governance review / health report / Self-Review).
- Entry closure for low/standard risk (with co-sign for standard).
- High-risk closure routes via Đ32.
- Next_review_date re-surfacing automated by sweep.
- Markdown mirror regeneration to knowledge/dev/laws/dieu44-trien-khai/registry/.
Confirm Decision 4 scope (cutter-only v0.1) is honored.
Publish initial sweep cadence (cross-link Decision 8 / Self-Review cadence in G-3).

Acceptance criteria for closure:

Registry custodian role recorded in Đ37 SOP.
Named occupant recorded.
Authority scope ratified by Council (or equivalent Đ37 council).
First sweep scheduled.
Markdown mirror path confirmed and accessible.
D5 backlog entry for G-2 transitions status = resolved with rationale.
No parallel governance-ops role created.
No new notification system created.

Dependency:

None. G-2 is foundational.

Blocker if unresolved:

"Anti-forgetting" guarantee (D5 §4.11) cannot be enforced — Decisions silently stale.
All other governance gaps cannot be tracked to closure (no sweep owner).
next_review_date expirations are ignored — recurrent issues drop on the floor.
Markdown mirror drifts from PG SSOT → governance trust loss.
Implementation planning gate stays blocked indefinitely.

6. G-1 — Threading Roles

Order: #2 (parallel with G-5, after G-2)

Owner role proposed (mapping per gap closure plan):

Threading concern	Đ37 role
Thread owner (per thread)	Domain Owner (Đ37 SOP role; appointed per domain)
Membership reviewer	AI Council reviewer (default) → Human reviewer for risk/contested
Thread split/merge governance	Council
User-AI disagreement arbitration	Human reviewer via Đ37 escalation queue
Anomaly oversight (overbroad/too_narrow/stale)	Registry custodian (G-2) + Council

Starter domain set for Domain Owner appointments:

birth_gate
segmentation
(expand per Decision 1 allowlist evolution)

Decision needed:

Confirm Đ37 Domain Owner role exists, or formally create the SOP entry.
Appoint Domain Owner per starter domain.
Confirm AI Council reviewer authority for low-risk thread membership candidates.
Confirm Human reviewer escalation path through Đ37 queue.
Confirm Council ownership of split/merge governance.
Confirm User-AI disagreement arbitration channel (Đ37 escalation queue, no parallel).
Confirm anomaly oversight responsibility split (custodian + Council).
Ratify Decision 1 thresholds (Balanced) at policy level.

Acceptance criteria for closure:

Domain Owner role recorded in Đ37 SOP for starter domains.
AI Council reviewer authority documented in Đ37.
Human reviewer escalation path wired through Đ37 queue (no new channel).
Council ownership of split/merge confirmed.
Disagreement arbitration channel documented.
Anomaly oversight responsibility split recorded.
Decision 1 thresholds ratified into policy (per Decision 1 closure: confidence ≥ 0.75, ≥ 2 signals, allowlist).
D5 backlog entry for G-1 transitions status = resolved.
No parallel governance channels created.

Dependency:

G-2 must be closed first (so the closure itself can be tracked).

Blocker if unresolved:

Ungoverned thread creation; uncontrolled semantic graph growth.
Auto-accept may operate without policy-approved reviewer chain → Đ32 risk-gating violation.
user_ai_disagreement events have no arbitration channel → silent overrides possible.
Cross-domain threads end up orphaned without owners.
D9 implementation planning blocked.
G-3 (Capability-intake reviewer) cannot start (depends on threading roles).

7. G-5 — Audience-Scope Access-Control Authority ⚠️ HIGH RISK

Order: #2 (parallel with G-1, after G-2)

Owner role proposed:

Access-control concern	Đ37 role
Audience class definition	Access-Control Authority (Đ37 SOP role; may map to existing security/governance lead)
Filter policy approval	Access-Control Authority + Council for Standard+ risk
`wrong_audience_result` security event handling	Access-Control Authority + Đ32 full escalation (high-risk path)
Visibility/readiness/publication vocabulary	Đ24 governance (cross-law)
Response block/unblock authority	Access-Control Authority

Decision needed:

Confirm Đ37 Access-Control Authority role exists, or formally create the SOP entry.
Name the human/Council seat occupying this role.
Ratify Decision 3 (Conservative audience definitions): 4 classes (AI-Agent / Employee / Partner / Customer), default visibility internal-only, tiered scheme public / partner / employee / internal / restricted.
Ratify Decision 6 (wrong_audience_result handling): Block + Log + Escalate, no auto-rollback.
Wire Đ37 escalation queue to receive wrong_audience_result events (no parallel notification system).
Cross-law agreement with Đ24 for visibility / readiness / publication / authority vocabulary.
Publish access-control runbook (Đ32 escalation path documented).

Acceptance criteria for closure:

Access-Control Authority role recorded in Đ37 SOP.
Named occupant recorded.
Decision 3 audience classes ratified by Council.
Decision 3 tiered visibility ratified by Council + Đ24 vocab.
Decision 3 default-internal-only rule confirmed at policy level.
Decision 6 Block + Log + Escalate handling ratified.
Decision 6 "no auto-rollback" rule formally adopted (rejection of auto-recall option).
Đ37 escalation queue wired for wrong_audience_result events (no parallel channel).
Đ32 risk class for wrong_audience_result confirmed as HIGH.
Đ24 cross-law agreement for visibility / readiness / publication / authority vocab.
Access-control runbook published.
D5 backlog entry for G-5 transitions status = resolved.

Dependency:

G-2 must be closed first.
Đ24 governance must engage in parallel for vocabulary cross-law agreement.

Blocker if unresolved:

Audience-scoped search becomes a quality filter, not access control → rev5d §14.2 guardrail violated.
wrong_audience_result events have no security owner → potential information leakage at scale.
Customer/partner-facing surfaces lack policy authority.
v0.1 metadata hooks (visibility / readiness / publication) accumulate without governance.
Decisions 3 and 6 cannot move from "recorded" to "ratified" → implementation planning blocked.

8. G-3 — Capability-Intake Reviewer

Order: #3 (after G-1 + G-2 + G-5)

Owner role proposed:

Intake kind	Đ37 role / approval level
`tac_capability` (Đ38)	TAC governance reviewer + Council for Standard+ risk
`kg_capability` (Đ39)	KG governance reviewer + Council for Standard+ risk
Policy / threshold tuning	Council (always Standard risk minimum per D4 §4.5)
Đ24 vocabulary change	Đ24 governance (cross-law)
`tool_revision`	Council + Đ32 review (always Standard+ minimum)
Audience filter policy	Council + G-5 Access-Control Authority

Decision needed:

Confirm or formally create TAC governance reviewer role in Đ37 (may map to existing Đ38 owner).
Confirm or formally create KG governance reviewer role in Đ37 (may map to existing Đ39 owner).
Confirm Council ownership of policy / threshold / tool_revision intakes.
Formalize Đ24 cross-law channel for vocabulary intakes.
Confirm Council + G-5 joint authority for audience filter policy intakes.
Define Self-Review cadence (cross-link Decision 8 default proposal — pending User confirm or Council ratify).
Document intake → review → approval → patch flow per D4 §4.6.
Define authority distribution for high-risk intakes (Đ32 escalation).

Acceptance criteria for closure:

TAC governance reviewer role recorded in Đ37 SOP.
KG governance reviewer role recorded in Đ37 SOP.
Council ownership of policy / threshold / tool_revision intakes confirmed.
Đ24 cross-law channel formalized.
Council + G-5 joint authority for audience filter intakes confirmed.
Self-Review cadence defaults published.
D4 intake → review → approval flow documented in Đ37 SOP.
Đ32 escalation path for high-risk intakes wired.
D5 backlog entry for G-3 transitions status = resolved.

Dependency:

G-1 closed (threading roles + AI Council baseline).
G-2 closed (custodian tracking).
G-5 closed (audience filter policy intake authority depends on G-5).

Blocker if unresolved:

Capability intakes accumulate as proposed without review owner → cutter becomes stale (D4 §4.9 anti-stale rule fires but routing breaks).
Positive recursion loop (P10) cannot close.
Tool revisions could deploy without Đ32 risk approval → Đ32 violation.
Đ24 vocabulary changes risk silent invention (criterion 39 violation).
D4 implementation planning blocked.
G-4 (DOT-pair signing) cannot start (depends on tool_revision policy in G-3).

9. G-4 — DOT-Pair Signing Authority

Order: #4 (LAST — after G-3)

Owner role proposed:

DOT-pair concern	Đ37 role
Pair registration	DOT registry custodian (Đ37 SOP role from S178 A+3 paired-DOT pattern)
Joint signature authority	DOT registry custodian + Council ratification
Executor vs Verifier boundary policy	Council via D4 capability intake (G-3 dependency)
Pair rotation / revocation	DOT registry custodian + Đ32 risk approval if mid-cycle

Decision needed:

Confirm DOT registry custodian role from S178 A+3 covers dot-iu-cutter + dot-iu-cutter-verify pair, or formalize new SOP entry.
Register the pair: dot-iu-cutter (executor) ↔ dot-iu-cutter-verify (verifier).
Ratify joint signature schema concept (schema itself is P0-3/P0-4 territory; not designed here — only authority is decided).
Decide executor VERIFY precheck vs verifier final co-sign boundary (Gate 2 §3.6 closure — routed through G-3 D4 intake).
Confirm pair rotation / revocation authority + Đ32 risk approval rule.
Confirm Decision boundary: both signatures required for valid REPORT PASS (criterion 28).
Confirm tool_revision drift policy (both sides must be at same revision for valid co-sign).

Acceptance criteria for closure:

DOT registry custodian role confirmed for cutter pair (or new SOP entry).
Pair dot-iu-cutter ↔ dot-iu-cutter-verify registered.
Joint signature authority ratified by Council.
Executor / Verifier boundary policy decided (via G-3 D4 intake).
Pair rotation / revocation authority documented.
Both-signatures-required rule formally adopted.
tool_revision drift policy documented.
Cross-link to P0-3 / P0-4 migration design recorded (migration is later phase).
D5 backlog entry for G-4 transitions status = resolved.

Dependency:

G-3 closed (tool_revision policy, Council authority for tool intakes).
G-2 closed (tracking).

Blocker if unresolved:

REPORT cannot emit valid PASS (criterion 28 fails) — both signatures required but no signing authority.
If only executor signs → DOT-pair guarantee broken; criterion 28 violated.
Tool revision drift between executor and verifier silently allowed → invalid co-sign.
Cross-link with S178 A+3 pattern lost — existing DOT registry discipline not honored.
D1 implementation planning blocked.
P0-3, P0-4 migration design blocked (signing schema needs authority owner).

10. Cross-Closure Tracking

Gap	Affects User Decision ratification	Unblocks P0 design work
G-2	All (because it tracks closure)	None directly
G-1	Decision 1 (Balanced thresholds)	P0-6 review_decision (reviewer role FK)
G-5	Decisions 3 + 6 (HIGH risk ratification)	None directly (P3 audience_filter_policy is later)
G-3	Decision 2 (retrieval targets); Decision 5 (vocab indirectly)	None directly
G-4	None	P0-3 cut_change_set + P0-4 verify_result (signature schema)

11. Implementation Planning Gate Status

implementation_planning_gate: BLOCKED
blockers_remaining:
  - G-1 Threading roles (this checklist §6)
  - G-2 Backlog custodian (this checklist §5)
  - G-3 Capability-intake reviewer (this checklist §8)
  - G-4 DOT-pair signing authority (this checklist §9)
  - G-5 Access-Control Authority (this checklist §7)
  - Đ44 Family Registry ratification (parallel to G-3)
  - Đ24 vocabulary ratification (audience tiers, manifest enums)
  - Đ32 risk approval for Decisions 3 & 6 (via G-5)
  - Council ratification for Decisions 3 & 6 (via G-5)
  - P0 migration design (separate FUTURE phase; not in scope)
unblocked_when:
  - All 5 governance gaps `status = resolved` in D5 backlog
  - Đ44 + Đ24 closures recorded
  - Decisions 3 + 6 ratified per G-5 path
implementation_planning_allowed: false
implementation_allowed: false

12. No-Op Confirmations

no_governance_role_created_outside_dieu37: true
no_parallel_notification_system_created: true
no_vocabulary_minted_outside_dieu24: true
no_code_written: true
no_ddl_written: true
no_sql_proposed: true
no_migration_executed: true
no_pg_mutation: true
no_qdrant_mutation: true
no_design_deliverable_modified: true
no_planning_file_modified: true
no_implementation_planning_started: true

13. Status Block

package_status: READY_FOR_DIEU37_EXECUTION
closure_order_defined: true
closure_acceptance_criteria_per_gap_defined: true
dependency_graph_published: true
high_risk_decisions_routed: 2 (Decisions 3, 6 via G-5)
implementation_planning_gate: BLOCKED
implementation_execution_gate: BLOCKED
no_action_taken: true

14. Coverage of Review Findings

Review source	Checklist mapping
Governance Closure Package §5.1 (G-1)	§6
Governance Closure Package §5.2 (G-2)	§5
Governance Closure Package §5.3 (G-3)	§8
Governance Closure Package §5.4 (G-4)	§9
Governance Closure Package §5.5 (G-5)	§7
Governance Closure Package §6 (closure order)	§3 (graph) + ordering throughout
Governance Closure Package §8 (universal prerequisites)	§4
User Decision Confirmation §4.3, §4.6 (HIGH risk ratification needed)	§7 G-5 acceptance criteria
D5 routing rules	§4 universal prerequisites
criterion 37 (Đ37 governance map)	All gap closures honor
criterion 38 (no parallel notification)	§4 universal prerequisites
criterion 39 (industry standards leverage)	§4 universal prerequisites (Đ24)