dot-iu-cutter v0.5 Constitution Snapshot-source MARK Entrypoint Design — GPT Ruling and Code Authoring Approval

Date: 2026-05-18 Reviewer / decision authority: GPT Reviewed package: knowledge/dev/laws/dieu44-trien-khai/v0.5-constitution-snapshot-source-mark-dryrun-entrypoint-design/

Reviewed files:

files:
  - dot-iu-cutter-v0.5-constitution-snapshot-mark-operational-framing-2026-05-18.md
  - dot-iu-cutter-v0.5-constitution-snapshot-mark-matcher-and-status-design-2026-05-18.md
  - dot-iu-cutter-v0.5-constitution-snapshot-mark-manifest-contract-2026-05-18.md
  - dot-iu-cutter-v0.5-constitution-snapshot-mark-command-and-verification-plan-2026-05-18.md
  - dot-iu-cutter-v0.5-constitution-snapshot-mark-entrypoint-design-report-2026-05-18.md

Verdict

entrypoint_design_package: PASS
agent_behavior: PASS_CORRECT
forbidden_respected: true
execution_performed: false
code_authored_yet: false
next_phase_authorized: code_authoring_package_only

The design resolves the missing snapshot-source MARK dry-run entrypoint at the specification level. It is approved as the frozen input specification for a code-authoring package. No dry-run execution is authorized.

---

Accepted design

accepted:
  input_source: pinned_normalized_snapshot_artifact
  source_document_version_id: icxconst-008a06ace23a96ea6cd456146e805c97
  snapshot_checksum: 17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c
  parser_refimpl: nuxt-incomex-portal-constitution-v1.refimpl.r1
  grammar_profile: incomex-architecture-constitution-v4
  mode: mark_manifest_only
  output_policy: artifact_only
  db_write_policy: none
  status_policy: enacted_only
  fail_closed: true

Accepted matcher/status design:

matchers:
  - mc.icx.zone_router
  - mc.icx.nguyen_tac
  - mc.icx.kien_truc_section
  - mc.icx.dieu
  - status_marker_detector
  - changelog_boundary_detector

status_cascade:
  tier_0: document_promulgation_default
  tier_1: group_header_status_inheritance
  tier_2: explicit_DIEU_marker_override

---

OD-G3 ruling — emit levels

OD_G3_emit_levels: APPROVE_EMIT_ALL_3_RATIFIED_LEVELS_WITH_DIEU_AS_FLOOR

Meaning:

manifest_unit_levels:
  - NGUYEN_TAC
  - KIEN_TRUC_SECTION
  - DIEU
segmentation_floor: DIEU
forbidden_for_first_dryrun:
  - sub_bullet_as_independent_IU
  - paragraph_split_below_DIEU

Rationale:

rationale:
  - matches the ratified grammar profile levels
  - preserves structural reconstruction
  - keeps DIEU as the lowest segmentation unit
  - avoids over-fragmentation below DIEU

Higher-level NGUYEN_TAC/KIEN_TRUC_SECTION rows should be manifest units for structure/provenance/reconstruction. DIEU remains the legal/content leaf for first dry-run.

---

Authorized next phase

Open:

next_phase: v0_5_constitution_snapshot_source_MARK_dryrun_entrypoint_code_authoring
nature: code_authoring_package_only__no_execution

This phase may inspect the repository and author a patch/package for the missing entrypoint. It must not run the dry-run. It must not CUT/VERIFY. It must not commit/deploy unless a later explicit approval authorizes it.

Allowed actions:

allowed:
  - inspect existing iu-cutter/cutter_agent code read-only
  - identify closest module/entrypoint to extend
  - author code patch for no-DB-write snapshot-source MARK manifest mode
  - author tests/fixtures for parser/matchers/status cascade if feasible
  - run local unit tests only if they do not touch production DB and do not execute the full dry-run
  - produce command-review package and report

Preferred delivery style:

preferred:
  - do not commit
  - provide patch/diff and files changed
  - if working tree is modified, report exact git status and do not deploy
  - if code cannot be safely authored in current environment, produce a patch-draft in KB and report BLOCKED

---

Code package requirements

The code package must implement or draft an entrypoint with this contract:

entrypoint:
  name: cutter_agent.dryrun --mode mark-manifest-only
  input:
    - source_document_version_id
    - snapshot_artifact
    - expected_region_sha
    - expected_length
    - expected_markers
    - grammar_profile
    - parser_refimpl
    - scope enacted_only
    - docprefix ICX-CONST
    - out_dir
  output:
    - manifest.json
    - review_evaluation.json_or_md
    - coverage_proof.json_or_md
    - determinism_digest.md
    - dryrun_report.md
  hard_forbidden:
    - production DB writes
    - CUT
    - VERIFY
    - fn_iu_create
    - Directus/vector writes

Required implementation gates:

implementation_gates:
  - rehash snapshot BEGIN/END region before parse
  - abort if checksum/length/markers mismatch
  - parse with deterministic matchers
  - apply status cascade and enacted_only policy
  - emit all 3 ratified levels with DIEU as floor
  - emit excluded rows with reason, including controlled_draft Điều 44
  - derive ICX-CONST/<path> addresses without status in address
  - prove coverage/no-overlap
  - fail closed on unknown marker, overlap, duplicate address, orphan section, uncovered span
  - produce determinism digest

---

Still forbidden

still_forbidden:
  - first Constitution dry-run execution
  - CUT
  - VERIFY
  - production IU creation
  - production DB writes
  - source_document/source_version mutation
  - schema change
  - Directus mutation
  - deploy/restart
  - git commit unless later explicitly approved
  - self-advance to execution

Final status

status: ENTRYPOINT_DESIGN_PASS__OD_G3_RULED__CODE_AUTHORING_PACKAGE_NEXT
next_action: author_no_DB_write_snapshot_source_MARK_entrypoint_patch_package