dot-iu-cutter v0.5 Constitution Source Seed From Snapshot — Final Command Review and Execution Approval

Date: 2026-05-18 Reviewer / decision authority: GPT Reviewed package: knowledge/dev/laws/dieu44-trien-khai/v0.5-constitution-source-document-seed-from-snapshot-DML-revision/

Reviewed files:

files:
  - dot-iu-cutter-v0.5-constitution-source-seed-from-snapshot-DML-revised-2026-05-18.sql.md
  - dot-iu-cutter-v0.5-constitution-source-seed-from-snapshot-rollback-revised-2026-05-18.sql.md
  - dot-iu-cutter-v0.5-constitution-source-seed-from-snapshot-verification-plan-revised-2026-05-18.md
  - dot-iu-cutter-v0.5-constitution-source-seed-from-snapshot-DML-revision-report-2026-05-18.md

Verdict

source_seed_from_snapshot_DML_revision: PASS
agent_behavior: PASS_CORRECT
forbidden_respected: true
DML_executed_yet: false
execution_authorized: true
scope: seed_constitution_source_document_and_one_snapshot_bound_version_atomically

The required patch is correctly applied. The revised DML is approved for controlled production execution subject to the mandatory prechecks below.

---

Approved execution scope

Exactly two rows may be inserted:

approved_rows:
  cutter_governance.source_document_registry: 1
  cutter_governance.source_document_version_registry: 1

Approved identity values:

source_document:
  source_document_ref: incomex-constitution
  address_docprefix: ICX-CONST
  source_url: https://vps.incomexsaigoncorp.vn/knowledge/dev/laws/constitution
  source_family: internal_incomex_constitution
  authority_class: authoritative
  lifecycle: active

source_document_version:
  document_version_id: icxconst-008a06ace23a96ea6cd456146e805c97
  source_document_ref: incomex-constitution
  content_checksum: 17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c
  retrieval_timestamp: 2026-05-18T13:03:03Z
  source_format: normalized_snapshot
  authoritative_version: v4.6.3 BAN HÀNH
  version_status: snapshot_captured

Approved provenance must include snapshot/refimpl metadata as authored:

required_provenance:
  snapshot_artifact_path: knowledge/dev/laws/dieu44-trien-khai/snapshots/constitution/constitution-normalized-17660443e0f23e99.md
  snapshot_revision: 1
  snapshot_artifact_checksum: 17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c
  normalized_content_length: 17522
  marker_counts: {enacted: 19, controlled_draft: 1, draft: 1, obsolete: 1}
  parser_profile_ref: nuxt-incomex-portal-constitution-v1
  parser_reference_implementation: nuxt-incomex-portal-constitution-v1.refimpl.r1
  parser_reference_source: doc3 rev3
  reference_script_sha256: 8f6220c9b346a21b823cc41c12c886cb5f51ef4ab557806d2137ad78a1d08e29
  live_url_role: discovery_only
  supersedes_document_version_id: null

---

Patch verification

The revised DML satisfies the prior required patch:

patch_check:
  runtime_DB_sha256_removed: true
  literal_document_version_id_used: icxconst-008a06ace23a96ea6cd456146e805c97
  deterministic_derivation_preserved_in_comments: true
  verification_plan_avoids_DB_sha256_dependency: true

The executable DML must not compute the document version id inside PostgreSQL.

---

Mandatory pre-execution checks

Before executing DML, Agent must verify and record:

P1_target:
  - production system_identifier equals 7611578671664259111
  - cutter_governance schema exists
  - source_document_registry exists
  - source_document_version_registry exists

P2_supporting_registry_state:
  - source_family internal_incomex_constitution exists
  - grammar_profile incomex-architecture-constitution-v4 exists
  - grammar_profile_status_marker has exactly:
      ✅: enacted
      📋: controlled_draft
      📝: draft
      ⛔: obsolete

P3_existing_source_rows:
  - source_document_ref incomex-constitution absent
  - address_docprefix ICX-CONST absent
  - document_version_id icxconst-008a06ace23a96ea6cd456146e805c97 absent
  - no existing source_document_version for incomex-constitution

P4_snapshot_rehash_gate:
  - read snapshot artifact path exactly
  - artifact revision is 1 or report if latest revision differs
  - extract strict BEGIN/END normalized-content region
  - region sha256 equals 17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c
  - normalized region length equals 17522
  - marker counts equal 19/1/1/1
  - parser/refimpl metadata present and matches expected values
  - if mismatch: STOP_AND_ESCALATE, no DML

P5_command_integrity:
  - revised DML matches approved package
  - INSERT-only
  - one BEGIN/COMMIT transaction
  - no UPDATE
  - no DELETE in apply command
  - no ON CONFLICT
  - no runtime DB sha256 call
  - no dry-run/CUT/VERIFY
  - no schema/GRANT/index/Directus changes

Mandatory fresh backup:

backup:
  required: true
  timing: after all prechecks pass and before DML
  must_record:
    - safe backup path or identifier
    - timestamp
    - size/integrity marker
    - sha256 if available
    - no secrets

If any precheck fails, Agent must stop and upload a BLOCKED report. Do not adapt DML on the fly.

---

Authorized execution procedure

procedure:
  1: run P1-P5 mandatory prechecks
  2: take fresh backup
  3: execute revised DML as workflow_admin in one transaction with ON_ERROR_STOP=1
  4: verify source_document row
  5: verify source_document_version row
  6: verify FK/checksum/docprefix/source_url/provenance/snapshot binding
  7: verify no dry-run/CUT/VERIFY/downstream mutation
  8: upload report and STOP

Expected post-state:

expected_post_state:
  source_document_registry:
    incomex-constitution: exactly_once
    address_docprefix_ICX_CONST: exactly_once
  source_document_version_registry:
    icxconst-008a06ace23a96ea6cd456146e805c97: exactly_once
    content_checksum_17660443: exactly_once_for_incomex_constitution
  FK_integrity: pass
  snapshot_artifact_binding: pass
  enacted_only_scope: unchanged
  dieu44: still_deferred
  dryrun_executed: false
  cut_executed: false
  verify_executed: false

---

Rollback / failure handling

if_apply_fails_before_commit:
  - transaction rollback expected
  - verify no source_document/source_version rows
  - report FAIL/BLOCKED

if_apply_commits_but_verification_fails:
  - rollback may execute only if rows exactly match the 2 approved inserted rows
  - delete child source_document_version row first
  - delete parent source_document row second
  - no CASCADE
  - if downstream references or unexpected rows exist, STOP_AND_ESCALATE

if_rows_already_exist_before_apply:
  - STOP_AND_ESCALATE
  - do not treat as idempotent success silently

---

Still forbidden

forbidden:
  - seed any other source_document
  - seed any other source_document_version
  - update existing source rows
  - ON CONFLICT masking
  - runtime DB sha256 computation for document_version_id
  - Constitution dry-run
  - CUT
  - VERIFY
  - schema change
  - GRANT/REVOKE
  - index DDL execution
  - Directus mutation
  - vector/NoSQL integration
  - deploy/restart
  - git commit
  - self-advance to dry-run

---

Required output

Agent must upload execution results under:

knowledge/dev/laws/dieu44-trien-khai/v0.5-constitution-source-document-seed-from-snapshot-production-execution/

Required files:

files:
  - dot-iu-cutter-v0.5-constitution-source-seed-from-snapshot-production-execution-log-2026-05-18.md
  - dot-iu-cutter-v0.5-constitution-source-seed-from-snapshot-production-verification-result-2026-05-18.md
  - dot-iu-cutter-v0.5-constitution-source-seed-from-snapshot-production-report-2026-05-18.md

Report must state:

required_report_fields:
  - execution_status: PASS | FAIL | BLOCKED | ROLLED_BACK
  - backup_status
  - pre_execution_checks
  - snapshot_rehash_result
  - inserted_rows
  - source_document_verification_summary
  - source_document_version_verification_summary
  - provenance_snapshot_binding_summary
  - rollback_status_if_any
  - downstream_not_executed
  - next recommended cycle

---

Final status

status: CONSTITUTION_SOURCE_SEED_FROM_SNAPSHOT_APPROVED_FOR_CONTROLLED_EXECUTION
next_action: run_prechecks_backup_execute_verify_stop