dot-iu-cutter v0.5 First Snapshot MARK Dry-run Command Review — Execution Approval

Date: 2026-05-18 Reviewer / decision authority: GPT Reviewed package: knowledge/dev/laws/dieu44-trien-khai/v0.5-constitution-first-snapshot-mark-dryrun-command-review/

Verdict

command_review_package: PASS
review_status: APPROVED_FOR_CONTROLLED_DRYRUN_EXECUTION
first_dryrun_authorized: true
CUT_authorized: false
VERIFY_authorized: false
production_DB_write_authorized: false

The command package correctly uses the committed entrypoint surface, not the superseded pseudo-flags. It is approved for one controlled first Constitution snapshot MARK dry-run execution.

Micro-rulings

M1_snapshot_artifact_input:
  ruling: USE_LOCAL_COMMITTED_FIXTURE
  path: tests/fixtures/constitution-normalized-17660443e0f23e99.md
  reason: KB snapshot path is MCP-only; identity is enforced by sha/length/marker gate, not by path string

M2_output_directory:
  ruling: USE_EPHEMERAL_LOCAL_SCRATCH_THEN_UPLOAD_ARTIFACTS_TO_KB
  local_out_dir: "$WD/manifest"
  KB_destination: knowledge/dev/laws/dieu44-trien-khai/v0.5-constitution-first-snapshot-mark-dryrun-output/

Approved command basis

repo_path: /Users/nmhuyen/iu-cutter-build/repo/iu-cutter
branch: feature/constitution-snapshot-mark-dryrun
required_HEAD: afb7bfcc9b7bbb953bb00159479c9611e6ac4bd1
required_dryrun_py_sha: f1f42e83ca23ba0b328f79cf04a8391ac699d1b307eb1b22b52c305f2efa1422
source_version_id: icxconst-008a06ace23a96ea6cd456146e805c97
snapshot_fixture: tests/fixtures/constitution-normalized-17660443e0f23e99.md
expected_region_sha: 17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c
expected_length: 17522
expected_markers: enacted=19,controlled_draft=1,draft=1,obsolete=1
grammar_profile: incomex-architecture-constitution-v4
parser_refimpl: nuxt-incomex-portal-constitution-v1.refimpl.r1
scope: enacted_only
docprefix: ICX-CONST

Mandatory pre-execution checks

Before running the dry-run command, Agent must verify:

prechecks:
  - current branch equals feature/constitution-snapshot-mark-dryrun
  - HEAD equals afb7bfcc9b7bbb953bb00159479c9611e6ac4bd1
  - git status clean
  - cutter_agent/dryrun.py sha256 equals f1f42e83ca23ba0b328f79cf04a8391ac699d1b307eb1b22b52c305f2efa1422
  - tests/fixtures/constitution-normalized-17660443e0f23e99.md exists
  - fixture region sha/length/markers match expected
  - no DB env vars are set for the run
  - out_dir scratch path is outside repo and empty/new

If any precheck fails, stop and upload a BLOCKED report. Do not adapt command on the fly.

Authorized execution

Exactly one dry-run execution is authorized with the reviewed command shape:

python3 -m cutter_agent.dryrun \
  --mode mark-manifest-only \
  --no-db-write --no-cut --no-verify --fail-closed \
  --source-version-id icxconst-008a06ace23a96ea6cd456146e805c97 \
  --snapshot-artifact tests/fixtures/constitution-normalized-17660443e0f23e99.md \
  --expect-region-sha 17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c \
  --expect-length 17522 \
  --expect-markers 'enacted=19,controlled_draft=1,draft=1,obsolete=1' \
  --grammar-profile incomex-architecture-constitution-v4 \
  --parser-refimpl nuxt-incomex-portal-constitution-v1.refimpl.r1 \
  --scope enacted_only \
  --docprefix ICX-CONST \
  --out-dir "$WD/manifest" \
  --emit manifest.json,review_evaluation.json,coverage_proof.json,determinism_digest.md,dryrun_report.md

Expected local outputs

expected_files:
  - manifest.json
  - review_evaluation.json
  - coverage_proof.json
  - determinism_digest.md
  - dryrun_report.md

After the run, upload the 5 output artifacts or safe summaries/digests if an artifact is too large, plus execution reports under:

knowledge/dev/laws/dieu44-trien-khai/v0.5-constitution-first-snapshot-mark-dryrun-output/

Required execution report files:

reports:
  - dot-iu-cutter-v0.5-first-snapshot-mark-dryrun-execution-log-2026-05-18.md
  - dot-iu-cutter-v0.5-first-snapshot-mark-dryrun-verification-result-2026-05-18.md
  - dot-iu-cutter-v0.5-first-snapshot-mark-dryrun-report-2026-05-18.md

Verification expectations

expected_verification:
  exit_code: 0
  dryrun_status: PASS
  db_write: NONE
  CUT: not_executed
  VERIFY: not_executed
  emitted_levels:
    - NGUYEN_TAC
    - KIEN_TRUC_SECTION
    - DIEU
  scope: enacted_only
  dieu_44: excluded
  address_prefix: ICX-CONST/
  coverage_closed: true
  no_overlap: true
  address_unique: true
  determinism_rerun_equal: true

Still forbidden

forbidden:
  - CUT
  - VERIFY
  - production IU creation
  - production DB writes
  - source_document/source_version mutation
  - schema change
  - Directus/vector writes
  - deploy/restart
  - merge to main
  - push/tag/remote
  - self-advance to CUT/VERIFY

Final status

status: FIRST_SNAPSHOT_MARK_DRYRUN_APPROVED_FOR_CONTROLLED_EXECUTION
next_action: run_prechecks_execute_one_dryrun_upload_artifacts_and_reports_stop