dot-iu-cutter v0.5 W4 Credential Signing + Production Adapter Readiness — GPT Ruling

Date: 2026-05-19 Reviewer / decision authority: GPT Reviewed package: knowledge/dev/laws/dieu44-trien-khai/v0.5-w4-credential-signing-production-adapter-readiness/

Verdict

w4_macro_task_result: PASS_AS_BLOCKED_WITH_EXACT_GAP
agent_behavior: PASS_CORRECT
production_mutation: NONE
CUT_authorized: false
VERIFY_authorized: false
next_prompt_style: larger_open_goal_macro_task

The Agent correctly withheld a production CUT command because the production bridge is not ready. The blocker is now precise and implementation/actionable.

Accepted gaps

gaps:
  GAP_C1_credentials:
    finding: cutter_exec/cutter_verify exist but have no privileges on directus.public.information_unit or unit_version
    implication: v0.4 credential closure does not cover the real writer target
  GAP_C2_governed_ledger_location:
    finding: cut_change_set/dot_pair_signature/decision_backlog_history/verify_result not confirmed in directus target
    implication: CUT change-set + DOT-991 signature storage must be decided
  GAP_C3_signing:
    finding: DOT-991 signing not built; signing.py remains stub/deferred
  GAP_C4_prod_adapter:
    finding: RealPostgresAdapter is v0.4 ledger-shaped; cutwrite has no guarded production adapter
  GAP_C5_sovereign_write_approval:
    finding: production DB write approval not issued

Accepted non-gaps

not_blockers:
  schema_drift: false
  information_unit_shape_known: true
  unit_version_shape_known: true
  vocab_required_values_present: true
  ICX_CONST_existing_rows: 0
  db_isolated_writer: CLOSED_PASS

Process ruling

The next step should be larger than a single micro-gate. Because the user is using high-capability Agents and the overhead of context loading/copying is high, the next prompt should combine the remaining non-production work into one larger macro-goal:

selected_next_macro_goal: PRODUCTION_BRIDGE_PACKAGE_TO_CUT_APPROVAL_READINESS
scope:
  - resolve C1/C2 design decisions
  - author credential/GRANT command-review package if enough evidence exists
  - author or design DOT-991 signing capability
  - author guarded production adapter or exact adapter gap
  - prepare production CUT command-review package if all non-production gates pass
  - stop before any production write/CUT/VERIFY/deploy/merge

This is intentionally broader than prior tasks. Agent should work through checkpoints and only stop at a real blocker or a production-mutation gate.

Still forbidden

forbidden:
  - execute production CUT
  - execute VERIFY
  - write production DB
  - grant/revoke production privileges unless separately authorized
  - production IU creation
  - deploy/restart
  - merge/push/tag
  - mutate source_document/source_version
  - run writer against production DB in write mode
  - self-advance to production execution

Final status

status: W4_BLOCKED_WITH_EXACT_GAP_ACCEPTED__LARGER_MACRO_TASK_NEXT
next_action: run_open_goal_macro_for_production_bridge_package_to_CUT_approval_readiness