GPT Review — D28 Phase 1B Retry #2 BLOCKED and Path F Directive

Date: 2026-05-10
Reviewer: GPT-5.5 Thinking / Incomex Hội đồng AI
Reviewed:

• knowledge/dev/laws/dieu28-trien-khai/reports/d28-generated-table-map-implementation-report.md rev2
• knowledge/dev/laws/dieu28-trien-khai/reviews/opus-review-d28-phase1b-retry2-blocked-path-f-recommendation-2026-05-10.md

Verdict

Agent report accepted. Opus review accepted.

Agent did the correct thing by stopping. Retry #2 revealed the real deployment architecture:

Production Nuxt container = runtime-only .output, no source, no node_modules, no tsx.
Host repo = source files, but no node_modules.
Dev compose = source + deps but not running; starting it would violate boundaries.

The rev6 container-exec path is therefore infeasible under current hard boundaries.

GPT approves Opus's Path F direction for prompt rev7:

Host-side plain Node .mjs generator, no external dependencies.

Do not dispatch after patch; return rev7 for GPT/User review.

Agent report assessment

Agent compliance was excellent:

• stopped at mount-through failure;
• did not create .mount-test because introspection already proved no source mount;
• did not modify files;
• did not mutate Directus/PG;
• did not deploy;
• did not restart containers;
• did not print secrets;
• preserved P3D state.

This is safe behavior and should be treated as successful discovery, not failure.

Why Path A is not preferred

Agent recommended Path A:

pnpm install --frozen-lockfile on host

This would likely work, but it crosses NO_PACKAGE_INSTALL and adds significant host node_modules footprint. It is reversible, but it creates a new operational maintenance surface.

Why Path F is preferred

Path F uses:

node scripts/generate-table-maps.mjs

with only Node built-ins:

• fetch;
• crypto;
• fs;
• no tsx;
• no node_modules;
• no package install;
• no lockfile change;
• no container restart;
• no dev compose;
• no source mount dependency.

The generated artifact remains TypeScript:

web/generated/table-maps.generated.ts

This trade-off is acceptable because the generator is an internal tool and can be kept small, documented, deterministic, and verified by --check.

Path F preconditions

Rev7 must preflight:

host_node_present=true|false
host_node_version>=18
host_node_fetch_available=true|false
host_repo_clean=true
/opt/incomex/docker/.env exists
DIRECTUS_ADMIN_TOKEN present (boolean only)
DIRECTUS_PUBLIC_URL present (boolean only)

If host Node is missing or <18, rev7 must STOP and recommend Path A or a separate tooling decision.

Rev7 direction

Opus should patch the implementation prompt to rev7 using Path F.

Core execution model

execution_model=HOST_NODE_MJS_NO_DEPS

Command pattern:

cd /opt/incomex/docker/nuxt-repo/web \
  && set -a; source /opt/incomex/docker/.env 2>/dev/null; set +a \
  && export NUXT_DIRECTUS_SERVICE_TOKEN="$DIRECTUS_ADMIN_TOKEN" \
  && export NUXT_PUBLIC_DIRECTUS_URL="$DIRECTUS_PUBLIC_URL" \
  && export DIRECTUS_URL="$DIRECTUS_PUBLIC_URL" \
  && node scripts/generate-table-maps.mjs

Do not print token or URL.

Generator script

Create:

web/scripts/generate-table-maps.mjs

Requirements:

• ESM .mjs;
• no external dependency;
• Node built-ins only;
• Node 18+ required;
• fetch Directus table_registry via token;
• use crypto.createHash;
• use fs.writeFileSync / readFileSync;
• modes:
  • generate;
  • --check;
  • --print-hash;
  • --include-draft;
• no secret/URL printing;
• output remains web/generated/table-maps.generated.ts;
• reverseCollectionMap emitted literal;
• content hash deterministic.

package.json scripts

Change from tsx to node:

"generate:table-maps": "node scripts/generate-table-maps.mjs",
"verify:table-maps": "node scripts/generate-table-maps.mjs --check"

No lockfile change.

Build/typecheck handling

Because host lacks node_modules and production container lacks source/deps, rev7 should not require host build/typecheck.

Instead:

• run generator --check host-side;
• verify generated artifact deterministic;
• verify only expected files changed;
• optionally run syntax validation of .mjs with host Node;
• classify build/typecheck as:

NOT_RUN_RUNTIME_CONTAINER_NO_SOURCE_AND_HOST_NO_DEPS

Do not claim full local build PASS.

Follow-up deploy/build pack will be needed after commit.

Consumer import changes still allowed

Rev7 still changes the same three consumers:

• registry page tableIdMap;
• config/detail-sections.ts maps;
• server/api/discovery/relations.get.ts map.

But since build/typecheck cannot run under current constraints, rev7 must be conservative:

• use existing import alias conventions where already proven;
• if uncertainty remains, report SERVER_IMPORT_NEEDS_BUILD_VERIFY;
• phase status may be PARTIAL if build/typecheck is not possible.

CI handling

CI workflow modification remains optional/conditional. Do not claim CI PASS.

If script can be added to package.json only, report:

ci_check_status=NOT_MODIFIED
follow_up_packs includes DEPLOY_BUILD_SMOKE_PACK or CI_VERIFY_PACK

Hard boundaries preserved

Rev7 must preserve:

NO_DEPLOY=true
NO_LIVE_ROUTE_SMOKE=true
NO_DIRECTUS_MUTATION=true
NO_PG_MUTATION=true
NO_PUBLISH_EVENT_OUTBOX=true
NO_CHANGE_TABLE_REGISTRY=true
NO_SECRET_IN_CODE_OR_LOG=true
NO_PRINT_ENV_TOKEN_URL=true
NO_PACKAGE_INSTALL=true
NO_NPX_AUTO_INSTALL=true
NO_LOCKFILE_CHANGE=true
NO_CONTAINER_RESTART=true
NO_DOCKER_COMPOSE_RESTART=true

Rev7 report fields

Add/update:

execution_model=HOST_NODE_MJS_NO_DEPS
host_node_present=true|false
host_node_version=<version>
host_node_fetch_available=true|false
host_env_source=/opt/incomex/docker/.env
host_env_alias_used=true
host_node_modules_required=false
package_install_used=false
container_exec_used=false
container_restart_used=false
build_typecheck_status=NOT_RUN_RUNTIME_CONTAINER_NO_SOURCE_AND_HOST_NO_DEPS|PASS|FAIL|BLOCKED
phase1b_status=PASS|PARTIAL|FAIL|BLOCKED

Directive to Opus

Patch prompt rev7 at:

knowledge/dev/laws/dieu28-trien-khai/prompts/d28-generated-table-map-implementation-prompt.md

Use Path F host .mjs no-dependency strategy.

Do not dispatch after patch. Return for GPT/User review.

Current P3D state

table_registry_id=21
permission_id=1483
tbl_event_outbox.status=draft
notification_display=paused
primary_goal=information_unit_text_as_code_infrastructure

Final status

retry2_blocked_report=ACCEPTED
opus_path_f_recommendation=ACCEPTED
rev7_direction=HOST_NODE_MJS_NO_DEPS
implementation_dispatch_allowed=false_until_rev7_review
p3d_resume_allowed=false