dot-iu-cutter v0.5 — Constitution CUT Command Review · CUT Input & Manifest Lock

Phase: v0_5_constitution_CUT_command_review · Nature: review_design_only__no_execution · Date: 2026-05-19 · doc 1 of 6

package_status: AUTHORED_FOR_REVIEW
outcome_preview: BLOCKED_WITH_EXACT_GAP   (see doc 3 + doc 6 — controlling capability gap)
nothing_executed: true · no CUT · no VERIFY · no DB/IU/Directus/vector · no source mutation
kb_read: confirmed (search_knowledge + batch_read + list_documents OK)
self_advance: PROHIBITED

This package is the CUT command-review mandated by the GPT duplicate-resume-guard ruling (2026-05-19, R3) → the first-snapshot MARK dry-run output-review concluded A — READY_FOR_CUT_COMMAND_REVIEW. It consolidates and supersedes the fragmented prior work (v0.5-constitution-first-snapshot-cut-command-review/ 5 docs; S1 cut-plan-dryrun command-review; S2 cutplan implementation; S2E evidence verification) into one current-state, evidence-grounded decision package. It does not open or authorize CUT/VERIFY/production.

1. Pinned CUT input identity (immutable — any deviation ⇒ ABORT)

The CUT input is exactly the accepted, authoritative first-snapshot MARK dry-run output. No re-run was performed (duplicate-resume-guard); these values are taken from the ratified KB SSOT (v0.5-constitution-first-snapshot-mark-dryrun-output/ + output-review + GPT ruling).

manifest_to_use:            the accepted first-snapshot MARK manifest.json (deterministic,
                            byte-reproducible by re-running the pinned MARK command)
manifest_digest_sha256:     9d908a62fcf01bb88e05a1af4335b960710006ddcfd21c811ca63efb33dd324f
manifest_json_file_sha256:  7d56f3ce066950ccef3de4156c5afeea81b2450b8e38393205b52c1fca012179
manifest_json_size_bytes:   84157
candidate_set:              60 accepted candidates ONLY
  by_level:                 NGUYEN_TAC=15 · KIEN_TRUC_SECTION=3 · DIEU=42
excluded_set:               4   (Điều 44 UOSL controlled_draft tier_2 reason
                            controlled_draft_deferred · Điều 34 Workflow draft · 2 obsolete)
source_document_version_id: icxconst-008a06ace23a96ea6cd456146e805c97
source_document_ref:        incomex-constitution · address_docprefix ICX-CONST
snapshot_region_sha256:     17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c
snapshot_region_length:     17522
snapshot_markers:           enacted=19 · controlled_draft=1 · draft=1 · obsolete=1
scope_policy:               enacted_only
address_form:               ICX-CONST/<path>  (status NEVER encoded in the address)
repo_anchor:                branch feature/constitution-snapshot-mark-dryrun @ HEAD
                            afb7bfcc9b7bbb953bb00159479c9611e6ac4bd1
mark_entrypoint_identity:   cutter_agent/dryrun.py sha256 f1f42e83…2efa1422 (committed)
re_run_equal:               true (determinism proven in the accepted dry-run)
cardinality_invariant:      IU rows a future CUT would create == candidate_count == 60

2. What CUT will take as input — answered precisely (requirement 1)

Question	Locked answer
Which manifest	The accepted first-snapshot MARK manifest.json (digest 9d908a62…)
Which digest	9d908a62fcf01bb88e05a1af4335b960710006ddcfd21c811ca63efb33dd324f
Which candidate set	The 60 accepted candidates (15 NGUYEN_TAC + 3 KIEN_TRUC_SECTION + 42 DIEU)
Which source_document_version_id	icxconst-008a06ace23a96ea6cd456146e805c97 (snapshot-bound, live per B5 closeout)
Which scope	enacted_only purity 60/60
Điều 44 / draft / obsolete exclusion	The 4 excluded rows stay excluded; never enter the cut set

3. Carry-forward notes N-1..N-4 — disposition (requirement 3)

N-1 sha-verify full manifest.json BEFORE row-set design:
  status: SPECIFIED AS A MANDATORY PRECHECK — NOT executed in this review.
  rule: before any CUT-class command (cut-plan dry-run OR production CUT) designs/derives a
    row-set, the operator MUST deterministically regenerate the full manifest.json into an
    ephemeral scratch dir (re-run the PINNED MARK command — re_run_equal:true) and assert
    sha256(file)==7d56f3ce…012179 AND recomputed manifest_digest==9d908a62…dd324f. Mismatch
    ⇒ ABORT (snapshot/manifest drift). This is precheck C-3/C-4 (doc 3).
  why NOT executed here: (a) the controlling outcome is BLOCKED at the capability gate
    (doc 2/3) — no ratified CUT entrypoint consumes the manifest, so regenerating it now
    cannot unblock anything and is premature effort past a known blocker; (b) the GPT
    duplicate-resume-guard ruling forbids re-running the first dry-run unless explicitly
    authorized as a fresh re-run; a deterministic ephemeral regen for sha-verification is
    therefore correctly deferred into the (separately gated) entrypoint command-review where
    it is the C-3 gate. The full body is byte-recoverable on demand (determinism proven).
N-2 NGUYEN_TAC / KIEN_TRUC_SECTION = IU or container at CUT:
  status: OPEN DESIGN INPUT for the CUT-entrypoint design sub-phase (doc 3 §gap, GAP-3).
  framing: the MARK manifest correctly emits all 3 levels (15+3+42=60); whether NGUYEN_TAC
    and KIEN_TRUC_SECTION become production IU rows or structural containers (with DIEU as
    the leaf IU) changes the `unit_kind`/`parent_or_container_ref` mapping into the live
    `information_unit` table — this is a CUT-entrypoint-design ruling, NOT a manifest defect.
    RECOMMENDATION carried to GPT: emit all 3 as IU rows with explicit `unit_kind`
    (nguyen_tac / kien_truc_section / dieu) and `parent_or_container_ref` linkage so
    reconstruction stays closed (preserves the proven 229+10+69=308 reconstruction); final
    ruling is GPT/User's at the design sub-phase.
N-3 Điều 44 + draft + obsolete excluded:
  status: HARD INVARIANT (I-3, doc 6). The 4 excluded rows must never be silently
    re-included in any cut-plan preview or production CUT row-set. Enforced by
    --exclude-dieu-44 contract flag + C-5 precheck + VR-2 verification.
N-4 canonical DIEU addresses fixed:
  status: HARD INVARIANT. Heterogeneous/non-contiguous DIEU keys are intentional and
    reconstruction-closed; CUT MUST reuse the manifest's ICX-CONST/<path> addresses
    verbatim — no renumber/normalise/canonicalization-stub invocation.

4. Explicit no-mutation statement for THIS doc

writes: KB document only. No CUT · no VERIFY · no DB/IU/Directus/vector · no source/version
  mutation · no code change · no commit/push/merge/tag/deploy · no dry-run re-run.

doc 1 of 6. Nothing executed. Self-advance PROHIBITED.