dot-iu-cutter v0.5 — Constitution source_document Seed Restart: Executable-for-Review DML Draft

Phase: v0_5_constitution_source_document_seed_authoring_restart · Date: 2026-05-18 · doc 2 of 5

⚠️ EXECUTABLE-FOR-REVIEW DRAFT — NOT EXECUTED IN THIS PHASE

dml_authored_for_review: TRUE  (B6 CLOSED -> executable shape, no longer NO-DML-DRAFT)
dml_executed: FALSE ; rows_inserted: 0 ; dry_run: none ; cut: none ; verify: none
intended_execution_role: workflow_admin  (later, separately-gated command-review phase)
on_conflict: NONE (justified) ; update: NONE ; delete: NONE ; other_documents: NONE
decision_authority: GPT / User ONLY ; self_advance: PROHIBITED

This replaces the prior NO-DML-DRAFT. B6 (Nuxt parser / normalized content_checksum determinism) is CLOSED (GPT ruling 2026-05-18), so the version-row checksum is now a ratified concrete value, not a placeholder. The DML below is authored for GPT command-review only — it is not executed in this phase.

---

1. Canonical inputs (ratified — do not alter)

parser_profile_name:                 nuxt-incomex-portal-constitution-v1   # GPT R-OD-SR2 approved
canonical_normalized_content_checksum:
  f9d22d0571fa296cbc8e308c46acde93804ffcfb4a19a2e7f55dabd8657d1689        # THE persisted version identity
normalized_content_length:           17791                                 # provenance only (no live column)
changelog:                           INCLUDED in normalized content (GPT R-CL1)
status_markers (integrity probe, not identity): ✅=19  📋=1  📝=1  ⛔=1
raw_fetch_checksum:                  forensic-only, NOT identity, NOT a drift signal
source_document_ref:                 incomex-constitution
deterministic_document_version_id:
  rule:  'icxconst-' || left( sha256_hex( content_checksum || '|' || source_document_ref ), 32 )
  inputs: content_checksum=f9d22d05…d1689 , source_document_ref='incomex-constitution'
  precomputed_expected_value: icxconst-f4ce1f63bd768838f26b4f0ccdb615e4
  (local read-only sha256 of the exact string
   "f9d22d0571fa296cbc8e308c46acde93804ffcfb4a19a2e7f55dabd8657d1689|incomex-constitution"
   = f4ce1f63bd768838f26b4f0ccdb615e4a3fc2a309cddc14cc1993d4087a11bce ; left 32 hex)
  identity_property: depends ONLY on (content_checksum, source_document_ref);
                     it does NOT depend on any wall-clock timestamp.

2. LIVE target schema (grounded; see report §3 for grounding basis)

Grounding note: No live catalog SELECT was executed this session (this environment has no VPS/repo shell; primary working dir is not a git repo). The live schema below is taken from KB read-only-confirmed records — WS-Q5 reauthorized catalog verification (2026-05-18), status-marker-amendment NEG-5, and the prior NO-DML-DRAFT §2 — and is re-confirmed by the PRE-checks (verification-plan §2.1) at command-review/execution time. Adapt to LIVE columns only (QG2/QG3); MISMATCH-5 design-only columns are excluded.

cutter_governance.source_document_registry:
  source_document_ref text  PK  NOT NULL
  address_docprefix   text  NOT NULL  UNIQUE uq_source_document_registry_docprefix
  source_url          text  NULL
  source_family       text  NOT NULL  FK fk_source_document_registry_family
                                      -> source_family_registry(source_family)
  authority_class     text  NOT NULL
  display_vi          text  NULL
  display_en          text  NULL
  lifecycle           text  NOT NULL
  registered_by       text  NOT NULL
  registered_at             NOT NULL
  rows_now: 0

cutter_governance.source_document_version_registry:
  document_version_id text  PK  NOT NULL
  source_document_ref text  NOT NULL  FK fk_sdvr_source_document
                                      -> source_document_registry(source_document_ref)
  content_checksum    text  NOT NULL
  retrieval_timestamp       NOT NULL
  source_format       text  NULL
  authoritative_version text NULL
  version_status      text  NULL
  provenance          jsonb NULL
  registered_by       text  NOT NULL
  registered_at             NOT NULL
  UNIQUE (source_document_ref, content_checksum)  uq_sdvr_doc_checksum
  rows_now: 0

NOT live (design-only, MISMATCH-5) -> routed into provenance jsonb + this plan/report:
  parser_profile_ref, raw_checksum, normalized_content_length,
  grammar_profile_ref (grammar binding is DERIVED via source_family),
  supersedes_version_id, human_aliases, expected_format

3. Executable-for-review seed DML (ATOMIC — one transaction, NOT executed)

-- =====================================================================
-- dot-iu-cutter v0.5 — Constitution source_document + source_document_version
-- ATOMIC SEED  (authored 2026-05-18, B6 CLOSED)
-- STATUS: NOT EXECUTED. For GPT command-review only.
-- Intended execution role (later, separately-gated): workflow_admin
-- No ON CONFLICT (tables empty; collisions MUST surface, not be swallowed).
-- No UPDATE / no DELETE / no other documents / no schema change.
-- =====================================================================
\set ON_ERROR_STOP on

BEGIN;

-- --- Row 1: source_document_registry (parent) -----------------------
INSERT INTO cutter_governance.source_document_registry
  (source_document_ref, address_docprefix, source_url, source_family,
   authority_class, display_vi, display_en, lifecycle,
   registered_by, registered_at)
VALUES
  ('incomex-constitution',
   'ICX-CONST',
   'https://vps.incomexsaigoncorp.vn/knowledge/dev/laws/constitution',
   'internal_incomex_constitution',
   'authoritative',
   'Hiến pháp Kiến trúc Hệ thống Incomex',
   'Internal Incomex Architecture Constitution',
   'active',
   'constitution-source-seed',
   now());

-- --- Row 2: source_document_version_registry (child, FK -> Row 1) ---
-- document_version_id is computed in-transaction from the ratified
-- content_checksum + source_document_ref (deterministic, timestamp-independent).
-- Expected value: icxconst-f4ce1f63bd768838f26b4f0ccdb615e4
INSERT INTO cutter_governance.source_document_version_registry
  (document_version_id, source_document_ref, content_checksum,
   retrieval_timestamp, source_format, authoritative_version,
   version_status, provenance, registered_by, registered_at)
VALUES
  ( 'icxconst-' || left(
        encode( sha256( ( 'f9d22d0571fa296cbc8e308c46acde93804ffcfb4a19a2e7f55dabd8657d1689'
                          || '|' || 'incomex-constitution' )::bytea ), 'hex' ), 32 ),
    'incomex-constitution',
    'f9d22d0571fa296cbc8e308c46acde93804ffcfb4a19a2e7f55dabd8657d1689',
    now(),
    'html/nuxt',
    'v4.6.3 BAN HÀNH',
    'fetched',
    jsonb_build_object(
      'parser_profile_ref',      'nuxt-incomex-portal-constitution-v1',
      'normalize_profile',       'N1..N9: UTF-8|isolate-SSR-article-span|detag+unescape|NFC+stripBOM|CRLF->LF|collapse-hspace|trim-lines|collapse-vspace|preserve-diacritics+markers',
      'normalized_content_length', 17791,
      'changelog_included',       true,
      'authoritative_span',       'SSR <article> H1 "HIẾN PHÁP …" .. end of CHANGELOG, excluding "Back to Knowledge Hub" backlink',
      'status_marker_counts',     jsonb_build_object('enacted',19,'controlled_draft',1,'draft',1,'obsolete',1),
      'raw_checksum',             null,            -- forensic-only; fill from THE single controlled GET at execution; NEVER identity
      'raw_bytes',                null,            -- fill from controlled GET at execution
      'http_status',              200,
      'content_type',             'text/html; charset=utf-8',
      'server',                   'nginx/1.29.5',
      'x_powered_by',             'Nuxt',
      'observed_title',           'Hiến pháp Kiến trúc Hệ thống Incomex v4.6.3 BAN HÀNH',
      'observed_version_label',   'v4.6.3 BAN HÀNH',
      'observed_kb_id_rev',       'KB-7294 rev 44',  -- provenance, NOT identity
      'b6_ruling',                'CLOSED 2026-05-18',
      'supersedes_version_id',    null
    ),
    'constitution-source-seed',
    now() );

-- Atomic: both rows succeed together or neither persists.
COMMIT;
-- expected: INSERT 0 1 ; INSERT 0 1 ; COMMIT

4. Field-by-field authority

source_document_registry:
  source_document_ref  'incomex-constitution'    : ratification version-plan §2 (stable logical key); prior package §3
  address_docprefix    'ICX-CONST'               : BR-A1 / canon §4 / WS-2 D6; UNIQUE-enforced; '/' separator (SEP-1, locked BR-A1)
  source_url           <given>                   : grounded GET 200 (multiple sessions); task input
  source_family        'internal_incomex_constitution' : LIVE FK target (1 of 3 seeded families)
  authority_class      'authoritative'           : GPT R4 (v4.6.3 BAN HÀNH, enacted/official)
  display_vi           'Hiến pháp Kiến trúc Hệ thống Incomex' : observed title (Vietnamese)
  display_en           'Internal Incomex Architecture Constitution' : ratification version-plan §2
  lifecycle            'active'                   : consistent w/ WS-Q5 LCV-1 (all seeded = active)
  registered_by        'constitution-source-seed' : provenance principal (REG-1; distinct from ws-q5-seed-bootstrap)
  registered_at        now()                      : set at execution; NOT pre-baked; NOT part of identity
source_document_version_registry:
  document_version_id  computed                   : deterministic rule §1; expected icxconst-f4ce1f63bd768838f26b4f0ccdb615e4
  source_document_ref  'incomex-constitution'     : FK -> Row 1
  content_checksum     f9d22d05…d1689             : GPT-ratified canonical normalized checksum (B6 CLOSED) — THE identity
  retrieval_timestamp  now()                      : NOT NULL metadata; capture time; NOT part of identity
  source_format        'html/nuxt'                : grounded (x-powered-by: Nuxt)
  authoritative_version 'v4.6.3 BAN HÀNH'         : LABEL only, never identity
  version_status       'fetched'                  : not 'ready'; cut-eligibility is a later gate
  provenance (jsonb)   parser_profile_ref + normalized_content_length + raw_checksum(forensic, null until controlled GET) + metadata : per GPT R-PP1 (no live parser_profile/raw_checksum/length column)
  registered_by        'constitution-source-seed'
  registered_at        now()

5. Scope & safety assertions

seeds_only:               Constitution source_document + source_document_version (QG5)
other_documents_seeded:   0
atomic:                   single BEGIN/COMMIT, child row references parent in same tx (QG3)
on_conflict:              NONE — justified: both tables 0 rows; any collision is a
                          production-state mismatch that MUST surface (NEG-7), not be masked
update_delete:            NONE authored
parser_profile_storage:   provenance jsonb + this plan/report (GPT R-PP1; no schema change)
identity_timestamp_free:  document_version_id = f(content_checksum, source_document_ref) only
grammar/status_marker/source_family tables: NOT touched (read-only referenced)
execution:                NONE (QG4); not run in this phase; intended role workflow_admin later
adapts_to_LIVE_schema_only: yes (QG2/QG3; MISMATCH-5 design columns excluded)

6. Statement

• B6 CLOSED → executable-for-review atomic DML authored using the GPT-ratified canonical checksum (QG1). Adapted strictly to KB-confirmed LIVE columns; design-only columns routed to provenance jsonb (QG2). source_document + source_document_version inserted atomically in one transaction (QG3). Nothing executed (QG4). Constitution-only; no other document (QG5). enacted_only / Điều 44 untouched (QG6).
• doc 2 of 5; STOP after package → route GPT/User. Self-advance PROHIBITED.

Companion: operational-framing, rollback-draft, verification-plan, report.