dot-iu-cutter v0.5 — Constitution source_document Grounding + Checksum/Parser Plan

Phase: v0_5_constitution_source_document_seed_authoring · Date: 2026-05-18 · doc 2 of 5

http_method_used: GET only (read-only) ; mutation: none ; dml: none
source_mutated: false ; production_mutated: false ; git_commit: false
decision_authority: GPT / User ONLY ; self_advance: PROHIBITED

---

1. Read-only source grounding (this session)

A single read-only HTTP GET of the registered source URL was performed this session (tool-mediated fetch, lossy→markdown). It confirms identity and is corroborated by the prior-session header-level GET recorded in the ratification grounding report.

source_url: https://vps.incomexsaigoncorp.vn/knowledge/dev/laws/constitution
this_session_GET:
  http_status: 200
  observed_title: "Hiến pháp Kiến trúc Hệ thống Incomex v4.6.3 BAN HÀNH"
  observed_version_label: "v4.6.3 BAN HÀNH"
  observed_kb_id_rev: "KB-7294 rev 44"   # surfaced in this fetch; treat as provenance, not identity (FLAG-4)
  markers_observed: ["✅","📋","📝","⛔"]   # matches the LIVE 4-marker map
  dieu_44_marker_observed: "📋"            # controlled_draft -> GPT R3 deferred from first dry-run
  changelog_dates_observed_up_to: 2026-05-18  # confirms living-document drift (MISMATCH-3)
prior_session_header_GET (ratification grounding-report 2026-05-18, authoritative for transport):
  content_type: text/html; charset=utf-8
  server: nginx/1.29.5
  x_powered_by: Nuxt                       # transport-level evidence
  raw_bytes: 1186671
  raw_sha256 (OBSERVATION ONLY, raw incl. chrome; NOT identity, NOT persisted):
    d19679599e0794e8051b872009c40ba766f46ed44702797b40d3b4120e041b26

1.1 Identity — CONFIRMED

source_identity: internal Incomex Architecture Constitution v4.6.3 BAN HÀNH
is_national_2013_constitution: NO
matches_live_source_family: internal_incomex_constitution (LIVE, 1 of 3 seeded families)
matches_live_grammar_binding: internal_incomex_constitution -> incomex-architecture-constitution-v4 (LIVE)
matches_live_marker_map: ✅/📋/📝/⛔ all 4 mapped (LIVE, B1 closed)
verdict: source identity is sufficiently grounded for the source_document row (B5 identity OK)

1.2 Rendering-mode discrepancy — FLAGGED, resolved in favour of header evidence

DISCREPANCY-R1:
  this_session_fetch_inference: "appears server-rendered HTML" (markdown-converting
    fast model inference — NOT a transport observation; cannot see headers/SPA hydration)
  prior_session_header_observation: x-powered-by: Nuxt, nginx, 1.18 MB raw dominated
    by CSS/chrome (direct HTTP header capture)
  resolution: HEADER evidence outranks model inference -> platform = Nuxt SPA/SSR
  consequence: STRENGTHENS the B6 blocker (raw bytes are chrome-heavy & re-render-volatile)

---

2. Why the checksum cannot be pinned now (B6 core)

The live identity basis is content_checksum (NOT NULL) on source_document_version_registry, with UNIQUE(source_document_ref, content_checksum). There is no raw_checksum column and no parser_profile_ref column live (MISMATCH-5). So the only persisted version identity is content_checksum = sha256(normalize(strip_chrome(raw))).

B6_blocking_facts:
  F1 content_checksum_is_NOT_NULL: a version row cannot be authored without a
     concrete, reproducible checksum value
  F2 strip_chrome_ruleset_undecided: the Nuxt chrome/script/style/nav strip ruleset
     = OD-SR2, explicitly NOT decided (source-document-version-plan 2026-05-18 §4)
  F3 no_ratified_parser_profile: no parser_profile registry row / no ratified
     normalization profile exists; live schema has no parser_profile_ref anyway
  F4 nuxt_volatility: Nuxt SPA/SSR raw payload (1.18 MB) is chrome-dominated and
     re-renders cosmetically -> raw_sha256 is unstable; content_checksum is
     UNDEFINED until strip_chrome is fixed
  F5 living_document_drift: CHANGELOG advanced 2026-04-18 -> 2026-05-18 under a
     stable v4.6.3 label -> content is moving; any hash captured now is a moving
     target with no ratified normalization to stabilize comparison
  F6 this_session_capture_is_lossy: the only fetch available this session is a
     model-summarized markdown conversion (cached 15 min, non-reproducible) —
     it CANNOT yield a deterministic content_checksum, and inventing one would
     violate governance ("never invent missing authority") and QG5
conclusion: content_checksum is NOT deterministically computable in this phase
            -> B6 = BLOCKED -> QG5 triggers -> doc 3 = NO-DML-DRAFT

---

3. Deterministic capture strategy (the plan to UNBLOCK B6 — design only)

This is the specification a future, separately-gated phase must ratify (OD-SR2) and execute under a controlled raw fetch before any executable seed DML:

raw_fetch_checksum:
  rule: sha256(exact raw response bytes, single controlled GET, redirects=0)
  storage: NO live column -> record under version_registry.provenance->>'raw_checksum'
  purpose: forensic/audit only; NEVER the identity (Nuxt-volatile)

normalized_content_checksum (THE identity):
  rule: content_checksum = sha256( normalize( extract_authoritative_span( raw ) ) )
  extract_authoritative_span (= the OD-SR2 decision, NOT decided here):
    keep: the rendered Constitution document body — H1 title through end of
          CHANGELOG, including 15 Nguyên tắc, Kiến trúc Hạ tầng A/B/C,
          Mục lục Luật (Điều 0..44), 2 Chiều Quản lý, Thuật ngữ, Changelog
    exclude (Nuxt chrome — candidate list, MUST be ratified): <script>, <style>,
          <head>, Nuxt hydration/state islands, nav/breadcrumb, footer, portal
          shell ("Incomex AI Portal"), Directus asset URLs, build-hash query
          strings, any timestamp injected by the renderer (not by the document)
  normalize: UTF-8 NFC ; strip BOM ; CRLF->LF ; collapse runs of inter-token
          whitespace to single space ; trim line ends ; PRESERVE Vietnamese
          diacritics AND status tokens ✅/📋/📝/⛔ exactly (codepoint-exact)
  property_required: stable across cosmetic Nuxt re-render (raw churns, content stable)

parser_profile (proposal — to be REGISTERED & RATIFIED separately, OD-SR2):
  parser_profile_ref: "nuxt-incomex-portal-constitution-v1"  (proposed name)
  applies_to_source_family: internal_incomex_constitution
  status: PROPOSED — NOT created, NOT a live column; recorded in provenance jsonb
          + this plan until a parser_profile registry exists / is decided

document_version_id (deterministic PK rule, unchanged from ratification plan):
  document_version_id = "icxconst-" || left( sha256_hex(
       content_checksum || '|' || source_document_ref ), 32 )
  -> pure f(content_checksum, source_document_ref); idempotent under live
     UNIQUE(source_document_ref, content_checksum)

drift_handling:
  different content => different content_checksum => NEW document_version_id;
  supersession recorded in provenance->>'supersedes_version_id'
  (no supersedes column live — MISMATCH-5)

---

4. Can the checksum be stable enough now?

assessment: NO — not until OD-SR2 (extract_authoritative_span / Nuxt strip ruleset)
            is ratified AND a single controlled raw GET is captured under it.
reasons: §2 F1–F6.
do_not: author executable INSERT DML with a fabricated/raw-only checksum
        pretending stability (forbidden by QG5 + governance).
do: author the deterministic specification (this doc) + NO-DML-DRAFT (doc 3) +
    rollback/verification plan (doc 4) so execution is mechanical once unblocked.

---

5. B6 status

B6_Nuxt_parser_checksum_determinism: BLOCKED
B6_design_progress: PARTIAL (capture strategy + parser_profile proposal authored;
  ratification of OD-SR2 + controlled raw fetch still required)
B5_source_document_version_seed: still OPEN (gated on B6)
unblock_path:
  1: GPT/User ratify OD-SR2 extract_authoritative_span + Nuxt strip ruleset
  2: register/decide parser_profile (or accept provenance-jsonb interim record)
  3: single controlled raw GET -> compute raw_sha256 + content_checksum under
     the ratified profile -> fill the NO-DML-DRAFT placeholders -> command-review

---

6. Statement

• Actual source grounded read-only this session; identity CONFIRMED (QG2). Rendering-mode discrepancy flagged, resolved on header evidence (Nuxt). Nuxt/parser/checksum determinism addressed (QG4). B6 = BLOCKED → doc 3 is NO-DML-DRAFT (QG5).
• No mutation, no DML, no dry-run, no cut/verify. doc 2 of 5; STOP after package → route GPT/User. Self-advance PROHIBITED.

Companion: operational-framing, seed-DML-draft (NO-DML-DRAFT), rollback-and-verification-plan, authoring-report.