dot-iu-cutter v0.5 — Constitution source_document Seed: NO-DML-DRAFT

Phase: v0_5_constitution_source_document_seed_authoring · Date: 2026-05-18 · doc 3 of 5

⚠️ THIS IS A NO-DML-DRAFT — NOT EXECUTABLE SEED DML

dml_authored_for_execution: FALSE
reason: B6 (Nuxt parser/normalized content_checksum determinism) = BLOCKED
qg5_invoked: TRUE  (checksum determinism blocked -> NO-DML-DRAFT, not unsafe DML)
rows_inserted: 0 ; dml_executed: 0 ; dry_run: none ; cut: none ; verify: none
decision_authority: GPT / User ONLY ; self_advance: PROHIBITED

---

1. Why no executable DML is authored

source_document_version_registry.content_checksum is NOT NULL and is the sole persisted version identity (no raw_checksum / parser_profile_ref columns live — MISMATCH-5). Its value = sha256(normalize(strip_chrome(raw))), and the strip_chrome/extract_authoritative_span ruleset (OD-SR2) is not ratified, the source is Nuxt SPA/SSR (chrome-volatile), and the document is a living document (CHANGELOG drift 2026-04-18 → 2026-05-18). See doc 2 §2.

Authoring an executable INSERT … VALUES (…, content_checksum, …) now would require inventing or faking a stable checksum. That is forbidden by QG5 and by the governance rule "never invent missing authority". Therefore this document specifies the exact rows, field-by-field, against the LIVE schema, with the checksum-dependent fields as explicit, named placeholders to be filled mechanically only in a future, separately-gated phase after OD-SR2 is ratified and a single controlled raw GET is captured.

---

2. LIVE target schema (read-only confirmed 2026-05-18; cross-checked WS-Q5 catalog)

cutter_governance.source_document_registry:
  source_document_ref text  PK  NOT NULL
  address_docprefix   text  NOT NULL  UNIQUE (uq_source_document_registry_docprefix)
  source_url          text  NULL
  source_family       text  NOT NULL  FK fk_source_document_registry_family
                                      -> source_family_registry(source_family)
  authority_class     text  NOT NULL
  display_vi          text  NULL
  display_en          text  NULL
  lifecycle           text  NOT NULL
  registered_by       text  NOT NULL
  registered_at       (NOT NULL)
  rows_now: 0  (WS-Q5 seed verify + marker-amendment NEG-5)

cutter_governance.source_document_version_registry:
  document_version_id text  PK  NOT NULL
  source_document_ref text  NOT NULL  FK fk_sdvr_source_document
                                      -> source_document_registry(source_document_ref)
  content_checksum    text  NOT NULL
  retrieval_timestamp (NOT NULL)
  source_format       text  NULL
  authoritative_version text NULL
  version_status      text  NULL
  provenance          jsonb NULL
  registered_by       text  NOT NULL
  registered_at       (NOT NULL)
  UNIQUE (source_document_ref, content_checksum)  uq_sdvr_doc_checksum
  rows_now: 0
NOT live (design-only, MISMATCH-5): human_aliases, expected_format,
  parser_profile_ref, grammar_profile_ref, raw_checksum, supersedes_version_id
  -> routed into provenance jsonb; grammar binding is DERIVED via source_family.

---

3. Proposed source_document_registry row (1 row — schema-accurate, NOT inserted)

Every value below maps to a LIVE column and is grounded:

# field                 value                                              authority/source
source_document_ref:   "incomex-constitution"                            # ratification version-plan §2 (stable logical key)
address_docprefix:     "ICX-CONST"                                       # BR-A1 / canon §4 / WS-2 D6; UNIQUE-enforced
source_url:            "https://vps.incomexsaigoncorp.vn/knowledge/dev/laws/constitution"  # grounded GET 200, doc 2 §1
source_family:         "internal_incomex_constitution"                   # LIVE FK target (1 of 3 seeded families)
authority_class:       "authoritative"                                   # GPT R4 (v4.6.3 BAN HÀNH, enacted/official)
display_vi:            "Hiến pháp Kiến trúc Hệ thống Incomex"             # observed title (Vietnamese)
display_en:            "Internal Incomex Architecture Constitution"      # ratification version-plan §2
lifecycle:             "active"                                          # consistent w/ WS-Q5 LCV-1 (all seeded = active)
registered_by:         "constitution-source-seed"                        # provenance principal (proposed; not 'ws-q5-seed-bootstrap')
registered_at:         <now() at execution time>                         # set by execution phase, not pre-baked
# grammar binding: DERIVED, NOT a column -> source_family internal_incomex_constitution
#                  -> grammar_profile incomex-architecture-constitution-v4 (LIVE FKV-5b)

Illustrative INSERT shape (NOT TO RUN — no executable artifact produced):

-- NO-DML-DRAFT: shape only; this is NOT a runnable .sql artifact and has NOT been executed.
INSERT INTO cutter_governance.source_document_registry
  (source_document_ref, address_docprefix, source_url, source_family,
   authority_class, display_vi, display_en, lifecycle, registered_by, registered_at)
VALUES
  ('incomex-constitution', 'ICX-CONST',
   'https://vps.incomexsaigoncorp.vn/knowledge/dev/laws/constitution',
   'internal_incomex_constitution', 'authoritative',
   'Hiến pháp Kiến trúc Hệ thống Incomex',
   'Internal Incomex Architecture Constitution',
   'active', 'constitution-source-seed', now());
-- no ON CONFLICT (table empty; uniqueness must surface, not be swallowed)
-- no UPDATE / no DELETE

The source_document_registry row is, in isolation, fully determinable now. It is still withheld from execution because a source_document with no resolvable authoritative version is operationally an E1/E2 hazard (doc 1 §5): creating the parent without the checksum-pinned child invites a later cut against an unpinned version. Per QG6 the seed is Constitution-only and atomic with its version; both are gated together on B6.

---

4. Proposed source_document_version_registry row (1 row — BLOCKED on checksum)

# field                  value                                            status
document_version_id:    "icxconst-" || left(sha256_hex(
                          content_checksum || '|' ||
                          'incomex-constitution'),32)                    # DERIVED — depends on <<CONTENT_CHECKSUM>>
source_document_ref:    "incomex-constitution"                           # FK -> parent row above
content_checksum:       <<CONTENT_CHECKSUM_PLACEHOLDER>>                  # ⛔ BLOCKED (B6/OD-SR2); NOT NULL; cannot fake
retrieval_timestamp:    <single controlled GET time, future phase>       # BLOCKED with checksum
source_format:          "html/nuxt"                                      # grounded (x-powered-by: Nuxt)
authoritative_version:  "v4.6.3 BAN HÀNH"                                # LABEL only, never identity
version_status:         "fetched"                                        # NOT "ready" until ratified+cut-gated
provenance (jsonb):     {                                                 # design-only contents (no secrets)
   raw_checksum: <<RAW_SHA256_PLACEHOLDER>>,                              #   forensic only (Nuxt-volatile)
   raw_bytes: <<from controlled GET>>,
   http_status: 200, content_type: "text/html; charset=utf-8",
   server: "nginx/1.29.5", x_powered_by: "Nuxt",
   retrieved_at: <<utc>>, source_format: "html/nuxt",
   parser_profile_ref: "nuxt-incomex-portal-constitution-v1",            #   PROPOSED (OD-SR2 — not ratified)
   normalize_profile: "NFC|stripBOM|CRLF->LF|collapse-ws|preserve-diacritics+markers",
   supersedes_version_id: null,
   observed_title: "Hiến pháp Kiến trúc Hệ thống Incomex v4.6.3 BAN HÀNH",
   observed_version_label: "v4.6.3 BAN HÀNH",
   observed_kb_id_rev: "KB-7294 rev 44"                                  #   provenance, not identity (FLAG-4)
  }
registered_by:          "constitution-source-seed"
registered_at:          <now() at execution time>

status: ⛔ NO EXECUTABLE DML — content_checksum / document_version_id /
        retrieval_timestamp / raw_checksum are BLOCKED placeholders.
        No INSERT shape is even rendered for this row to avoid any
        copy-paste-execute hazard while B6 is open.

---

5. Scope & safety assertions

seeds_only: Constitution source_document + source_document_version (QG6)
other_documents_seeded: 0
grammar/status_marker/source_family tables: NOT touched (read-only referenced)
ON_CONFLICT: none (justified — tables empty; collisions must surface)
UPDATE/DELETE: none authored
execution: NONE (QG8) ; this file is not a runnable .sql artifact
adapts_to_LIVE_schema_only: yes (QG3; MISMATCH-5 design columns excluded)

6. Statement

• B6 BLOCKED → NO-DML-DRAFT produced instead of unsafe DML (QG5). source_document_registry row fully specified & schema-accurate; source_document_version_registry row blocked on content_checksum (NOT NULL, OD-SR2 unratified) — both gated together (QG6). Nothing executed (QG8).
• doc 3 of 5; STOP after package → route GPT/User. Self-advance PROHIBITED.

Companion: operational-framing, grounding-and-checksum-plan, rollback-and-verification-plan, authoring-report.