dot-iu-cutter v0.5 — Constitution Source Seed FROM SNAPSHOT: Executable-for-Review DML Draft

Phase: v0_5_constitution_source_document_seed_from_snapshot_authoring · Date: 2026-05-18 · doc 2 of 5

⚠️ EXECUTABLE-FOR-REVIEW DRAFT — NOT EXECUTED IN THIS PHASE

dml_authored_for_review: TRUE
dml_executed: FALSE ; rows_inserted: 0 ; dry_run: none ; cut: none ; verify: none
intended_execution_role: workflow_admin  (later, separately-gated command-review phase)
on_conflict: NONE (justified) ; update: NONE ; delete: NONE ; other_documents: NONE
version_identity_basis: pinned snapshot artifact region sha256 (NOT live page)
decision_authority: GPT / User ONLY ; self_advance: PROHIBITED

This supersedes the prior live-page restart DML. The source_document_version.content_checksum is now the pinned snapshot artifact region sha256, not a live-page fresh hash.

---

1. Canonical inputs (ratified — do not alter)

snapshot_artifact_path:
  knowledge/dev/laws/dieu44-trien-khai/snapshots/constitution/constitution-normalized-17660443e0f23e99.md
snapshot_revision:                   1
content_checksum (THE version identity = artifact BEGIN/END region sha256):
  17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c
normalized_content_length:           17522            # provenance only (no live column)
status_markers (integrity probe, not identity): ✅=19  📋=1  📝=1  ⛔=1
parser_profile_ref:                  nuxt-incomex-portal-constitution-v1
parser_reference_implementation:     nuxt-incomex-portal-constitution-v1.refimpl.r1
parser_reference_source: >-
  doc3 rev3 — knowledge/dev/laws/dieu44-trien-khai/v0.5-constitution-nuxt-parser-reference-implementation-authoring/dot-iu-cutter-v0.5-constitution-nuxt-parser-reference-implementation-draft-2026-05-18.md (revision 3)
reference_script_sha256 (PROVENANCE ONLY, NOT identity — GPT R-RI2):
  8f6220c9b346a21b823cc41c12c886cb5f51ef4ab557806d2137ad78a1d08e29
raw_fetch_checksum (FORENSIC ONLY, never identity, never a drift gate):
  e8aa7f93e400210e470218ca4bda98161674a6155527cca9a0f3f20e03f440b4
captured_from_live_url:              https://vps.incomexsaigoncorp.vn/knowledge/dev/laws/constitution
snapshot_captured_at:                2026-05-18T13:03:03Z
source_document_ref:                 incomex-constitution
deterministic_document_version_id:
  rule (UNCHANGED — GPT Q2): 'icxconst-' || left( sha256_hex( content_checksum || '|' || source_document_ref ), 32 )
  inputs: content_checksum=17660443…cae80c , source_document_ref='incomex-constitution'
  precomputed_expected_value: icxconst-008a06ace23a96ea6cd456146e805c97
  derivation (read-only local sha256, reproducible):
    sha256("17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c|incomex-constitution")
      = 008a06ace23a96ea6cd456146e805c97a64bb92f415b06f4c08ae73ba3469554
    left 32 hex -> 008a06ace23a96ea6cd456146e805c97
  identity_property: depends ONLY on (content_checksum, source_document_ref);
                     NOT on any wall-clock timestamp. The RULE is unchanged; the VALUE
                     differs from the prior live-page draft because the checksum input
                     is now the pinned snapshot region sha256.

2. LIVE target schema (grounding basis below; KB-confirmed, PRE-re-confirmed)

Grounding note: This session's read-only role context_pack_readonly on db directus can see only information_schema, pg_catalog, public (no USAGE on cutter_governance); a live cutter_governance introspection returned 0 rows for that reason, NOT because the tables are absent. The schema below is the KB read-only-confirmed live shape (WS-Q5 reauthorized catalog verification 2026-05-18 + status-marker-amendment NEG checks + restart package §2) and is re-confirmed by PRE-checks (verification-plan §1) at command-review/execution time. Adapt to LIVE columns only (QG4); design-only columns are excluded and routed to provenance jsonb.

cutter_governance.source_document_registry:
  source_document_ref  text  PK  NOT NULL
  address_docprefix    text  NOT NULL  UNIQUE uq_source_document_registry_docprefix
  source_url           text  NULL
  source_family        text  NOT NULL  FK fk_source_document_registry_family
                                       -> source_family_registry(source_family)
  authority_class      text  NOT NULL
  display_vi           text  NULL
  display_en           text  NULL
  lifecycle            text  NOT NULL
  registered_by        text  NOT NULL
  registered_at              NOT NULL
  rows_now: 0

cutter_governance.source_document_version_registry:
  document_version_id   text  PK  NOT NULL
  source_document_ref   text  NOT NULL  FK fk_sdvr_source_document
                                        -> source_document_registry(source_document_ref)
  content_checksum      text  NOT NULL
  retrieval_timestamp         NOT NULL
  source_format         text  NULL
  authoritative_version text  NULL
  version_status        text  NULL
  provenance            jsonb NULL
  registered_by         text  NOT NULL
  registered_at               NOT NULL
  UNIQUE (source_document_ref, content_checksum)  uq_sdvr_doc_checksum
  rows_now: 0

NOT live (design-only) -> routed into provenance jsonb + this plan/report:
  parser_profile_ref, parser_reference_implementation, parser_reference_source,
  raw_checksum, normalized_content_length, snapshot_artifact_path/revision/checksum,
  marker_counts, grammar_profile_ref (DERIVED via source_family),
  supersedes_document_version_id, live_url_role

3. Executable-for-review seed DML (ATOMIC — one transaction, NOT executed)

-- =====================================================================
-- dot-iu-cutter v0.5 — Constitution source_document + source_document_version
-- ATOMIC SEED  (authored 2026-05-18; identity = PINNED SNAPSHOT artifact)
-- STATUS: NOT EXECUTED. For GPT command-review only.
-- Intended execution role (later, separately-gated): workflow_admin
-- PRECONDITION (operator/runtime, see verification-plan §1A): the snapshot
--   artifact MUST be re-read and its BEGIN/END region rehashed == 17660443…
--   BEFORE this transaction is run. Live-URL fresh checksum is NOT the gate.
-- No ON CONFLICT (tables empty; collisions MUST surface, not be swallowed).
-- No UPDATE / no DELETE / no other documents / no schema change.
-- =====================================================================
\set ON_ERROR_STOP on

BEGIN;

-- --- Row 1: source_document_registry (parent) -----------------------
-- source_url is the DISCOVERY / current URL only (live_url_role=discovery_only).
INSERT INTO cutter_governance.source_document_registry
  (source_document_ref, address_docprefix, source_url, source_family,
   authority_class, display_vi, display_en, lifecycle,
   registered_by, registered_at)
VALUES
  ('incomex-constitution',
   'ICX-CONST',
   'https://vps.incomexsaigoncorp.vn/knowledge/dev/laws/constitution',
   'internal_incomex_constitution',
   'authoritative',
   'Hiến pháp Kiến trúc Hệ thống Incomex',
   'Internal Incomex Architecture Constitution',
   'active',
   'constitution-source-seed',
   now());

-- --- Row 2: source_document_version_registry (child, FK -> Row 1) ---
-- document_version_id computed in-transaction from the PINNED SNAPSHOT
-- content_checksum + source_document_ref (deterministic, timestamp-independent).
-- Expected value: icxconst-008a06ace23a96ea6cd456146e805c97
-- retrieval_timestamp = the snapshot capture instant (faithful to the pinned
--   artifact; NOT identity). registered_at = now() (seed time).
INSERT INTO cutter_governance.source_document_version_registry
  (document_version_id, source_document_ref, content_checksum,
   retrieval_timestamp, source_format, authoritative_version,
   version_status, provenance, registered_by, registered_at)
VALUES
  ( 'icxconst-' || left(
        encode( sha256( ( '17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c'
                          || '|' || 'incomex-constitution' )::bytea ), 'hex' ), 32 ),
    'incomex-constitution',
    '17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c',
    TIMESTAMPTZ '2026-05-18T13:03:03Z',
    'normalized_snapshot',
    'v4.6.3 BAN HÀNH',
    'snapshot_captured',
    jsonb_build_object(
      'identity_basis',                  'snapshot_artifact_region_sha256',
      'snapshot_artifact_path',          'knowledge/dev/laws/dieu44-trien-khai/snapshots/constitution/constitution-normalized-17660443e0f23e99.md',
      'snapshot_revision',               1,
      'snapshot_artifact_checksum',      '17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c',
      'normalized_content_length',       17522,
      'marker_counts',                   jsonb_build_object('enacted',19,'controlled_draft',1,'draft',1,'obsolete',1),
      'captured_from_live_url',          'https://vps.incomexsaigoncorp.vn/knowledge/dev/laws/constitution',
      'snapshot_captured_at',            '2026-05-18T13:03:03Z',
      'parser_profile_ref',              'nuxt-incomex-portal-constitution-v1',
      'parser_reference_implementation', 'nuxt-incomex-portal-constitution-v1.refimpl.r1',
      'parser_reference_source',         'doc3 rev3 — knowledge/dev/laws/dieu44-trien-khai/v0.5-constitution-nuxt-parser-reference-implementation-authoring/dot-iu-cutter-v0.5-constitution-nuxt-parser-reference-implementation-draft-2026-05-18.md (revision 3)',
      'reference_script_sha256',         '8f6220c9b346a21b823cc41c12c886cb5f51ef4ab557806d2137ad78a1d08e29',
      'reference_script_sha256_note',    'provenance only, NOT the version identity (GPT R-RI2)',
      'changelog_included',              true,
      'authoritative_span',              'candidate_B (H1 "HIẾN PHÁP" -> end CHANGELOG, excl trailing "Back to Knowledge Hub" backlink)',
      'raw_checksum',                    'e8aa7f93e400210e470218ca4bda98161674a6155527cca9a0f3f20e03f440b4',
      'raw_checksum_note',               'FORENSIC ONLY (fetch1/3; Nuxt-render-volatile; never identity, never a drift gate)',
      'source_title',                    'HIẾN PHÁP KIẾN TRÚC HỆ THỐNG INCOMEX — v4.6.3 BAN HÀNH',
      'observed_version_label',          'v4.6.3 BAN HÀNH',
      'live_url_role',                   'discovery_only',
      'b6_ruling',                       'CLOSED 2026-05-18',
      'sc3_disposition',                 'CLOSED_BY_REFIMPL_R1',
      'supersedes_document_version_id',  null
    ),
    'constitution-source-seed',
    now() );

-- Atomic: both rows succeed together or neither persists.
COMMIT;
-- expected: INSERT 0 1 ; INSERT 0 1 ; COMMIT

4. Field-by-field authority

source_document_registry:
  source_document_ref  'incomex-constitution'      : stable logical key (ratification version-plan §2)
  address_docprefix    'ICX-CONST'                 : BR-A1 / canon §4; UNIQUE-enforced
  source_url           <given>                     : DISCOVERY/current URL ONLY (provenance.live_url_role=discovery_only)
  source_family        'internal_incomex_constitution' : LIVE FK target (1 of 3 seeded families)
  authority_class      'authoritative'             : task §4 + GPT R4 (v4.6.3 BAN HÀNH, enacted/official)
  display_vi           'Hiến pháp Kiến trúc Hệ thống Incomex'
  display_en           'Internal Incomex Architecture Constitution'
  lifecycle            'active'                     : WS-Q5 LCV-1 (all seeded = active)
  registered_by        'constitution-source-seed'   : provenance principal (distinct from ws-q5-seed-bootstrap)
  registered_at        now()                        : set at execution; NOT identity
source_document_version_registry:
  document_version_id  computed                     : UNCHANGED rule §1; expected icxconst-008a06ace23a96ea6cd456146e805c97
  source_document_ref  'incomex-constitution'       : FK -> Row 1
  content_checksum     17660443…cae80c              : PINNED SNAPSHOT region sha256 — THE identity (NOT live page)
  retrieval_timestamp  2026-05-18T13:03:03Z         : faithful to snapshot capture instant; NOT identity (see OPEN-DECISION-2)
  source_format        'normalized_snapshot'        : identity binds to the normalized snapshot artifact, not raw html (see OPEN-DECISION-3)
  authoritative_version 'v4.6.3 BAN HÀNH'           : LABEL only, never identity
  version_status       'snapshot_captured'          : minimal lifecycle (GPT Q4); cut-eligibility is a later gate (see OPEN-DECISION-1)
  provenance (jsonb)   snapshot_* + parser_* + refimpl + live_url_role=discovery_only + supersedes=null : GPT R-PP1/Q5 (no schema change)
  registered_by        'constitution-source-seed'
  registered_at        now()

5. Open decisions flagged for GPT command-review

OPEN-DECISION-1 version_status:
  authored value: 'snapshot_captured'  (GPT Q4 explicitly allows 'fetched' OR 'snapshot_captured')
  alternative:    'fetched' (consistency with prior restart draft)
  rationale for chosen: identity is now a pinned, rehash-verified snapshot artifact —
    'snapshot_captured' is the more accurate minimal value; still NOT a cut-ready signal.
  gate: GPT picks the canonical value at command-review.
OPEN-DECISION-2 retrieval_timestamp:
  authored value: TIMESTAMPTZ '2026-05-18T13:03:03Z' (the snapshot capture instant — faithful, deterministic)
  alternative:    now() (seed/registration time, as prior restart draft used)
  note: NOT part of identity either way (document_version_id is timestamp-independent).
OPEN-DECISION-3 source_format:
  authored value: 'normalized_snapshot' (the row's content_checksum is the normalized snapshot region hash)
  alternative:    'html/nuxt_snapshot'  (records the upstream capture medium)
  note: LIVE column is free text NULL; upstream medium is fully recorded in provenance regardless.

6. Scope & safety assertions

seeds_only:               Constitution source_document + source_document_version (QG5)
other_documents_seeded:   0
atomic:                   single BEGIN/COMMIT, child references parent in same tx
version_identity:         pinned snapshot region sha256 17660443…cae80c (QG1; NOT live page)
document_version_id_rule: UNCHANGED (QG3)
on_conflict:              NONE — justified: both tables 0 rows; any collision is a
                          production-state mismatch that MUST surface, not be masked
update_delete:            NONE authored
parser/refimpl/snapshot:  provenance jsonb + this plan/report (GPT R-PP1; no schema change)
identity_timestamp_free:  document_version_id = f(content_checksum, source_document_ref) only
grammar/status_marker/source_family tables: NOT touched (read-only referenced)
execution:                NONE (QG5); intended role workflow_admin later
adapts_to_LIVE_schema_only: yes (QG4; design-only columns excluded -> provenance)

7. Statement

• Executable-for-review atomic DML binds source_document_version.content_checksum to the pinned snapshot artifact region sha256 17660443…cae80c, not the live page (QG1). Snapshot rehash precondition referenced (QG2; detailed in verification-plan §1A). document_version_id rule unchanged → expected icxconst-008a06ace23a96ea6cd456146e805c97 (QG3). Strictly KB-confirmed LIVE columns; design-only routed to provenance (QG4). Nothing executed (QG5). Constitution-only; enacted_only/Điều 44 untouched (QG6).
• doc 2 of 5; STOP after package → route GPT/User. Self-advance PROHIBITED.

Companion: operational-framing, rollback-draft, verification-plan, authoring-report.