dot-iu-cutter v0.5 — Constitution Source Seed FROM SNAPSHOT: Production Execution Log (RERUN, capable env)

Phase: v0_5_constitution_source_seed_from_snapshot_production_execution_rerun_capable_env · Date: 2026-05-18 · doc 1 of 3

execution_status: PASS
dml_executed: TRUE ; rows_inserted: 2 (atomic) ; backup_taken: TRUE ; rollback: NOT_NEEDED
dml_source: KB approved revised package (revision 2) — used VERBATIM, no adaptation
dry_run: none ; cut: none ; verify(registry op): none ; directus_mutation: none ; git_commit: none
authority: GPT final command-review + execution approval 2026-05-18 + environment-blocked review (rerun same package from capable env)
channel: SSH contabo (38.242.240.89) -> docker `postgres` (postgres:16) -> psql role workflow_admin -> db directus
decision_authority: GPT / User ONLY ; self_advance: PROHIBITED

The prior session blocked correctly (read-only env). This rerun used the GPT-recommended capable channel (Contabo SSH → docker postgres → workflow_admin). The approved revised DML was applied verbatim from KB (no re-authoring, no on-the-fly change).

---

1. Environment capability (verified, not assumed)

ssh_contabo: OK (root@vmi3080463) ; docker container `postgres` image postgres:16
db_role_for_apply: workflow_admin (has_schema_privilege USAGE on cutter_governance = true)
db: directus ; system_identifier = 7611578671664259111 (production target)
local_tools: ssh, pg_dump, psql present
note: MCP query_pg (context_pack_readonly) NOT used for apply (GPT-forbidden);
      apply done strictly via workflow_admin over SSH.

2. P1–P5 prechecks (read-only, recorded BEFORE backup/DML)

P1_target:
  system_identifier == 7611578671664259111            : PASS
  cutter_governance schema exists                      : PASS
  source_document_registry exists                      : PASS
  source_document_version_registry exists              : PASS
P2_supporting_registry_state:
  source_family 'internal_incomex_constitution' exists : PASS
    grammar_profile_ref = incomex-architecture-constitution-v4
    status_policy        = enacted_only
  grammar_profile 'incomex-architecture-constitution-v4' exists (count=1) : PASS
  grammar_profile_status_marker (4 rows, exact map)    : PASS
    📋->controlled_draft, 📝->draft, ✅->enacted, ⛔->obsolete  (count=4)
P3_existing_source_rows (clean target):
  source_document_ref 'incomex-constitution'           : ABSENT (0) PASS
  address_docprefix 'ICX-CONST'                        : ABSENT (0) PASS
  document_version_id 'icxconst-008a06ace23a96ea6cd456146e805c97' : ABSENT (0) PASS
  any source_document_version for incomex-constitution : ABSENT (0) PASS
  both tables totals                                   : 0 / 0 PASS
P4_snapshot_rehash_gate (true stored bytes, agent-data store incomex_metadata.kb_documents):
  artifact path exact                                  : PASS
  artifact revision == 1                               : PASS (data->>'revision' = 1)
  region (strict BEGIN/END, sentinels excluded, no trailing newline) sha256
    = 17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c : PASS (EXACT, recomputed on VPS)
  region length (chars) = 17522                        : PASS
  region byte length (UTF-8) = 20220                   : informational (multibyte; identity is sha256, not bytes)
  marker counts = enacted 19 / controlled_draft 1 / draft 1 / obsolete 1 : PASS
  parser_profile_ref / parser_reference_implementation / reference_script_sha256 present & match : PASS
  method: JSON-decoded kb_documents.data->'content'->'body', extracted region, sha256 on VPS python3
P5_command_integrity:
  revised DML == KB approved package (rev 2)           : PASS (verbatim; sha256 of apply file recorded)
  INSERT-only ; one BEGIN/COMMIT ; \set ON_ERROR_STOP on : PASS
  no UPDATE / no DELETE / no ON CONFLICT               : PASS
  document_version_id = literal (no DB sha256/pgcrypto): PASS
  insert column lists == live columns (exact)          : PASS
  no schema/GRANT/index/Directus                       : PASS
OVERALL_PRECHECK_GATE: PASS (all P1–P5)

3. Fresh backup (after prechecks PASS, before DML)

required: true
method: docker exec postgres pg_dump -U workflow_admin -d directus -n cutter_governance
        --no-owner --no-privileges  (schema-scoped: only mutated schema; proportionate, restorable)
path: /root/backups/constitution-source-seed/cg_pre_constitution_source_seed_20260518T151101Z.sql.gz
timestamp_utc: 2026-05-18T15:11:01Z
size_bytes: 9134 (gzip)
sha256: c1a87f2f2c70f48439fa31559156b3c5a28ba04588c0313769519fd85e8cad25
integrity_marker: gzip OK ; pre-state (source tables empty 0/0 captured)
secrets: none (governance registry schema dump only)
apply_file_on_vps_sha256: 6315a09740409657e68acae8a132f9ef4725c197adedab7626301a7df1257e24 (4723 B)

4. DML execution

command: docker exec postgres psql -U workflow_admin -d directus -v ON_ERROR_STOP=1 -f /tmp/icx_seed.sql
transaction: single BEGIN ... COMMIT (atomic)
output:
  BEGIN
  INSERT 0 1
  INSERT 0 1
  COMMIT
exit_code: 0
rows_inserted: 2  (source_document_registry +1 ; source_document_version_registry +1)
rollback: NOT NEEDED (clean commit; verification PASS)
scratch_cleanup: /tmp/icx_seed.sql (container) + /root/icx_seed.sql (vps) + local file removed; backup retained

5. Forbidden-actions compliance

no_reauthoring / no_DML_adaptation:        TRUE (verbatim KB rev 2)
no_skip_prechecks / no_skip_backup:        TRUE (all P1–P5 + backup done first)
no_other_source_document/version_seeded:   TRUE (exactly 2 rows, the approved pair)
no_update_existing / no_ON_CONFLICT:       TRUE
no_runtime_db_sha256:                      TRUE (literal id)
no_dry_run / CUT / VERIFY:                 TRUE
no_schema_change / GRANT / index DDL:      TRUE
no_directus_mutation / vector-NoSQL:       TRUE
no_deploy_restart / git_commit:            TRUE
no_self_advance:                           TRUE (STOP after 3 reports)

6. Statement

• Capable-env rerun: P1–P5 PASS → fresh backup → exact approved DML applied as workflow_admin in one atomic transaction (INSERT 0 1; INSERT 0 1; COMMIT, exit 0). 2 rows seeded; nothing else mutated; no dry-run/CUT/VERIFY. execution_status = PASS.
• doc 1 of 3; STOP after 3 files → route GPT/User. Self-advance PROHIBITED.

Companion: production-verification-result, production-report.