dot-iu-cutter v0.5 — Cut-plan Dry-run & Writer Decision · Cut-plan Dry-run Readiness + Result

Phase: v0_5_cutplan_dryrun_and_writer_decision_package · Date: 2026-05-19 · doc 1 of 6 Authorized by GPT ruling …s2-planner-commit-writer-bridge-gpt-ruling-2026-05-19 (P3_cutplan_dryrun: "run or prepare the first no-DB cut-plan dry-run … if safely possible", mutation artifact_only).

kb_read: confirmed · kb_upload: confirmed (this doc)
result: CUTPLAN_DRYRUN_PASS · production_mutation: NONE · self_advance: PROHIBITED

1. Pre-run readiness (read-only)

repo_path:   /Users/nmhuyen/iu-cutter-build/repo/iu-cutter
branch:      feature/constitution-snapshot-mark-dryrun
HEAD:        d66a60d9d7d11d60366825b08e0ea3d5d2d6aeef   (== committed S2 planner)
working_tree: clean (git status --porcelain empty), unchanged after the run
file_sha256 (byte-exact == pinned):
  cutter_agent/cutplan.py            548eabc5530260555ff448ce6f3acded9728fe51c4ae61de658e9a97c4d828f1
  tests/test_cutplan_snapshot.py     06e871e73496089f5a88f072fb0a1e4f5d4ac720e1cb73bd737bc12d699a578a
  cutter_agent/dryrun.py             f1f42e83ca23ba0b328f79cf04a8391ac699d1b307eb1b22b52c305f2efa1422
  tests/fixtures/constitution-normalized-17660443e0f23e99.md  5c76eedd…96c7f1b
  constitution-normalized-17660443e0f23e99.md (repo-root mirror, byte-identical) 5c76eedd…96c7f1b
safety_basis: cutplan is import-isolated stdlib-only, artifact-only, requires
  --no-db-write/--no-cut/--no-verify/--exclude-dieu-44, refuses any DB env var ⇒ net-zero
  by construction. The run was executed with all DB env vars unset, out-dir in ephemeral
  /tmp scratch OUTSIDE the repo. ⇒ safely runnable; RUN (not just command-review).

2. Input manifest — N-1 deterministic regeneration + sha-verify (the C-3 gate)

method: reconstructed manifest.json into ephemeral /tmp via the EXACT ratified path the
  green S2 test uses — cutter_agent.dryrun.extract_region → snapshot_gate → build_manifest
  over the committed pinned fixture (region sha 17660443…cae80c, len 17522,
  markers enacted19·controlled_draft1·draft1·obsolete1, source_version
  icxconst-008a06ace23a96ea6cd456146e805c97). NOT a MARK CLI re-run; NOT a KB overwrite;
  no DB; net-zero; byte-identical to the accepted manifest.
verify:
  manifest.json file sha256   = 7d56f3ce066950ccef3de4156c5afeea81b2450b8e38393205b52c1fca012179  ✓ == pinned
  declared manifest_digest    = 9d908a62fcf01bb88e05a1af4335b960710006ddcfd21c811ca63efb33dd324f  ✓ == pinned
  candidate_count = 60 · excluded_count = 4   ✓
verdict: N-1 C-3 PASS — full manifest body byte-verified before the cut-plan run.

3. Cut-plan dry-run command (executed; net-zero)

env -u PG_DSN -u DATABASE_URL -u DIRECTUS_URL -u PGPASSWORD -u PGHOST -u PGUSER \
python3 -m cutter_agent.cutplan \
  --mode cut-plan-only --no-db-write --no-cut --no-verify --fail-closed --exclude-dieu-44 \
  --manifest "$WD/manifest.json" \
  --expect-manifest-digest    9d908a62fcf01bb88e05a1af4335b960710006ddcfd21c811ca63efb33dd324f \
  --expect-manifest-file-sha  7d56f3ce066950ccef3de4156c5afeea81b2450b8e38393205b52c1fca012179 \
  --expect-candidate-count    60 \
  --source-version-id         icxconst-008a06ace23a96ea6cd456146e805c97 \
  --docprefix ICX-CONST --scope enacted_only \
  --out-dir "$WD/cutplan" --emit cut_plan.json,write_set_preview.jsonl,iu_mapping_preview.json,idempotency_keys_preview.json,dryrun_report.md
# $WD = mktemp -d /tmp/icx-const-cutplan.XXXXXX  (chmod 700, OUTSIDE the repo)

4. Result — PASS

exit_code: 0 · status: PASS · mode: cut-plan-only
db_write: NONE · production_touched: false
candidate_count: 60 · excluded_count: 4 · dieu_44_excluded: true · reconstruction_ok: true
manifest_digest_sha256: 9d908a62fcf01bb88e05a1af4335b960710006ddcfd21c811ca63efb33dd324f
cut_plan_digest_sha256: edcae74f815fdb6dbc025c32d627de823f095489a3ba4a813eb513f05198ef6c
re_run_equal: true   (second independent run into a separate out-dir → identical cut_plan_digest)
artifacts_emitted: cut_plan.json, write_set_preview.jsonl, iu_mapping_preview.json,
  idempotency_keys_preview.json, dryrun_report.md  (5/5, see doc 2 for sizes+sha256)

Note: cut_plan_digest edcae74f… equals the value recorded from the in-test S2 run (prior phase) — determinism proven across session/environment.

5. Post-run cleanup / no-mutation

scratch: /tmp/icx-const-cutplan.* shredded (rm -rf) after evidence capture.
repo: working tree clean, HEAD still d66a60d (unchanged), no file added/modified/committed.
production: NONE. No DB/IU/Directus/vector write. No CUT/VERIFY. No source/version mutation.
git: no commit/merge/push/tag/deploy this phase.

doc 1 of 6. Artifact-only run, net-zero. No production mutation. Self-advance PROHIBITED.