dot-iu-cutter v0.5 — First Controlled CUT · Preflight & Backup Result

doc 1 of 6 · 2026-05-20 · execution attempt of macro: first controlled Constitution CUT (leg-A only), UB-2 decoupled.

phase              : preflight (G0 + G1 + G2)
outcome            : G0 PASS · G1 PASS · G2 BLOCKED
production_mutation: NONE
self_advance       : PROHIBITED

1. Session identity

date                : 2026-05-20
operator            : Agent (Claude Code / Opus 4.7 / 1M ctx)
working_directory   : /Users/nmhuyen
repo                : /Users/nmhuyen/iu-cutter-build/repo/iu-cutter
branch              : feature/constitution-snapshot-mark-dryrun
HEAD                : f20c79cbc867b009bc84e632bf9e23fd9d359728
                      ("feat(R1): add --mode production-leg-a-only + execute_leg_a_only seam (UB-2)")
tree                : clean (git status --short empty)
remote              : not configured (push impossible from this checkout)

2. G0 — SSOT + environment precheck — PASS

KB_read              : confirmed (8 approval docs read fully via batch_read, untruncated)
KB_upload            : confirmed (this report set uploaded; see doc-6 final)
repo_path            : present
branch               : matches approval (feature/constitution-snapshot-mark-dryrun)
HEAD                 : matches approval (f20c79c == ratified post_commit_HEAD)
working_tree         : clean
unexpected_changes   : none
targeted_tests_rerun :
  command : python3 -m unittest tests.test_prod_iu_adapter tests.test_cutwrite_snapshot
                                tests.test_dryrun_snapshot_mark tests.test_cutplan_snapshot
  result  : Ran 95 tests in 0.129s · OK
  status  : 95/95 PASS (matches approval doc 2 of production-legA package)

3. G1 — live drift precheck (read-only, role=context_pack_readonly) — PASS · ZERO DRIFT

target_db                  : directus
production_DB_identity     : confirmed (current_database() = 'directus')
public.information_unit_cols : 19    (== PIN_IU_COLS)
public.unit_version_cols   : 16      (== PIN_UV_COLS)
L1_md5                     : f38c94d0043a61507a8c2e85afd59998   (== PIN_L1_MD5)
L2_md5                     : 078ba0051ce4d894cabcc0102c4320f8   (== PIN_L2_MD5)
ICX_CONST_existing_rows    : 0       (G-CUT-ONCE precondition met)
public.information_unit_total : 98   (matches doc 1 §3 of first-controlled-cut package)
public.unit_version_total  : 105     (matches doc 1 §3)
vocab_dot_config (6/6) :
  vocab.unit_kind.law_unit                  : PRESENT
  vocab.section_type.principle              : PRESENT
  vocab.section_type.section                : PRESENT
  vocab.section_type.article                : PRESENT
  vocab.publication_type.law                : PRESENT
  vocab.publication_authority.incomex_council: PRESENT
grants_on_writer_targets (must be ABSENT pre-GRANT) :
  ce_iu_S=false ce_iu_I=false ce_iu_D=false
  ce_iu_upd_van=false ce_iu_upd_can=false
  ce_uv_S=false ce_uv_I=false
  ce_dc_S=false
  cv_iu_S=false cv_uv_S=false
roles_exist :
  cutter_exec  : present, role exists
  cutter_verify: present, role exists
verdict : ZERO DRIFT vs the pins ratified 2026-05-19 (W-4 doc 5 / Final-Bridge doc 5)
          AND ratified 2026-05-20 (production-legA doc 4 / first-controlled-cut doc 1).

4. G2 — backup creation & verification — BLOCKED

required_by :
  - first-controlled-cut doc 1 §6 "Backup feasibility"
  - first-controlled-cut doc 3 §2 (input pins) "backup_artifact_sha256"
  - updated GRANT+CUT doc 3 §3.4 PC-5
  - rollback/compensation doc 5 §4 (backup is the catastrophic-breach restore target)

specification_quotes (verbatim) :
  PC-5 (production-legA doc 3 §3.4) :
    "fresh logical backup of public.information_unit + unit_version +
     dot_config taken by an authorized operator (NOT the Agent ;
     NOT cutter_exec) ; age ≤ 60 minutes from txn open ; restorability
     test-verified ; sha256 recorded for --fresh-backup-sha256."
  first-controlled-cut doc 1 §6 :
    "by an authorized DB operator (NOT the Agent, NOT cutter_exec)
     age ≤ 60 minutes from the moment cutter_exec opens its CUT transaction
     restorability verified : test-restore the dump into a scratch namespace +
     row-count + sha256 reconciliation on the dump artifact
     artefact sha256 must be logged in the U-W4b/CUT execution log"
  rollback doc 5 §4 :
    "who executes : an authorized DB operator
     (NOT the Agent ; NOT cutter_exec / cutter_verify)."

outcome :
  status                  : BLOCKED
  reason                  : The approval package explicitly forbids the Agent
                            (and cutter_exec / cutter_verify) from taking the
                            backup. No fresh logical backup of
                            directus.public.{information_unit, unit_version,
                            dot_config} exists for this session. No backup sha256
                            has been recorded. Therefore --fresh-backup-sha256
                            cannot be supplied to the CUT command (G3 will
                            independently refuse on this missing flag).

what_was_NOT_done :
  - no pg_dump issued by the Agent (forbidden by spec; Agent has no write/backup path)
  - no restore-into-scratch attempted
  - no sha256 forged or fabricated
  - no backup artefact uploaded to KB

what_is_required_to_unblock_G2 :
  - an authorized DB operator (human or sovereign-controlled service ; not the Agent ;
    not cutter_exec ; not cutter_verify) takes a fresh logical dump of the three tables
    in the directus database, performs the restorability test, records the sha256,
    and stores the artefact per the approval package.
  - the sha256 (64-hex) is logged in this folder before the CUT command is
    issued, so it can be supplied to --fresh-backup-sha256.

5. Disposition

G0 (SSOT + env)        : PASS
G1 (live drift)        : PASS · ZERO drift · all six pins match
G2 (backup)            : BLOCKED — sovereign-operator action required ;
                         Agent forbidden by PC-5 / doc 1 §6 / doc 5 §4
proceed_to_G3_G4_G5_G6 : NO — G2 must close before G3 can be assembled
                         (the CUT command cannot include --fresh-backup-sha256
                          unless an authorized operator's backup sha exists).
production_mutation_this_phase : NONE
self_advance                   : PROHIBITED
next_action                    : route → GPT/User (see doc 6 of this report set)

doc 1 of 6. No production mutation. Self-advance PROHIBITED.