dot-iu-cutter v0.5 — Final Execution Approval Readiness Report

doc 4 of 4 · 2026-05-20 · STOP → route GPT/User

result   : A — READY_FOR_GPT_GRANT_AND_PRODUCTION_CUT_EXECUTION_APPROVAL
kb_read  : confirmed (this session ; 7 prior approval docs + 3 GPT rulings)
kb_upload: confirmed (this doc + 3 preceding docs of this package)
production_mutation : NONE
self_advance        : PROHIBITED

1. Outcome

result : A — READY_FOR_GPT_GRANT_AND_PRODUCTION_CUT_EXECUTION_APPROVAL
why honest (not premature) :
  - GAP-A1 closed by R1 : --mode production-leg-a-only authored, unit-
    tested (37/37 prod_adapter + 95/95 targeted), and committed on the
    feature branch ONLY (no push/merge/tag possible — no remote configured).
  - GD-1 closed by sovereign ruling : apply principal = directus (owns
    public.*) ; the doc-3 GRANT delta + 18-probe verifier are ready.
  - UB-2 in force : the first CUT writes ONLY leg-A (180 statements,
    1 atomic txn) ; leg-B governed recording deferred to the separate
    post-CUT package (audit-debt window ≤24 h ; doc 6 of the prior pkg).
  - Adapter still REFUSES to connect by default (default _default_provider
    raises ProductionAccessNotAuthorized) ; cutprod refuses without all
    five sovereign-intent flags AND a sovereign-authored connection-
    provider module (NOT in this repo).
  - Live PG re-verified read-only this session : zero drift (IU 19, UV 16,
    L1 f38c94d0…, L2 078ba005…, vocab 6/6) ; ICX-CONST = 0 ; cutter_exec /
    cutter_verify grants still ABSENT (as expected ; closed by U-W4b).

2. What this package added vs the prior approval package

new commit                 : 152e7db → f20c79c on feature branch (3 files
                             modified ; 487 / 25 lines ; ratified cutwrite.py
                             byte-unchanged 31ce88dc…).
new tests                  : +17 R1 tests ; total 95/95 targeted PASS.
new runnable               : --mode production-leg-a-only in cutprod ; new
                             ProdIuBirthAdapter.execute_leg_a_only seam.
new sovereign-intent flags : --i-have-grant-execution-approval-kb-id ·
                             --production-intent · --fresh-backup-sha256 ·
                             --connection-provider-module (in addition to
                             the pre-existing --i-have-sovereign-production-
                             write-approval).
unchanged                  : verification plan (VW-1..VW-12) · rollback/
                             compensation doctrine · leg-B governed-recording
                             obligation · pinned identity (digest, region,
                             writer_digest, source-version).

3. Required sovereign approvals — exactly four remaining EXECUTION gates

A-3  GRANT execution approval (U-W4b)
     ratify executing the doc-3 §2 GRANT delta via apply principal `directus` ;
     operator then runs doc-3 §2.1 structural verification immediately and
     records the relacl snapshot for audit.
     decision authority : GPT / User
     prerequisite        : none (GD-1 ruled directus)
     produces            : KB doc id consumed by --i-have-grant-execution-
                           approval-kb-id

A-4  Production-write approval (C5) for the leg-A CUT (U-W5)
     issue a KB-persisted approval scoped to :
       manifest_digest    : 9d908a62…
       candidate_count    : 60
       writer_digest      : d99a31d4…
       target             : directus.public.information_unit + unit_version
       principal          : cutter_exec
       txn                : single atomic
       append_only        : true ; G-CUT-ONCE : true
       exclusions         : Điều 44, draft, obsolete
       forward_comp_only  : true (R-3 doctrine)
       leg_b              : recorded SEPARATELY post-CUT (UB-2)
     decision authority : GPT / User
     prerequisite        : A-3 closed
     produces            : KB doc id consumed by --i-have-sovereign-
                           production-write-approval

LATER  VERIFY execution approval
     after the CUT commits successfully, sovereign issues a SEPARATE approval
     for cutter_verify to run prior-pkg doc 4 VW-1..VW-12 (DOT-992 ; SoD).
     decision authority : GPT / User

LATER  POST-CUT governed recording approval / package (leg-B)
     after VERIFY closes, sovereign authorises (and the operator runs) the
     SEPARATE 6–7 doc package described in prior-pkg doc 6 §3 to record the
     126 cutter_governance leg-B rows (INV-A..INV-I cross-bindings ; closes
     the audit-debt window).
     decision authority : GPT / User

4. Pre-execution operator checklist (this session does NOT perform any)

[ ] author sovereign-side --connection-provider-module (NOT in this repo) ;
    record its sha256 ; DSN sourced from approved secret store only.
[ ] capture fresh logical backup (≤60 min) of public.* tables in target DB ;
    record sha256 for --fresh-backup-sha256.
[ ] verify caller env clean of {PG_DSN, DATABASE_URL, DIRECTUS_URL,
    PGPASSWORD, PGHOST, PGUSER}.
[ ] run plan-only smoke first (no DB) ; confirm PLAN_OK iu=60 uv=60
    writer_digest=d99a31d4… leg_a_statements=180 leg_b=GAP-B1(unavailable)
    production=REFUSED.
[ ] execute A-3 doc-3 §2 GRANT delta as principal directus ; doc-3 §2.1
    structural verifier returns the EXACT expected row.
[ ] run the doc-3 §3.1 production-leg-a-only command with the resolved
    A-3 + A-4 KB ids + backup sha + sovereign-authored provider module.
[ ] on exit 0 : SoD partner runs prior-pkg doc 4 VW-1..VW-12 (cutter_verify).
[ ] on any non-zero exit : STOP_AND_ESCALATE per prior-pkg doc 5 §6.
[ ] after VERIFY closes : run the SEPARATE post-CUT leg-B recording pkg.

5. Ready-for-execution-approval flags

ready_for_A3_grant_execution_approval     : YES
  rationale : GD-1 ruled directus ; doc-3 §2 GRANT delta minimal & scoped ;
              byte-inverse REVOKE prepared ; 18-probe verifier specified ;
              live state re-verified read-only (cutter_exec / cutter_verify
              still zero on public.*).
ready_for_A4_production_cut_execution_approval : YES
  rationale : R1 runnable command shipped in commit f20c79c with full
              sovereign-intent flag wall ; zero schema drift ; G-CUT-ONCE
              preconditions met (ICX-CONST=0) ; backup gate wired ; 95/95
              targeted tests PASS ; UB-2 leg-B decoupling and post-CUT
              recording obligation honored.
ready_for_LATER_verify_execution_approval : will be requested SEPARATELY
                                            after CUT commits (cutter_verify
                                            DOT-992 ; SoD ; read-only).
ready_for_LATER_legB_recording_pkg_approval : will be authored SEPARATELY
                                              after VERIFY closes (UB-2
                                              audit-debt window ≤24 h).

6. Explicit no-mutation statement for THIS session

production_mutation_this_session :
  - NO production DB write
  - NO information_unit / unit_version / dot_config / cutter_governance.*
    row touched
  - NO GRANT / REVOKE issued
  - NO VERIFY run
  - NO source_document / source_document_version write
  - NO deploy / restart / docker rebuild
  - NO main branch merge ; NO push (no remote configured) ; NO tag
  - NO secret rotation / secret echo / DSN handling
  - all DB env vars (PG_DSN / DATABASE_URL / DIRECTUS_URL / PGPASSWORD /
    PGHOST / PGUSER) absent from the test environment ; tests assert this.
authoring done this session :
  - committed 1 feature-branch commit f20c79c (3 files modified ; +487/-25 ;
    0 new files) ; reversible via git reset --hard 152e7db ; cutwrite.py
    sha unchanged 31ce88dc…
  - uploaded 4 KB docs (this approval-ready package).
read-only actions this session :
  - KB reads (prior package + GPT rulings) and KB uploads (4 docs)
  - PostgreSQL read-only catalog/ACL/constraint/function probes via
    context_pack_readonly role (1 SELECT)
  - local repo + test reads and 95/95 targeted test runs (no DB connect)

7. Final status — disposition

status              : READY_FOR_GPT_GRANT_AND_PRODUCTION_CUT_EXECUTION_APPROVAL
remaining gates     : A-3 (U-W4b GRANT execution) · A-4 (C5 production CUT
                      execution) · LATER (VERIFY) · LATER (leg-B recording)
production_mutation : NONE
self_advance        : PROHIBITED
next_action         : route → GPT / User for A-3 + A-4 execution rulings

doc 4 of 4. No production mutation. Self-advance PROHIBITED.