dot-iu-cutter v0.5 — W-4 · Current Writer Readiness

Phase: v0_5_w4_credential_signing_production_adapter_readiness · Date: 2026-05-19 · doc 1 of 6 Authorized by GPT ruling …cutwrite-db-isolated-writer-gpt-ruling-2026-05-19 (W-3 CLOSED_PASS → next macro = W4 credential/signing + prod-adapter readiness; production_write NOT authorized).

kb_read: confirmed · kb_upload: confirmed (this doc)
production_mutation: NONE · git: none this phase · self_advance: PROHIBITED

1. Repo / writer state (read-only, re-verified)

repo:   /Users/nmhuyen/iu-cutter-build/repo/iu-cutter
branch: feature/constitution-snapshot-mark-dryrun
HEAD:   f0120ac018b8942fdafaf105923b0e6f8dba6b40   (W-3 cutwrite commit; unchanged)
log:    f0120ac cutwrite | d66a60d cutplan | afb7bfc MARK | 4367c83 baseline
working_tree: clean (git status --porcelain empty)
file_sha256 (byte-exact == W-3 pinned):
  cutter_agent/cutwrite.py  31ce88dca8f68abd1bff484d665235f396272b0b4f64448812de8a93a1f901d3
  cutter_agent/dryrun.py    f1f42e83ca23ba0b328f79cf04a8391ac699d1b307eb1b22b52c305f2efa1422
  cutter_agent/cutplan.py   548eabc5530260555ff448ce6f3acded9728fe51c4ae61de658e9a97c4d828f1

2. Tests re-run this phase (no DB env; net-zero)

tests.test_cutwrite_snapshot   : Ran 22 tests … OK
tests.test_dryrun_snapshot_mark: Ran 21 tests … OK
tests.test_cutplan_snapshot    : Ran 15 tests … OK

3. Current writer posture (still DB-isolated only — confirmed)

cutwrite.py mode: ONLY db-isolated-dryrun. Production mode is REFUSED (exit 2). It is
  import-isolated (stdlib + only cutter_agent.dryrun); imports NO psycopg / db_adapter /
  phases / ledger / signal / signing ⇒ it CANNOT open a production DB by construction.
fail-closed production refusal is ALREADY PROVEN by the committed W-3 test suite
  (TestFailClosed): wrong mode ⇒ exit 2; any DB env var set ⇒ exit 2; missing
  --no-production/--fail-closed/--exclude-dieu-44 ⇒ exit 2. No new guard code is needed
  for "production mode refuses without approval/credentials" — it holds at f0120ac.
production_DB_connection: NONE. production_mutation: NONE.

4. What this phase did / did NOT do

did: read-only investigation of credential/signing requirements (doc 2), production
  schema/role/grant drift (doc 3), and production-CUT command-review readiness (doc 4-5);
  re-ran the writer suites; authored this 6-doc readiness package.
did_NOT: no code change (cutwrite.py preserved byte-exact at the ratified W-3 sha — a
  speculative production adapter is NOT authored because the credential/grant TARGET is
  unresolved, see doc 4 GAP-C1/C2; authoring against an unknown grant surface would be
  guessing); no commit/merge/push/tag; no production DB write; no CUT/VERIFY; no DB
  connection; no source/version mutation; no self-advance.

doc 1 of 6. No production mutation. Self-advance PROHIBITED.