6000x-authority-closeout — Section B · Nuxt PR open (not merged)

Verdict: DONE — PR opened with strict scope; merge deferred to frontend/DevOps.

Authority discovery

gh auth status shows admin/push permission on Huyen1974/web-test. The 6000x report's "frontend/DevOps owns push" was a labelling assumption, not a token limitation. User authorised PR-open scope; merge stays with the team.

Workflow safety analysis

• deploy-vps.yml only fires via workflow_run after Nuxt CI on main → cannot fire on PR or feat-branch push.
• deploy.yml (Terraform Deploy) builds gates; directus_deploy job gated to workflow_dispatch → no deploy on push/PR.
• Other workflows: build/lint only.

What was pushed

• Branch: feat/iu-core-three-axis-envelope
• Commit: e6a5659
• 3 files changed, 252 insertions(+):
  • A web/composables/useIuThreeAxis.ts (2813 bytes, factory output)
  • A web/pages/admin/iu-three-axis.vue (6124 bytes, factory output)
  • M web/nuxt.config.ts (+6 lines runtimeConfig.public iuCoreDirectusCollection)

Constitutional boundary checks

• No pg/postgres/psycopg references in pushed files (grep).
• All reads via useDirectus<> + @directus/sdk.
• Collection name env-driven: IU_CORE_DIRECTUS_COLLECTION (fallback iu_three_axis_envelope).

PR

• URL: https://github.com/Huyen1974/web-test/pull/669
• State: OPEN, MERGEABLE, not draft
• Base: main; Head: feat/iu-core-three-axis-envelope
• Created: 2026-05-24T01:54:41Z

Triggered CI

Nuxt 3 CI, Critical File Guard, E2E Tests, required-docs-guard, Enforce Table Rule, Terraform Deploy (build gates only). deploy-vps.yml and post-deploy-e2e.yml correctly did NOT fire.

Remaining work (owner: frontend/DevOps)

1. Review PR.
2. Merge to main → image rebuild → incomex-nuxt restart.
3. Smoke /admin/iu-three-axis route.

Rollback

• Pre-merge: gh pr close 669 && git push origin --delete feat/iu-core-three-axis-envelope
• Post-merge: git revert <merge-sha> — frontend-only, PG/Directus/Qdrant unaffected.