Checkpoint — Authority Contract v0.1

Date: 2026-06-09 Final status: AUTHORITY_CONTRACT_V0_1_READY_FOR_GPT_REVIEW Production mutation: NO

What was done

Wrote the binding Authority Contract v0.1 for the tool-kiem-thu workstream — recording Codex's sealed B/C/D/G/H plus the already-adopted A/E/F/I/J, the denominator contract, the allowed/prohibited envelope, the existing-authority reuse map, the unresolved/deferred list, and the gate to the next phase (Reuse Extraction Map). No new law, tool, schema, or runner. Nothing implemented, invoked, installed, or mutated. No sealed decision reopened. No denominator collapsed.

Sealed decisions recorded (verbatim)

Domain	Disposition	One-line
A	adopted default	309 dot_tools = catalog of record (listing = live query; frozen 2026-04-02); listing-only.
B	MODIFY → SEALED (opt 5)	filesystem-DOT "can run" NOT AVAILABLE for v0.1; no invoke; presence/run-history ≠ can run.
C	MODIFY → SEALED (opt 5)	read/report only; no calls until a separate call contract; 15 IU mutating=false = future candidate only; no static whitelist/dispatcher.
D	MODIFY → SEALED (opt 1)	canonical current diff = latest code-keyed v_dot_reconciliation_reliability over wf_fs_dot_bin_snapshot; v_dot_registry_no_file = diagnostic only; unmatched = NON-CALLABLE; no reconciliation mutation.
E	adopted default	no direct Directus mutation until 100% DOT-control proven.
F	adopted default	sink = fn_tac_log_checker_issue → system_issues (Đ23); new logger prohibited; v0.1 file-only, write deferred.
G	SEALED	reuse Đ19/Đ23/Đ39/universal_edges/v_kg_edges_all/entity_dependencies; new resolver prohibited until a concrete miss is proven; doc-level canonical-id UNPROVEN.
H	SEALED	no TAC↔IU bridge; dual-report only; no choose/merge/consume/build; corpus authority unresolved.
I	adopted default	v0.1 file-report-only under tool-kiem-thu/; escalate to system_issues only once approved to mutate.
J	adopted default	KB design + /opt/incomex/dot/bin runtime mirror; local checkout (163) ≠ runtime; binds post-spec.

Prohibited actions recorded

New runner authority; filesystem DOT invocation; new registry authority; new logger/sink; new duplicate/graph/orphan resolver; TAC/IU merge/bridge/corpus choice; Directus mutation; registry cleanup/reconciliation mutation; package/schema/tool build before Reuse Extraction Map + approved spec; prose-only PASS; collapsed counts.

Parallel-authority risk — all NO (no new runner / registry / logger / graph-duplicate / TAC-IU corpus authority).

Denominators kept separate (not collapsed)

309 dot_tools/PIV-007 (listing only) · 214 operational files (presence) · 186 mapped/confirmed (reconciliation diagnostic) · 163 CAT-006 actual_count/local (unsafe/unverified) · 54 command catalog (IU surface, not DOT count) · 128 Directus flows / 36 DOT-named (flow surface, not 100% control) · 219 IU & 102 TAC (separate corpora, dual-report only). Every count is dated evidence with surface+query+timestamp+key+population+confidence; never an invariant.

Unresolved / deferred recorded

Call contract for future execution · proof-of-run semantics · Directus 100% DOT-control proof · TAC↔IU bridge/resolver contract · registry cleanup/reconciliation mutation · system_issues wiring timing · Implementation Package DOT actual spec · MVP implementation · fresh-read items (CAT-006 actual_count filter, OS listing of /opt/incomex/dot/bin, /opt/incomex/scripts "42", Đ19/Đ23 inverse-check run).

Documents created / updated

• contracts/authority-contract-v0-1-2026-06-09.md (created)
• contracts/authority-contract-v0-1-2026-06-09.json (created)
• checkpoints/checkpoint-authority-contract-v0-1-2026-06-09.md (this file, created)
• 00-index.md (updated)

Next permitted phase

Reuse Extraction Map (read-only). Not permitted yet: Implementation Package DOT scope spec, verifier code, schema, runner, command invocation.

Source authority

• reviews/codex-seal-authority-matrix-bcdgh-2026-06-09.md (BCDGH_SEALED)
• reports/authority-decision-matrix-draft-after-baseline-2026-06-09.md (A/E/F/I/J)
• reports/dot-registry-directus-text-as-code-baseline-reconciliation-2026-06-09.{md,json} (baseline ledger)