Checkpoint — Implementation Package DOT v0.1 Feasibility Plan

Date: 2026-06-09 · Status: PLAN_DRAFT_READY · Production mutation: NO Task nature: planning / audit only. No implement, no install, no production mutation, no law authored, no FIX7 recheck resumed.

1. Objective

Produce a first practical, reuse-first plan for a reusable testing / implementation-package verification framework ("Implementation Package DOT v0.1") that catches the FIX7 failure class (prose claims an executable that does not actually run), grounded in the actual current system state, centralized under knowledge/dev/laws/tool-kiem-thu/.

2. What was inspected (read-only)

• KB (agent-data MCP — SSOT for knowledge/dev/…):
  • Điều 23 DOT Scanning — knowledge/dev/architecture/dot-scanning-system.md (tam quyền; "Không có DOT = không deploy"; system_issues sink).
  • Đ38 Text-as-Code — knowledge/dev/laws/dieu38-trien-khai/ (HOW-TO-READ, P5/P5b, P6 checker/DOT, P11E checker-proof = checker_run_status contract, P9-G6 dry-run).
  • Đ43 Context Pack — knowledge/dev/laws/dieu43-system-context-law.md v1.2 + scripts knowledge/dev/dot/dot-context-pack-{build,verify}.sh (paired DOT, sha256, hardcode-ban).
  • Đ35 DOT Governance v5.2 — dot_registry/dot_config; CAT-006 dot_tools (309).
  • FIX7 pain point — …/codex-fix7-blueprint-recheck-8-…/06-constitution14-executable-check-recheck.md (verdict CONSTITUTION_14_EXECUTABLE_CHECK_FAIL, 5 verbatim failure modes).
  • Constitution v4.6.3 (rev 44) Article 14 / NT14 (via council/SSOT notes).
• Local filesystem (/Users/nmhuyen):
  • Toolchain present: python3, pip3, node, npm, jq, docker, git, go, trivy, shasum, brew 5.1.14, pyyaml.
  • Absent: opa, conftest, squawk, gpg, yq, cargo, jsonschema, pydantic.
  • dot-iu-cutter runnable verifier: /Users/nmhuyen/iu-cutter-build/repo/iu-cutter/cutter_agent/dryrun.py (stdlib-only, import-isolated, sha256 precheck, fail-closed, selftest) — gold-standard template.
  • knowledge/dev on disk has no laws/ and no .git ⇒ the central folder is realized in the KB.

3. What was produced (KB documents created)

Path	Kind
knowledge/dev/laws/tool-kiem-thu/README.md	central folder readme
knowledge/dev/laws/tool-kiem-thu/00-index.md	index
knowledge/dev/laws/tool-kiem-thu/planning/implementation-package-dot-v0-1-feasibility-plan-2026-06-09.md	the plan
knowledge/dev/laws/tool-kiem-thu/checkpoints/checkpoint-…-2026-06-09.md	this checkpoint

4. Key conclusions

• Existing framework: PARTIAL. Contracts + templates exist (Đ23 gate, P6 taxonomy, P11E checker_run_status, P9-G6 package, Đ43 paired-DOT scripts, dot-iu-cutter runnable verifier). Missing: a package_manifest.json envelope + a generic runner that resolves artifacts, runs declared commands, recomputes sha256, and binds prose claims to executable evidence, packaged as a new DOT family.
• Recommended approach: subordinate "Implementation Package DOT v0.1" = a small Python Article-14 gate over package_manifest.json, consuming Đ38/Đ23/Đ43, reusing P11E verbatim, modeled on dryrun.py. The machine reads JSON/YAML only; no deep Markdown parser.
• External tools: USE_NOW = python3 + jsonschema + shasum + Bash. DEFER = OPA/Conftest (Phase 5), Squawk (Phase 6), GPG, git hooks/CI, Docker sandbox. REJECT for v0.1 = Trivy as a conformance gate (different axis).
• Law hook (proposal only): Điều 23 Appendix — Implementation Package DOT (+ a one-paragraph NT14 pointer). Avoids overlap because Đ38/Đ43 are consumed and the DOT gate is Đ23's domain. NOT written.
• Effort: planning amendment 0.5–1 day; MVP-for-FIX7 2–4 days; reusable v0.1 1–2 weeks; production-grade 3–6 weeks.

5. What was deliberately NOT done

• ❌ No implementation, no tool code written.
• ❌ No install (no opa/conftest/squawk/jsonschema installed).
• ❌ No production mutation; no DB object / role / grant / trigger / function / scheduler / UI / permit / REAL_RUN / QT001 / activation / repoint / cutover touched.
• ❌ No FIX7 blueprint recheck resumed.
• ❌ No law/amendment authored.
• ❌ No final decision claimed.

6. Next step

User / GPT / Codex / T1 review the plan and decide the six open questions (plan §13). If approved: Phase 1 (central folder) is complete; proceed to Phase 2 (Implementation Package DOT spec) — still design-only, no code.

7. Read-back

All four documents created under knowledge/dev/laws/tool-kiem-thu/; central folder was empty before this session (verified). Nothing scattered outside the central folder.