{ "document_kind": "design_artifact_machine_summary", "not_a_runtime_schema": true, "not_a_manifest": true, "tool": "implementation_package_dot_inspector", "version": "v0.1", "revision": "rev2", "mode": "read_report_only", "date": "2026-06-09", "supersedes": "designs/implementation-package-dot-v0-1-gap-only-scope-spec-2026-06-09.json", "status": "GAP_ONLY_SCOPE_SPEC_v0_1_REV2_READY_FOR_CODEX", "repaired_after": "reviews/codex-review-gap-only-spec-fix7-pilot-mvp-readiness-2026-06-09.md (BLOCKED_BY_AUTHORITY_OR_ARTICLE14_RISK)", "fix_ledger": "reports/codex-fix-ledger-gap-only-spec-rev2-2026-06-09.md", "production_mutation": false, "production_mutation_means": "no PG/Directus/registry/filesystem/system_issues write", "writes_performed": [ "knowledge/dev/laws/tool-kiem-thu/ design documents (the deliverables; sealed Domain I file-report-only) — disclosed, not hidden (Codex fix 12)" ], "fresh_live_read_taken": false, "governing_authority_in_precedence": [ "Codex-sealed B/C/D/G/H (BCDGH_SEALED) — binding constraints, not reopened", "Codex review 2026-06-09 — the 12 required fixes", "Authority Contract v0.1 (READY_FOR_GPT_REVIEW) — records sealed constraints; NOT yet ratified / NOT binding as a whole", "baseline ledger + fresh-read closure — dated evidence only" ], "constitution_anchors": { "article_14_NT14": "THUC THI DUOC NGAY — executable claim must be backed by an executable that actually runs; prose-claims-executable-that-does-not-run is the violation", "article_13_NT13": "PG FIRST / NATIVE / DRIVEN — consume PG, use native features, let PG drive runtime; no parallel SSOT" }, "article14_adequacy_chain": [ "claim", "claim_type", "required_evidence_class[]", "evidence_artifact_or_reference (existence)", "evidence_capability (right kind? bound? independent? provenanced?)", "evidence_adequacy_verdict (per-claim)", "dossier_verdict + article14_status (overall)" ], "iron_law": "a reference that merely resolves yields at most ARTIFACT_EXISTENCE_EVIDENCE; it NEVER by itself produces a positive claim verdict. 'artifact exists' != 'artifact proves this claim'.", "claim_binding_fields": [ "claim_id", "claim_type", "required_evidence_class[]", "evidence_ref[]", "evidence_kind", "resolves", "bound_to_claim", "identity_match", "producer", "observation_ts", "independence_non_self_reference", "conflict_set[]", "evidence_adequacy_verdict", "notes" ], "verdict_model": { "per_claim_adequacy_verdict": [ "EVIDENCE_SUFFICIENT_FOR_READ_LEVEL (non-execution claim types ONLY; never proof-of-run)", "EVIDENCE_INSUFFICIENT", "EVIDENCE_CONFLICTING", "BLOCKED_BY_NO_CALL_CONTRACT", "BLOCKED_BY_UNVERIFIED_SOURCE" ], "dossier_flags": [ "FLAG_PROSE_ONLY_PASS", "FLAG_HARDCODED_DENOMINATOR", "FLAG_AUTHORITY_VIOLATION" ], "article14_status": [ "ARTICLE14_NOT_APPLICABLE_NO_EXECUTABLE_CLAIMS", "ARTICLE14_NOT_PROVEN_EXECUTION_UNVERIFIED" ], "final_dossier_verdict": [ "READ_LEVEL_ACCEPTABLE", "READ_LEVEL_FAIL", "BLOCKED", "UNVERIFIED" ], "precedence": "BLOCKED > READ_LEVEL_FAIL > UNVERIFIED > READ_LEVEL_ACCEPTABLE", "read_level_acceptable_requires": [ "article14_status == ARTICLE14_NOT_APPLICABLE_NO_EXECUTABLE_CLAIMS", "every in-scope claim == EVIDENCE_SUFFICIENT_FOR_READ_LEVEL", "zero FLAG_", "claim_inventory_completeness != UNVERIFIED", "zero high-risk UNPARSED_REGION" ], "removed_rev1_tokens": ["READ_REPORT_PASS", "READ_REPORT_FLAG", "READ_REPORT_BLOCKED", "EVIDENCE_PRESENT(as positive)", "NOT_APPLICABLE(as verdict)"], "execution_class_claim_types": [1, 2, 3, 4, 5, 6, 11], "execution_class_rule": "any execution-class claim forces article14_status=ARTICLE14_NOT_PROVEN_EXECUTION_UNVERIFIED and makes READ_LEVEL_ACCEPTABLE structurally unavailable", "fail_closed_classification": "a claim whose type is uncertain/multi-matched/in an unparsed region defaults to execution-class (stricter ceiling); misclassification can only lower a verdict, never raise it to ACCEPTABLE" }, "evidence_class_model": [ {"class": "CLAIM_DECLARATION", "proves": "a claim was made", "cannot_prove": "the claim is true", "v0_1_assesses": "yes (best-effort)"}, {"class": "ARTIFACT_IDENTITY_EVIDENCE", "proves": "which artifact a claim names", "cannot_prove": "it exists/runs", "v0_1_assesses": "yes (identity only)"}, {"class": "ARTIFACT_EXISTENCE_EVIDENCE", "proves": "the artifact resolves as an object", "cannot_prove": "it runs/passes", "v0_1_assesses": "yes"}, {"class": "LOG_EVIDENCE", "proves": "a log artifact exists + its contents", "cannot_prove": "the log reflects a real/current/reproducible run", "v0_1_assesses": "presence+kind+binding only; caps at NOT_PROVEN"}, {"class": "EXIT_CODE_EVIDENCE", "proves": "an exit-code record exists", "cannot_prove": "it is from a real current run", "v0_1_assesses": "presence+kind+binding; caps at NOT_PROVEN"}, {"class": "HASH_EVIDENCE", "proves": "a hash value is recorded", "cannot_prove": "it matches a freshly recomputed artifact", "v0_1_assesses": "presence+kind+binding; NEVER recompute"}, {"class": "RUN_LEDGER_EVIDENCE", "proves": "a run was recorded in a ledger", "cannot_prove": "it corresponds to the claim's current artifact/version or is reproducible", "v0_1_assesses": "presence+kind+binding; version-binding is the gap -> NOT_PROVEN"}, {"class": "SOURCE_SURFACE_EVIDENCE", "proves": "surface+query+timestamp of a fact/count", "cannot_prove": "the count is an invariant", "v0_1_assesses": "yes"}, {"class": "AUTHORITY_CONTRACT_EVIDENCE", "proves": "a decision's recorded status", "cannot_prove": "more than its recorded status (review-ready != binding)", "v0_1_assesses": "yes (status only; never upgrade)"}, {"class": "DENOMINATOR_SOURCE_EVIDENCE", "proves": "a denominator's definition+source+value+staleness", "cannot_prove": "that it equals another denominator", "v0_1_assesses": "yes"}, {"class": "CORPUS_DUAL_REPORT_EVIDENCE", "proves": "both corpora separately with independent provenance", "cannot_prove": "any bridge/canonical choice (0 joining views)", "v0_1_assesses": "dual-report only"}, {"class": "NEGATIVE_TEST_EVIDENCE", "proves": "a prohibited action is structurally impossible", "cannot_prove": "correctness of allowed behavior", "v0_1_assesses": "design-level now; structural at build"} ], "claim_type_matrix": [ {"n": 1, "type": "executable exists", "required": ["ARTIFACT_IDENTITY_EVIDENCE", "ARTIFACT_EXISTENCE_EVIDENCE"], "max_verdict": "UNVERIFIED", "forbidden": ["EVIDENCE_SUFFICIENT_FOR_READ_LEVEL", "READ_LEVEL_ACCEPTABLE"], "prose_only": "EVIDENCE_INSUFFICIENT + FLAG_PROSE_ONLY_PASS", "execution_class": true}, {"n": 2, "type": "command ran", "required": ["RUN_LEDGER_EVIDENCE", "EXIT_CODE_EVIDENCE"], "max_verdict": "UNVERIFIED/BLOCKED_BY_NO_CALL_CONTRACT", "forbidden": ["EVIDENCE_SUFFICIENT_FOR_READ_LEVEL"], "prose_only": "EVIDENCE_INSUFFICIENT", "execution_class": true}, {"n": 3, "type": "selftest PASS", "required": ["LOG_EVIDENCE", "EXIT_CODE_EVIDENCE", "RUN_LEDGER_EVIDENCE"], "max_verdict": "UNVERIFIED", "forbidden": ["EVIDENCE_SUFFICIENT_FOR_READ_LEVEL"], "prose_only": "EVIDENCE_INSUFFICIENT", "execution_class": true, "recheck8": true}, {"n": 4, "type": "hash computed/matches", "required": ["HASH_EVIDENCE", "ARTIFACT_IDENTITY_EVIDENCE"], "max_verdict": "UNVERIFIED", "forbidden": ["EVIDENCE_SUFFICIENT_FOR_READ_LEVEL"], "prose_only": "EVIDENCE_INSUFFICIENT (never recompute)", "execution_class": true}, {"n": 5, "type": "exit code was 0", "required": ["EXIT_CODE_EVIDENCE", "RUN_LEDGER_EVIDENCE"], "max_verdict": "UNVERIFIED", "forbidden": ["EVIDENCE_SUFFICIENT_FOR_READ_LEVEL"], "prose_only": "EVIDENCE_INSUFFICIENT", "execution_class": true}, {"n": 6, "type": "canonicalizer SSOT exists", "required": ["ARTIFACT_IDENTITY_EVIDENCE", "ARTIFACT_EXISTENCE_EVIDENCE", "LOG_EVIDENCE", "EXIT_CODE_EVIDENCE"], "max_verdict": "UNVERIFIED", "forbidden": ["EVIDENCE_SUFFICIENT_FOR_READ_LEVEL"], "prose_only": "EVIDENCE_INSUFFICIENT", "execution_class": true, "recheck8": true}, {"n": 7, "type": "artifact is canonical", "required": ["AUTHORITY_CONTRACT_EVIDENCE", "ARTIFACT_IDENTITY_EVIDENCE"], "max_verdict": "EVIDENCE_SUFFICIENT_FOR_READ_LEVEL iff sealed authority names it canonical", "forbidden": ["choosing canonical itself"], "prose_only": "EVIDENCE_INSUFFICIENT", "execution_class": false}, {"n": 8, "type": "denominator count is X", "required": ["DENOMINATOR_SOURCE_EVIDENCE"], "max_verdict": "EVIDENCE_SUFFICIENT_FOR_READ_LEVEL as dated provenance only", "forbidden": ["treating X as invariant", "collapsing"], "prose_only": "FLAG_HARDCODED_DENOMINATOR -> FAIL", "execution_class": false}, {"n": 9, "type": "TAC/IU authority chosen", "required": ["CORPUS_DUAL_REPORT_EVIDENCE"], "max_verdict": "n/a (choice prohibited)", "forbidden": ["any choice/merge"], "prose_only": "FLAG_AUTHORITY_VIOLATION -> BLOCKED", "execution_class": false}, {"n": 10, "type": "Directus 100% DOT-controlled", "required": ["AUTHORITY_CONTRACT_EVIDENCE", "deferred DOT-control proof"], "max_verdict": "UNVERIFIED (PARTIAL_EVIDENCE_ONLY)", "forbidden": ["READ_LEVEL_ACCEPTABLE", "100%"], "prose_only": "EVIDENCE_INSUFFICIENT", "execution_class": false}, {"n": 11, "type": "system_issues written", "required": ["RUN_LEDGER_EVIDENCE", "LOG_EVIDENCE"], "max_verdict": "BLOCKED_BY_NO_CALL_CONTRACT (write contract deferred)", "forbidden": ["wrote"], "prose_only": "EVIDENCE_INSUFFICIENT", "execution_class": true}, {"n": 12, "type": "graph/orphan resolver sufficient", "required": ["existing D19/D23/D39 coverage proof"], "max_verdict": "UNVERIFIED (advisory)", "forbidden": ["resolver completeness", "canonical-id coverage"], "prose_only": "UNVERIFIED (coverage advisory)", "execution_class": false}, {"n": 13, "type": "prose PASS / design PASS", "required": [], "max_verdict": "n/a", "forbidden": ["any positive"], "prose_only": "FLAG_PROSE_ONLY_PASS -> FAIL (never re-assert)", "execution_class": false} ], "claim_extractor_limitation": { "is": "best-effort inventory only", "is_not": "an authority that found all claims", "outputs": ["UNPARSED_REGION[] (risk-classified)", "claim_inventory_completeness in {COMPLETE_BY_GOVERNED_CONTRACT, UNVERIFIED}"], "complete_only_if": "a governed claim-declaration/binding contract backs the dossier (none exists today -> normally UNVERIFIED)", "high_risk_unparsed_rule": "high-risk UNPARSED_REGION -> claim_inventory_completeness=UNVERIFIED -> READ_LEVEL_ACCEPTABLE unavailable + manual_review_required=true" }, "denominator_rules": { "no_literal_count_is_normative": true, "record_fields": ["surface_name", "query_or_view_or_report_path", "observation_timestamp", "denominator_definition", "observed_value", "stale_or_unverified_marker", "confidence", "match_key", "population", "no_collapse_rule"], "observed_value_is": "dated evidence/data, never a comparator or gate", "no_collapse_rule": "enumerate ALL denominators relevant to the inspected claims/surfaces; prove none collapsed; prove each fully provenanced. No numeric minimum (the >=2 rule is REMOVED), no fixed maximum.", "collapsed_single_dot_number": "FLAG_HARDCODED_DENOMINATOR -> FAIL/BLOCKED", "historical_counts_are_dated_examples_only": ["309", "214", "186", "163", "54", "128/36", "219/102", "41 vs 4"], "historical_counts_note": "appear ONLY as as_of:2026-06-09 is_dated_example:true illustrations; NEVER acceptance values or expected outputs", "unsafe_sources_never_denominators": ["actual_count external-sync artifact", "local checkout", "/opt/incomex/scripts"] }, "allowed_read_only_inputs": { "principle": "consume governed sources at runtime (Authority Contract records + live pg_catalog + sealed Domain tables) OR mark coverage UNVERIFIED; never a frozen file literal where a dynamic source exists", "source_metadata_points_to": "native table/view/report/contract (never a file-only surrogate)", "surfaces_dated_examples": [ "KB document_id+path+revision", "dot_tools / meta_catalog CAT-006 (listing only)", "v_dot_reconciliation_reliability over wf_fs_dot_bin_snapshot (canonical code-key)", "v_dot_registry_no_file / v_dot_fs_reconciliation (name-key diagnostic, never overrides canonical)", "wf_fs_dot_bin_snapshot (presence)", "dot_iu_command_catalog/_run/_runtime_lease (read-only report)", "universal_edges / v_kg_edges_all / entity_dependencies", "D19 orphan + duplicate result views", "D43 context pack surfaces", "information_unit + tac_logical_unit (dual-report only, never joined)", "directus_flows (observe only)", "system_issues (read-only; write sink fn_tac_log_checker_issue NEVER written in v0.1)" ], "detectors_never_executed": true }, "output_contract": { "surface": "report triplet under knowledge/dev/laws/tool-kiem-thu/ (reports/.md, reports/.json, checkpoints/checkpoint-.md)", "report_md_sections": ["header", "final_verdict + article14_status", "dossier identity", "claim/evidence inventory (adequacy chain)", "UNPARSED_REGION[] + claim_inventory_completeness", "declared-artifact existence", "denominator ledger (full source records)", "dual-corpus (joined:false)", "reconciliation (canonical+diagnostic both directions)", "advisory dead-link/coverage (ADVISORY_UNVERIFIED)", "unverified/stale", "deferred carve-outs", "writes_performed[]", "cross-references"], "report_json_keys": ["verdict_model", "final_verdict", "article14_status", "dossier_identity", "claims[]", "unparsed_regions[]", "claim_inventory_completeness", "denominator_source_records[]", "dual_corpus", "reconciliation", "dead_link_coverage", "flags[]", "deferred_carveouts[]", "exit_code", "writes_performed[]", "production_mutation"] }, "exit_semantics_design_only_no_cli_built": { "0": "read completed AND final_verdict==READ_LEVEL_ACCEPTABLE (article14 N/A)", "1": "read completed but READ_LEVEL_FAIL or any FLAG_*", "2": "BLOCKED or UNVERIFIED", "3": "CONTRACT_VIOLATION / prohibited action attempted", "4": "internal error", "rule": "FLAG/FAIL/BLOCKED/UNVERIFIED can NEVER map to exit 0; no green-but-flagged code exists" }, "capability_model": { "allowed_actions": ["READ_ONLY_QUERY", "READ_FILE", "WRITE_REPORT"], "prohibited_actions": ["EXECUTE_COMMAND", "INVOKE_DOT", "MUTATE_PG", "MUTATE_DIRECTUS", "MUTATE_REGISTRY", "WRITE_SYSTEM_ISSUES", "CREATE_RESOLVER"], "every_module_declares_allowed_actions": true, "prohibited_action_in_module_plan": "CONTRACT_VIOLATION (build rejected; runtime exit 3)", "static_guard": "capability/dependency lint: no subprocess/shell/socket, no PG write driver, no Directus write SDK, no write outside approved KB path allowlist", "runtime_guard": "read-only PG role context_pack_readonly in read-only transaction; no Directus write credential; report writer restricted to approved KB path; no shell/subprocess capability", "negative_capability_tests_required_before_mvp_acceptance": true, "enforcement_is": "structural (static+runtime guard), not module-name assertion" }, "failure_modes": [ {"id": "F1", "mode": "missing identity", "verdict": "BLOCKED"}, {"id": "F2", "mode": "count without denominator_source_record", "verdict": "FLAG_HARDCODED_DENOMINATOR->FAIL"}, {"id": "F3", "mode": "collapsed denominator", "verdict": "BLOCKED"}, {"id": "F4", "mode": "execution claim no/insufficient evidence", "verdict": "EVIDENCE_INSUFFICIENT->FAIL"}, {"id": "F5", "mode": "prose-only PASS", "verdict": "FLAG_PROSE_ONLY_PASS->FAIL"}, {"id": "F6", "mode": "declared artifact does not resolve", "verdict": "EVIDENCE_INSUFFICIENT->FAIL"}, {"id": "F7", "mode": "reference ambiguity", "verdict": "EVIDENCE_INSUFFICIENT/UNVERIFIED"}, {"id": "F8", "mode": "TAC/IU joined", "verdict": "BLOCKED"}, {"id": "F9", "mode": "diagnostic overrides canonical", "verdict": "FAIL"}, {"id": "F10", "mode": "evidence resolves but wrong kind/unbound/self-referential", "verdict": "EVIDENCE_INSUFFICIENT->FAIL (resolvable-but-insufficient catch)"}, {"id": "F11", "mode": "evidence artifacts contradict", "verdict": "EVIDENCE_CONFLICTING->FAIL"}, {"id": "F12", "mode": "high-risk prose unparsed", "verdict": "UNVERIFIED + manual review"}, {"id": "F13", "mode": "evidence only on stale/unverifiable source", "verdict": "BLOCKED_BY_UNVERIFIED_SOURCE->UNVERIFIED"}, {"id": "F14", "mode": "attempt invoke/write", "verdict": "CONTRACT_VIOLATION->BLOCKED (exit 3)"}, {"id": "F15", "mode": "non-ACCEPTABLE verdict mapped to exit 0", "verdict": "build/CI failure"} ], "master_fail_closed": "when in doubt, flag/block/unverified, never accept; absence or inadequacy of evidence = EVIDENCE_INSUFFICIENT/FAIL, never silent acceptance (NT9 Khong chac dung = sai)", "tac_iu_dual_report": {"joined": false, "check": "role/key/separation, distinct surfaces, independent provenance", "no_literal_corpus_count_in_criterion": true, "join_attempt": "FLAG_AUTHORITY_VIOLATION->BLOCKED"}, "reconciliation": {"canonical": "code-key v_dot_reconciliation_reliability", "diagnostic": "name-key v_dot_registry_no_file", "both_directions": true, "diagnostic_never_overrides_canonical": true, "check": "role/key/population/provenance/separation; no literal 41/4 in criterion"}, "dead_link_coverage": "ADVISORY_UNVERIFIED (no canonical-id coverage, no resolver completeness claim; doc-level canonical-id coverage UNPROVEN per sealed Domain G)", "authority_contract_status_normalized": { "sealed_BCDGH": "binding constraints, not reopened", "authority_contract_v0_1": "RECORDS sealed constraints; own status READY_FOR_GPT_REVIEW; NOT yet ratified / NOT binding as a whole; subject to GPT/User review", "removed_language": ["PROGRAM_MACRO_READY", "no engineering omissions remain"] }, "deferred_carveouts": [ {"capability": "run command + exit capture", "contract": "Call Contract", "codex_review": "mandatory"}, {"capability": "bind claim to real run / proof-of-run", "contract": "Proof-of-run semantics", "codex_review": "mandatory"}, {"capability": "--selftest N/N + module_sha256 self-pin", "contract": "post-seal build", "codex_review": "n/a"}, {"capability": "generic package_manifest schema", "contract": "iu_core<->cutter_governance lineage decision + Codex schema review", "codex_review": "mandatory"}, {"capability": "audit_dead_links() engine + system_issues sink", "contract": "system_issues write contract", "codex_review": "mandatory"}, {"capability": "Directus write", "contract": "Directus DOT-control proof contract", "codex_review": "mandatory if any write"}, {"capability": "TAC<->IU bridge / canonical choice", "contract": "bridge/resolver contract", "codex_review": "mandatory + owner authorization"}, {"capability": "reconciliation mutation / rebirth", "contract": "registry cleanup contract", "codex_review": "mandatory"}, {"capability": "OPA/Conftest/Squawk/CI/Git-hook gating", "contract": "CI/policy-gate integration contract", "codex_review": "mandatory"} ], "parallel_authority_risk": { "new_runner": "NO (capability enums + static/runtime guard, not module-name)", "new_registry": "NO (file report is evidence only, never authority; consumes governed surfaces)", "new_logger": "NO (read-only system_issues; write deferred to contract)", "new_graph_duplicate": "NO (advisory-only coverage; no resolver)", "new_tac_iu_corpus": "NO (dual-report only; no bridge)", "new_claim_evidence_authority": "BOUNDED (best-effort + claim_inventory_completeness=UNVERIFIED; not an authority; no governed declaration contract yet)" }, "self_audit": { "article_14": "PASS", "no_prose_only_pass": "PASS", "no_hidden_hardcode": "PASS", "no_fake_green": "PASS", "pg_first_native_driven": "PASS", "no_parallel_authority": "PASS", "no_run_write_violation": "PASS", "claim_evidence_adequacy": "PASS", "fix7_pilot_catches_recheck8_class": "PASS (read-level evidence-adequacy class; run-proof deferred)", "codex_12_fixes_addressed": "PASS (12/12)" }, "cross_references": [ "reports/codex-fix-ledger-gap-only-spec-rev2-2026-06-09.md", "designs/implementation-package-dot-v0-1-gap-only-scope-spec-rev2-2026-06-09.md", "designs/fix7-read-report-pilot-design-rev2-for-implementation-package-dot-v0-1-2026-06-09.md", "planning/mvp-read-report-inspector-implementation-plan-no-code-rev2-2026-06-09.md", "designs/acceptance-test-matrix-implementation-package-dot-v0-1-rev2-2026-06-09.md", "reviews/codex-review-gap-only-spec-fix7-pilot-mvp-readiness-2026-06-09.md", "reviews/codex-seal-authority-matrix-bcdgh-2026-06-09.md", "contracts/authority-contract-v0-1-2026-06-09.md (READY_FOR_GPT_REVIEW)", "knowledge/dev/laws/constitution.md" ] }