Checkpoint — DOT agent_api Endpoint / Dry-Run Readiness (short SSOT)

Date: 2026-06-04 · Macro: DOT_AGENT_API_ENDPOINT_TRUE_DRYRUN_JOBCUT_UI_D1D2_AND_PROCESS_READINESS Final status: PARTIAL — all safe branches done; true DRY_RUN blocked on a missing agent_api producer endpoint (now classified as external infra). Execution mode: EXECUTION_MODE. RO=query_pg; RW=ssh contabo→docker exec -i postgres psql -U directus; KB=upload_document; staging=/opt/incomex/docs/mcp-writes/dot-agent-api-endpoint-2026-06-04/.

Live mutation: YES (additive, birth-free)

fn_dryrun_fixture_selfcheck(jsonb) (pure) + 5 v6 views committed. birth_registry 1,163,409→1,163,429 (+20 background KB-doc births only; DDL births nothing). trigger_guard_alerts=129 unchanged. MCP read-back PASS.

Endpoint status: producer BLOCKED_EXTERNAL

agent_api = LLM/agent invocation; no executor service/route/credential on the VPS (10 containers, none a DOT executor). Producer endpoint cannot be a DB function or fixture replay without becoming a mock. Verifier half IMPLEMENTED as real code (fn_dryrun_fixture_selfcheck, 7/7 on real fixture, fails on hallucinated node) — but it's a harness, not the DOT, so not bound.

Endpoint_ref binding: NULL (correct, no fake)

Both contracts keep endpoint_ref=NULL, mode unchanged. Schema CHECK still encodes the blocker. Bind packet ready.

True dry-run: NOT EXECUTED — exact blocker

Dispatcher refuses DRY_RUN while endpoint_ref NULL. 0 DRY_RUN / 0 REAL_RUN preserved. Faking = forbidden.

v6 / policy: LIVE

5 views: agent_api_endpoint_status, endpoint_binding_status, candidate_status_v6, birth_readiness_v6, auto_workflow_policy_gaps. dot:kg = plan_only_tested / all_missing / blocked_endpoint_missing. job:cut = verified_candidate / verified_pending_owner. Admission ladder (structural→simulated→dry_run→real_run→verified→owner→birth) encoded as gates with per-candidate next action. verified_candidates_v3 = only job:cut (invariant held).

UI packet: ready (operator-gated)

7 /process-discovery/* routes + badges; verified badge only from v3; no Nuxt math. Not deployed.

job:cut prep: done (owner pending)

8 members correlated by job_queue.run_id; VERIFIED_PENDING_OWNER; owner_missing. Registration packet authored; no birth/approval (action='review' note). Only owner blocks.

dot:kg prep: done (sequenced)

endpoint→correlation→real run→verified→owner→10-law-def split→process.* activation. 7 events still inactive (do-not-activate). Verifier re-classification surfaced as an owner decision.

D1/D2 expansion: done

Published d1-supp-kg-explain-pilot-and-discovery-status + d2-supp-endpoint-dryrun-ladder. No source IU edited.

Auto-workflow policy: live

v_process_discovery_auto_workflow_policy_gaps + doc 10: stricter pre-birth gate for discovered auto workflows (mandatory dry-run + negative control + kill-switch); MOW/MOT-born vs discovered distinction; periodic orphan scan rule.

Next macro

PRIMARY AGENT_API_PLAN_ONLY_ENDPOINT_SERVICE_IMPLEMENTATION. Parallel: PROCESS_DISCOVERY_V6_UI_DEPLOY · JOB_CUT_PROCESS_REGISTRATION_OWNER_PACKET · INFORMATION_PIECE_D1_D2_KG_DOT_EXPANSION_CONTINUE.

Exact blocker

A registered, no-mutation agent_api producer invocation endpoint for DOT_KG_EXPLAIN (agent/LLM + credential + hosting surface) consuming FIXTURE:dot:kg:explain:v1, writing only to DRYRUN-NS:dot:kg:explain, returning a verifier-checkable output; bind as endpoint_ref, flip mode→DRY_RUN. External infra; no DB engineering blocker on contract/dispatcher/verifier-logic/v6/policy.

Artifacts

Apply …/v6_apply.sql · Rollback …/v6_rollback.sql · Report dir …/dot-agent-api-endpoint-true-dryrun-jobcut-ui-d1d2-readiness-2026-06-04/ (docs 00–14). Continues checkpoint-dot-agent-api-contract-dispatcher-2026-06-04.md.