Checkpoint — DOT Execution Wrapper / Correlation Harness (short SSOT)

Date: 2026-06-04 · Macro: DOT_EXECUTION_WRAPPER_CORRELATION_PATCH_AND_KG_DRYRUN_HARNESS Final status: PARTIAL — no-execute harness + correlation surface LIVE; true dry-run blocked on a non-existent DOT runner + fixture. Execution mode: EXECUTION_MODE. RO=query_pg; RW=ssh contabo→docker exec postgres psql -U directus; KB=upload_document.

Live mutation: YES (birth-free)

birth_registry 1,158,306 before == after (rehearsed BEGIN/ROLLBACK net-zero, then committed; independent MCP read-back PASS). trigger_guard_alerts 129 unchanged. Additive only.

Runner inventory status: NO DOT RUNNER EXISTS

DOT layer = engine agent_api, script_path NULL, usage_count 0, 0 executed. The reusable safe-runtime scaffolding exists only in the IU-command layer (fn_dot_iu_operator_runtime_enabled, fn_assert_safe_for_dot_action, fn_dot_iu_runtime_lease_acquire/release, fn_dot_iu_command_log) — this macro ports its observation half to the process layer.

Wrapper / harness status: LIVE (no-execute)

Applied: 3 process_dot_runtime.* toggles (execute_enabled=false, dry_run_only=true, real_run_enabled=false; mirror of piece_event_runtime.*); fn_process_run_observe + fn_process_component_observe (pure-insert, fail-closed on dot_code, REAL_RUN refused unless enabled, idempotent); v_process_dot_wrapper_status (generic over 303 DOT_*). The functions cannot execute a DOT. Proven: REAL_RUN refused, unknown dot_code refused, idempotency, birth-free.

KG pilot package status: WRAPPER_READY_BUT_FIXTURE_MISSING → BLOCKED_BY_NO_RUNNER

Pair DOT_KG_EXPLAIN + DOT_KG_EXPLAIN_VERIFY fully specified (ids, idempotency keys, correlation prefix DRYRUN:, source_system dot_exec_wrapper, event sequence, expected rows, cleanup). Missing: DOT runner, plan/verify-only mode, fixture. DO NOT EXECUTE — SIMULATED_DRY_RUN retained.

Event handling status: 0 activated

7 process.* types all inactive. Decision: do not activate. Reference-without-emit (event_code recorded, no event_outbox while inactive). Payload contract + activation packet staged, not applied.

Status upgrade rules: intact

Ladder structural→simulated_observed→dry_run_observed→real_run_observed→verified_candidate→birth_ready. Invariants re-proven: simulated≠verified; dry≠real; REAL_RUN refused at write. verified_candidates_v3 = only job:cut. "DRY_RUN_PREPARED" kept OUT of evidence_type domain (modelled via evidence_ref) to avoid inflation.

RP/UI impact: patch-ready

v_process_dot_wrapper_status (WRAPPER_NEEDED 182 / WRAPPER_READY_NO_OBSERVATION 119 / SIMULATED_OBSERVED 2). 3 routes; verified badge only from v3; no Nuxt math; operator-gated deploy.

Next macro

DOT_EXECUTION_WRAPPER_IMPLEMENTATION (DOT runner + plan/verify-only mode + KG fixture) → then DOT_KG_TRUE_DRY_RUN_ONE_PAIR. Parallel: PROCESS_DISCOVERY_WRAPPER_UI_DEPLOY · DOT_KG_OWNER_AND_EVENT_ACTIVATION_PREP.

Exact blocker

A DOT runner that calls agent_api in an asserted plan/verify-only, no-mutation mode + a KG fixture (input + expected output). Downstream governance: dot:kg owner registration, process.* activation, owner birth admission. No engineering blocker on the observation/correlation layer.

Artifacts

Apply contabo:/tmp/dot_exec_wrapper_apply.sql · Rollback contabo:/tmp/DOT_EXEC_WRAPPER_ROLLBACK.sql · Report dir knowledge/dev/reports/architecture/dot-execution-wrapper-correlation-patch-kg-dryrun-harness-2026-06-04/ (docs 00–11). Continues checkpoint-process-discovery-runtime-observation-2026-06-04.md.