07 — True DRY_RUN One Pair — Result / Blocker (Workstream F)

Outcome: NOT executed. Exact blocker captured and now schema-encoded.

Mandatory safety conditions vs reality (pilot = DOT_KG_EXPLAIN pair)

condition	status
plan/verify-only runner exists	✅ fn_process_agent_api_dispatch (validation only)
fixture exists	✅ FIXTURE:dot:kg:explain:v1
output to DRYRUN-NS	✅ enforced
no production writes	✅ enforced
event emission inactive/test-only	✅ 0 emitted
observation writes DRY_RUN only	✅ would-be, gated
verified remains false	✅
real agent_api plan/verify-only endpoint exists	❌ endpoint_ref NULL; host grep for an agent_api dispatcher source = empty

Decision

Do not run. The only way to produce a DRY_RUN row today is to hand-improvise the EXPLAIN reasoning and label it as the DOT having run — a MOCK mislabelled as a dry-run, i.e. fake verification. Forbidden. Proven live: dispatcher T2 refuses DRY_RUN while endpoint_ref is NULL.

Exact blocker

A registered agent_api invocation endpoint for DOT_KG_EXPLAIN (+ _VERIFY): a no-mutation entrypoint (HTTP endpoint / prompt-op / service) that consumes FIXTURE:dot:kg:explain:v1, writes only to DRYRUN-NS:dot:kg:explain, and returns a structured output the verifier can check. Bind it as dot_agent_api_contract.endpoint_ref and flip the contract mode to DRY_RUN.

Exact next command (once endpoint exists)

SELECT fn_process_agent_api_dispatch('DOT_KG_EXPLAIN', '<corr>', 'agent', 'DRY_RUN', true, '<root>'); — with the endpoint wired behind it, then upgrade the observation from SIMULATED_DRY_RUN to DRY_RUN.

Capability reference

A genuine Mode.DRYRUN runner already exists for job:cut (iu-cutter-v0.6 + o7 sidecar, 366/366 tests). It was not re-run (job:cut is already verified; no status change, host-root execution exceeds this macro's additive-DB envelope). It remains the template the agent_api layer still lacks an endpoint for.

Honesty posture

System still has 0 DRY_RUN and 0 REAL_RUN observations. verified_candidates_v3 = only job:cut.