12 — Next Macro Decision (Workstream K)

Decision

PRIMARY: AGENT_API_PLAN_ONLY_ENDPOINT_SERVICE_IMPLEMENTATION.

Why (per the decision rules)

• Endpoint is still missing because the service code/credential is absent (external infra), not because of a contract/dispatcher/discovery gap — those are all LIVE and proven. The rule says: if the endpoint is still missing because service code is absent, choose endpoint service implementation.
• This macro removed every DB-side blocker: contract ✅, dispatcher ✅, fixture sound ✅, verifier logic implemented ✅, v6/policy ✅. The only thing standing between plan_only_tested and dry_run_observed is a real no-mutation producer executor — that is the next macro's whole job.

Scope of the primary next macro

Build the agent_api plan-only executor: a small no-mutation service/route (new container or guarded route) that invokes an agent/LLM over FIXTURE:dot:kg:explain:v1, returns a verifier-checkable explanation to DRYRUN-NS: (memory only), fail-closed, generic over agent_api DOTs. Then bind endpoint_ref, flip mode→DRY_RUN, run DOT_KG_EXPLAIN once, record the first real DRY_RUN. Externally required: an agent credential + a hosting surface (owner/operator to provision).

Parallel (safe, no owner needed for the first two)

• PROCESS_DISCOVERY_V6_UI_DEPLOY — operator-gated Nuxt rebuild of the 7 v6 routes (packet ready, doc 06).
• JOB_CUT_PROCESS_REGISTRATION_OWNER_PACKET — only if paired (owner-gated; packet ready, doc 07). Do not run alone (approval-only).
• INFORMATION_PIECE_D1_D2_KG_DOT_EXPANSION_CONTINUE — render the family diagram + per-DOT spec series (companions seeded, doc 09).

Not chosen

• DOT_KG_TRUE_DRY_RUN_ONE_PAIR — blocked until the endpoint exists (would be a no-op).
• A standalone approval-only macro — disallowed by the rules.

Completion

Next macro chosen with no rediscovery required.