06 — True DRY_RUN One Pair — Result / Blocker (Workstream E)

Outcome: NOT executed for the agent_api pilot pair — exact blocker captured. A true-dry-run capability is independently proven for job:cut.

Mandatory safety conditions vs. reality (pilot = DOT_KG_EXPLAIN pair)

condition	status
plan/verify-only runner exists	✅ fn_process_dryrun_prepare_pair (but it does not execute the DOT)
fixture exists	✅ FIXTURE:dot:kg:explain:v1
dry-run call cannot mutate production	✅ (would be enforced)
output to fixture/test namespace	✅ DRYRUN-NS:
an actual no-mutation invocation of the DOT logic	❌ no agent_api plan-only contract binds DOT_KG_EXPLAIN to an invocation
observation evidence_type=DRY_RUN	❌ would require the above

Decision: do not execute. The only way to produce a DRY_RUN row for this pair today is for the agent to improvise the explanation by hand and label it as the DOT having run. That is a MOCK mislabeled as a dry-run — i.e. fake verification — and is forbidden. SIMULATED_DRY_RUN is retained; DRY_RUN rows = 0.

Exact blocker

A registered agent_api plan-only contract for DOT_KG_EXPLAIN (+ _VERIFY): a no-mutation invocation entrypoint (endpoint/prompt/operation) that takes FIXTURE:dot:kg:explain:v1, writes only to DRYRUN-NS:dot:kg:explain, and returns a structured output the verifier can check — wired so a runner can call it and record evidence_type=DRY_RUN honestly. Exact next command (once contract exists): run plan_only_runner.example.sh-style call against the fixture with the real invocation behind it, then upgrade the observation to DRY_RUN.

The capability does exist — for job:cut

iu-cutter-v0.6 + o7_live_dryrun_runner.py is a genuine Mode.DRYRUN, RO, kill-switch-asserted runner (doc 02). A true dry-run for job:cut is reachable today. It was not re-run this session deliberately:

• job:cut is already verified_candidate; a dry-run would not change its status (no value, possible noise);
• executing a host-level Python runner as root exceeds this macro's clean additive-DB envelope, and the prior macro already captured its dry-run proof (o7-smoke-summary.json, 366/366 tests). This is recorded as the template the agent_api layer lacks, and feeds the next-macro choice (doc 12).

Honesty posture

Nothing simulated or prepared reaches verified. The system still has zero DRY_RUN and zero REAL_RUN observations. verified_candidates_v3 = only job:cut (via its real runtime + cross-component correlation, not via this run).