{ "doc": "fix7-p0-implementation-mutation-inventory", "date": "2026-06-11", "authority_of_this_doc": "PLANNING_NON_AUTHORITY; inventory of CANDIDATE target surfaces for a FUTURE execution macro; allowed_now=false for every surface", "rule": "default-deny: a surface is mutable only when a future owner-approved (OPT-4) execution macro lists it explicitly with a verified rollback; nothing here is mutated now", "surfaces": [ { "surface": "KB doc: canonicalizer-fix7-canon-v1-ssot.md (rev3)", "classification": "KB_REFERENCE", "mutation_class": "NONE_PINNED_BY_P7", "current_state": "rev3 sha256 49c386a9..b734d0, 38756 bytes, pinned by P7 as authoritative blueprint identity", "proposed_mutation": "no content change; add an operative-status marker referencing the P7 pin (DOC_STATUS marker only)", "reason": "make the sealed canonicalizer the operative FIX7 birth-blueprint reference rather than a candidate", "prerequisite": "owner OPT-4 execution authorization + seal-vs-bytes recheck PASS", "dryrun_method": "apply marker on a /tmp copy, recompute sha256, confirm body bytes (38756) unchanged so P7 pin still verifies", "rollback_method": "revert marker edit (single-line); body hash must return to 49c386a9..b734d0", "evidence_required": "before/after sha256, P7 verify_pin PASS on body, diff = marker line only", "allowed_now": false }, { "surface": "KB doc: FIX7 P0 birth-blueprint operative definition (new doc)", "classification": "KB_REFERENCE", "mutation_class": "NONE", "current_state": "does not exist as an operative doc; only candidate/planning material exists", "proposed_mutation": "author the operative birth-blueprint doc that binds P7 pin + Packet V3 tree + N6 corpus as the operative FIX7 mechanism", "reason": "the sealed blueprint must have a single operative surface the execution lane reads", "prerequisite": "owner OPT-4 + seal recheck", "dryrun_method": "author in /tmp, validate it references only sealed digests (P7/N7/N8/N6/canonicalizer/Packet V3), no invented values", "rollback_method": "do not publish, or supersede the doc (additive doc; no production state)", "evidence_required": "digest cross-check vs seal-consumption.json; report-vs-file audit", "allowed_now": false }, { "surface": "Packet V3 artifact set (tree b95df0a5..ca6d)", "classification": "KB_ARTIFACT", "mutation_class": "NONE_PINNED_BY_P7", "current_state": "candidate tree pinned by P7; not bound as operative", "proposed_mutation": "reference (not alter) the Packet V3 tree from the operative blueprint doc", "reason": "operative blueprint must point at the exact sealed tree", "prerequisite": "owner OPT-4 + seal recheck", "dryrun_method": "verify tree b95df0a5..ca6d still reconstructs byte-exact from KB before referencing", "rollback_method": "remove the reference; tree itself is never modified", "evidence_required": "tree reconstruct PASS", "allowed_now": false }, { "surface": "Object registry / 00-index (governance, canonical JSON+MD)", "classification": "GOVERNANCE_REGISTRY_INDEX", "mutation_class": "ADDENDUM_ONLY_NOW__CANONICAL_FOLD_DEFERRED", "current_state": "canonical registry JSON rev20 (max id 224); PROPOSED reservations via standalone addenda run through TKT-OBJ-342; T2 fold (TKT-BASE-GOV-FOLD-1 / V02-NVSZ-GOV-FOLD-1) still pending", "proposed_mutation": "register the FIX7 implementation objects + mark blueprint operative; canonical fold only after T1/T2 race resolved + owner/GPT authorization", "reason": "implementation objects must be governed (no orphan)", "prerequisite": "owner OPT-4 + confirmation no T1/T2 write-race on the canonical files", "dryrun_method": "collision-scan proposed IDs vs registry JSON + all standalone addenda; emit patch package APPLY_NOW=NO", "rollback_method": "addendum is additive (delete addendum doc); canonical fold rollback = restore prior registry JSON/MD revision", "evidence_required": "collision scan report; before/after registry revision", "allowed_now": false }, { "surface": "Production object-birth pipeline (birth_registry / Directus row creation)", "classification": "PRODUCTION_UNKNOWN_NEEDS_SCOPING", "mutation_class": "PRODUCTION_FORBIDDEN_THIS_MACRO", "current_state": "UNKNOWN exact surface in this paper lane; not inspected (no Directus/PG read performed in this macro)", "proposed_mutation": "UNKNOWN until owner/operator scopes whether birth-blueprint execution writes any production birth row", "reason": "the word 'birth' implies an eventual object-birth action; scope must be owner/operator-defined, not invented", "prerequisite": "owner OPT-4 + separate explicit production authorization (NOT granted by seal or OPT-4 alone)", "dryrun_method": "design only; any real birth requires a separate REAL_RUN/cutover-class authorization", "rollback_method": "TBD by owner/operator scoping; must be verified before any apply", "evidence_required": "owner/operator surface scoping; blocker FIX7-P0-PLAN-SURFACE-1", "allowed_now": false, "blocker_id": "FIX7-P0-PLAN-SURFACE-1" }, { "surface": "PG (PostgreSQL schema/data)", "classification": "PRODUCTION_FORBIDDEN", "mutation_class": "PRODUCTION_FORBIDDEN_THIS_MACRO", "current_state": "untouched; no PG command issued in this macro", "proposed_mutation": "NONE in any planning-authorized phase; only a future separately-authorized production phase could touch PG", "reason": "listed forbidden surface", "prerequisite": "separate explicit production authorization beyond seal + OPT-4", "dryrun_method": "staging/temp DB only in any future dry-run; never production PG", "rollback_method": "DB snapshot/restore; verified before any apply", "evidence_required": "separate authorization; blocker FIX7-P0-PLAN-SURFACE-1", "allowed_now": false, "blocker_id": "FIX7-P0-PLAN-SURFACE-1" }, { "surface": "Directus", "classification": "PRODUCTION_FORBIDDEN", "mutation_class": "PRODUCTION_FORBIDDEN_THIS_MACRO", "current_state": "untouched; no Directus command issued in this macro", "proposed_mutation": "NONE in any planning-authorized phase", "reason": "listed forbidden surface", "prerequisite": "separate explicit production authorization", "dryrun_method": "staging Directus only in any future dry-run", "rollback_method": "item delete/restore; verified before apply", "evidence_required": "separate authorization; blocker FIX7-P0-PLAN-SURFACE-1", "allowed_now": false, "blocker_id": "FIX7-P0-PLAN-SURFACE-1" }, { "surface": "registry-row (production registry insertion)", "classification": "PRODUCTION_FORBIDDEN", "mutation_class": "PRODUCTION_FORBIDDEN_THIS_MACRO", "current_state": "untouched; KB governance addendum is NOT a production registry-row", "proposed_mutation": "NONE in any planning-authorized phase", "reason": "listed forbidden surface", "prerequisite": "separate explicit production authorization", "dryrun_method": "staging only", "rollback_method": "row delete/restore; verified before apply", "evidence_required": "separate authorization; blocker FIX7-P0-PLAN-SURFACE-1", "allowed_now": false, "blocker_id": "FIX7-P0-PLAN-SURFACE-1" }, { "surface": "system_issues", "classification": "PRODUCTION_FORBIDDEN", "mutation_class": "PRODUCTION_FORBIDDEN_THIS_MACRO", "current_state": "untouched; no mutation in this macro", "proposed_mutation": "NONE in any planning-authorized phase", "reason": "listed forbidden surface", "prerequisite": "separate explicit production authorization", "dryrun_method": "staging only", "rollback_method": "restore; verified before apply", "evidence_required": "separate authorization; blocker FIX7-P0-PLAN-SURFACE-1", "allowed_now": false, "blocker_id": "FIX7-P0-PLAN-SURFACE-1" }, { "surface": "CI / workflow enforcement of the blueprint", "classification": "CONFIG_UNKNOWN_NEEDS_SCOPING", "mutation_class": "DEFERRED", "current_state": "UNKNOWN whether the blueprint is enforced in CI; not inspected", "proposed_mutation": "UNKNOWN; possibly add a seal-vs-bytes CI check", "reason": "continuous enforcement of the P7 pin may be desired", "prerequisite": "owner OPT-4 + CI scope decision", "dryrun_method": "design a CI check that recomputes canonicalizer sha256 and compares to P7 pin; run in a throwaway branch", "rollback_method": "revert the workflow file", "evidence_required": "owner scoping; blocker FIX7-P0-PLAN-SURFACE-2", "allowed_now": false, "blocker_id": "FIX7-P0-PLAN-SURFACE-2" } ], "any_surface_allowed_now": false, "forbidden_surfaces_inventoried": ["PG", "Directus", "registry-row", "system_issues", "production"], "production_mutation_in_this_macro": false }