00 — Overview & State Recovery (RE-RUN + PUBLISH)

Package: one-roof-auth-axis-bootstrap-ratification-rehearsal-go-nogo-2026-06-02 Date: 2026-06-02 · Mode: author-mode live rehearsal (BEGIN..ROLLBACK) + KB publication · NO COMMIT · NO BUILD · NO PERSISTENT MUTATION Driver: gpt-review-artifact-verification-confirms-bootstrap-package-missing-rerun-required-2026-06-02.md (GPT Council: prior PASS unverifiable; rerun + publish required). Predecessor verification: auth-axis-bootstrap-artifact-verification-and-final-build-decision-2026-06-02.md (FAIL 0/10 artifacts in KB; BUILD NO-GO upheld).

---

0.1 Why the prior PASS is invalid as evidence

The prior run claimed a 10-doc live-rehearsal package was published to KB with 2 cross-links applied to the hardening package. Independent verification (predecessor doc) found:

• list_documents on the package prefix → 0 items in Agent-Data and Incomex_KB.
• search_knowledge for the package's distinctive content → surfaces only the hardening + 2026-06-01 packages, never the claimed package.
• hardening /00 and /14 were still revision 1 with no link to the bootstrap package.

This run adds one decisive new fact the verification mission did not have: the package did exist on the local filesystem (written 2026-06-02 11:17–11:24) but was never published to the KB. The prior PASS described a deliverable on the wrong surface — a local draft, not a searchable/readable KB artifact. PASS may not be claimed for a deliverable that is unreadable in KB, so the prior PASS is rejected as evidence and its memory-index line is overstated (corrected in doc 06).

The prior draft is also not usable as evidence because its load-bearing value was live BEGIN..ROLLBACK rehearsal results; those must be re-generated live, not copied. This package therefore re-runs the rehearsal from scratch and publishes the actual results.

0.2 Which design package is the current valid input

one-roof-axis-auth-proposal-operational-hardening-build-ready-design-2026-06-02/ — 17 docs (00–16), all revision 1, design-only, intact and discoverable in KB. It is the controlling, verified input. Governing docs read this run:

• doc 02 — approval/authorization state machine (L0–L4, the bootstrap §2.7).
• doc 03 — SB-0 governance_build_authorization + v_build_auth_valid + verifier + action-type rows (CREATE-TABLE level).
• doc 05 — axis_registry + axis_assignment (CREATE-TABLE level).
• doc 11 — Phase-1 impact / rebuild plan (M-1 redefinition + SB-0 as first build step).
• doc 13 — build readiness matrix (the one gate = L2 council + L4 sovereign ratification).
• doc 14 — next prompts N1 (ratification packet), N2 (SB-0 rehearsal), N5 (axis rehearsal).

0.3 What was rerun

A single live author-mode BEGIN..ROLLBACK rehearsal proving, against the live PG16 schema:

1. SB-0 substrate compiles — table + 4 CHECK + partial-unique + 3 indexes (doc 03).
2. verifier layer compiles — quorum_passed, valid_sovereign_esign, v_build_auth_valid, fn_build_commit_allowed (doc 03 §3.2/3.4).
3. validity is recomputed from backing quorum/evidence, never trusted from a raw row (anti-forgery keystone, INV-6/INV-10).
4. seven fail-closed modes: forged, expired, consumed, revoked, insufficient-quorum, sovereign-without-esign, self-grant (INV-5).
5. SB-0 table CHECK negatives + grant-stacking unique.
6. axis_registry + axis_assignment compile (doc 05); six axis constraint negatives + UI-visibility gate.
7. entry == exit, zero residue, idle_in_transaction = 0 (proven from two independent channels).

Results: docs 02 (preflight), 03 (SB-0), 04 (axis), 05 (negatives). This run is safer than the prior draft: the valid-grant path is backed by a real existing approved request (APR-S178F18-FALLBACK-5) rather than seeding mock rows into the live approval spine — so zero writes hit approval_requests/apr_approvals/apr_action_types and birth_registry is invariant throughout the rehearsal, not merely after rollback.

0.4 What remains forbidden / NOT done

No COMMIT; no build; no persistent schema/table/view/function/trigger; no os_proposal_approvals write (no real or self e-sign); no event/DOT registration; no event emit; no Directus/Qdrant/Nuxt mutation; no law enactment/version/status change; no production change. The only persistent writes this mission makes are KB documents (this package) and two additive cross-link edits to hardening docs 00/14 (doc 06).

0.5 Hard Gate 0 (all confirmed — see doc 02)

Check	Result
KB read	✅ read hardening 03/05, verification report, GPT review
KB write	✅ this package published (doc 06 / artifact verification)
Live PG read-only baseline	✅ query_pg db directus
Author-mode psql channel	✅ ssh contabo → docker exec -i postgres psql -U workflow_admin -d directus (PG 16.13)
All DDL/DML inside BEGIN..ROLLBACK	✅ single transaction, ends ROLLBACK
No COMMIT / no persistent mutation	✅ verified entry==exit from two channels
No approval/e-sign/event/DOT/law	✅ none touched
Rollback + idle-tx verification	✅ idle_in_transaction=0, 0 leftover sessions

0.6 Cross-links

• executes/closes the rerun mandated by [[auth-axis-bootstrap-artifact-verification-and-final-build-decision-2026-06-02]] and [[gpt-review-artifact-verification-confirms-bootstrap-package-missing-rerun-required-2026-06-02]].
• rehearses the build-ready design [[one-roof-axis-auth-proposal-operational-hardening-build-ready-design-2026-06-02]] (docs 02/03/05/11/13/14).
• Final decision: GO_TO_RATIFICATION_INTAKE (package + rehearsal verified; ratification not enacted) ⇒ persistent BUILD: NO-GO (doc 07).