01 — Live State and SSOT Confirmation

All claims below were re-verified live this run (RO query_pg + ssh read-only inspection). Old reports are evidence; the live readings here are authority.

Containers (10) — none is a DOT executor

agent-data (8080), claude-kb (8000), claude-mcp (8000), directus (8055), nginx (443/80), nuxt (8080), qdrant, pg-restore-test, postgres (5432), uptime-kuma. Confirmed: no agent_api executor container exists. (This run authors one as a package.)

agent_api contracts (live)

2 rows in dot_agent_api_contract:

• DOT_KG_EXPLAIN — contract_ready, mode PLAN_ONLY, endpoint_ref NULL, ns DRYRUN-NS:dot:kg:explain, fixture FIXTURE:dot:kg:explain:v1.
• DOT_KG_EXPLAIN_VERIFY — contract_ready, mode VERIFY_ONLY, endpoint_ref NULL, same ns/fixture. Both endpoint_ref NULL (correct; no fake binding).

Dispatcher (live)

fn_process_agent_api_dispatch — fail-closed. Verified by reading its source: refuses unless runtime execute=false/real=false/dry_only=true; refuses REAL_RUN; refuses DRY_RUN while endpoint_ref NULL; requires correlation_id; validates contract, dot_tools membership, fixture_ref, DRYRUN-NS namespace. When asked to write an observation it records SIMULATED_DRY_RUN with preparedness DRY_RUN_PREPARED_BLOCKED_NO_ENDPOINT — never DRY_RUN/REAL_RUN.

Observation tables (live)

process_run_observation: 4 rows, all evidence_type=SIMULATED_DRY_RUN. 0 DRY_RUN, 0 REAL_RUN. process_component_observation: present (FK to run).

Views (live)

31 v_process_discovery_* views (v2..v6 chain + endpoint/contract/policy + this run's 3 v7).

Verifier function (live, this run)

fn_dryrun_fixture_selfcheck — pure IMMUTABLE. Re-ran live:

• real fixture → pass=true, 7/7.
• FAIL path was crashing (malformed array literal); FIXED this run; negative controls now return pass=false with correct reasons (hallucinated node, missing target, production-table ref).

process.* events (live)

7 types, all active=false (do-not-activate this run).

job:cut (live)

v_process_discovery_verified_candidates_v3: PROC-CAND:job:cut, kind=job, 8 members, verified_candidate, VERIFIED_PENDING_OWNER, has_cross_component_correlation=true, owner_missing=true. Only verified candidate (invariant holds).

Safety baseline

births 1,163,447; guard_alerts 129; DRY_RUN 0; REAL_RUN 0 — captured at start and re-checked after every live change.

SSOT confirmation

Checkpoints 1 and 9–12 read in full; docs 02/04/05/07/08/09/13 of the prior macro read in full. All consistent with live EXCEPT the verifier failure-path claim, corrected above.