09 — Process Axis Closeout Roadmap (Workstream H)

One decision-grade roadmap to finish the Registries-Pivot Process Axis and return to information-piece content work. No small task loops.

What is DONE / LIVE

• Process Discovery substrate v2→v6 + this run's v7 closeout views (LIVE).
• Runtime observation tables; fail-closed dispatcher; agent_api contract registry (LIVE).
• Deterministic verifier — proven both directions (pass + negatives) after this run's fix (LIVE).
• Endpoint producer service — authored, staged, wiring-self-tested (STAGED).
• Auto-workflow admission policy — operationalized over live views (LIVE).
• D1/D2 companion content set — published.
• job:cut — verified_candidate, registration packet final.
• dot:kg — plan_only_tested, full post-endpoint packet (owner/event/10-def split) final.

What REMAINS

#	step	gate type	blocker
1	Deploy endpoint container + bind	operator + owner	owner authorizes OpenAI credential reuse; operator deploys
2	First true DRY_RUN (one KG pair)	operator	step 1
3	UI v6/v7 deploy	operator	none (ready)
4	job:cut owner registration + birth	owner	owner-of-record (Điều 37)
5	dot:kg correlation + real run	engineering + operator	step 2; establish shared process_run_id
6	dot:kg owner + 10-def split + birth	owner	step 5
7	process pivots canonization (PIV-*)	owner	births canon
8	process.* event activation	owner	production-affecting; deliberate
9	return to information-piece content work	—	none

What can proceed WITHOUT owner (operator/engineering only)

• UI v6/v7 deploy (step 3) — fully ready now.
• Endpoint container build + internal deploy + self-test (the no-credential parts of step 1).
• dot:kg correlation modeling design (pre-work for step 5).

What requires OWNER

• Credential reuse authorization (step 1), job:cut + dot:kg birth (4, 6), pivot canon (7), event activation (8), verifier re-classification decision (doc 06).

What requires EXTERNAL infra

• Only the OpenAI credential authorization for the new executor (everything else — SDK, egress, hosting — is present). This is the single remaining true external dependency, and it is narrow.

Exact order to finish

1. UI v6/v7 deploy (parallel, no blockers).
2. Owner authorizes credential reuse → operator deploys endpoint → bind.
3. First true DRY_RUN (one KG pair).
4. job:cut owner registration + birth.
5. dot:kg correlation → real run → owner → 10-def split → (optional) event activation.
6. Process pivots canonization.
7. Return to information-piece content work.

Anti-pattern guard

Do NOT re-run discovery/readiness loops. The substrate is complete; remaining work is deploy + owner decisions + content. The next macro should pick the largest safe block (see doc 11), not a narrow approval-only step.