# Source Registry Admin Dry-Run Preview Enable Disable Workflow V01 Issue: [#341](https://github.com/pinklon/ai-capability-discipline/issues/341) Date: 2026-06-28 Repository: `pinklon/ai-capability-discipline` Baseline commit: `c9d704e05a9b26d104d717d5e2321c1eaed06a39` Status: dry-run Preview enable/disable workflow depth only. This ticket adds dry-run Preview enable/disable workflow depth only. This ticket does not implement live Source Registry Admin commands, does not mutate source registries, does not mutate Preview or Production source sets, does not enable sources, does not disable sources, does not retire sources, does not promote sources, does not use Cloudflare CLI or API, does not call external URLs, does not change provider or model configuration, does not change runtime retrieval behavior, does not change package authority, does not start Production apply, does not start OKF implementation, does not start Google SDLC implementation, does not start multi-agent orchestration implementation, does not close #271, does not reopen #269, does not close #269, and does not apply `codex-automerge`. ## Purpose Prove dry-run workflow posture for Preview enable and Preview disable before any live apply capability exists. The workflow demonstrates that Source Registry Admin can validate the governed preconditions for adding a source to Preview posture and removing a source from Preview posture while reporting intended deltas only. It does not write registry state and does not write source-set state. ## Relationship To Prior Source Registry Admin Slices #325 / PR #326 defines Source Registry Admin product requirements. #327 / PR #328 documents the first substantive current-source extraction-profile slice. #329 / PR #330 defines Source Registry Admin command contract v01. #331 / PR #332 defines Source Registry Admin schema and lifecycle validation. #333 / PR #334 defines Source Registry Admin dry-run command parser v01. #335 / PR #336 defines Source Registry Admin dry-run receipt schema enforcement. #337 / PR #338 defines Source Registry Admin dry-run registry snapshot and last-known-good posture. #339 / PR #340 defines dry-run add_source plus validate_source workflow depth. This slice extends that chain with Preview source-set workflow depth while preserving dry-run evidence posture. ## Non-Goals This dry-run Preview enable/disable workflow slice does not: - implement live Source Registry Admin commands - mutate source registries - mutate Preview or Production source sets - enable, disable, retire, or promote any source - use Cloudflare CLI or API - call external URLs - change provider or model configuration - change runtime retrieval behavior - change package authority - start Production apply - start OKF implementation - start Google SDLC implementation - start multi-agent orchestration implementation - close #271 - reopen #269 - close #269 - apply `codex-automerge` This ticket does not mutate source registries. This ticket does not mutate Preview or Production source sets. ## Workflow Model The dry-run workflow evaluator supports these Preview workflow names: - `enable_preview` - `disable_preview` - `enable_preview_plus_disable_preview` `enable_preview` evaluates whether a fixture source record is eligible for Preview posture. `disable_preview` evaluates whether a fixture source record is represented as Preview-enabled and eligible for Preview removal posture. `enable_preview_plus_disable_preview` evaluates an ordered dry-run sequence with an enable step and a disable step for the same `source_id`. The sequence uses fixture posture for each step. It does not apply the first step before evaluating the second step. Accepted workflow output includes: - `dry_run: true` - `workflow` - `workflow_status` - `commands` - `source_id` - `initial_lifecycle_state` - `proposed_lifecycle_state` - `validation_checks` - `refusal_checks` - `receipt_previews` - `snapshot_posture` - `last_known_good_posture` - `intended_preview_source_set_deltas` - `preview_source_set_mutated: false` - `mutations_performed: false` - `boundary_confirmations` ## Preview Enable Dry-Run Posture Accepted `enable_preview` workflow posture requires: - a source record that passes existing schema and lifecycle validation - `lifecycle_state: registered` - `environment_eligibility.preview: true` - validation posture sufficient for active Preview use - explicit `registry_snapshot_ref` - explicit `last_known_good_registry_ref` - receipt posture with `dry_run: true` - no current Preview active-environment posture in the fixture The accepted output reports an intended Preview source-set add delta. The delta states that the source would be added to Preview by a future live implementation, but that the current dry run applied nothing. ## Preview Disable Dry-Run Posture Accepted `disable_preview` workflow posture requires: - a source record that passes existing schema and lifecycle validation - `lifecycle_state: preview_enabled` - fixture `active_environments` containing `preview` - explicit `disable_reason` - explicit `registry_snapshot_ref` - explicit `last_known_good_registry_ref` - receipt posture with `dry_run: true` The accepted output reports an intended Preview source-set remove delta. The delta states that the source would be removed from Preview by a future live implementation, but that the current dry run applied nothing. ## Refusal Cases Preview enable dry-run workflow refuses: - missing source record - missing registry snapshot reference - missing last-known-good reference - source already Preview-enabled by fixture posture - source already disabled by fixture posture - source not in `registered` lifecycle posture - missing Preview eligibility - schema or lifecycle validation failure - request for live source registry mutation, source-set mutation, Cloudflare operation, external URL call, runtime behavior change, provider/model configuration change, or package authority change Preview disable dry-run workflow refuses: - missing source record - missing registry snapshot reference - missing last-known-good reference - source not represented as Preview-enabled by fixture posture - source already disabled by fixture posture - missing disable reason - schema or lifecycle validation failure - request for live source registry mutation, source-set mutation, Cloudflare operation, external URL call, runtime behavior change, provider/model configuration change, or package authority change ## Receipt-Preview Behavior Each accepted command step emits a dry-run receipt preview. The receipt preview includes command name, source ID, lifecycle before/proposed posture, active-environment before/proposed posture, registry snapshot posture, last-known-good posture, and `boundary_confirmations`. For Preview enable and Preview disable, the receipt preview also includes `intended_preview_source_set_delta`. Refused workflows emit `refusal_receipt_posture` with `dry_run: true`, failed checks, `mutations_performed: false`, and boundary confirmations. ## Snapshot/LKG Posture Preview enable and Preview disable are environment-changing postures. They require pre-mutation registry snapshot and last-known-good references in the dry-run fixture. The workflow output includes `snapshot_posture`. The workflow output includes `last_known_good_posture`. Both postures are evidence posture only. They do not create a snapshot, do not create a last-known-good record, and do not apply rollback behavior. ## Boundary Guarantees No source registries were mutated. No Preview source set was changed. No Production source set was changed. No source was enabled, disabled, retired, or promoted. No Cloudflare CLI or API was used. No external URLs were called. No provider or model configuration was changed. No runtime retrieval behavior was changed. No package authority was changed. #271 remains open. #269 remains closed. `codex-automerge` was not applied. ## Difference Between Intended Delta And Live Mutation An intended Preview source-set delta is a receipt-preview statement. For `enable_preview`, the delta says the future live operation would add the source ID to Preview. For `disable_preview`, the delta says the future live operation would remove the source ID from Preview. The delta is not a source-set write. It is not live registry state. It is not Cloudflare state. It is not runtime retrieval behavior. It is not source promotion. It is only deterministic dry-run output for validation and review. ## Fixture Strategy Valid fixtures live in `validation/fixtures/source_registry_admin/dry_run_preview_enable_disable_workflows_valid_v01.json`. They cover: - valid Preview enable posture - valid Preview disable posture - composed Preview enable plus disable posture - registry snapshot and last-known-good posture - intended Preview add delta - intended Preview remove delta - no Preview source-set mutation Invalid fixtures live in `validation/fixtures/source_registry_admin/dry_run_preview_enable_disable_workflows_invalid_v01.json`. They cover refusal for: - missing source record - missing registry snapshot reference - missing last-known-good reference - source already Preview-enabled by fixture posture - missing Preview eligibility - source not Preview-enabled by fixture posture - source already disabled by fixture posture - missing disable reason - live mutation request flags ## Validation Coverage The focused validator is `validation/scripts/check_source_registry_admin_dry_run_preview_enable_disable_workflow.py`. It checks: - `enable_preview` workflow support - `disable_preview` workflow support - `enable_preview_plus_disable_preview` workflow support - accepted fixture output shape - refused fixture output shape - specific failed-check coverage - intended Preview source-set delta posture - receipt-preview posture - snapshot posture - last-known-good posture - no source registry mutation - no Preview source-set mutation - no Production source-set mutation - documentation and JSON companion existence - `run_all.py` wiring - context-pack discoverability - validation receipt presence ## Post-Closeout Next Action After this dry-run Preview enable/disable workflow slice is merged and locally closed out, choose whether to add a future live apply design gate for Source Registry Admin or continue extraction-profile work under #271. Do not start #271 from this ticket.