ORACLE Pre-Conversion Intent — GATE-2 Deploy Report

Date: 2026-08-19 Status: Build merged, hardened, and GATE-2 DDL deployed. Activation (person-level flag-flips) intentionally not performed — blocked on a Cell 36 holdout registration by the workflow's own constitutional gate. Claim label: built, pre-benchmark; zero person-level activation.

Companion docs (all on main): the build report docs/reports/ORACLE_PRECONV_BUILD_2026-08-18.md, the operator procedure docs/runbooks/ORACLE_PRECONV_ACTIVATION_RUNBOOK.md, and the Step-0 verify report docs/reports/ORACLE_PRECONV_STEP0_2026-08-18.md.

1. What landed

Piece	Evidence	State
ORACLE build (Cell 33 VDI/behavioral capture, Cell 34 session transformer, creative-aesthetic vectors, Cell 35 latent bridges)	auto-merge `f872a9d` (GATE 1)	merged, flag-OFF, CI green
Activation runbook	`e79b8b01`	on `main`
GATE-2 operator-assist workflow (`oracle-operator-assist.yml`)	PR #736 → `877bb535`	merged (dispatch-only, all activations default OFF)
Hardening — 4 fail-closed gates	PR #738 → `8c7a85e6` (closes #737)	merged
Skills-parity CI red (pre-existing, main-side)	`a6a16537`	fixed — `main` green
GATE-2 additive DDL	run `32272394825` (sha `2902dddb8`) SUCCESS	applied

2. The hardening (issue #737, Codex P1/P2 on #736)

.github/scripts/oracle_activation_lib.sh provides reusable, fail-closed gates that every activate_* stage runs before flipping a flag:

P1a validate_holdout — refuses unless intent_holdouts for the tenant has BOTH arms (holdout+treatment), a plausible fraction (5–30%), assigned_at in the past (pre-exposure), and ≥ min_holdout_units. A lone hand-inserted holdout row no longer passes.
P1b assert_single_tenant — the flags are read globally, so it asserts the service is single-tenant-pinned to the gated tenant (MIZOKI_TENANT_ID / extender INTENT_TENANT_ID, no INTENT_TENANT_MAP).
P2a assert_traffic_serving — status.traffic must route 100% to the newest revision (a traffic pin cannot mask the flip).
P2b assert_extender_ready — extender /readyz 200 after Stage A.

Residual (tracked in #737, not hidden): the cells accept a per-request asserted tenant, so complete multi-tenant safety also needs cell-side rejection of non-gated asserted tenants when a flag is on — a cell-code follow-up. Until then these gates enforce single-tenant-only activation.

3. The DDL defect this surfaced

The first apply_ddl run (32270883946) failed: creative_vectors.embedding ARRAY<FLOAT64> NOT NULL — BigQuery rejects NOT NULL on an ARRAY/REPEATED field ("NULL arrays are always stored as an empty array"). Fixed in 395c9d28 (dropped NOT NULL; moot — the writer always sets the 128-dim vector). Hazard: DDL unit tests parse but never execute against BigQuery, so this only appeared on the first real apply.

4. Live state after the successful apply (run `32272394825`)

Additive DDL applied: intent_signals behavioral columns (behavioral, sequence_id, sequence_index) + intent_scores_shadow + creative_vectors.
Posture smoke green: cells 33/34/35 IAM-locked (unauth /health refused, authed 200, traffic 100% on newest revision); extender ready.
All activate_* flags OFF — no behavioral capture, no scoring, no hypotheses, no serving.

5. Remaining for actual activation (owner / Cell 36 operator)

Register the permanent holdout via Cell 36 assign_holdouts (per account × action-class, ~10–20%, before first exposure) — the workflow refuses every activation stage until intent_holdouts satisfies validate_holdout.
Dispatch oracle-operator-assist.yml staged: activate_capture=true → verify shadow rows → activate_shadow=true → activate_hypotheses=true.
Serving/targeting stays out of scope behind the separate uplift_export_cohort + iROAS gate.