Codex FIX7 Final Hardcode / PG-Native-Driven Design Review - Progress

Date: 2026-06-08 Mode: READ-ONLY production; KB report/checkpoint/design corrections only.

Mission

Adversarially review and correct FIX7 before T1 implementation, with absolute zero-hardcode and true PG-first/native/driven gates.

Progress

• Read .claude/skills/incomex-rules.md.
• Read Operating Rules v7.58 and Constitution v4.6.3 through Agent Data MCP.
• Read Birth Gateway Design Index rev22 and open-goal prompt v1.3.
• Read all FIX7 design documents and checkpoint.
• Identify design gaps.
• Correct original FIX7 package/checkpoint.
• Write 12 review documents + review checkpoint.
• Verify and MCP read-back.

Initial Adversarial Verdict

PG_NATIVE_DRIVEN_PARTIAL_NEEDS_DESIGN_FIX

Original FIX7 had the correct authority direction but still left ambiguity/disguised-hardcode risk:

1. gate evaluator functions could hide policy or literal PASS/FAIL;
2. capability threshold_jsonb required capability-specific CASE parsing;
3. principal classes and tier reviewer mapping were embedded literals;
4. operator-controlled activation could replace a denominator without independent quorum;
5. hash component list was described as fixed code rather than a sealed exact-set manifest;
6. static analysis did not fully define dynamic-SQL and analyzer-completeness rules;
7. evidence URI immutability did not prove artifact availability/content on read-back;
8. authoritative inventory discovery still referenced an existing/manual inventory;
9. writer-side-path closure was not stated as zero direct table DML for every runtime role;
10. privileged cutover wording allowed operator-executed SQL instead of requiring an approved DOT/migration pipeline.

These are being corrected before final certification.

Corrections Completed

1. Generic typed fact/policy interpreter; adapters cannot return authoritative PASS/FAIL.
2. Normalized typed capability requirements/results; removed free-form threshold policy.
3. Manifest/FK-driven principal classes, actions/verdicts, tiers, signoff requirements.
4. Exact independent activation quorum; operator-alone activation rejected.
5. Manifest-driven hash components and no-bypass vectors.
6. Deterministic authority-scope closure; 262 is evidence only.
7. Analyzer contract/test corpus; dynamic SQL forbidden unless manifest-bounded/runtime OID checked.
8. Content-addressed/versioned evidence with scheduled byte/hash read-back.
9. Zero direct runtime protected-target DML outside sealed gateway.
10. Approved Level-B DOT/migration pipeline required for privileged live changes.
11. Hash-bound control-epoch serialization prevents writer/activation TOCTOU.
12. Fact adapters/operator primitives constrained by typed signature, owner, source, dependency, volatility, and read-only/side-effect-free contract.

Final Verification Evidence

ADVERSARIAL_COVERAGE_CHECK=PASS
CHECKS=11
ORIGINAL_DOCS=12
REVIEW_DOCS=12
FINAL_DIFF_CHECK=0
FORBIDDEN_POSITIVE_SCHEMA_REMAINDERS=(none)

Final Verdict

PG_NATIVE_DRIVEN_READY_FOR_T1_IMPLEMENTATION

• Original FIX7 sufficient without changes: NO.
• Corrected FIX7 sufficient for T1 authoring/testing: YES.
• T1 live FIX7a: only through operator-gated approved pipeline and must keep authority_cutover_complete=false.
• FIX7b/FIX7c live actions: operator-gated.
• Stage 2.6B/apply/permits/REAL_RUN: BLOCKED.
• Production mutation in this review: NONE.

MCP Evidence

original FIX7 key docs updated: 5, revision=2
final-review key docs/checkpoint created: 4, revision=1
get_document(final-review checkpoint): revision=1
get_document(corrected original checkpoint): revision=2
list_documents(final-review directory): count=3
semantic search: returned exact PG_NATIVE_DRIVEN_READY_FOR_T1_IMPLEMENTATION checkpoint,
corrected recommendation, final-review readme, and T1 go/no-go

Operating Closeout

• Operating Rules update: not needed; review follows v7.58 and changes no operating law.
• Technical debt: no separate TD. Real analyzer implementation, real capability runs, and live ownership/ACL cutover remain explicit blocking implementation work.
• Handoff: T1 author/test boundary and operator-gated live boundary are explicit in review doc 11.