Current State — FIX7 Final Authority-Seal Fail-Open + Provenance Patch Ready

• Effective date: 2026-06-11 Asia/Ho_Chi_Minh
• Status: FIX7_FINAL_AUTHORITY_SEAL_SELF_CODEX_READY_AFTER_FAILOPEN_PATCH
• Supersedes: CODEX_FIX7_FINAL_AUTHORITY_SEAL_REJECT (2026-06-10) for all engineering classes.

T1 closed Codex's final-seal rejection at the engineering level. The authority-seal encoder now fails closed on every invalid authority value, empty/duplicate report set, and REHEARSAL/missing/forbidden provenance; the governed-KB evidence files Codex flagged 404 are published and present.

• Codex's 8 direct probes: reproduced ACCEPTED pre-fix → all REJECTED post-fix; +11 extended probe classes also REJECTED (19/19 fail-closed).
• Self-Codex dry-run (bash rehearsal/commands.sh, rc 0): selftest 48/48 · rehearsal OK · red-team 39/39 · drift 41/41 · anti-hardcode 13/13 · probes 19/19 REJECTED.
• Encoder 13344f92…957144b8; fixture pins 6225f265…/b1f001b6…/3599f663… and engineering pins 49c386a9…/b95df0a5… unchanged → no Packet V3 contradiction.

No real N7/N8/P7 seal was authored. No real seal is claimed. The provenance gate surfaces a standing true blocker — SEAL_REAL_N6_NOT_AVAILABLE: a real non-rehearsal ENGINEERING_VERIFIED_CANDIDATE N1..N6 chain must be supplied and sealed (owner/operator + Codex). It was not faked.

Implementation and all production actions remain blocked. No Stage 2.6B, permit, REAL_RUN, QT001 apply, PostgreSQL, Directus, registry, or system mutation was authorized or performed.

Next: route the patched closure packet to Codex for a fresh final-seal review (Codex re-runs the dry-run from governed KB; all probes now fail closed). Seal remains gated on the real N6 chain + N7/N8/P7 authority inputs + owner implementation authorization.

Full report: knowledge/dev/laws/tool-kiem-thu/reports/fix7-final-authority-seal-failopen-provenance-patch-master-report-2026-06-11.md Checkpoint: knowledge/dev/laws/tool-kiem-thu/checkpoints/checkpoint-fix7-final-authority-seal-failopen-provenance-patch-ready-2026-06-11.md Ledger (rev7): knowledge/dev/laws/tool-kiem-thu/checkpoints/fix7-recheck9-remaining-authority-blocker-ledger-2026-06-10.md