Incomex AI Portal
KB-4713 rev 31

Birth Gateway Design Index

41 min read Revision 31
birth-gatewayssotdesignindex2026-06-06

Birth Gateway Design Index

2026-06-08 - CODEX FIX7 LEGACY-DISPOSITION DESIGN AMENDMENT, OPTION BETA APPROVED: Status FIX7_LEGACY_DISPOSITION_DESIGN_AMENDMENT_APPROVED_OPTION_BETA. Codex confirms the existing exactly-27-surface design has no typed home for a five-value legacy-disposition contract and T1 correctly stopped. Option Beta removes the standalone disposition enum, LEGACY_* #20 semantics, computed/CASE classifier, STUB body path, manual DO_NOT_TOUCH exclusion, and all label/class-driven policy branches. Exact U_legacy is derived only from sealed #20 protected-target roots plus #11 analyzer closure; every member converges to one uniform end-state: approved unreachable qt001_cp_owner, unchanged definition/body, and effective privileges exactly equal complete closed-world sealed #21 rows. relkind/prokind may choose syntax mechanics only, never policy. Boundary collisions and unsupported cases fail closed. Invariants 27/11/14/7 unchanged; no new authority surface/readiness gate/hash contract. T1 must patch the blueprint, then Codex recheck 3. Implementation, Stage 2.6B, permit, REAL_RUN, QT001 apply, activation/repoint/cutover remain BLOCKED. Report codex-fix7-legacy-disposition-design-amendment-2026-06-08/00..08; checkpoint checkpoint-codex-fix7-legacy-disposition-design-amendment-2026-06-08.md.

2026-06-08 - T1-Max FINAL INDEPENDENT REVIEW OF FIX7 REFACTOR BLUEPRINT (REVISED, READY FOR CODEX CRITICAL REVIEW): Status FIX7_REFACTOR_BLUEPRINT_MAX_REVIEWED_AND_REVISED_READY_FOR_CODEX_CRITICAL_REVIEW. READ-ONLY production; blueprint KB-doc direct-revision; no production mutation. Final internal adversarial pass (did NOT trust the blueprint's embedded or the XHigh PASS claims) audited the XHigh-revised blueprint vs LIVE evidence + the governing law. 🔴 Live evidence (read-only DB directus, 2026-06-08): ALL 46 legacy qt001_* functions + sp_dot_birth_qt001_apply have proacl=NULL = PUBLIC EXECUTE, none SECURITY DEFINER; 0 triggers on qt001 tables / 0 triggers invoke a qt001 fn (no trigger bypass vector); counts confirmed 20 tables / 46 fns / 196 directus-owned views (183 v_qt001_* + 13 other qt001-named). 7 findings, ALL directly fixed in-blueprint, 0 blockers (3 P1 / 3 P2 / 1 P3): MB-01 (P1) legacy neutralization (S15/PKG-F + G-NOLEGACY) widened from a sampled "apply/writer" subset to the COMPLETE S00-captured legacy-entrypoint set, closing the activate->freeze window; MC-01 (P1) G-DOT-NOOVERWRITE re-grounded on PG-native owner-isolation (nspacl/ownership) as FINAL authority, DOT-body scan demoted to fail-closed diagnostic (DOTs are not pg_proc); birth-gateway overwrite-protection = detection (G-BIRTH-NEUTRAL) + DOT-frozen + DO_NOT_TOUCH policy (FIX7 cannot strip directus's gateway ownership); MA-01 (P2) stale post-XHigh top-line status (..._READY_FOR_CODEX_CRITICAL_REVIEW, which skipped the Max gate) corrected in doc 12 + blueprint checkpoint; ME-01 (P2) owner/ACL rollback snapshot made concrete (ownership + table/view/function/sequence ACLs + nspacl + default privileges); MG-01 (P2) fresh Codex re-audit gates added before PKG-F + PKG-G (law §4G: governance/authority change must be explicit + re-reviewed); MH-01 (P2) guard-quality rules (no vacuous "=0" pass / NULL-strict aggregates not bool_and / source-text diagnostic-only); MB-02 (P3) birth-family completed (10 fn_birth_*, all DO_NOT_TOUCH). 30 guards unchanged (tightened, none added/removed); invariants 27/11/14/7 PRESERVED; zero-hardcode + PG-native PASS. Blueprint docs revised: 01/02/04/05/06/07/08/12 + checkpoint. Implementation / Stage 2.6B / permit / REAL_RUN / QT001-apply / owner-ACL-cutover / manifest-activation ALL remain BLOCKED. NEXT = Codex independent critical review of the blueprint. Report dir t1-max-fix7-refactor-blueprint-review-2026-06-08/00..12; checkpoint checkpoint-t1-max-fix7-refactor-blueprint-review-2026-06-08.md.

2026-06-08 - T1-XHigh INDEPENDENT REVIEW OF FIX7 REFACTOR BLUEPRINT (REVISED, READY FOR MAX REVIEW): Status FIX7_REFACTOR_BLUEPRINT_XHIGH_REVIEWED_AND_REVISED_READY_FOR_MAX_REVIEW. READ-ONLY production; blueprint KB-doc direct-revision; no production mutation. Independent XHigh pass (did NOT trust the blueprint's embedded self-review) audited the refactor blueprint vs LIVE evidence + doc consistency. 🔴 Live evidence: legacy apply/writer fns (fn_dot_birth_qt001_apply, sp_dot_birth_qt001_apply, fn_qt001_plan_v5, fn_dot_birth_qt001_plan_v2) have proacl=NULL = PostgreSQL default EXECUTE to PUBLIC → legacy entrypoints PUBLIC-executable LIVE, substantiating "blocked not merely unreachable" + gateway-overwrite risk. 10 findings, ALL directly fixed in-blueprint, 0 blockers (3 P1): XHI-02 dangling guard G-LEGACY-FROZEN (referenced doc04 S17 + doc07 PKG-H, undefined) → defined; XHB-01 no gateway/control-plane overwrite guard → +G-DOT-NOOVERWRITE (DOT-119 embeds CREATE OR REPLACE fn_birth_registry_auto); XHB-02 S15 rollback restores legacy EXECUTE → doc05 note5 proves returns to prior safe-blocked baseline (apply blocked since NOT_SAFE), not silent bypass; XHH-01 +hard-block rows birth-gateway-modification + registry-pivot-repoint; XHL-01 +cross-layer OUT-OF-SCOPE (Đ43 context-truth / QT-006 lifecycle / registry-pivot / raw-birth-as-truth); XHI-01 guard count 26→30; XHD-01 PKG-G no-go; XHO-01 regclass binding order + S19 precond S16→S18; XHJ-01 S00 inventory diagnostic-only (authority=#11/#20/#21); XHM-01 #26 mapping reworded (registers/binds, NOT replaces birth gateway). Guards now 30 (PG-native). Invariants 27/11/14/7 PRESERVED; zero-hardcode + PG-native PASS. Blueprint docs revised: 02/04/05/06/07/08/12 + checkpoint. Implementation/2.6B/permit/REAL_RUN/QT001-apply/owner-ACL-cutover/manifest-activation ALL remain BLOCKED. NEXT = Max review, then Codex independent critical review. Report dir t1-xhigh-fix7-refactor-blueprint-review-2026-06-08/00..13; checkpoint checkpoint-t1-xhigh-fix7-refactor-blueprint-review-2026-06-08.md.

2026-06-08 - T1 FIX7 EXISTING-SYSTEM REFACTOR EXECUTION BLUEPRINT (READY FOR CODEX CRITICAL REVIEW): Status FIX7_REFACTOR_BLUEPRINT_READY_FOR_CODEX_CRITICAL_REVIEW. READ-ONLY production / AUTHOR_MODE_ONLY; KB docs only; no production mutation. T1 mapped the officially-approved FIX7 design onto the LIVE system (read-only introspection of DB directus, 2026-06-08). Central finding: FIX7 is a parallel green-field qt001_cp control plane, not an in-place edit - qt001_cp schema and qt001_cp_owner/migrator/reader roles ABSENT; legacy qt001_* in public = 20 tables / 46 fns / 196 views, all owner directus (FIX..FIX6); birth gateway + DOT-118/119 = DO_NOT_TOUCH. Refactor = ADD whole qt001_cp (all MISSING_ADD, operator-gated) + atomic authoritative repoint proven non-reachable-to-legacy by dependency_manifest #11 + legacy freeze/deprecate (never live DROP) + ROLE_CUTOVER_LATER for directus-owned control objects. Internal three-phase review: High authoring (docs 00-08) -> XHigh (3 findings + 1 advisory) -> Max (3 findings); all 6 revised in-macro to PASS. Key fixes: XH-2 legacy entrypoints PUBLIC/directus-executable in activate->cutover window (FIX2/FIX3 bypass) -> neutralization bundled into PKG-F + G-NOLEGACY "blocked not merely unreachable"; XH-4 ACL cutover scoped to control objects only (Directus CMS app authority preserved); MX-1 capture existing Directus SELECT set before #21 authoring; MX-2 flag S15 neutralization + S17/S18 freeze/deprecate as T1 operationalization needing Codex confirmation; MX-3 verify ACL rollback snapshot before REVOKE. Invariants preserved: 27 authority surfaces / 11 non-authority runtime-evidence / 14 readiness gates (DATA) / 7 hash contracts H01..H07; 0 new gates; 0 new hash contracts. Zero-hardcode PASS, PG-first/native/driven PASS, rollback COMPLETE. 18-gap matrix (7 P0 / 9 P1 / 2 P2 / 0 open); S00-S19 construction order; 26-guard test blueprint; PKG-A..I split. Implementation, Stage 2.6B, permit, REAL_RUN, QT001 apply, manifest activation, owner/ACL cutover ALL remain BLOCKED. NEXT = Codex independent critical review of the blueprint. Report dir t1-fix7-existing-system-refactor-execution-blueprint-2026-06-08/00..12; checkpoint checkpoint-t1-fix7-existing-system-refactor-execution-blueprint-2026-06-08.md.

2026-06-08 - CODEX OWNER CONFIRMATION, FIX7 OFFICIALLY APPROVED FOR IMPLEMENTATION PLANNING: Status FIX7_DESIGN_OFFICIALLY_APPROVED_BY_CODEX_FOR_IMPLEMENTATION_PLANNING. Codex acknowledges that the prior codex-fix7-final-design-approval-2026-06-08 package was executed by T1 and therefore was review evidence, not owner authority. In this actual owner-confirmation run: A MISROUTING_ACKNOWLEDGED · B T1_EVIDENCE_VALID (T1 genuine final short-review = DESIGN_READY_FOR_CODEX_FINAL_APPROVAL, 11/11 docs readable, 0 blocking proposals; invalid optional OBS-01 rejected and not carried forward) · C CODEX_OWNER_APPROVES · D BOUNDARIES_CONFIRMED. Exactly 27 authority surfaces · 11 non-authority runtime-evidence tables · 0 new readiness gates · 0 new top-level hash contracts (H01..H07 intact). The FIX7 design is the official Codex-approved baseline for a later, separately authorized implementation-planning/authoring phase only. Production implementation, Stage 2.6B, permit, REAL_RUN, QT001 apply, manifest activation, and owner/ACL cutover remain BLOCKED. Report dir codex-owner-confirmation-fix7-final-design-approval-2026-06-08/00..05; checkpoint checkpoint-codex-owner-confirmation-fix7-final-design-approval-2026-06-08.md; current-state knowledge/current-state/reports/fix7-design-officially-approved-by-codex-2026-06-08.md.

2026-06-08 - FIX7 CP-06 hash micro-patch: Status FIX7_CP06_HASH_SPEC_PATCHED_READY_FOR_T1_FINAL_SHORT_REVIEW. Codex resolved T1 P-01..P-04: H04 evidence hashes dereference evidence_registry.artifact_sha256; existing scope_hash is byte-pinned by eight-key H04_SCOPE_V1; H02/H05 aggregate membership and total orders are pinned; every extra index fails until added to a new sealed expected #20 set. Strict self-review: zero-hardcode/disguised-hardcode and PG-first/native/driven PASS; exactly 27 authority surfaces, 11 non-authority runtime-evidence tables, new gates/top-level hash contracts = 0. This is not official-design promotion: T1 final short-review remains required. Implementation/live steps, Stage 2.6B, permit, REAL_RUN, and QT001 apply remain blocked. See checkpoint-codex-fix7-cp06-hash-micro-patch-from-t1-proposals-2026-06-07.md.

2026-06-08 - FIX7 artifact finalization published: Status FIX7_SPEC_ARTIFACTS_PUBLISHED_READY_FOR_T1_FOCUSED_REVIEW. Codex published exact 27 child-contract DDL, 14 readiness adapter rules, seven hash key-maps, 14 bypass vectors, Directus SELECT/no-authority cutover, Level-B operator packet, T1 dashboard, and same-human quorum control. T1 focused review is required before authoring; implementation/live steps, Stage 2.6B, permit, REAL_RUN, and QT001 apply remain blocked. See checkpoint-codex-fix7-spec-artifact-publish-finalization-2026-06-07.md.

2026-06-07 — Stage 2.6A-FIX6 PARTIAL (rev22 — signoff fixed-point + behavioral proof + self-Codex-audit; verdict PG_NATIVE_DRIVEN_PARTIAL_BLOCKED; self_audit_pass=true + independent adversarial read-only subagent CONFIRM; ready for EXTERNAL Codex re-audit): The SIXTH Codex rejection (STAGE2_6A_FIX5_FAIL_HARDCODE_OR_BYPASS_STILL_DANGEROUS, B1..B10) is answered. New discipline that worked: T1 ran a Codex-style self-audit AFTER building and BEFORE reporting, self-found+fixed 2 of its own defects in-macro (no_bypass awkward literals; false_green tautology), re-ran, and additionally ran an independent adversarial read-only auditor. FIX6 makes every guard structurally sound / fail-closed (NULL=FAIL) / non-false-greenable and SURFACES what cannot be fixed in 2.6A as hard blockers instead of faking green: (1) native pg_depend/pg_rewrite callgraph — PostgreSQL records NO function call-edges (func_to_func=0) so the apply path is not natively provable → v_qt001_callgraph_unclassified_fail_guard BLOCKS; regex demoted to diagnostic; v_qt001_callgraph_no_regex_authority_guard proves (pg_depend) no authoritative guard derives from regex; (2) fn_qt001_plan_v5 is a byte-identical clone of plan_v2 (v_qt001_v2_logic_clone_detector normalized_identical=true) → detected+blocked (re-author 2.6B); (3) fixed-point v_qt001_plan_content_hash (pg_depend-proven to EXCLUDE signoff tables) vs v_qt001_control_state_hash breaks the fingerprint/signoff loop; (4) signoff identity schema-enforced — FK qt001_signoff_plan_binding_review_fk_fix6 + strict CHECK qt001_irs_reviewer_strict_fix6 (no OTHER/OWNER) + fn_qt001_signoff_*_v6 content-hash-bound; (5) capability typed-evidence qt001_capability_operational_evidence (empty) → 0/3, scale NOT_SAFE, v_qt001_capability_false_green_guard FALSIFIABLE; (6) readiness v_qt001_apply_readiness_guard_v9 dynamic guard registry, NULL-STRICT (count-match, not bool_and) → BLOCKED; (7) v_qt001_hardcode_guard_v7 consumes readiness/scale/directus/no-bypass + requires system_apply_blocked (vs OLD v6 now false); v_qt001_no_bypass_proof_v4 honest all_blocked=false (directus owner bypass) + v_qt001_no_tautology_guard_v4 (pg_depend); (8) v_qt001_directus_mutation_blocks_readiness_guard (262 control objs owned by directus) hard blocker; (9) v_qt001_fix6_pg_native_driven_scorecard fully computed → PG_NATIVE_DRIVEN_PARTIAL_BLOCKED. Writer repointed → v9/v6/content-hash/unclassified authoritative in the REAL apply path (uses_*=true). Safety no-worse: births/permits/done/bindings/apply-tiers=0, tga=129 (ADD CONSTRAINT/FK tga-neutral), gateway all_ok=true, readiness BLOCKED, scale NOT_SAFE. NEXT=BIRTH_STAGE2_6A_FIX6_CODEX_REAUDIT; 2.6B load-bearing = dedicated owner role + REVOKE app-role DML/DDL (top false-green vector) / retire-convert legacy fns so callgraph natively provable / genuinely re-author plan_v5 / real keyset-resume-perf verified evidence. See checkpoint-birth-stage2-6a-fix6-qt001-signoff-fixed-point-behavioral-proof-self-audit-2026-06-07 + report dir …/birth-stage2-6a-fix6-…-2026-06-07/00..09. SQL /opt/incomex/docs/mcp-writes/birth-stage2-6a-fix6-2026-06-07/sql/.

2026-06-07 — Stage 2.6A-FIX5 PARTIAL (rev20 — legacy planner removed from the REAL callgraph; false proofs rebuilt; ready for Codex re-audit): The FIFTH Codex rejection (STAGE2_6A_FIX4_FAIL_HARDCODE_OR_BYPASS_STILL_DANGEROUS) is answered. Repeated root cause across FIX..FIX4: T1 graded newly-created guards in isolation while the real writer/driver/builder/current-plan path still called legacy objects, and the "no-legacy" guard was a hand-maintained NAME deny-list that never traced the actual dependency closure. FIX5 builds a RECURSIVE STRUCTURAL callgraph (v_qt001_callgraph_edges_v2 word-boundary edges from pg_get_functiondef/pg_get_viewdef → v_qt001_authoritative_callgraph_v2 MATERIALIZED node-deduped closure from the 3 roots writer/driver/builder → v_qt001_authoritative_legacy_dependency_guard FAIL-CLOSED on any reached legacy_superseded OR UNCLASSIFIED node; legacy identified by the registry TABLE qt001_authoritative_object_registry, never by a literal in a reachable view). Native fact planner fn_qt001_plan_v5/fn_qt001_plan_all_v5 replaces plan_v2; writer/driver/builder/refresh/tier-wrapper/machine_blocked_reason all repointed to the v5 family; plan_v2 retained as a frozen unreachable sentinel (roots_reaching=0). Fingerprint v5 NULL-strict + includes signoff/capability/scale-behavioral/authority-risk/keyset state; capability is a BEHAVIORAL contract (behavior+evidence, never existence/free-text); hardcode guard v6 consumes the structural callgraph; no-bypass proof v3 uses explicit booleans (no IS NOT NULL) with v_qt001_no_tautology_proof_guard; readiness v8 BLOCKED (SSOT 13/15, APPLY 0/4; 2 red SSOT = public/directus REVOKE routed 2.6B); scorecard verdict PG_DRIVEN_PARTIAL_BLOCKED (no longer PG_HOSTED_HARDCODE_REMAINS). 12/12 Codex FIX4 blockers now_safe (11 FIXED + 1 ROUTED_2_6B). Machine tiers unchanged TIER2=7/TIER3=6/BLOCKED=6/INELIGIBLE=55/TIER1=0. Birth-neutral (qt001 births 0), tga 129, gateway norm-md5 9393db3c (unchanged), permits 0, done 0, DOT freeze 2/2, apr 42. CURRENT plan = PLAN-d0272db42f77 v5. 4 tables, 8 new fns, 6 repoints, ~25 views, 1 plan rebuild; 0 gateway/trigger/DOT change; rehearsed BEGIN..ROLLBACK twice before COMMIT; ROLLBACK_fix5_to_fix4.sql staged. No apply. No permit. Fresh independent Codex re-audit of FIX5 required before 2.6B. Report …/birth-stage2-6a-fix5-qt001-remove-legacy-planner-false-proof-rebuild-2026-06-07/00..13; checkpoint checkpoint-birth-stage2-6a-fix5-qt001-remove-legacy-planner-false-proof-rebuild-2026-06-07.md; SQL /opt/incomex/docs/mcp-writes/birth-stage2-6a-fix5-2026-06-07/sql/. Next: BIRTH_STAGE2_6A_FIX5_CODEX_REAUDIT.

2026-06-07 — Codex independent audit of FIX4 = FAIL (STAGE2_6A_FIX4_FAIL_HARDCODE_OR_BYPASS_STILL_DANGEROUS): read-only audit found the live writer + driver still call fn_dot_birth_qt001_plan_v2; builder reaches it transitively (refresh→plan_all→plan_v2); the no-legacy guard is a fixed VALUES list + regex deny-list that OMITS plan_v2 and never recurses; fingerprint v4 omits signoff/capability state and uses the old literal-true scale guard; the NULL guard passes while fingerprint null_component_rows=6; capability proof is to_regproc/to_regclass existence only with a literal-true negative test; the no-bypass proof uses (NOT pass) IS NOT NULL tautologies; controlled identities/evidence are Directus-mutable rows; PG verdict PG_HOSTED_HARDCODE_REMAINS. Answered by FIX5 (above). Report …/codex-stage2-6a-fix4-qt001-authoritative-path-no-legacy-bypass-audit-2026-06-07/00..14; checkpoint checkpoint-codex-stage2-6a-fix4-qt001-authoritative-path-no-legacy-bypass-audit-2026-06-07.md.

2026-06-07 — Stage 2.6A-FIX4 PARTIAL (rev19 — authoritative path repointed, no legacy bypass, ready for Codex re-audit): The FOURTH Codex rejection (STAGE2_6A_FIX3_FAIL_HARDCODE_OR_BYPASS_STILL_DANGEROUS) is answered. Root cause across FIX/FIX2/FIX3: each fix built newer safe layers but the REAL authoritative callers kept calling the OLD layers (writer read readiness v5 + old signoff; builder emitted fingerprint v2; CURRENT plan hash was v2 9bac30375765; tier v3 took its signoff signal from collection_signals_v2→old fn_qt001_signoff_satisfies; governance-invalid BLOCK was ignored fail-open; identities/capability were non-empty-string/free-text). All 11 blockers reproduced LIVE then 9 FIXED + 2 ROUTED_2_6B. FIX4 repoints EVERY authoritative caller to one v4 family — fn_qt001_machine_tier→_v4 (FAIL-CLOSED BLOCK: blocks unless =BLOCK_CLEAR), _eval_rule_v4→_collection_signals_v4→_signoff_satisfies_v4/_signoff_row_valid_v4 (controlled identities), _plan_fingerprint_v4 (ACYCLIC: per-binding signoff removed; NULL-STRICT: 'NULL' token not 0), _rule_governance_ok_v2; builder emits fingerprint v4 + RULE_ENGINE_V4 and CURRENT plan rebuilt to v4 composite 32a807b7a438cd515fbc1054983ebb64; writer reads readiness v7 + signoff v4 + verifies CURRENT==fingerprint-v4 + requires the no-legacy guard. The loop-closer is v_qt001_writer_no_legacy_dependency_guard (+v_qt001_authoritative_path_dependency_map): it scans pg_get_functiondef of all 12 authoritative objects for legacy tokens (0 offenders) and is enforced inside the writer, readiness v7, and hardcode guard v5 — reproducing Codex's call-graph audit as a self-enforcing gate. New: controlled qt001_authority_identity_registry+qt001_evidence_registry (approver/reviewer by FK+immutable evidence, not non-empty strings; 5/5 spoof negative tests); evidence-based v_qt001_capability_contract_guard_v2/scale_blocking_guard_v4 (free-text proof_object is diagnostic only; 3/3 fake-capability tests; scale NOT_SAFE); v_qt001_hardcode_guard_v5 pass true (11 sub-guards); v_qt001_apply_readiness_guard_v7 BLOCKED (SSOT 10/12, APPLY 0/4; the 2 red SSOT = public/directus REVOKE routed 2.6B); v_qt001_26a_fix4_codex_failure_matrix 11/11; v_qt001_26a_fix4_no_bypass_proof 11/11 blocked; v_qt001_26a_fix4_must_not_proceed_guard.pass=true. Machine tiers reproduce exactly: TIER2=7/TIER3=6/TIER_BLOCKED=6/INELIGIBLE=55/TIER1=0. Birth-neutral 1,211,064==1,211,064, tga 129, gateway all_ok, permits 0, done 0, DOT freeze 2/2, apr 2. 2 tables, 8 fns, 4 repoints, ~21 views, 1 plan rebuild; 0 ALTER TABLE, 0 CREATE TRIGGER, 0 gateway/DOT change; rehearsed BEGIN..ROLLBACK twice (incl. apply→rollback reversibility) before COMMIT. No apply. No permit. Fresh independent Codex re-audit of FIX4 required before 2.6B. Report …/birth-stage2-6a-fix4-qt001-authoritative-path-repoint-no-legacy-bypass-2026-06-07/00..14; SQL /opt/incomex/docs/mcp-writes/birth-stage2-6a-fix4-2026-06-07/ (01_fix4, 90_verify, 99_rollback). Next: BIRTH_STAGE2_6B_QT001_PERMIT_RUN_KEYSET_RESUME_AND_AUTHORITY_REVOKE.

2026-06-06 — Stage 2.6A-FIX3 PARTIAL (rev17 — exact control contract, machine-enforced, ready for Codex re-audit): The THIRD Codex rejection of 2.6A (STAGE2_6A_FIX2_FAIL_HARDCODE_STILL_DANGEROUS) is answered. All twelve FIX2 blockers were reproduced against LIVE source first; ten fixed, two (PUBLIC EXECUTE / Directus DML revocation; keyset/resume scale) made structurally blocking and routed to 2.6B (hence PARTIAL). Rule governance is now MACHINE-ENFORCED in the authoritative tier path: fn_qt001_machine_tier repointed to fn_qt001_machine_tier_v3 → fn_qt001_eval_rule_v3 → fn_qt001_rule_governance_ok (a rule fails closed unless authority_lock/provenance/version/approver/APPROVED/active/not-superseded AND stored rule_checksum equals recomputed canonical fn_qt001_rule_checksum; the 11 rules were checksum-synced → verified not decorative). Plan fingerprint v3 (fn_qt001_plan_fingerprint_v3, composite cb7f062ed3becb1d71ff70917ec5b105) is content-addressed over scope+rules-with-governance+engine+signal+governance-state+signoff-with-identity+trigger+ACTUAL-gateway-hash+DOT-freeze+guard-states+policy/identity+watermark+blockers (13 sensitivity negative tests). Exact signoff v3 (fn_qt001_signoff_row_valid_v3) binds plan_id+version+fingerprint+scope+tier+reviewer-ALLOWLIST (OTHER rejected)+strict-future-expiry (15 negative tests). Readiness v6 has NO regex/function-existence proof — capability is a data contract (qt001_capability_contract, default UNSATISFIED); BLOCKED (SSOT 5/7, APPLY 0/4). Hardcode guard v4 (v_qt001_hardcode_guard_v4) is structural+behavioral; manual inventory demoted to diagnostic; 11-check behavioral disguised detector; status PASS_WITH_ROUTED_2_6B. End-to-end no-bypass proof v_qt001_26a_fix3_no_bypass_proof = 11/11 blocked; v_qt001_26a_fix3_must_not_proceed_guard.pass=true. Machine tiers TIER2=7/TIER3=6/TIER_BLOCKED=6/INELIGIBLE=55/TIER1=0. Birth-neutral 1,211,019==1,211,019, tga 129, gateway c022f849, permits 0, done 0, Stage-0 frozen 2/2, apr_approved 2. 20 new views, 8 fns, 1 table, 0 ALTER TABLE, 0 CREATE TRIGGER. No apply. No permit. Re-audit required before 2.6B. Report …/birth-stage2-6a-fix3-qt001-exact-control-contract-authority-lockdown-2026-06-06/; SQL /opt/incomex/docs/mcp-writes/birth-stage2-6a-fix3-2026-06-06/. Next: BIRTH_STAGE2_6B_QT001_PERMIT_RUN_KEYSET_RESUME_AND_AUTHORITY_REVOKE.

2026-06-06 — Stage 2.6A-FIX2 PARTIAL (current-layer gates fail-closed): The SECOND Codex rejection of 2.6A (STAGE2_6A_FIX_FAIL_HARDCODE_STILL_DANGEROUS) is answered. Parity is now BLOCK-only (it can demote a tier, never grant one — proven by v_qt001_parity_not_authority_guard); fail-closed rule engine (fn_qt001_eval_predicate_v2/eval_rule_core: missing/NULL/unknown signal -> FAIL incl not_in_set(NULL), expected_result evaluated, superseded/inactive/non-approved excluded; governed qt001_tier_rule_registry_v2 with version/approval/authority_lock/provenance/checksum + operator CHECK); content-addressed plan fingerprint (fn_qt001_plan_fingerprint_v2) over full 74-scope + rules + engine + signals + signoff + trigger + gateway + watermark + blockers (every component proven sensitive); EXACT per-collection+tier+checksum+verdict+reviewer+evidence+expiry signoff (fn_qt001_signoff_row_valid, 10 negative tests); readiness v5 (no literals, derived gates, BLOCKED); writer in-body governance lockdown (reads readiness v5 + tier apply_allowed + exact signoff -> fail-closed for ANY caller, neutralizing PUBLIC EXECUTE; REVOKE routed 2.6B). 13/13 Codex blockers reproduced then 10 FIXED / 3 ROUTED-CONTAINED to 2.6B; v_qt001_26a_fix2_must_not_proceed_guard.pass=true. Machine tiers: TIER1=0, TIER2=7, TIER3=6, INELIGIBLE=55, TIER_BLOCKED=6. Birth-neutral 1,210,989==1,210,989, tga 129, apr 42, gateway c022f849, permits 0, done 0, Stage-0 frozen. No apply. No permit. Re-audit required before 2.6B. Report: …/birth-stage2-6a-fix2-qt001-policy-complete-plan-failclosed-signoff-authority-lockdown-2026-06-06/; SQL /opt/incomex/docs/mcp-writes/birth-stage2-6a-fix2-2026-06-06/. Next: BIRTH_STAGE2_6B_QT001_PERMIT_RUN_KEYSET_RESUME_AND_AUTHORITY_REVOKE.

Status: ACTIVE — Stage 1 PASS (2026-06-06); Stage 2 PARTIAL; QT-001 apply BLOCKED by independent review (Codex 2026-06-06 = NOT_SAFE_NEEDS_FIX + SCALE_NOT_SAFE). The hardening macro 2.5 PASSED (apply runtime is real/fail-closed/auditable, false-done structurally impossible). The Codex Stage 2.5 re-audit then returned NOT_SAFE_NEEDS_FIX / SCALE_NOT_SAFE (direct + disguised hardcode, authority bypass, broken batch/resume, full rescans). Stage 2.6A (first SSOT pass) was then FAILED by the Codex independent audit (STAGE2_6A_FAIL_HARDCODE_STILL_DANGEROUS): tier CASE hardcode, bad divergence driving Tier3, descriptive-only tier registry, same-literal blocked reason, signoff not plan-bound, any review granting Tier1, hardcode guard false-passing, readiness false-green risk, writer public bypass. Stage 2.6A-FIX PASSED (2026-06-06): the Plan/Tier/Signoff layer is now machine-enforced — tiers derived by predicate rule rows (qt001_tier_rule_registry) via a pure operator interpreter (no CASE), signoff bound to the current plan checksum (qt001_signoff_plan_binding), per-row computed blocked reasons, hardcode guard v2 that FAILS on dangerous open hardcode, readiness v4 consuming machine rules, and the writer bypass made visible + provably blocked. Because TIER1 now requires a plan-bound signoff (none exists), the machine result is TIER1=0, TIER2=7, TIER3=6 — the five previously hard-listed TIER1 collections correctly demote to TIER2. Apply remains BLOCKED pending the remaining 2.6 layers (permit/run/keyset/resume, parity-invariant separation HC-05/HC-11, resolver HC-04, TG_ARGV scanner HC-07, trigger reconciliation, paired DOTs + revoke PUBLIC EXECUTE) and a FRESH independent re-audit of 2.6A-FIX before 2.6B. This index is the canonical entry point for the Birth Gateway SSOT repair program.

Stage 1 result (live 2026-06-06): Gateway SSOT runtime contract is LIVE — birth_gateway_release_registry (semantic SHA-256 + normalized-md5 per gateway fn) with v_birth_gateway_release_drift_guard / v_birth_gateway_contract_integrity_dashboard (all OK, 5 fns tracked). Shared foundation functions fn_birth_policy_decision, fn_birth_resolve_identity, fn_birth_register are live (deterministic, no-write / dry-run-default, fail-closed). birth_admission_permit + birth_backfill_ledger created and empty (fail-closed). Live fn_birth_registry_auto was NOT changed (integration Option A = parity-guard-only; norm-md5 c022f849 preserved; tga 129; birth before==after). QT-002 live path not worsened; QT-001 stays blocked until Stage 2. Report: knowledge/dev/reports/architecture/birth-stage1-gateway-ssot-runtime-contract-foundation-2026-06-06/; checkpoint checkpoint-birth-stage1-gateway-ssot-runtime-contract-foundation-2026-06-06.md.

Canonical design (read this first)

  • knowledge/dev/architecture/birth-gateway-ssot-qt001-repair-design-2026-06-06.md — the reconstructed official executable design: gateway SSOT decision, shared policy/identity/register functions, the rule that dot-birth-trigger-setup must never redefine the gateway, the Stage 0..5 rollout, forbidden DOTs, rollback / no-go, and next macro.

Source design package (Codex, 2026-06-06)

  • knowledge/dev/reports/architecture/codex-birth-gateway-ssot-qt001-design-plan-2026-06-06/00-readme-first.md
  • knowledge/dev/reports/architecture/codex-birth-gateway-ssot-qt001-design-plan-2026-06-06/11-final-summary.md
  • knowledge/dev/reports/architecture/checkpoint-codex-birth-gateway-ssot-qt001-design-plan-2026-06-06.md
  • NOTE: detailed design docs 01..10 were never authored. The canonical design reconstructs one executable design from the checkpoint + readme + final summary, cross-checked against live production (2026-06-06). No unknown implementation details were invented.
  • Side-door risk source: knowledge/dev/reports/architecture/checkpoint-codex-birth-first-side-door-compatibility-audit-2026-06-06.md

Foundational laws / procedures

  • knowledge/dev/architecture/birth-registry-law.md — Điều 0-G (Birth Registry Law).
  • knowledge/dev/architecture/birth-procedures.md — QT-001..QT-006 v3.1.
  • knowledge/ops/processes/birth-process-v1.md — birth-first / backfill quy trình v1.0.

QT-001 apply re-audit chain (read in order)

  • Stage 2.5 hardening (PASS): knowledge/dev/reports/architecture/birth-stage2-qt001-apply-dot-harden-permit-ledger-2026-06-06/ + checkpoint.
  • Codex Stage 2.5 re-audit (NOT_SAFE_NEEDS_FIX / SCALE_NOT_SAFE): knowledge/dev/reports/architecture/codex-stage2-5-qt001-apply-runtime-hardcode-scale-reaudit-2026-06-06/00..11 + checkpoint.
  • Stage 2.6A SSOT + hardcode elimination (first pass): knowledge/dev/reports/architecture/birth-stage2-6a-qt001-plan-tier-registry-ssot-hardcode-elimination-2026-06-06/00..11 + checkpoint. Packet: BIRTH_STAGE2_6A_QT001_SSOT_PACKET.md.
  • Codex 2.6A independent audit (STAGE2_6A_FAIL_HARDCODE_STILL_DANGEROUS): knowledge/dev/reports/architecture/codex-stage2-6a-qt001-plan-tier-registry-hardcode-audit-2026-06-06/00..10 + checkpoint.
  • Stage 2.6A-FIX machine-enforced tier/plan/signoff + hardcode guards (PASS, apply BLOCKED): knowledge/dev/reports/architecture/birth-stage2-6a-fix-qt001-machine-enforced-tier-plan-signoff-hardcode-guards-2026-06-06/00..12 + checkpoint checkpoint-birth-stage2-6a-fix-qt001-machine-enforced-tier-plan-signoff-hardcode-guards-2026-06-06.md.

Implementation macros (staged)

Stage Macro Status
0 BIRTH_P0_STAGE0_DANGEROUS_DOT_EXECUTION_FREEZE_AND_GATEWAY_SSOT_GUARD PASS 2026-06-06 — report dir birth-p0-stage0-dangerous-dot-freeze-gateway-ssot-guard-2026-06-06
1 BIRTH_STAGE1_GATEWAY_SSOT_IMPLEMENTATION PASS 2026-06-06 — runtime contract registry + shared policy/identity/register fns live; report dir birth-stage1-gateway-ssot-runtime-contract-foundation-2026-06-06
2 QT-001 identity classification + metadata backfill repair PARTIAL 2026-06-06 — 70/74 identity-resolvable; full dry-run 137 across 5 governed; apply rehearsed (BEGIN..ROLLBACK, +137, rerun-delta=0); apply BLOCKED by independent review. Report dir birth-stage2-qt001-identity-metadata-backfill-repair-2026-06-06
2.5 BIRTH_STAGE2_QT001_APPLY_DOT_HARDEN_AND_INDEPENDENT_REAUDIT PASS (hardened) 2026-06-06; apply BLOCKED — real bounded writer + permit_v2/ledger_v2 + structural false-done CHECK + metadata planner; rehearsed 137 / rerun 0 / rollback clean / birth-neutral. Then Codex re-audit returned NOT_SAFE_NEEDS_FIX + SCALE_NOT_SAFE. Report dir birth-stage2-qt001-apply-dot-harden-permit-ledger-2026-06-06; re-audit codex-stage2-5-qt001-apply-runtime-hardcode-scale-reaudit-2026-06-06
2.6A BIRTH_STAGE2_6A_QT001_PLAN_TIER_REGISTRY_SSOT_AND_HARDCODE_ELIMINATION PASS 2026-06-06; apply BLOCKED by design — Plan/Tier/Signoff registries LIVE as SSOT (qt001_plan_registry + fn_qt001_build_plan_registry, qt001_tier_registry, qt001_independent_review_signoff + qt001_review_validated_collection, qt001_hardcode_inventory); 11 hardcode findings classified, dangerous authority-gate hardcode superseded or routed; tiers now derived from DATA (reproduce TIER1 5/137, TIER2 2/137, TIER3 6/505 exactly); readiness v3 consumes registries and stays BLOCKED (overall_ready=false); writer unchanged + must-remain-blocked guard pass; scale annotated SCALE_NOT_SAFE. Additive/reversible, birth-neutral (1,210,928), tga 129, gateway md5 c022f849. Report dir birth-stage2-6a-qt001-plan-tier-registry-ssot-hardcode-elimination-2026-06-06; checkpoint same; packet BIRTH_STAGE2_6A_QT001_SSOT_PACKET.md; SQL /opt/incomex/docs/mcp-writes/birth-stage2-6a-2026-06-06/. Next: 2.6B permit/run/keyset/resume + parity-invariant separation + trigger reconciliation + paired DOTs, then fresh re-audit
2.6A-codex Codex independent audit of 2.6A FAIL 2026-06-06 STAGE2_6A_FAIL_HARDCODE_STILL_DANGEROUS — tier CASE hardcode, divergence drives Tier3, descriptive tier registry, literal blocked reason, signoff not plan-bound, any review grants Tier1, hardcode guard false-pass, readiness false-green, writer public bypass. Report dir codex-stage2-6a-qt001-plan-tier-registry-hardcode-audit-2026-06-06
2.6A-FIX BIRTH_STAGE2_6A_FIX_QT001_MACHINE_ENFORCED_TIER_PLAN_BOUND_SIGNOFF_AND_HARDCODE_GUARDS PASS 2026-06-06; apply BLOCKED — machine-enforced tiering via qt001_tier_rule_registry predicates + interpreter fn_qt001_eval_tier_predicate (no CASE); fn_qt001_machine_tier / fn_qt001_machine_blocked_reason; builder + snapshot fns rewritten (CASE + IN-list + literal removed); plan-bound signoff qt001_signoff_plan_binding; hardcode guard v2 = FAIL on HC-05; readiness v4 BLOCKED (overall_ready=false); writer bypass visible + must-block guard pass. Machine tiers TIER1=0/TIER2=7/TIER3=6 (5 ex-TIER1 demoted — no plan-bound signoff). Additive/reversible, birth-neutral 1,210,956, tga 129, gateway c022f849. Report dir birth-stage2-6a-fix-qt001-machine-enforced-tier-plan-signoff-hardcode-guards-2026-06-06; checkpoint same; SQL /opt/incomex/docs/mcp-writes/birth-stage2-6a-fix-2026-06-06/. Next: fresh independent re-audit, then 2.6B permit/run/keyset/resume
2.6A-FIX3 BIRTH_STAGE2_6A_FIX3_QT001_EXACT_CONTROL_CONTRACT_AUTHORITY_LOCKDOWN_AND_NO_HARDCODE_PROOF PARTIAL 2026-06-06; apply BLOCKED — governance machine-enforced (fn_qt001_rule_governance_ok/fn_qt001_eval_rule_v3/fn_qt001_machine_tier→v3, checksum-verified); fingerprint v3 over all control inputs (13 sensitivity tests); exact signoff v3 (15 neg tests, reviewer allowlist, OTHER rejected); readiness v6 data-driven no regex/name (qt001_capability_contract); hardcode guard v4 structural (inventory→diagnostic, 11 behavioral detectors); public/directus lockdown structurally blocking (REVOKE routed 2.6B); scale blocking; no-bypass proof 11/11. 10/12 FIX2 blockers fixed, 2 routed 2.6B. Birth-neutral 1,211,019, tga 129, gateway c022f849. Report dir birth-stage2-6a-fix3-qt001-exact-control-contract-authority-lockdown-2026-06-06; checkpoint same; SQL /opt/incomex/docs/mcp-writes/birth-stage2-6a-fix3-2026-06-06/. Next: fresh Codex re-audit, then 2.6B permit/run/keyset/resume + authority revoke
2.6A-FIX4 BIRTH_STAGE2_6A_FIX4_QT001_AUTHORITATIVE_PATH_REPOINT_NO_LEGACY_BYPASS PARTIAL 2026-06-07; apply BLOCKED — repointed authoritative callers to the v4 family + name-deny-list no-legacy guard. Subsequently FAILED Codex re-audit (no-legacy guard omitted plan_v2; writer/driver/builder still reached it). Report dir birth-stage2-6a-fix4-qt001-authoritative-path-repoint-no-legacy-bypass-2026-06-07
2.6A-FIX4-codex Codex independent audit of FIX4 FAIL 2026-06-07 STAGE2_6A_FIX4_FAIL_HARDCODE_OR_BYPASS_STILL_DANGEROUS — writer/driver/builder still reach planner v2; no-legacy guard is a name deny-list; fingerprint omits signoff/capability + old scale; NULL guard false-pass (6 rows); capability existence-only + literal-true neg test; no-bypass IS NOT NULL tautology; PG_HOSTED_HARDCODE_REMAINS. Report dir codex-stage2-6a-fix4-qt001-authoritative-path-no-legacy-bypass-audit-2026-06-07
2.6A-FIX5 BIRTH_STAGE2_6A_FIX5_QT001_REMOVE_LEGACY_PLANNER_AND_FALSE_PROOF_REBUILD PARTIAL 2026-06-07; apply BLOCKED — recursive STRUCTURAL callgraph from roots (writer/driver/builder) proves no root reaches planner v2/legacy (legacy_reached=0, unclassified=0); native fn_qt001_plan_v5/_plan_all_v5 replace plan_v2; all 6 authoritative callers repointed; fingerprint v5 NULL-strict + signoff/capability/scale state; behavioral capability contract (no existence/free-text); hardcode guard v6 consumes the callgraph; no-bypass proof v3 + no-tautology guard; readiness v8 BLOCKED (SSOT 13/15, APPLY 0/4); scorecard PG_DRIVEN_PARTIAL_BLOCKED. 12/12 Codex FIX4 blockers now_safe (11 FIXED + 1 ROUTED_2_6B). Birth-neutral, gateway md5 9393db3c unchanged, tga 129, permits 0, done 0, DOT 2/2. CURRENT plan PLAN-d0272db42f77 v5. Report dir birth-stage2-6a-fix5-qt001-remove-legacy-planner-false-proof-rebuild-2026-06-07; checkpoint same; SQL /opt/incomex/docs/mcp-writes/birth-stage2-6a-fix5-2026-06-07/sql/. Next: fresh Codex re-audit of FIX5, then 2.6B
3 QT-003 / QT-003R first-row hard gate Designed, not implemented
4 QT-005 governance transition Designed, not implemented
5 QT-006 universal lifecycle / death Separate approved program

Live gateway facts (verified 2026-06-06)

  • Gateway function: fn_birth_registry_auto() — GUARDED (contains coverage_status + BIRTH_EXEMPT policy skip); 166 triggers across 148 tables.
  • Secondary variant: fn_birth_registry_auto_id() — no exempt guard; serves 3 BIRTH_REQUIRED tables only.
  • Danger DOTs: dot-birth-trigger-setup (DOT-119 — embeds CREATE OR REPLACE FUNCTION fn_birth_registry_auto() with OLD logic lacking the exempt guard); dot-birth-backfill (DOT-118 — direct INSERT INTO birth_registry). Both frozen (Stage 0 freeze guard PASS 2/2).
  • collection_registry.coverage_status: BIRTH_REQUIRED 74 / BIRTH_DEFERRED_NEEDS_REVIEW 58 / BIRTH_EXEMPT_* 36.
  • birth_registry row count anchor: 1,210,928 (Stage 2.6A DDL birth-neutral).
  • Stage 1 runtime contract objects (live 2026-06-06): birth_gateway_release_registry, fn_birth_policy_decision / fn_birth_resolve_identity / fn_birth_register (dry-run default), birth_admission_permit, birth_backfill_ledger. SQL on VPS: /opt/incomex/docs/mcp-writes/birth-stage1-2026-06-06/.
  • Stage 2.5 apply runtime (live, BLOCKED): birth_admission_permit_v2, birth_backfill_ledger_v2 (structural false-done CHECK), fn_dot_birth_qt001_plan_v2 / fn_qt001_plan_all / fn_dot_birth_qt001_apply (p_execute default false), sp_dot_birth_qt001_apply, qt001_plan_snapshot. SQL /opt/incomex/docs/mcp-writes/birth-stage2-apply-harden-2026-06-06/.
  • Stage 2.6A SSOT objects (live, apply-blocked): tables qt001_hardcode_inventory, qt001_plan_registry, qt001_tier_registry, qt001_independent_review_signoff, qt001_review_validated_collection; fn fn_qt001_build_plan_registry; views v_qt001_hardcode_inventory/_risk_classification/_no_go_guard, v_qt001_plan_registry_current/_diff_vs_hardcoded/_no_go_guard, v_qt001_tier_registry_current/_gate_status/_no_go_guard, v_qt001_independent_review_signoff_status/_no_go_guard, v_qt001_apply_readiness_guard_v3/_dashboard_v3/_readiness_v3_no_go_guard, v_qt001_writer_registry_enforcement_contract/_writer_must_remain_blocked_guard, v_qt001_scale_risk_annotation/_scale_not_safe_guard. Rollback /opt/incomex/docs/mcp-writes/birth-stage2-6a-2026-06-06/99_rollback.sql.
  • Identity readiness (BIRTH_REQUIRED 74): 27 column + 4 synthetic = 31 resolvable; 43 unclassified (39 of 43 classified in Stage 2 by mirroring trigger TG_ARGV). Birth-trigger gap = 2 (no PG table: iu_staging_payload, iu_staging_record).