12 — INTERNAL CODEX-STYLE NEGATIVE REVIEW — 2026-06-22

Posture: try to reject this package. Codex is reserved for final confirmation; all bug-finding is done here. A "success" for an attack means it would block a READY claim. Since this package's verdict is HOLD (not READY), attacks that target a false-READY succeed and are honored (they are exactly why READY is withheld); attacks alleging fail-open / overclaim / scope drift must fail for the verdict to be HOLD rather than REJECT.

#	Attack	Result	Reasoning
A1	gap map missed a prerequisite	does not break HOLD	18-prereq map (file 01) covers contract/schema/collection/registry/manifest/hash/verifier/grant/preflight/dispatch/harness/evidence/rollback/gates/executor/clean-state
A2	write channel not actually governed	does not break HOLD	every route probed live; governed channel denied C1 + registry (E7); no sandbox (E8)
A3	contract exists only as prose	honored → READY withheld	no DOT_C1_* row; not claimed otherwise (file 03)
A4	contract not C1-scoped	honored → READY withheld	the 2 live contracts are DOT_KG only (E3)
A5	Directus/table_registry wiring absent	honored → READY withheld	file 04; E2/E7
A6	manifest hash not recomputable from a registered artifact	honored → READY withheld	file 05; design-only
A7	authorization matching loose	n/a	verifier not implemented; spec is exact set-equality (file 06)
A8	no/generic/wrong auth passes	cannot occur	no verifier and no grant exist; nothing passes (E5)
A9	preflight says ready without contract	cannot occur	no C1 preflight; the DOT_KG one says NO_GO (file 07)
A10	dry-run not actually dispatchable	honored → READY withheld	file 08; nothing to dispatch; not claimed dispatchable
A11	bad-input harness missing	honored → READY withheld	file 09; defined, not executable
A12	invalid input emits digest/PASS/seal	fails (good)	no emitter exists; no PASS/digest/seal can be produced — no fail-open
A13	rollback/dismantle unproven	fails (good)	no governed state created; clean by absence + readback (file 10)
A14	evidence readback missing	fails (good)	E1–E10 + before/after diff ∅ (file 11)
A15	production path touched	fails (good)	0 governed mutations; 1 disclosed inert docs file only
A16	C2/C3 touched	fails (good)	no cross-carrier write; governed channel denies anyway
A17	dry-run readiness overclaimed as production readiness	fails (good)	verdict is HOLD; production explicitly NO

Adjudication

• Attacks A3–A6, A10, A11 succeed against any READY claim — which is precisely why this package reports HOLD, not READY.
• The fail-open / overclaim / scope-drift / production-touch attacks (A12–A17) all fail — no invalid input produces PASS/digest/seal, no overclaim, no production/C2 mutation. Therefore the correct stop is HOLD, not REJECT.

Internal review result: HOLD upheld; READY correctly withheld; no fail-open; no REJECT condition. Ready for Codex final confirmation.