C1 STAGING CODEX R3 FINAL REVIEW BEFORE DRY-RUN — INDEX

Session: C1-STAGING-CODEX-R3-FINAL-REVIEW-2026-06-23 Mode: read-only/static adversarial review; no dry-run; no DB created; no code/runtime file patched.

Verdict

CODEX_REJECT_C1_STAGING_R3_EVIDENCE_FALSE_PASS_RISK

Claude's R2 and R3-SELF-1 fixes are valid for shell safety, partial-create cleanup, cleanup ownership, P2 failure propagation, --force removal, P5 exact oracle, combined digest, and official isolation.

One blocking evidence defect remains: P3/P4/P5 commit their ledger rows before their fatal postconditions. P6 treats row existence as P3_DONE/P4_DONE/P5_DONE and does not independently enforce the exact canonical operation set. A caller that continues after rejected P3/P4 can therefore reach a committed P6 PASS/digest for a noncanonical three-row validated set. This violates the explicit R3 condition that P6_DONE cannot commit on partial upstream success.

Reports: 01 context; 02 findings; 03 code; 04 injection/sandbox; 05 P1/plan/P2; 06 P5/P6; 07 stamps/runtime; 08 attacks; 09 verdict.