Codex Review — RS5A-PATCH1 Prerequisite / Sequencing Correction — 2026-06-21

STATUS: HOLD REVIEW VERDICT: NEED_RS5A_PATCH2 Stop state: RS5A_PATCH1_NEEDS_PATCH2 · SCOPE_DRIFT · GOV_COUNCIL_EDGE_INSUFFICIENT · TEST_ORACLE_INSUFFICIENT Registration gate: REGISTRATION_HOLD REGISTRATION_CAN_PROCEED = NO Evidence mode: NO_CODEX_LIVE_READ — this is a KB contract review; no runtime proof is claimed or required for the patch assessment.

1. Source Register

Codex read directly from AgentData KB:

The prior Codex RS5A HOLD report, revision 1, full readback.
The RS5A-PATCH1 rollup.
The RS5A-PATCH1 index.
RS5A-PATCH1-01 through RS5A-PATCH1-07.
The RS5A-PATCH1 Codex review packet.
Metadata/readback for the five cited RS5A source documents and three accepted RS4A/PATCH2 references; all remained at revision 1.
Operating Rules SSOT (knowledge/dev/ssot/vps/vps-operating-rules.md, version 1.0 returned by direct search) and Constitution (knowledge/dev/laws/constitution.md, v4.6.3 returned by direct search).

All ten target PATCH1 documents were read complete and untruncated at revision 1. No local prose was used as package evidence.

2. Package Completeness

PASS. The package has ten required files: one rollup plus nine documents under knowledge/dev/laws-new/reports/rs5a-patch1/ (index, 01–07, Codex packet). AgentData list evidence returned nine directory documents with truncated=false; the rollup exists separately. No target file was empty, missing, or truncated.

The cited RS5A source documents remained revision 1, so PATCH1 is an additive correction and did not overwrite the source package.

3. Closure Map Assessment

Residual	Assessment	Reason
R1 replay/audit sequencing	PARTIAL — NOT CLOSED	The controlling graph is correct, but PATCH1-04 reintroduces “6 gate + 3 deferrable,” contradicting PATCH1-02's replacement of the gate/deferrable framing.
R2 bootstrap/execution drift	CLOSED	No entity may execute on accept; next step is non-mutating RS5B design; unresolved bootstrap is carried fail-closed.
R3 GOV-COUNCIL edge	PARTIAL — NOT CLOSED	The tenth scope is explicit and narrow, but approver-role identity and vote-principal uniqueness remain underspecified.
R4 replacement handler	CLOSED	New identity, replace-not-wrap, old unsafe real-run path forbidden.
R5 test oracle	PARTIAL — NOT CLOSED	Scenario semantics are improved, but aliases and G02 subcase counting leave the executable oracle non-canonical.
R6 carrier coupling	CLOSED_WITH_CAVEAT	Carrier edges are explicit; approval carrier still depends on completing R3's canonical principal model.

The closure map therefore overclaims all R1–R6 as closed. A narrow PATCH2 is required; the whole RS5A dossier does not need to be reopened.

4. Hard Prerequisite Graph Assessment

PASS_WITH_ONE_BLOCKING_CONTRADICTION. PATCH1-02 correctly establishes P0–P3 and makes all eleven prerequisites conjunctive before real register_dot: active accountable Owner, implemented action, effect-bound approval, authorization digest carrier, artifact hash, nonce/replay, U3, status enforcement, failure audit, postcondition verifier, and replacement handler.

It clearly states replay and failure audit may be designed after the G2 decision but must exist and pass before runtime registration. This is the correct fail-closed contract.

However, PATCH1-04 §4 says the taxonomy becomes “10 scopes (6 gate + 3 deferrable + this 1).” The old three-item bucket includes activation, replay, and audit. Activation may legitimately follow inert registration; replay and failure audit may not. Reusing “3 deferrable” within the correction package preserves the exact unsafe interpretation R1 was opened to remove.

PATCH2 must replace that phrase everywhere with an explicit classification, for example: one post-registration-capable activation scope, two pre-registration hard-prerequisite scopes (replay and audit), six other prerequisite scopes, and one approval/quorum scope. No generic “deferrable” group may include replay or audit.

5. Bootstrap Correction Assessment

PASS. PATCH1-03 accurately carries:

no bound Owner today;
assign_governance_owner unimplemented;
BOOTSTRAP_AUTHORITY_UNRESOLVED;
OWNER_MINT_PATH_FAIL_CLOSED;
acceptance authorizes only RS5B design, not execution.

The phrase suggesting immediate Owner execution has been removed from the controlling PATCH1 documents. RS5B is explicitly non-mutating unless separately authorized later. No bootstrap solution is invented in this patch.

6. GOV-COUNCIL Edge Assessment

NEEDS_PATCH. Defining DOT_APPROVAL_QUORUM_AUTHORITY as a proposed tenth scope is acceptable at design tier because it is narrow, REQUIRED_NOT_PRESENT, separately ownable, and grants no registration/admission/activation authority. GOV-COUNCIL remains only a candidate head. Broad approval inheritance is correctly forbidden.

The identity-binding contract does not yet fully replace approver ILIKE '%president%':

Resolving an approver to any governance head or head-delegated identity does not prove that the principal is authorized for the president quorum slot.
Binding council votes to GOV-COUNCIL does not define distinct canonical voting principals; two aliases or delegations of the same underlying principal could still satisfy a two-vote count.
Delegation validity, scope, effective window, revocation, and canonical-principal uniqueness are not stated as quorum conditions.

PATCH2 must define requirements, not implementation: president-role authority must resolve through an authoritative policy/reference; every counted vote must carry a canonical principal ID; one canonical principal may count once per APR; president and council slot semantics must be explicit; delegated identities must be active, scoped, unrevoked, and time-valid. Free text and self-declared type remain forbidden.

The tenth scope is accepted only as a future proposed scope contract, not as a created or final runtime scope.

7. Handler Replacement Assessment

PASS. dot-dot-register:governed is withdrawn in favor of DOT_REGISTER_GOVERNED_REPLACEMENT / dot-register-governed-replacement:v1. The future handler has a distinct identity and may not wrap, relabel, invoke, shell out to, or reuse the unsafe real-run path.

Allowed reuse is constrained to read-only/advisory scan, classification, source evidence, and warning mapping. None may make an admission decision or perform a write. This preserves the accepted replace-not-wrap contract.

8. Negative Test Oracle Assessment

NEEDS_PATCH. The semantic corrections are technically sound:

D07 → REGISTER_DOT_RISK_TIER_MISMATCH;
H03 → STATUS_VALUE_OUT_OF_VOCABULARY;
H07 → SUCCESS_AUDIT_FORBIDDEN_BY_PHASE4_CONTRACT;
I03 → DRAFT_WRITE_EMITTED_ACTIVATION_NOTIFY;
G02 distinguishes committed exact retry from nonce reuse with changed effect/authorization;
G08 is an idempotency behavior, not rejection.

Two oracle defects remain:

An executable oracle must have one canonical expected code. Parenthetical aliases such as REGISTER_DOT_ACTION_CONTRACT_VIOLATION cannot be alternative PASS outcomes unless an explicit versioned alias-normalization registry exists. PATCH2 must select one canonical code per case; aliases may be documentation-only and non-accepted.
The count statement is ambiguous. There were 84 parent IDs. Replacing one G02 scenario with G02a/G02b/G02c yields 86 executable scenarios: 78 unaffected + four single-case corrections + three G02 subcases + G08. PATCH2 must declare either “84 top-level IDs / 86 executable scenarios” or assign stable unique IDs and publish the resulting canonical count. It must not call all G02a/b/c separately enumerated while also claiming only 84 enumerated cases.

The suite remains DEFINED_NOT_EXECUTED; no PASS result is accepted.

9. Accepted Points

Package completeness and additive, non-overwriting storage.
Four-phase sequencing and eleven conjunctive runtime prerequisites.
Correct distinction between design-after-G2 and exist-before-runtime.
Bootstrap unresolved state and RS5B-only next step.
Narrow proposed approval/quorum scope with no broad inheritance.
Replacement-handler identity and prohibition on unsafe-path reuse.
Corrected replay/idempotency behavior and primary reject-code semantics.
Explicit carrier dependency edges and preservation of REGISTRATION_HOLD.
No accepted RS4A/PATCH2 identity semantics were reopened.

10. Required PATCH2 and Caveats

The single scoped RS5A-PATCH2 item is semantic closure precision:

Remove the “3 deferrable” taxonomy and classify activation separately from replay/audit.
Complete the approval/quorum identity requirement with authoritative role binding, canonical principal IDs, anti-double-counting, and valid scoped delegation.
Make test outcomes canonical: one accepted code per scenario and an unambiguous parent-ID versus executable-scenario count.

PATCH2 should update only PATCH1-04, PATCH1-06, and their closure/rollup/index/decision/Codex summaries. It must not reopen accepted identity, U3, handler, bootstrap, or prerequisite-graph semantics.

11. Rejected or Overclaimed Points

Rejected: R1 is fully closed while PATCH1 itself still says “3 deferrable.”
Rejected: resolving a vote to a generic governance head alone proves president authority or independent council principals.
Rejected: an executable test may accept either a primary code or an undocumented alias.
Rejected: G02a/G02b/G02c are separately enumerated scenarios while the suite is still described simply as 84 enumerated cases.
Not claimed: any live/runtime state was independently verified by Codex.

12. Sequencing, Gate, and Repository Check

Sequence remains:

Produce and re-review the narrow RS5A-PATCH2 corrections in §10.
Only after acceptance, proceed to RS5B Owner-of-record execution-design / authorization-design.
RS5B remains non-mutating unless a later authorization explicitly permits a subsequent phase.

REGISTRATION_HOLD remains active. REGISTRATION_CAN_PROCEED = NO. No Owner, scope, APR, action, handler, validator, registration, or activation operation is authorized.

Three declarations for this review:

Permanent: canonical prerequisite, authority-principal, and test-ID contracts remove interpretation drift rather than patching runtime cases.
Mistake-resistant: P3 remains mechanically prohibited while any prerequisite is absent; canonical principal and oracle IDs prevent text/alias substitution.
Automatic: this review executes nothing; future automation is acceptable only when these contracts become machine-enforced and the suites run with real evidence.

OR/TD update: not applicable because this mission is an independent read-only review and creates no runtime/design implementation change. The official Codex report is the sole review artifact.

13. Final Verdict

VERDICT: NEED_RS5A_PATCH2

PATCH1 fixes most of the prior HOLD correctly, but the remaining contradictions are material at a final technical gate. Accepting them would allow ambiguous prerequisite sequencing, identity-spoofable quorum counting, and non-deterministic test results to flow into RS5B.

Single next step: RS5A-PATCH2 limited to the three semantic-closure corrections in §10.

DO NOT IMPLEMENT: Confirmed. No runtime mutation, DDL/DML, Owner row, scope row, APR, register_dot, approval, handler, schema, registrar/validator patch, RS-VALIDATOR, registration, activation, technical implementation, or blocker resolution was performed or authorized.