RS-TKT-0A-PATCH1 · 07 — Level Dependency & Output Consistency Patch (P7)

Lane: RS-TKT-0A-PATCH1 · Date: 2026-06-21 Gate: REGISTRATION_HOLD · REGISTRATION_CAN_PROCEED = NO · 0 runtime mutations (KB writes only) Authority: NON_AUTHORITY · may_gate=false · decision_effect=NONE · design-only

Supersedes: the dependency lines in 04 (e.g. TKT-L2-FAIL-CLOSED "dependencies: TKT-L0-FILE") and the level-model dependency wording in 03; clarifies status semantics referenced in 08.

---

1. The defect (Codex P7)

04 declared L2's dependency as L0 only. L2 must depend on both L0 and L1. Cumulative caps and status semantics (PASS/FAIL/HOLD/N/A) were also under-specified, risking HOLD/PASS mixing and aggregate status implying authority/gating.

2. Dependency chain (binding)

L0  — no prior dependency.
L1  — depends on L0 PASS.
L2  — depends on L0 PASS AND L1 PASS.
L3 aggregate — depends on L0 PASS AND L1 PASS AND L2 PASS.
L3 sub-bricks (AUTHORITY-FIREWALL, CLAIM-AUDIT, IDENTITY, NVSZ) — each depends on L0+L1+L2 PASS;
               they are independent of EACH OTHER (no cross-brick dependency; see patch1/02).

3. Cumulative cap (consistent N/A)

If L0 FAIL  → L1 = N/A, L2 = N/A, L3 = N/A
If L1 FAIL  → L2 = N/A, L3 = N/A
If L2 FAIL  → L3 = N/A
If any L3 sub-brick FAIL → L3 aggregate = FAIL

level_reached caps at the highest fully-passed level. Higher levels after a lower failure are always N/A, never PASS and never HOLD.

4. Separated status fields (no overloading)

Every result carries these independent fields:

level_status      : PASS | FAIL | HOLD | N/A        # per level/brick
aggregate_status  : PASS | FAIL | HOLD | N/A        # combiner over levels (advisory)
review_readiness  : READY | NOT_READY | BLOCKED     # is the packet ready for GPT/Codex?
authority_effect  : NONE                            # ALWAYS NONE (TKT grants no authority)
registration_effect : NONE                          # ALWAYS NONE (TKT never moves registration)

5. Status meanings (exact)

PASS = this exact check ran and passed.
FAIL = this exact check ran/was assessed and failed.
HOLD = required context is missing or unsafe to assess (e.g. HOLD_RUNTIME_SURFACE_REQUIRED).
N/A  = a prerequisite level failed, or the check is out of scope.

Rules:

• Do not mix HOLD with PASS. A HOLD is not a soft PASS and never contributes to a PASS aggregate.
• HOLD ≠ N/A: HOLD means "could not safely assess"; N/A means "prerequisite failed or out of scope."
• A level that is N/A (because a lower level failed) is not evidence of anything — it is not PASS.

6. Aggregate ≠ authority / gating

aggregate_status is ADVISORY ONLY.
aggregate_status = PASS  does NOT imply: authority granted, gate opened, registration moved,
                                          CAN_PROCEED=YES, or HOLD cleared.
authority_effect and registration_effect are ALWAYS NONE, independent of aggregate_status.

Any BLOCKER-severity FAIL ⇒ review_readiness = NOT_READY (advisory). The combiner that computes aggregate_status is a thin function over per-level/per-brick records and emits no authority/registration field other than the constant NONE.

7. Net effect

The level model is now a single consistent state machine: deterministic dependencies, deterministic N/A propagation, four orthogonal status fields, and a hard wall between the engineering aggregate and any authority/registration meaning.