Checkpoint — Codex Re-seal Gap-only Scope Spec rev3

Date: 2026-06-09
Final status: GAP_ONLY_SPEC_REV3_PARTIAL_FIX_REQUIRED
Production mutation: NO
MVP implementation authorized: NO
Minimal safe next step: Return to T1 for rev4.

Scope completed

Performed only the prompt-bounded adversarial re-seal of the four rev2 blocker classes. Did not redo baseline/history, redesign the tool, implement code, create schema/tool/runner, resume FIX7, install anything, or mutate production.

Gate summary

Gate	Verdict
1 — Taxonomy / rule authority	PARTIAL
2 — KB-first / PG-first / native-driven	PARTIAL
3 — Structural no-run/no-write guard feasibility	FAIL
4 — PG read-client write risk	PARTIAL
5 — FIX7 artifact discoverability honesty	PASS
6 — Negative tests coverage	PARTIAL
7 — MVP readiness	FAIL

Correct repairs in rev3

• Removed positive verdict and exit 0.
• Marked taxonomy PROVISIONAL_NON_AUTHORITY, versioned and fail-closed.
• Replaced socket ban with endpoint-allowlist intent.
• Named context_pack_readonly, read-only transaction, no-direct-driver design.
• Corrected FIX7 artifact result to “not adequately evidenced through allowed surfaces,” never global absence.
• Added Fixture A′ and all requested negative-test categories.
• Preserved Article 14 and no fake-green behavior.

Remaining blockers

1. Negative taxonomy verdicts can still become a shadow denial authority if used to gate/block downstream workflows.
2. Gateway DB allowlist does not prove process-level network egress allowlist.
3. Static denylist/self-check does not structurally prevent alternate network clients, environment-secret access, or local filesystem access.
4. No named server-enforced KB writer restricts writes to the report prefix and permitted verbs only.
5. SELECT-only AST validation does not alone prove side-effect-function rejection; exact query/function policy and effective grants are ungrounded.
6. Negative tests list the required cases but several are not yet bound to a concrete enforcement mechanism.

Verdicts

• KB-first / PG-first: PARTIAL — local-last is correct; KB location alone must not imply authority.
• Taxonomy / shadow SSOT: PARTIAL — no positive authority, but negative gate authority remains possible.
• Guard feasibility: FAIL — process-level sandbox/egress/secret/local-FS/KB-write controls remain unspecified.
• FIX7 discoverability: PASS — honest, read-only, no global-absence claim.
• Negative tests: PARTIAL — coverage listed, enforcement proof incomplete.

Read-back target

knowledge/dev/laws/tool-kiem-thu/reviews/codex-reseal-gap-only-spec-rev3-2026-06-09.md