Checkpoint — FIX7 Authority-Seal Full-Dress Rehearsal Codex-Ready

• Date: 2026-06-10 · Host: T1 · Status: FIX7_AUTHORITY_SEAL_FULL_DRESS_REHEARSAL_CODEX_READY
• Production mutation: NO · Codex consulted: NO · Seal authored: NO · Blueprint approved: NO · FIX7 implemented: NO
• Lane: FIX7_AUTHORITY_SEAL_FULL_DRESS_REHEARSAL_AND_CODEX_READY_PACKET_MACRO_2026_06_10

Outcome

The N7→N8→P7 executable authority-seal contract was freshly reconstructed from governed KB (byte-exact), run end-to-end, red-teamed, drift-checked, and anti-hardcode-proven, then packaged Codex-ready. Codex can now author the real seal supplying only authority inputs and inventing no field/order/encoding.

Evidence (all exit 0, reproducer bash rehearsal/commands.sh → rc=0)

Check	Result
Fresh KB reconstruction	encoder 47200442…a452b5bb (19131 B) ✓; spec.json f1c49927…95ef5eb (4928 B) ✓
Encoder selftest	22/22 PASS
End-to-end N7→N8→P7 rehearsal	PASS, acyclic, deterministic (digests NOT-A-SEAL: N7 6225f265…, N8 b1f001b6…, P7 3599f663…)
Red-team (20 attacks)	20/20 caught, 0 escaped
Spec/code/json/doc drift	22/22 agree, drift=0
Anti-hardcode/laundering	9/9 PASS
Packet tree	9f40519aa390497869850a12a82e73b2d3dd17ec53b5356b9c4fa1a243fb7314 (22 files)

Key finding

A --selftest alone has no expected-hex oracle — a physically broken encoder still passes 22/22. The drift checker is the binding integrity oracle: it pins the published fixture digests to spec.json and exits nonzero on the broken encoder. This is why repeating 22/22 is not completion, and why the drift + anti-hardcode layer is load-bearing.

Boundary preserved

Packet V3 tree b95df0a5…ca6d and canonicalizer rev3 49c386a9…b734d0 (rev3, 38756 bytes) unchanged. FIX7 implementation and every production/runtime gate remain BLOCKED. No Codex call, no real seal, no self-approval, no production mutation.

Remaining true blockers (authority only)

N7-INPUTS (A1/A2/A3/A5 — owner+Codex), N8-AUTH (Codex signer/timestamp/parent/report), P7-PIN (Codex seal_p7), OWN-1 (owner blueprint decision), IMPL-OWNER (separate implementation authorization). All authority inputs, not engineering gaps.

Deliverables

• Master report + 5 detail reports under …/reports/fix7-authority-seal-*-2026-06-10.md
• Closure packet …/packets/fix7-authority-closure-2026-06-10/ (encoder + spec + n7/n8/p7 + 4 harnesses + rehearsal/ + codex-final-seal-review-packet)
• Blocker ledger rev6; governance update TKT-OBJ-157..171 (148..156 reserved by the concurrent v0.2 lane); current-state doc.

Next

Route the rehearsed closure packet to Codex for the seal macro. Preserve Packet V3 / rev3; keep all implementation/production gates closed.