Checkpoint — FIX7 Final Authority-Seal Fail-Open + Provenance Patch Ready

• Date: 2026-06-11 Asia/Ho_Chi_Minh · Host: T1 · Codex consulted: NO · Production mutation: NO
• Final status: FIX7_FINAL_AUTHORITY_SEAL_SELF_CODEX_READY_AFTER_FAILOPEN_PATCH
• Standing true blocker: SEAL_REAL_N6_NOT_AVAILABLE (real N6 chain — owner/operator + Codex).
• Real N7/N8/P7 authored: NO / NO / NO. Real seal claimed: NO.

Decision

Codex's CODEX_FIX7_FINAL_AUTHORITY_SEAL_REJECT is closed for all engineering classes:

1. Fail-open → per-field value grammar (hex/id/identity/timestamp/decision/posint/path) + empty gate; all 8 Codex direct probes reproduced ACCEPTED pre-fix and now REJECTED post-fix.
2. Report set → empty/duplicate/invalid records rejected; deterministic sort.
3. Provenance-blind → provenance class system; REHEARSAL/missing/forbidden cannot enter a real N7 (encode_real_n7/n8/p7); the standing SEAL_REAL_N6_NOT_AVAILABLE is surfaced, not faked.
4. Governed-KB 404 → 7 required evidence files published + re-fetched present; manifest + tree ac3f56f9…477dc.

Evidence (self-Codex dry-run, bash rehearsal/commands.sh rc 0)

selftest 48/48 · rehearsal OK (deterministic; rehearsal→real BLOCKED) · red-team 39/39 (incl. all Codex probe classes) · drift 41/41 · anti-hardcode 13/13 · direct probes 19/19 REJECTED (fail-closed). Encoder 13344f92cafcaf0d07dcb21700bdb642f38b89351702e08080eacb0e957144b8. Pins preserved: fixtures 6225f265…/b1f001b6…/3599f663…; engineering 49c386a9…/b95df0a5… unchanged.

Boundaries honored

No production / PG / Directus / registry / system_issues mutation; no REAL_RUN / QT001 / permit / activation / repoint / cutover; no registries-pivot; no auto-birth repair; no Codex call; no self-authored real seal; no implementation.

Next

Route patched packet → Codex fresh final-seal review. Seal blocked on SEAL_REAL_N6_NOT_AVAILABLE + N7/N8/P7 authority inputs + owner authorization.

Master report: knowledge/dev/laws/tool-kiem-thu/reports/fix7-final-authority-seal-failopen-provenance-patch-master-report-2026-06-11.md. Ledger rev7: knowledge/dev/laws/tool-kiem-thu/checkpoints/fix7-recheck9-remaining-authority-blocker-ledger-2026-06-10.md.