Checkpoint — v0.2-hardening Build on V3 (2026-06-10)

Status: NON_AUTHORITY · NOT_PROMOTED · may_gate=false · decision_effect=NONE · Object: TKT-OBJ-134 Macro: TKT_V02_HARDENING_BUILD_ON_V3_APPROVAL_LANE_MACRO · Author: T2 / Claude-Code / Fable5 Final status: TKT_V02_HARDENING_BUILD_ON_V3_REVIEW_READY

Scope note

Approval-lane macro (not a rebase note). Live-read SSOT/baseline, then assembled the v0.2-hardening dev surface end-to-end on top of the Codex-engineering-accepted FIX7 V3 baseline. Local runnable prototype built + executed; KB dev surface authored.

Locks honored

• Production mutation: NO · Codex consulted: NO · V3 baseline mutated: NO · KB/FIX7 packet baseline mutated: NO (read-only).
• Writes only under dev/v0.2-hardening/ (KB) + ~/tkt-v0.2-hardening-workbench/ (local scratch). Fully reversible (delete two trees).
• No PG/Directus/registry-row/system_issues/REAL_RUN/QT001/permit/activation/repoint/cutover/registries-pivot/auto-birth. No raw logs in vector KB. No invented NVSZ root.

Verdicts

workstream	verdict
V3 baseline freeze	PASS (V3_BASELINE_FROZEN, fingerprint pinned from live read; rollback/compare defined)
v0.2 dev surface	PASS (separated, NON_AUTHORITY)
black-box oracle framework	PASS (specified + prototyped + run)
manifest laundering prevention	PASS (specified + proven M2-M6)
fail-open regression	PASS (exit 0 = attack caught at emit+verify+suite; canonical tree intact)
fail-closed manifest verifier	PASS (tamper/unknown-key/oracle-violation all fail closed)
strict RERUN	PASS (RERUN_RESULT: PASS, gates 0-8, exit 0)
Run Evidence Packet	PASS (prototype); NVSZ root = BLOCKED (V02-PB-NVSZ-1, action-ready)
KB-native reconstruction	PARTIAL (prototype local; KB-publish deferred V02-PB-KBPKT-1)
adversarial/regression suite	PASS (7/7 acceptance; V1/V2/V3 fixtures mapped)
object governance	PASS (TKT-OBJ-121..136; registry rev9)

Evidence

• bash tkt_v02_rerun_template.sh → RERUN_RESULT: PASS (exit 0)
• tkt_v02_selftest.py → SELFTEST_RESULT: 7/7 acceptance checks PASS (exit 0)
• transcript: ~/tkt-v0.2-hardening-workbench/evidence/master-evidence-transcript.txt; hashes: evidence/WORKBENCH_HASH_MANIFEST.sha256

Remaining (true blockers only)

V02-PB-NVSZ-1 (no-vector file/object-store root — owner/operator) · V02-PB-KBPKT-1 (KB-publish prototype — follow-up macro) · V02-PB-PROMOTE-1 (promotion — owner). None blocks the v0.2 dev surface.

Next macro

R1 resolve NVSZ root (owner) → R2 adopt framework for a real SUT → R3 KB-publish prototype packet.