FIX7 Authority-Seal Encoder Spec (N7/N8/P7, executable, value-grammar + provenance)
FIX7 Authority-Seal Encoder Spec (N7 / N8 / P7) — executable, byte-exact
- Date: 2026-06-10 · Patched: 2026-06-11 (fail-open + provenance closure) · Lane:
FIX7_FINAL_AUTHORITY_SEAL_FAILOPEN_AND_PROVENANCE_PATCH_MACRO_2026_06_11 - Authority of THIS doc: provisional-non-authority engineering contract. It defines HOW Codex authors N7/N8/P7 deterministically. It does not approve, seal, or fabricate any authority value. No self-seal.
- Executable:
authority_seal_encoder.py(sha25613344f92cafcaf0d07dcb21700bdb642f38b89351702e08080eacb0e957144b8); machine mirrorauthority-seal-encoder-spec.json(hash recorded inrehearsal/HASH_MANIFEST.txt). - Closes Codex AS-P1 (N7 encoder), AS-P2 (acyclic DAG), AS-P3 (N8 contract), AS-P4 (P7 artifact) and the final-seal blockers
FINAL-AS-VALUE-GRAMMAR,FINAL-AS-PROVENANCE,FINAL-AS-REPORT-SET. Codex reject:knowledge/dev/reports/architecture/codex-fix7-final-authority-seal-n7-n8-p7-2026-06-10/00-readme-first.md.
0. Why this exists / why it was patched
Codex first rejected the prose-only closure packet (no executable N7 encoder, an N7↔N8 cycle in wording, no byte-exact N8/P7). The executable encoder closed AS-P1..AS-P4. Codex then rejected the final seal (CODEX_FIX7_FINAL_AUTHORITY_SEAL_REJECT) for two new defect classes proved by direct adversarial probes: the encoder was fail-open (it accepted NOT_A_SHA, empty IDs/signers, not-an-int revisions, -1 byte counts, empty and duplicate report sets, all producing a 64-hex digest), and it was provenance-blind (the proposed N6 active_corpus_sha256 was classified REHEARSAL, yet nothing stopped it entering a real N7). This revision removes both gaps: every value now has a semantic grammar, the report set is validated, and a provenance class system makes REHEARSAL inputs impossible to submit as a real seal.
1. Grammar (identical to the canonicalizer — no new encoding)
The encoder copies the canonicalizer rev3 grammar byte-for-byte (proven by cross-tool equality of rec, digest, and FORBIDDEN_BYTES):
FORBIDDEN_BYTES = {0x09 TAB, 0x0A LF, 0x0D CR, 0x00 NUL, 0x5C backslash}
rec(*fields) = ("\t".join(fields) + "\n").encode("utf-8") # rejects TAB/LF/forbidden byte in any field
digest(tag,recs)= sha256( (tag + "\n").encode() + b"".join(recs) )
Each seal node is encoded as: the node's domain tag, then one rec(field_name, field_value) per roster field in fixed roster order (NOT sorted), then digest. The field order is the encoding. UTF-8 throughout. In addition (this revision), before any record is emitted every value is checked against a semantic grammar (§7); a value that violates its grammar is rejected and no digest is produced (fail-closed).
2. Authority-seal DAG (acyclic) — AS-P2
Engineering edges N1..N8/N9 are copied verbatim from the canonicalizer EDGES; this authority layer adds only the P7 pin node:
N1 [] per-doc normalized_active_content_sha256
N2 [] canonicalizer_sha256 (rev3 49c386a9…b734d0)
N3 [] marker_fence_registry_sha256
N4 [] superseded_boundary_sha256
N5 [] guard_set_sha256 (= N1 of doc 06)
N6 [N1] active_corpus_sha256
N7 [N2,N3,N4,N5,N6,N1] envelope_manifest_sha256
N8 [N2,N5,N6,N7] detached_seal_sha256 (depends on N7)
P7 [N2,N7,N8] authority_seal_pin_sha256 (depends on N7 and N8)
has_cycle(EDGES) → False (executable check). Seal order: engineering N1..N6 → N7 → N8 → P7. N7 never binds N8 or P7; N8 never binds P7. Any input that would create a back-edge is rejected SEAL_HASH_GRAPH_CYCLE.
P7 dependency rationale (precede vs follow)
P7 is the final authoritative pin; it FOLLOWS N7 and N8 (P7 → N2,N7,N8). The candidate identity values it pins — canonicalizer rev3 path/revision/bytes/hash (= N2) and the Packet V3 tree — are leaf data inputs available throughout; they are not a node that depends on N7/N8, so there is no cycle. No node points back to P7 ⇒ acyclic.
3. N7 — envelope manifest (AS-P1)
- Domain tag:
FIX7_ACTIVE_AUTHORITY_ENVELOPE_MANIFEST_V1 - Output field:
envelope_manifest_sha256 - Fixed roster (order = encoding; kind column = value grammar from §7):
| # | field | kind | source | actor |
|---|---|---|---|---|
| 1 | schema_version |
const | const FIX7-AUTHORITY-SEAL-V1 |
contract |
| 2 | node_id |
const | const N7 |
contract |
| 3 | membership_sha256 |
hex | N1 doc-set anchor (per-doc N1 via N6) | engineering |
| 4 | canonicalizer_sha256 |
hex | N2 (rev3) | engineering |
| 5 | marker_fence_registry_sha256 |
hex | N3 | engineering |
| 6 | superseded_boundary_sha256 |
hex | N4 | engineering |
| 7 | guard_set_sha256 |
hex | N5 | engineering |
| 8 | active_corpus_sha256 |
hex | N6 | engineering |
| 9 | approval_event_id |
id | A1 | Codex |
| 10 | approver_identity |
identity | A2 | owner + Codex |
| 11 | approval_event_timestamp |
timestamp | A3 | Codex |
| 12 | owner_blueprint_decision |
decision | A5 | owner |
| 13 | approval_scope |
const | const BLUEPRINT_SEAL_ONLY_NO_IMPLEMENTATION |
contract |
- Excluded (cycle guard):
detached_seal_sha256(N8),authority_seal_pin_sha256(P7), selfenvelope_manifest_sha256. Presence ⇒SEAL_HASH_GRAPH_CYCLE.
4. N8 — Codex detached seal (AS-P3)
- Domain tag:
FIX7_CODEX_DETACHED_SEAL_V1 - Output field:
detached_seal_sha256 - Fixed roster:
| # | field | kind | source | actor |
|---|---|---|---|---|
| 1 | schema_version |
const | const | contract |
| 2 | node_id |
const | const N8 |
contract |
| 3 | canonicalizer_sha256 |
hex | N2 | engineering |
| 4 | guard_set_sha256 |
hex | N5 | engineering |
| 5 | active_corpus_sha256 |
hex | N6 | engineering |
| 6 | envelope_manifest_sha256 |
hex | N7 (dependency) | from §3 |
| 7 | sealed_by |
identity | signer/authority identity | Codex |
| 8 | sealed_at |
timestamp | timestamp | Codex |
| 9 | parent_checkpoint |
path | checkpoint document_id@revision |
Codex |
| 10 | report_documents_digest |
hex | sub-digest (§9), tag FIX7_CODEX_SEAL_REPORTS_V1 |
Codex |
| 11 | seal_scope |
const | const BLUEPRINT_SEAL_ONLY_NO_IMPLEMENTATION |
contract |
- Excluded (cycle guard):
authority_seal_pin_sha256(P7), self. N8 requires N7 (SEAL_INPUT_MISSINGif absent).
5. P7 — authority seal pin (AS-P4)
- Domain tag:
FIX7_AUTHORITY_SEAL_PIN_V1 - Output field:
authority_seal_pin_sha256 - Nature: P7 is a seal document with a byte-exact digest, authored via
seal_p7(). A prose-only pin is rejectedSEAL_PROSE_ONLY_PIN_REJECTED. - Fixed roster:
| # | field | kind | value/source | actor |
|---|---|---|---|---|
| 1 | schema_version |
const | const | contract |
| 2 | node_id |
const | const P7 |
contract |
| 3 | pinned_canonicalizer_document_id |
path | …/canonicalizer-fix7-canon-v1-ssot.md |
engineering |
| 4 | pinned_canonicalizer_revision |
posint | 3 |
engineering |
| 5 | pinned_canonicalizer_utf8_bytes |
posint | 38756 |
engineering |
| 6 | pinned_canonicalizer_sha256 |
hex | 49c386a9…b734d0 (= N2) |
engineering |
| 7 | pinned_packet_v3_tree_sha256 |
hex | b95df0a5…ca6d |
engineering |
| 8 | codex_report_document |
path | report document_id@revision |
Codex |
| 9 | codex_checkpoint_document |
path | checkpoint document_id@revision |
Codex |
| 10 | envelope_manifest_sha256 |
hex | N7 | from §3 |
| 11 | detached_seal_sha256 |
hex | N8 | from §4 |
| 12 | approval_event_id |
id | A1 | Codex |
| 13 | pin_scope |
const | const CANDIDATE_TO_AUTHORITATIVE_PIN_BLUEPRINT_ONLY |
contract |
verify_pin(expected, pairs)recomputes P7; any mutation of the pinned canonicalizer hash or Packet V3 tree changes the digest ⇒ verify FAIL.
6. Fail-closed status vocabulary
SEAL_UNKNOWN_NODE, SEAL_DOMAIN_TAG_MISMATCH, SEAL_HASH_GRAPH_CYCLE, SEAL_INPUT_MISSING, SEAL_INPUT_EXTRA, SEAL_INPUT_DUPLICATE, SEAL_FIELD_ORDER_MISMATCH, SEAL_CONSTANT_FIELD_MISMATCH, SEAL_FIELD_NOT_STRING, SEAL_FIELD_FORBIDDEN_BYTE, SEAL_FIELD_RESERVED_TOKEN, SEAL_FIELD_EMPTY, SEAL_FIELD_NOT_HEX, SEAL_FIELD_BAD_ID, SEAL_FIELD_BAD_IDENTITY, SEAL_FIELD_BAD_TIMESTAMP, SEAL_FIELD_BAD_ENUM, SEAL_FIELD_BAD_INT, SEAL_FIELD_BAD_PATH, SEAL_FIELD_UNKNOWN_KIND, SEAL_PROSE_ONLY_PIN_REJECTED, SEAL_REPORT_SET_EMPTY, SEAL_REPORT_SET_DUPLICATE, SEAL_REPORT_DOC_ID_INVALID, SEAL_REPORT_REVISION_INVALID, SEAL_PROVENANCE_MISSING, SEAL_PROVENANCE_UNKNOWN_CLASS, SEAL_PROVENANCE_REHEARSAL_BLOCKED, SEAL_PROVENANCE_FORBIDDEN_CLASS, SEAL_REAL_N6_NOT_AVAILABLE.
7. Value grammar (per-field kinds) — FINAL-AS-VALUE-GRAMMAR
Every roster field is bound to exactly one grammar kind. The value is validated before any digest is produced; an invalid value fails closed with the status shown. Any non-const field whose value is "" is rejected SEAL_FIELD_EMPTY first.
| # | kind | rule | reject status |
|---|---|---|---|
| 1 | hex |
exactly 64 lowercase hex ^[0-9a-f]{64}$ |
SEAL_FIELD_NOT_HEX |
| 2 | id |
^[A-Za-z0-9][A-Za-z0-9._:@+/-]{0,199}$ |
SEAL_FIELD_BAD_ID |
| 3 | identity |
non-empty printable ASCII, not all-whitespace | SEAL_FIELD_BAD_IDENTITY |
| 4 | timestamp |
RFC3339 UTC ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,9})?Z$ |
SEAL_FIELD_BAD_TIMESTAMP |
| 5 | decision |
uppercase token ^[A-Z0-9][A-Z0-9_]{0,127}$ |
SEAL_FIELD_BAD_ENUM |
| 6 | posint |
positive integer ^[1-9][0-9]{0,17}$ (rejects -1, 0, not-an-int) |
SEAL_FIELD_BAD_INT |
| 7 | path |
non-empty ^[A-Za-z0-9][A-Za-z0-9._/@:+-]{0,399}$ |
SEAL_FIELD_BAD_PATH |
| 8 | const |
fixed contract value (checked by the constant gate) | SEAL_CONSTANT_FIELD_MISMATCH |
The field_kinds map in authority-seal-encoder-spec.json is the machine mirror of this table and is drift-checked field-by-field against the encoder FIELD_KIND.
8. Provenance classes — FINAL-AS-PROVENANCE
A REAL seal (functions encode_real_n7 / encode_real_n8 / encode_real_p7) requires a provenance class for every input. The rehearsal path (encode_node) is provenance-agnostic and is never a real seal.
Classes: ENGINEERING_VERIFIED_CANDIDATE, REHEARSAL, AUTHORITY_INPUT, CODEX_AUTHORED, OFFICIAL_PIN, FORBIDDEN_FOR_REAL_SEAL.
- Real engineering corpus (N6 etc.) may be only
ENGINEERING_VERIFIED_CANDIDATEorOFFICIAL_PIN. - Real authority/signer inputs may be only
AUTHORITY_INPUT,CODEX_AUTHORED, orOFFICIAL_PIN. - A
REHEARSALinput →SEAL_PROVENANCE_REHEARSAL_BLOCKED. Missing →SEAL_PROVENANCE_MISSING. Unknown class →SEAL_PROVENANCE_UNKNOWN_CLASS.FORBIDDEN_FOR_REAL_SEALor any other disallowed class →SEAL_PROVENANCE_FORBIDDEN_CLASS. - Even with valid classes, the real path stays BLOCKED with
SEAL_REAL_N6_NOT_AVAILABLEuntil a real non-rehearsal N1..N6 chain is supplied (real_n6_available=Truewith first-hand evidence). No such chain exists in this lane — this is the standing true blocker.
9. Report-set rules — FINAL-AS-REPORT-SET
report_documents_digest(report_pairs) (tag FIX7_CODEX_SEAL_REPORTS_V1): rejects an empty set (SEAL_REPORT_SET_EMPTY), a duplicate record or duplicate document id (SEAL_REPORT_SET_DUPLICATE), an invalid/empty document id (SEAL_REPORT_DOC_ID_INVALID, grammar = path), and an invalid revision (SEAL_REPORT_REVISION_INVALID, grammar = posint). Validated records are deterministically sorted before hashing, so input order does not change the digest but invalidity always fails closed.
10. How Codex authors the seal (no invention required)
- Obtain engineering digests N1(membership)/N2/N3/N4/N5/N6 from canonicalizer
--producewith provenanceENGINEERING_VERIFIED_CANDIDATE(notREHEARSAL). - Run the authorized approval event → fill A1/A2/A3/A5 (provenance
AUTHORITY_INPUT) →encode_real_n7(…, provenance, real_n6_available=True)→envelope_manifest_sha256. - Fill Codex signer/timestamp/parent/report (
CODEX_AUTHORED) →encode_real_n8(…)→detached_seal_sha256. - Fill report/checkpoint/event id →
encode_real_p7(…)→authority_seal_pin_sha256.
Every field name, order, tag, byte rule, value grammar, and provenance class is fixed above. Codex invents nothing.
11. Fixture digests (NOT a seal)
With FIXTURE authority inputs (--emit-fixture): N7 6225f265…459bfd, N8 b1f001b6…75aa73, P7 3599f663…a7d541. These prove the encoder RUNS and is DETERMINISTIC; they are not real authority values (real A1–A5 + Codex signer are owner/Codex inputs, and the rehearsal corpus is provenance-classed REHEARSAL, which the real path rejects).