KB-37A8 rev 2

FIX7 Authority-Seal Encoder Spec (N7/N8/P7, executable, value-grammar + provenance)

13 min read Revision 2

FIX7 Authority-Seal Encoder Spec (N7 / N8 / P7) — executable, byte-exact

  • Date: 2026-06-10 · Patched: 2026-06-11 (fail-open + provenance closure) · Lane: FIX7_FINAL_AUTHORITY_SEAL_FAILOPEN_AND_PROVENANCE_PATCH_MACRO_2026_06_11
  • Authority of THIS doc: provisional-non-authority engineering contract. It defines HOW Codex authors N7/N8/P7 deterministically. It does not approve, seal, or fabricate any authority value. No self-seal.
  • Executable: authority_seal_encoder.py (sha256 13344f92cafcaf0d07dcb21700bdb642f38b89351702e08080eacb0e957144b8); machine mirror authority-seal-encoder-spec.json (hash recorded in rehearsal/HASH_MANIFEST.txt).
  • Closes Codex AS-P1 (N7 encoder), AS-P2 (acyclic DAG), AS-P3 (N8 contract), AS-P4 (P7 artifact) and the final-seal blockers FINAL-AS-VALUE-GRAMMAR, FINAL-AS-PROVENANCE, FINAL-AS-REPORT-SET. Codex reject: knowledge/dev/reports/architecture/codex-fix7-final-authority-seal-n7-n8-p7-2026-06-10/00-readme-first.md.

0. Why this exists / why it was patched

Codex first rejected the prose-only closure packet (no executable N7 encoder, an N7↔N8 cycle in wording, no byte-exact N8/P7). The executable encoder closed AS-P1..AS-P4. Codex then rejected the final seal (CODEX_FIX7_FINAL_AUTHORITY_SEAL_REJECT) for two new defect classes proved by direct adversarial probes: the encoder was fail-open (it accepted NOT_A_SHA, empty IDs/signers, not-an-int revisions, -1 byte counts, empty and duplicate report sets, all producing a 64-hex digest), and it was provenance-blind (the proposed N6 active_corpus_sha256 was classified REHEARSAL, yet nothing stopped it entering a real N7). This revision removes both gaps: every value now has a semantic grammar, the report set is validated, and a provenance class system makes REHEARSAL inputs impossible to submit as a real seal.

1. Grammar (identical to the canonicalizer — no new encoding)

The encoder copies the canonicalizer rev3 grammar byte-for-byte (proven by cross-tool equality of rec, digest, and FORBIDDEN_BYTES):

FORBIDDEN_BYTES = {0x09 TAB, 0x0A LF, 0x0D CR, 0x00 NUL, 0x5C backslash}
rec(*fields)    = ("\t".join(fields) + "\n").encode("utf-8")    # rejects TAB/LF/forbidden byte in any field
digest(tag,recs)= sha256( (tag + "\n").encode() + b"".join(recs) )

Each seal node is encoded as: the node's domain tag, then one rec(field_name, field_value) per roster field in fixed roster order (NOT sorted), then digest. The field order is the encoding. UTF-8 throughout. In addition (this revision), before any record is emitted every value is checked against a semantic grammar (§7); a value that violates its grammar is rejected and no digest is produced (fail-closed).

2. Authority-seal DAG (acyclic) — AS-P2

Engineering edges N1..N8/N9 are copied verbatim from the canonicalizer EDGES; this authority layer adds only the P7 pin node:

N1 []                         per-doc normalized_active_content_sha256
N2 []                         canonicalizer_sha256  (rev3 49c386a9…b734d0)
N3 []                         marker_fence_registry_sha256
N4 []                         superseded_boundary_sha256
N5 []                         guard_set_sha256 (= N1 of doc 06)
N6 [N1]                       active_corpus_sha256
N7 [N2,N3,N4,N5,N6,N1]        envelope_manifest_sha256
N8 [N2,N5,N6,N7]              detached_seal_sha256       (depends on N7)
P7 [N2,N7,N8]                 authority_seal_pin_sha256  (depends on N7 and N8)

has_cycle(EDGES)False (executable check). Seal order: engineering N1..N6 → N7 → N8 → P7. N7 never binds N8 or P7; N8 never binds P7. Any input that would create a back-edge is rejected SEAL_HASH_GRAPH_CYCLE.

P7 dependency rationale (precede vs follow)

P7 is the final authoritative pin; it FOLLOWS N7 and N8 (P7 → N2,N7,N8). The candidate identity values it pins — canonicalizer rev3 path/revision/bytes/hash (= N2) and the Packet V3 tree — are leaf data inputs available throughout; they are not a node that depends on N7/N8, so there is no cycle. No node points back to P7 ⇒ acyclic.

3. N7 — envelope manifest (AS-P1)

  • Domain tag: FIX7_ACTIVE_AUTHORITY_ENVELOPE_MANIFEST_V1
  • Output field: envelope_manifest_sha256
  • Fixed roster (order = encoding; kind column = value grammar from §7):
# field kind source actor
1 schema_version const const FIX7-AUTHORITY-SEAL-V1 contract
2 node_id const const N7 contract
3 membership_sha256 hex N1 doc-set anchor (per-doc N1 via N6) engineering
4 canonicalizer_sha256 hex N2 (rev3) engineering
5 marker_fence_registry_sha256 hex N3 engineering
6 superseded_boundary_sha256 hex N4 engineering
7 guard_set_sha256 hex N5 engineering
8 active_corpus_sha256 hex N6 engineering
9 approval_event_id id A1 Codex
10 approver_identity identity A2 owner + Codex
11 approval_event_timestamp timestamp A3 Codex
12 owner_blueprint_decision decision A5 owner
13 approval_scope const const BLUEPRINT_SEAL_ONLY_NO_IMPLEMENTATION contract
  • Excluded (cycle guard): detached_seal_sha256 (N8), authority_seal_pin_sha256 (P7), self envelope_manifest_sha256. Presence ⇒ SEAL_HASH_GRAPH_CYCLE.

4. N8 — Codex detached seal (AS-P3)

  • Domain tag: FIX7_CODEX_DETACHED_SEAL_V1
  • Output field: detached_seal_sha256
  • Fixed roster:
# field kind source actor
1 schema_version const const contract
2 node_id const const N8 contract
3 canonicalizer_sha256 hex N2 engineering
4 guard_set_sha256 hex N5 engineering
5 active_corpus_sha256 hex N6 engineering
6 envelope_manifest_sha256 hex N7 (dependency) from §3
7 sealed_by identity signer/authority identity Codex
8 sealed_at timestamp timestamp Codex
9 parent_checkpoint path checkpoint document_id@revision Codex
10 report_documents_digest hex sub-digest (§9), tag FIX7_CODEX_SEAL_REPORTS_V1 Codex
11 seal_scope const const BLUEPRINT_SEAL_ONLY_NO_IMPLEMENTATION contract
  • Excluded (cycle guard): authority_seal_pin_sha256 (P7), self. N8 requires N7 (SEAL_INPUT_MISSING if absent).

5. P7 — authority seal pin (AS-P4)

  • Domain tag: FIX7_AUTHORITY_SEAL_PIN_V1
  • Output field: authority_seal_pin_sha256
  • Nature: P7 is a seal document with a byte-exact digest, authored via seal_p7(). A prose-only pin is rejected SEAL_PROSE_ONLY_PIN_REJECTED.
  • Fixed roster:
# field kind value/source actor
1 schema_version const const contract
2 node_id const const P7 contract
3 pinned_canonicalizer_document_id path …/canonicalizer-fix7-canon-v1-ssot.md engineering
4 pinned_canonicalizer_revision posint 3 engineering
5 pinned_canonicalizer_utf8_bytes posint 38756 engineering
6 pinned_canonicalizer_sha256 hex 49c386a9…b734d0 (= N2) engineering
7 pinned_packet_v3_tree_sha256 hex b95df0a5…ca6d engineering
8 codex_report_document path report document_id@revision Codex
9 codex_checkpoint_document path checkpoint document_id@revision Codex
10 envelope_manifest_sha256 hex N7 from §3
11 detached_seal_sha256 hex N8 from §4
12 approval_event_id id A1 Codex
13 pin_scope const const CANDIDATE_TO_AUTHORITATIVE_PIN_BLUEPRINT_ONLY contract
  • verify_pin(expected, pairs) recomputes P7; any mutation of the pinned canonicalizer hash or Packet V3 tree changes the digest ⇒ verify FAIL.

6. Fail-closed status vocabulary

SEAL_UNKNOWN_NODE, SEAL_DOMAIN_TAG_MISMATCH, SEAL_HASH_GRAPH_CYCLE, SEAL_INPUT_MISSING, SEAL_INPUT_EXTRA, SEAL_INPUT_DUPLICATE, SEAL_FIELD_ORDER_MISMATCH, SEAL_CONSTANT_FIELD_MISMATCH, SEAL_FIELD_NOT_STRING, SEAL_FIELD_FORBIDDEN_BYTE, SEAL_FIELD_RESERVED_TOKEN, SEAL_FIELD_EMPTY, SEAL_FIELD_NOT_HEX, SEAL_FIELD_BAD_ID, SEAL_FIELD_BAD_IDENTITY, SEAL_FIELD_BAD_TIMESTAMP, SEAL_FIELD_BAD_ENUM, SEAL_FIELD_BAD_INT, SEAL_FIELD_BAD_PATH, SEAL_FIELD_UNKNOWN_KIND, SEAL_PROSE_ONLY_PIN_REJECTED, SEAL_REPORT_SET_EMPTY, SEAL_REPORT_SET_DUPLICATE, SEAL_REPORT_DOC_ID_INVALID, SEAL_REPORT_REVISION_INVALID, SEAL_PROVENANCE_MISSING, SEAL_PROVENANCE_UNKNOWN_CLASS, SEAL_PROVENANCE_REHEARSAL_BLOCKED, SEAL_PROVENANCE_FORBIDDEN_CLASS, SEAL_REAL_N6_NOT_AVAILABLE.

7. Value grammar (per-field kinds) — FINAL-AS-VALUE-GRAMMAR

Every roster field is bound to exactly one grammar kind. The value is validated before any digest is produced; an invalid value fails closed with the status shown. Any non-const field whose value is "" is rejected SEAL_FIELD_EMPTY first.

# kind rule reject status
1 hex exactly 64 lowercase hex ^[0-9a-f]{64}$ SEAL_FIELD_NOT_HEX
2 id ^[A-Za-z0-9][A-Za-z0-9._:@+/-]{0,199}$ SEAL_FIELD_BAD_ID
3 identity non-empty printable ASCII, not all-whitespace SEAL_FIELD_BAD_IDENTITY
4 timestamp RFC3339 UTC ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,9})?Z$ SEAL_FIELD_BAD_TIMESTAMP
5 decision uppercase token ^[A-Z0-9][A-Z0-9_]{0,127}$ SEAL_FIELD_BAD_ENUM
6 posint positive integer ^[1-9][0-9]{0,17}$ (rejects -1, 0, not-an-int) SEAL_FIELD_BAD_INT
7 path non-empty ^[A-Za-z0-9][A-Za-z0-9._/@:+-]{0,399}$ SEAL_FIELD_BAD_PATH
8 const fixed contract value (checked by the constant gate) SEAL_CONSTANT_FIELD_MISMATCH

The field_kinds map in authority-seal-encoder-spec.json is the machine mirror of this table and is drift-checked field-by-field against the encoder FIELD_KIND.

8. Provenance classes — FINAL-AS-PROVENANCE

A REAL seal (functions encode_real_n7 / encode_real_n8 / encode_real_p7) requires a provenance class for every input. The rehearsal path (encode_node) is provenance-agnostic and is never a real seal.

Classes: ENGINEERING_VERIFIED_CANDIDATE, REHEARSAL, AUTHORITY_INPUT, CODEX_AUTHORED, OFFICIAL_PIN, FORBIDDEN_FOR_REAL_SEAL.

  • Real engineering corpus (N6 etc.) may be only ENGINEERING_VERIFIED_CANDIDATE or OFFICIAL_PIN.
  • Real authority/signer inputs may be only AUTHORITY_INPUT, CODEX_AUTHORED, or OFFICIAL_PIN.
  • A REHEARSAL input → SEAL_PROVENANCE_REHEARSAL_BLOCKED. Missing → SEAL_PROVENANCE_MISSING. Unknown class → SEAL_PROVENANCE_UNKNOWN_CLASS. FORBIDDEN_FOR_REAL_SEAL or any other disallowed class → SEAL_PROVENANCE_FORBIDDEN_CLASS.
  • Even with valid classes, the real path stays BLOCKED with SEAL_REAL_N6_NOT_AVAILABLE until a real non-rehearsal N1..N6 chain is supplied (real_n6_available=True with first-hand evidence). No such chain exists in this lane — this is the standing true blocker.

9. Report-set rules — FINAL-AS-REPORT-SET

report_documents_digest(report_pairs) (tag FIX7_CODEX_SEAL_REPORTS_V1): rejects an empty set (SEAL_REPORT_SET_EMPTY), a duplicate record or duplicate document id (SEAL_REPORT_SET_DUPLICATE), an invalid/empty document id (SEAL_REPORT_DOC_ID_INVALID, grammar = path), and an invalid revision (SEAL_REPORT_REVISION_INVALID, grammar = posint). Validated records are deterministically sorted before hashing, so input order does not change the digest but invalidity always fails closed.

10. How Codex authors the seal (no invention required)

  1. Obtain engineering digests N1(membership)/N2/N3/N4/N5/N6 from canonicalizer --produce with provenance ENGINEERING_VERIFIED_CANDIDATE (not REHEARSAL).
  2. Run the authorized approval event → fill A1/A2/A3/A5 (provenance AUTHORITY_INPUT) → encode_real_n7(…, provenance, real_n6_available=True)envelope_manifest_sha256.
  3. Fill Codex signer/timestamp/parent/report (CODEX_AUTHORED) → encode_real_n8(…)detached_seal_sha256.
  4. Fill report/checkpoint/event id → encode_real_p7(…)authority_seal_pin_sha256.

Every field name, order, tag, byte rule, value grammar, and provenance class is fixed above. Codex invents nothing.

11. Fixture digests (NOT a seal)

With FIXTURE authority inputs (--emit-fixture): N7 6225f265…459bfd, N8 b1f001b6…75aa73, P7 3599f663…a7d541. These prove the encoder RUNS and is DETERMINISTIC; they are not real authority values (real A1–A5 + Codex signer are owner/Codex inputs, and the rehearsal corpus is provenance-classed REHEARSAL, which the real path rejects).

Back to Knowledge Hub knowledge/dev/laws/tool-kiem-thu/packets/fix7-authority-closure-2026-06-10/authority-seal-encoder-spec.md