FIX7 Authority-Seal Rehearsal — Run Evidence (commands.sh · stdout.log · exit_codes · HASH_MANIFEST · packet_tree · summary)

• Date: 2026-06-10 · Host: T1 · NOT A SEAL. This is the captured reproduction evidence for the full-dress rehearsal.
• stderr.log: empty (0 bytes) — no errors on any step.

exit_codes.json (all 0)

{"steps": {"recon_identity": 0, "selftest": 0, "rehearsal": 0, "drift_check": 0, "redteam": 0, "antihardcode": 0}, "all_zero": true, "commands_sh": "bash rehearsal/commands.sh"}

rehearsal-summary.json

{"NOT_A_SEAL": {"ARTIFACT_CLASS": "REHEARSAL_ONLY_NOT_A_SEAL"}, "sequence": ["N7","N8","P7"], "dag_acyclic": true,
 "n7_envelope_manifest_sha256": "6225f265155942c1d32ce3ed2d491b4c3b7b0109a3b4b6fde9a37f434b459bfd",
 "n8_detached_seal_sha256": "b1f001b64da50748823259593393b6e2d050c8c55c56918c99386984d075aa73",
 "p7_authority_seal_pin_sha256": "3599f6635be42a695991f66f561642e26718403f4e14ad220480480a8da7d541",
 "deterministic_second_pass_identical": true,
 "encoder_sha256": "47200442f176b1c534f000c4079632f6388b17dd1763bdbac2cbb725a452b5bb"}

commands.sh (the reproducer)

#!/usr/bin/env bash
set -u
HERE="$(cd "$(dirname "$0")" && pwd)"
ROOT=""
for cand in "$HERE/.." "$HERE/../recon" "$HERE"; do
  if [ -f "$cand/authority_seal_encoder.py" ]; then ROOT="$(cd "$cand" && pwd)"; break; fi
done
if [ -z "$ROOT" ]; then echo "FATAL: cannot locate authority_seal_encoder.py" >&2; exit 2; fi
cd "$ROOT"; rc=0
shasum -a 256 authority_seal_encoder.py || rc=1
wc -c authority_seal_encoder.py || rc=1
shasum -a 256 authority-seal-encoder-spec.json || rc=1
python3 authority_seal_encoder.py --selftest || rc=1
python3 authority_seal_rehearsal.py "$HERE" || rc=1
python3 authority_seal_drift_check.py "$ROOT" || rc=1
python3 authority_seal_redteam.py "$HERE" || rc=1
python3 authority_seal_antihardcode.py || rc=1
echo "## RESULT rc=$rc"; exit $rc

packet_tree.sha256

# convention: sha256 of  relpath\0 len(bytes)\0  over sorted tracked files
# excluded: HASH_MANIFEST.txt, packet_tree.sha256, codex-final-seal-review-packet.md
# tracked_files: 22
PACKET_TREE_SHA256=9f40519aa390497869850a12a82e73b2d3dd17ec53b5356b9c4fa1a243fb7314

HASH_MANIFEST.txt (rehearsal artifacts, local-build)

aca0e9b7cf515d35812abe76aaac06dec4df2ab62cdd18bb4cee12809659783c  README_NOT_A_SEAL.md
028ab90f7be60b7456ce700120fc570309d60095555909d53b8d4dc8f41d867c  commands.sh
a0fb7d99c33a2f5e544fecbf1a31ca0716a23805c1a8c23308d2898a4b3e535f  exit_codes.json
3f8ee4dec43022aec1584bd16081eb59f6e9b01a9ad91882f8b655812fc2d9a8  fixture-inputs.json
fd726f04e4b04ceba24fa2ae241b222a1f204fb81bfaa96095344b62a91553c5  n7-rehearsal-artifact.json
8f46ee7351f28c0c8880acfd3304cbb08ac1ecb08041f3bef2e0466eaf8d8b3b  n8-rehearsal-artifact.json
e3e3f9bc59c0a704702f10762d4dbf0c49bf47ac4644aa8a817ff6a7b2c499f6  p7-rehearsal-artifact.json
4ec6f3056f0ae725b97bc9a8a9f2eb645b02aded134f98b68698349633baf3c9  redteam-results.json
12c45758be207822f98555a1aa00b501e7c03338dcee92006bb327702b303960  rehearsal-summary.json
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  stderr.log (empty)
46ba26490fe54af43a223cee44fabe5803eeaa5406400596f9a5c918168312ac  stdout.log

stdout.log (verbatim, all steps)

## 0. fresh-recon identity (expect 47200442…a452b5bb / 19131 bytes)
47200442f176b1c534f000c4079632f6388b17dd1763bdbac2cbb725a452b5bb  authority_seal_encoder.py
   19131 authority_seal_encoder.py
f1c499270923c65c56783196b411ad6cacfe1188be0c531fabdd05a7795ef5eb  authority-seal-encoder-spec.json
## 1. encoder selftest (expect 22/22 PASS, exit 0)
AUTHORITY-SEAL-ENCODER SELFTEST: 22/22 PASS
## 2. end-to-end N7->N8->P7 rehearsal (NOT A SEAL)
  N7: 6225f265155942c1d32ce3ed2d491b4c3b7b0109a3b4b6fde9a37f434b459bfd
  N8: b1f001b64da50748823259593393b6e2d050c8c55c56918c99386984d075aa73 (binds N7)
  P7: 3599f6635be42a695991f66f561642e26718403f4e14ad220480480a8da7d541 (binds N7,N8)
  DAG acyclic: True ; deterministic 2nd pass: True ; REHEARSAL OK
## 3. spec/code/json/doc drift check (expect 22/22 agree, drift=0)
DRIFT-CHECK: 22/22 agree; drift=0
## 4. red-team adversarial suite (expect 20/20 caught)
RED-TEAM: 20/20 attacks caught; escaped=0
## 5. anti-hardcode / anti-laundering proof (expect 9/9 PASS)
  [PASS] T4 broken encoder selftest still exits 0 (no hex oracle in selftest)  -- rc=0
  [PASS] T4 broken encoder FLAGGED by spec.json fixture-digest oracle (drift)
  [PASS] T4 drift-checker exits NONZERO on broken encoder  -- rc=1
ANTI-HARDCODE/LAUNDERING: 9/9 PASS
## RESULT rc=0

(Full per-line PASS output is in the local stdout.log; condensed here for the governed record.)