Incomex AI Portal
KB-3F6E rev 17

FIX7 Codex Recheck-9 Reproducible Packet V2 — README_FOR_CODEX (2026-06-10)

15 min read Revision 17

FIX7 Canonicalizer — Codex Recheck-9 Reproducible Packet V3 (README_FOR_CODEX)

  • Date: 2026-06-10 · Packet ID: FIX7-CODEX-RECHECK-9-PACKET-V3 · Object ID: TKT-OBJ-050 (superseding rev)
  • Authority: provisional-non-authority, evidence-only, decision_effect=NONE, may_gate=false. Tool-Kiem-Thu does not seal/approve. Codex remains the sole sealing authority; owner's standing decision ("do not approve the construction blueprint") is preserved.
  • Codex consulted: NO · Production mutation: NO · REAL_RUN/QT001/apply/permit/activation/repoint/cutover: NO · auto-birth repair: NO
  • Target: T1 FIX7 Existing-System Refactor Execution Blueprint canonicalizer SSOT, at Codex Recheck-9 V2 = CODEX_RECHECK_9_V2_NEEDS_T1_FIX.

0. What V3 fixes — R9-V2-B6 (oracle laundering / synthesized CLI exit)

Codex's V2 finding: manifest_tool.run_negative_tests() called canon.produce() in-process and synthesized cli_exit_contract = 0 if corpus_ok … else 4 without ever executing the CLI. Codex mutated the CLI error branch sys.exit(4) → sys.exit(0) on a copy, regenerated expected output + manifest + HASH_MANIFEST with the packet's own tools, and the full RERUN passed 22/22 while the actual missing-doc CLI exited 0. Self-referential proof: SUT → expected/manifest → verifier → PASS.

V3 closes this with a strict SUT / ORACLE / VERIFIER separation:

element V3 definition
SUT the actual canonicalizer CLI file executed as __main__ — at true OS-process level in RERUN.sh gate 6 ($? observed from bash), and via a runpy harness (manifest_tool.run_cli: real argv, fresh module run, OBSERVED SystemExit code, captured stdout) in the python proof layer. For verifier-lane cases the SUT is the actual manifest_tool.py CLI itself.
ORACLE manifest_tool.CLI_ORACLE: STATIC spec pin derived from the SSOT contract text ("exit 0 ONLY iff corpus_ok AND membership_frozen_ok; exit 4 otherwise"). It is a constant of the verifier, never regenerated from SUT output.
VERIFIER blackbox_negative_suite.py, failopen_regression.py, run_negative_tests, RERUN gates 6–8/11 — compare OBSERVED exits/stdout against the oracle and fail closed.

Anti-laundering (R9-B6.4): compute_authority executes the real CLI for every negative case and both positive controls at --emit AND --verify; any oracle violation raises ORACLE_VIOLATION, so --emit refuses to write a manifest over a fail-open SUT and --verify fails. Re-running the packet's own publishing commands can no longer convert bad behavior into a self-consistent packet. The synthesized cli_exit_contract field is REMOVED; RERUN gate 11 hard-fails if it ever reappears in manifest.json and requires cli_exit_observed + EXECUTED_CLI_BLACKBOX fields.

Executable proof of the exact Codex attack (failopen_regression.py, run live by RERUN gate 8 on an OS-temp copy; canonical packet never mutated):

  • M2: mutated SUT is genuinely fail-open — missing-doc CLI OBSERVED exit == 0;
  • M3: --emit on it exits nonzero with ORACLE_VIOLATION (laundering blocked);
  • M4: --verify exits nonzero; M5: the black-box suite exits nonzero; M6: canonical tree unchanged.

R9-B1..B5 repairs from V2 are unchanged (authority/explanatory manifest split, P-EXT-2 fail-closed SSOT fence, strict RERUN, KB-native packet, MCP byte proof).

1. Files in this packet (ALL at the KB packet root — no local-only artifact)

file role
README_FOR_CODEX.md this file (NON_AUTHORITY explanation)
manifest.json machine truth: authority (every field recomputed fail-closed, incl. 6 REAL CLI executions vs the static oracle) + explanatory (non-authority)
manifest_tool.py --emit / --verify / --scan / --complete / --emit-hash-manifest; hosts CLI_ORACLE (static spec pin) + run_cli (runpy black-box harness); emit/verify EXECUTE the real CLI and fail closed on any oracle violation
blackbox_negative_suite.py R9-B6.2: black-box CLI negative suite — 10 observed-behavior checks (P1/P2 positive controls; N1 missing doc 05, N2 extra, N3 invalid, N4 absent dir → OBSERVED exit 4 + suppression markers + zero aggregate-digest leak + no output artifact; N5 duplicate-on-disk N/A rationale + adjacent validator check; N6 forbidden marker → manifest CLI --scan exit 1 observed; N7 manifest tamper / N8 sealed-class claim → manifest CLI --verify exit 1 observed)
failopen_regression.py R9-B6.3: the Codex V2 attack as an executable regression (see §0); exit 0 iff the fail-open SUT is caught by emit, verify, and the black-box suite
adversarial_suite.py Codex-adversarial selfcheck: 4 positive controls + 13 tamper classes (T1..T13), 25 expectations; T2d observes the ACTUAL CLI exit; T13 = fail-open SUT must defeat emit AND verify. Excluded from the forbidden scan BY DESIGN (embeds forbidden tokens as test vectors); hash-pinned instead
kb_fetch_reconstruct.py R9-B4 fresh-fetch tool: rebuilds the runnable packet from the KB surface alone; verifies against HASH_MANIFEST bidirectionally; fails closed. READ-ONLY; no API key embedded; scan-excluded with reason; hash-pinned
RERUN.sh strict 13-gate rerun (see §2)
HASH_MANIFEST.txt sha256 of every tracked packet file (bidirectional coverage enforced by --complete)
evidence/canonicalizer-fix7-canon-v1-ssot.md the PATCHED SSOT (P-EXT-2; python fence = fail-closed extended canonicalizer) — byte-equal to the KB blueprint-path SSOT at its current revision
evidence/canonicalizer-fix7-canon-v1-ssot.py materialized from the SSOT fence; byte-identical to the extended reference (ONE canonical identity)
evidence/fix7_canon_v1_ssot_extended.py extended reference (same bytes as the materialized fence)
evidence/materialize_canonicalizer.py P1 byte-extraction command
evidence/selftest-expected-output.txt, evidence/produce-expected-output.txt SUT-derived VALUE-CONSISTENCY regression pins (candidate digest values) — explicitly NOT behavioral oracles; the behavioral oracle is authority.cli_oracle, checked only against EXECUTED CLI runs
docs/ ×10 the active members. NOT duplicated as KB packet copies — the governed source is the 10 CANONICAL blueprint document ids; kb_fetch_reconstruct.py rebuilds docs/ from those ids; the pinned hashes fail closed if the live corpus diverges
logs/ raw publish-run logs: materialized-selftest.log, extended-selftest.log, produce.log, forbidden-scope.log (pinned in manifest authority) + manifest-verify.log, adversarial-suite.log, blackbox-negative-suite.log, failopen-regression.log (generated after manifest emission → pinned by HASH_MANIFEST only, circularity-free; RERUN regenerates all of them live into rerun-out/)

Authority / non-authority (Article 14). The single executable authority is the SSOT fence. The hash-truth source is manifest.json → authority, every field recomputed at --verify from disk bytes + live executions — now including six REAL CLI executions (4 negative corpus cases + produce/selftest positive controls) whose exits are OBSERVED, never inferred. explanatory is declared non-authority and excluded from PASS. No value here is a Codex seal (codex_sealed_values_present: false, enforced fail-closed).

2. Exact rerun (what Codex runs)

bash RERUN.sh     # exit 0 + final "RERUN_RESULT: PASS" ONLY if all 13 gates pass live:
                  # 0 completeness · 1 shasum -c · 2 materialize+cmp · 3/4 selftests byte-diff
                  # 5 produce byte-diff · 6 BLACK-BOX negative CLI x4 (OS-process $? == 4 observed,
                  #   suppression markers, zero digest leak) · 7 black-box negative suite
                  # 8 fail-open regression (Codex V2 attack must be caught) · 9 cross-tool membership
                  # 10 forbidden scan · 11 FULL manifest verify (REAL CLI executions vs static oracle;
                  #   inferred-evidence fields rejected) · 12 adversarial suite (25 expectations)

Offline, stdlib-python3 + shasum/diff/cmp/grep; writes only ./rerun-out/ + OS temp dirs.

Key expected values (machine truth = manifest.json; these are convenience copies):

  • SSOT .md sha256 (P-EXT-2 candidate): 49c386a9b9666c09786fc4f89bc79776b6046eaee6f4da6d8537d2c753b734d0
  • materialized/extended .py sha256: d9caa9fe9f46854c38c996747d50d2e73bc5074705730e869fd6b1f8cc26f3e5
  • frozen membership: f2bda8effc7be19b54722828126b82d7d2d48bee5e5e5dc0c8f347ce210fe251
  • selftest: 45/45, CLI exit OBSERVED 0 · produce: corpus_ok: True, CLI exit OBSERVED 0
  • every negative corpus case: CLI exit OBSERVED 4, all 8 aggregate digests SUPPRESSED_CORPUS_NOT_OK, zero hex leak

3. Replaying the Codex V2 attack yourself (expected: V3 defeats it)

On a COPY of the packet: flip the single sys.exit(4) to sys.exit(0) in the SSOT fence + materialized .py + extended .py; regenerate evidence/*-expected-output.txt with the mutated CLI; then:

  1. python3 manifest_tool.py --emit → MUST exit nonzero printing ORACLE_VIOLATION (cli_exit_observed: 0, cli_exit_expected: 4) — the manifest cannot be laundered;
  2. python3 manifest_tool.py --emit-hash-manifest still "succeeds" (it only hashes bytes — by design it proves transport integrity, not behavior);
  3. bash RERUN.sh → MUST abort nonzero at gate 6 with NEGATIVE CLI CASE 'missing': OBSERVED exit 0 != 4 (oracle) — FAIL-OPEN before any PASS line;
  4. python3 adversarial_suite.py / python3 blackbox_negative_suite.py → nonzero.

This exact replay was executed during V3 publication (T1 self-check) with observed results: V2 packet → BYPASS_RERUN_EXIT=0 (defect reproduced); V3 packet → --emit exit 1 (ORACLE_VIOLATION), RERUN exit 1 at gate 6, missing-doc CLI observed exit 0 detected.

4. What Codex verifies

  1. bash RERUN.sh → exit 0, RERUN_RESULT: PASS (all 13 gates live).
  2. Adversarially: every Recheck-9 + V2 probe is now a packet test — manifest tampers (T1/T3/T4/T10/T11/T12), missing doc 05 incl. OBSERVED CLI exit (T2a–T2d), log/HASH/RERUN removal (T5/T6/T7), byte-flip (T8), forbidden token (T9), fail-open SUT (T13 + failopen_regression + gate 6).
  3. Fresh-fetch reconstruction (R9-B4): fetch every §6 document, write bytes, bash RERUN.sh — same hash tree, same PASS.
  4. Current-KB byte identity (R9-B5): re-fetch the 10 active docs + SSOT via MCP, hash UTF-8 bytes, compare to authority.artifacts / per_doc.

5. What Codex should NOT infer

  • (a) No digest VALUE here is sealed/approved — candidates/rehearsals only (codex_sealed_values_present: false, fail-closed enforced).
  • (b) The blueprint is NOT approved — owner's "do not approve" stands.
  • (c) N7/N8 are NOT produced — BLOCKED_NEEDS_SEALED_INPUTS / CODEX_ONLY by design.
  • (d) The authoritative canonicalizer_sha256/canonicalizer_revision are NOT pinned — 49c386a9… is a CANDIDATE; Codex seals over KB MCP bytes at the sealed revision.
  • (e) Honest structural limit: a packet cannot fully self-defend against an attacker who rewrites the VERIFIER code itself (manifest_tool/RERUN/suites) — those bytes are hash-pinned and KB-published precisely so that Codex's independent fresh-fetch rerun (this review) is the backstop that detects tool mutation. What V3 guarantees is that a fail-open SUT can no longer pass while the packet tools are intact, and that the packet's own publishing commands refuse to launder it.

6. KB packet root (fresh-fetch list) and reconstruction

Packet root: knowledge/dev/laws/tool-kiem-thu/packets/fix7-codex-recheck-9-2026-06-10/ holding 23 files: README_FOR_CODEX.md, RERUN.sh, HASH_MANIFEST.txt, manifest.json, manifest_tool.py, adversarial_suite.py, kb_fetch_reconstruct.py, blackbox_negative_suite.py, failopen_regression.py, evidence/canonicalizer-fix7-canon-v1-ssot.md, evidence/canonicalizer-fix7-canon-v1-ssot.py, evidence/fix7_canon_v1_ssot_extended.py, evidence/materialize_canonicalizer.py, evidence/selftest-expected-output.txt, evidence/produce-expected-output.txt, logs/materialized-selftest.log, logs/extended-selftest.log, logs/produce.log, logs/forbidden-scope.log, logs/manifest-verify.log, logs/adversarial-suite.log, logs/blackbox-negative-suite.log, logs/failopen-regression.log.

The 10 docs/ members are fetched from their CANONICAL blueprint ids (NOT duplicated under the packet root — one authority surface): knowledge/dev/reports/architecture/t1-fix7-existing-system-refactor-execution-blueprint-2026-06-08/ + 00-readme-first.md, 01-live-existing-system-inventory.md, 02-design-to-live-mapping.md, 03-gap-classification.md, 04-dependency-safe-construction-order.md, 05-rollback-blueprint.md, 06-test-guard-blueprint.md, 07-implementation-package-split.md, 08-hard-blocks-do-not-touch-list.md, 12-final-verdict.md.

Reconstruction (either way):

  1. MCP_URL=… MCP_KEY=… python3 kb_fetch_reconstruct.py <outdir> — fetches all 33 documents (23 root + 10 docs), writes bytes verbatim, prints per-file sha256, verifies the tree against HASH_MANIFEST bidirectionally, fails closed; then cd <outdir> && bash RERUN.sh.
  2. Manually: fetch each id with FULL (untruncated) content via the governed MCP, write the content as UTF-8 bytes to the same relative path (docs into docs/), then bash RERUN.sh.

The V3 packet tree hash (relpath\0bytes\0 over the 32 tracked files; HASH_MANIFEST excluded) is recorded in the V3 handoff checkpoint OUTSIDE the packet tree (knowledge/dev/laws/tool-kiem-thu/checkpoints/fix7-codex-recheck-9-rerun-packet-v3-handoff-2026-06-10.md) — embedding it here would be circular, since this README is itself a tracked file. If any live blueprint doc has changed since pinning, HASH_MANIFEST/--complete/--verify fail closed — correct behavior (the seal candidate is corpus-bound).

7. Remaining blockers before a seal (authority, not engineering)

  1. N7 envelope_manifest — needs sealed sub-digests + approval-event fields (Codex/owner).
  2. N8 detached_seal — Codex-authored.
  3. P7 — Codex re-seal of the artifact whose load-bearing fence changed (P-EXT-2 / SSOT rev3 candidate 49c386a9…).
  4. Owner's standing do-not-approve.
  5. R9-B5 residual (tooling): no governed server-side byte-export/digest endpoint; the byte proof is MCP-fetch-level. If Codex requires a server-computed digest, that endpoint must be built first (action-ready blocker; NOT claimed sealed here).

Verdict

FIX7_RECHECK9_PACKET_V3_BLACKBOX_CLI_ORACLE_SELF_CODEX_HARDENED — the Codex V2 oracle-laundering attack is reproduced, closed, and converted into live packet gates: every negative CLI case is EXECUTED (OS-process and runpy levels) against a static spec oracle; --emit refuses to launder a fail-open SUT; the packet is KB-native and fresh-fetch reconstructible. Remaining gates are Codex/owner authority plus the named R9-B5 tooling residual.

Back to Knowledge Hub knowledge/dev/laws/tool-kiem-thu/packets/fix7-codex-recheck-9-2026-06-10/README_FOR_CODEX.md