FIX7 Authority-Seal — AS-P1..AS-P4 Closure Ledger

• Date: 2026-06-10 · Host: T1 · Codex consulted: NO · Production mutation: NO
• Each Codex blocker mapped to its exact executable repair + the selftest line that proves it.

AS-P1 — N7 deterministic executable encoder — CLOSED

• Codex evidence: canonicalizer rev3 emits only REHEARSAL_ONLY_NEEDS_SEALED_INPUTS (N7); no N7 function/roster/order/vector.
• Repair: authority_seal_encoder.py encode_node("N7", pairs).
  • domain tag FIX7_ACTIVE_AUTHORITY_ENVELOPE_MANIFEST_V1
  • fixed 13-field roster (spec §3), order = encoding, NOT sorted
  • included: membership(N1)/N2/N3/N4/N5/N6 + A1/A2/A3/A5 + 2 const
  • excluded (cycle guard): detached_seal_sha256, authority_seal_pin_sha256, self
  • encoding: rec/digest byte-identical to canonicalizer
• Proof lines: N7 encodes to 64-hex PASS · N7 deterministic PASS · missing/extra/order/tag/byte negatives PASS.

AS-P2 — Acyclic authority DAG and sequence — CLOSED

• Codex evidence: A4 made N7 bind N8/P7 while DAG has N8→N7 ⇒ SEAL_HASH_GRAPH_CYCLE.
• Repair: deleted A4 wording (n7 §6.1); enacted EDGES with engineering edges verbatim + P7: N7→N2,N3,N4,N5,N6,N1 · N8→N2,N5,N6,N7 · P7→N2,N7,N8. Acyclic order N7 → N8 → P7. N7 never binds N8/P7; N8 never binds P7.
• Proof lines: DAG acyclic (N7,N8,P7) PASS · injected N7->N8 edge detected as cycle PASS · N7 binds N8 -> SEAL_HASH_GRAPH_CYCLE PASS · N7 binds P7 -> SEAL_HASH_GRAPH_CYCLE PASS · N8 binds P7 -> SEAL_HASH_GRAPH_CYCLE PASS.

AS-P3 — N8 executable detached-seal contract — CLOSED

• Codex evidence: N8 prose-only; no roster/order/encoding/signer representation/vector.
• Repair: encode_node("N8", pairs).
  • domain tag FIX7_CODEX_DETACHED_SEAL_V1
  • fixed 11-field roster (spec §4): N2/N5/N6 + N7 + sealed_by/sealed_at/parent_checkpoint/report_documents_digest + const
  • signer identity = sealed_by; parent = parent_checkpoint (id@rev); reports = sub-digest tag FIX7_CODEX_SEAL_REPORTS_V1
  • depends on N7 (missing → fail); excludes P7 (cycle guard)
• Proof lines: N8 encodes (binds N7) to 64-hex PASS · N8 deterministic PASS · N8 missing N7 -> SEAL_INPUT_MISSING PASS · wrong dependency (N3 into N8) -> SEAL_INPUT_EXTRA PASS.

AS-P4 — P7 executable seal artifact schema/encoding — CLOSED

• Codex evidence: P7 candidate verified but no exact seal artifact schema/encoding; prose-only prohibited.
• Repair: seal_p7(pairs).
  • domain tag FIX7_AUTHORITY_SEAL_PIN_V1; output authority_seal_pin_sha256
  • fixed 13-field roster (spec §5): pins canonicalizer doc/rev/bytes/hash + Packet V3 tree + codex report/checkpoint + N7 + N8 + A1 + const
  • nature: digest over a seal document (primary); alt enacted rule = checkpoint id@rev + content sha256 (also byte-exact)
  • prose-only pin rejected SEAL_PROSE_ONLY_PIN_REJECTED
• Proof lines: P7 seals (binds N7,N8) to 64-hex PASS · P7 prose-only -> SEAL_PROSE_ONLY_PIN_REJECTED PASS · mutated canonicalizer hash -> P7 verify FAIL PASS · mutated Packet V3 tree -> P7 verify FAIL PASS.

AS-P5 — positive + negative vectors — CLOSED

All 11 macro-required vectors present and passing (see fix7-authority-seal-test-vectors-report-2026-06-10.md); selftest 22/22 exit 0.

AS-P6 — authority closure packet patched — CLOSED

n7 md/json rev2, n8 md rev2, p7 md rev2, encoder + spec md/json created. owner-decision-packet + precondition checklist reviewed — no cycle/overclaim, unchanged. Ledger + current-state updated.

AS-P7 — self-Codex dry-run — CLOSED

See fix7-authority-seal-self-codex-dry-run-report-2026-06-10.md: N7 computable from finite fields YES; N8 after N7 YES; P7 pinnable under exact schema YES; cycle NO; negatives fail YES; ambiguity NONE.

Summary

AS-P1..AS-P7 = CLOSED by T1. Remaining = owner/Codex authority inputs only (N7-INPUTS, N8-AUTH, P7-PIN, OWN-1, IMPL-OWNER). Status FIX7_AUTHORITY_SEAL_CONTRACT_SELF_CODEX_READY.