FIX7 Authority-Seal — Fresh KB Reconstruction Report (Workstream A)

• Date: 2026-06-10 · Host: T1 · Codex consulted: NO · Production mutation: NO
• Goal: prove the authority-seal closure packet can be rebuilt from governed KB bytes into a fresh working directory — no reliance on any prior local working copy — and that the pinned identities match exactly.

1. Method

1. Fetched each artifact from governed KB via batch_read(full=true) — NOT from any /private/tmp/fix7-canon/* prior local copy.
2. Wrote the bytes into a fresh directory /private/tmp/fix7-dress/recon/ (created this lane).
3. Recomputed shasum -a 256 and byte counts; compared to the pinned values.
4. Re-ran the encoder selftest from the reconstructed file.

2. Live-read / reconstruction matrix

File	KB content_length	Reconstructed sha256	Expected pin	Byte-exact?	Role	Executable?
authority_seal_encoder.py	19131	47200442f176b1c534f000c4079632f6388b17dd1763bdbac2cbb725a452b5bb	47200442…a452b5bb	YES	N7/N8/P7 encoder	YES (selftest)
authority-seal-encoder-spec.json	4928	f1c499270923c65c56783196b411ad6cacfe1188be0c531fabdd05a7795ef5eb	f1c49927…95ef5eb	YES	machine spec / drift oracle	parsed
authority-seal-encoder-spec.md	8870	reconstructed	(not separately pinned)	content-faithful	human spec	parsed by drift checker
n7-approval-event-input-envelope.json	4063	reconstructed	(not separately pinned)	content-faithful	N7 machine roster	parsed by drift checker
n8-detached-seal-request.md	3215	reconstructed	(not separately pinned)	content-faithful	N8 request	parsed by drift checker
p7-codex-reseal-request.md	3955	reconstructed	(not separately pinned)	content-faithful	P7 request	parsed by drift checker
fix7-implementation-precondition-checklist.md	2282	reconstructed	(not separately pinned)	content-faithful	production-gate guard input	parsed by red-team A18

The two load-bearing pinned artifacts (encoder + spec.json) reproduced byte-exact against their recorded SHA-256 and byte counts. The remaining docs are not independently hash-pinned in the prior reports; they were reconstructed faithfully from KB full content and are validated structurally by the drift checker (their rosters/tags must equal the encoder's — they do, 22/22).

3. Commands + results (verbatim)

$ shasum -a 256 authority_seal_encoder.py
47200442f176b1c534f000c4079632f6388b17dd1763bdbac2cbb725a452b5bb  authority_seal_encoder.py
$ wc -c authority_seal_encoder.py
   19131 authority_seal_encoder.py
$ shasum -a 256 authority-seal-encoder-spec.json
f1c499270923c65c56783196b411ad6cacfe1188be0c531fabdd05a7795ef5eb
$ wc -c authority-seal-encoder-spec.json
    4928
$ python3 authority_seal_encoder.py --selftest
AUTHORITY-SEAL-ENCODER SELFTEST: 22/22 PASS   (exit 0)

4. Verdict

RECONSTRUCTION: OK. The encoder and machine spec are reproducible from governed KB to the byte; the encoder runs from the reconstructed packet (selftest 22/22 exit 0). No local-only file is required. The fresh-reconstruction packet tree over the full evidence set is 9f40519aa390497869850a12a82e73b2d3dd17ec53b5356b9c4fa1a243fb7314 (22 files).

5. Residual

• The five non-pinned docs have no independent hash pin in the corpus; structural drift-equality is the guarantee. Optional hardening: pin their SHA-256 in the governance record (non-blocking; the load-bearing encoder/spec are pinned).