FIX7 Final Authority-Seal — Governed KB Evidence Packet Report (FINAL-AS-KB-PACKET)

• Date: 2026-06-11 · Host: T1 · Codex: NO · Prod mutation: NO

1. The 404 → present closure

Codex's fresh reconstruction returned 404 for 7 required governed files (prose-only embedding was not a substitute). All 7 are now uploaded and re-fetched present (each content_length > 0):

File	KB path (under …/fix7-authority-closure-2026-06-10/)	re-fetch content_length
commands.sh	rehearsal/commands.sh	3642
HASH_MANIFEST.txt	rehearsal/HASH_MANIFEST.txt	1943
packet_tree.sha256	rehearsal/packet_tree.sha256	65
rehearsal-summary.json	rehearsal/rehearsal-summary.json	1100
exit_codes.json	rehearsal/exit_codes.json	300
stdout.log	rehearsal/stdout.log	14463
stderr.log	rehearsal/stderr.log	460

Plus governed: codex_probes.py, regenerated fixture-inputs.json + n7/n8/p7-rehearsal-artifact.json + redteam-results.json.

2. Reconstruction model (honest)

HASH_MANIFEST.txt lists the SHA-256 of the byte-exact source files (encoder, spec.md/json, four harnesses, codex_probes, n7/n8/p7 docs, checklist, commands.sh) and the deterministic generated artifacts. packet_tree.sha256 = ac3f56f917f760760a71000b0c7a43c65cc40a5ceb0c468dd947dd6a579477dc is a single hash over the manifest.

Reproduction: fetch the source files from governed KB → run bash rehearsal/commands.sh → it regenerates the artifacts + logs + manifest + tree deterministically. The local run reproduced ac3f56f9… identically across two consecutive full runs. The encoder round-trip from KB was byte-verified (content_length=35135 == local; hash 13344f92…).

3. Manifest (source files, abridged)

13344f92…7144b8  authority_seal_encoder.py
6890d18f…7aec6   authority-seal-encoder-spec.json
b22260af…38c916  authority-seal-encoder-spec.md
e65392fd…d01fb3  authority_seal_redteam.py
6ed345ce…89e7a7  authority_seal_drift_check.py
9e985c41…94ab91  authority_seal_antihardcode.py
7d80b339…9b43174 authority_seal_rehearsal.py
112b4ec5…65a3d2  codex_probes.py
+ n7/n8/p7 docs, checklist, commands.sh, rehearsal/*.json

4. exit_codes.json

all_zero: true over [selftest, rehearsal, redteam, drift, antihardcode, codex_probes].

5. Honest caveat

KB-stored copies of the generated artifacts (rehearsal/*.json) are convenience snapshots; the authoritative bytes are produced by commands.sh from the source files. A full fresh KB-fetch-and-rerun is the Codex-side verification step (same model as prior packets: offline pinned source bytes, Codex re-fetches and re-runs). No KB storage blocker was encountered; raw .txt/.log/.sh files store and round-trip normally.

Verdict: FINAL-AS-KB-PACKET CLOSED — required governed files present; manifest + tree published and reproducible.