FIX7 Final Authority-Seal — Report-Set Validation Report (FINAL-AS-REPORT-SET)

• Date: 2026-06-11 · Host: T1 · Codex: NO · Prod mutation: NO

1. Mechanism (report_documents_digest(report_pairs), tag FIX7_CODEX_SEAL_REPORTS_V1)

Before any hashing, the function validates the whole set:

• empty set → SEAL_REPORT_SET_EMPTY
• each record must be a (document_id, revision) 2-tuple, else SEAL_REPORT_DOC_ID_INVALID
• document_id must match the path grammar (non-empty), else SEAL_REPORT_DOC_ID_INVALID
• revision must match the posint grammar, else SEAL_REPORT_REVISION_INVALID
• duplicate (doc,rev) record → SEAL_REPORT_SET_DUPLICATE
• duplicate document_id (even with different revisions) → SEAL_REPORT_SET_DUPLICATE
• validated records are then deterministically sorted (sorted(rec(doc,rev))) before digest, so input order does not change the digest but invalidity always fails closed.

2. Evidence

selftest report-set negatives (5) + determinism positive: []→EMPTY; [(a,1),(a,1)]→DUPLICATE (record); [(a,1),(a,2)]→DUPLICATE (doc-id); [("",1)]→DOC_ID_INVALID; [(a,"x")]→REVISION_INVALID; [(a,1),(b,2)] == [(b,2),(a,1)] (order-independent). Codex probes CP7/CP8/CP15/CP16. Red-team A27/A28/A36/A37/A38.

3. Pin preservation

The single fixture report record (codex-…/00-readme-first.md, "1") is valid (path + posint, unique), so the N8 fixture's report_documents_digest (44f50f83…a9cc) and hence the N8 digest b1f001b6… are unchanged. Confirmed by drift fixture-digest N8 check.

Verdict: FINAL-AS-REPORT-SET CLOSED.