FIX7 Recheck-9 V3 — Fail-Open Regression Report

• Date: 2026-06-10 · Verdict: PASS — the Codex V2 fail-open mutation is caught at every gate, before any PASS
• Tool: failopen_regression.py (packet root, scan-scoped, sha256 982bdb29…f0ee5c); runs LIVE in canonical RERUN.sh gate 8; raw log logs/failopen-regression.log (+ rerun-out/failopen-regression.log each rerun).

1. In-packet executable regression (OS-temp copy; canonical packet never mutated)

check	what it does	expected	OBSERVED
M1	apply the exact Codex mutation sys.exit(4)→sys.exit(0) in SSOT fence + materialized .py + extended .py (exactly 1 site each, asserted)	applies	applied
M2	prove the mutation took: REAL missing-doc CLI on the mutated copy	exit 0 (genuinely fail-open)	exit 0 observed, corpus_ok: False in stdout
M3	laundering attempt: regenerate expected outputs with the mutated SUT, then REAL manifest_tool.py --emit CLI	exit ≠ 0 with ORACLE_VIOLATION	exit 1, ORACLE_VIOLATION in output; manifest NOT written
M4	REAL manifest_tool.py --verify CLI on the mutated copy	exit ≠ 0	exit 1
M5	the copy's own blackbox_negative_suite.py (REAL CLI)	exit ≠ 0	exit 1, BLACKBOX_NEGATIVE_SUITE: FAIL
M6	canonical packet unchanged	tree hash before == after	identical

Result line: FAILOPEN_REGRESSION: PASS (6/6 — a fail-open CLI mutation must be caught by emit, verify, and the black-box suite before any PASS).

2. Full-packet replay on V3 final bytes (work dir /private/tmp/r9-repro/v3-failopen)

The complete Codex V2 sequence including HASH relaundering was replayed against the published V3 packet:

step	command	OBSERVED
mutate 3 SUT files + regenerate both expected outputs with mutated CLI	—	done (mutation verified by step 5)
python3 manifest_tool.py --emit	exit 1 (V3_BYPASS_EMIT_EXIT=1), ORACLE_VIOLATION … cli_exit_observed: 0, cli_exit_expected: 4 — raw log /private/tmp/r9-repro/v3-failopen-emit.log	laundering blocked
python3 manifest_tool.py --emit-hash-manifest	exit 0	by design: HASH proves transport bytes, never behavior; behavior gates below still fire
bash RERUN.sh	exit 1 (V3_BYPASS_RERUN_EXIT=1); aborts at gate 6: NEGATIVE CLI CASE 'missing': OBSERVED exit 0 != 4 (oracle) — FAIL-OPEN + RERUN_RESULT: FAIL (black-box negative CLI gate); NO PASS line printed — raw log /private/tmp/r9-repro/v3-failopen-rerun.log	fails before any PASS
python3 adversarial_suite.py	exit 1 (fails closed on the mutated SSOT) — raw log /private/tmp/r9-repro/v3-failopen-adversarial.log	suite rejects
REAL missing-doc CLI	exit 0 (V3_BYPASS_MISSING_DOC_CLI_EXIT=0) — raw log /private/tmp/r9-repro/v3-failopen-missing-doc-cli.log	mutation genuinely fail-open; detected by all gates above

3. Contrast (the acceptance core)

gate	V2 (Codex finding, reproduced first-hand)	V3
--emit after mutation+regen	exit 0 — broken behavior laundered into a fresh manifest	exit 1 ORACLE_VIOLATION
full RERUN on self-regenerated fail-open packet	exit 0, PASS, adversarial 22/22	exit 1, FAIL at gate 6, no PASS
missing-doc actual CLI	exit 0, invisible to every gate	exit 0, CAUGHT by gates 6/7/8/11 + emit/verify