13 — GPT / MCP-Readable Checkpoint

STATUS: STAGE2_6A_FIX2_POLICY_COMPLETE_FAIL_CLOSED_SIGNOFF_EXACT_AUTHORITY_LOCKED_READY_FOR_CODEX_REAUDIT. VERDICT: PARTIAL (current-layer gates fail-closed; PUBLIC EXECUTE revoke + Directus role separation + scale keyset deferred to 2.6B, each with a live no-go guard). LIVE MUTATION: YES (additive, reversible, birth-neutral). APPLY: NONE. PERMIT: NONE.

CODEX BLOCKERS: 13/13 reproduced; 10 FIXED, 3 ROUTED/CONTAINED-2.6B; 0 OPEN. Guard views: v_qt001_26a_fix2_codex_blocker_matrix, v_qt001_26a_fix2_must_not_proceed_guard (pass=true).

KEY GUARDS (live): rule_engine_fail_closed pass=true (11/11). parity_not_authority pass=true (grant=0 block=2 delegates_v2). plan_fingerprint_guard pass=true (scope 74=74, all components sensitive). exact_signoff_binding_guard pass=true (logic_exact, 13 candidates unsigned, current_apply_signoff_safe=false). hardcode_guard_v3 pass=true (unclassified 0, dangerous_authority_open 0, status PASS_WITH_ROUTED_2_6B). disguised_hardcode_detector all 9 passed. writer_authority_lockdown_status enforced_in_body=true. writer_lockdown_no_go_guard pass=true (writer_cannot_execute). scale_not_safe_guard_v2 scale_not_safe=true. readiness_guard_v5 overall_ready=false (SSOT 7/7, APPLY 0/5).

PLAN: PLAN-9bac30375765 version 3, 74 rows, composite 9bac30375765c1162d216b2b70a81ef5, tier_source RULE_ENGINE_V2. TIERS: TIER1=0 TIER2=7 TIER3=6 TIER_INELIGIBLE=55 TIER_BLOCKED=6.

SAFETY: birth_registry 1,210,989 before==after; qt001-origin 0; tga 129; apr 42; gateway all_ok=true (c022f849); open exec permits 0; done ledgers 0; Stage-0 freeze enforced. No trigger/gateway-body/old-DOT/REALRUN/event/UI/owner/vote change.

OBJECTS ADDED: table qt001_tier_rule_registry_v2 (11 governed rules); functions fn_qt001_eval_predicate_v2, fn_qt001_eval_rule_core, fn_qt001_eval_rule_v2, fn_qt001_machine_tier_v2, fn_qt001_collection_signals_v2, fn_qt001_signoff_row_valid, fn_qt001_signoff_satisfies, fn_qt001_plan_fingerprint_v2, fn_qt001_fp_compose; CREATE OR REPLACE fn_qt001_machine_tier (delegates v2), fn_qt001_build_plan_registry (full scope + fingerprint), fn_dot_birth_qt001_apply (governance lockdown). 20 new v_qt001_* views. Inventory: HC-05 superseded; HC-14..21 added.

SQL: /opt/incomex/docs/mcp-writes/birth-stage2-6a-fix2-2026-06-06/ (01a, 01b, 90_verify, 99_rollback). REPORT: knowledge/dev/reports/architecture/birth-stage2-6a-fix2-qt001-policy-complete-plan-failclosed-signoff-authority-lockdown-2026-06-06/00..13. INDEX: BIRTH_GATEWAY_DESIGN_INDEX.md rev16.

NEXT: BIRTH_STAGE2_6B_QT001_PERMIT_RUN_KEYSET_RESUME_AND_AUTHORITY_REVOKE, then fresh independent Codex re-audit BEFORE any permit or apply. EXACT BLOCKER: independent re-audit + 2.6B layers + owner permit; zero engineering blocker.