Checkpoint — Codex Birth-First Side-Door Compatibility Audit

Date: 2026-06-06
Status: PARTIAL — concrete risk map complete; read-only audit; no fixes applied

Executive Finding

The live P0/P1 authority and birth containment patches did not directly break legitimate birth runtime. The deeper risk is operational SSOT drift:

• active dot-birth-trigger-setup can overwrite the guarded birth gateway with old logic lacking BIRTH_EXEMPT;
• active QT-001 backfill is incompatible with 22/36 governed collections and can partially execute;
• QT-003/QT-003R/QT-005 remain soft/detect-only;
• QT-006 generic death lifecycle is absent.

Evidence

READ ONLY: transaction_read_only=on
birth_registry=1,210,814; all status=born
managed_object_count=2,929; raw noise=98.97%
QT-001: governed=36, script-compatible=14, incompatible=22
trigger policy: exempt+trigger=29, deferred+trigger=50, required-no-trigger=5
open collection_onboarding_gap=345
v_birth_orphan=59; v_birth_phantom=289
authority guards: P0 3/3 PASS; P1 8/8 PASS

Three Declarations

• Vĩnh viễn: FAIL today because active DOT source can restore old unsafe logic.
• Nhầm: FAIL today because running an active DOT can reopen the hole and soft registration can pass incomplete.
• 100% tự động: FAIL today because backfill/reconciliation/death are not closed-loop.

Required Next Macro

BIRTH_GATEWAY_SSOT_AND_QT001_METADATA_BACKFILL_P0_CLOSURE

No production execution should run dot-birth-trigger-setup or dot-birth-backfill until that macro passes source-parity/preflight review.

Canonical Report

knowledge/dev/reports/architecture/codex-birth-first-side-door-compatibility-audit-2026-06-06/