Checkpoint Codex FIX7 Control-Plane Immutability Design Plan

Date: 2026-06-07
Mode: READ-ONLY production; KB reports/checkpoint only.

Status: STAGE2_6A_FIX7_CONTROL_PLANE_IMMUTABLE_READINESS_SIGNOFF_CAPABILITY_HASH_READY_FOR_T1_IMPLEMENTATION

Root cause of FIX1-FIX6 loop: policy moved into PostgreSQL but remained owned/mutable by Directus; runtime rows defined their own denominator and evidence, so the constrained role could rewrite the constraint and false-green.

FIX7 design:

• NOLOGIN qt001_cp_owner owns authoritative objects; Directus read-only; PUBLIC writer EXECUTE revoked.
• sealed SHA-256 exact-set manifests for objects/readiness/capabilities/dependencies;
• controlled principal/evidence/signoff/verifier functions authenticate exact session_user;
• canonical PG16 JSONB SHA-256 domain-separated hashes;
• honest external static-analysis dependency manifest, with any unknown dependency blocking;
• acceptance cannot pass unless all_blocked=true, exact sets match, and real behavioral evidence exists.

T1 should implement FIX7a/b/c. Operator authority is required for role/owner/ACL/repoint actions. Codex should remain independent reviewer and must not live-apply this design.

Stage 2.6B, permits, REAL_RUN, and QT001 apply remain blocked.

Package: knowledge/dev/reports/architecture/codex-fix7-control-plane-immutability-design-plan-2026-06-07/