Checkpoint - T1 FIX7 Blueprint Patch After Codex Recheck 6 (Byte-Exact Envelope)

Date: 2026-06-09 Mode: READ-ONLY production; blueprint KB-document direct-revision only; NO production mutation. Macro: PROGRAM_PATCH_T1_FIX7_BLUEPRINT_AFTER_CODEX_RECHECK_6_BYTE_EXACT_CANONICALIZATION_AND_ACYCLIC_SEAL_GRAPH

Final status

FIX7_REFACTOR_BLUEPRINT_T1_PATCHED_AFTER_CODEX_RECHECK_6_READY_FOR_CODEX_RECHECK_7

What happened

Codex recheck 6 accepted the recheck-5 direction (full-path membership f2bda8…fe251, doc-00 self-reference resolution, blueprint-checkpoint NON_AUTHORITY classification, invariants/boundary, PG-first + typed-set separation) but did not seal — four blockers in the construction-document authority layer. T1 patched all four in-blueprint; no runtime design amendment; nothing accepted reopened.

blocker	fix	guard
A canonical encoding not byte-exact	REJECT-not-escape field policy (whitelist grammar + forbidden bytes TAB/LF/CR/NUL/backslash + forbidden reserved tokens + no-null/no-empty)	G-CANONICAL-FIELD-REJECT
B no exact extractor / prose scope	one deterministic active-scope/fence/section extractor (normalize-first, 1-based, exact markers, single DOC_STATUS, flat non-nesting, fail-closed statuses) + closed envelope key-classification schema	G-ACTIVE-SCOPE-EXTRACTOR
C record-encoding ambiguity	closed per-record encoding schema (domain tag + fixed fields + grammar + sort + no-null/no-empty + full-path); superseded fences → byte-exact L-ranges	G-RECORD-ENCODING-CLOSED
D/E detached-seal self-reference cycle	acyclic seal hash graph N1..N9 (manifest binds no checkpoint hash; seal never hashes its checkpoint; seal_report_checkpoint_content_sha256 → diagnostic _excluding_seal); checkpoint anchored out-of-band by platform revision + MCP read-back + Codex authorship (limitation stated)	G-SEAL-HASH-GRAPH-ACYCLIC

Guards 54 → 58; guard-quality rule 11 added. Invariants 27/11/14/7 preserved (no runtime surface/gate/#20-col/catalog-family/8th runtime hash contract; H01..H07 stay 7). Seal event → recheck 7; SEAL_AT_CODEX_RECHECK_6 → _7; parent_recheck_checkpoint_id → recheck-6 checkpoint.

Self-review

Codex-style adversarial self-review 15/15 PASS, hash/extractor/DAG cases computed in python (hashlib == shasum): reference FIX7-CANON-V1 encoder reproduces f2bda8…fe251; TAB/LF/CR/NUL/backslash

• reserved tokens rejected; marker missing/duplicate, fence unbalanced/nested, overlap, section id/range, exclude unbalanced fail closed; record reorder → sort stable, field reorder → differs; null≠empty rejected; the two old cyclic edges (manifest→checkpoint, seal→own-checkpoint) detected as cycles; new graph topologically sorts. (Report doc 08.)

Blueprint docs patched (read-back verified)

• 00-readme-first: rev 18 → 31
• 06-test-guard-blueprint: rev 58 → 64 (58 guard rows verified)
• 07-implementation-package-split: rev 47 → 51
• 12-final-verdict: rev 43 → 54

Output

• Report: t1-fix7-blueprint-patch-after-codex-recheck-6-byte-exact-envelope-2026-06-09/00..12 (13 docs).
• This checkpoint + the updated blueprint checkpoint (checkpoint-t1-fix7-existing-system-refactor-execution-blueprint-2026-06-08.md).

Boundaries

Implementation, Stage 2.6B, qt001_backfill_permit, REAL_RUN, QT001 apply, manifest activation, repoint, owner/ACL cutover all remain BLOCKED. Production was READ-ONLY throughout. Next: Codex recheck 7 only (seals the canonical envelope + writes the Codex detached seal). Do not claim implementation approval.