Checkpoint — T1 FIX7 Design Deep Verification Before Implementation

Date: 2026-06-08. Verifier: T1 (production Agent for Agent Data). Execution mode: READ-ONLY design verification (Design-Only Macro Mode). Live mutation: NONE except this checkpoint + the 15 report docs 00–14. No DB object created (report-only; v_fix7_design_review_scope_summary deliberately NOT created — DDL forbidden in design-only mode).

FINAL STATUS: DESIGN_BLOCKED_REQUIRES_CODEX_UPDATE

T1 must not implement FIX7a. The corrected FIX7 design exists in the KB only as ~6 KB of high-level property assertions; the per-dimension review docs the verdict rests on (final-review 01–09) were never authored (confirmed not_found in agent-data KB and Incomex KB; design index confirms the precedent). No concrete specification (manifest DDL, gate denominator, quorum N, hash component list, control-epoch lock mechanism, analyzer trust model, capability measurements, operator steps, rollback) exists. Implementing now = "fix by assuming" → forbidden. The architecture direction is sound; the package is not implementation-ready.

Per-supertrack verdicts

• A Design completeness: INCOMPLETE — 9 review docs missing; ≥8 undefined governance-critical decisions.
• B Zero-hardcode: NOT DEMONSTRABLE — 0 FAIL, 1 PASS, 7 INTENT-OK, 5 NEEDS_CLARIFICATION (no hardcode observed; can't be confirmed clean).
• C PG-first/native/driven: INTENT-PASS / LIVE-FAIL (Directus still owns control plane) / spec-unproven.
• D Control-plane immutability: INTENT-PASS / LIVE-FAIL — Directus owns all 4 control tables; INSERT+DELETE on signoff, INSERT on cap evidence proven live; qt001_cp_owner absent.
• E Readiness exact-set: no mutable-denominator in intent; live mutable path exists (Directus DELETE); FIX7 denominator unspecified.
• F Signoff/evidence: not spoofable in intent; live app-spoofable; schema unspecified; expiry/supersede/revoke silent.
• G Capability: no fake proof in intent; self-attestable live; behavioral/measurement schema unspecified.
• H Hash: SHA-256 + plan-vs-control-state separation good; extension/primitive availability unaddressed; canonicalization unspecified.
• I Dependency/callgraph: PASS on I.1 (correctly does NOT pretend pg_depend sees body calls; func_to_func=0); analyzer seal/staleness binding unspecified.
• J TOCTOU/control_epoch: correct primitive (shared/exclusive hash-bound epoch); lock object + pre-commit predicate + evidence epoch-binding unspecified.
• K Level-B pipeline: author-vs-activate boundary PASS; pipeline not shown to exist as artifact; rollback/approval/proof unspecified.
• L T1 boundary: clear and usable post-correction; T1 implements nothing until Codex publishes concrete spec.
• M Risk register: 12 risks, 0 closed; CRITICAL = R2 (Directus mutates control plane, live) + R12 (missing design/evidence docs, root cause).
• N Go/No-Go: DESIGN_BLOCKED_REQUIRES_CODEX_UPDATE; 9 corrections enumerated in doc 14.

Live read-only evidence (directus DB, no mutation)

• qt001_cp_owner role: absent. Owner of qt001_plan_registry / tier_rule_registry_v2 / independent_review_signoff / capability_operational_evidence: directus.
• has_table_privilege(directus, independent_review_signoff, INSERT)=true, DELETE=true; INSERT on capability_operational_evidence=true.
• Row counts: signoff_plan_binding=0, capability_operational_evidence=0, independent_review_signoff=2 → readiness BLOCKED, scale NOT_SAFE, no false-green today.

Top design corrections required (Codex)

1 concrete manifest/engine spec; 2 readiness denominator spec (+ Directus-no-write gate); 3 signoff schema + expiry/supersede/revoke; 4 capability measurement spec; 5 hash primitive + extension staging; 6 analyzer seal + source-hash staleness binding; 7 TOCTOU concurrency spec; 8 Level-B pipeline + rollback + approval; 9 operator cutover runbook. (Detail in doc 14.)

Unchanged hard blocks

No Stage 2.6B. No permit. No REAL_RUN. No QT001 apply. Readiness BLOCKED until owner cutover + fresh evidence + fresh independent Codex re-audit.

Artifacts

Report dir: knowledge/dev/reports/architecture/t1-fix7-design-deep-verification-before-implementation-2026-06-07/00..14. Checkpoint: this file. Next: route corrections 1–9 to Codex; on a corrected package, re-run this deep verification before any FIX7a authoring.