Checkpoint - T1 FIX7 Existing-System Refactor Execution Blueprint

<!-- DOC_STATUS: NON_AUTHORITY_INDEX (DERIVED_STATUS / REPORT_ONLY) (recheck-5 blocker D). This checkpoint is a derived status mirror of the blueprint; it is NOT an ACTIVE_AUTHORITY member, NOT a self-host, has no ENVELOPE:EXCLUDE region, and is consumed by NO guard or package as authority. Authoring authority is the SEALED ACTIVE_AUTHORITY_APPROVAL_ENVELOPE (doc 00 §Active-authority approval envelope) + the Codex detached seal only. The internal SUPERSEDED_NON_AUTHORITY fences remain as audit trail. Boundary registry: 00-readme-first.md §Active-authority boundary. -->

Date: 2026-06-08 Author: T1 (production Agent for Agent Data) Macro: FIX7_EXISTING_SYSTEM_REFACTOR_MAPPING_EXECUTION_BLUEPRINT_WITH_INTERNAL_XHIGH_MAX_REVIEW Mode: READ-ONLY production / AUTHOR_MODE_ONLY. No production DB/role/grant/trigger/function/ scheduler/UI mutation; no DB object creation; no live SQL; no manifest activation; no ownership/ACL change; no permit; no Stage 2.6B; no REAL_RUN; no QT001 apply; no Directus authority change; no source IU mutation; no Codex-doc edit. KB blueprint documents only.

Final status

FIX7_REFACTOR_BLUEPRINT_T1_PATCHED_AFTER_CODEX_RECHECK_7_READY_FOR_CODEX_RECHECK_8

(Latest gate: T1 recheck-4 approval-envelope patch pass (immutable content-addressed ACTIVE_AUTHORITY_APPROVAL_ENVELOPE; guards 47 -> 51) -> Codex RECHECK 5 accepted the envelope direction + guard rebinding + invariants/boundary but did NOT seal: the aggregate-hash canonicalization was incomplete, the manifest omitted authority fields, doc 00's full-doc hash was self-referential, the blueprint-checkpoint ACTIVE/self-host status was contradictory, and the Codex-checkpoint anchor was not immutable -> T1 recheck-5 canonical-envelope patch pass (2026-06-09, PROGRAM_PATCH_T1_FIX7_BLUEPRINT_AFTER_CODEX_RECHECK_5_CANONICAL_ENVELOPE_SEALING): defined the byte-exact Canonical hash encoding (FIX7-CANON-V1), the complete envelope-manifest authority-field roster, the Option-1 doc 00 self-reference resolution, the blueprint-checkpoint NON_AUTHORITY_INDEX classification, and the Codex detached seal anchor contract; guards 51 -> 54. -> Codex RECHECK 6 accepted the membership hash + doc-00 self-reference + checkpoint classification + invariants/boundary + PG-first/typed-set separation but did NOT seal (four byte-exact/acyclicity blockers) -> T1 recheck-6 byte-exact-canonicalization patch pass (2026-06-09, PROGRAM_PATCH_T1_FIX7_BLUEPRINT_AFTER_CODEX_RECHECK_6_BYTE_EXACT_CANONICALIZATION_AND_ACYCLIC_SEAL_GRAPH): REJECT-not-escape field policy + deterministic active-scope/fence/section extractor + closed record/key-classification schemas + acyclic seal hash graph (cyclic checkpoint-content binding removed; checkpoint anchored out-of-band by platform revision + MCP read-back); guards 54 -> 58. -> Codex RECHECK 7 accepted the deterministic extractor + the N1-N9 content-hash DAG + invariants but did NOT seal (five Constitution-Article-14 blockers: revision-layer self-reference, no single executable canonicalizer SSOT, duplicate canonical authority, document_id path aliases, loose marker contract) -> T1 recheck-7 Constitution-Article-14 SSOT patch pass (2026-06-09, PROGRAM_PATCH_T1_FIX7_BLUEPRINT_AFTER_CODEX_RECHECK_7_CONSTITUTION_14_EXECUTABLE_SSOT_AND_NON_SELF_REFERENTIAL_SEAL): authored the executable canonicalizer SSOT FIX7-CANON-V1-CANONICALIZER (--selftest exits 0, reproduces f2bda8...fe251), demoted all other canonical descriptions to NON_AUTHORITY_EXPLANATION, removed the checkpoint own-revision from load-bearing authority (revision diagnostic-only), tightened document_id to exact MCP id, and bound marker_kind<->marker_literal; guards 58 -> 63. Next = Codex recheck 8.)

Codex recheck-7 Constitution-Article-14 SSOT patch pass (2026-06-09) - executable SSOT + non-self-referential seal

Codex recheck 7 accepted the deterministic active extractor, the N1-N9 content-hash DAG (acyclic), the invariants/boundary, and no new runtime hardcode / PG-first regression, but held authoring-planning approval on five Constitution-Article-14 / NT14 defects. T1 patched all five in-blueprint; nothing accepted reopened. Governing principle made enforceable: a design is valid only if the implementation path cannot misinterpret it - one executable/checkable SSOT, no duplicate authority, no self-reference, no path alias, no marker ambiguity.

• A revision-layer self-reference -> the checkpoint own-revision anchor is REMOVED from load-bearing authority (a platform revision exists only after the write). Authority = detached_seal_sha256 content recompute + MCP read-back of existence; the recheck-N checkpoint's own revision is NON_AUTHORITY_DIAGNOSTIC. Finite ordered seal (stage -> Codex seals without own-revision -> platform assigns revision -> optional diagnostic); weaker-guarantee acceptance + separation-of-duties compensation stated. +G-NO-SELF-REVISION-ANCHOR.
• B no single executable canonicalizer SSOT -> authored FIX7-CANON-V1-CANONICALIZER (canonicalizer-fix7-canon-v1-ssot.md): python reference + --selftest (exit 0) + I/O contract + frozen test vectors (f2bda8...fe251) + closed failure-status set + AUTHORING_REQUIREMENT; pinned in the envelope by id/path/version (now) + revision/sha256 (sealed by Codex). +G-CANONICALIZER-SSOT-ONLY.
• C duplicate canonical authority (Article 14) -> doc 00 canonical/extractor/record sections + all report docs demoted to NON_AUTHORITY_EXPLANATION; exactly one load-bearing canonical contract; a second contract / divergent package canonicalizer / conflicting report fails closed. +G-NO-DUPLICATE-CANONICAL-AUTHORITY (= Codex G-CANONICAL-CONTRACT-SSOT-NO-DUPLICATE).
• D document_id path alias -> exact MCP canonical id byte-for-byte; reject ./../empty////leading or trailing slash/backslash/%-encoding/homoglyph slash; ASCII-only segments. +G-DOCUMENT-ID-CANONICAL-MCP.
• E marker contract -> closed kind enum + per-kind literal grammar; kind/literal mismatch, unknown kind, disallowed literal fail closed. +G-MARKER-KIND-LITERAL-CONSISTENCY.

Test/verification guards 58 -> 63; guard-quality rule 12 added. Invariants 27/11/14/7 preserved (the SSOT artifact is a pinned construction-document TOOL, NOT an active_corpus member - membership stays f2bda8...fe251 - and not a runtime surface/gate/#20-col/catalog-family/8th-hash-contract). All hard blocks intact. No fresh live read required. 🔴 Method change (the user's ask): T1 built the canonicalizer as real executable code and RAN it - python3 canonicalizer-fix7-canon-v1-ssot.py --selftest -> 22/22 PASS, exit 0, reproducing f2bda8...fe251 and every rejection status (TAB/null/empty; document_id ./..////empty/backslash/%-encoded/homoglyph/leading-slash/scope/case; marker unknown/inconsistent/ typo; seal self-revision/self-hash edge detected as a cycle). The 15 Article-14 adversarial scenarios are COMPUTED, not asserted (report doc 07). Blueprint docs patched: 00 (rev 31->49), 06 (rev 64->70; 63 guard rows), 07 (rev 51->55), 12 (rev 54->64) + the canonicalizer SSOT artifact + this checkpoint. Report: t1-fix7-blueprint-patch-after-codex-recheck-7-constitution14-ssot-2026-06-09/00..11; checkpoint checkpoint-t1-fix7-blueprint-patch-after-codex-recheck-7-constitution14-ssot-2026-06-09.md. Implementation / Stage 2.6B / qt001_backfill_permit / REAL_RUN / QT001 apply / activation / repoint / owner-ACL cutover all remain BLOCKED. Next = Codex recheck 8 (which seals the canonical envelope incl. canonicalizer_sha256 + writes the Codex detached seal).

Codex recheck-6 byte-exact-canonicalization patch pass (2026-06-09) - acyclic seal graph

Codex recheck 6 accepted the full-path membership hash (f2bda8…fe251, independently reproduced), the doc-00 self-reference resolution, the blueprint-checkpoint NON_AUTHORITY classification, the invariants/boundary, and PG-first/typed-set separation, but did NOT seal: four blockers in the construction-document authority layer. T1 patched all four in-blueprint (no runtime amendment; nothing accepted reopened).

• A canonical encoding not byte-exact -> FIX7-CANON-V1 Field rejection policy (REJECT, not escape): per-field whitelist grammar + forbidden bytes TAB/LF/CR/NUL/backslash + forbidden reserved tokens + no-null/no-empty; records provably injective. +G-CANONICAL-FIELD-REJECT.
• B no exact extractor / prose scope -> one deterministic active-scope/fence/section extractor (normalize CRLF/CR->LF first, 1-based lines, exact marker grammar, exactly one DOC_STATUS, flat non-nesting, re-emit line+LF) with fail-closed statuses for every ambiguity; section identity by marker structure (controlled tokens), never heading text; closed envelope key-classification schema (MANIFEST_BOUND / SEAL_LAYER_READBACK_PROTECTED / NON_AUTHORITY_DIAGNOSTIC / STRUCTURAL_CONTRACT_PROSE). +G-ACTIVE-SCOPE-EXTRACTOR.
• C record-encoding ambiguity -> closed per-record encoding schema for every record type (domain tag + fixed field list/order + grammar + sort key + no-null/no-empty + full-path); manifest is fixed-roster-order with key\tvalue scalars + sorted sub-records; fenced SUPERSEDED regions moved from prose into superseded_boundary_sha256 (superseded_id + L-range). +G-RECORD-ENCODING-CLOSED.
• D/E detached-seal self-reference cycle -> acyclic seal hash graph N1..N9: envelope_manifest_sha256 binds NO Codex-checkpoint revision/content hash and not the seal; detached_seal_sha256 excludes itself
  • signature and never hashes its own checkpoint; the removed seal_report_checkpoint_content_sha256 becomes the diagnostic codex_checkpoint_content_sha256_excluding_seal (consumed by nothing). Checkpoint anchored out-of-band by platform revision + MCP read-back + Codex authorship, with the stated limitation that a fully-privileged both-sides forger is not cryptographically prevented (separation of duties compensates). +G-SEAL-HASH-GRAPH-ACYCLIC; status SEAL_HASH_GRAPH_CYCLE.

Test/verification guards 54 -> 58; guard-quality rule 11 added. Invariants 27/11/14/7 preserved (0 new authority surface / readiness gate / top-level runtime hash contract / #20 column / catalog family; production mutation 0) - the canonical encoding + extractor + record/key schemas + seal hash graph are a non-runtime construction-document content-address (H01..H07 stay 7). All hard blocks intact. No fresh live read required. Codex-style adversarial self-review: 15/15 PASS, hash/extractor/DAG cases COMPUTED in python (hashlib == shasum; report doc 08) - membership reproduces f2bda8…fe251; TAB/LF/CR/NUL/ backslash + reserved tokens rejected; marker/fence/overlap/section ambiguities fail closed; record reorder -> sort stable; field reorder -> differs; null != empty rejected; the two old cyclic edges (manifest->checkpoint, seal->own-checkpoint) detected as cycles while the new graph topologically sorts. Blueprint docs patched: 00 (rev 18->31), 06 (rev 58->64; 58 guard rows), 07 (rev 47->51), 12 (rev 43->54)

• this checkpoint. Report: t1-fix7-blueprint-patch-after-codex-recheck-6-byte-exact-envelope-2026-06-09/00..12; checkpoint checkpoint-t1-fix7-blueprint-patch-after-codex-recheck-6-byte-exact-envelope-2026-06-09.md. Implementation / Stage 2.6B / qt001_backfill_permit / REAL_RUN / QT001 apply / activation / repoint / owner-ACL cutover all remain BLOCKED. Next = Codex recheck 7 (which seals the canonical envelope + writes the Codex detached seal).

Codex recheck-5 canonical-envelope patch pass (2026-06-09) - byte-exact seal + detached anchor

Codex recheck 5 accepted the envelope direction, the guard rebinding, and the invariants/boundary (INVARIANTS_BOUNDARY_FINAL_ACCEPTED), but did NOT seal: six canonical-encoding / seal / anchor defects. T1 patched all six in-blueprint (no runtime amendment; nothing accepted reopened).

• A canonical encoding -> doc 00 §Canonical hash encoding FIX7-CANON-V1: every aggregate digest defined byte-exactly (domain tag + record type + field order + sort key + TAB/LF separators + newline normalization + UTF-8 + null/boolean tokens + full-path normalization + revision representation + trailing-LF + reproducible shasum/hashlib command). No prose-only / unordered hash. active_corpus_membership_sha256 recomputed over full doc_ids = f2bda8effc7be19b54722828126b82d7d2d48bee5e5e5dc0c8f347ce210fe251 (shasum == hashlib). +G-CANONICAL-ENCODING-CONTRACT.
• B manifest completeness -> envelope_manifest_sha256 binds the complete authority-field roster (excluding only itself + detached_seal_sha256); unknown/missing field fails closed. +G-ENVELOPE-MANIFEST-AUTHORITY-COMPLETE.
• C doc 00 self-reference -> Option 1: full_document_sha256 is NON_AUTHORITY_DIAGNOSTIC for every member; load-bearing = normalized_active_content_sha256 excluding the ENVELOPE:EXCLUDE region; no full-doc-vs-exclude contradiction; the envelope is tamper-protected by the detached seal.
• D blueprint-checkpoint classification -> this checkpoint is NON_AUTHORITY_INDEX (DERIVED_STATUS / REPORT_ONLY): not a member, not a self-host, consumed by no guard/package. Sole self-host = doc 00.
• E Codex detached seal anchor -> a Codex-authored CODEX_DETACHED_SEAL block (seal_version, sealed_by/at, sealed manifest/corpus/membership hashes, parent checkpoint, report doc ids+revisions+hashes, signature or signature_not_available_in_current_tooling); compensating fail-closed rule = revision
  • SHA-256 + MCP read-back + mismatch guard. +G-CODEX-DETACHED-SEAL-ANCHOR.
• F fail-closed guards use canonical hashes -> G-ACTIVE-AUTHORITY-HASH-MATCH / -REVISION-MATCH / -CHANGE-FAIL-CLOSED / G-NO-SUPERSEDED-CONSUMPTION / G-LEGACY-NO-DISPOSITION-AUTHORITY re-bound to the FIX7-CANON-V1 digests + the detached seal; guard-quality rule 10.

Test/verification guards 51 -> 54 (+G-CANONICAL-ENCODING-CONTRACT, +G-ENVELOPE-MANIFEST-AUTHORITY-COMPLETE, +G-CODEX-DETACHED-SEAL-ANCHOR; guard-quality rule 10). Invariants 27/11/14/7 preserved (0 new authority surface / readiness gate / top-level runtime hash contract / #20 column / catalog family; production mutation 0) - the canonical envelope + detached seal are a non-runtime construction-document content-address, NOT an 8th runtime hash contract (H01..H07 stay 7). All hard blocks intact. No fresh live read required. Adversarial canonicalization self-audit: 12/12 PASS (report doc 08). Blueprint docs patched: 00 (rev 10->16), 06 (rev 49->58), 07 (rev 43->47), 12 (rev 36->43) + this checkpoint. Report: t1-fix7-blueprint-patch-after-codex-recheck-5-canonical-envelope-2026-06-09/00..12; checkpoint checkpoint-t1-fix7-blueprint-patch-after-codex-recheck-5-canonical-envelope-2026-06-09.md. Implementation / Stage 2.6B / qt001_backfill_permit / REAL_RUN / QT001 apply / activation / repoint / owner-ACL cutover all remain BLOCKED. Next = Codex recheck 6 (which seals the canonical envelope + writes the detached seal).

Codex recheck-4 approval-envelope patch pass (2026-06-09) - immutable content-addressed ACTIVE corpus

Codex recheck 4 accepted object-only legacy universe, principal + entry-vector separation, uniform-end-state scope, PG-native-final, and 27/11/14/7 + boundaries. Single remaining blocker: the ACTIVE_AUTHORITY corpus was classified only by mutable KB markers/registry/fences and not pinned to the exact Codex-reviewed revisions/content hashes (a mutable authoring-authority denominator / disguised hardcode). T1 patched it in-blueprint (no runtime amendment).

• Fix: added the ACTIVE_AUTHORITY_APPROVAL_ENVELOPE (doc 00 §Active-authority approval envelope): every ACTIVE doc/section + KB revision + normalized SHA-256, plus marker-fence / registry / guard-set / membership / manifest hashes + the Codex recheck checkpoint anchor; fail-closed on any drift (ACTIVE_AUTHORITY_ENVELOPE_MISMATCH → block authoring → fresh Codex recheck). Corpus-membership hash computed now (916d6e11027ff466ffd4f0ae0f66b15c314fb89601b70ecdb7261ce463c03b87); per-document body hashes seal at recheck-5 (a hash of the approved corpus can only be computed at the approval event; T1 pre-writing "approved" hashes would be self-fabricated authority).
• Guards 47 -> 51 (+G-ACTIVE-AUTHORITY-APPROVAL-ENVELOPE, +G-ACTIVE-AUTHORITY-HASH-MATCH, +G-ACTIVE-AUTHORITY-REVISION-MATCH, +G-ACTIVE-AUTHORITY-CHANGE-FAIL-CLOSED; +guard-quality rule 9; G-ACTIVE-AUTHORITY-SCOPE / G-NO-SUPERSEDED-CONSUMPTION / G-LEGACY-NO-DISPOSITION-AUTHORITY re-bound to the sealed envelope). PKG-A gated on a SEALED, verified envelope (doc 07).
• Invariants 27/11/14/7 preserved — the envelope is a non-runtime construction-document content-address (pins the docs being authored from), explicitly NOT a runtime surface / readiness gate / #20 column / catalog family / 8th top-level runtime hash contract (H01..H07 stay 7). All hard blocks intact. No fresh live read required.
• Ten-point adversarial self-audit PASS (report doc 06): mutate a marker, flip a fence, add a STUB term to active text, reference superseded from PKG-F/G, edit the registry only, edit a guard only, move a section range, edit history only, proceed after mismatch, rely on mutable Directus/marker state — each fails closed / blocks authoring as designed.

Blueprint docs patched: 00 (rev 6->10), 06 (rev 38->49), 07 (rev 40->43), 12 (rev 29->36) + this checkpoint. Report: t1-fix7-blueprint-patch-after-codex-recheck-4-active-authority-envelope-2026-06-09/00..10; checkpoint checkpoint-t1-fix7-blueprint-patch-after-codex-recheck-4-active-authority-envelope-2026-06-09.md. Implementation / Stage 2.6B / qt001_backfill_permit / REAL_RUN / QT001 apply / activation / repoint / owner-ACL cutover all remain BLOCKED. Next = Codex recheck 5 (which seals the envelope).

Option-Beta legacy-disposition amendment patch pass (2026-06-08) - disposition model REMOVED

Codex (design owner) approved Option Beta for blocker C. Option Beta REPLACES the disposition concept — it does not re-home it. T1 patched the blueprint to one uniform required end-state for every member of a closed, sealed U_legacy set: owner-isolated to the unreachable qt001_cp_owner, body/definition unchanged, effective privileges exactly equal the closed-world sealed #21 rows; relkind/prokind select PG syntax only; collisions fail closed.

• B1 remove disposition model -> 5-value enum / LEGACY_* #20 rows / computed classifier / truth table / CASE branch / external-artifact policy / STUB & body-restore / DO_NOT_TOUCH subtraction / relkind-prokind-name-owner-pattern-label policy all removed from load-bearing design; former labels survive only as non-authority English; +G-LEGACY-NO-DISPOSITION-AUTHORITY + rule 6.
• B2 redefine U_legacy -> closure(#11, roots=#20 protected_target rows); single sealed set; no DO_NOT_TOUCH subtraction; both-EXCEPT vs closed denominator; collisions fail closed; +G-U-LEGACY-OPTION-BETA-UNIFORM-ENDSTATE.
• B3 remove STUB/body path -> no body mutation/restore; rollback = forward-only supersede/deactivate
  • owner/ACL snapshot replay only; source artifacts evidence only.
• B4 owner isolation + #21 contract -> S15 owner-transfer → reconcile to exact #21 (both-EXCEPT) → verify; directus/runtime effective authority absent unless #21 grants read-only.
• B5 remove DO_NOT_TOUCH exclusion -> boundary/hard-block label only (birth gateway, DOTs); never subtracts; collision → fail closed.
• B6 hardcode/PG-native -> PASS (12/12); patch removes, not adds, disguised hardcode.
• B7 cross-layer -> unchanged; all live gates BLOCKED; §4G re-audit gates on PKG-F/PKG-G preserved.

Test/verification guards 40 → 42 (+G-U-LEGACY-OPTION-BETA-UNIFORM-ENDSTATE, +G-LEGACY-NO-DISPOSITION-AUTHORITY; G-LEGACY-TARGET-SEALED + G-LEGACY-TARGET-CLOSED-DENOMINATOR now fully operational, no disposition/LEGACY_*/subtraction dependency; G-LEGACY-FROZEN → G-LEGACY-RETAINED). Invariants 27/11/14/7 preserved (0 new authority surface, 0 new readiness gate, 0 new hash contract, 0 new #20 column, 0 new catalog family; production mutation 0). All hard blocks intact. Blueprint docs patched: 02 (rev 23→24), 03 (rev 3→4), 04 (rev 36→37), 05 (rev 22→23), 06 (rev 29→30), 07 (rev 35→36), 08 (rev 15→16), 12 (rev 14→18) + this checkpoint. Report: t1-fix7-blueprint-patch-after-legacy-disposition-option-beta-2026-06-08/00..10; checkpoint checkpoint-t1-fix7-blueprint-patch-after-legacy-disposition-option-beta-2026-06-08.md. Implementation / Stage 2.6B / qt001_backfill_permit / REAL_RUN / QT001 apply / activation / repoint / owner-ACL cutover all remain BLOCKED. Next = Codex recheck 3.

Codex recheck-3 set-separation patch pass (2026-06-09) - typed sets + active-authority boundary

Codex recheck 3 accepted the Option-Beta disposition/STUB/DO_NOT_TOUCH-subtraction removal and confirmed 27/11/14/7 + boundaries, but raised two narrow blockers; T1 patched both in-blueprint (no design amendment).

• Blocker 1 (mixed-type denominator): the single U_legacy was used for a denominator that unioned PG objects + principals + entry-vectors, then asserted object both-EXCEPT (type error). Split into three typed universes — U_legacy_object (PG objects only; the uniform-end-state object both-EXCEPT, doc 02 §H.4.A), U_effective_privilege_principal (roles only; the object × principal privilege-tuple join to sealed #21, §H.4.B), U_entry_vector (trigger/event-trigger/scheduler/DOT/ external; fail-closed bypass-coverage relation, §H.4.C). U_legacy ≡ U_legacy_object; no set is a member of another. +G-U-LEGACY-OBJECT-ONLY, +G-PRINCIPAL-SET-SEPARATE, +G-ENTRY-VECTOR-SEPARATE; G-LEGACY-TARGET-CLOSED-DENOMINATOR re-scoped object-shape; guard-quality rule 7. Docs 02/03/04/05/06/07/08/12.
• Blocker 2 (no-disposition guard scope): the guard scanned the whole blueprint while history retained old disposition/STUB terms. Introduced a machine-readable ACTIVE_AUTHORITY vs SUPERSEDED_NON_AUTHORITY boundary (doc 00 registry + per-doc DOC_STATUS markers + SUPERSEDED_NON_AUTHORITY BEGIN/END fences; lives in the blueprint KB doc structure, not Directus-editable). G-LEGACY-NO-DISPOSITION-AUTHORITY re-scoped to ACTIVE_AUTHORITY (reports fenced history, never fails on it); +G-ACTIVE-AUTHORITY-SCOPE, +G-NO-SUPERSEDED-CONSUMPTION; guard-quality rule 8; historical pass sections fenced in docs 00/12 and this checkpoint. Docs 00/04/06/07/08/12.

Test/verification guards 42 -> 47. Invariants 27/11/14/7 preserved (0 new authority surface, 0 new readiness gate, 0 new top-level hash contract, 0 new #20 column, 0 new catalog family; the active/superseded boundary is document metadata, NOT a DB surface). All hard blocks intact. No fresh live read required (prior pg_roles evidence stands: directus non-superuser; workflow_admin superuser; qt001_cp_* roles absent; 0 trigger bypass vector). Blueprint docs patched: 00 (rev 3->6), 01 (rev 5->6), 02 (rev 24->33), 03 (rev 4->6), 04 (rev 37->39), 05 (rev 23->24), 06 (rev 30->38), 07 (rev 36->40), 08 (rev 16->17), 09/10/11 (+DOC_STATUS: SUPERSEDED_NON_AUTHORITY markers), 12 (rev 18->29) + this checkpoint. Report: t1-fix7-blueprint-patch-after-codex-recheck-3-set-separation-2026-06-08/00..11; checkpoint checkpoint-t1-fix7-blueprint-patch-after-codex-recheck-3-set-separation-2026-06-08.md. Implementation / Stage 2.6B / qt001_backfill_permit / REAL_RUN / QT001 apply / activation / repoint / owner-ACL cutover all remain BLOCKED. Next = Codex recheck 4.

<!-- SUPERSEDED_NON_AUTHORITY BEGIN: pre-recheck-3 patch-pass history (recheck-2 / owner-semantics recheck / critical-review); audit trail only — NOT current authority; contains removed disposition/STUB/DO_NOT_TOUCH-subtraction terms by design -->

Codex RECHECK-2 patch pass (2026-06-08) - 6.5/8 in-blueprint; blocker C -> design amendment

Codex recheck 2 failed the blueprint on 8 blockers. T1 analysed each against the approved byte-level DDL and a fresh read-only pg_roles read; 6.5/8 bind to already-approved surfaces and were patched directly, and blocker C (the legacy-disposition contract) has no approved home and is routed to the design owner (law §4G HARD-STOP on governance/design change).

• A owner-unreachable -> NOLOGIN (CP-01 §2.1) + no inbound pg_auth_members membership + Level-B-only SET ROLE (CP-09); +G-OWNER-UNREACHABLE.
• B independent root denominator -> roots = sealed #20 protected_target TABLE rows + #26 protected_target_set_sha256; closure = sealed #24 analyzer into #11; dynamic calls fail closed.
• C disposition contract -> DESIGN_AMENDMENT_REQUIRED: no approved home (sealed exact catalog CP-03; no #20 disposition column; §2.7 scope; item_payload forbidden). Option α add a typed contract / Option β collapse to approved primitives (T1 recommends β). §§H.2/I withdrawn/fail-closed.
• D operator authorization -> typed PG model (CP-09 Level-B + #07/#20/#21/#16/#19/#08 + manifest_activation payload/epoch); evidence artifact supporting-only; +G-OPERATOR-AUTH-PG-NATIVE.
• E rollback source -> forward-only: prior immutable sealed manifest version + S14 snapshot via manifest_activation.rollback_evidence_id; legacy STUB body rides on C.
• F superuser break-glass -> workflow_admin outside ACL-zero; Level-B-only operator session; readiness = no-unauthorized-use-path; +G-SUPERUSER-BREAKGLASS.
• G forward-only history -> rollback supersedes forward (never clears activated_at); G-NOMIXED-AUTHORITY reads the derived current-active route.
• H author/rehearse/seal order -> #11/#20/#26/#27 + denominator authored (PKG-B) before the PKG-C rehearsal seal; PKG-D read-only re-validation; +G-SEAL-AFTER-AUTHOR-REHEARSE.

Test/verification guards 36 -> 40 (+G-OWNER-UNREACHABLE, +G-SUPERUSER-BREAKGLASS, +G-SEAL-AFTER-AUTHOR-REHEARSE, +G-OPERATOR-AUTH-PG-NATIVE; G-NOMIXED-AUTHORITY forward-only; G-LEGACY-TARGET-SEALED + the disposition aspect of G-LEGACY-TARGET-CLOSED-DENOMINATOR fail-closed pending the C amendment). Invariants 27/11/14/7 preserved (0 new authority surface/readiness gate/hash contract/#20 column/catalog family; production mutation 0). Live (read-only, DB directus): directus rolsuper=false/rolbypassrls=false; workflow_admin rolsuper=true/rolbypassrls=true; qt001_cp_* roles absent. Blueprint docs patched: 02 (rev 17->23), 04 (rev 33->36), 05 (rev 18->22), 06 (rev 25->29), 07 (rev 28->35), 08 (rev 10->15), 12 (rev 12->14) + this checkpoint. Report: t1-fix7-blueprint-patch-after-codex-recheck-2-pg-authority-contract-2026-06-08/00..13; checkpoint checkpoint-t1-fix7-blueprint-patch-after-codex-recheck-2-pg-authority-contract-2026-06-08.md. All hard blocks intact; implementation / Stage 2.6B / qt001_backfill_permit / REAL_RUN / QT001 apply / activation / repoint / owner-ACL cutover all remain BLOCKED.

Codex RECHECK (owner-semantics) patch pass history

(Gate progression: authored ..._READY_FOR_CODEX_CRITICAL_REVIEW -> independent XHigh pass -> ..._XHIGH_REVIEWED_AND_REVISED_READY_FOR_MAX_REVIEW -> independent Max pass 2026-06-08 -> ..._MAX_REVIEWED_AND_REVISED_READY_FOR_CODEX_CRITICAL_REVIEW -> Codex critical review FAILED it (..._CODEX_CRITICAL_REVIEW_FAIL_HARDCODE_OR_PG_NATIVE_GAP; 7 blockers) -> T1 patched all 7 (PROGRAM_PATCH_T1_FIX7_REFACTOR_BLUEPRINT_AFTER_CODEX_CRITICAL_FAIL) -> ..._T1_PATCHED_AFTER_CODEX_FAIL_READY_FOR_CODEX_RECHECK -> Codex RECHECK FAILED it (..._CODEX_RECHECK_FAIL_HARDCODE_OR_PG_NATIVE_GAP; root cause = PostgreSQL owner semantics at S15; A-K: B/I FAIL, A/C/D/H NEEDS_FIX, E/J accepted-with-order, F/G accepted, K FAIL) -> T1 patched all recheck blockers directly in-blueprint (2026-06-08, PROGRAM_PATCH_T1_FIX7_BLUEPRINT_AFTER_CODEX_RECHECK_OWNER_SEMANTICS_FAIL) -> the status above. Next = Codex recheck 2 only.)

Codex RECHECK patch pass (2026-06-08) - owner semantics + recheck blockers

Codex's recheck failed the patched blueprint; decisive root cause = at S15 the legacy routines were still owned by directus, and a PostgreSQL owner keeps implicit EXECUTE, so REVOKE alone could not zero directus's effective EXECUTE (G-NOLEGACY-POST impossible). T1 re-patched every recheck blocker directly in-blueprint (READ-ONLY production; no production mutation), grounded on fresh live evidence (directus rolsuper=false; cluster superuser workflow_admin) and the approved byte DDL. No design amendment required - every fix uses an approved surface/column.

• A PG owner semantics -> S14 STAGED (no activation); S15 atomic ordered owner-transfer (off directus->qt001_cp_owner) -> REVOKE/stub -> verify G-NOLEGACY-POST -> activate+repoint; superuser dispositioned.
• B closed denominator -> U_legacy (reverse write-effect #11/#22 + analyzer-edges) ∪ effective-EXECUTE principals ∪ entry-vectors − DO_NOT_TOUCH; +G-LEGACY-TARGET-CLOSED-DENOMINATOR.
• C byte-DDL conflict -> map to EXISTING approved #20 columns (object_type/protected_target/ entrypoint/expected_owner_role/expected_acl_sha256/source_sha256); disposition COMPUTED; set integrity = manifest seal; 0 new #20 column, 0 new catalog family.
• D no-mixed vs S14 ACTIVE -> STAGED activation; activate in atomic PKG-F after neutralization; G-NOMIXED keys on the ACTIVE route fact (activated_at), not manifest existence.
• E rollback source artifact -> STUB body restore = sealed evidence_registry artifact (artifact_uri+artifact_sha256) pinned by #27; no-artifact => REVOKE_ONLY.
• F operator_authorization / set-hash -> operator_authorization_artifact = evidence_registry non-authority evidence consumed by a PG-native decision; expected_legacy_set_sha256 eliminated.
• G permit wording -> doc 08 "operator permit" -> operator_authorization; grep claim.
• H ACL snapshot order -> snapshot at S14 BEFORE the S15.1 owner transfer; superuser dispositioned.

Guards 35 -> 36 (+G-LEGACY-TARGET-CLOSED-DENOMINATOR; G-NOLEGACY-POST/G-NOMIXED-AUTHORITY/ G-LEGACY-TARGET-SEALED/G-OWNER-CUTOVER tightened; guard-quality rule 5). Invariants 27/11/14/7 preserved (0 new authority surface, 0 new readiness gate, 0 new hash contract, 0 new #20 column, 0 new catalog family). Blueprint docs patched: 02 (rev 17), 04 (rev 33), 05 (rev 18), 06 (rev 25), 07 (rev 28), 08 (rev 10), 12 (rev 12) + this checkpoint. Report: t1-fix7-blueprint-patch-after-codex-recheck-owner-semantics-2026-06-08/00..13; checkpoint checkpoint-t1-fix7-blueprint-patch-after-codex-recheck-owner-semantics-2026-06-08.md. All hard blocks intact; implementation / Stage 2.6B / qt001_backfill_permit / REAL_RUN / QT001 apply / activation / repoint / owner-ACL cutover all remain BLOCKED.

Codex critical-review patch pass (2026-06-08)

Codex's critical review failed the blueprint on 7 blockers (B/E/G/H/I FAIL; C/D/F NEEDS_FIX; J terminology). T1 patched every blocker directly in the blueprint docs (READ-ONLY production; no production mutation; KB blueprint-doc revision only):

• B1 legacy target = disguised hardcode -> sealed legacy-disposition set in authority_scope_manifest #20 (typed identity + source_sha256 + privilege_acl_hash + expected_legacy_set_sha256, exact-set both-EXCEPT vs catalog); name/owner scan demoted to diagnostic candidate; +G-LEGACY-TARGET-SEALED; G-PGNATIVE extended to reject name-pattern binding authority. **Live proof of fragility (read-only, 2026-06-08): views = 0/183/196 by literal (qt001%/v_qt001%/%qt001%); routines = 45 functions
  • 1 procedure (the prose "46 functions" conflated the apply procedure).**
• B2 G-NOLEGACY deadlock -> split into G-NOLEGACY-PRE (gates PKG-F; no EXECUTE-revoked requirement) + G-NOLEGACY-POST (verifies PKG-F).
• B3 stub-scope contradiction -> 5 dispositions; stub only STUB_FAIL_CLOSED; body-rollback bounded to those (pinned #27); REVOKE_ONLY = privilege change only.
• B4 rollback may reopen PUBLIC EXECUTE -> atomic deactivation-first rollback sequence + G-NOMIXED-AUTHORITY (new path superseded before any legacy EXECUTE restore).
• B5 ACL snapshot incomplete -> +column ACL (pg_attribute.attacl) + effective role-membership privilege (pg_auth_members) + sequence/default/PUBLIC/Directus/cp grants + snapshot_sha256; both-direction effective-privilege rollback verify.
• B6 writer-gateway identity ambiguous -> pinned #26 identity (regprocedure+source+owner), phase-explicit owner table (gateway born qt001_cp_owner, no transition); +G-WRITER-GATEWAY-IDENTITY.
• B7 permit ambiguity -> operator_authorization (package-execution, machine-checkable artifact) separated from the BLOCKED qt001_backfill_permit / REAL_RUN_authority; +G-NO-QT001-PERMIT-DURING-FIX7; law §4G citation corrected (the real §4G makes governance_change a stop_without_asking_if hard-stop; the law has no "permit" term).

Guards 30 -> 35 (all TEST/VERIFICATION guards, not readiness gates). Invariants 27/11/14/7 preserved (0 new authority surface, 0 new readiness gate, 0 new hash contract; the sealed set is DATA rows in existing #20/#27 + one typed disposition column). Blueprint docs patched: 00, 01, 02, 03, 04, 05, 06, 07, 08, 12 + this checkpoint. Patch report: t1-fix7-blueprint-patch-after-codex-critical-fail-2026-06-08/00..12; patch checkpoint checkpoint-t1-fix7-blueprint-patch-after-codex-critical-fail-2026-06-08.md. All hard blocks intact; implementation / Stage 2.6B / qt001_backfill_permit / REAL_RUN / QT001 apply / activation / repoint / owner-ACL cutover all remain BLOCKED.

<!-- SUPERSEDED_NON_AUTHORITY END -->

Design-approval source (confirmed)

FIX7_DESIGN_OFFICIALLY_APPROVED_BY_CODEX_FOR_IMPLEMENTATION_PLANNING - codex-owner-confirmation-fix7-final-design-approval-2026-06-08/05-final-verdict.md (A/B/C/D); T1 final short-review DESIGN_READY_FOR_CODEX_FINAL_APPROVAL (0 blocking); index rev 27.

Central finding (live read-only inventory, 2026-06-08, DB directus)

FIX7 is a parallel green-field qt001_cp control plane, not an in-place edit:

• qt001_cp schema ABSENT (live schemas: cutter_governance, iu_core, public, sandbox_tac).
• qt001_cp_owner/migrator/reader roles ABSENT.
• Legacy qt001_* in public, all owner directus: 20 tables, 46 functions, 196 views (FIX..FIX6).
• Birth gateway (birth_registry + permit/ledger/release + 5 fn_birth_*) present, directus-owned -> DO_NOT_TOUCH.
• DOT-118/119 frozen -> DO_NOT_TOUCH.

Refactor = ADD whole qt001_cp (all MISSING_ADD, operator-gated) + atomic authoritative repoint (proven non-reachable-to-legacy by #11) + legacy U_legacy_object brought to the uniform Option-Beta end-state (owner-isolated, body unchanged, effective privileges == sealed #21) and retained forward-only (never live DROP) + DO_NOT_TOUCH birth gateway/DOTs (entry-vector boundary, never object members) + ROLE_CUTOVER_LATER for directus-owned control objects.

<!-- SUPERSEDED_NON_AUTHORITY BEGIN: pre-Option-Beta phase/review history (High / XHigh / Max / independent passes); audit trail only; not current authority -->

Phase outcomes

• Phase 1 (High, docs 00-08): authored - inventory, design-to-live mapping (27 surfaces #01..#27, 11 runtime-evidence, 14 gates DATA, 7 hashes DATA), 18-gap matrix, S00-S19 construction order, rollback blueprint (COMPLETE), test/guard blueprint (26 -> 30 guards after independent XHigh), PKG-A..I split, hard-blocks list.
• Phase 2 (XHigh, doc 09): 3 findings + 1 advisory.
  • XH-2 (P1): legacy entrypoints PUBLIC/directus-executable in activate->cutover window (the FIX2/FIX3 bypass) -> neutralization bundled into PKG-F; G-NOLEGACY extended to "blocked, not merely unreachable".
  • XH-3: missing S05 guard -> added G-OPERAND-TYPED.
  • XH-4 (P1): unscoped ACL cutover could break live Directus CMS -> scoped to control objects; added G-DIRECTUS-APP-INTACT.
  • XH-1 (advisory): runtime_config dual-role mapping refined.
• Phase 3 (Max, doc 10): 3 findings.
  • MX-1 (P1): existing Directus SELECT set never captured -> S00 capture artifact; PKG-B precondition; G-DIRECTUS-READ compares against captured set.
  • MX-2 (P2): S15 neutralization + S17/S18 freeze/deprecate flagged as T1 operationalization beyond literal design; Codex confirmation requested.
  • MX-3: ACL rollback snapshot must be captured + read-back-verified + restore-rehearsed before REVOKE.
• Revisions (doc 11): all six findings revised in-macro; affected XHigh checks 6/10/12 and Max checks 1/5/11 re-run to PASS.
• Independent XHigh pass (2026-06-08, separate macro PROGRAM_REVIEW_XHIGH_...): audited vs live evidence (legacy fns proacl=NULL = PUBLIC EXECUTE) and doc consistency; 10 findings directly revised in-blueprint (3 P1): XHI-02 dangling G-LEGACY-FROZEN defined; XHB-01 +G-DOT-NOOVERWRITE (no DOT/non-owner gateway-overwrite); XHB-02 rollback safe-blocked-baseline clarified; XHH-01 +birth-gateway-modification/+registry-pivot hard-block rows; XHL-01 cross-layer OUT-OF-SCOPE (Đ43/QT-006/registry-pivot/raw-birth); XHI-01 guard count 26->30; +XHD-01/XHO-01/XHJ-01/XHM-01. Status advanced to FIX7_REFACTOR_BLUEPRINT_XHIGH_REVIEWED_AND_REVISED_READY_FOR_MAX_REVIEW. Report t1-xhigh-fix7-refactor-blueprint-review-2026-06-08/00..13; checkpoint checkpoint-t1-xhigh-fix7-refactor-blueprint-review-2026-06-08.md. Invariants 27/11/14/7 intact.
• Independent Max pass (2026-06-08, separate macro PROGRAM_REVIEW_MAX_FIX7_REFACTOR_BLUEPRINT_...): audited the XHigh-revised blueprint vs LIVE production + the governing law (did NOT trust prior PASS claims); 7 findings directly revised in-blueprint (3 P1, 3 P2, 1 P3): MB-01 legacy neutralization widened from "apply/writer" to the COMPLETE S00-captured legacy-entrypoint set (live: ALL 46 fns + apply proc proacl=NULL/PUBLIC EXECUTE, none SECURITY DEFINER); MC-01 G-DOT-NOOVERWRITE re-grounded on PG-native owner-isolation (nspacl/ownership) as final authority, DOT-body scan = fail-closed diagnostic; MA-01 stale top-line status corrected; ME-01 ACL rollback snapshot made concrete (ownership + table/view/function/sequence ACLs + nspacl + default privileges); MG-01 fresh Codex re-audit gates before PKG-F/PKG-G (law section 4G); MH-01 guard-quality rules (no vacuous pass / NULL-strict / source-text diagnostic-only); MB-02 birth-family completed (10 fns DO_NOT_TOUCH) + 0-trigger bypass-vector evidence. 30 guards unchanged; invariants 27/11/14/7 intact; 0 blockers. Blueprint docs revised: 01/02/04/05/06/07/08/12 + this checkpoint. Status advanced to FIX7_REFACTOR_BLUEPRINT_MAX_REVIEWED_AND_REVISED_READY_FOR_CODEX_CRITICAL_REVIEW. Report t1-max-fix7-refactor-blueprint-review-2026-06-08/00..12; checkpoint checkpoint-t1-max-fix7-refactor-blueprint-review-2026-06-08.md.

<!-- SUPERSEDED_NON_AUTHORITY END -->

Invariants (preserved, non-regressed)

AUTHORITY_SURFACES=27 · RUNTIME_EVIDENCE=11_NON_AUTHORITY · READINESS_GATES=14_DATA ·
HASH_CONTRACTS=7_H01..H07 · NEW_GATES=0 · NEW_HASH_CONTRACTS=0 · PRODUCTION_MUTATION=0 ·
STAGE_2_6B/PERMIT/REAL_RUN/QT001_APPLY=BLOCKED · OWNER_ACL_CUTOVER/MANIFEST_ACTIVATION=OPERATOR_GATED

Verdicts

• Zero-hardcode (incl. disguised): PASS. PG-first/native/driven: PASS.
• 27/11/14/7: PRESERVED. Rollback: COMPLETE. Dependency-safe order: COMPLETE.
• XHigh: PASS-after-revision. Max: PASS-after-revision.

Output

• Report dir: knowledge/dev/reports/architecture/t1-fix7-existing-system-refactor-execution-blueprint-2026-06-08/00..12 (13 docs).
• Checkpoint: this file.

Next

Codex recheck 8 of the recheck-7 Constitution-Article-14 SSOT-patched blueprint (external; not implementation), which seals the ACTIVE_AUTHORITY_APPROVAL_ENVELOPE under the canonical FIX7-CANON-V1 contract (now a single executable SSOT, non-self-referential, acyclic) incl. canonicalizer_sha256, and writes the Codex detached seal at PASS. Until it passes, implementation is NOT approved. Then (each separately gated, all currently BLOCKED): implementation-authoring package PKG-A..D (author/rehearsal/read-only) -> Codex re-audit + operator_authorization -> PKG-E create/seal/stage (OPERATOR; NO activation) -> PKG-F atomic owner-transfer + reconcile-to-#21 + activate + repoint (uniform end-state over U_legacy_object) -> PKG-G owner/ACL cutover -> PKG-H legacy retention (uniform end-state) -> PKG-I verify -> (separate gates) REAL_RUN / QT001 apply / Stage 2.6B.

Do not claim implementation approval. This macro repaired the construction blueprint per Codex recheck 7; next is Codex recheck 8 only.