Codex Stage 2.6A-FIX3 Exact Control Contract Hardcode Audit

Audit date 2026-06-07. READ-ONLY. Status STAGE2_6A_FIX3_FAIL_HARDCODE_OR_BYPASS_STILL_DANGEROUS. Do not proceed 2.6B, open permits, or apply.

Primary failure: FIX3 v3/v6 controls are disconnected from authoritative path. Writer reads readiness v5 and old signoff; builder writes fingerprint v2; tier v3 signals call old signoff; current plan hash is v2.

Additional false-green: arbitrary approver/provenance/reviewer identity and plan id/version; synthetic fingerprint tests; snapshot-relative scope; NULL-to-zero fingerprinting; free-text capability proof.

MCP upload/list/read/search PASS: 13 canonical docs listed; verdict/FIX4/current-state returned; checkpoint uploaded. Final no-worse: QT001 births/permits/done/Tier1/signoff all 0; readiness v5/v6 BLOCKED; scale NOT_SAFE.

Required FIX4: BIRTH_STAGE2_6A_FIX4_QT001_AUTHORITATIVE_PATH_UNIFICATION_VERIFIED_CAPABILITIES_AND_SCALE_FAILCLOSED.