<!-- DOC_STATUS: ACTIVE_NON_AUTHORITY -->

FIX7 P0 — Implementation Planning Validation Probes (2026-06-11)

• Authority: PLANNING_NON_AUTHORITY. Executable, fail-closed.
• Executables (in packet): planning_packet_validator.py (exit 0 pass / 1 gate-fail / 2 missing-file), bad_input_probes.py (15 probes + positive controls).

Validator result (good packet)

[PASS] seal-consumption
[PASS] mutation-inventory
[PASS] precondition-checklist
[PASS] dryrun-design
[PASS] rollback-recovery
[PASS] owner-decision-template
PLANNING_VALIDATOR_RESULT: PASS (all planning gates; execution still blocked)   # exit 0

Bad-input probes (each injects one defect → must fail closed)

probe	injected defect	gate fail-code	result
P1	missing P7	MISSING_P7 / P7_DIGEST_MISMATCH	FAIL-CLOSED
P2	P7 digest mismatch	P7_DIGEST_MISMATCH	FAIL-CLOSED
P3	implementation execution claimed now	IMPLEMENTATION_EXECUTION_CLAIMED_NOW	FAIL-CLOSED
P4	production mutation allowed now	PRODUCTION_MUTATION_ALLOWED_NOW	FAIL-CLOSED
P5	rollback proof fabricated (PROVEN)	ROLLBACK_PROOF_FABRICATED	FAIL-CLOSED
P6	missing precondition evidence	MISSING_PRECONDITION_EVIDENCE	FAIL-CLOSED
P7	target surface not inventoried (drop PG)	SURFACE_NOT_INVENTORIED	FAIL-CLOSED
P8	dry-run command without rollback	DRYRUN_CMD_WITHOUT_ROLLBACK	FAIL-CLOSED
P9	registry/index mutation not classified	REGISTRY_MUTATION_NOT_CLASSIFIED	FAIL-CLOSED
P10	owner approval fabricated	OWNER_APPROVAL_FABRICATED	FAIL-CLOSED
P11	default decision not HOLD	DEFAULT_NOT_HOLD	FAIL-CLOSED
P12	mutation allowed_now=true	MUTATION_ALLOWED_NOW	FAIL-CLOSED
P13	execution_ready overclaim	EXECUTION_READY_OVERCLAIM / …CLAIMED_IN_PLANNING	FAIL-CLOSED
P14	owner decision not OPT3 (forged token)	OWNER_DECISION_NOT_OPT3	FAIL-CLOSED
P15	dry-run targets production	DRYRUN_TARGETS_PRODUCTION	FAIL-CLOSED

[CONTROL] good packet passes all gates: YES
BAD_INPUT_PROBES: 15/15 fail-closed; controls_pass=True; any_fail_open=False   # exit 0

All ten failure modes required by the macro (missing P7, P7 mismatch, execution claimed now, production allowed now, rollback proof without execution, missing precondition evidence, surface not inventoried, dry-run command without rollback, registry/index mutation not classified, owner approval fabricated) are covered and fail closed, plus five additional probes (P11–P15).

Reconstruct evidence

bash RERUN.sh → HASH_MANIFEST OK · packet_tree f470d0d0…fe8f match · validator exit 0 · probes 15/15 fail-closed · exit codes byte-match · RERUN_RESULT: PASS. KB round-trip: 14/14 files reconstructed from KB-stored bytes → shasum -c all OK → RERUN PASS (byte-exact).