KB-5E7F

FIX7 P0 Hardening Packet — README

4 min read Revision 1

FIX7 P0 — Rollback-Validator Hardening Patch Packet (2026-06-11)

Lane: FIX7_P0_PRE_EXECUTION_HARDENING_AND_GOVERNANCE_CONSOLIDATION_MACRO_2026_06_11
Type: HARDENING PATCH PACKET — REQUIRED_FOR_FUTURE_EXECUTION_MACRO
Authority: PRE_EXECUTION_HARDENING_NON_AUTHORITY. Authorizes nothing. Staging/paper-only. No production mutation, no implementation execution, no REAL_RUN/QT001/permit/activation/repoint/cutover.
Does NOT rewrite or supersede the original dry-run packet's verdict history. The original evidence remains valid; this packet adds a hardened gate for a future execution macro.

What this addresses

T2-REC-ROLLBACK-HARDENING-1 (non-blocking recommendation from the T2 independent review):

The validator should require after_apply_hash != before_hash when staging mutation is claimed, so a fake rollback proof cannot pass with no real applied mutation.

The hardening (strict superset of the original validator)

hardened_dryrun_validator.py is byte-faithful to the original dryrun_validator.py (sha256 7fb2f11e…b297, inside fix7-p0-dryrun-and-execution-readiness-packet-2026-06-11, tree 02b200e5…94e6), plus rollback hardening in check_rollback_proof:

When rollback_proof_status == PROVEN_IN_STAGING, every entry must satisfy:

before_hash, after_apply_hash, after_rollback_hash all present;
after_apply_hash != before_hash → apply actually changed the artifact (new fail code ROLLBACK_APPLY_DID_NOT_MUTATE);
after_rollback_hash == before_hash (or == expected_restored_hash if pinned; new fail code ROLLBACK_NOT_RESTORED_TO_PIN);
production_rollback_status stays NOT_APPLICABLE (production mutation forbidden).

No original gate is removed → every original defect class is still caught. The ABSENT sentinel (additive surfaces that never existed before/after) is preserved: a real after_apply_hash differs from ABSENT, so legitimate additive rollbacks pass.

Evidence in this packet

python3 hardened_dryrun_validator.py --selftest → real frozen T1 rollback evidence PASSES; a fabricated no-mutation rollback (apply == before) FAILS CLOSED. Exit 0.
python3 hardened_bad_input_probes.py → 7/7 fail-closed, any_fail_open=false, control passes; results in hardening_probe_results.json. Exit 0.
valid_evidence_recheck.json holds the frozen T1 rollback entries (RB-2/RB-3/RB-4) copied byte-for-byte from rollback-recovery-proof.json (07acdf19…37ba).

No-regression cross-check (recorded in `exit_codes.json`)

The real fix7-p0-dryrun-and-execution-readiness packet was reconstructed and:

original dryrun_validator.py → PASS (exit 0) — reproduces T1;
hardened_dryrun_validator.py (full-packet mode) → PASS (exit 0) — no regression;
original 20 bad_input_probes.py → 20/20 fail-closed (exit 0) — no regression.

Run it

bash commands.sh   # selftest + 7 hardening probes; checks exit_codes.json
bash RERUN.sh      # regenerate evidence, verify HASH_MANIFEST + packet_tree

Files

README.md, hardened_dryrun_validator.py, hardened_bad_input_probes.py, valid_evidence_recheck.json, hardening_probe_results.json, commands.sh, RERUN.sh, exit_codes.json, HASH_MANIFEST.txt, packet_tree.sha256, manifest.json.

Governance

Objects TKT-OBJ-430..441 — PROPOSED, standalone addendum, above ceiling 429, APPLY_NOW=NO. Canonical registry JSON rev20 (max 224) / 00-index rev114 untouched. Backlog 225..429 is contiguous + collision-free + readable → fold is ready but not applied (owner/GPT-only; live lane race) = FOLD_READY_PACKET_ONLY.

What is still blocked (unchanged)

Implementation execution; any production mutation; PG/Directus/registry-row/system_issues; REAL_RUN/QT001/permit/activation/repoint/cutover. Default owner decision: HOLD.