Reconstruction instructions — FIX7 Real-N6 Provenance Packet

This packet verifies governed evidence it does not duplicate (one authority, one nature). To run it you must first materialize that evidence from the KB.

Prerequisites

• python3 (stdlib only; no third-party packages).
• Read-only access to the agent-data MCP KB (~/.claude.json mcpServers["agent-data"], or env MCP_URL + MCP_KEY). Only get_document_for_rewrite (read) is used.

Steps

# 1) fresh-reconstruct governed evidence from KB into _recon/
python3 kb_fetch_reconstruct.py _recon
#    -> fetches FIX7 Recheck-9 Packet V2 root files + 10 active corpus docs from
#       their canonical blueprint document ids, verifies bidirectionally against
#       that packet's HASH_MANIFEST.txt, and fetches + pins authority_seal_encoder.py.
#    -> prints "RECONSTRUCTION: OK (...)"; FAILS CLOSED on any gap/drift.

# 2) run the gates
RECON=_recon bash commands.sh     # OVERALL: PASS (5/5 gates)

# 3) strict end-to-end (reconstruct + all gates + cert byte-diff, every exit enforced)
bash RERUN.sh                     # RERUN_RESULT: PASS

What gets reconstructed into _recon/

• docs/ — the 10 frozen active-authority blueprint docs (the N6 corpus).
• evidence/fix7_canon_v1_ssot_extended.py — governed canonicalizer (sha256 d9caa9fe…26f3e5).
• evidence/canonicalizer-fix7-canon-v1-ssot.md — SSOT .md (sha256 49c386a9…b734d0).
• HASH_MANIFEST.txt — the recheck-9 byte-exact pins for all of the above.
• authority/authority_seal_encoder.py — governed seal encoder (sha256 13344f92…957144b8).

Governed source document ids

• Corpus prefix: knowledge/dev/reports/architecture/t1-fix7-existing-system-refactor-execution-blueprint-2026-06-08/
• Recheck-9 packet: knowledge/dev/laws/tool-kiem-thu/packets/fix7-codex-recheck-9-2026-06-10/
• Authority encoder: knowledge/dev/laws/tool-kiem-thu/packets/fix7-authority-closure-2026-06-10/authority_seal_encoder.py

Note: blueprint docs may have advanced KB revisions, but their active-authority content is frozen; the reconstruction verifies each against the recheck-9 HASH_MANIFEST and fails closed on any drift.