01 - Codex Recheck-6 Failure Matrix

Source: codex-fix7-blueprint-recheck-6-canonical-envelope-seal-2026-06-09/ (00, 01, 02, 05, 06, 08, 10, 11) + checkpoint-codex-fix7-blueprint-recheck-6-canonical-envelope-seal-2026-06-09.md.

Final Codex status: FIX7_REFACTOR_BLUEPRINT_CODEX_RECHECK_6_NEEDS_T1_FIX.

Accepted (must NOT be reopened)

Codex check	verdict
C — doc 00 self-reference	DOC00_SELF_REFERENCE_RESOLVED
D — blueprint checkpoint classification	BLUEPRINT_CHECKPOINT_CLASSIFICATION_ACCEPTED
J — invariants / boundary	INVARIANTS_BOUNDARY_FINAL_ACCEPTED
(membership)	active_corpus_membership_sha256 = f2bda8…fe251 independently reproduced
(runtime)	PG-first / native / typed-set separation did not regress

Blocked (what T1 must fix)

Codex check	verdict	root cause	T1 fix (this pass)
A canonical encoding	CANONICAL_ENCODING_NEEDS_FIX	no escaping/rejection for TAB/LF/CR/backslash/reserved tokens inside field values → TAB/LF-delimited records not injective; normalized active bytes / restricted to active scope had no parser; marker_literal/fence_range/superseded_id/manifest/seal records had no exact representation	doc 02 (rejection) + doc 03 (extractor) + doc 04 (records)
B manifest coverage	ENVELOPE_MANIFEST_COVERAGE_NEEDS_FIX	"authority-bearing field" left discretion; detached_seal_anchor.contract/signature/detached_seal_sha256/notes not classified; circular checkpoint anchor unresolved	doc 04 (closed key-classification schema) + doc 05/06 (cycle removed)
E detached seal anchor	CODEX_DETACHED_SEAL_NEEDS_FIX	manifest binds codex_checkpoint_content_sha256; checkpoint contains the seal binding the manifest; seal_report_checkpoint_content_sha256 self-referential	doc 05 (acyclic DAG) + doc 06 (anchor without self-hash)
F sealing execution	CODEX_SEALING_NEEDS_T1_FIX	load-bearing computations ambiguous/circular; no partial seal authored	resolved by A–E; Codex seals at recheck 7
G drift guards	FAIL_CLOSED_DRIFT_GUARDS_NEED_FIX	guards keyed on prose-interpreted scopes / circular anchor	doc 07 (4 new guards + rebinding)
H/I hardcode / PG-native	HARDCODE_FINAL_NEEDS_FIX / PG_NATIVE_FINAL_NEEDS_FIX	"disguised-hardcode risk is construction-document authority: prose-interpreted scopes + circular anchor permit verifier-dependent authority" — fix WITHOUT adding a runtime authority surface, readiness gate, #20 column, catalog family, or 8th runtime hash contract	doc 09 (no runtime surface added; content-addressed not prose)
K authoring planning	AUTHORING_PLANNING_NEEDS_T1_FIX	seal could not be executed	unblocked after recheck 7 seal; implementation stays unauthorized

The two root blockers (Codex readme + checkpoint, verbatim sense)

1. FIX7-CANON-V1 lacked byte-exact escaping and a deterministic active-section/fence extraction for all load-bearing aggregate/content hashes.
2. The detached-seal model was circular: envelope manifest binds the Codex checkpoint content hash, while that checkpoint contains the detached seal that binds the manifest; seal_report_checkpoint_content_sha256 is additionally self-referential.

Both are closed in this pass (docs 02–06), computed in doc 08.