08 - Codex-Style Adversarial Self-Review (15/15, computed)

This is the "mimic Codex, catch my own holes before he does" pass the user demanded. Every hash / extractor / DAG case was executed in python (hashlib.sha256 == shasum -a 256), not asserted. A reference implementation of FIX7-CANON-V1 (field rejection + record encoders + extractor + DAG cycle check) was built and run; it reproduces the accepted membership digest, which proves the encoder is the same one Codex used.

Anchor proof

membership over the 10 full doc_ids, FIX7_ACTIVE_AUTHORITY_MEMBERSHIP_V1, ascending, LF, trailing LF
computed : f2bda8effc7be19b54722828126b82d7d2d48bee5e5e5dc0c8f347ce210fe251
expected : f2bda8effc7be19b54722828126b82d7d2d48bee5e5e5dc0c8f347ce210fe251
MATCH    : True

The 15 scenarios (Codex's required battery) — all PASS

#	attempted bypass	required behaviour	result (computed)
1	insert TAB in a field value	rejected	PASS → CANONICAL_FIELD_RESERVED_TOKEN_REJECTED
2	insert LF in a field value	rejected	PASS → CANONICAL_FIELD_RESERVED_TOKEN_REJECTED
3	insert a reserved fence token inside a field	rejected	PASS → CANONICAL_FIELD_RESERVED_TOKEN_REJECTED
4	duplicate ACTIVE/DOC_STATUS marker	fail closed	PASS → ACTIVE_SCOPE_MARKER_DUPLICATE
5	missing ACTIVE/DOC_STATUS marker	fail closed	PASS → ACTIVE_SCOPE_MARKER_MISSING
6	nested SUPERSEDED fence	fail closed	PASS → FENCE_NESTED_UNSUPPORTED
7	unbalanced EXCLUDE fence	fail closed	PASS → EXCLUDE_REGION_UNBALANCED
8	overlap ACTIVE and SUPERSEDED ranges (EXCLUDE inside SUPERSEDED)	fail closed	PASS → FENCE_NESTED_UNSUPPORTED (overlap is unreachable without a nest/wrong-kind END, both fail closed; ACTIVE_SUPERSEDED_OVERLAP is the explicit line-intersection assertion)
9	change heading/section id	fail closed	PASS → computed descriptor flips (WHOLE_DOCUMENT → WHOLE_DOCUMENT_MINUS_SUPERSEDED_FENCES) ⇒ SECTION_ID_MISMATCH vs recorded
10	reorder records	canonical sort stable	PASS (sorted input identical digest)
11	reorder fields within a record	rejected / differs	PASS (fixed field order ⇒ different bytes ⇒ different digest)
12	optional NULL → empty string	mismatch/reject as specified	PASS → null CANONICAL_FIELD_NULL_REJECTED; empty CANONICAL_FIELD_EMPTY_REJECTED
13	hash checkpoint including its own seal	rejected by DAG guard	PASS → N8 ← N8 cycle detected = True
14	include Codex checkpoint content hash in envelope manifest	rejected by DAG guard	PASS → N7 ← N8 cycle detected = True
15	continue authoring after an ambiguous extraction	blocked	PASS → any extractor status raises AUTHORING_BLOCKED

Raw computed output (abridged)

=== DAG / SEAL HASH GRAPH ===
acyclic: True
topo order: N1 -> N2 -> N3 -> N4 -> N5 -> N6 -> N7 -> N8 -> N9
N9 diagnostic consumed by any load-bearing node: False
N7 inputs contain checkpoint/seal node: False
N8 inputs contain itself or checkpoint content: False
S14 (manifest<-seal added) cycle detected: True
S13 (seal<-seal self) cycle detected: True

=== scenarios 1-12, 15 ===
S1 TAB ... PASS rejected -> CANONICAL_FIELD_RESERVED_TOKEN_REJECTED
S2 LF  ... PASS rejected -> CANONICAL_FIELD_RESERVED_TOKEN_REJECTED
S3 reserved token ... PASS rejected -> CANONICAL_FIELD_RESERVED_TOKEN_REJECTED
S4 duplicate DOC_STATUS ... PASS rejected -> ACTIVE_SCOPE_MARKER_DUPLICATE
S5 missing DOC_STATUS ... PASS rejected -> ACTIVE_SCOPE_MARKER_MISSING
S6 nested SUPERSEDED ... PASS rejected -> FENCE_NESTED_UNSUPPORTED
S7 unbalanced EXCLUDE ... PASS rejected -> EXCLUDE_REGION_UNBALANCED
S8 overlap ... PASS rejected -> FENCE_NESTED_UNSUPPORTED
S9 section flip ... WHOLE_DOCUMENT -> WHOLE_DOCUMENT_MINUS_SUPERSEDED_FENCES (mismatch True)
S10 reorder->sort stable: True
S11 field reorder differs: True
S12a null forbidden -> CANONICAL_FIELD_NULL_REJECTED
S12b empty rejected  -> CANONICAL_FIELD_EMPTY_REJECTED
S15 authoring blocked on ambiguity -> AUTHORING_BLOCKED

Second-order holes I closed in self-review (not deferred to Codex)

• Free-text manifest fields (digest_algorithm, full_document_hash_policy, active_section_id_or_range) were byte-exact but semantically loose → made the first two fixed constants and the third a controlled vocabulary validated by the extractor. No free-text authority field remains.
• Revision-level cycle: binding codex_checkpoint_kb_revision in the manifest would itself cycle (the revision is fixed only after the seal is written). So the manifest binds the checkpoint id (path, known in advance) and the revision is protected by read-back equality instead.
• Unbound seal-layer keys: dropping the checkpoint hash from the manifest would leave anchor fields "present but unbound" → closed via the key-classification schema (every key bound / read-back-protected / declared non-authority).

Verdict: RECHECK6_ADVERSARIAL_SELF_REVIEW_PASS — 15/15, hash/extractor/DAG cases reproduced byte-for-byte.