diff --git a/docs/plans/2026-09-06_foundation-inspector-charter.md b/docs/plans/2026-09-06_foundation-inspector-charter.md new file mode 100644 index 00000000..ab32a5b3 --- /dev/null +++ b/docs/plans/2026-09-06_foundation-inspector-charter.md @@ -0,0 +1,416 @@ +# Foundation synthetic inspector — frozen charter candidate 3 + +Issue: #53. Author/integrator: darkwing. Feasibility contributor: rocko. +Independent reviewer: filbert, pending exact-candidate review. +Status: proposed implementation contract, NOT permission to implement. +Jason authorized continuation of planning after accepting the reviewed map. +No source changes, migration, publication, push or live fleet activity authorized. + +## 1. Bound inputs and interpretation + +Accepted map/handoff: commit 7345f330fc6bfae5aa1d896c78cfb7cbe62efbae. +Source/plan baseline: d4696d09eb1b5dcf1028f30db2cd63735f51cb16. +Map verdict: FM-FILBERT-1, SHA-256 +6b08c6fac0718d3db527cf9ffbfab49407e7b289d09782f5d1d0e26493eaabb3. +That approval does not cover this new charter. + +Detailed incorporated specification: sections 5–13 of +reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md, +SHA-256 f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1. +The explicit corrections/decisions below override that note. Its other sections +are contributor rationale/history, not normative repository facts. Original r1 +and the FI-ROCKO-2 corrections remain history, not alternate specifications. +Any ambiguity or contradiction discovered at implementation is a charter defect +to resolve, not permission for a coder to guess or weaken refusal rules. + +Candidate records.schema.json SHA-256: +05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6. +Candidate check.py SHA-256: +82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607. +Both resolve under docs/plans/foundation-v1-candidate at d4696d09. + +## 2. Deliverable and non-goals + +One local CLI over an explicitly supplied synthetic bundle, with deterministic +text and JSON previews of selected agent/project/workspace permission. No cwd +inference of scope, live registry, config bootstrap, account lookup, engine launch, +assignment mutation or real permission grant. Every result, including parser/I/O +failures, says SYNTHETIC PREVIEW — NO LIVE EFFECTS and authentication: not-modelled. + +Implemented operations: work.read (null target), file.read/file.change (logical +workspace-relative target), and assignment.change as a negative/unresolved check +only. The other 25 known catalog names return unsupported-capability, exit 2. +Unknown names return invalid-request, exit 2. No assignment-change success path. +No execution.stop operation is invented; the catalog contains execution.control. +No general RPC, sandbox, authentication, command audit, stopping, durability, +legacy adoption, OAuth refresh or extension integration is delivered. + +Operator supplies synthetic files only. The CLI reads just that explicit input, +never discovers credentials/config. It cannot know whether arbitrary operator- +selected file bytes contain secrets before reading them; this is not a general +credential-read prevention boundary. Never pass credentials or live records to it. +Tests and agents are not authorized to access such files. + +## 3. Input, identity and graph rules + +Use the closed bundle/selection/registry/artifact/authorization shapes in r2 §5, +subject to the proposal and output overrides below. All fields shown there are +required except message. proposal is explicitly null outside assignment.change; +assignment.change requires non-null proposal and null operation.target. The +subjectAssignmentRef must exactly equal selection.assignmentRef; selection agent, +project and workspace must match that assignment. Never infer a different subject. + +Eight supported record kinds: agent-definition, project, workspace, registration, +mission, task, assignment and decision. Other candidate kinds refuse unsupported- +kind. Candidate record shapes remain unchanged; simulation-specific fields exist +only in the enclosing bundle, never appended to accepted records. + +Record references are kind/id/scope/revision, WITHOUT digest. Registry references +include registry/id/revision/digest. Artifact references and authorization IDs +match declared simulation inputs; their presence proves neither publication +permission, authentication, authentic evidence nor current real-world authority. +Decision approvals are evaluated as synthetic fixture facts, not verified signatures. +Missing declarations refuse; no flag can turn them into actual authenticated facts. + +Reject duplicate record identities, duplicate registry identities even with different +digests, duplicate artifact identities (runId/artifactId) even with different digests, +and duplicate authorization IDs. Do not choose one of ambiguous registrations: +more than one current active registration for the same agent/scope refuses ambiguity. + +Revision rules: complete contiguous history from 1, or a single revision-1 record. +Structural references on every revision must resolve. Apply head/current-admission +checks only to head records used for this calculation and their consulted chain; +historical records do not fail merely because their then-current refs are now old. +Explicit historical supersedes/decision subject references may name existing old +revisions. Current selected intent/task/mission/registration/delegation/proposal +refs must name heads; no invented predecessor, repair or fallback. + +Cycle checks cover task.dependencies, mission.parentMissionRef and supersedes as +separate edge relations. Before tests are counted, show that each fixture reaches +the intended rule rather than failing an earlier shape error. Workspace ownership, +mission parent scope and registration parent match the accepted schema/README. +Dependencies grant no ownership/access. A selected task's same-project dependencies +must be accepted to permit file.change; another project's dependency never lends +permission. Broader dependency execution semantics are unsupported in this slice. + +## 4. Mandatory policy and assignment calculation + +Adopt r2 §7 L1–L9: enabled agent ceiling, both active registrations each bounded by +its mandatory scope-role ceiling, required project and workspace policy, exact +assignment/task/intent checks, applicable task/mission narrowing and an explicit +simulation execution layer. Workspace policy never falls back to a scope role. +Null optional restrictions mean no additional narrowing; missing required ceiling +never means unrestricted. Empty operations/path grants mean none. Exactly one +selected assignment contributes; no union across assignments. + +Selected project/workspace must be active. Assignment is selected, belongs to the +selected agent and workspace, and binds the selected task. Task is ready/active, +with approved current plan-approval intent whose subjects include that exact task. +Assignment intent is an approved current plan-approval, delegation or assignment- +change decision covering the task/assignment. An unrelated approved acceptance +or owner-checkpoint decision is not a substitute. Mission chain must be active. +Taskless work.read/file.read skips assignment/task/mission only when assignmentRef +is explicitly null. Supplying an invalid assignment never falls back to taskless. + +Paths use logical workspace roots and component-prefix intersection, never raw +string prefixes or physical filesystem traversal. Network restrictions are parsed +and intersected but no network operation is implemented or performed. + +## 5. Reassignment negative check — tightened requester context + +Extend r2 §5 proposal with required requesterContexts, a closed object: +- original: {assignmentRef, execution} +- target: {assignmentRef, execution} +Each assignmentRef is non-null recordRef; execution uses the same mandatory +selection.execution shape. No extra keys. Original scope derives from the subject +assignment; target scope derives from targetTaskRef. Both requester contexts belong +to requesterAgentId and the corresponding scope, not the subject agent. + +Apply L1–L9 to the requester in BOTH scopes for assignment.change, using those +contexts. Role membership alone is insufficient; task/mission/intent and execution +limits also narrow the request. Require original subject and target task current +intent/status checks. Apply r2 §8 recipient/subject-bounded delegation and recorded +change checks, with approved outcomes and exact current references. Artifact basis +is evidence only. Delegations are direct declared simulation assumptions as specified in §10; +this inspector cannot detect chains hidden in artifacts or omitted from the bundle. + +No message authorizes a change. Missing delegation with a message yields the +message-is-not-authority rule once structural validation succeeds. Other failures +use fixed deterministic original-scope, target-scope, delegation, change, intent +ordering. If all simulation checks pass, return unresolved/unknown-effects with +runtime-reconciliation-required, NOT allowed. No supplied runtime observations +field exists. Echo the original selection unchanged on every admitted proposal. +This is a negative preview, not a real assignment engine or proof of stopping. + +## 6. Canonicalization and precise limits + +Adopt separately named inspector-content-digest/1 for mock registry content only: +sorted keys, compact encoding, ASCII string domain, safe integer values, array order +preserved. No launch fingerprint or full JCS claim. V1–V3 in r2 were independently +recomputed and match. Use 1.5 (not 1.0) for the nonintegral-number V4 test: JavaScript +cannot distinguish numeric 1.0 from 1 after parsing. Reject negative zero and unsafe +integer values. Strict bundle number tokens use integer notation only: reject +fraction/exponent forms and negative zero, bound integer tokens exactly before +Number conversion. This prevents precision loss from hiding unsupported values. +This lexical restriction is an inspector profile rule, not a change to candidate +JSON Schema integer semantics; the differential record validator tests shapes +separately from this strict-input profile. +Non-ASCII mock content refuses unsupported-capability; candidate record and target +paths still use the candidate Unicode/path formats. Validation tests separate schema +validity from the stricter inspector input/canonicalization domain. + +Bounds: file <=1 MiB; each top-level inventory <=256; arrays <=1024; nesting <=32; +strings <=4096 UTF-8 bytes subject to stricter candidate limits. Duplicate JSON keys, +malformed UTF-8, invalid calendar dates, forbidden path characters/segments and +unknown fields refuse. Parser object construction must not invoke prototype setters; +__proto__/constructor keys are ordinary unknown keys, never executable behavior. +Never normalize an invalid path into a permitted one. + +Linux input open: require available O_RDONLY, O_NOFOLLOW and O_NONBLOCK; open the +final component without following its symlink, fstat regular type and bounded size, +read within limit with an extra-byte/truncation check, close in finally. Parent-path +containment is NOT claimed. Missing/symlink/FIFO/nonregular input refuses exit 4. +Do not OR an undefined O_CLOEXEC constant: host Node v26.8.1 exposes none (measured). +No child spawning or close-on-exec guarantee is claimed. The CLI itself never spawns; +verification harness processes are separate test effects. Same-size concurrent file +mutation is not ruled out by size checks: operator/test inputs must remain quiescent. + +## 7. Output and exits — replaces r2 §9 shape + +Closed result fields, emitted on every outcome: +- disclaimer: fixed SYNTHETIC PREVIEW — NO LIVE EFFECTS +- preview: fixed preview: no live registrations or permission grants +- bundleVersion: 1 +- authentication: fixed not-modelled +- declarations: fixed unverified-simulation +- result: allowed | refused | unresolved | invalid +- reason: allowed | invalid-request | missing-state | stale-revision | + not-authorized | unsupported-capability | unsupported-kind | unknown-effects | io-failure +- rule: fixed documented rule identifier or null; never input-derived prose +- selection: null before safe structural validation, otherwise exactly the selected + {agentId, projectId, workspaceId, assignmentRef} supplied by the caller +- operation: null before safe validation, otherwise the validated {name, target} +- proposal: null outside a valid assignment.change input, otherwise + {result, reason, rule, selectedAssignmentRef}, with no allowed result +- diagnostic: null or {byteOffset, inputPath}, each member nullable; offset only for + parse failure, original argv path only for I/O failure, never file contents + +No consulted inventory, global counts, unrelated identities/payloads or raw parser +messages. Text and JSON derive from the same result. JSON is ordinary valid JSON +with the disclaimer field, not a non-JSON preamble. Text escapes control characters +in echoed arguments/targets so diagnostics cannot inject terminal controls. +No time/random data. No output claims authentic publication or real grants. + +Exits: 0 permitted permission preview; 2 malformed/structurally incoherent or +unsupported input; 3 simulated permission refusal or unresolved admission; 4 I/O. +Missing required JSON keys (including execution) are structural: 2 invalid-request. +Absent referenced ordinary records are incoherent: 2 missing-state. Absent declared +mandatory policy/artifact/authorization inputs: 3 missing-state. Existing historical +reference used for current admission: 3 stale-revision. Cycles/duplicates: 2 invalid- +request. These override inconsistent example exits in r2. Refusal is never repaired. + +## 8. Physical paths, toolchain and verification + +Proposed implementation allowlist only: +- scripts/foundation-inspect.mjs (CLI; eventual packages/mosaic) +- scripts/foundation/{strict-json,canonical,resolve}.mjs (pure; eventual packages/config) +- scripts/foundation/validate-record.mjs (test-only differential bridge) +- scripts/foundation/verify-schema.py (verification only) +- scripts/foundation/*.test.mjs and scripts/foundation/fixtures/** +- scripts/test-foundation.sh + +This is not yet a code-write authorization. No root/package-manager files, packages/ +scaffolds, duplicate runtime sources, .pi/extensions, Dewey scripts, roles or config +changes. Pure modules never import live config, filesystem/process/network APIs or +read environment/clock. CLI handles input/output only, with no ambient config lookup. + +Node ESM, zero new runtime dependencies. Record exact tested Node version; proposed +minimum 22 is not evidence of testing every supported version. Host measured 26.8.1; +container source uses node:24-bookworm-slim, not the first CLI's test environment. +No new repository engines pin is inferred. No automatic installation. + +Mandatory verification uses existing explicitly selected Python/jsonschema 4.26.0, +checking pinned schema/checker hashes first. Missing dependency fails, never skips. +The differential bridge compares field-level validation over supported candidate +fixtures plus deterministic mutations, not invocation of check.py as a library. +Keep record-schema verdict distinct from unsupported-kind/profile/graph refusal. +Use calendar/path format semantics from the pinned checker, not string-only tests. + +Unit/CLI tests cover r2 §12 with these overrides. Separate observed fixture/home/cwd/ +data-root roots from harness output. Compare before/after path/type/size/mode/owner/ +inode/content inventories; canaries and static import checks are bounded evidence, +not a sandbox or proof of no reads. No native synchronization or live fleet tests. +Required five repository suites and foundation author checks must remain green. + +## 9. Acceptance and gates + +A1. Positive read and assigned file.change permission previews with coherent records; + deterministic text/JSON, explicit disclaimers and no effects. +A2. Unregistered second workspace/cross-project selection refuses without fallback + or unrelated payload disclosure. +A3. Ownership/reference/duplicate/revision/cycle negatives hit the intended rules. +A4. Required role ceilings and all applicable layers narrow; empty/missing authority, + cross-assignment union and unassigned change refuse. +A5. Encoding, duplicate keys, calendar, path, bounds and unknown-field tests refuse + safely with the documented schema/profile distinction. +A6. Input/observed roots unchanged; no bootstrap, ambient config/credential lookup, + engine, network, installation or migration action. +A7. Cross-lane proposal preserves original selection; requester limits in both + scopes enforced; even fully supplied mock evidence cannot yield allowed. +A8. All output/exit combinations match the closed result contract, including parse + and I/O failure. No raw contents, unrelated metadata or terminal injection. +A9. Jason runs the positive and negative demo and understands the limitation before + any dependent live-registry/runtime increment begins. + +First: Filbert independently reviews the frozen charter and incorporated note at +exact hashes without authorship or edits. Resolve substantive findings as a new +candidate. Then present the reviewed build scope to Jason for implementation +approval; prior map acceptance does not supply it. After authorized implementation, +retain separate author/reviewer roles, serialize shared index use, run all required +checks and obtain owner demo acceptance before dependent work. No automatic push, +issue closure, implementation or next-phase advancement follows from this charter. + +## 10. Candidate 3 corrections — normative overrides for FI-FILBERT-2 + +These rules resolve findings 1–5 and override any remaining inconsistent shorthand +in this charter or the incorporated note. Candidate 2 and its NOT APPROVED verdict +are preserved separately; approval of this revision is not yet established. + +### 10.1 Registration delegation and explicit mock issuer bounds (finding 1) + +Add required top-level `delegationInputs`, an array of at most 256 closed objects: +`{decisionRef, mode, issuerCeiling}`. decisionRef is a candidate recordRef of kind +decision; mode is exactly `direct-declared`; issuerCeiling is candidate restrictions. +No extra fields. Duplicate exact decisionRef entries are structural invalid-request, +exit 2. This is another explicit simulation input, not an accepted record-schema +change or a runtime authority record. Empty array is allowed when none is consulted. +Its ceiling is an unverified stand-in for the referenced decision author's reviewed +delegation ceiling; it proves neither authorship nor actual permission to delegate. + +For each consulted current L2/L3 registration: +1. Check current registration identity, active status, correct agent/owning scope + and required parent registration. Revoked registration: exit 3 not-authorized, + rule registration-revoked. Resolve mandatory scope-role and policy ceilings. +2. delegationRef null explicitly models owner-origin registration under the + declared authorization ID. That is a fixture assumption, not verified owner + issuance. Other mandatory checks/ceilings still apply; null is not a grant. +3. Non-null delegationRef must name a current head decision. Old decision reference: + exit 3 stale-revision, registration-delegation-stale. Its decisionKind must be + delegation and outcome approved; otherwise exit 3 not-authorized, + registration-delegation-not-approved. No new revoked field is invented: changing + the decision head to rejected blocks admission, as does using its old revision. +4. Supported scope is exactly the registration's scope. A broader/other scope is + exit 3 unsupported-capability, registration-delegation-scope-not-modelled. + subjectRefs must be exactly the current agent-definition reference for that + registration's agent and the exact current registration reference. A wrong + recipient/registration is exit 3 not-authorized, registration-delegation-bounds; + additional subject forms are exit 3 unsupported-capability, + registration-delegation-subject-form. No ambiguous pairing of multiple recipients. +5. Require the exact decision's delegationInputs entry. Missing: exit 3 missing-state, + delegation-input-missing. Every delegatedOperation must be in issuerCeiling's + operations; otherwise exit 3 not-authorized, delegation-exceeds-issuer-ceiling. +6. Intersect the role ceiling, optional registration restrictions, delegated + operation set AND the issuerCeiling restrictions (operations, paths, network and + endpoints), then all other L1–L9 layers. No union or skipping the role ceiling. + +Current consulted scope-role/agent-policy/project-policy references must name the +highest declared revision of that registry/id; an older ceiling is exit 3 +stale-revision, policy-ceiling-stale. Historical records may retain exact old refs. +This is currentness within the explicit mock inventory, never live-current proof. + +Apply the same exact delegationInputs/issuer bound check to the proposal's explicit +delegation after its approved kind/outcome/recipient/subject tests. Its issuer +restrictions additionally narrow the requester's calculations in both scopes. +No source of declared authority overrides any required role, policy or assignment. + +Required coherent tests: owner-origin null; approved applicable direct delegation +with file.read permitted; rejected delegation; unrelated plan-approval/acceptance; +wrong recipient; wrong registration; unsupported scope; role allows file.change +but delegated operations/issuer paths do not; missing issuer input; active registration +pointing to an old approved decision whose newer head rejects it; reference updated +to that rejected head; and revoked registration. Each must reach its named gate. + +### 10.2 Structural ownership versus consulted work access (finding 2) + +Structural graph validation uses EACH record's own scope, never the global selected +project. Every task mission must belong to the task's project (project-level mission +or a workspace mission in that project). A mismatch is exit 2 invalid-request, +mission-owning-project-mismatch. Workspace mission parents must be project missions +in their own project; project missions have no parent. Dependencies may structurally +reference tasks in other scopes/projects; they confer no permission or ownership. +Unselected P2 tasks with P2 missions remain valid when the caller selects P1. + +For each actual calculation context (main selection, or requester original/target): +- Consulted tasks/mission/dependency references may target the SAME workspace or + the parent project only. A different workspace of the same project is exit 3 + unsupported-capability, cross-workspace-work-reference-not-modelled. Another + project is exit 3 unsupported-capability, cross-project-work-reference-not-modelled. + Apply these refusals even if that agent has another registration there. The first + slice deliberately does not model additional cross-scope visibility contexts. + Do not inspect that referenced work's status/restrictions for admission or silently + omit the reference from readiness checks. Structural existence/type checks are + distinct and operate on the supplied synthetic inventory, not live private data. +- References within the supported relation require work.read in the caller's full + applicable L1–L9 intersection, as well as the requested operation. Otherwise exit 3 + not-authorized, consulted-work-not-readable. The parent-project registration and + policy are already mandatory layers, as are the acting workspace restrictions. + The calculator may combine supplied mock restrictions to derive this intersection; + it returns no referenced bodies and does not claim authentic private-record access. +- Dependencies of a task used for file.change or proposal requester authority must + be accepted. Otherwise exit 3 not-authorized, dependency-not-accepted. A reference + rejected by the scope guard cannot be skipped because its status says accepted. + Taskless work.read/file.read does not traverse unrelated tasks or their dependencies. +- Apply the same reference-access rules when the proposal checks its subject/target + work: original requester context for the subject; target requester context for + the target. Dependency refs never become extra assignments or execution authority. + +Tests: local workspace mission/dependency permitted with work.read; parent project +mission permitted; work.read removed while file.change remains; W1 task referring +to W2 mission or accepted dependency while agent registered only W1; same case even +with W2 registration (still unsupported in this slice); cross-project dependency; +and independent P2 task/mission inventory under a P1 selection, which must not fail +merely because it is unselected. All outputs remain body-free. + +### 10.3 Direct assumptions, not hidden-chain detection (finding 3) + +The model supports only the direct-declared delegationInputs form in §10.1. There is +NO claim to detect a chain concealed behind an artifact, a declaration or an omitted +record. A decision subject reference to another decision is not automatically a +parent-delegation edge. Historical subject references retain their defined meaning. +No artifact body is read and artifact presence is not authentic authority. + +An input adding parentDelegationRef or another undocumented field fails the closed +shape rule: exit 2 invalid-request. A mode other than direct-declared likewise fails +shape; it is not a successfully detected hidden chain. A valid direct declaration +with opaque artifact pointers is checked as a declared assumption and cannot prove +absence of chaining. Test these three distinctions explicitly. Proposal success +remains unreachable, even when all direct simulation checks pass. + +### 10.4 Fixed graph sub-order and fixture reachability (finding 4) + +Global order: input bounds/lexical parsing; closed shapes/profile/supported kinds; +identity index and duplicate checks; structural reference existence/type; cycles +(task.dependencies, then mission.parentMissionRef, then supersedes); revision-chain +continuity; per-record ownership/parent-scope checks; supported operation selection; +then context binding/current-head, work-scope guards and ordered admission checks. +Within a stage use stable kind/id/scope/revision and field ordering, not input order. +Use the documented missing-declaration/current-admission exit exceptions in §7. + +Schema-valid workspace mission self-parent and revision-2 self-supersedes fixtures +must hit their cycle rule BEFORE parent-scope or predecessor-continuity refusal. +Use separate detector unit tests and CLI-precedence tests. Never count an earlier +schema/ownership rejection as demonstrated cycle-detector coverage. Missing required +policy/artifact/authorization declarations are admission failures at their documented +stage, not swallowed by the ordinary-record structural missing-reference rule. + +### 10.5 Differential corpus and platform boundary additions (finding 5) + +Add scalar type substitution; every null-versus-absent branch; integer min/max, +boolean-versus-integer and numeric 1.0 schema cases; nested object-order-insensitive +uniqueItems comparisons; BMP/non-BMP code-point length boundaries; UTF-8 byte-path +boundaries; and escaped surrogate cases. Schema verdict and strict bundle/profile +verdict are separate expected columns. Strict bundle strings reject unpaired escaped +surrogates as profile-invalid; this is not an assertion about unformatted candidate +JSON Schema strings. A passing finite corpus is compatibility evidence, not proof +of complete schema equivalence. Actual Node versions tested must be reported. +O_RDONLY availability checks use presence/type, not truthiness: its valid value is 0. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-build-admission-findings.md b/docs/plans/reviews/2026-09-06_foundation-inspector-build-admission-findings.md new file mode 100644 index 00000000..1139fd69 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-build-admission-findings.md @@ -0,0 +1,82 @@ +# FI-ROCKO-4 — build admission findings before independent code review + +Coordinator: darkwing. Build report SHA-256 verified: +857470d97af6aeae4e7d7942c2a1d8455bfcda74ff68b8e1dc4ba8d066521fa4. +These are coordinator admission findings, not Filbert's independent code verdict. +No new CLI/test code has been executed by darkwing in this admission check. + +## C1 — resolve the advertised candidate identity mismatch + +Of 35 explicit file rows checked, 34 match. Both fixture-tree manifest hashes and +counts match (185 bundles; 19 raw files). The demo file +scripts/foundation/fixtures/demo/prop-message-is-not-authority.json differs from +the report's advertised digest: +- Report: f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548fc023378fd8ab +- Measured: f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab + +Confirm whether this is a transcription error or unexpected file drift. Do not +silently regenerate/overwrite evidence to make a hash match. Return a corrected, +complete per-file machine-readable manifest for the next candidate, including modes. +The initial manifest-verification attempt stopped at this mismatch; it did not +produce a completed coordinator manifest. A subsequent table audit confirmed the +single mismatch above and both matching aggregate tree manifests. + +## C2 — differential verification cannot silently waive disagreements + +verify-schema.py:427–435 accepts six KNOWN_DIVERGENCES and fails if they disappear. +The charter incorporates a required oracle where disagreements fail, separating +schema verdict from legitimate strict-profile limitations. No six-exception waiver +was requested or approved. Reporting those reproduced mismatches as PASS is not +satisfaction of that gate. The report itself identifies years 0001–0999 accepted +by Node but rejected by the pinned format checker, plus trailing-newline cases. + +Make the shape validator and oracle faithful to the pinned contract, with strict +input/profile behavior independently verified. Do not relax safe input handling +merely to turn counts green. If a charter/source-format conflict requires a policy +choice, return a precise proposed amendment and witness; do not implement your own +waiver or change the pinned schema/checker. A finite corpus remains limited even +when it has no unapproved disagreements. + +## C3 — serialized output adds a field outside the closed charter + +Charter §7 lists the closed emitted result fields, with no exit field. CLI +renderJson(r) serializes the result directly; renderText(r) emits an exit line; +main uses result.exit. The report calls the result closed but describes RESULT_KEYS +from the implementation, not a check against the independent charter field list. + +Keep process exit metadata separate from the serialized result, or return a proposed +charter amendment instead of changing the external contract implicitly. Add tests +whose expected output keys come from the approved contract, not solely from an +implementation-exported key list. + +## C4 — before/after demo evidence must preserve the original digest + +Report §9 step 2 recomputes hashes independently inside each process substitution; +both checks compare files to their own current values. That cannot establish +unchanged bytes across the operation. Preserve a before manifest in a separate +scratch location, execute the preview, then verify against that SAME manifest. +Existing suite observations may remain useful; correct the owner-demo receipt. + +## C5 — report/code flag discrepancy + +The report says the open flags are O_RDONLY|O_NOFOLLOW only. Actual reviewed CLI +readBundleBytes includes O_NONBLOCK and checks its numeric availability. Correct +the report; do not remove the required flag to match its prose. This finding is +about receipt accuracy, not evidence that a FIFO actually blocked. + +## Authorized correction and return + +First reconcile C1, then fix C2–C5 only under the existing FI-ROCKO-3 source/test +allowlist. Preserve the original report; new allowed report/manifest paths are: +- docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r2.md +- docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r2.json + +Return FI-ROCKO-4 with per-finding dispositions, exact hashes, all required tests +and any unresolved specification decision. Freeze the resulting candidate for +Filbert. No staging, commit, push, new runtime dependencies, live environment, +credential or native/sync work. The shared index remains outside this assignment. +Do not edit charter, existing schemas, prior verdicts or coordinator records. + +Transport (2026-09-06 18:17 UTC): FI-ROCKO-4 sent once to =rocko/mosaic-fleet; +exit 0, delivered. Await corrected manifest/test receipts or spec blocker. +Follow-up darkwing; no timer or automatic acceptance. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-charter-candidate2.md b/docs/plans/reviews/2026-09-06_foundation-inspector-charter-candidate2.md new file mode 100644 index 00000000..358b1841 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-charter-candidate2.md @@ -0,0 +1,270 @@ +# Foundation synthetic inspector — frozen charter candidate 2 + +Issue: #53. Author/integrator: darkwing. Feasibility contributor: rocko. +Independent reviewer: filbert, pending exact-candidate review. +Status: proposed implementation contract, NOT permission to implement. +Jason authorized continuation of planning after accepting the reviewed map. +No source changes, migration, publication, push or live fleet activity authorized. + +## 1. Bound inputs and interpretation + +Accepted map/handoff: commit 7345f330fc6bfae5aa1d896c78cfb7cbe62efbae. +Source/plan baseline: d4696d09eb1b5dcf1028f30db2cd63735f51cb16. +Map verdict: FM-FILBERT-1, SHA-256 +6b08c6fac0718d3db527cf9ffbfab49407e7b289d09782f5d1d0e26493eaabb3. +That approval does not cover this new charter. + +Detailed incorporated specification: sections 5–13 of +reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md, +SHA-256 f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1. +The explicit corrections/decisions below override that note. Its other sections +are contributor rationale/history, not normative repository facts. Original r1 +and the FI-ROCKO-2 corrections remain history, not alternate specifications. +Any ambiguity or contradiction discovered at implementation is a charter defect +to resolve, not permission for a coder to guess or weaken refusal rules. + +Candidate records.schema.json SHA-256: +05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6. +Candidate check.py SHA-256: +82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607. +Both resolve under docs/plans/foundation-v1-candidate at d4696d09. + +## 2. Deliverable and non-goals + +One local CLI over an explicitly supplied synthetic bundle, with deterministic +text and JSON previews of selected agent/project/workspace permission. No cwd +inference of scope, live registry, config bootstrap, account lookup, engine launch, +assignment mutation or real permission grant. Every result, including parser/I/O +failures, says SYNTHETIC PREVIEW — NO LIVE EFFECTS and authentication: not-modelled. + +Implemented operations: work.read (null target), file.read/file.change (logical +workspace-relative target), and assignment.change as a negative/unresolved check +only. The other 25 known catalog names return unsupported-capability, exit 2. +Unknown names return invalid-request, exit 2. No assignment-change success path. +No execution.stop operation is invented; the catalog contains execution.control. +No general RPC, sandbox, authentication, command audit, stopping, durability, +legacy adoption, OAuth refresh or extension integration is delivered. + +Operator supplies synthetic files only. The CLI reads just that explicit input, +never discovers credentials/config. It cannot know whether arbitrary operator- +selected file bytes contain secrets before reading them; this is not a general +credential-read prevention boundary. Never pass credentials or live records to it. +Tests and agents are not authorized to access such files. + +## 3. Input, identity and graph rules + +Use the closed bundle/selection/registry/artifact/authorization shapes in r2 §5, +subject to the proposal and output overrides below. All fields shown there are +required except message. proposal is explicitly null outside assignment.change; +assignment.change requires non-null proposal and null operation.target. The +subjectAssignmentRef must exactly equal selection.assignmentRef; selection agent, +project and workspace must match that assignment. Never infer a different subject. + +Eight supported record kinds: agent-definition, project, workspace, registration, +mission, task, assignment and decision. Other candidate kinds refuse unsupported- +kind. Candidate record shapes remain unchanged; simulation-specific fields exist +only in the enclosing bundle, never appended to accepted records. + +Record references are kind/id/scope/revision, WITHOUT digest. Registry references +include registry/id/revision/digest. Artifact references and authorization IDs +match declared simulation inputs; their presence proves neither publication +permission, authentication, authentic evidence nor current real-world authority. +Decision approvals are evaluated as synthetic fixture facts, not verified signatures. +Missing declarations refuse; no flag can turn them into actual authenticated facts. + +Reject duplicate record identities, duplicate registry identities even with different +digests, duplicate artifact identities (runId/artifactId) even with different digests, +and duplicate authorization IDs. Do not choose one of ambiguous registrations: +more than one current active registration for the same agent/scope refuses ambiguity. + +Revision rules: complete contiguous history from 1, or a single revision-1 record. +Structural references on every revision must resolve. Apply head/current-admission +checks only to head records used for this calculation and their consulted chain; +historical records do not fail merely because their then-current refs are now old. +Explicit historical supersedes/decision subject references may name existing old +revisions. Current selected intent/task/mission/registration/delegation/proposal +refs must name heads; no invented predecessor, repair or fallback. + +Cycle checks cover task.dependencies, mission.parentMissionRef and supersedes as +separate edge relations. Before tests are counted, show that each fixture reaches +the intended rule rather than failing an earlier shape error. Workspace ownership, +mission parent scope and registration parent match the accepted schema/README. +Dependencies grant no ownership/access. A selected task's same-project dependencies +must be accepted to permit file.change; another project's dependency never lends +permission. Broader dependency execution semantics are unsupported in this slice. + +## 4. Mandatory policy and assignment calculation + +Adopt r2 §7 L1–L9: enabled agent ceiling, both active registrations each bounded by +its mandatory scope-role ceiling, required project and workspace policy, exact +assignment/task/intent checks, applicable task/mission narrowing and an explicit +simulation execution layer. Workspace policy never falls back to a scope role. +Null optional restrictions mean no additional narrowing; missing required ceiling +never means unrestricted. Empty operations/path grants mean none. Exactly one +selected assignment contributes; no union across assignments. + +Selected project/workspace must be active. Assignment is selected, belongs to the +selected agent and workspace, and binds the selected task. Task is ready/active, +with approved current plan-approval intent whose subjects include that exact task. +Assignment intent is an approved current plan-approval, delegation or assignment- +change decision covering the task/assignment. An unrelated approved acceptance +or owner-checkpoint decision is not a substitute. Mission chain must be active. +Taskless work.read/file.read skips assignment/task/mission only when assignmentRef +is explicitly null. Supplying an invalid assignment never falls back to taskless. + +Paths use logical workspace roots and component-prefix intersection, never raw +string prefixes or physical filesystem traversal. Network restrictions are parsed +and intersected but no network operation is implemented or performed. + +## 5. Reassignment negative check — tightened requester context + +Extend r2 §5 proposal with required requesterContexts, a closed object: +- original: {assignmentRef, execution} +- target: {assignmentRef, execution} +Each assignmentRef is non-null recordRef; execution uses the same mandatory +selection.execution shape. No extra keys. Original scope derives from the subject +assignment; target scope derives from targetTaskRef. Both requester contexts belong +to requesterAgentId and the corresponding scope, not the subject agent. + +Apply L1–L9 to the requester in BOTH scopes for assignment.change, using those +contexts. Role membership alone is insufficient; task/mission/intent and execution +limits also narrow the request. Require original subject and target task current +intent/status checks. Apply r2 §8 recipient/subject-bounded delegation and recorded +change checks, with approved outcomes and exact current references. Artifact basis +is evidence only. Unmodelled delegation chains refuse unsupported-capability. + +No message authorizes a change. Missing delegation with a message yields the +message-is-not-authority rule once structural validation succeeds. Other failures +use fixed deterministic original-scope, target-scope, delegation, change, intent +ordering. If all simulation checks pass, return unresolved/unknown-effects with +runtime-reconciliation-required, NOT allowed. No supplied runtime observations +field exists. Echo the original selection unchanged on every admitted proposal. +This is a negative preview, not a real assignment engine or proof of stopping. + +## 6. Canonicalization and precise limits + +Adopt separately named inspector-content-digest/1 for mock registry content only: +sorted keys, compact encoding, ASCII string domain, safe integer values, array order +preserved. No launch fingerprint or full JCS claim. V1–V3 in r2 were independently +recomputed and match. Use 1.5 (not 1.0) for the nonintegral-number V4 test: JavaScript +cannot distinguish numeric 1.0 from 1 after parsing. Reject negative zero and unsafe +integer values. Strict bundle number tokens use integer notation only: reject +fraction/exponent forms and negative zero, bound integer tokens exactly before +Number conversion. This prevents precision loss from hiding unsupported values. +This lexical restriction is an inspector profile rule, not a change to candidate +JSON Schema integer semantics; the differential record validator tests shapes +separately from this strict-input profile. +Non-ASCII mock content refuses unsupported-capability; candidate record and target +paths still use the candidate Unicode/path formats. Validation tests separate schema +validity from the stricter inspector input/canonicalization domain. + +Bounds: file <=1 MiB; each top-level inventory <=256; arrays <=1024; nesting <=32; +strings <=4096 UTF-8 bytes subject to stricter candidate limits. Duplicate JSON keys, +malformed UTF-8, invalid calendar dates, forbidden path characters/segments and +unknown fields refuse. Parser object construction must not invoke prototype setters; +__proto__/constructor keys are ordinary unknown keys, never executable behavior. +Never normalize an invalid path into a permitted one. + +Linux input open: require available O_RDONLY, O_NOFOLLOW and O_NONBLOCK; open the +final component without following its symlink, fstat regular type and bounded size, +read within limit with an extra-byte/truncation check, close in finally. Parent-path +containment is NOT claimed. Missing/symlink/FIFO/nonregular input refuses exit 4. +Do not OR an undefined O_CLOEXEC constant: host Node v26.8.1 exposes none (measured). +No child spawning or close-on-exec guarantee is claimed. The CLI itself never spawns; +verification harness processes are separate test effects. Same-size concurrent file +mutation is not ruled out by size checks: operator/test inputs must remain quiescent. + +## 7. Output and exits — replaces r2 §9 shape + +Closed result fields, emitted on every outcome: +- disclaimer: fixed SYNTHETIC PREVIEW — NO LIVE EFFECTS +- preview: fixed preview: no live registrations or permission grants +- bundleVersion: 1 +- authentication: fixed not-modelled +- declarations: fixed unverified-simulation +- result: allowed | refused | unresolved | invalid +- reason: allowed | invalid-request | missing-state | stale-revision | + not-authorized | unsupported-capability | unsupported-kind | unknown-effects | io-failure +- rule: fixed documented rule identifier or null; never input-derived prose +- selection: null before safe structural validation, otherwise exactly the selected + {agentId, projectId, workspaceId, assignmentRef} supplied by the caller +- operation: null before safe validation, otherwise the validated {name, target} +- proposal: null outside a valid assignment.change input, otherwise + {result, reason, rule, selectedAssignmentRef}, with no allowed result +- diagnostic: null or {byteOffset, inputPath}, each member nullable; offset only for + parse failure, original argv path only for I/O failure, never file contents + +No consulted inventory, global counts, unrelated identities/payloads or raw parser +messages. Text and JSON derive from the same result. JSON is ordinary valid JSON +with the disclaimer field, not a non-JSON preamble. Text escapes control characters +in echoed arguments/targets so diagnostics cannot inject terminal controls. +No time/random data. No output claims authentic publication or real grants. + +Exits: 0 permitted permission preview; 2 malformed/structurally incoherent or +unsupported input; 3 simulated permission refusal or unresolved admission; 4 I/O. +Missing required JSON keys (including execution) are structural: 2 invalid-request. +Absent referenced ordinary records are incoherent: 2 missing-state. Absent declared +mandatory policy/artifact/authorization inputs: 3 missing-state. Existing historical +reference used for current admission: 3 stale-revision. Cycles/duplicates: 2 invalid- +request. These override inconsistent example exits in r2. Refusal is never repaired. + +## 8. Physical paths, toolchain and verification + +Proposed implementation allowlist only: +- scripts/foundation-inspect.mjs (CLI; eventual packages/mosaic) +- scripts/foundation/{strict-json,canonical,resolve}.mjs (pure; eventual packages/config) +- scripts/foundation/validate-record.mjs (test-only differential bridge) +- scripts/foundation/verify-schema.py (verification only) +- scripts/foundation/*.test.mjs and scripts/foundation/fixtures/** +- scripts/test-foundation.sh + +This is not yet a code-write authorization. No root/package-manager files, packages/ +scaffolds, duplicate runtime sources, .pi/extensions, Dewey scripts, roles or config +changes. Pure modules never import live config, filesystem/process/network APIs or +read environment/clock. CLI handles input/output only, with no ambient config lookup. + +Node ESM, zero new runtime dependencies. Record exact tested Node version; proposed +minimum 22 is not evidence of testing every supported version. Host measured 26.8.1; +container source uses node:24-bookworm-slim, not the first CLI's test environment. +No new repository engines pin is inferred. No automatic installation. + +Mandatory verification uses existing explicitly selected Python/jsonschema 4.26.0, +checking pinned schema/checker hashes first. Missing dependency fails, never skips. +The differential bridge compares field-level validation over supported candidate +fixtures plus deterministic mutations, not invocation of check.py as a library. +Keep record-schema verdict distinct from unsupported-kind/profile/graph refusal. +Use calendar/path format semantics from the pinned checker, not string-only tests. + +Unit/CLI tests cover r2 §12 with these overrides. Separate observed fixture/home/cwd/ +data-root roots from harness output. Compare before/after path/type/size/mode/owner/ +inode/content inventories; canaries and static import checks are bounded evidence, +not a sandbox or proof of no reads. No native synchronization or live fleet tests. +Required five repository suites and foundation author checks must remain green. + +## 9. Acceptance and gates + +A1. Positive read and assigned file.change permission previews with coherent records; + deterministic text/JSON, explicit disclaimers and no effects. +A2. Unregistered second workspace/cross-project selection refuses without fallback + or unrelated payload disclosure. +A3. Ownership/reference/duplicate/revision/cycle negatives hit the intended rules. +A4. Required role ceilings and all applicable layers narrow; empty/missing authority, + cross-assignment union and unassigned change refuse. +A5. Encoding, duplicate keys, calendar, path, bounds and unknown-field tests refuse + safely with the documented schema/profile distinction. +A6. Input/observed roots unchanged; no bootstrap, ambient config/credential lookup, + engine, network, installation or migration action. +A7. Cross-lane proposal preserves original selection; requester limits in both + scopes enforced; even fully supplied mock evidence cannot yield allowed. +A8. All output/exit combinations match the closed result contract, including parse + and I/O failure. No raw contents, unrelated metadata or terminal injection. +A9. Jason runs the positive and negative demo and understands the limitation before + any dependent live-registry/runtime increment begins. + +First: Filbert independently reviews the frozen charter and incorporated note at +exact hashes without authorship or edits. Resolve substantive findings as a new +candidate. Then present the reviewed build scope to Jason for implementation +approval; prior map acceptance does not supply it. After authorized implementation, +retain separate author/reviewer roles, serialize shared index use, run all required +checks and obtain owner demo acceptance before dependent work. No automatic push, +issue closure, implementation or next-phase advancement follows from this charter. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-code-review-gates.md b/docs/plans/reviews/2026-09-06_foundation-inspector-code-review-gates.md new file mode 100644 index 00000000..ba990680 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-code-review-gates.md @@ -0,0 +1,65 @@ +# Synthetic inspector code-review and owner-demo gates + +Coordinator: darkwing. Code writer: rocko. Independent reviewer: filbert. +Task: FI-ROCKO-3. Status: checklist prepared; no code candidate received or approved. +Charter identity: 19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6. +This is verification preparation under the authorized build, not another specification. + +## Candidate admission + +- Receive exact path list, file hashes, integration HEAD and test receipts. +- Verify charter/note/schema identities and compare every changed path with the + approved allowlist. Preserve Dewey's changes; never blanket-stage or reset. +- Inspect source and test commands before executing the new code. No native/sync, + credential, live-state or network experiments. A temporary HOME alone is not an + OS sandbox; apply the charter's explicit bounded-evidence qualifications. +- Freeze a content-hash manifest for the full code/fixture/test candidate. Do not + call moving work independently reviewed. Recheck Filbert's assignment compatibility + and non-authorship before the full review request. + +## Required review evidence by acceptance group + +| Group | Evidence required, not just a green aggregate | +|---|---| +| A1 | Coherent positive read and assigned-change previews; exact text/JSON outputs, disclaimers, no physical change | +| A2 | Missing workspace registration and cross-project selection refusals; no fallback or unrelated payload output | +| A3 | Named first-failure results for duplicate/reference/ownership/revision/cycle fixtures; detector and CLI coverage distinct | +| A4 | All mandatory ceilings and optional restrictions; role/issuer/delegated-operation narrowing; no cross-assignment union | +| A5 | Strict parser and separate schema/profile corpus: duplicate keys, numeric tokens, type/null/bounds/Unicode/calendar/path cases | +| A6 | Static import/I/O inspection, descriptor checks, fixture/observed-root inventory comparison, no ambient bootstrap or live lookup | +| A7 | Both requester contexts and intent/delegation checks; direct-assumption limits; original selection preserved; allowed reassignment unreachable | +| A8 | Every output/exit class including pre-validation and I/O errors; body-free diagnostics, escaped terminal data, stable ordering | + +Oracle verification must be mandatory, version-recorded and pinned to the accepted +schema/checker. Missing dependency is a blocker, never a skip. Compare schema shape +validity separately from profile/unsupported-kind/graph/admission outcomes. + +Run the foundation checker and all five repository suites against the measured +integration candidate, reporting unrelated concurrent changes separately. Existing +charter-review shape probes are not code tests. No raw test counts substitute for +coverage of the named failure paths. Finite tests do not prove complete schema +conformance, absence of all reads, containment, authentic delegation or crash safety. + +## Independent verdict + +Filbert must receive the exact candidate manifest, source baseline, charter/note +hashes, writer receipts and this checklist. He returns an independent verdict with +findings, actual commands/results and untested limits. Darkwing reconciles findings; +Rocko alone fixes owned code, then a newly hashed candidate is re-reviewed. +Neither writer nor coordinator substitutes for the independent verdict. + +## Owner demo (A9), only after verified code + +Use only the delivered coherent synthetic examples and actual verified CLI syntax: +1. Show the selected agent/project/workspace and a permitted read preview. +2. Show an assigned file-change permission preview; demonstrate no file was changed. +3. Select the unregistered workspace and show a refusal without fallback. +4. Preview cross-lane reassignment: the original assignment remains selected and + even fully supplied mock declarations cannot produce a real change or allowed result. +5. Ask Jason whether the selection/refusal display and no-live-effects disclaimer + are clear, and whether he accepts this increment. Record his answer separately. + +Do not invent demo commands before the writer returns the implemented interface. +No dependent live-registry/runtime increment starts before Jason's acceptance. +No push, migration or issue closure follows automatically. Shared-index/commit +coordination remains separate from code delivery and reviewer approval. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-code-review-request.md b/docs/plans/reviews/2026-09-06_foundation-inspector-code-review-request.md new file mode 100644 index 00000000..30835c5d --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-code-review-request.md @@ -0,0 +1,83 @@ +# FI-FILBERT-6 — full independent inspector CODE review + +Owner authorized Rocko's implementation, Filbert's independent code review and a +later owner demo. Author: rocko. Coordinator/follow-up: darkwing. Reviewer: filbert. +Check current assignment compatibility and confirm no code authorship; do not +replace another owner assignment. Earlier charter/addendum review is not code review. + +## Exact frozen candidate + +Repository: /home/jwoltje/src/mosaic-stack-dev-test +Integration HEAD: 9a5fbdbda74b16adf488fe28138b2ba69ea5e669 +Pinned source/schema baseline: d4696d09eb1b5dcf1028f30db2cd63735f51cb16 +Accepted map: 7345f330fc6bfae5aa1d896c78cfb7cbe62efbae + +Code is uncommitted and bound by the machine-generated manifest, not falsely +claimed to exist at the integration HEAD: +- docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r3.json + SHA-256 3c2253b6c9f31e448c77aaac53977d41baecfb30e15845dcfffd8dc694428547 +- docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r3.md + SHA-256 ec0444c94c9caf16472fdba1ff3fbc767dffd1a798b9a2da837598c9f4b25508 + +Coordinator verified all 294 files, exact allowlist/no extra implementation files, +file modes/sizes/hashes, aggregates, pinned inputs and measured HEAD. This is identity +verification, not independent execution of the writer's tests. + +Governing charter: docs/plans/2026-09-06_foundation-inspector-charter.md +SHA-256 19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6 +Reviewed addendum: reviews/2026-09-06_foundation-inspector-pattern-profile-addendum.md +SHA-256 afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5 +Its verdict: reviews/2026-09-06_foundation-inspector-pattern-profile-verdict.md +SHA-256 03c979b77cc6b03b6685ba51ed1ce24c3f1d7b274ce8f772263a103670050da7 +Incorporated Rocko r2 feasibility hash: f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1. +Review gates: docs/plans/reviews/2026-09-06_foundation-inspector-code-review-gates.md. + +## Required scope + +Review ALL implementation/CLI/parser/canonicalizer/validator/resolver paths and +the oracle, generators, tests and evidence—not only the last regex fix. Compare +against the independent charter/addendum, not just code-exported constants or +writer-selected fixture expectations. Verify A1–A8 and §§10.1–10.5. Challenge +claim/reference/history/scoped registration/issuer/task/mission/intent/execution +intersections, proposal branches and identity/privacy handling. + +Specifically verify genuine schema compatibility and strict production profile +before graph admission, with zero schema disagreements and no waiver/normalization. +Check all typed occurrences, positive free-text controls and pre-validation nulls. +Confirm no reassignment success branch, extra serialized fields or tautological +before/after evidence checks. Revisit prior admission findings C1–C5 against r3, +not the earlier red candidates. Their original reports remain historical. + +Inspect source/test commands before executing new code. Run relevant checks in a +disposable isolated export containing only pinned required baseline inputs, exact +candidate files and bound planning inputs; hash those copies before execution. +Do not run fixture regeneration against the frozen shared tree. Use synthetic +HOME/cwd/data only. A temporary HOME alone is not OS containment; report actual +limits. No credentials, live data, native/sync/installation or ~/.mosaic tests. +No dependency installation or implicit network. Stop rather than improvise around +an unavailable verification dependency or suspicious out-of-scope effect. + +Writer reports: 63 Node tests, 43 selftest checks, oracle 1539-record corpus with +zero schema disagreements and independent profile refusals, foundation checker and +five repository suites green. These are writer receipts until independently rerun. +Record your actual commands, versions, exit codes, output and unexecuted limits. + +## Verdict and write boundary + +Only allowed repository write: +docs/plans/reviews/2026-09-06_foundation-inspector-code-verdict.md. +Do not fix/co-author code, mutate fixtures/charter, edit shared logs/CURRENT, stage, +commit, checkout/reset or push. Any test/reproduction scratch must remain isolated. +Return FI-FILBERT-6 APPROVED/NOT APPROVED for the exact manifest and contract hashes, +with numbered blocking/nonblocking findings, source locations, concrete witnesses, +required corrections, acceptance dispositions and independently measured limits. +Include verdict SHA-256. Recheck candidate identities before verdict; drift blocks +approval. If assignment compatibility fails, return a blocker instead of retasking. + +No owner-demo, runtime security, real permission grant or full Archify acceptance +is implied by code review. No dependent work starts automatically. Direct tagged +reply is the return mechanism; follow-up darkwing; no deadline or automatic timer. + +Transport (2026-09-06 21:30 UTC): FI-FILBERT-6 sent once to =filbert/default, exit 2, +unconfirmed. Follow-up darkwing; reconcile the declared verdict artifact and direct +reply on next invocation. No timer, blind retry or automatic approval. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-code-verdict.md b/docs/plans/reviews/2026-09-06_foundation-inspector-code-verdict.md new file mode 100644 index 00000000..5c2ea279 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-code-verdict.md @@ -0,0 +1,311 @@ +# FI-FILBERT-6 — independent CODE verdict: NOT APPROVED + +Reviewer: filbert. Author: rocko. Coordinator/follow-up: darkwing. +Date: 2026-09-06. Authority: the exact FI-FILBERT-6 request under Jason's authorization. + +No competing assignment is known. I have not authored the implementation. This is +review of the full frozen inspector candidate, not just the regex correction. +The supplied tests pass, but independent adversarial CLI witnesses expose failures +of reference completeness, work-access narrowing, revision handling and specified +first-failure ordering. No real permission grant or runtime exploit is claimed. + +## 1. Exact subject and admission + +| Input | SHA-256 / commit | +|---|---| +| `2026-09-06_foundation-inspector-rocko-build-manifest-r3.json` | `3c2253b6c9f31e448c77aaac53977d41baecfb30e15845dcfffd8dc694428547` | +| `2026-09-06_foundation-inspector-rocko-build-r3.md` | `ec0444c94c9caf16472fdba1ff3fbc767dffd1a798b9a2da837598c9f4b25508` | +| Charter candidate 3 | `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` | +| Incorporated feasibility r2, §§5–13 subject to overrides | `f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1` | +| Pattern/profile addendum | `afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5` | +| Addendum verdict | `03c979b77cc6b03b6685ba51ed1ce24c3f1d7b274ce8f772263a103670050da7` | +| `records.schema.json` | `05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6` | +| `check.py` | `82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607` | +| Source/schema baseline | `d4696d09eb1b5dcf1028f30db2cd63735f51cb16` | +| Accepted map | `7345f330fc6bfae5aa1d896c78cfb7cbe62efbae` | +| Measured integration HEAD | `9a5fbdbda74b16adf488fe28138b2ba69ea5e669` | + +Report/manifest paths above are under `docs/plans/reviews/`. Code is uncommitted; +HEAD alone is not its identity. I independently verified all 294 distinct regular +files, modes, sizes, hashes, the exact implementation allowlist with no extras, +all six aggregates and every pinned input before execution. Source baseline +package bytes were exported from the committed baseline, not mutable extensions. + +Final recheck at **2026-09-06T21:49:22Z** verified the same identities in both the +shared tree and isolated export, and the same HEAD. No candidate drift found. +The all-candidate aggregate is +`e5f9039cf4614e8acc3f6c6a71f0a03dbc1c29002703029180d1ccef5757979c`. + +## 2. Numbered findings and required dispositions + +All source locations below refer to the frozen `scripts/foundation/resolve.mjs` +(SHA-256 `eaa4a419618328915cd470ba192a88b8d313ee8fa48f600289ffe39df15280b2`) +unless another file is named. Witnesses use copies of the frozen demos; no shared +fixture was edited. `B` means `fixtures/demo/demo-file-change-src.json`; `P` means +`fixtures/demo/demo-change-w1.json`, under `scripts/foundation/`. + +### F1 — BLOCKING / high: referenced declarations are incompletely enforced + +Locations: `checkStructuralReferences`, lines 1043–1083; `computeContext`, +1324–1347 and 1403–1407; declaration helpers at 1213 onward. +Contract: charter §3 and incorporated r2 §6.2 require exact registry-reference +resolution and declared authorization inputs; charter §§7/10.4 preserve the +special admission-stage missing-declaration exits. + +Two independent witnesses: + +- From B, remove registry declarations whose registry is `harness`, `settings` + or `context-content`, leaving the agent's references intact. Actual: **exit 0, + allowed**. These references are shape-checked but never resolved. +- From B, set `task-w1-dep.authorizationRef` to the undeclared, well-formed UUID + `00000000-0000-4000-8000-000000000099`. Actual: **exit 0, allowed**. The dependency + is consulted and its accepted status used, but its authorization is not checked. + Required result is a missing-state refusal, not an allowed preview; the + authorization case has the charter's exit-3 admission exception. + +Required correction: enforce the applicable exact declaration checks, including +consulted dependencies, without turning missing declarations into unrestricted +facts or swallowing their documented admission exits. Add independent negatives +for absence and mismatched references, not just missing policy ceilings. + +### F2 — BLOCKING / high: task-only contexts evade required `work.read` + +Locations: `computeContext` lines 1354–1356, 1385–1417; +`checkWorkAccess` lines 1426–1434. +Contract: charter §10.2 requires work.read for consulted task references within +the supported workspace/project relation, in the full applicable intersection. + +- From B, clear the selected task's `missionRef` and `dependencies`. Set execution + restrictions to operations `["file.change"]`, readPaths `[]`, writePaths + `[{"root":"workspace","path":null}]`, network `none`, endpointRefs `[]`. + Actual: **exit 0, allowed**, despite consulting the assigned task without + work.read. The boolean `consultedWork` is set only for missions/dependencies, + not the task bound by the assignment. +- From P, clear every task's mission/dependency references and set both requester + execution restrictions to operations `["assignment.change"]`, empty paths, + network `none`, no endpoints. Actual: **exit 3, unresolved / + runtime-reconciliation-required**, rather than consulted-work-not-readable. + `checkWorkAccess` similarly conditions work.read on the task having other refs. + +Required correction: distinguish genuinely taskless reads from calculations +which consult a task. Require work.read for the latter, including proposal +subject/target work, even when that task has no mission or dependency. + +### F3 — BLOCKING / high: proposal issuer narrowing does not recheck work access + +Locations: `evaluateProposal`, lines 1504–1535 and 1555–1563. +Contract: charter §10.1 says the explicit delegation issuer's restrictions +additionally narrow the requester calculations in **both** scopes; §10.2 requires +work.read in that full intersection. + +From P, change only `delegationInputs[0].issuerCeiling.operations` to +`["assignment.change"]`. Its delegated operation remains within the issuer ceiling, +but the resulting intersection excludes work.read. Original subject work includes +mission/dependency references, so this case does not depend on F2's task-only edge. +Actual: **exit 3, unresolved / runtime-reconciliation-required**. + +The code checks work access before applying the issuer, then checks only +assignment.change against the narrowed layers. Required correction: enforce all +applicable access conditions against the issuer-narrowed contexts, with coherent +negative coverage in both scopes. An unresolved preview must not falsely claim +that all modeled checks passed. + +### F4 — BLOCKING / medium: cycle construction merges distinct historical revisions + +Location: `checkCycles`, lines 1087–1109. +Contract: exact four-field references, contiguous history, and separate edge +relations in charter §3 / §10.4 and incorporated r2 §6.2–6.3. + +The dependency graph keys tasks by identity **without revision** and unions edges +from every historical record. Independent witness: + +- Keep B's revision-1 history: T1 (`task-w1`) depends on D1 (`task-w1-dep`). +- Add contiguous T2 with no dependencies, and D2 depending on T2. +- Add revision 2 of the selected assignment and the two relevant plan decisions; + bind the assignment/selection and plan subjects to the new exact revisions. + Each new record supersedes its own revision 1. All old references still exist. + +All records pass the pinned schema/formats. Independent exact-reference DFS finds +**no cycle** in dependencies, mission parents or supersedes, and independently +asserts contiguous histories. The selected current task T2 has no dependencies. +Actual CLI: **exit 2, invalid-request / dependency-cycle** because the implementation +constructs the different graph T→D→T by discarding revision distinctions. + +Required correction: do not infer cycles by unioning temporally distinct edges. +Preserve the approved exact-reference/history semantics and required cycle-before- +continuity precedence. If a stronger, identity-wide historical prohibition is +intended, obtain an explicit contract ruling instead of silently adding it. + +### F5 — BLOCKING / medium: specified first-failure ordering is not preserved + +Locations: `validateBundleShapeScoped`, approximately 719–733 (before Model's +record sort at 988); `evaluateProposal`, 1504–1541. +Contract: charter §10.4 requires stable kind/id/scope/revision/field ordering within +a stage, not inventory input order; §5 gives missing delegation plus message its +named rule after structural validation. + +1. From B, set `agent-a.payload.status` to an invalid enum and add an unknown + `extra` field to `agent-b.payload`. Forward record inventory yields + **exit 2 / shape-enum-mismatch**. Reverse only the top-level record array: + **exit 2 / shape-unknown-field**. Both identities remain well-formed. Validation + returns the first array member's error before the later stable sorting applies. +2. From P, set delegationRef null, supply a synthetic message, and restrict original + requester execution to work.read only. Structural validation succeeds. Actual: + **exit 3 / operation-not-permitted**, proposal rule + `requester-lacks-original-scope-authority`, rather than `message-is-not-authority`. + The special message check is deferred until after requester admission. + +Required correction: implement the frozen first-failure contract and add independent +multi-failure/permutation tests. If message precedence is meant differently, darkwing +must reconcile the explicit §5 exception; the writer must not guess an override. + +### F6 — NONBLOCKING evidence improvement: writer inventories omit ownership + +`cli.test.mjs:31–39` and `test-foundation.sh:123` inventory path/type/size/mode/ +inode/mtime/content, but omit UID/GID despite charter §8 naming ownership. +My separate 15-run inventory includes UID/GID and passes (see §4), so this is not +an observed owner change or an additional code rejection. Preserve ownership +coverage in the maintained regression harness rather than relying on this review's +one-off receipt. + +## 3. Acceptance and historical-finding dispositions + +| Gate | Independent disposition | +|---|---| +| A1 | Positive text/JSON read and assigned-change demos pass exact-output tests; disclaimers present; bounded no-effect observation passes. Does not rescue F1/F2's additional false-positive cases. | +| A2 | Named missing-workspace-registration/cross-project fixtures pass; no fallback or unrelated payload emission observed. | +| A3 | Supplied duplicate/reference/ownership/revision/cycle negatives pass, including separate detector and CLI-precedence tests. **Not satisfied generally: F1/F4.** | +| A4 | Supplied role, mandatory policy, optional task/mission/execution, registration-delegation, path-prefix and no-assignment-union tests pass. **Not satisfied: F1–F3.** | +| A5 | Strict-parser, bounded canonical domain, separate pinned schema/profile oracle and production LF refusals pass the tested finite domains. | +| A6 | Static runtime import/I/O review and independent descriptor/non-effect tests pass within stated limits; see F6. No OS-containment claim. | +| A7 | No allowed reassignment branch found; original selection is preserved and supplied requester negatives pass. **Not satisfied: F2/F3 and F5's proposal ordering.** | +| A8 | Closed fields, exits 0/2/3/4, parser/I/O diagnostics, escaping and body-free outputs pass supplied tests. **Not fully satisfied: F5.** | +| Required integration verification | Foundation checker independently green. **Five repository suites not independently rerun; writer receipts only. Gate remains uncleared.** | +| A9 | Not performed; Jason's demo/acceptance remains separate and cannot proceed as an accepted-code gate from this verdict. | + +Prior admission findings against the older candidates: + +- **C1 closed for r3 identity.** The corrected message-demo digest is + `f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab`; + manifest and demo-copy equality verify. I do not independently attest the writer's + historical scratch timestamps or reconstruct authorship of the original typo. +- **C2 closed for the tested r3 corpus/profile implementation.** The actual Node + schema column agrees with pinned Python; no disagreement waiver or copied oracle + answer supplies the Node result. Strict production validation remains separate, + rejects rather than normalizes identities, and precedes graph admission. + Original four LF witnesses remain, as do the low-year calendar witnesses. +- **C3 closed.** Exactly the twelve charter result fields; process exit is separate. + Contract-derived assertions and spawned outputs pass, including pre-validation. +- **C4 closed as bounded evidence.** Before inventories are captured before runs + and compared afterwards, not regenerated as the expected baseline. My separate + ownership-inclusive observation confirms the measured result. +- **C5 closed.** Actual CLI requires O_RDONLY/O_NOFOLLOW/O_NONBLOCK, including the + valid zero-valued O_RDONLY; FIFO refusal passes. No O_CLOEXEC claim is made. + +## 4. Independent commands, receipts and reproducibility + +Isolated candidate export: `/tmp/fi-filbert-6.42ru903e`. +Separate harness/evidence root: `/tmp/fi-filbert-6.42ru903e-evidence`. +Source/test commands were inspected before execution. Candidate fixture generation +ran only into the suite's disposable scratch, never the shared frozen tree. + +Measured toolchain: Node **v26.8.1**, Python **3.12.8**, jsonschema **4.26.0**. +The pinned low-year platform witness is `strftime('%Y', year 999) == '999'`. + +From the isolated export, the following commands each exited **0**, under `env -i` +with PATH `/home/jwoltje/.pyenv/versions/3.12.8/bin:/usr/bin:/bin`, synthetic HOME +and TMPDIR beneath the evidence root, `PYTHONDONTWRITEBYTECODE=1`, `NO_COLOR=1`: + +| Command | Actual result | +|---|---| +| `node --test scripts/foundation/` | 63 tests, 63 pass, 0 fail, 0 skipped | +| `python3 scripts/foundation/verify-schema.py` | 3 pins match; 38 pinned fixtures; 1539 corpus records; 519 agree-valid / 983 agree-invalid / **0 disagreements**; 27 parser-only; 10 unsupported-kind unassessed; 489 profile-valid / 30 profile-invalid among schema-valid records; 73 named probes verified | +| `bash scripts/test-foundation.sh` | 43 passed, 0 failed; scratch regeneration equality, suites/oracle, goldens, I/O and non-effect checks | +| `python3 docs/plans/foundation-v1-candidate/check.py` | Exit 0: command 38+5, records 38, paths 16, restricted fingerprints 7, runtime/artifact 155+5, synthetic semantic model 35; not runtime enforcement | + +Additional independent harnesses in the evidence root: + +- `python3 reproduce.py` and `python3 additional-probes.py`: exact CLI witnesses + described above, plus the allowed B positive control. Captured result JSON and + input hashes are in `witnesses/`; all CLI stderr was empty. +- `python3 witness-validation.py`: 390 record-shape checks across exploratory and + finding witnesses pass using the pinned schema and independently redeclared + checker formats. The intentional shape-order negatives are excluded. Also checks + exact graph acyclicity and complete histories for F4; exit 0. +- `python3 profile-probes.py`: **831** independently enumerated typed-identity + occurrences/probes across B/P and a non-null agent execution-ID control. Each + single-final-LF mutation gives exit 2, invalid-request/profile-pattern-mismatch, + with selection/operation/proposal/diagnostic all null. A multiline mission + objective remains allowed. This extends, not replaces, the supplied record oracle. +- `python3 non-effect.py`: 15 independent text/JSON, parser, missing-file, + final-symlink, FIFO and usage runs. All expected exits pass. **16 inventory + entries unchanged**, including path/type/size/mode/UID/GID/inode/mtime-ns and + content or symlink target, with fixture/home/cwd/data roots separated from logs. + Absolute Node executable, PATH `/nonexistent`, synthetic HOME/config canaries; + no canary output. Exit 0. +- `python3 recheck.py`: final shared-tree/export identities and HEAD pass, exit 0. + +Selected evidence hashes (paths relative to the evidence root): + +| Artifact | SHA-256 | +|---|---| +| `node-tests.log` | `36c59ae491eec2d97909912f3fe4141b44e6473f0640b2141c460e2089a8a1df` | +| `oracle.log` | `18774c031f6e2bea64c45112fc23e29984db4923a74b365eaafed912746481ad` | +| `selftest.log` | `fafe1f016eaa8d150119902f2bec5ca2a83a78ccaf06501dbc5db9e9b0979a05` | +| `foundation-check.log` | `42ddd578b4f2be0c0b7b5b78a95de3a94e7d372661f634eb6f5209aa55e0c60a` | +| `profile-probe-receipts.json` | `6c067bcd6c4d88482b410e4e91f228ae5ef293156670b32c13d88544bcba463a` | +| `witnesses/receipts.json` | `db77081d5f0acf6f9f2744c48ea208a5363a688ec363db19a8767c32ef02b773` | +| `witnesses/additional-receipts.json` | `04c3945df8de33e0ed7b44a760703c19cb9d1a27dcc1e31b5678be1d630a7df1` | +| `inventory-before.json` and `inventory-after.json` (identical) | `78d5da15db9f0ae1501f7a24dccb14208eb9ba8b80c6e96d243fb850daced47c` | +| `recheck.log` | `66a96b5d044180515a717551a26ec75adaa109d0765eeb3a74ef3081b43c7d37` | + +Witness input SHA-256s, for exact reproduction/audit: + +| Witness basename under `witnesses/` | SHA-256 | +|---|---| +| `missing-agent-registry-declarations.json` | `78efd6fb46960079423eacc5cc9f469f0856a945137b03808e64b98add50bf56` | +| `consulted-dependency-undeclared-authorization.json` | `cc78be2811d49e6d56d67a009cac532e559a901e9a960834f64121d154e75299` | +| `assigned-change-without-work-read.json` | `35ee45e648387b9a8b0aa81b201b4eff61eb5a15bdc6eea30ecbfacecae77bd9` | +| `proposal-task-only-contexts-without-work-read.json` | `e1a9cd887f1bc64a8abdd8a0a1326df21b1ac0406ead978d2e6fc26e4eb0d683` | +| `proposal-issuer-denies-work-read.json` | `34d1ed805d3d42098052be2b928404947bd2d3b7b4c1af0edd3ec344aaec88f2` | +| `acyclic-versioned-history-false-cycle.json` | `e3dd1cd34e24c4d9ba0354203b7754c9e045966f0503d28ae1912e4e89eb2d15` | +| `shape-order-forward.json` | `689f9aa9713e53d7b10f9a9e263d16a2ff7e83d3056060c37c79c4e30bd11d6c` | +| `shape-order-reversed.json` | `d14fca5e43632c3283f1bcda772f9940dcd234afdfa43fe19bf5faa336eff062` | +| `message-priority-after-structural-validation.json` | `9e2ec77b87fb99fa602876fb5ffd52bbcd2142a4f7224cf1cdf7ec223a89d6fe` | + +Scratch paths are local, disposable evidence, not durable repository artifacts. +The mutation recipes above and the frozen demo identities permit reconstruction. + +## 5. Limits, corrections and handoff + +- The five legacy repository suites were **not independently rerun**. Their green + results remain Rocko's receipts. Inspection found Docker/live branches in legacy + task/release tests and git mutation fixtures in the conductor test; I did not + widen this already-failing review into those activities or invent a skip/stub + and call the integration gate green. That required gate still needs an explicitly + authorized, isolated, non-live verification run before approval. +- Exploratory scratch receipts also contain blocked-subject-task, unrelated + subject-task-intent and blocked-target-mission probes reaching unresolved. + **Correction to their provisional expected-from-contract labels and my early + progress wording:** these are not counted as established violations here. + §5 specifically names subject-assignment and target-task checks; I do not infer + an additional full subject/target L1–L9 calculation from those experiments. +- An exploratory Unicode probe agreed (both rejected U+13439); no Unicode + disagreement is claimed. Exhaustive comparison of the host Python/Node + Cc/Cf/Cs category sets found the same 2283 code points. This does not establish + general equivalence of their Unicode or schema implementations. +- Finite tests, static import review and unchanged inventories do not prove absence + of every read, complete schema equivalence, OS containment, authentic delegation, + crash safety, parent-path containment or resistance to same-size concurrent + input mutation. Only Node v26.8.1 was executed; no Node 22/24 portability claim. +- No shared implementation, fixture, charter, log, CURRENT or index edits; no + installation, staging/commit/checkout/reset/push, engine/network/native/sync or + live-data work. Synthetic canary files used by tests are not real credentials; + the operator's actual HOME/credentials/`~/.mosaic` were not investigated. + This verdict is the only repository write for FI-FILBERT-6. + +**Return to darkwing:** reconcile F1–F5 with the frozen contract, let Rocko alone +make any authorized corrections, then supply a newly hashed frozen candidate and +complete verification receipts for independent re-review. No implementation, +reassignment, acceptance, owner demo, push, issue closure or next phase follows +automatically. No timer or deadline is set. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-request-r3.md b/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-request-r3.md new file mode 100644 index 00000000..f5301cf7 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-request-r3.md @@ -0,0 +1,72 @@ +# FI-FILBERT-3 — charter candidate 3 resubmission + +Owner continuation authority unchanged. Reviewer: filbert, non-author; recheck +assignment compatibility if changed. Author/integrator and follow-up: darkwing. +Written-charter review only, not code or runtime approval. + +## Exact inputs + +Repository /home/jwoltje/src/mosaic-stack-dev-test +- docs/plans/2026-09-06_foundation-inspector-charter.md, candidate 3 + SHA-256 19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6 +- Incorporated Rocko r2 note sections 5–13, subject to charter overrides: + docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md + SHA-256 f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1 + +These are frozen, uncommitted planning inputs. Map/source commits remain +7345f330fc6bfae5aa1d896c78cfb7cbe62efbae / d4696d09eb1b5dcf1028f30db2cd63735f51cb16. +Candidate 2 archived byte-for-byte as +reviews/2026-09-06_foundation-inspector-charter-candidate2.md, hash cbd0487a…; +your FI-FILBERT-2 verdict remains unchanged, full hash +2f3858c81d32b1305cb7fd49b0d8860153d8d592ac62df2c45dd25d30af7a722. + +## Finding disposition for re-review + +1. Charter §10.1 defines null owner-origin assumptions, approved current delegation, + exact recipient/registration/scope bounds, rejected/newer-rejected behavior, + required mock issuer ceilings, and intersections with role/narrowing. New closed + delegationInputs wrapper data is simulation-only; no accepted record changed. + Verify both ordinary registration and proposal use, not just the positive example. +2. §10.2 replaces selected-project global graph interpretation with per-record + ownership. Same-workspace/parent-project consulted work requires work.read in + applicable context. Other-workspace/project consulted refs return explicit + unsupported-capability even if separately registered; no silent readiness skip. + Unselected P2 inventory is not coerced into P1. Test outcomes specified. +3. §10.3 withdraws hidden-chain detection. Only direct-declared assumptions exist; + unknown parent fields/modes are structural errors, not chain detection. Artifact + bodies are never inferred; direct assertions cannot prove absence of chaining. +4. §10.4 fixes graph order: cycles precede continuity/parent-scope semantics, with + detector and CLI-precedence tests distinguished. O_RDONLY=0 check also corrected. +5. §10.5 expands differential type/null/bounds/uniqueness/Unicode corpus and preserves + schema-versus-profile separation and finite-test limitations. + +All original substantive requests and exact-hash review boundaries still apply. +Please challenge new ambiguity, contradictions or unnecessary scope growth rather +than treating this disposition as proof. No implementation exists to test. + +## Return and scope + +Return FI-FILBERT-3 APPROVED/NOT APPROVED for exact identities, with per-finding +closure/reopening, new numbered findings, evidence and actual measurement limits. +Only allowed repository write: +docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict-r3.md. +Do not edit the candidate, prior verdict or shared files. No code, dependency +installation, checkout/reset, commit/push, native/sync/live/credential tests or +separate ~/.mosaic investigation. No deadline or automatic phase advancement. +Direct reply is the return mechanism; follow-up darkwing. + +Transport (2026-09-06 08:58 UTC): FI-FILBERT-3 sent once to =filbert/default; exit 2, +unconfirmed. Await direct verdict/blocker; no timer, retry or automatic approval. + +## Inspector charter independently approved (2026-09-06 09:03 UTC) + +FI-FILBERT-3 APPROVED received and full verdict read. Verified verdict SHA-256 +15f3d04cb74a7296be6a1a26f2c0907b9dd2b08fdd1eb0ef51c95c7a52ff0399, exact +charter 19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6 +and incorporated r2 f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1. +All five prior findings closed at specification level; four informational limits +retained. Reviewer reports 14 in-memory schema probes, hash checks and Node +constants measurements, not CLI/runtime/security or owner-demo acceptance. +Closeout delivered to Filbert (exit 0), no further work requested. Candidate and +prior verdicts unchanged. Await Jason's build authorization. No code, commit, +push or live changes; shared index left with Dewey per MS58-DW-1. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-request.md b/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-request.md new file mode 100644 index 00000000..c82f12dc --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-request.md @@ -0,0 +1,71 @@ +# FI-FILBERT-2 — frozen inspector charter review + +Jason authorized continued planning with Filbert and Rocko. FI-FILBERT-1 confirmed +availability/non-authorship; recheck if current assignments changed, without +reprioritizing owner work. Author/integrator: darkwing; contributor: rocko. +Review requester/follow-up owner: darkwing. Reviewer: filbert. + +## Exact candidate + +Repository: /home/jwoltje/src/mosaic-stack-dev-test + +1. docs/plans/2026-09-06_foundation-inspector-charter.md, candidate 2 + SHA-256 cbd0487a2ab699722924e2f91367bf556facb015752ce3b5a76ad474977df791 +2. Incorporated sections 5–13 of + docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md + SHA-256 f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1 + +Charter overrides the note explicitly. These are frozen uncommitted planning +inputs, not falsely attributed to an earlier Git commit. No edits during review. +Accepted map commit 7345f330fc6bfae5aa1d896c78cfb7cbe62efbae; +accepted source/plan baseline d4696d09eb1b5dcf1028f30db2cd63735f51cb16. +Use committed bytes for those sources, not Dewey's mutable extension work. + +## Review questions + +- Is this bounded build contract coherent, implementable and faithful to the + accepted map, or does it need further design before code authorization? +- Validate exact reference types, graph/current-versus-historical handling, record + subset, required role/policy/execution layers and optional narrowing semantics. +- Challenge requester contexts in both reassignment scopes, intent/delegation + checks and the deliberately unreachable success path. Do not mistake declared + authorizations/artifacts for authentication or trusted evidence. +- Check privacy-safe output on every failure stage, closed shape/nullability, + precedence, rule/exit distinctions, number/Unicode domains and differential + test separation. Identify contradictory requirements or untestable acceptance. +- Check proposed filesystem open/read boundaries, no-live-effect limits and + static/test evidence limits. Node does not expose O_CLOEXEC on the measured host; + the charter explicitly corrects the note rather than claiming unsupported flags. +- Check that mandatory schema differential verification actually addresses validator + drift, that fixtures can reach intended rules, and that the proposed first slice + stays small enough to test before dependent runtime work. + +This is a written implementation-charter review, not code, runtime, full Archify +or owner acceptance. No runtime implementation exists to test. Do not run native, +sync, live fleet, credential or installation checks. Static/helper calculations on +synthetic data in temporary space are allowed; report what you actually measured. +No dependency installation, shared checkout/reset, commits or pushes. + +## History, not alternate specifications + +Rocko r1 was useful but had nine coordinator correction groups; r2 accepted all. +The charter further fixes numeric 1.0 versus 1.5, unsupported-operation exit 2, +O_CLOEXEC availability, requester policy contexts, error output, input profile, +registration ambiguity and historical-reference admission. Re-evaluate these +changes independently; Rocko did not approve the integrated charter. + +## Return + +Reply FI-FILBERT-2 with APPROVED or NOT APPROVED for these exact input hashes, +numbered blocking/nonblocking findings, evidence and required corrections, review +question dispositions and measurement limits. Do not fix or co-author the candidate. +Only allowed repository write: +docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict.md. +Provide its SHA-256. If assignment compatibility fails, return a blocker instead. +No implementation, source moves, role changes, fleet investigation or phase advance. +No deadline, automatic timeout or automatic acceptance. Direct reply is the return +mechanism; darkwing owns follow-up. No separate ~/.mosaic activity is requested. + +Transport (2026-09-06 08:42 UTC): sent FI-FILBERT-2 once to =filbert on default socket; +exit 2, submission unconfirmed, not acknowledged. Await direct admission/verdict +or blocker. No timer or retry. Follow-up owner darkwing. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict-r3.md b/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict-r3.md new file mode 100644 index 00000000..0b5eb0ce --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict-r3.md @@ -0,0 +1,195 @@ +# FI-FILBERT-3 — independent charter candidate 3 verdict + +Reviewer: filbert. Author/integrator and follow-up owner: darkwing. +Contributor: rocko. Date: 2026-09-06. + +## Admission and exact verdict + +**APPROVED for the written implementation charter at the exact identities below.** +All five FI-FILBERT-2 findings are closed at specification level. No new blocking +charter defect found. Implementation authorization remains Jason's separate gate; +this is neither implementation approval nor runtime/security/owner-demo acceptance. + +No competing current personal owner-authorized assignment appeared. I remain a +non-author of the charter and incorporated feasibility note. I reviewed the complete +candidate, its changes from candidate 2, the incorporated rules and their interactions; +Rocko's contribution was not treated as approval of the integrated charter. + +Independently verified identities: + +| Input | SHA-256 | +|---|---| +| `docs/plans/2026-09-06_foundation-inspector-charter.md`, candidate 3 | `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` | +| `docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md` | `f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1` | +| Archived `docs/plans/reviews/2026-09-06_foundation-inspector-charter-candidate2.md` | `cbd0487a2ab699722924e2f91367bf556facb015752ce3b5a76ad474977df791` | +| Preserved `docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict.md` | `2f3858c81d32b1305cb7fd49b0d8860153d8d592ac62df2c45dd25d30af7a722` | + +Map commit: `7345f330fc6bfae5aa1d896c78cfb7cbe62efbae`. +Source/plan baseline: `d4696d09eb1b5dcf1028f30db2cd63735f51cb16`. +Candidate and incorporated note remain frozen uncommitted planning inputs. Sections +10.1–10.5 explicitly override earlier shorthand, including the incorporated note. +The earlier NOT APPROVED remains an accurate historical verdict on candidate 2. + +## Per-finding disposition + +### 1. CLOSED — registration delegation semantics and issuer limits + +Evidence: charter §10.1 supplies the missing ordinary L2/L3 checks: current active +registration, approved current delegation, exact registration scope, exact current +agent/registration subject pair, and explicit missing/stale/rejected/bounds outcomes. +Null delegation is expressly an unverified owner-origin fixture assumption, not an +unrestricted grant. A newer rejected head cannot be bypassed with an old approved +reference. Current consulted policy registries also have an explicit head rule. + +The new closed `delegationInputs` wrapper does not mutate accepted records. Its +issuerCeiling and delegated operations narrow, rather than replace, mandatory role, +registration, project/workspace, task/mission and execution restrictions. Required +issuer input and subset checks apply to proposal delegation too; issuer restrictions +additionally narrow both requester contexts. This closes the previous ordinary +registration gap without treating a declaration as authenticated authority. + +Independent shape/identity probes confirmed that same-scope approved decisions with +exact agent/registration subjects, and rejected successor decisions plus registration +successors, can be represented by the unchanged candidate schema. In a rejected +decision fixture, delegatedOperations must be empty to reach the intended semantic +rejection rather than fail its earlier schema conditional. This is a fixture detail, +not a new field or authority mechanism. + +### 2. CLOSED — per-record ownership and consulted work access + +Evidence: §10.2 replaces global selected-project graph interpretation with each +record's own project. It distinguishes structural existence from consulted access. +Unselected P2 task/mission inventory is no longer coerced into the P1 selection. + +Consulted work supports only the current workspace or its parent project. Another +workspace/project receives the specified unsupported-capability refusal, even if a +separate registration exists. Thus no extra visibility context, cross-assignment +union or permission borrowing is silently introduced. Supported consulted work +requires work.read in the caller's full applicable intersection in addition to the +requested operation. Dependencies cannot be skipped when their scope is unsupported; +accepted status is required for file.change and proposal requester authority. + +The subject and target proposal checks explicitly use original and target requester +contexts respectively. Taskless read does not traverse unrelated work. These are +bounded conservative limitations, consistent with baseline README:57–71,124–136; +they are not a promise to implement all future cross-scope dependency behavior. + +### 3. CLOSED — hidden-chain detection claim withdrawn + +Evidence: §§5 and 10.3 now expressly deny detection of a chain hidden behind opaque +artifacts, declarations or omitted records. The only wrapper mode is direct-declared. +Unknown parent fields and modes are structural invalid-request failures, not claimed +chain detections. A subject reference to a decision is not invented into a parent +edge. Artifact bodies remain unread and their presence remains unauthenticated. + +This resolves the unobservable-predicate defect honestly. A valid direct declaration +can pass synthetic checks without proving absence of chaining. It still cannot +produce an allowed reassignment result: the final proposal branch is unresolved / +unknown-effects / runtime-reconciliation-required. + +### 4. CLOSED — graph sub-order and fixture reachability + +Evidence: §10.4 orders ordinary structural reference checks, then task/mission/ +supersedes cycle checks, then revision continuity and ownership/parent-scope checks. +It also separates admission-time missing declarations from ordinary missing records. +The cycle order is no longer inferred from unordered requirements. + +Independent schema probes confirmed a workspace mission self-parent and a revision-2 +self-supersedes are shape-valid. Their references can resolve to themselves, allowing +the now-earlier cycle stage to run before parent-scope/continuity rejection. Detector +unit coverage and CLI first-failure coverage remain explicitly distinct. Stable +identity/field ordering, rather than inventory order, governs within-stage traversal. + +### 5. CLOSED — differential corpus and platform boundaries + +Evidence: §10.5 adds scalar types, null/absence, integer bounds and booleans, 1.0, +object-key-order-insensitive uniqueness, BMP/non-BMP lengths, byte-path limits and +escaped surrogates. Schema and strict input-profile verdicts occupy separate expected +columns; finite-corpus success is explicitly not a complete equivalence proof. + +Independent probes confirmed representative distinctions: boolean revision invalid; +1.0 valid as a schema integer; maximum safe revision valid and the next integer +invalid; 128 non-BMP display-name code points valid and 129 invalid; duplicate path +objects invalid despite key-order reversal. A lone surrogate in an unformatted +schema string can be shape-valid while the strict inspector profile must refuse it. +O_RDONLY's zero value is now correctly handled with presence/type checks. + +## New interaction findings and limits + +1. **Informational / nonblocking — declaration authority remains an assumption.** + Location: §§3,7,10.1,10.3. An issuerCeiling is caller-supplied synthetic data; + its addition does not authenticate an issuer or model a real delegation chain. + The unconditional not-modelled/unverified-simulation output and the no-success + proposal endpoint preserve that distinction. No correction required. Code review + must ensure no diagnostic or positive preview upgrades this assumption into a + real authorization claim. + +2. **Informational / nonblocking — added work.read is an intentional additional guard.** + Location: §§4,5,10.2. An assigned operation permitted by file.change alone must + still refuse when the context lacks work.read for consulted work. Taskless + file.read does not acquire an unrelated assignment/mission layer. Proposal + original/target contexts retain their own assignments and execution limits; + one context cannot supply another's missing permission. No correction required; + positive and negative tests must distinguish these cases. + +3. **Informational / nonblocking — bounded scope, but substantial validator work.** + Location: §§6,8,10.1–10.5. The new inventory is capped at 256, graph/profile limits + remain finite, and no live source lookup, artifact-body loading, chain traversal, + runtime observer or publication component has been added. This remains feasible + as an offline increment, not a trivial schema wrapper. The mandatory differential + oracle, coherent fixtures and independent code review remain necessary. No + implementation-size or completion-time estimate was measured. + +4. **Informational / nonblocking — testability is not implemented enforcement.** + Location: §§6,8–9. Descriptor flags, byte limits, Unicode handling, immutable + observed roots, privacy-safe outputs and fail-closed exits are obligations for + later code/tests. This review did not execute those mechanisms. No correction + required; do not promote schema probes or constants inspection into a security, + no-read, complete-mediation or crash-durability receipt. + +## Full review-question dispositions + +| Area | Disposition | +|---|---| +| Coherence/feasibility/faithfulness | Approved as a bounded written charter; prior substantive gaps are resolved without a runtime implementation or implicit phase advance. | +| Types, subset, history and mandatory layers | Closed wrapper addition, unchanged eight supported record shapes, complete histories versus consulted heads, explicit role/policy/execution ceilings and optional narrowing remain coherent. | +| Requester/subject/target, intent and delegation | Both requester scopes retain full contexts; ordinary/proposal delegation now has explicit bounded synthetic checks; subject selection is preserved; proposal success remains unreachable by specification. | +| Privacy/output/exits/profile | Closed body-free output, safe pre-validation nulls, fixed disclaimers, escaped text, documented refusal exceptions and separate number/Unicode profile remain intact. | +| Filesystem/no-live-effects | Proposed Linux descriptor boundary and its parent-path/concurrent-write/read-observation limitations remain explicit. No unsupported O_CLOEXEC or O_RDONLY truthiness assumption remains. | +| Differential verification/reachability | Mandatory pinned oracle, expanded corpus and explicit cycle precedence are adequate charter requirements; their implementation and actual coverage remain unverified. | +| First slice and owner gates | No implementation, live grants, source moves, package scaffolds, credentials, native integration or runtime security mechanisms added. Jason's build authorization and later demo acceptance remain separate. | + +## Independent receipts for this FI-FILBERT-3 cycle + +- `sha256sum` verified all four planning/history identities listed above. +- `diff -u ` showed the title change, replacement + of the hidden-chain claim in §5, and addition of normative §10. Exit 1 denotes + these expected differences, not a failed verification command. +- `git show d4696d09:` read committed schema/checker and relevant accepted + README rules. Independent hashes again matched: + - records.schema.json: `05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6` + - check.py: `82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607` +- Inline Python read committed records fixtures/schema with `git show`, made only + in-memory synthetic mutations, and ran **14 asserted schema probes: all passed, + exit 0**, using Python 3.12.8 and existing jsonschema 4.26.0. Four probes covered + direct delegation/registration and rejected successors, two covered cycle shapes, + four covered revision type/bounds, two covered non-BMP length, one lone-surrogate + schema string, and one object-order-independent uniqueItems check. Identity + assertions also distinguished the old approved reference from the rejected head. + These are shape/identity witnesses, not a complete coherent bundle or an inspector + implementation. Custom calendar/path formats were not exercised in this run. +- `node -e` independently observed Node v26.8.1; O_RDONLY=0 with numeric presence, + O_NOFOLLOW=131072, O_NONBLOCK=2048, and no exposed O_CLOEXEC. No descriptor was + opened for a filesystem behavior test. + +No proposed CLI/differential harness, five repository suites, author checker, +canonicalizer implementation, symlink/FIFO tests, native/sync tests or live runtime +ran in this cycle. Earlier receipts are not relabelled as current execution. No +new dependencies or helper implementation files were installed/written; schema +calculations were inline and in memory. No credential contents or separate +~/.mosaic environment were accessed. + +Only this offered verdict path was written in the repository. Candidate, incorporated +note, prior verdict, source, logs, policies, installations and shared index were not +edited. No checkout/reset, commit or push occurred. Follow-up remains darkwing; +this approval does not automatically authorize code or advance the phase. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict.md b/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict.md new file mode 100644 index 00000000..afa4a314 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict.md @@ -0,0 +1,215 @@ +# FI-FILBERT-2 — independent frozen-charter review + +Reviewer: filbert. Author/integrator: darkwing. Contributor: rocko. +Follow-up owner: darkwing. Date: 2026-09-06. + +## Admission and verdict + +**NOT APPROVED for implementation-charter readiness.** The bounded inspector is +plausibly implementable without a new dependency or live runtime, but the frozen +algorithm needs the three substantive clarifications below before code authorization. +This is a written specification verdict, not a reproduced implementation failure. + +Admission remains compatible: no competing current personal owner-authorized +assignment appeared. I did not author/co-author either input. I treated Rocko's +note as contributor material, not his approval of darkwing's integration. Charter +corrections take precedence over incorporated note sections 5–13. + +Exact inputs independently hashed: + +- `docs/plans/2026-09-06_foundation-inspector-charter.md`, candidate 2: + `cbd0487a2ab699722924e2f91367bf556facb015752ce3b5a76ad474977df791` +- `docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md`: + `f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1` +- Accepted map: `7345f330fc6bfae5aa1d896c78cfb7cbe62efbae`. +- Source/plan baseline: `d4696d09eb1b5dcf1028f30db2cd63735f51cb16`. + +The first two are frozen uncommitted files, not blobs falsely attributed to the +source baseline. Source comparisons used `git show` at the specified commits. + +## Numbered findings + +### 1. Blocking / high — consulted registration delegation has no semantic gate + +**Locations:** charter §§3–4, especially current registration/delegation references +and adoption of L1–L9; incorporated r2 §§6.2–6.3 and §7 L2/L3. Baseline candidate +README:73–78,128–136; records.schema.json `$defs/registrationPayload` and +`$defs/decisionPayload`. + +The registration's `delegationRef` may be non-null. The specified rules require +that it resolve, name a head, and have the record kind `decision`. L2/L3 then check +registration status, role ceiling and narrowing. They do not say that the referenced +decision must be an approved, applicable delegation, or what a rejected/revoked or +unrelated decision does to the registration's simulated admission. + +Concrete witness to specify: an otherwise valid active registration points to a +current rejected delegation decision, or to a current plan-approval/acceptance +about unrelated work. All its role/policy layers permit file.read. Exact reference +resolution and active registration status alone do not reject these cases under +the listed algorithm. They must not silently become a permitted preview of current +authority. Charter §5's proposal delegation checks do not cover ordinary L2/L3 +registration use. + +**Independent evidence:** a baseline valid registration mutated to reference the +valid fixture's non-delegation decision remains JSON-Schema-valid. This was an +isolated shape probe, not an executed inspector or complete graph demonstration. +It establishes that the schema cannot supply the missing semantic check. + +**Required correction:** define the simulation semantics of non-null registration +delegation references, including applicable kind/outcome/recipient/scope bounds and +revocation/current-decision behavior. Keep null/owner-origin registration assumptions +explicit. Add coherent positive and rejected/unrelated/current-revoked negatives +that reach that semantic gate. No actual authentication or signature verification +is requested for this offline slice. + +### 2. Blocking / high — cross-scope work-reference admission is underspecified + +**Locations:** charter §3:88–95 and §4; incorporated r2 §6.2:222–227 and §7 L8. +Accepted map:250–269; baseline candidate README:57–71. + +The baseline requires task mission/dependency references to resolve to **permitted +work**, with cross-scope access distinct from membership and execution authority. +The incorporated graph rule only says a task's mission resolves in the “selected +project.” The charter adds accepted status for same-project dependencies before +file.change, but does not define access checks for work in another workspace of +that project. “Dependencies grant no ownership/access” is not an algorithm for +checking whether the referenced work is permitted. + +Concrete witnesses: + +- Agent A is registered only in W1. Its selected W1 task names an active mission, + or an accepted dependency task, in W2 of the same project. All named records and + declarations exist. The listed same-project/status checks can succeed without + any check of A's permission to use that W2 work reference. +- An unselected historical/current task in P2 has a legitimate P2 mission while + selection names P1. If “selected project” is a global structural graph constraint, + this legitimate separate project is rejected. If it means each task's owning + project/context, the specification should say so. This matters to a bundle with + multiple projects and the new original/target requester contexts. +- A dependency in another project is said not to lend permission and broader + execution semantics are unsupported, but the exact admission result for that + reference is not stated. It must not simply be omitted from readiness checks. + +**Independent evidence:** a valid baseline task mutated to name a mission in a +different workspace of the same project remains JSON-Schema-valid. No cross-scope +permission resolver was run or claimed; this is a missing specified semantic rule. + +**Required correction:** distinguish per-record structural ownership from per-caller +consulted-reference access. Define the supported mission/dependency scope relations, +visibility/admission checks, and refusal for out-of-slice references, with exact +rule/exit outcomes. Add coherent same-project-unregistered-workspace and unrelated-P2 +inventory tests. Resolve this within the bounded model, not by implementing real +authentication or expanding into a runtime dependency engine. + +### 3. Blocking / medium — delegation-chain refusal lacks an observable predicate + +**Locations:** charter §3 declaration limits and §5:133–135; incorporated r2 +§§5.2,6.2,8; baseline decisionPayload and artifactRef definitions. + +The charter promises “Unmodelled delegation chains refuse unsupported-capability.” +The closed proposal supplies one delegationRef. A decision has subjectRefs and an +artifact basis, but no typed parent-delegation field. Declared artifacts contain only +runId/artifactId/digest; the inspector never reads their bodies. The specification +does not define a subjectRef to another decision as a delegation-parent relation +(subject references otherwise explicitly support history). + +Consequently an implementation cannot determine that an otherwise well-shaped +delegation relies on a chain hidden behind its declared basis. Adding an arbitrary +parent field would instead fail the unknown-field structural rule, not reach the +promised unsupported-capability gate. Treating every referenced decision as a parent +would invent a relation and can misclassify historical subjects. + +**Required correction:** state exactly what observable input denotes an unsupported +chain and its precedence, or explicitly delimit the model to direct declared +delegation assumptions and withdraw any claim to detect hidden chains. Define tests +for the chosen supported/unsupported distinction. Do not infer trust from artifact +presence or add an undocumented parent relationship during coding. + +### 4. Nonblocking / medium — cycle fixtures need explicit within-graph precedence + +**Locations:** charter §3:88–90 and A3; incorporated r2 §§6.2–6.3,12.3,13. + +The global stages are ordered, but ownership/parent-scope/continuity checks versus +cycle checks within the graph stage are not. A mission cycle necessarily violates +the permitted workspace-to-project parent structure; a supersedes cycle necessarily +violates the immediately preceding revision rule. Either can therefore be caught +by another semantic guard before the cycle detector. + +**Independent evidence:** a workspace mission with a self-parent and a revision-2 +task with self-supersedes both pass the record schema. Thus cycle tests can reach +a semantic detector if it precedes the other graph guards; they are not inherently +impossible. After successful parent-scope/continuity checks, those cycle cases cannot +reach a distinct cycle outcome. + +**Disposition / requested clarification:** freeze the graph sub-order or document +which guard is the intended outcome for each fixture. Use separate detector-unit +and CLI-precedence tests where appropriate. Do not count an earlier wrong-owner or +bad-predecessor refusal as demonstrated cycle-detector coverage. This does not by +itself require a larger implementation scope. + +### 5. Nonblocking / low — strengthen differential coverage beyond the listed mutations + +**Locations:** charter §8; incorporated r2 §12.1; pinned checker/schema. + +The mandatory independent Python oracle, pinned hashes, no-skip rule, and separation +of schema verdict from inspector-profile/unsupported-kind/graph verdict are valuable +and address drift. The listed mutations do not systematically cover scalar type +substitution, all null/absence branches, numeric bounds/boolean-versus-integer cases, +object-order-insensitive uniqueness, or non-BMP character-count boundaries. + +**Disposition / recommendation:** include those boundaries in the deterministic +corpus, particularly because the Node validator is handwritten. Numeric 1.0 is a +valid schema integer but forbidden as an inspector input token; retain separate +entry paths for those tests. A passing finite corpus is compatibility evidence, +not proof that all candidate-schema behavior has been implemented. + +## Review-question dispositions + +| Question | Disposition | +|---|---| +| Coherent, implementable, faithful, ready for code authorization? | Not yet: findings 1–3 require design resolution. The dependency-free offline architecture itself is feasible in principle. | +| Exact types, subset, history, mandatory/optional layers | Reference types, eight-kind subset, explicit execution layer and null narrowing are sound. Complete-history versus consulted-head distinction is materially improved. Registration delegation and cross-scope reference semantics remain incomplete. | +| Requester contexts and reassignment | Both requester contexts correctly apply all L1–L9 rather than just memberships. Subject/selection binding, approved task intent and no reassignment success are clear. Delegation-chain behavior needs finding 3 resolved. No mock basis/auth ID is treated here as authentic evidence. | +| Privacy, output, exits, number/Unicode domains | Revised closed output removes inventory/count disclosure; null pre-validation fields, fixed prose, JSON disclaimer field and escaped text are sensible. Numeric lexical profile is distinct from schema semantics. Clarify cycle precedence per finding 4 and test those output rules rather than just exit codes. | +| Filesystem and no-effect limits | Proposed descriptor-based Linux boundary is implementable; final-component symlink protection is not parent containment. O_CLOEXEC correction, quiescent-input limitation and no proof-of-no-reads caveats are honest. No descriptor behavior was tested in this review. | +| Differential verification and fixture reachability | Mandatory oracle/hashes and separated validation layers are sound. Findings 4–5 qualify reachability and coverage. Existing fixtures are shapes, not a coherent permission graph. | +| Small first slice / gates | Still offline and bounded, but already includes a full historical graph and substantial handwritten validation. Resolve the above rather than having the coder invent semantics. Written approval, implementation authority, code review and Jason's demo remain separate gates. | + +## Independently measured receipts and limits + +1. `sha256sum` of both frozen files matched the exact requested hashes. +2. `git show d4696d09:` read schema/fixtures/checker. Independent + SHA-256 matched records.schema.json + `05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6` + and check.py + `82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607`. + Temporary copies: `/tmp/fi-filbert-2.XdSfM8/`. +3. Inline Python using existing jsonschema 4.26.0 ran five schema-shape probes from + copied committed fixtures: cross-workspace mission reference; mission self-cycle; + revision-2 self-supersedes; registration pointing to non-delegation decision; + numeric revision 1.0. **All five schema-valid, assertions passed, exit 0.** These + deliberately show where separate semantics/profile checks are required. Custom + calendar/path format callbacks were not exercised by these probes; their existing + fixture dates/paths were unchanged. No complete bundle or inspector execution is + claimed. +4. Inline Python `json.dumps(sort_keys=True,separators=(',',':'))` plus SHA-256 + independently recomputed V1–V3: all matched, exit 0: + - V1 `0bc44e14fd8354a8a85be879306a54881da7a0cb4d3dcf1f88bc4bc08a40dc9c` + - V2 `63817bffc57803ca6ac5df971aa0a160d4be73646394b3bc536578bd66c82660` + - V3 `d538c865808cfe7665956615fb48f69819baa0833626d1ef6e1cb3614acbc7da` +5. `node -e` read Node constants and parsed synthetic numeric strings. Observed + **Node v26.8.1**, O_RDONLY=0, O_NOFOLLOW=131072, O_NONBLOCK=2048, + O_CLOEXEC absent. `1.0` parses as 1, `-0` preserves negative zero, and + `9007199254740993` rounds to `9007199254740992`. This supports exact lexical + checking before Number conversion. O_RDONLY availability must not be tested by + truthiness because its valid value is zero. No file-open/symlink/FIFO behavior + was measured; constants alone are not enforcement evidence. + +No proposed code exists to test. I did not run the proposed differential bridge, +CLI, non-effect harness, five repository suites or foundation author checker in +this FI-FILBERT-2 cycle. Earlier FM-FILBERT-1 receipts are not relabelled as new +execution. No dependencies, native/sync tests, engines, live runtime, credentials, +installations, commits, pushes, source changes or ~/.mosaic investigation occurred. +Only this offered verdict path was written in the repository. No charter fix or +co-authorship was performed. Follow-up and any revised candidate remain darkwing's; +this verdict authorizes no implementation or phase advancement. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-addendum.md b/docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-addendum.md new file mode 100644 index 00000000..5e8c46fe --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-addendum.md @@ -0,0 +1,84 @@ +# FI-C2-1 — proposed schema/profile clarification + +Author: darkwing. Status: frozen proposal for independent review, not yet approved +or authority to edit code. Scope: resolve FI-ROCKO-4 C2 without a mismatch waiver or +weaker CLI admission. No live permissions, new dependencies or source-schema changes. + +## Bound context + +Charter candidate 3 SHA-256: +19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6. +Pinned schema/checker baseline: d4696d09eb1b5dcf1028f30db2cd63735f51cb16. +Rocko r2 report SHA-256: +0dabd82fffdc3a56ebf9a1d8b851832c3acee2cb9332892bde9dbb13151d5e19. +Frozen r2 manifest SHA-256: +2e8b5f1998a3be6cc7fcc3fba308724d2a29ca166c08f005e1bca88ddbc14196. +The coordinator verified all 239 file identities/modes/sizes, aggregates and pinned +inputs. This establishes the candidate identity, not functional acceptance. + +## Problem + +Python re's end anchor permits matching immediately before a final LF; the +inspector's ECMAScript patterns reject it. Four shape-oracle cases therefore +currently disagree. The earlier waiver was removed and the gate correctly fails. +The choice is not limited to permitting unsafe identifiers or waiving disagreements: +the charter already distinguishes schema-only verdicts from strict input profiles. + +## Proposed normative clarification + +1. Keep the pinned Python/jsonschema oracle and schema/checker bytes unchanged. + The Node schema-only validator must reproduce the pinned shape verdict, + including its pattern semantics. Every schema-column disagreement still fails; + no named exceptions, suppressed mutations or green artifact-difference class. +2. Define an explicit stricter inspector profile for values using candidate + $defs/id, $defs/runtimeId and $defs/digest: the entire string must satisfy the + declared grammar under strict end-of-string semantics. A final LF must fail the + profile even if the schema-only oracle accepts it. This covers all occurrences + of those types, including scopes, actors, record/registry/artifact references, + authorizations and simulation wrapper fields—not merely the four current probes. +3. Preserve the original value throughout both checks. Do not trim, normalize, + silently substitute or create an identity index from a newline-stripped value. + No schema-only pass can bypass the profile before graph/admission evaluation. +4. A well-decoded, schema-valid but profile-invalid value returns process exit 2, + invalid-request, a fixed documented profile-pattern-mismatch rule, and safe + pre-admission output. No newline-bearing identifier/authority/digest reaches + a permitted preview. Existing closed output fields/disclaimers remain unchanged. +5. The test bridge exposes schema and profile verdicts independently. For the four + reported cases: Python schema true, Node schema true, inspector profile false, + actual CLI refusal. These are schema AGREEMENTS plus tested profile refusals, + not allowed schema disagreements under another label. Other stricter documented + lexical/byte/Unicode profile rules retain their separate expected columns. +6. Implement schema-pattern compatibility as real bounded validator behavior, not + case-name/path whitelisting or a harness-only answer adjustment. A copied oracle + answer is not an independent Node shape verdict. The production admission path + must actually enforce the profile, not rely on a test-only wrapper to reject it. + +This clarification changes validation-layer classification, not the CLI's accepted +identity grammar. It does not introduce a broader accepted record profile, change +a runtime policy, or require Jason to adjudicate regex dialect details. Independent +review must confirm that this remains within the authorized offline build scope. + +## Required evidence + +- Preserve all four existing disagreement witnesses; do not delete/rename them out + of coverage. Test valid values, one/two final LF, CRLF, interior LF and relevant + Unicode line separators across every affected type family, with independent + expected shape/profile/CLI outcomes. Do not assume all separators share semantics. +- Include both records and wrapper/reference inventories, including unselected + records and declared inputs. Reject before identity lookup or permission result; + tests must distinguish profile refusal from a later missing-reference mismatch. +- Ordinary free-form text that legitimately permits escaped newlines must not be + blanket-rejected by this targeted identifier profile. Path/time custom formats + keep their existing semantics and separate tests. +- Differential oracle has zero unapproved schema disagreements; strict-only/profile + refusals are visibly counted and asserted. All other mandatory tests remain green. +- No normalization, extra output fields, dependency install, modified pinned inputs + or exceptions to required gates. Retain actual toolchain/platform receipts. + +## Gate + +Filbert reviews this exact proposal as a non-author. Rocko keeps code frozen pending +that verdict and coordinator instruction. If approved, record it as an explicit +addendum to the unchanged charter, update bound test identities deliberately, then +implement only within existing source/test paths and return a new frozen candidate. +Full independent CODE review and Jason's demo remain subsequent separate gates. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-verdict.md b/docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-verdict.md new file mode 100644 index 00000000..62d30be1 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-verdict.md @@ -0,0 +1,109 @@ +# FI-FILBERT-5 — independent pattern/profile addendum verdict + +Reviewer: filbert. Author/follow-up owner: darkwing. Date: 2026-09-06. + +## Admission and exact verdict + +**APPROVED for the written addendum only.** The proposed separation preserves +strict CLI admission while requiring genuine Node/Python schema agreement. It is +not a whitelist or permission to waive the red differential gate. + +No competing current personal owner-authorized assignment appeared. I did not +author/co-author this proposal. This narrow review does not start or replace the +later frozen implementation review. + +Reviewed file: +`docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-addendum.md` + +Independently verified SHA-256: +`afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5` + +Unchanged charter candidate 3 SHA-256 independently verified: +`19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` + +Pinned source baseline: +`d4696d09eb1b5dcf1028f30db2cd63735f51cb16`. + +## Numbered findings and dispositions + +1. **Confirmed / no blocking defect — the mismatch premise is reproducible.** + For the pinned id, runtimeId and digest definitions, Python/jsonschema accepts + a valid value followed by exactly one final LF, whereas the measured Node + ECMAScript patterns reject it. Two final LF, CRLF, CR, interior LF, U+2028 and + U+2029 did not share that acceptance. The proposal correctly requires independent + outcomes instead of treating every line separator alike. No correction required. + +2. **Confirmed / no blocking defect — no weaker admitted identity grammar.** + Normative points 2–4 require strict whole-string matching for every occurrence + of the affected types, including unselected records and declared wrapper inputs, + before indexing or admission. Original strings are preserved; no trimming or + newline-stripped identity can enter the graph. Thus reproducing the oracle's + schema-only acceptance does not enlarge the CLI's accepted identifier language: + the additional profile still rejects the final-LF cases with exit 2, + invalid-request/profile-pattern-mismatch and safe pre-admission output. + This fits the charter's existing schema/profile separation. No correction required. + +3. **Confirmed / no blocking defect — the proposed gate is not an oracle whitelist.** + Points 1,5,6 require an actual independent Node shape verdict, zero schema-column + disagreements, independently asserted profile verdicts and real CLI refusals. + They prohibit named exceptions, deleted witnesses, copied oracle answers, + harness-only answer adjustment and test-only rejection wrappers. Green must mean + schema agreement AND production profile enforcement, not relabelling an ongoing + discrepancy. No correction required; code review must verify these obligations. + +4. **Confirmed / bounded scope — targeted profile, not blanket newline rejection.** + The proposal leaves legitimate free-form multiline text and existing path/time + formats separate. I independently confirmed an escaped-newline mission objective + remains valid under the pinned record schema. This supports the required negative + control: an implementation that bans every decoded newline would violate this + addendum. Pinned schemas/checker, dependencies, output fields and allowed source + paths remain unchanged. No new runtime capability or grant is introduced. + +5. **Informational / unverified implementation gate — written approval does not turn the build green.** + I did not inspect the moving implementation, independently validate the reported + 239-file manifest, identify/re-execute its four particular witnesses, or run its + differential bridge/CLI. Those remain reported context, not my receipts. The new + frozen code candidate must preserve those witnesses, pass every mandatory check, + and receive full independent code review. No correction to the written proposal + is required; no functional acceptance is issued here. + +## Independent measurements in this review cycle + +1. `sha256sum` verified the exact addendum and unchanged charter hashes above. +2. Read `records.schema.json` using `git show` at d4696d09 and independently checked + SHA-256 `05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6`. +3. Inline Python using Python 3.12.8/jsonschema 4.26.0 validated three pinned type + definitions over eight variants each. An inline Node v26.8.1 subprocess evaluated + their actual ECMAScript patterns and a strict-end helper on the same original + values. **All 24 expected matrix rows asserted successfully; exit 0.** + + | Value variant, for each of id/runtimeId/digest | Python schema | Node pattern | Strict-end helper | + |---|---|---|---| + | Valid value | true | true | true | + | One final LF | true | false | false | + | Two final LF | false | false | false | + | CRLF | false | false | false | + | CR | false | false | false | + | U+2028 | false | false | false | + | U+2029 | false | false | false | + | Interior LF | false | false | false | + + The helper is only a regex measurement, not the proposed schema compatibility + implementation, profile traversal, differential bridge or CLI. +4. A separate in-memory mutation of the committed valid mission fixture inserted + an escaped newline into its free-form objective. **Pinned record-schema verdict + true, assertion passed, exit 0.** Custom path/calendar formats were not exercised + by that unchanged-field shape probe. + +No dependency installation, implementation edit, helper implementation file, +staging, commit, push, native/sync/live runtime, credential read or ~/.mosaic work +occurred. Calculations used synthetic strings and committed schemas in memory. +Only this offered verdict path was written in the repository. + +## Return boundary + +Approval permits treating this exact proposal as the reviewed written addendum, +not treating Rocko's current red build as accepted. Coordinator instruction and +deliberate binding of updated test identities remain necessary before code resumes. +A green frozen implementation, independent CODE review and Jason's demo remain +separate subsequent gates. Follow-up stays with darkwing; no automatic advancement. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r2.json b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r2.json new file mode 100644 index 00000000..9e2522f0 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r2.json @@ -0,0 +1,1525 @@ +{ + "candidate": "foundation-inspector rocko build r2 (FI-ROCKO-4)", + "generatedBy": "scratchpad/make-manifest-r2.py (machine-generated; no hand-transcribed hashes)", + "generatedAt": "2026-09-06T18:29:50Z", + "git": { + "head": "9a5fbdbda74b16adf488fe28138b2ba69ea5e669", + "branch": "main", + "note": "all candidate files untracked; no staging/commit/push" + }, + "toolchain": { + "node": "v26.8.1", + "python": "3.12.8", + "jsonschema": "4.26.0", + "kernel": "Linux 7.2.2-1-cachyos", + "strftime_year_999": "999" + }, + "pinnedInputs": { + "docs/plans/2026-09-06_foundation-inspector-charter.md": "19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6", + "docs/plans/foundation-v1-candidate/records.schema.json": "05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6", + "docs/plans/foundation-v1-candidate/check.py": "82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607", + "docs/plans/foundation-v1-candidate/records.fixtures.json": "d433d06da5cd38baf9e51c8857244ee70375db3b68e02a5325a6d1c2cc47da85", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-request.md": "90a1f329e859152d4ce8e157cbd6c56e6bcced16b4ed757822d2309514fa9a15", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build.md": "857470d97af6aeae4e7d7942c2a1d8455bfcda74ff68b8e1dc4ba8d066521fa4", + "docs/plans/reviews/2026-09-06_foundation-inspector-build-admission-findings.md": "8d9f7aab3b3bdf79345a07ba3595b966982b7667714ac7e3f669d65e328ca3d5", + "docs/plans/reviews/2026-09-06_foundation-inspector-code-review-gates.md": "6e7980186b2f49dec93d300f3681afd397ec7349c90806759a995695d9077b24" + }, + "counts": { + "source": 6, + "tests": 5, + "fixtures-demo": 20, + "fixtures-bundles": 185, + "fixtures-raw": 19, + "fixtures-meta": 3, + "suite": 1, + "total": 239 + }, + "aggregates": [ + { + "prefix": "scripts/foundation/fixtures/", + "files": 227, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "36d99b91065ed7af03f17b7b9cc309b3f7805ca5e3a337ddb5f3536f2ccaa563" + }, + { + "prefix": "scripts/foundation/fixtures/bundles/", + "files": 185, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "5fb4d351ca6b43fb04bb2fb98410da2a8f05f8f45dd22c5895685175cc2bf876" + }, + { + "prefix": "scripts/foundation/fixtures/raw/", + "files": 19, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "dbc620a7247aef198a3f502002d73fa8d598a5fc939f4bdb5352467fa50360d3" + }, + { + "prefix": "scripts/foundation/fixtures/demo/", + "files": 20, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "6a32862b8985e39a339a504338b3fb94558890152e04b64c155ebdc77e7a8956" + }, + { + "prefix": "scripts/foundation/", + "files": 237, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "6c111ad1165e0da219d566f919e25005af47fa004257a11e7e2750a4010b9ecb" + }, + { + "prefix": "scripts/", + "files": 239, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "e0fe89d9cc5245031ce484e9e0fe15b93319dd2cdf040800c52555a26fb1c1a6" + } + ], + "files": { + "source": [ + { + "path": "scripts/foundation-inspect.mjs", + "mode": "0o644", + "size": 8597, + "sha256": "dad369490ca8396d3b4a7bd4a1b7fa87b677a2b8cf991bf61672d446e5aa3c93" + }, + { + "path": "scripts/foundation/canonical.mjs", + "mode": "0o644", + "size": 2936, + "sha256": "a7760882c4c49992b9d702eb125a3e8f63048be543516b0eba61231018b90172" + }, + { + "path": "scripts/foundation/resolve.mjs", + "mode": "0o644", + "size": 76594, + "sha256": "aa842898ebb0bb2a911406314c4c3a2c4079b46bfd674c4ffba0176a1e32766c" + }, + { + "path": "scripts/foundation/strict-json.mjs", + "mode": "0o644", + "size": 10437, + "sha256": "7c31fe6be8cd29ee07662a21bb2e490a2ec799e263dec981ee257fcf7e6f6ebf" + }, + { + "path": "scripts/foundation/validate-record.mjs", + "mode": "0o644", + "size": 2506, + "sha256": "e4e70f60cce68e535ef98b0627647c440d620432cf8ddaed074df4e252ecde58" + }, + { + "path": "scripts/foundation/verify-schema.py", + "mode": "0o644", + "size": 21934, + "sha256": "b61031b6c2cea126133afda70894e7f2429b08bf2cd50fc766ec6b99f348c966" + } + ], + "tests": [ + { + "path": "scripts/foundation/canonical.test.mjs", + "mode": "0o644", + "size": 4197, + "sha256": "f504321983b2c41eff5af7e6dc27e40e360e0aae299d0a9abc369c743f5384f7" + }, + { + "path": "scripts/foundation/cli.test.mjs", + "mode": "0o644", + "size": 12645, + "sha256": "ccec06c266e03d878c1ecd9e8c20ee3f1fb82f478daead25efa4661b7090d83f" + }, + { + "path": "scripts/foundation/fixtures.test.mjs", + "mode": "0o644", + "size": 5421, + "sha256": "94e7508717efcafd11585a288a5d791e1e48a993794e2d470c6097f904befdb3" + }, + { + "path": "scripts/foundation/resolve.test.mjs", + "mode": "0o644", + "size": 19877, + "sha256": "6bb6d40fa6ec90fb52db658f77ca9fd27cc3eb8673f040f52fc126e67983a571" + }, + { + "path": "scripts/foundation/strict-json.test.mjs", + "mode": "0o644", + "size": 6837, + "sha256": "b40488edfc4eba6962e8c0949ddf1f92fdc15d630b7e9bdff72ac6d06bdb092e" + } + ], + "fixtures-demo": [ + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.json", + "mode": "0o644", + "size": 731, + "sha256": "c44b0935ed329c1a381f986997b1bc4be702fc4229166d8a0b49e4e80f9b2fa8" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.txt", + "mode": "0o644", + "size": 393, + "sha256": "c2fd118d44d21cbd709d30a2c2be2603740a81e628aa9d32f95d6eaf06d3a9a6" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.json", + "mode": "0o644", + "size": 48279, + "sha256": "ff7b859cd959876b2b6ede97fff90383a38acde765a16294b095ba220290c579" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.json", + "mode": "0o644", + "size": 1082, + "sha256": "ecf8313993ca27450d1753c6178be1a063fb0637f14be8f091de923b8b722516" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.txt", + "mode": "0o644", + "size": 536, + "sha256": "0e2807ab56d15670c51c8ad4a43f33b36c5672799937561f39e20c6e93be1dda" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.json", + "mode": "0o644", + "size": 50119, + "sha256": "54aad9047f7fe86892889ead543403c42986f591722d0dd23e0e027c3b7191d5" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.json", + "mode": "0o644", + "size": 767, + "sha256": "7ea412916404ec948c94e929cc7b2ce120b394944c66c7bfcc811d0721dd82db" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.txt", + "mode": "0o644", + "size": 390, + "sha256": "2cdd6d4e162fa904b03e8f8a88553a03065ac7fb646baabf21625d4f5962a79b" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.json", + "mode": "0o644", + "size": 47060, + "sha256": "7c0948d39abd3f1eeb0b0990766cbf584959712000faacaf47ae0d3501def3cc" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.json", + "mode": "0o644", + "size": 706, + "sha256": "42055bda71075ba5c710f011f83d470228f18097d93ac5585ba1b534cba0ef2a" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.txt", + "mode": "0o644", + "size": 370, + "sha256": "8ba4bbe92819ac8912c72e7c635730e99eac7916c0d924fc81b75115b5939b53" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.json", + "mode": "0o644", + "size": 46999, + "sha256": "7a3cfc58c1356cc2a986e0a6ed8f9f2dffbc33277ea1b7800020bfc55624b750" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.json", + "mode": "0o644", + "size": 1060, + "sha256": "742e479ddbb4cf2138d49ec0ac40cd038b6c20f8b9c0e2daffc5a859db9f4145" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.txt", + "mode": "0o644", + "size": 514, + "sha256": "388983ad6e4e31db6f5a688773ff2bf07d44d7ffe530eb7870e729a0f546278d" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.json", + "mode": "0o644", + "size": 49975, + "sha256": "f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab" + } + ], + "fixtures-bundles": [ + { + "path": "scripts/foundation/fixtures/bundles/adm-agent-disabled.json", + "mode": "0o644", + "size": 47000, + "sha256": "cb92e2f7c19b8d8133389f62393228c8d5471f1c21ee46166392ce7dd31a9c32" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-agent-policy-missing.json", + "mode": "0o644", + "size": 45528, + "sha256": "ace29f2529cc16edf21ccd828cb371febf1690c6c55fb9db6e129e7c19057799" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-artifact-undeclared.json", + "mode": "0o644", + "size": 46843, + "sha256": "50ddfbd0e192521c0bc146268d00b9a28fb32d28ec2c9cc7e519677f16387bfa" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-ended.json", + "mode": "0o644", + "size": 47003, + "sha256": "45e10ae6b5fc71617db1303155cac53e26854bf00524a45756cfcec066e9ae6e" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-other-subject.json", + "mode": "0o644", + "size": 47001, + "sha256": "3c9abc1bb5be9649de7c9c82bf50766ab533e35f715cc8658a5b256dd68d032a" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-rejected.json", + "mode": "0o644", + "size": 46999, + "sha256": "13127e14aa12c3d1b4ab7864bb2b1495c271aaf11c6d952105cb1f0a01c79181" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-stale.json", + "mode": "0o644", + "size": 48755, + "sha256": "297d062015d3fec28a8bdb1415106be963dd70ad7b367f00e2623ebfca7e0985" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-other-agent.json", + "mode": "0o644", + "size": 46999, + "sha256": "0f3f15457115e8ecc5f629b6d818f42491f0e484a01eaa981f053c71143e8c46" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-other-workspace.json", + "mode": "0o644", + "size": 46999, + "sha256": "c1a0021541ebc6c27a9f9b9ba9d0c4f062366a92bc52733384ea483b9a93b007" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-paused.json", + "mode": "0o644", + "size": 46997, + "sha256": "956fd1008a5161007bf74eb5eabd7dbcb23fd05236fac7122cf8d1733d18020b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-required-for-change.json", + "mode": "0o644", + "size": 46868, + "sha256": "d58b71364fa5d900fad552817f3e5ca87f8c2330972ea8fae40c817b31bb6eb3" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-stale.json", + "mode": "0o644", + "size": 48276, + "sha256": "ee369230403bc139e32e15eb121f623975c657bde5801adc2608bf704aca9b50" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-authorization-undeclared.json", + "mode": "0o644", + "size": 46999, + "sha256": "1bfc562d60c31c7dddaa43e0976861b30b64a67b69d338ec307c0936e597da74" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-consulted-work-not-readable.json", + "mode": "0o644", + "size": 47442, + "sha256": "e6f6edb8de4fa83895e854be796e7321c1c195c4431f6e3a56c11bdc804f38a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-cross-project-dependency.json", + "mode": "0o644", + "size": 47247, + "sha256": "e30e939819f7b2e05fd42efd02a22d8752e9cdb0fba82ed45d1b8bc93f128324" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-cross-workspace-mission.json", + "mode": "0o644", + "size": 46999, + "sha256": "88bca4ecf7f2cae37d92e0c6656b51c812a0df4546a44eeceb4494331afd63ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-grants-nothing.json", + "mode": "0o644", + "size": 48729, + "sha256": "39c227de39c473f631ff94b56bcbd5b113de9364f9bddd3488ac3926eaec66a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-not-accepted-change.json", + "mode": "0o644", + "size": 47051, + "sha256": "bb9bcc18a733912ede338804219dd3316ff8240e0206de2d182051394721dc2d" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-stale.json", + "mode": "0o644", + "size": 48209, + "sha256": "b46f5667dfa0b652e9afe35b7895affeeea309a4c66635b3c66b6bb10a104f55" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-blocked.json", + "mode": "0o644", + "size": 47000, + "sha256": "6fd722efaacb595940505ff3a0422ed0dcb4121460d1e1ead9d82ad9f1d2c400" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-stale.json", + "mode": "0o644", + "size": 48106, + "sha256": "034e7d5e51b02b19fb44db4840a7dfe31934fa100d227e96bae9b8522d7b0b17" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-agent-policy.json", + "mode": "0o644", + "size": 47055, + "sha256": "87f23f0296c0a2b309f35daca97a88630e391de09b1e3f19e6ec4710bb50473b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-execution.json", + "mode": "0o644", + "size": 47442, + "sha256": "d1921054dc83fc9c4b999cf12914b4eac51c814264bd96a370c80af7ace3d134" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-role.json", + "mode": "0o644", + "size": 47053, + "sha256": "41429de9ab146264b5b887ec8ee303cb373b13fdcc892d2ab8dd17b95b8babaa" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-parent-mission-accepted.json", + "mode": "0o644", + "size": 47001, + "sha256": "76b4fa2904c8bc4400b7a7b4ad92a9b5d0d0ddfd6645d18dd613b8a45b1bebd4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-parent-mission-stale.json", + "mode": "0o644", + "size": 47863, + "sha256": "8f85116b9278024d257bcda57a4ce0e0526744e9a73df53f0106de0d29a87062" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-prefix-string.json", + "mode": "0o644", + "size": 47057, + "sha256": "303379a7fd5315ffa38929af357e38447e4d5419c61ab4602dab42b79a63cc9b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-read-execution.json", + "mode": "0o644", + "size": 47351, + "sha256": "0d31922e61a2a433377dd398cae230f638b694a91e6a36795caad33d197d2112" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-task-narrows.json", + "mode": "0o644", + "size": 47502, + "sha256": "623ee44ebe8edb0943bb98b89a0ece148965fce669bd12202ff61bfa05068e61" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-write-outside.json", + "mode": "0o644", + "size": 47057, + "sha256": "fb40436ff51935c811e044a2fb01c6b160d88f48dfb4488368702314ae2fe087" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-policy-ceiling-stale.json", + "mode": "0o644", + "size": 47546, + "sha256": "7d0dd0314b7cdaa73031e069e6db0ba32f219b5b5b1e57ca231602e46c7c99d0" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-policy-missing.json", + "mode": "0o644", + "size": 47001, + "sha256": "01915e487576036117d92eeaeabfd8bcde56501cfe7c26e8dee5033fa747afa8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-registration-missing.json", + "mode": "0o644", + "size": 45959, + "sha256": "9fe8fc27cc6c83e2e85fbe449a6c74ca78a6c6f8101c60f7a37a6e01c2166086" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-retired.json", + "mode": "0o644", + "size": 47000, + "sha256": "b945bf5863105512d2ed75427eeb94037c0a66a52e77bccb4b1dbc2ecbc5f91f" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-ambiguous.json", + "mode": "0o644", + "size": 48077, + "sha256": "cd7322b10c7bda7ef5dccd2c0df7c472412ba35aaa0beb25de8a7b399f99ef8e" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-parent-not-current.json", + "mode": "0o644", + "size": 47863, + "sha256": "8283f6bd81ac0bb2d11fc46c0ee759e85ae87c4dc5f54a22ccafa41559faaa98" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-parent-stale.json", + "mode": "0o644", + "size": 48026, + "sha256": "e9dae21b733ab51636b8421fbbf41adb74aba250b4319ba8097d2aeff7b5c7ca" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-revoked.json", + "mode": "0o644", + "size": 48279, + "sha256": "ff7b859cd959876b2b6ede97fff90383a38acde765a16294b095ba220290c579" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-scope-role-missing.json", + "mode": "0o644", + "size": 46321, + "sha256": "49dcd13d523295c852fe5327b1227ac40b0d1503c836ff9b236800e4abbee5bc" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-agent-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "c2bde4733d09f154ff913dad96bdad19b0ab01e6fcf7bf8b565b409ca86f103a" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-project-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "59340a02bf4759a88bd89d65790e8cd7108d7e6516a4b737c1f07f362f86f4a4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-workspace-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "aef0bfbb5e5605b48e9e2ecc7a358ea9cb0209f2687703a1b2f1701fd809c7ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-intent-not-plan.json", + "mode": "0o644", + "size": 47003, + "sha256": "d5a260a2ad091b9ff23aa3abb0ab59b9712467601e49b1e18f2aadad26082288" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-intent-stale.json", + "mode": "0o644", + "size": 48755, + "sha256": "5323e36a3123fe5cf995de10e5fba493f5935fbf3f7dfde7c95a56a9bae94801" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-proposed.json", + "mode": "0o644", + "size": 47001, + "sha256": "9201feda75c3c5069748c5f85ec065beb173884e4e5146045de01577ec2aeb61" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-ref-stale.json", + "mode": "0o644", + "size": 48667, + "sha256": "5f59548d4ae2363277aa1ac15a1b8bfa29fa89bd3547c741138b1e34531ac8e3" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-policy-missing.json", + "mode": "0o644", + "size": 47001, + "sha256": "a0810fc2d9e8103e8c6065d977e729d7aad3cd8ee22851ab9486b93912ccbb80" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-registration-missing.json", + "mode": "0o644", + "size": 45740, + "sha256": "635dfad244da0d1da7cc3c12dc6a6b5983cf16526af12f6c104d96efed81377c" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-retiring.json", + "mode": "0o644", + "size": 47001, + "sha256": "6c229ce8d707d8221541362a93c36a7d32f46f8032cdc298d759aeefb9616e7a" + }, + { + "path": "scripts/foundation/fixtures/bundles/continuity-revision-gap.json", + "mode": "0o644", + "size": 48201, + "sha256": "853129ae49f83ac334a45cd36e9ec4b2970f3fd5060794f0402f8459c9d814b1" + }, + { + "path": "scripts/foundation/fixtures/bundles/continuity-supersedes-other-identity.json", + "mode": "0o644", + "size": 48201, + "sha256": "475ff6eac6b455d305b9af1dbbdf15c09fe308240416dcee67890bba926ddb9b" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-pair.json", + "mode": "0o644", + "size": 47255, + "sha256": "e87ca56e0c3ae241dfe7d6c61e3841877a8bbe79b80fbbf9dc48f938a706feda" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-self.json", + "mode": "0o644", + "size": 46995, + "sha256": "419980fc700a4d4870a3aeef78948d1acae91aac62769f73bde3dae5051fb956" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-mission-self-parent.json", + "mode": "0o644", + "size": 47034, + "sha256": "90c872b66ed4a190bb29bf6c8c1c40dada8cc98211893393ea0519c399d13027" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-supersedes-self-rev2.json", + "mode": "0o644", + "size": 47195, + "sha256": "f717ef0f14db090af156a3f08a2f1268f55f5aa9418aafe7dbc5916d826465b5" + }, + { + "path": "scripts/foundation/fixtures/bundles/deleg-approved-file-read.json", + "mode": "0o644", + "size": 50277, + "sha256": "4d1564ad708acfac940fcbbeff548fad649dbc08c1bd3708c1af86f756f1800e" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-change-w1.json", + "mode": "0o644", + "size": 50119, + "sha256": "54aad9047f7fe86892889ead543403c42986f591722d0dd23e0e027c3b7191d5" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-file-change-src.json", + "mode": "0o644", + "size": 47060, + "sha256": "7c0948d39abd3f1eeb0b0990766cbf584959712000faacaf47ae0d3501def3cc" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-file-read-src.json", + "mode": "0o644", + "size": 47058, + "sha256": "0b987af8fa79f322db409b7071f65f2ddfdac782f726dcb88e12c32b61c0a526" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-read-w1.json", + "mode": "0o644", + "size": 46999, + "sha256": "7a3cfc58c1356cc2a986e0a6ed8f9f2dffbc33277ea1b7800020bfc55624b750" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-artifact-identity.json", + "mode": "0o644", + "size": 47155, + "sha256": "5a816c1cb4e902b5c8bf85cd18c6215c624cae83f7dac2cbbd97b1da9541bd85" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-authorization.json", + "mode": "0o644", + "size": 47043, + "sha256": "814dcc1d5097c42a2066eb7aa1560f24a2580ed4434ede20e8cf492d84ab0b44" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-delegation-input.json", + "mode": "0o644", + "size": 51563, + "sha256": "2a1ba16ae05c25c4d9d6960cb8641d29f5de322046400af6658cbbeff1b9186d" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-record-identity.json", + "mode": "0o644", + "size": 48471, + "sha256": "b0db30a49d17aed1e39c53a3d8c73b962b53f56816309c64b4cb93bbf376880f" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-registry-identity.json", + "mode": "0o644", + "size": 47677, + "sha256": "8b95dc95d744b86a93e20a2f9eab9c2192e7d077cc37c19424b008edde548bd8" + }, + { + "path": "scripts/foundation/fixtures/bundles/execution-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47362, + "sha256": "3fd7ac1c0d44810c9cb30cf9972d0330cef0379f4c0c394b517d9dcbdfbaf9d3" + }, + { + "path": "scripts/foundation/fixtures/bundles/file-read-with-unaccepted-dependency.json", + "mode": "0o644", + "size": 47056, + "sha256": "6ebd0dee9886ff5f2f81351a155d5c0b2e6e62beb6bd17dda0f740ce32d3f297" + }, + { + "path": "scripts/foundation/fixtures/bundles/mission-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47495, + "sha256": "6e4acb4436a03454e1e5913b649d75c4df33b24d2f1da1116a742405cf94a5c7" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-change-without-proposal.json", + "mode": "0o644", + "size": 47007, + "sha256": "79923ed22f0b10cae5539b94cf79350529733e322fb7075958fef10ca7d68967" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-file-read-without-target.json", + "mode": "0o644", + "size": 46999, + "sha256": "3c35d78bb7d9d5e7895f6b0f7ea6279bb87ac0ec88b8e516cd61b9c1acadeff7" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unknown-name.json", + "mode": "0o644", + "size": 47001, + "sha256": "185a49b6e9fa1e218cbcad79aba57542a9c6b08ee44a1c8562aaa3bfbb386ff2" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unsupported-catalog.json", + "mode": "0o644", + "size": 47005, + "sha256": "00b116393a818923d4c5be9bef3942339a9b6b2c3d429a02dcb4d4926ae2b74f" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unsupported-workspace-retire.json", + "mode": "0o644", + "size": 47006, + "sha256": "1041dda47094246bd07fc3a9ad68ec59d482a8d380f460cefb6ebdf5673dce6e" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-work-read-with-target.json", + "mode": "0o644", + "size": 47047, + "sha256": "5c7c93a1b232c208ab371891746aa57e6bfcabca89fdbd3e261ef72f233db17b" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-assignment-task-other-workspace.json", + "mode": "0o644", + "size": 46999, + "sha256": "fc5d7a1fb64247c378a9b105450dcc954d8bfb2bd35c43c4558d1ed0fb5dd3fb" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-owning-project-mismatch.json", + "mode": "0o644", + "size": 46964, + "sha256": "12ce91207b12ce3b0c7d9f8e1921095cfdab02832ed54c41f4ab5ff4a50ead69" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-parent-other-project.json", + "mode": "0o644", + "size": 46999, + "sha256": "2b59f55a278a3632079bf393949050daf281c44623849d8511f486966c8d3392" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-parent-workspace.json", + "mode": "0o644", + "size": 47034, + "sha256": "205c6b725eb19a2a795d8f4b4bc64c762a92a770f170cb07fb7cf42669d8886e" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-project-id-scope.json", + "mode": "0o644", + "size": 46999, + "sha256": "e3747cde436b485f4b7b0137313a5919a710ef86dd47681baaab487f85950c5e" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-registration-parent-other-agent.json", + "mode": "0o644", + "size": 46999, + "sha256": "a5f871898dc8c0d5b8ce67de17de588176c69140cbcf41e615bd2f58d350a90a" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-registration-parent-other-project.json", + "mode": "0o644", + "size": 46999, + "sha256": "9074b8298e25c5715235476caf66363ec7c721e953deb2dd7835ade6bcf29ea6" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-workspace-id-scope.json", + "mode": "0o644", + "size": 46999, + "sha256": "7de9e947dbd89bc703cd864ac3840e8b938f59a750c5d51ba9d6bf63854fa49c" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-workspace-project-missing.json", + "mode": "0o644", + "size": 45553, + "sha256": "3f38f7154d9cb72d1fe27321899953f6a16fee4c95aa2d253d82807b8ad75e6f" + }, + { + "path": "scripts/foundation/fixtures/bundles/p2-inventory-unselected.json", + "mode": "0o644", + "size": 47000, + "sha256": "46b56f9e999441451b722ac1f826df24c349fad606c29224e7fed4453f078be5" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-all-pass-restricted-contexts.json", + "mode": "0o644", + "size": 51185, + "sha256": "ccf22e319ada775b014be68687a4d54da2234b2c6e01b3507319012ad7b2b5b1" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-not-recorded.json", + "mode": "0o644", + "size": 49934, + "sha256": "abe2511b7006e56a91b4d40213075aacac2e08dbdba35a7b2e69c07c345cf68c" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-rejected.json", + "mode": "0o644", + "size": 50119, + "sha256": "b4a19d16a0a6d07e071663db371d77073a615319d1a1b4862a1aa7935a4cb251" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-stale.json", + "mode": "0o644", + "size": 51883, + "sha256": "e52970ec3675eda0bdff8742b453c109e848eeea9e2c6b9c1ad6db3a227a7ce0" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-subjects-mismatch.json", + "mode": "0o644", + "size": 49871, + "sha256": "6d726823ea3181892717f6bdd0cfc03ca6ed68c52d27874208e595a001c1b348" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-wrong-kind.json", + "mode": "0o644", + "size": 50118, + "sha256": "cc810af17db5661a2c2446e26da390b008f66a0a25c7513108ec0c21cc8e4807" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-artifact-undeclared.json", + "mode": "0o644", + "size": 50119, + "sha256": "33a7c5c4d7927f1875ed21931807b83700068b289256607a075881c2b45017bf" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-exceeds-issuer-ceiling.json", + "mode": "0o644", + "size": 49375, + "sha256": "dade48f2e5147037ae009e42acb1de4fe56fc2b53711de0fd0dc65ce6a4df0af" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-input-missing.json", + "mode": "0o644", + "size": 48673, + "sha256": "25c0a2fd08a2270dd8609abd709a0e8d5df96923e521ef0c9c6b9414b0eb6626" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-missing.json", + "mode": "0o644", + "size": 49935, + "sha256": "d76b138aac1f6138c6c4d5a3a057e20ea7dcc0488b625e037e6a97297527abc7" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-other-recipient.json", + "mode": "0o644", + "size": 50119, + "sha256": "79a6ce60aca3376e5ba3123a6a9f7515ef70ea6d3479261443bf02dc8518b8b9" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-other-subject.json", + "mode": "0o644", + "size": 50119, + "sha256": "2f83da99d4a915d0fb97e9198c082604821f0fd45c239d82075fee88b852dd02" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-rejected.json", + "mode": "0o644", + "size": 50080, + "sha256": "d5cbc12c8697f707f7538ae2d17777d159d5b646268e283ead10c355e10cc3b8" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-stale.json", + "mode": "0o644", + "size": 51854, + "sha256": "0e8815068566524de3f07221ada8c14b3224193cef9b50d4ebd4a34ce84cef8c" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-wrong-operation.json", + "mode": "0o644", + "size": 50111, + "sha256": "3f00f24d96c061e5a266a534119717facdeed620aef5577f7a119e00963df12e" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-subject-intent-stale.json", + "mode": "0o644", + "size": 51875, + "sha256": "05e3b3696194ad9d64b0c8279914ffa3543eab36e5203e4847ff6682836b6187" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-subject-paused.json", + "mode": "0o644", + "size": 50117, + "sha256": "28fe6c19dab8365ed95a15f09faefa3d85c1310e7ed5d50446e1938cb12d23cd" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-target-task-blocked.json", + "mode": "0o644", + "size": 50121, + "sha256": "2c0f02ea2130c90ee2e46d8c008f900da6a65e1f1a448b96c976873fcf4ab84b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-target-task-intent-rejected.json", + "mode": "0o644", + "size": 50119, + "sha256": "bd53add1593ca3ae27673256f814d5a8c1cbb34ffa1ba31ad06687126156d916" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-is-not-authority.json", + "mode": "0o644", + "size": 49975, + "sha256": "f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-context-no-work-read.json", + "mode": "0o644", + "size": 50596, + "sha256": "1fd82546b0e78663afd29d2fbbb2151dea8b4477d5d2085b6ca185a3cd45a536" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-assignment-paused.json", + "mode": "0o644", + "size": 50117, + "sha256": "97e1353813efa41e5f7afdca86ee71f878e1e5bb9de300f36532aa49016cdf84" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-lacks-change.json", + "mode": "0o644", + "size": 50118, + "sha256": "0a58eacc571a255ef355573e26a7c1d69aafe8435c0a779c667577874f0a7d89" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-registration-revoked.json", + "mode": "0o644", + "size": 51400, + "sha256": "e8f336a3ba50d1d17d8330c871ab80cc0823ca612f15359371c28737534099e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-agent-missing.json", + "mode": "0o644", + "size": 50119, + "sha256": "b5a9258c22c41aaf440add5cc4f030365942adba5c1f7b48c33f55698af90f75" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-context-wrong-agent.json", + "mode": "0o644", + "size": 50119, + "sha256": "2bf77e5d80aa3c7cd5c8a9c9d5632f841dddeff0b3b42325a8a938cb2e318f39" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-context-wrong-scope.json", + "mode": "0o644", + "size": 50119, + "sha256": "432d503f0e105d7aa3bc71547d7e88f621870a54a8837b73ae6941daf5d279cd" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-selection-agent-mismatch.json", + "mode": "0o644", + "size": 50119, + "sha256": "ae7138b549b3e1b0a212d4a859294c4492755b6e108777d4b42a35e44f01c46b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-selection-null-assignment.json", + "mode": "0o644", + "size": 49934, + "sha256": "f06fe01ffa553af1473a87497c8192ef2d786cc2031e33ff8e3c7a42852c4267" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-assignment-stale.json", + "mode": "0o644", + "size": 51396, + "sha256": "90ac6747e11416ba52fc6c3ea57d735ee2d2993e8720a81955fdc73ddd3197dc" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-not-selected-assignment.json", + "mode": "0o644", + "size": 50119, + "sha256": "6eddffc4fa618dfe25c758cf2165a47c30b6a5cb9daa63685c6896fc501f57a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-cross-project-context.json", + "mode": "0o644", + "size": 51449, + "sha256": "61b7a1f1c2f8f4e576c40a424df4b29136577b4aa0f6519bda789b8ae026969f" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-cross-project-task.json", + "mode": "0o644", + "size": 50119, + "sha256": "be88c9667e9d4077039d327f63ce20c3a9d7475aac80912538b675db27810ff7" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-requester-lacks-change.json", + "mode": "0o644", + "size": 50118, + "sha256": "5655309b8c4b21b3a60806f52e0eb9285680af0a033867db606fcad737e95803" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-task-stale.json", + "mode": "0o644", + "size": 51527, + "sha256": "77d3b1605bd66b361cb4b89d5e4f4452f6a6a922ecc79043e5e122ead7904e7d" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-workspace-retired.json", + "mode": "0o644", + "size": 50120, + "sha256": "47afa9bbd362d9514bce95924e45d8bed59b86edafe8a5dcec34b9a64e6a6909" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-bounds-other-agent.json", + "mode": "0o644", + "size": 50273, + "sha256": "5f2b5ae9680c274c6d8dfe9df0a0ba00f3102f2b3d393f56358eef5a222046ea" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-bounds-other-registration.json", + "mode": "0o644", + "size": 50273, + "sha256": "bceaeb2aa35d12d66e3aa67928162a6b90485ed1800bf6c1068f6b90fcce27f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-exceeds-issuer-ceiling.json", + "mode": "0o644", + "size": 49506, + "sha256": "72649b1beb999e234e5f6bc8a0d0f97afb50221048de87e5742117202402a3c0" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-input-missing.json", + "mode": "0o644", + "size": 48825, + "sha256": "612f95f4efda53b423d3f91eb282cff12655e273c36e42ef7f3ab1ea5f734125" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-issuer-ceiling-narrows-path.json", + "mode": "0o644", + "size": 49415, + "sha256": "5b321508e396c175d87afe5298f6431a4e1de90545e07d0847964e163f56d813" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-narrows-to-delegated-ops.json", + "mode": "0o644", + "size": 50275, + "sha256": "2507c45e93894e3168d7d223c7c16e62b4f0506396532cf90bf4fd2f539c2666" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-not-approved.json", + "mode": "0o644", + "size": 50219, + "sha256": "e117ca5d24dc96b33efd7382460066fa4d869c0930e0be17c37f6ca6116eed57" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-policy-ceiling-stale.json", + "mode": "0o644", + "size": 50822, + "sha256": "7f4eeadff72d311f8eeba2005da48cbaf0158297c32b797e8fe564f6d21f654a" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-scope-not-modelled.json", + "mode": "0o644", + "size": 50174, + "sha256": "82754afdbd8e329c19e377050b64aa92c077528ffc7212cb9c07e3e73b17688f" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-stale.json", + "mode": "0o644", + "size": 52029, + "sha256": "32fbb55099b9a0e97cf7a0101f51cd43d8ba373eba48b3fc664332b89de9d412" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-subject-form-task.json", + "mode": "0o644", + "size": 50264, + "sha256": "4b67c67f0d2b23de599b8988745b39d3517c5f4d76f4c6a85d610a44d8f4ef67" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-subject-form-three.json", + "mode": "0o644", + "size": 50521, + "sha256": "c8529b73636366b52d023d4da4b2c2cdc9ea842a97bb2a345ff9f28c9b07ff79" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-wrong-kind.json", + "mode": "0o644", + "size": 50222, + "sha256": "6c81b577f70da7eec74977be72f625a29417495ff71e28b24cae5024087848ac" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-decision-subject.json", + "mode": "0o644", + "size": 46999, + "sha256": "77adf0a0c7033eb40ba2fe6bbb49a4d90153cf491ba33e6edbb2e075e68883a0" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-dependency.json", + "mode": "0o644", + "size": 46997, + "sha256": "c113550fec982779ed7d01b1900dee98709dc738447f7f02beaab88331979dbd" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-selection-assignment.json", + "mode": "0o644", + "size": 46999, + "sha256": "66510d5f82c0353f7a7223d992d248f67ab0aaa894f9e129e05044df343e9901" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-supersedes.json", + "mode": "0o644", + "size": 47195, + "sha256": "d27909e13bde230b9d1c92edd6048016c70eeddcbb8af727966aaa6e3a38ad28" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-task-intent.json", + "mode": "0o644", + "size": 46997, + "sha256": "c81c7c5c2802b88e594eedb378721cd4c2b970cc372f9c7ca5b4cee02def9345" + }, + { + "path": "scripts/foundation/fixtures/bundles/registration-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47493, + "sha256": "baea07d3ab6a92653c0d8f3e7d9ef24ece8eab05cd3f02ad702278951e58ba07" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-assignment-ended-without-reason.json", + "mode": "0o644", + "size": 46996, + "sha256": "d7850b97b4a1f355621a290d14e1b57fae55a7c5f0d7c63585fb12b3ba3fa6f1" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-bundle-version-2.json", + "mode": "0o644", + "size": 46999, + "sha256": "8fe4cf694ff5fee90bf195bb99cc954a153a92fa04eab7a8f43c34eea3d2806b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-input-other-mode.json", + "mode": "0o644", + "size": 48447, + "sha256": "8a58b8ce6547b351b69302ec31c7d16d2c26dc3801b44ec80a84b065c5ca5c45" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-input-parent-ref.json", + "mode": "0o644", + "size": 48480, + "sha256": "5b12d03072f33e05b59d0425647350dd6547584d105ab5835246b313a6be54a7" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-without-operations.json", + "mode": "0o644", + "size": 46960, + "sha256": "946584e5be25821e022cdff3a5b2787c2458c6ee1809ef0b630703815ac790df" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-missing-execution.json", + "mode": "0o644", + "size": 46933, + "sha256": "7b5bcecb69a4e88c44de482810887ed32b455deca9c97b32c52088918af67a1a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-missing-operation.json", + "mode": "0o644", + "size": 46933, + "sha256": "99934a0d7ce4d96575edce7276c8d31a89db3683e4afad29556bac9241232d37" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-path-grant-absolute.json", + "mode": "0o644", + "size": 47285, + "sha256": "b2f22d443464d52d0e809f596fd4a286139b7d637b5b746f26ffc7a9d65840aa" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-plan-with-delegated-operations.json", + "mode": "0o644", + "size": 47030, + "sha256": "7927734520f92ee53f8d9cc3244fcaf40224c1ad00f21c3796983e541aa827f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-project-mission-with-parent.json", + "mode": "0o644", + "size": 47178, + "sha256": "d96eec739e15ddab9c1aec3573829a9293a8bfb03f66a0e4a28100fe97e21d56" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-project-registration-with-parent.json", + "mode": "0o644", + "size": 47187, + "sha256": "d62b0f3612e8680a083860c5f4e2ffa377b7b7a71e3ca410f9f57fdae196820a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-proposal-on-read.json", + "mode": "0o644", + "size": 50111, + "sha256": "74d3aed956fb0e1ed49d7bf1bdf0fc670a62e70d032aefcf5588107945b9897a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-proto-key.json", + "mode": "0o644", + "size": 47018, + "sha256": "3521338f24e902c9dbafaf1a0af9a8be203b997ca5ba4d3de7e6e5f42a3e4f93" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-agent-actor-null-execution.json", + "mode": "0o644", + "size": 47001, + "sha256": "6aacb4bae667501f38d97b9cbe459d09bc887f749c80be04311e3fad328772cc" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-bad-id.json", + "mode": "0o644", + "size": 46999, + "sha256": "c38770ccc41af4f357f3eebcb602dd56255a8a90c9899a75d9e9be3f30bd4ddc" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-bad-time.json", + "mode": "0o644", + "size": 46995, + "sha256": "df248c9a003deb6d7feb77c414ef67190c3cd0f2084997d2e41b09dfbc3f53cf" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-calendar-invalid.json", + "mode": "0o644", + "size": 46999, + "sha256": "5db137c0843d7b7c87d4b8e06a8a7612cb17a98874379c4da03e41a00a2ff709" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-criteria-duplicate.json", + "mode": "0o644", + "size": 47075, + "sha256": "06f42f587fcd9c8e36df97f67155a4f1ab6a39d28ad4a7998af4231be72490c6" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-criteria-empty.json", + "mode": "0o644", + "size": 46915, + "sha256": "7bc8fb98e35c689fe7ce73a184056e5be70e11191fd461e42db619b8b5a48f2b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-displayname-too-long.json", + "mode": "0o644", + "size": 47118, + "sha256": "bbe6bfb36597210ea692f67bc35ea6f6409388beafd9e2e6af56bd57344db3c3" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-leap-second.json", + "mode": "0o644", + "size": 46999, + "sha256": "544f5f84a78021fa197ec8507edeefca58ca2cff18ca23284e9ee3c1d612b8df" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-missing-field.json", + "mode": "0o644", + "size": 46891, + "sha256": "aa520c95f7af8e81e0242711e33a610820908b7b0a7947977dbb62ff6bf039ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-rev1-with-supersedes.json", + "mode": "0o644", + "size": 47195, + "sha256": "c06fa51658d8a505e8836c2016d671955997f0ccc84ef8fa33e68084011ad9aa" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-status-enum.json", + "mode": "0o644", + "size": 46997, + "sha256": "8040becb0d4fc9cfef1e52247f0cd44d5b3f6fd9bb4dded8fa73baa9c1175b5b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-unknown-field.json", + "mode": "0o644", + "size": 47020, + "sha256": "a6702f7f22a94469084f05f79fce624445feae9909dc98e5912268c91e9683c4" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-content-non-ascii.json", + "mode": "0o644", + "size": 47002, + "sha256": "7b1cf22485682d612a4e74aa24a133ea859d1183958bfd78d9084d3dcd4cc179" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-digest-mismatch.json", + "mode": "0o644", + "size": 47030, + "sha256": "b3cb2f63220077df78bd0a83023300b8031c6b84afca9bbcda7d6ddf9989671f" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-missing-content.json", + "mode": "0o644", + "size": 46504, + "sha256": "393d89a31cf86a95e43a6a15cf950c382949a2aa7533998023865454b6c56461" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-plain-with-content.json", + "mode": "0o644", + "size": 48289, + "sha256": "de7fceecac43163b591300dcb29b18206e728edd9bd7d8c20a6e69c14366d43f" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-restrictions-none-with-endpoints.json", + "mode": "0o644", + "size": 47412, + "sha256": "09ece43156218d02e9b2ae467ff76310bd7e85080ed4a8ef55886e41ead9f5ed" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-restrictions-unknown-operation.json", + "mode": "0o644", + "size": 47184, + "sha256": "6bec9d250fa308cf524128d6a37db7c23ba53f27f269152833c5b9f0caafa56a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-simulation-false.json", + "mode": "0o644", + "size": 47000, + "sha256": "557da19b296380c61ce200473a11173a0805846c0496a2619b1c0d1757c2e15b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-backslash.json", + "mode": "0o644", + "size": 47052, + "sha256": "76668ec2c1bb0341ed5f1ab96e9f37d5201bafb4483e82af88f5fbad4ca24f26" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-control-char.json", + "mode": "0o644", + "size": 47061, + "sha256": "05fb3da905f93c975fbf6f5f8d7effa0df45997ba528d8070ffbd3cb915bf135" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-dotdot.json", + "mode": "0o644", + "size": 47063, + "sha256": "aeffd2e5d0362fa93b5b50445426dbfff2ee40056e128ae2c79c6fb19deca954" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-empty-segment.json", + "mode": "0o644", + "size": 47052, + "sha256": "3efdcae8c0691f77bc896ff5f6839882ac6ba26beb8ebe72f3579dd877980804" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-line-separator-echo-ok.json", + "mode": "0o644", + "size": 47055, + "sha256": "8fcee4457379e23fb2f92e92ab17a6e586acf95f1e504fed6a9b94ad3f783553" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-unicode-ok.json", + "mode": "0o644", + "size": 47064, + "sha256": "8040178585bb71bfb7a5e73b1d236d30bfee4358d1ec84d276705492d3a70055" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-wrong-root.json", + "mode": "0o644", + "size": 47042, + "sha256": "7ca0872b7e035b83d8adccfff7fed1669881629c9e5d248f82a9231120423a27" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-too-many-records.json", + "mode": "0o644", + "size": 385409, + "sha256": "69d89b94922c81f8a6aabfcaaeaf18cc64c0dfcf7399e0879dc2e35c99b863e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unknown-kind.json", + "mode": "0o644", + "size": 47485, + "sha256": "15abdcf2fab896e477facf78d6f58c237089d321480cf483ef03cac48d5756e6" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unknown-top-field.json", + "mode": "0o644", + "size": 47013, + "sha256": "fb62948772ee0297f951a53636667e166f6640dde611efe82b2f01103088d7cf" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unsupported-kind-session.json", + "mode": "0o644", + "size": 47486, + "sha256": "c2c6549b1088b007b031ebf30e56c7bc37503f7201f19f577e8a539e1c539da6" + }, + { + "path": "scripts/foundation/fixtures/bundles/taskless-file-read.json", + "mode": "0o644", + "size": 46875, + "sha256": "54b2d827b76e289754dd89c2b37a3bf22abe6bfe064b4ba9e53058eb627c8f9d" + }, + { + "path": "scripts/foundation/fixtures/bundles/taskless-work-read.json", + "mode": "0o644", + "size": 46814, + "sha256": "5eac10a34626b91eb881a86adb30042296df700218fd273a5cc1560fd205e61a" + }, + { + "path": "scripts/foundation/fixtures/bundles/work-parent-project-mission.json", + "mode": "0o644", + "size": 46964, + "sha256": "f13594287cf8a240bffcf47be56ed52c73f0c37343841b06aa5822aef81b8c69" + } + ], + "fixtures-raw": [ + { + "path": "scripts/foundation/fixtures/raw/raw-array-too-long.json", + "mode": "0o644", + "size": 2051, + "sha256": "617dbb4c661baa3f145bdf28ac60df6b868c172ddad965c8733e704204048b8b" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-bom-prefix.json", + "mode": "0o644", + "size": 47001, + "sha256": "b4a98e270b4024cb974cca5998a8c96e179441beb07c466649d67fc39abd7446" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-constructor-key.json", + "mode": "0o644", + "size": 50, + "sha256": "db542a3baaf43c88776789470e9df3c74409d6529ea21c503673229737ac5315" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-depth-33.json", + "mode": "0o644", + "size": 66, + "sha256": "ffba7a731546fa3b609b0503e5b88d1523824b0f082f1c2f9166b08b57933566" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-duplicate-key.json", + "mode": "0o644", + "size": 40, + "sha256": "d260762a322a0c015f31ea99777551042acf8ced23a8471d886376e8a5805063" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-empty-file.json", + "mode": "0o644", + "size": 0, + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-exponent.json", + "mode": "0o644", + "size": 47000, + "sha256": "909fe77e9bc4489366666eb4e16c5d966520bf753560ca2705a56cec319f2799" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-fraction-number.json", + "mode": "0o644", + "size": 47000, + "sha256": "d0ca3b6fcf776b9f605ae35ee00642e4dd78a4396124f46fe24a0d41fa10c174" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-invalid-utf8.json", + "mode": "0o644", + "size": 9, + "sha256": "375eaa6515e23b024e4feb1a132beaf9e35b865e54cca181d01a7a0527ea9791" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-lone-escape-surrogate.json", + "mode": "0o644", + "size": 15, + "sha256": "f6ce88b5d0b4f17a625764062775db270c469f9cdc94f09e66828315f5c547a9" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-negative-zero.json", + "mode": "0o644", + "size": 46999, + "sha256": "448a56829ffa3d4b120dc9437f7df4349a481e540a802e74b64907f0c5a5f026" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-not-object.json", + "mode": "0o644", + "size": 2, + "sha256": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-oversize-file.json", + "mode": "0o644", + "size": 1048577, + "sha256": "9fa2b407b667e7ce77587038b445ff3df704f6972572708dc18cf355f13a45f4" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-proto-key.json", + "mode": "0o644", + "size": 33, + "sha256": "9a62fc3db4305c0079d42bf9bbf062fc1f60e2cc5eec25a42164350d88550547" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-raw-control-in-string.json", + "mode": "0o644", + "size": 12, + "sha256": "d0e097db994e029efa27ecc5a3da2213f203f30cbb49d12d10c1b297ead8d9aa" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-string-too-long.json", + "mode": "0o644", + "size": 4106, + "sha256": "15dd16f02a269a3b62326cc91ae8199c23d756a42d986cca61c83f68ce519485" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-trailing-content.json", + "mode": "0o644", + "size": 47001, + "sha256": "433f22797e2c1eab343b1711c80c9249053487dba9df986cfcf4759356d7cf60" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-unsafe-integer.json", + "mode": "0o644", + "size": 47013, + "sha256": "daa5145f11272cbfcdc3115e6d397a6a82830099ad6c2db5d25ee0e16c5c8ad1" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-utf8-surrogate.json", + "mode": "0o644", + "size": 10, + "sha256": "957a49305a06fd66d2ef727af1f8d7fde39456593641835c0b640947d18895ac" + } + ], + "fixtures-meta": [ + { + "path": "scripts/foundation/fixtures/README.md", + "mode": "0o644", + "size": 2045, + "sha256": "aba48ba054d09247b048a8955507b87a275cd585870f1f658b7c6b826fc892bd" + }, + { + "path": "scripts/foundation/fixtures/build-fixtures.mjs", + "mode": "0o644", + "size": 56071, + "sha256": "094ecc811b85465cc0748a86b76b75c1784a2e0296f242b6ff2dbd1660b426a9" + }, + { + "path": "scripts/foundation/fixtures/index.json", + "mode": "0o644", + "size": 70969, + "sha256": "74988a1dcd4b48b0be2243d3fefff3b6de5d90a947094be201c3486142ca12a2" + } + ], + "suite": [ + { + "path": "scripts/test-foundation.sh", + "mode": "0o755", + "size": 7023, + "sha256": "fdfa13ce247bc9ad8f3617e248913aef384029198924685ada3431006ffdf114" + } + ] + } +} diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r3.json b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r3.json new file mode 100644 index 00000000..3a036187 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r3.json @@ -0,0 +1,1859 @@ +{ + "candidate": "foundation-inspector rocko build r3 (FI-ROCKO-5)", + "generatedBy": "scratchpad/make-manifest-r3.py (machine-generated; no hand-transcribed hashes)", + "generatedAt": "2026-09-06T21:22:43Z", + "git": { + "head": "9a5fbdbda74b16adf488fe28138b2ba69ea5e669", + "branch": "main", + "note": "all candidate files untracked; no staging/commit/push" + }, + "toolchain": { + "node": "v26.8.1", + "python": "3.12.8", + "jsonschema": "4.26.0", + "kernel": "Linux 7.2.2-1-cachyos", + "strftime_year_999": "999" + }, + "pinnedInputs": { + "docs/plans/2026-09-06_foundation-inspector-charter.md": "19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6", + "docs/plans/foundation-v1-candidate/records.schema.json": "05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6", + "docs/plans/foundation-v1-candidate/check.py": "82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607", + "docs/plans/foundation-v1-candidate/records.fixtures.json": "d433d06da5cd38baf9e51c8857244ee70375db3b68e02a5325a6d1c2cc47da85", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-request.md": "90a1f329e859152d4ce8e157cbd6c56e6bcced16b4ed757822d2309514fa9a15", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build.md": "857470d97af6aeae4e7d7942c2a1d8455bfcda74ff68b8e1dc4ba8d066521fa4", + "docs/plans/reviews/2026-09-06_foundation-inspector-build-admission-findings.md": "8d9f7aab3b3bdf79345a07ba3595b966982b7667714ac7e3f669d65e328ca3d5", + "docs/plans/reviews/2026-09-06_foundation-inspector-code-review-gates.md": "6e7980186b2f49dec93d300f3681afd397ec7349c90806759a995695d9077b24", + "docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-addendum.md": "afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5", + "docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-verdict.md": "03c979b77cc6b03b6685ba51ed1ce24c3f1d7b274ce8f772263a103670050da7", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r2.md": "0dabd82fffdc3a56ebf9a1d8b851832c3acee2cb9332892bde9dbb13151d5e19", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r2.json": "2e8b5f1998a3be6cc7fcc3fba308724d2a29ca166c08f005e1bca88ddbc14196" + }, + "counts": { + "source": 6, + "tests": 5, + "fixtures-demo": 20, + "fixtures-bundles": 240, + "fixtures-raw": 19, + "fixtures-meta": 3, + "suite": 1, + "total": 294 + }, + "aggregates": [ + { + "prefix": "scripts/foundation/fixtures/", + "files": 282, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "3de4c896d63041db0b6b5beb961d9dfa6486f7681dd16f91abb5d8ef48c16bfb" + }, + { + "prefix": "scripts/foundation/fixtures/bundles/", + "files": 240, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "aa4836a4a4f989ecc70acf8df770b894c6ef77e85c4e913c24bb422b1aef0afa" + }, + { + "prefix": "scripts/foundation/fixtures/raw/", + "files": 19, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "dbc620a7247aef198a3f502002d73fa8d598a5fc939f4bdb5352467fa50360d3" + }, + { + "prefix": "scripts/foundation/fixtures/demo/", + "files": 20, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "6a32862b8985e39a339a504338b3fb94558890152e04b64c155ebdc77e7a8956" + }, + { + "prefix": "scripts/foundation/", + "files": 292, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "4fbdcfb8d71612d4ac21dc0b7f5b60064847d7087bfbe8ec215a9f1abdbafb9a" + }, + { + "prefix": "scripts/", + "files": 294, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "e5f9039cf4614e8acc3f6c6a71f0a03dbc1c29002703029180d1ccef5757979c" + } + ], + "files": { + "source": [ + { + "path": "scripts/foundation-inspect.mjs", + "mode": "0o644", + "size": 8597, + "sha256": "dad369490ca8396d3b4a7bd4a1b7fa87b677a2b8cf991bf61672d446e5aa3c93" + }, + { + "path": "scripts/foundation/canonical.mjs", + "mode": "0o644", + "size": 2936, + "sha256": "a7760882c4c49992b9d702eb125a3e8f63048be543516b0eba61231018b90172" + }, + { + "path": "scripts/foundation/resolve.mjs", + "mode": "0o644", + "size": 79882, + "sha256": "eaa4a419618328915cd470ba192a88b8d313ee8fa48f600289ffe39df15280b2" + }, + { + "path": "scripts/foundation/strict-json.mjs", + "mode": "0o644", + "size": 10437, + "sha256": "7c31fe6be8cd29ee07662a21bb2e490a2ec799e263dec981ee257fcf7e6f6ebf" + }, + { + "path": "scripts/foundation/validate-record.mjs", + "mode": "0o644", + "size": 3040, + "sha256": "dcff28b53501b68fe7368adcbf02db0526ab4273d1c1c42e47df9a78a0bd9b4b" + }, + { + "path": "scripts/foundation/verify-schema.py", + "mode": "0o644", + "size": 28331, + "sha256": "e5fce462abd0e8c5be4e4543fd31146a35aba41a653d2aa105c28ca5a20deb67" + } + ], + "tests": [ + { + "path": "scripts/foundation/canonical.test.mjs", + "mode": "0o644", + "size": 4197, + "sha256": "f504321983b2c41eff5af7e6dc27e40e360e0aae299d0a9abc369c743f5384f7" + }, + { + "path": "scripts/foundation/cli.test.mjs", + "mode": "0o644", + "size": 14609, + "sha256": "a0bda7779739021da7cbe03b46209e370f7443100f6ea56a512468003d60b74c" + }, + { + "path": "scripts/foundation/fixtures.test.mjs", + "mode": "0o644", + "size": 5421, + "sha256": "94e7508717efcafd11585a288a5d791e1e48a993794e2d470c6097f904befdb3" + }, + { + "path": "scripts/foundation/resolve.test.mjs", + "mode": "0o644", + "size": 26004, + "sha256": "d7de059015edcf0bded7c4da901a7302394a42bf1e38b86bd403fbb01f5327ff" + }, + { + "path": "scripts/foundation/strict-json.test.mjs", + "mode": "0o644", + "size": 6837, + "sha256": "b40488edfc4eba6962e8c0949ddf1f92fdc15d630b7e9bdff72ac6d06bdb092e" + } + ], + "fixtures-demo": [ + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.json", + "mode": "0o644", + "size": 731, + "sha256": "c44b0935ed329c1a381f986997b1bc4be702fc4229166d8a0b49e4e80f9b2fa8" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.txt", + "mode": "0o644", + "size": 393, + "sha256": "c2fd118d44d21cbd709d30a2c2be2603740a81e628aa9d32f95d6eaf06d3a9a6" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.json", + "mode": "0o644", + "size": 48279, + "sha256": "ff7b859cd959876b2b6ede97fff90383a38acde765a16294b095ba220290c579" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.json", + "mode": "0o644", + "size": 1082, + "sha256": "ecf8313993ca27450d1753c6178be1a063fb0637f14be8f091de923b8b722516" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.txt", + "mode": "0o644", + "size": 536, + "sha256": "0e2807ab56d15670c51c8ad4a43f33b36c5672799937561f39e20c6e93be1dda" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.json", + "mode": "0o644", + "size": 50119, + "sha256": "54aad9047f7fe86892889ead543403c42986f591722d0dd23e0e027c3b7191d5" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.json", + "mode": "0o644", + "size": 767, + "sha256": "7ea412916404ec948c94e929cc7b2ce120b394944c66c7bfcc811d0721dd82db" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.txt", + "mode": "0o644", + "size": 390, + "sha256": "2cdd6d4e162fa904b03e8f8a88553a03065ac7fb646baabf21625d4f5962a79b" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.json", + "mode": "0o644", + "size": 47060, + "sha256": "7c0948d39abd3f1eeb0b0990766cbf584959712000faacaf47ae0d3501def3cc" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.json", + "mode": "0o644", + "size": 706, + "sha256": "42055bda71075ba5c710f011f83d470228f18097d93ac5585ba1b534cba0ef2a" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.txt", + "mode": "0o644", + "size": 370, + "sha256": "8ba4bbe92819ac8912c72e7c635730e99eac7916c0d924fc81b75115b5939b53" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.json", + "mode": "0o644", + "size": 46999, + "sha256": "7a3cfc58c1356cc2a986e0a6ed8f9f2dffbc33277ea1b7800020bfc55624b750" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.json", + "mode": "0o644", + "size": 1060, + "sha256": "742e479ddbb4cf2138d49ec0ac40cd038b6c20f8b9c0e2daffc5a859db9f4145" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.txt", + "mode": "0o644", + "size": 514, + "sha256": "388983ad6e4e31db6f5a688773ff2bf07d44d7ffe530eb7870e729a0f546278d" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.json", + "mode": "0o644", + "size": 49975, + "sha256": "f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab" + } + ], + "fixtures-bundles": [ + { + "path": "scripts/foundation/fixtures/bundles/adm-agent-disabled.json", + "mode": "0o644", + "size": 47000, + "sha256": "cb92e2f7c19b8d8133389f62393228c8d5471f1c21ee46166392ce7dd31a9c32" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-agent-policy-missing.json", + "mode": "0o644", + "size": 45528, + "sha256": "ace29f2529cc16edf21ccd828cb371febf1690c6c55fb9db6e129e7c19057799" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-artifact-undeclared.json", + "mode": "0o644", + "size": 46843, + "sha256": "50ddfbd0e192521c0bc146268d00b9a28fb32d28ec2c9cc7e519677f16387bfa" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-ended.json", + "mode": "0o644", + "size": 47003, + "sha256": "45e10ae6b5fc71617db1303155cac53e26854bf00524a45756cfcec066e9ae6e" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-other-subject.json", + "mode": "0o644", + "size": 47001, + "sha256": "3c9abc1bb5be9649de7c9c82bf50766ab533e35f715cc8658a5b256dd68d032a" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-rejected.json", + "mode": "0o644", + "size": 46999, + "sha256": "13127e14aa12c3d1b4ab7864bb2b1495c271aaf11c6d952105cb1f0a01c79181" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-stale.json", + "mode": "0o644", + "size": 48755, + "sha256": "297d062015d3fec28a8bdb1415106be963dd70ad7b367f00e2623ebfca7e0985" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-other-agent.json", + "mode": "0o644", + "size": 46999, + "sha256": "0f3f15457115e8ecc5f629b6d818f42491f0e484a01eaa981f053c71143e8c46" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-other-workspace.json", + "mode": "0o644", + "size": 46999, + "sha256": "c1a0021541ebc6c27a9f9b9ba9d0c4f062366a92bc52733384ea483b9a93b007" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-paused.json", + "mode": "0o644", + "size": 46997, + "sha256": "956fd1008a5161007bf74eb5eabd7dbcb23fd05236fac7122cf8d1733d18020b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-required-for-change.json", + "mode": "0o644", + "size": 46868, + "sha256": "d58b71364fa5d900fad552817f3e5ca87f8c2330972ea8fae40c817b31bb6eb3" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-stale.json", + "mode": "0o644", + "size": 48276, + "sha256": "ee369230403bc139e32e15eb121f623975c657bde5801adc2608bf704aca9b50" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-authorization-undeclared.json", + "mode": "0o644", + "size": 46999, + "sha256": "1bfc562d60c31c7dddaa43e0976861b30b64a67b69d338ec307c0936e597da74" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-consulted-work-not-readable.json", + "mode": "0o644", + "size": 47442, + "sha256": "e6f6edb8de4fa83895e854be796e7321c1c195c4431f6e3a56c11bdc804f38a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-cross-project-dependency.json", + "mode": "0o644", + "size": 47247, + "sha256": "e30e939819f7b2e05fd42efd02a22d8752e9cdb0fba82ed45d1b8bc93f128324" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-cross-workspace-mission.json", + "mode": "0o644", + "size": 46999, + "sha256": "88bca4ecf7f2cae37d92e0c6656b51c812a0df4546a44eeceb4494331afd63ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-grants-nothing.json", + "mode": "0o644", + "size": 48729, + "sha256": "39c227de39c473f631ff94b56bcbd5b113de9364f9bddd3488ac3926eaec66a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-not-accepted-change.json", + "mode": "0o644", + "size": 47051, + "sha256": "bb9bcc18a733912ede338804219dd3316ff8240e0206de2d182051394721dc2d" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-stale.json", + "mode": "0o644", + "size": 48209, + "sha256": "b46f5667dfa0b652e9afe35b7895affeeea309a4c66635b3c66b6bb10a104f55" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-blocked.json", + "mode": "0o644", + "size": 47000, + "sha256": "6fd722efaacb595940505ff3a0422ed0dcb4121460d1e1ead9d82ad9f1d2c400" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-stale.json", + "mode": "0o644", + "size": 48106, + "sha256": "034e7d5e51b02b19fb44db4840a7dfe31934fa100d227e96bae9b8522d7b0b17" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-agent-policy.json", + "mode": "0o644", + "size": 47055, + "sha256": "87f23f0296c0a2b309f35daca97a88630e391de09b1e3f19e6ec4710bb50473b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-execution.json", + "mode": "0o644", + "size": 47442, + "sha256": "d1921054dc83fc9c4b999cf12914b4eac51c814264bd96a370c80af7ace3d134" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-role.json", + "mode": "0o644", + "size": 47053, + "sha256": "41429de9ab146264b5b887ec8ee303cb373b13fdcc892d2ab8dd17b95b8babaa" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-parent-mission-accepted.json", + "mode": "0o644", + "size": 47001, + "sha256": "76b4fa2904c8bc4400b7a7b4ad92a9b5d0d0ddfd6645d18dd613b8a45b1bebd4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-parent-mission-stale.json", + "mode": "0o644", + "size": 47863, + "sha256": "8f85116b9278024d257bcda57a4ce0e0526744e9a73df53f0106de0d29a87062" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-prefix-string.json", + "mode": "0o644", + "size": 47057, + "sha256": "303379a7fd5315ffa38929af357e38447e4d5419c61ab4602dab42b79a63cc9b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-read-execution.json", + "mode": "0o644", + "size": 47351, + "sha256": "0d31922e61a2a433377dd398cae230f638b694a91e6a36795caad33d197d2112" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-task-narrows.json", + "mode": "0o644", + "size": 47502, + "sha256": "623ee44ebe8edb0943bb98b89a0ece148965fce669bd12202ff61bfa05068e61" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-write-outside.json", + "mode": "0o644", + "size": 47057, + "sha256": "fb40436ff51935c811e044a2fb01c6b160d88f48dfb4488368702314ae2fe087" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-policy-ceiling-stale.json", + "mode": "0o644", + "size": 47546, + "sha256": "7d0dd0314b7cdaa73031e069e6db0ba32f219b5b5b1e57ca231602e46c7c99d0" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-policy-missing.json", + "mode": "0o644", + "size": 47001, + "sha256": "01915e487576036117d92eeaeabfd8bcde56501cfe7c26e8dee5033fa747afa8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-registration-missing.json", + "mode": "0o644", + "size": 45959, + "sha256": "9fe8fc27cc6c83e2e85fbe449a6c74ca78a6c6f8101c60f7a37a6e01c2166086" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-retired.json", + "mode": "0o644", + "size": 47000, + "sha256": "b945bf5863105512d2ed75427eeb94037c0a66a52e77bccb4b1dbc2ecbc5f91f" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-ambiguous.json", + "mode": "0o644", + "size": 48077, + "sha256": "cd7322b10c7bda7ef5dccd2c0df7c472412ba35aaa0beb25de8a7b399f99ef8e" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-parent-not-current.json", + "mode": "0o644", + "size": 47863, + "sha256": "8283f6bd81ac0bb2d11fc46c0ee759e85ae87c4dc5f54a22ccafa41559faaa98" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-parent-stale.json", + "mode": "0o644", + "size": 48026, + "sha256": "e9dae21b733ab51636b8421fbbf41adb74aba250b4319ba8097d2aeff7b5c7ca" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-revoked.json", + "mode": "0o644", + "size": 48279, + "sha256": "ff7b859cd959876b2b6ede97fff90383a38acde765a16294b095ba220290c579" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-scope-role-missing.json", + "mode": "0o644", + "size": 46321, + "sha256": "49dcd13d523295c852fe5327b1227ac40b0d1503c836ff9b236800e4abbee5bc" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-agent-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "c2bde4733d09f154ff913dad96bdad19b0ab01e6fcf7bf8b565b409ca86f103a" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-project-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "59340a02bf4759a88bd89d65790e8cd7108d7e6516a4b737c1f07f362f86f4a4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-workspace-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "aef0bfbb5e5605b48e9e2ecc7a358ea9cb0209f2687703a1b2f1701fd809c7ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-intent-not-plan.json", + "mode": "0o644", + "size": 47003, + "sha256": "d5a260a2ad091b9ff23aa3abb0ab59b9712467601e49b1e18f2aadad26082288" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-intent-stale.json", + "mode": "0o644", + "size": 48755, + "sha256": "5323e36a3123fe5cf995de10e5fba493f5935fbf3f7dfde7c95a56a9bae94801" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-proposed.json", + "mode": "0o644", + "size": 47001, + "sha256": "9201feda75c3c5069748c5f85ec065beb173884e4e5146045de01577ec2aeb61" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-ref-stale.json", + "mode": "0o644", + "size": 48667, + "sha256": "5f59548d4ae2363277aa1ac15a1b8bfa29fa89bd3547c741138b1e34531ac8e3" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-policy-missing.json", + "mode": "0o644", + "size": 47001, + "sha256": "a0810fc2d9e8103e8c6065d977e729d7aad3cd8ee22851ab9486b93912ccbb80" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-registration-missing.json", + "mode": "0o644", + "size": 45740, + "sha256": "635dfad244da0d1da7cc3c12dc6a6b5983cf16526af12f6c104d96efed81377c" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-retiring.json", + "mode": "0o644", + "size": 47001, + "sha256": "6c229ce8d707d8221541362a93c36a7d32f46f8032cdc298d759aeefb9616e7a" + }, + { + "path": "scripts/foundation/fixtures/bundles/continuity-revision-gap.json", + "mode": "0o644", + "size": 48201, + "sha256": "853129ae49f83ac334a45cd36e9ec4b2970f3fd5060794f0402f8459c9d814b1" + }, + { + "path": "scripts/foundation/fixtures/bundles/continuity-supersedes-other-identity.json", + "mode": "0o644", + "size": 48201, + "sha256": "475ff6eac6b455d305b9af1dbbdf15c09fe308240416dcee67890bba926ddb9b" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-pair.json", + "mode": "0o644", + "size": 47255, + "sha256": "e87ca56e0c3ae241dfe7d6c61e3841877a8bbe79b80fbbf9dc48f938a706feda" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-self.json", + "mode": "0o644", + "size": 46995, + "sha256": "419980fc700a4d4870a3aeef78948d1acae91aac62769f73bde3dae5051fb956" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-mission-self-parent.json", + "mode": "0o644", + "size": 47034, + "sha256": "90c872b66ed4a190bb29bf6c8c1c40dada8cc98211893393ea0519c399d13027" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-supersedes-self-rev2.json", + "mode": "0o644", + "size": 47195, + "sha256": "f717ef0f14db090af156a3f08a2f1268f55f5aa9418aafe7dbc5916d826465b5" + }, + { + "path": "scripts/foundation/fixtures/bundles/deleg-approved-file-read.json", + "mode": "0o644", + "size": 50277, + "sha256": "4d1564ad708acfac940fcbbeff548fad649dbc08c1bd3708c1af86f756f1800e" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-change-w1.json", + "mode": "0o644", + "size": 50119, + "sha256": "54aad9047f7fe86892889ead543403c42986f591722d0dd23e0e027c3b7191d5" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-file-change-src.json", + "mode": "0o644", + "size": 47060, + "sha256": "7c0948d39abd3f1eeb0b0990766cbf584959712000faacaf47ae0d3501def3cc" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-file-read-src.json", + "mode": "0o644", + "size": 47058, + "sha256": "0b987af8fa79f322db409b7071f65f2ddfdac782f726dcb88e12c32b61c0a526" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-read-w1.json", + "mode": "0o644", + "size": 46999, + "sha256": "7a3cfc58c1356cc2a986e0a6ed8f9f2dffbc33277ea1b7800020bfc55624b750" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-artifact-identity.json", + "mode": "0o644", + "size": 47155, + "sha256": "5a816c1cb4e902b5c8bf85cd18c6215c624cae83f7dac2cbbd97b1da9541bd85" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-authorization.json", + "mode": "0o644", + "size": 47043, + "sha256": "814dcc1d5097c42a2066eb7aa1560f24a2580ed4434ede20e8cf492d84ab0b44" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-delegation-input.json", + "mode": "0o644", + "size": 51563, + "sha256": "2a1ba16ae05c25c4d9d6960cb8641d29f5de322046400af6658cbbeff1b9186d" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-record-identity.json", + "mode": "0o644", + "size": 48471, + "sha256": "b0db30a49d17aed1e39c53a3d8c73b962b53f56816309c64b4cb93bbf376880f" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-registry-identity.json", + "mode": "0o644", + "size": 47677, + "sha256": "8b95dc95d744b86a93e20a2f9eab9c2192e7d077cc37c19424b008edde548bd8" + }, + { + "path": "scripts/foundation/fixtures/bundles/execution-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47362, + "sha256": "3fd7ac1c0d44810c9cb30cf9972d0330cef0379f4c0c394b517d9dcbdfbaf9d3" + }, + { + "path": "scripts/foundation/fixtures/bundles/file-read-with-unaccepted-dependency.json", + "mode": "0o644", + "size": 47056, + "sha256": "6ebd0dee9886ff5f2f81351a155d5c0b2e6e62beb6bd17dda0f740ce32d3f297" + }, + { + "path": "scripts/foundation/fixtures/bundles/mission-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47495, + "sha256": "6e4acb4436a03454e1e5913b649d75c4df33b24d2f1da1116a742405cf94a5c7" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-change-without-proposal.json", + "mode": "0o644", + "size": 47007, + "sha256": "79923ed22f0b10cae5539b94cf79350529733e322fb7075958fef10ca7d68967" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-file-read-without-target.json", + "mode": "0o644", + "size": 46999, + "sha256": "3c35d78bb7d9d5e7895f6b0f7ea6279bb87ac0ec88b8e516cd61b9c1acadeff7" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unknown-name.json", + "mode": "0o644", + "size": 47001, + "sha256": "185a49b6e9fa1e218cbcad79aba57542a9c6b08ee44a1c8562aaa3bfbb386ff2" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unsupported-catalog.json", + "mode": "0o644", + "size": 47005, + "sha256": "00b116393a818923d4c5be9bef3942339a9b6b2c3d429a02dcb4d4926ae2b74f" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unsupported-workspace-retire.json", + "mode": "0o644", + "size": 47006, + "sha256": "1041dda47094246bd07fc3a9ad68ec59d482a8d380f460cefb6ebdf5673dce6e" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-work-read-with-target.json", + "mode": "0o644", + "size": 47047, + "sha256": "5c7c93a1b232c208ab371891746aa57e6bfcabca89fdbd3e261ef72f233db17b" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-assignment-task-other-workspace.json", + "mode": "0o644", + "size": 46999, + "sha256": "fc5d7a1fb64247c378a9b105450dcc954d8bfb2bd35c43c4558d1ed0fb5dd3fb" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-owning-project-mismatch.json", + "mode": "0o644", + "size": 46964, + "sha256": "12ce91207b12ce3b0c7d9f8e1921095cfdab02832ed54c41f4ab5ff4a50ead69" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-parent-other-project.json", + "mode": "0o644", + "size": 46999, + "sha256": "2b59f55a278a3632079bf393949050daf281c44623849d8511f486966c8d3392" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-parent-workspace.json", + "mode": "0o644", + "size": 47034, + "sha256": "205c6b725eb19a2a795d8f4b4bc64c762a92a770f170cb07fb7cf42669d8886e" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-project-id-scope.json", + "mode": "0o644", + "size": 46999, + "sha256": "e3747cde436b485f4b7b0137313a5919a710ef86dd47681baaab487f85950c5e" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-registration-parent-other-agent.json", + "mode": "0o644", + "size": 46999, + "sha256": "a5f871898dc8c0d5b8ce67de17de588176c69140cbcf41e615bd2f58d350a90a" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-registration-parent-other-project.json", + "mode": "0o644", + "size": 46999, + "sha256": "9074b8298e25c5715235476caf66363ec7c721e953deb2dd7835ade6bcf29ea6" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-workspace-id-scope.json", + "mode": "0o644", + "size": 46999, + "sha256": "7de9e947dbd89bc703cd864ac3840e8b938f59a750c5d51ba9d6bf63854fa49c" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-workspace-project-missing.json", + "mode": "0o644", + "size": 45553, + "sha256": "3f38f7154d9cb72d1fe27321899953f6a16fee4c95aa2d253d82807b8ad75e6f" + }, + { + "path": "scripts/foundation/fixtures/bundles/p2-inventory-unselected.json", + "mode": "0o644", + "size": 47000, + "sha256": "46b56f9e999441451b722ac1f826df24c349fad606c29224e7fed4453f078be5" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-artifact-digest-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "4a2ebbff331d103c82ded30ef6648bd7b21c7893a2ecd3b54000e6531f3a23ef" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-artifact-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ccaa0b7b543168cdf647fbc638f7f04cc8a722d74dd59ea56c518337f3c27362" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-artifact-run-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "3d7d4fce68e440044862466a91811c4f1d8d42746f041abf69fe8e010c7b5940" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-authorization-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "bb20c0c27a9f2e7c1aa8a551e6a4aab0817ca992e5e59965e2e26232aff5ba00" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-delegation-input-decision-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 50223, + "sha256": "f06e95047a396b4e076651780d034391b7b67036d5d464d40c80fc1f6a795dab" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-cr.json", + "mode": "0o644", + "size": 47001, + "sha256": "30dcfc1ac5bec6983bc611240d67128374f5c27a49aa346740dd169fc95233d4" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-crlf.json", + "mode": "0o644", + "size": 47003, + "sha256": "c41d28c9ac000ee612562f99b02ad353b4e504c9fc95eb5a58d9a7ad21ed9d80" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-interior-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "91399148e681674f46351ecc5d5612f816f4dfcca5f41c881ea20d8168779071" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "128e1dde7dd30dcbc4b2a628ed708afcaa3dbd317f0b56f941a1c815af2be901" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-two-final-lf.json", + "mode": "0o644", + "size": 47003, + "sha256": "f9e155deaf0fe356470fd284e115ad27fb7e9fdc12d0daaf6da025505309de78" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-u2028.json", + "mode": "0o644", + "size": 47002, + "sha256": "ce2f0c27ccad7ccf422656fb5f3d7c1a597280bef78f977dc1118a672742b9db" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-u2029.json", + "mode": "0o644", + "size": 47002, + "sha256": "4b040b44d1f39d124b67b5c456979188bf8bf38e36b38f839f82be01287084fa" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-escaped-newline-free-text-allowed.json", + "mode": "0o644", + "size": 47008, + "sha256": "d53f005a9283b35c48e7093c7c84959e67d0b9d7703240451d61fece9d4a59fe" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-cr.json", + "mode": "0o644", + "size": 47001, + "sha256": "e5c13868b71b409f6dfe0cbf66ee6a847d58077fee210a1a0009484ccfd34c3a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-crlf.json", + "mode": "0o644", + "size": 47003, + "sha256": "cef6102987f8de847b8c7ee1a23aa5e72403b1fbb6d11189cdacb2cdb463957f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-interior-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "a4cb7e74b3ad77a000de77b43dd172d8a68f0e16abf1abc07d972b35fd9076e7" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "eede0a44305cc40aa15c5181105fce7c695ae7381696deb022d7dc64bdb8f8c8" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-two-final-lf.json", + "mode": "0o644", + "size": 47003, + "sha256": "42986229494c4d80104293639927b9e8bf15d5fea94abb6c684492f8d2c7471a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-u2028.json", + "mode": "0o644", + "size": 47002, + "sha256": "50da9b3aefe6163cc3f53dce63fd37a5a742501b31f0fed6d466b23653265ed1" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-u2029.json", + "mode": "0o644", + "size": 47002, + "sha256": "4e1adcaa3665bba405508e448cdfc6b6e42f0fb255309d0261a22af08362983b" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-path-one-final-lf.json", + "mode": "0o644", + "size": 47060, + "sha256": "11aa009e6435ec07cf2fc218d7b23e9fb7ec5e2a42627fedeb54f8ac9cd24dbb" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-proposal-requester-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 50121, + "sha256": "bc2c862ee7d033551a261502d33ea309c0e54a0b13027c0f0477cce4144fa70a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-proposal-requester-context-assignment-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 50121, + "sha256": "47bd3833eaa5b240a0bf974958a7b0dfe9f69541a4921a0df4aaa6288a3d093f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-proposal-target-task-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 50121, + "sha256": "5f0ee53fabe59d51355f19d7b4f6cfd8115e708b857bafc296d54bed0e07c33c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-actor-execution-id-one-final-lf.json", + "mode": "0o644", + "size": 47037, + "sha256": "c95c2002cd0e345ea5589fce6a2688780bd523b76bd406439fcb906c463e621c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-actor-principal-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "a5fad7a69c136738bf74042c96ff1bd2f176b1bf768ff45cea0d9d7245021d9d" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-agent-type-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ab5174ec3f9136fc0290bd15743db5c89414f33938d731fa74882b49ae7d5edf" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-assignment-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "b36bb80f4607cb173012ff4c462d0ebbdfbd0be2ce07594796fbb89117a20cec" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-criterion-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "6defe71fd655947c23cdaa7e0eede5befe8aa92b06cb5762e0fa3d373ab3ae3c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-decision-subject-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "c71ce20d13abdc757fff44643ce2e9d58049f3f25fddb761519cf5ec9e46d1e1" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-dependency-ref-id-dangling-one-final-lf.json", + "mode": "0o644", + "size": 46999, + "sha256": "c61d5e84fa5dd4f16232fb71fcedd0d2cb535f40e3d4d1a15c0f5c3246348a7f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-file-root-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "a11a5f59429bda53240f0bc00c98b327d6555b2039ca7f7fb06e4982af8d0187" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-registration-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "17367fb547e62e68be267330eb98e04dd4fe2febb3faea461984901a5e7dee46" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-registry-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "e5853ec5455477ce99b82eea55a4faa42b40126434c28de1000b13406f2d94cb" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-scope-project-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "537f70c753dc214a66087a1ccc10825df2312c28355bbc1a4fbf1a06cffa56d5" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-scope-workspace-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "feddd255c7abdcbac1369b63df555627576e5c9bb70535a2fc1d78966acded2a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-supersedes-id-one-final-lf.json", + "mode": "0o644", + "size": 48203, + "sha256": "69ee9f06c06d673334e55bc5356c094b88078f2f45a676d338f8e6afb4aa0119" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-registry-digest-content-bearing-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "8123d8856307c79838b9e67c5176bf6dcfd650555429646452e7a5edd29fbef8" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-registry-digest-plain-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "797beab4cecc709ca1010d88472819080369775a074e0db94cd4744891c51a3c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-registry-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "c068396afaeac858d93b114ee314a331abeee7197e81d30716353ae4c1d91bd3" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-cr.json", + "mode": "0o644", + "size": 47001, + "sha256": "51c38ea4f0d088869f96a44566c6fb83e3cfb98f9c27ca67f2555f6359345390" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-crlf.json", + "mode": "0o644", + "size": 47003, + "sha256": "28a2723cdc46e87b2407e6fd2fe944cf78a67739d9c88a2ef42a7e06386a1afb" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-interior-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "97cf8d143f7309717250c86784638ee69c6dda16c3ec609119c4abc4f7800404" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "64f7323e9bd799ff1f0e997aa4c33baffb677853921b71990fc0baeac94acc59" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-two-final-lf.json", + "mode": "0o644", + "size": 47003, + "sha256": "1cecf2c29720b272c7f1822abb7a037a66cd209fcd6af5f7c1248d8368e163b7" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-u2028.json", + "mode": "0o644", + "size": 47002, + "sha256": "935dfe037f4bf48085bb8ef86d1f5ac1287f2c4ba5eab789913216f2af4840b5" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-u2029.json", + "mode": "0o644", + "size": 47002, + "sha256": "641b359f8bb90db0f4dfea964d8d46acf408b29ee37a6cf8ced04b975e60fa58" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "1aa1b1dd878798fb5f8201861bee7f4ee2de39cd21f91f75c168f0224c2e6ea2" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-assignment-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "f07fe150fc578fe9fad603f96ed51e7969aee20e970f5abad4fd1ee49ab94692" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-assignment-ref-scope-workspace-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ecdb566ec563416d08647279b2be7b5f0368866b99057d52dfd952e5922a5500" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-project-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "233062e341b71e65c7b900b1da1f93b1a7cb9d6ea603919584e339246233234f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-workspace-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ab430903ebe13af3a8ec1bd57f925196bac1aac38b8f6f2ec4058f42fd110f0e" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-time-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "22776f383b20d2620dcc2731c1f7b5bbf4c2556c50cd04e2ffcb1b8bddad853d" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-unselected-record-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "c22ce5dec672c5ad5fe8e1cdd6b901b98d8ae7134ebe2c4865387aeb8d7cfd0d" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-unselected-record-scope-project-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "559c7d55bc1a88ac918922cfb7d0f0daf285c08cb6c68d27728dbe024a9ccf93" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-all-pass-restricted-contexts.json", + "mode": "0o644", + "size": 51185, + "sha256": "ccf22e319ada775b014be68687a4d54da2234b2c6e01b3507319012ad7b2b5b1" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-not-recorded.json", + "mode": "0o644", + "size": 49934, + "sha256": "abe2511b7006e56a91b4d40213075aacac2e08dbdba35a7b2e69c07c345cf68c" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-rejected.json", + "mode": "0o644", + "size": 50119, + "sha256": "b4a19d16a0a6d07e071663db371d77073a615319d1a1b4862a1aa7935a4cb251" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-stale.json", + "mode": "0o644", + "size": 51883, + "sha256": "e52970ec3675eda0bdff8742b453c109e848eeea9e2c6b9c1ad6db3a227a7ce0" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-subjects-mismatch.json", + "mode": "0o644", + "size": 49871, + "sha256": "6d726823ea3181892717f6bdd0cfc03ca6ed68c52d27874208e595a001c1b348" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-wrong-kind.json", + "mode": "0o644", + "size": 50118, + "sha256": "cc810af17db5661a2c2446e26da390b008f66a0a25c7513108ec0c21cc8e4807" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-artifact-undeclared.json", + "mode": "0o644", + "size": 50119, + "sha256": "33a7c5c4d7927f1875ed21931807b83700068b289256607a075881c2b45017bf" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-exceeds-issuer-ceiling.json", + "mode": "0o644", + "size": 49375, + "sha256": "dade48f2e5147037ae009e42acb1de4fe56fc2b53711de0fd0dc65ce6a4df0af" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-input-missing.json", + "mode": "0o644", + "size": 48673, + "sha256": "25c0a2fd08a2270dd8609abd709a0e8d5df96923e521ef0c9c6b9414b0eb6626" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-missing.json", + "mode": "0o644", + "size": 49935, + "sha256": "d76b138aac1f6138c6c4d5a3a057e20ea7dcc0488b625e037e6a97297527abc7" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-other-recipient.json", + "mode": "0o644", + "size": 50119, + "sha256": "79a6ce60aca3376e5ba3123a6a9f7515ef70ea6d3479261443bf02dc8518b8b9" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-other-subject.json", + "mode": "0o644", + "size": 50119, + "sha256": "2f83da99d4a915d0fb97e9198c082604821f0fd45c239d82075fee88b852dd02" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-rejected.json", + "mode": "0o644", + "size": 50080, + "sha256": "d5cbc12c8697f707f7538ae2d17777d159d5b646268e283ead10c355e10cc3b8" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-stale.json", + "mode": "0o644", + "size": 51854, + "sha256": "0e8815068566524de3f07221ada8c14b3224193cef9b50d4ebd4a34ce84cef8c" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-wrong-operation.json", + "mode": "0o644", + "size": 50111, + "sha256": "3f00f24d96c061e5a266a534119717facdeed620aef5577f7a119e00963df12e" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-subject-intent-stale.json", + "mode": "0o644", + "size": 51875, + "sha256": "05e3b3696194ad9d64b0c8279914ffa3543eab36e5203e4847ff6682836b6187" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-subject-paused.json", + "mode": "0o644", + "size": 50117, + "sha256": "28fe6c19dab8365ed95a15f09faefa3d85c1310e7ed5d50446e1938cb12d23cd" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-target-task-blocked.json", + "mode": "0o644", + "size": 50121, + "sha256": "2c0f02ea2130c90ee2e46d8c008f900da6a65e1f1a448b96c976873fcf4ab84b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-target-task-intent-rejected.json", + "mode": "0o644", + "size": 50119, + "sha256": "bd53add1593ca3ae27673256f814d5a8c1cbb34ffa1ba31ad06687126156d916" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-is-not-authority.json", + "mode": "0o644", + "size": 49975, + "sha256": "f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-context-no-work-read.json", + "mode": "0o644", + "size": 50596, + "sha256": "1fd82546b0e78663afd29d2fbbb2151dea8b4477d5d2085b6ca185a3cd45a536" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-assignment-paused.json", + "mode": "0o644", + "size": 50117, + "sha256": "97e1353813efa41e5f7afdca86ee71f878e1e5bb9de300f36532aa49016cdf84" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-lacks-change.json", + "mode": "0o644", + "size": 50118, + "sha256": "0a58eacc571a255ef355573e26a7c1d69aafe8435c0a779c667577874f0a7d89" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-registration-revoked.json", + "mode": "0o644", + "size": 51400, + "sha256": "e8f336a3ba50d1d17d8330c871ab80cc0823ca612f15359371c28737534099e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-agent-missing.json", + "mode": "0o644", + "size": 50119, + "sha256": "b5a9258c22c41aaf440add5cc4f030365942adba5c1f7b48c33f55698af90f75" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-context-wrong-agent.json", + "mode": "0o644", + "size": 50119, + "sha256": "2bf77e5d80aa3c7cd5c8a9c9d5632f841dddeff0b3b42325a8a938cb2e318f39" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-context-wrong-scope.json", + "mode": "0o644", + "size": 50119, + "sha256": "432d503f0e105d7aa3bc71547d7e88f621870a54a8837b73ae6941daf5d279cd" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-selection-agent-mismatch.json", + "mode": "0o644", + "size": 50119, + "sha256": "ae7138b549b3e1b0a212d4a859294c4492755b6e108777d4b42a35e44f01c46b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-selection-null-assignment.json", + "mode": "0o644", + "size": 49934, + "sha256": "f06fe01ffa553af1473a87497c8192ef2d786cc2031e33ff8e3c7a42852c4267" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-assignment-stale.json", + "mode": "0o644", + "size": 51396, + "sha256": "90ac6747e11416ba52fc6c3ea57d735ee2d2993e8720a81955fdc73ddd3197dc" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-not-selected-assignment.json", + "mode": "0o644", + "size": 50119, + "sha256": "6eddffc4fa618dfe25c758cf2165a47c30b6a5cb9daa63685c6896fc501f57a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-cross-project-context.json", + "mode": "0o644", + "size": 51449, + "sha256": "61b7a1f1c2f8f4e576c40a424df4b29136577b4aa0f6519bda789b8ae026969f" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-cross-project-task.json", + "mode": "0o644", + "size": 50119, + "sha256": "be88c9667e9d4077039d327f63ce20c3a9d7475aac80912538b675db27810ff7" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-requester-lacks-change.json", + "mode": "0o644", + "size": 50118, + "sha256": "5655309b8c4b21b3a60806f52e0eb9285680af0a033867db606fcad737e95803" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-task-stale.json", + "mode": "0o644", + "size": 51527, + "sha256": "77d3b1605bd66b361cb4b89d5e4f4452f6a6a922ecc79043e5e122ead7904e7d" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-workspace-retired.json", + "mode": "0o644", + "size": 50120, + "sha256": "47afa9bbd362d9514bce95924e45d8bed59b86edafe8a5dcec34b9a64e6a6909" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-bounds-other-agent.json", + "mode": "0o644", + "size": 50273, + "sha256": "5f2b5ae9680c274c6d8dfe9df0a0ba00f3102f2b3d393f56358eef5a222046ea" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-bounds-other-registration.json", + "mode": "0o644", + "size": 50273, + "sha256": "bceaeb2aa35d12d66e3aa67928162a6b90485ed1800bf6c1068f6b90fcce27f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-exceeds-issuer-ceiling.json", + "mode": "0o644", + "size": 49506, + "sha256": "72649b1beb999e234e5f6bc8a0d0f97afb50221048de87e5742117202402a3c0" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-input-missing.json", + "mode": "0o644", + "size": 48825, + "sha256": "612f95f4efda53b423d3f91eb282cff12655e273c36e42ef7f3ab1ea5f734125" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-issuer-ceiling-narrows-path.json", + "mode": "0o644", + "size": 49415, + "sha256": "5b321508e396c175d87afe5298f6431a4e1de90545e07d0847964e163f56d813" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-narrows-to-delegated-ops.json", + "mode": "0o644", + "size": 50275, + "sha256": "2507c45e93894e3168d7d223c7c16e62b4f0506396532cf90bf4fd2f539c2666" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-not-approved.json", + "mode": "0o644", + "size": 50219, + "sha256": "e117ca5d24dc96b33efd7382460066fa4d869c0930e0be17c37f6ca6116eed57" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-policy-ceiling-stale.json", + "mode": "0o644", + "size": 50822, + "sha256": "7f4eeadff72d311f8eeba2005da48cbaf0158297c32b797e8fe564f6d21f654a" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-scope-not-modelled.json", + "mode": "0o644", + "size": 50174, + "sha256": "82754afdbd8e329c19e377050b64aa92c077528ffc7212cb9c07e3e73b17688f" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-stale.json", + "mode": "0o644", + "size": 52029, + "sha256": "32fbb55099b9a0e97cf7a0101f51cd43d8ba373eba48b3fc664332b89de9d412" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-subject-form-task.json", + "mode": "0o644", + "size": 50264, + "sha256": "4b67c67f0d2b23de599b8988745b39d3517c5f4d76f4c6a85d610a44d8f4ef67" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-subject-form-three.json", + "mode": "0o644", + "size": 50521, + "sha256": "c8529b73636366b52d023d4da4b2c2cdc9ea842a97bb2a345ff9f28c9b07ff79" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-wrong-kind.json", + "mode": "0o644", + "size": 50222, + "sha256": "6c81b577f70da7eec74977be72f625a29417495ff71e28b24cae5024087848ac" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-decision-subject.json", + "mode": "0o644", + "size": 46999, + "sha256": "77adf0a0c7033eb40ba2fe6bbb49a4d90153cf491ba33e6edbb2e075e68883a0" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-dependency.json", + "mode": "0o644", + "size": 46997, + "sha256": "c113550fec982779ed7d01b1900dee98709dc738447f7f02beaab88331979dbd" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-selection-assignment.json", + "mode": "0o644", + "size": 46999, + "sha256": "66510d5f82c0353f7a7223d992d248f67ab0aaa894f9e129e05044df343e9901" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-supersedes.json", + "mode": "0o644", + "size": 47195, + "sha256": "d27909e13bde230b9d1c92edd6048016c70eeddcbb8af727966aaa6e3a38ad28" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-task-intent.json", + "mode": "0o644", + "size": 46997, + "sha256": "c81c7c5c2802b88e594eedb378721cd4c2b970cc372f9c7ca5b4cee02def9345" + }, + { + "path": "scripts/foundation/fixtures/bundles/registration-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47493, + "sha256": "baea07d3ab6a92653c0d8f3e7d9ef24ece8eab05cd3f02ad702278951e58ba07" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-assignment-ended-without-reason.json", + "mode": "0o644", + "size": 46996, + "sha256": "d7850b97b4a1f355621a290d14e1b57fae55a7c5f0d7c63585fb12b3ba3fa6f1" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-bundle-version-2.json", + "mode": "0o644", + "size": 46999, + "sha256": "8fe4cf694ff5fee90bf195bb99cc954a153a92fa04eab7a8f43c34eea3d2806b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-input-other-mode.json", + "mode": "0o644", + "size": 48447, + "sha256": "8a58b8ce6547b351b69302ec31c7d16d2c26dc3801b44ec80a84b065c5ca5c45" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-input-parent-ref.json", + "mode": "0o644", + "size": 48480, + "sha256": "5b12d03072f33e05b59d0425647350dd6547584d105ab5835246b313a6be54a7" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-without-operations.json", + "mode": "0o644", + "size": 46960, + "sha256": "946584e5be25821e022cdff3a5b2787c2458c6ee1809ef0b630703815ac790df" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-missing-execution.json", + "mode": "0o644", + "size": 46933, + "sha256": "7b5bcecb69a4e88c44de482810887ed32b455deca9c97b32c52088918af67a1a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-missing-operation.json", + "mode": "0o644", + "size": 46933, + "sha256": "99934a0d7ce4d96575edce7276c8d31a89db3683e4afad29556bac9241232d37" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-path-grant-absolute.json", + "mode": "0o644", + "size": 47285, + "sha256": "b2f22d443464d52d0e809f596fd4a286139b7d637b5b746f26ffc7a9d65840aa" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-plan-with-delegated-operations.json", + "mode": "0o644", + "size": 47030, + "sha256": "7927734520f92ee53f8d9cc3244fcaf40224c1ad00f21c3796983e541aa827f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-project-mission-with-parent.json", + "mode": "0o644", + "size": 47178, + "sha256": "d96eec739e15ddab9c1aec3573829a9293a8bfb03f66a0e4a28100fe97e21d56" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-project-registration-with-parent.json", + "mode": "0o644", + "size": 47187, + "sha256": "d62b0f3612e8680a083860c5f4e2ffa377b7b7a71e3ca410f9f57fdae196820a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-proposal-on-read.json", + "mode": "0o644", + "size": 50111, + "sha256": "74d3aed956fb0e1ed49d7bf1bdf0fc670a62e70d032aefcf5588107945b9897a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-proto-key.json", + "mode": "0o644", + "size": 47018, + "sha256": "3521338f24e902c9dbafaf1a0af9a8be203b997ca5ba4d3de7e6e5f42a3e4f93" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-agent-actor-null-execution.json", + "mode": "0o644", + "size": 47001, + "sha256": "6aacb4bae667501f38d97b9cbe459d09bc887f749c80be04311e3fad328772cc" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-bad-id.json", + "mode": "0o644", + "size": 46999, + "sha256": "c38770ccc41af4f357f3eebcb602dd56255a8a90c9899a75d9e9be3f30bd4ddc" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-bad-time.json", + "mode": "0o644", + "size": 46995, + "sha256": "df248c9a003deb6d7feb77c414ef67190c3cd0f2084997d2e41b09dfbc3f53cf" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-calendar-invalid.json", + "mode": "0o644", + "size": 46999, + "sha256": "5db137c0843d7b7c87d4b8e06a8a7612cb17a98874379c4da03e41a00a2ff709" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-criteria-duplicate.json", + "mode": "0o644", + "size": 47075, + "sha256": "06f42f587fcd9c8e36df97f67155a4f1ab6a39d28ad4a7998af4231be72490c6" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-criteria-empty.json", + "mode": "0o644", + "size": 46915, + "sha256": "7bc8fb98e35c689fe7ce73a184056e5be70e11191fd461e42db619b8b5a48f2b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-displayname-too-long.json", + "mode": "0o644", + "size": 47118, + "sha256": "bbe6bfb36597210ea692f67bc35ea6f6409388beafd9e2e6af56bd57344db3c3" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-leap-second.json", + "mode": "0o644", + "size": 46999, + "sha256": "544f5f84a78021fa197ec8507edeefca58ca2cff18ca23284e9ee3c1d612b8df" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-missing-field.json", + "mode": "0o644", + "size": 46891, + "sha256": "aa520c95f7af8e81e0242711e33a610820908b7b0a7947977dbb62ff6bf039ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-rev1-with-supersedes.json", + "mode": "0o644", + "size": 47195, + "sha256": "c06fa51658d8a505e8836c2016d671955997f0ccc84ef8fa33e68084011ad9aa" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-status-enum.json", + "mode": "0o644", + "size": 46997, + "sha256": "8040becb0d4fc9cfef1e52247f0cd44d5b3f6fd9bb4dded8fa73baa9c1175b5b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-unknown-field.json", + "mode": "0o644", + "size": 47020, + "sha256": "a6702f7f22a94469084f05f79fce624445feae9909dc98e5912268c91e9683c4" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-content-non-ascii.json", + "mode": "0o644", + "size": 47002, + "sha256": "7b1cf22485682d612a4e74aa24a133ea859d1183958bfd78d9084d3dcd4cc179" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-digest-mismatch.json", + "mode": "0o644", + "size": 47030, + "sha256": "b3cb2f63220077df78bd0a83023300b8031c6b84afca9bbcda7d6ddf9989671f" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-missing-content.json", + "mode": "0o644", + "size": 46504, + "sha256": "393d89a31cf86a95e43a6a15cf950c382949a2aa7533998023865454b6c56461" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-plain-with-content.json", + "mode": "0o644", + "size": 48289, + "sha256": "de7fceecac43163b591300dcb29b18206e728edd9bd7d8c20a6e69c14366d43f" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-restrictions-none-with-endpoints.json", + "mode": "0o644", + "size": 47412, + "sha256": "09ece43156218d02e9b2ae467ff76310bd7e85080ed4a8ef55886e41ead9f5ed" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-restrictions-unknown-operation.json", + "mode": "0o644", + "size": 47184, + "sha256": "6bec9d250fa308cf524128d6a37db7c23ba53f27f269152833c5b9f0caafa56a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-simulation-false.json", + "mode": "0o644", + "size": 47000, + "sha256": "557da19b296380c61ce200473a11173a0805846c0496a2619b1c0d1757c2e15b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-backslash.json", + "mode": "0o644", + "size": 47052, + "sha256": "76668ec2c1bb0341ed5f1ab96e9f37d5201bafb4483e82af88f5fbad4ca24f26" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-control-char.json", + "mode": "0o644", + "size": 47061, + "sha256": "05fb3da905f93c975fbf6f5f8d7effa0df45997ba528d8070ffbd3cb915bf135" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-dotdot.json", + "mode": "0o644", + "size": 47063, + "sha256": "aeffd2e5d0362fa93b5b50445426dbfff2ee40056e128ae2c79c6fb19deca954" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-empty-segment.json", + "mode": "0o644", + "size": 47052, + "sha256": "3efdcae8c0691f77bc896ff5f6839882ac6ba26beb8ebe72f3579dd877980804" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-line-separator-echo-ok.json", + "mode": "0o644", + "size": 47055, + "sha256": "8fcee4457379e23fb2f92e92ab17a6e586acf95f1e504fed6a9b94ad3f783553" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-unicode-ok.json", + "mode": "0o644", + "size": 47064, + "sha256": "8040178585bb71bfb7a5e73b1d236d30bfee4358d1ec84d276705492d3a70055" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-wrong-root.json", + "mode": "0o644", + "size": 47042, + "sha256": "7ca0872b7e035b83d8adccfff7fed1669881629c9e5d248f82a9231120423a27" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-too-many-records.json", + "mode": "0o644", + "size": 385409, + "sha256": "69d89b94922c81f8a6aabfcaaeaf18cc64c0dfcf7399e0879dc2e35c99b863e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unknown-kind.json", + "mode": "0o644", + "size": 47485, + "sha256": "15abdcf2fab896e477facf78d6f58c237089d321480cf483ef03cac48d5756e6" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unknown-top-field.json", + "mode": "0o644", + "size": 47013, + "sha256": "fb62948772ee0297f951a53636667e166f6640dde611efe82b2f01103088d7cf" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unsupported-kind-session.json", + "mode": "0o644", + "size": 47486, + "sha256": "c2c6549b1088b007b031ebf30e56c7bc37503f7201f19f577e8a539e1c539da6" + }, + { + "path": "scripts/foundation/fixtures/bundles/taskless-file-read.json", + "mode": "0o644", + "size": 46875, + "sha256": "54b2d827b76e289754dd89c2b37a3bf22abe6bfe064b4ba9e53058eb627c8f9d" + }, + { + "path": "scripts/foundation/fixtures/bundles/taskless-work-read.json", + "mode": "0o644", + "size": 46814, + "sha256": "5eac10a34626b91eb881a86adb30042296df700218fd273a5cc1560fd205e61a" + }, + { + "path": "scripts/foundation/fixtures/bundles/work-parent-project-mission.json", + "mode": "0o644", + "size": 46964, + "sha256": "f13594287cf8a240bffcf47be56ed52c73f0c37343841b06aa5822aef81b8c69" + } + ], + "fixtures-raw": [ + { + "path": "scripts/foundation/fixtures/raw/raw-array-too-long.json", + "mode": "0o644", + "size": 2051, + "sha256": "617dbb4c661baa3f145bdf28ac60df6b868c172ddad965c8733e704204048b8b" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-bom-prefix.json", + "mode": "0o644", + "size": 47001, + "sha256": "b4a98e270b4024cb974cca5998a8c96e179441beb07c466649d67fc39abd7446" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-constructor-key.json", + "mode": "0o644", + "size": 50, + "sha256": "db542a3baaf43c88776789470e9df3c74409d6529ea21c503673229737ac5315" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-depth-33.json", + "mode": "0o644", + "size": 66, + "sha256": "ffba7a731546fa3b609b0503e5b88d1523824b0f082f1c2f9166b08b57933566" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-duplicate-key.json", + "mode": "0o644", + "size": 40, + "sha256": "d260762a322a0c015f31ea99777551042acf8ced23a8471d886376e8a5805063" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-empty-file.json", + "mode": "0o644", + "size": 0, + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-exponent.json", + "mode": "0o644", + "size": 47000, + "sha256": "909fe77e9bc4489366666eb4e16c5d966520bf753560ca2705a56cec319f2799" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-fraction-number.json", + "mode": "0o644", + "size": 47000, + "sha256": "d0ca3b6fcf776b9f605ae35ee00642e4dd78a4396124f46fe24a0d41fa10c174" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-invalid-utf8.json", + "mode": "0o644", + "size": 9, + "sha256": "375eaa6515e23b024e4feb1a132beaf9e35b865e54cca181d01a7a0527ea9791" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-lone-escape-surrogate.json", + "mode": "0o644", + "size": 15, + "sha256": "f6ce88b5d0b4f17a625764062775db270c469f9cdc94f09e66828315f5c547a9" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-negative-zero.json", + "mode": "0o644", + "size": 46999, + "sha256": "448a56829ffa3d4b120dc9437f7df4349a481e540a802e74b64907f0c5a5f026" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-not-object.json", + "mode": "0o644", + "size": 2, + "sha256": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-oversize-file.json", + "mode": "0o644", + "size": 1048577, + "sha256": "9fa2b407b667e7ce77587038b445ff3df704f6972572708dc18cf355f13a45f4" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-proto-key.json", + "mode": "0o644", + "size": 33, + "sha256": "9a62fc3db4305c0079d42bf9bbf062fc1f60e2cc5eec25a42164350d88550547" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-raw-control-in-string.json", + "mode": "0o644", + "size": 12, + "sha256": "d0e097db994e029efa27ecc5a3da2213f203f30cbb49d12d10c1b297ead8d9aa" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-string-too-long.json", + "mode": "0o644", + "size": 4106, + "sha256": "15dd16f02a269a3b62326cc91ae8199c23d756a42d986cca61c83f68ce519485" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-trailing-content.json", + "mode": "0o644", + "size": 47001, + "sha256": "433f22797e2c1eab343b1711c80c9249053487dba9df986cfcf4759356d7cf60" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-unsafe-integer.json", + "mode": "0o644", + "size": 47013, + "sha256": "daa5145f11272cbfcdc3115e6d397a6a82830099ad6c2db5d25ee0e16c5c8ad1" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-utf8-surrogate.json", + "mode": "0o644", + "size": 10, + "sha256": "957a49305a06fd66d2ef727af1f8d7fde39456593641835c0b640947d18895ac" + } + ], + "fixtures-meta": [ + { + "path": "scripts/foundation/fixtures/README.md", + "mode": "0o644", + "size": 2514, + "sha256": "ed0376589b203b1bcea6e1d82322311ec843eb7537756762bf917b8552d29523" + }, + { + "path": "scripts/foundation/fixtures/build-fixtures.mjs", + "mode": "0o644", + "size": 61777, + "sha256": "0386276f0e0ba8fbb3f4126ffabadd6afec90fc3a92749fe314783d26300aa5c" + }, + { + "path": "scripts/foundation/fixtures/index.json", + "mode": "0o644", + "size": 91390, + "sha256": "c013090406bb6bbb7b490b952eb4020065b4c732e4aecb0e6cf5c5c8037a6663" + } + ], + "suite": [ + { + "path": "scripts/test-foundation.sh", + "mode": "0o755", + "size": 8479, + "sha256": "73417979d1f9320603b0244350f9665d2bdf1485084c0928002ba033929b3c19" + } + ] + } +} diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r2.md b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r2.md new file mode 100644 index 00000000..d2b02143 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r2.md @@ -0,0 +1,305 @@ +# Foundation inspector — rocko build report r2 (FI-ROCKO-4 dispositions) + +Author: rocko (Claude Fable 5.1). Coordinator: darkwing. Task: FI-ROCKO-4. +Written 2026-09-06 18:35 UTC. Supersedes nothing: the original report +`docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build.md` is preserved +unedited (sha256 `857470d97af6aeae4e7d7942c2a1d8455bfcda74ff68b8e1dc4ba8d066521fa4`, +unchanged since delivery); this revision records the admission findings, what +changed, and the new frozen candidate. + +Inputs bound to this revision: + +| Input | sha256 | +|---|---| +| Admission findings `2026-09-06_foundation-inspector-build-admission-findings.md` (as received, 18:04Z) | `59233c6126c2355df5a367f0e61df7798e6cccfaa682454992fcd0d0df39c82c` | +| Same file now (darkwing's "Transport (2026-09-06 18:17 UTC)" footnote appended; no other change) | `8d9f7aab3b3bdf79345a07ba3595b966982b7667714ac7e3f669d65e328ca3d5` | +| Charter candidate 3 `docs/plans/2026-09-06_foundation-inspector-charter.md` | `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` | +| `records.schema.json` / `check.py` / `records.fixtures.json` | `05774aaf…72af6` / `82564a7d…4607` / `d433d06d…da85` (full values re-verified by the oracle gate 1 and listed in the manifest) | +| Build request `2026-09-06_foundation-inspector-rocko-build-request.md` (now, transport footnote included) | `90a1f329e859152d4ce8e157cbd6c56e6bcced16b4ed757822d2309514fa9a15` | +| Integration HEAD (unchanged, nothing staged) | `9a5fbdbda74b16adf488fe28138b2ba69ea5e669` | +| Machine-generated manifest `2026-09-06_foundation-inspector-rocko-build-manifest-r2.json` | `2e8b5f1998a3be6cc7fcc3fba308724d2a29ca166c08f005e1bca88ddbc14196` | + +Toolchain measured: Node v26.8.1, CPython 3.12.8, jsonschema 4.26.0, Linux +7.2.2-1-cachyos x86_64, glibc 2.44 (`strftime("%Y")` for year 999 → `999`). + +## 1. Per-finding dispositions + +### C1 — demo hash mismatch: transcription error, no drift + +Disposition: **typo in the original report, not evidence drift.** Corrected; +no evidence was regenerated to make anything match. + +- Advertised (report line 96): `…548fc023…`; measured then and now: + `f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab`. + The only difference is the transposition `fc`→`cf` at positions 51–52; the + other 62 hex characters are identical. +- Evidence the file never changed: my scratch hash listing taken at 18:03:52 UTC + (before the report was written) already contains the measured value for + `demo/prop-message-is-not-authority.json`; the file's mtime is 17:52:58 UTC, + earlier than that listing; the demo copy is byte-identical to + `bundles/prop-message-is-not-authority.json` (same hash, 49,975 bytes; asserted + by `fixtures.test.mjs` "demo copy drifted"); and both aggregate manifests + reproduce the original report's values with the original method: + bundles 185 files 9,235,245 bytes `a804e4ab253839ba2bb8ad7475d27512b2ef88e70a9779f9093fee5478de4823`, + raw 19 files 1,336,985 bytes `508ad85208f4b69676f3d041faa4ff4cd4a2f8de74b7bde9b0b89123a8485cc4`. +- Root cause: the original §3 tables were hand-transcribed. The r2 manifest is + written by a script (`manifest-r2.json`: path, mode, size, sha256 for all 239 + candidate files, aggregates, HEAD, toolchain, pinned inputs). No hash in this + report or in the manifest is typed by hand except where a value is quoted from + the original report to show the error. + +### C2 — oracle divergences were waived: waiver removed, one class remains as a spec blocker + +Disposition: **fixed for the calendar class; precise blocker for the pattern +class.** The oracle no longer has a `KNOWN_DIVERGENCES` list; every +schema-column disagreement is a problem and the oracle FAILS. + +Calendar class (2 cases, fixed): the pinned checker refuses years 0001–0999 on +this platform because `strftime("%Y")` is unpadded below 1000, so its +strptime/strftime round-trip fails. The inspector now refuses them identically +(`isValidTime`: year < 1000 refused; charter §8 "calendar semantics from the +pinned checker"). Witness: +`python3 -c 'from datetime import datetime; print(datetime(999,1,1).strftime("%Y"))'` → `999`. +The oracle asserts this witness as gate 3 before comparing and fails with an +explicit "platform boundary" message on a platform that pads. Cases +`calendar-year-0001`, `calendar-year-0999`, `calendar-year-0100` now agree +(both refuse). `resolve.test.mjs` adds the three boundary vectors. + +Pattern class (4 cases, blocker, unchanged verdicts): the pinned checker +evaluates `pattern` through Python `re.search`, whose `$` also matches +immediately before a trailing `\n`; ECMAScript `$` does not. Consequently the +pinned checker ACCEPTS `id`, `scope.projectId`, `authorizationRef` (runtimeId +pattern) and `policyRef.digest` values that carry a trailing newline, and the +inspector REFUSES them (`shape-pattern-mismatch`). Witnesses: + +``` +python3 -c 'import re; print(bool(re.search(r"^[a-z0-9][a-z0-9._-]{0,63}$", "abc\n")))' # True +node -e 'console.log(/^[a-z0-9][a-z0-9._-]{0,63}$/.test("abc\n"))' # false +``` + +Current oracle output (verbatim, exit 1): + +``` +platform witness: strftime('%Y') for year 999 -> '999' (pinned checker refuses years 0001..0999) +node v26.8.1; corpus 1432 records (38 pinned fixtures, 410 unique bundle records, 984 typeCase/mutation/lexical cases) +schema column: agree-valid 476, agree-invalid 915, DISAGREEMENTS 4; strict-only (parser-bound) cases: 27; unsupported-kind records not schema-assessed by the inspector: 10 +profile column (schema-valid records only): profile-valid 476, profile-invalid 0 + problem: DISAGREEMENT pattern-authorization-ref-trailing-newline: pinned-checker schema True / inspector schema False (inspector profile False, rule shape-pattern-mismatch) + problem: DISAGREEMENT pattern-digest-trailing-newline: pinned-checker schema True / inspector schema False (inspector profile False, rule shape-pattern-mismatch) + problem: DISAGREEMENT pattern-id-trailing-newline: pinned-checker schema True / inspector schema False (inspector profile False, rule shape-pattern-mismatch) + problem: DISAGREEMENT pattern-scope-project-id-trailing-newline: pinned-checker schema True / inspector schema False (inspector profile False, rule shape-pattern-mismatch) +FAIL: 4 differential problems +``` + +Why I did not resolve it myself: the findings forbid implementing a waiver or +changing the pinned schema/checker, and the charter forbids weakening safe +input handling. Making the inspector accept an identifier with an embedded +newline would relax input handling merely to turn the count green (the newline +would then be carried into `selection.projectId` and the text rendering, and a +`scope.projectId` of `p1\n` would be a distinct identity from `p1` that renders +almost identically). The schema-column comparison is therefore left honestly +red, and the suite reports `selftest: 36 passed, 1 failed` until this is ruled. + +Proposed amendment (for darkwing/Jason; I implement nothing until ruled): + +- (a) **Recommended.** Add to charter §8 (or the incorporated notes) a + "checker-dialect artifact" clause: "The pinned checker's `pattern` semantics + are Python `re.search`; its `$` accepts one trailing newline. This is a + dialect artifact, not an intended grammar. The inspector applies the pattern + with anchored (ECMAScript) semantics and refuses a trailing newline. The + differential oracle records the cases in this class by name, with the two + witnesses above, and reports them as an expected artifact-class difference + separately from agreement counts; any other disagreement fails." Under (a) the + oracle would carry a named, witnessed artifact class with exact direction + (pinned True / inspector False) and fail on any other direction or any other + case. This is the amendment I would implement; it needs a coordinator ruling + because it is a policy choice about which side is authoritative. +- (b) Against: relax the inspector to Python semantics. Rejected for the input + handling reason above and because §8 keeps "record-schema verdict distinct + from … refusal"; the inspector would have to accept an identifier the runtime + would never mint. +- (c) Against: drop the four mutations from the corpus. Rejected: it hides a + real, reproducible difference between the two implementations. + +Until ruled, the candidate's differential gate is **red by design**, and this +report does not claim oracle PASS. + +### C3 — `exit` outside the closed §7 fields: removed from the serialized result + +Disposition: **fixed; no charter amendment needed.** Exit status is process +metadata derived from the emitted result (`exitFor(result)`), never a field +of it and never a text line. + +- `resolve.mjs`: `RESULT_KEYS` is exactly the 12 charter §7 names in charter + order; `buildResult` builds no `exit` member and throws if the requested exit + is inconsistent with the derived result/reason; new export `exitFor(result)` + (allowed→0; refused/unresolved→3; invalid+io-failure→4; other invalid→2). + `evaluate()` returns `{ result, exit, detail }` with `exit` outside `result`. +- `foundation-inspect.mjs`: `renderText` ends with the `diagnostic:` line (no + `exit:` line); `run()` returns `{ json, result, exit }`; `main()` writes the + rendering and sets `process.exitCode = exit`. +- Tests whose expected keys come from the approved contract, not from the + implementation: `resolve.test.mjs` "closed result fields equal the pinned + charter §7 list" reads the charter file, asserts its sha256 is + `19b67211…798b6`, parses the twelve `- name:` bullets under "Closed result + fields, emitted on every outcome:", and asserts they equal both an + independent literal copy in the test and the implementation's `RESULT_KEYS`; + it also asserts `exit` is absent, checks `exitFor` on all four classes, and + that `buildResult` throws for four exit/reason inconsistencies. + `cli.test.mjs` and `fixtures.test.mjs` assert `!("exit" in parsed)` for every + spawned run and derive the expected process status from the parsed result; + text renderings are asserted to end with the diagnostic line and to contain + no `exit` line for all 204 cases. `test-foundation.sh` asserts the `--json` + key list equals the twelve names literally. +- Consequence: **the ten demo goldens (`*.expected.txt`, `*.expected.json`) were + regenerated** with the README loop because the contract fix removed one line + / one member from each; the five `*.expected.exit` files are byte-identical + to before (hashes `9a271f2a…86aa` for 0 and `1121cfcc…02a2` for 3, as in the + original table). `index.json` is unchanged (its `expect.exit` was always the + process status). Demo tree total bytes 249,096 → 248,991 (−105 = 5 × (8-byte + text line + 13-byte JSON member)). + +### C4 — demo step 2 could not show unchanged bytes: corrected + +Disposition: **fixed.** The BEFORE manifest is saved in a separate scratch +location first, the preview runs, then `sha256sum -c` verifies against that +SAME manifest (plus an inventory of path/type/size/mode/inode/mtime and a file +count). Corrected commands are in §4; the receipt from running them is in §3. + +### C5 — report omitted O_NONBLOCK: prose corrected, flag kept + +Disposition: **fixed in prose only; no code change.** The CLI opens the input +with `O_RDONLY | O_NOFOLLOW | O_NONBLOCK` (`REQUIRED_FLAGS` = those three +names) and refuses with `open-flags-unavailable` (exit 4) if any is not a +number on the platform. O_CLOEXEC is not used (charter §6). The original +report's lines 142 and 270 said `O_RDONLY|O_NOFOLLOW` only; that text was wrong +and is superseded by this paragraph. The FIFO test (`cli.test.mjs` "FIFO must be +refused after O_NONBLOCK open, not read") exercises the flag. + +## 2. Changed files (old → new sha256; everything else byte-identical) + +All under the FI-ROCKO-3 allowlist plus the two paths offered in the findings. +Nothing else in the working tree was touched; `git status` shows the same +pre-existing modified/untracked entries as before plus the two r2 documents. + +| File | Lines | Original report sha256 | r2 sha256 | +|---|---|---|---| +| `scripts/foundation-inspect.mjs` | 239→244 | `bfa1b78007c772c54fe1dab90a53e19e6bce7e4888a5adb2de0b2cfe43c5cddd` | `dad369490ca8396d3b4a7bd4a1b7fa87b677a2b8cf991bf61672d446e5aa3c93` | +| `scripts/foundation/resolve.mjs` | 1625→1646 | `9ae8b4255b5dc1f1e9b0d36549865268c12dc53f010984eb1e5616b127d1d8a2` | `aa842898ebb0bb2a911406314c4c3a2c4079b46bfd674c4ffba0176a1e32766c` | +| `scripts/foundation/verify-schema.py` | 453→467 | `7e3098655b2e5f261391d788c2112a6ffb055895e357b427bc68e5f2fa7b52d7` | `b61031b6c2cea126133afda70894e7f2429b08bf2cd50fc766ec6b99f348c966` | +| `scripts/foundation/resolve.test.mjs` | 294→333 | `05f27aa6c8a1b8ff2ee45e5de03a9aea5ed13cf011b2464c5865022dc9781449` | `6bb6d40fa6ec90fb52db658f77ca9fd27cc3eb8673f040f52fc126e67983a571` | +| `scripts/foundation/cli.test.mjs` | 279→281 | `b7e9a13c11e3e6f487ada2779c892cdf848526de1ef8b21387d15d4a461ddb62` | `ccec06c266e03d878c1ecd9e8c20ee3f1fb82f478daead25efa4661b7090d83f` | +| `scripts/foundation/fixtures.test.mjs` | 93→98 | `2827de36214c8014471fed3478c42bf48eddb3fbdbff82cac9e27851646b15d2` | `94e7508717efcafd11585a288a5d791e1e48a993794e2d470c6097f904befdb3` | +| `scripts/test-foundation.sh` | 132 | `76fb7ba9da4345271b6ba93228a9da69c7e55c4e44b9f4033e84a8f4b430e8ec` | `fdfa13ce247bc9ad8f3617e248913aef384029198924685ada3431006ffdf114` | +| `fixtures/demo/demo-read-w1.expected.txt` | | `8bfff519ce8275cfe59562efd04647c242c328a09b301b91d70491f030cf1600` | `8ba4bbe92819ac8912c72e7c635730e99eac7916c0d924fc81b75115b5939b53` | +| `fixtures/demo/demo-read-w1.expected.json` | | `55e10c1693787cd8e39d3a66841d30e2336080d2ae4450a806a7ae8373db476b` | `42055bda71075ba5c710f011f83d470228f18097d93ac5585ba1b534cba0ef2a` | +| `fixtures/demo/demo-file-change-src.expected.txt` | | `f5387217ca0a41d437468af33b7d87d06c0c5535ab5490b568f9866a13b2732e` | `2cdd6d4e162fa904b03e8f8a88553a03065ac7fb646baabf21625d4f5962a79b` | +| `fixtures/demo/demo-file-change-src.expected.json` | | `88c7793c6af17ca255525451a499d9f8bb165155e50d2ee936bd68ba82a876a7` | `7ea412916404ec948c94e929cc7b2ce120b394944c66c7bfcc811d0721dd82db` | +| `fixtures/demo/demo-change-w1.expected.txt` | | `2a1090e5f5ad08e2175830943a7c81928de970470893e803b1e440843152c348` | `0e2807ab56d15670c51c8ad4a43f33b36c5672799937561f39e20c6e93be1dda` | +| `fixtures/demo/demo-change-w1.expected.json` | | `36c287cba327070f7ff3dd9846421bee3ebd0dd52e9c602b68e84fa620ef4fc5` | `ecf8313993ca27450d1753c6178be1a063fb0637f14be8f091de923b8b722516` | +| `fixtures/demo/adm-registration-revoked.expected.txt` | | `624c9e5991597d59fc3379343b16e7eab9cb6434f054da3a4df7518742e3b36c` | `c2fd118d44d21cbd709d30a2c2be2603740a81e628aa9d32f95d6eaf06d3a9a6` | +| `fixtures/demo/adm-registration-revoked.expected.json` | | `b966d939e0d2851ef731462a0fda932e75f53b9aac406216ad440f781e036d0f` | `c44b0935ed329c1a381f986997b1bc4be702fc4229166d8a0b49e4e80f9b2fa8` | +| `fixtures/demo/prop-message-is-not-authority.expected.txt` | | `e7b0e9fa64abe0c0f8c91fbc9aa565988ce76cb3967672bfacafab350e20d8be` | `388983ad6e4e31db6f5a688773ff2bf07d44d7ffe530eb7870e729a0f546278d` | +| `fixtures/demo/prop-message-is-not-authority.expected.json` | | `53884bfdea21185141b9a06d52aa1c0fe8e7bfae6627b465929403521f9bc4d8` | `742e479ddbb4cf2138d49ec0ac40cd038b6c20f8b9c0e2daffc5a859db9f4145` | +| `fixtures/demo/prop-message-is-not-authority.json` | | (report typo `…548fc023…`) | `f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab` (file unchanged) | + +Unchanged (same hash as the original table): `strict-json.mjs`, `canonical.mjs`, +`validate-record.mjs`, `strict-json.test.mjs`, `canonical.test.mjs`, +`build-fixtures.mjs`, `index.json`, `fixtures/README.md`, all five +`*.expected.exit`, all five demo `*.json` bundles, all 185 bundles and 19 raw +fixtures (aggregates above). Full per-file listing with modes: `manifest-r2.json`. + +Aggregates (r2 manifest method: sha256 of the LC_ALL=C sorted `sha256sum` +listing with repo-relative paths): `scripts/foundation/fixtures/` 227 files +`36d99b91065ed7af03f17b7b9cc309b3f7805ca5e3a337ddb5f3536f2ccaa563`; +`scripts/foundation/` 237 files `6c111ad1165e0da219d566f919e25005af47fa004257a11e7e2750a4010b9ecb`; +all 239 candidate files `e0fe89d9cc5245031ce484e9e0fe15b93319dd2cdf040800c52555a26fb1c1a6`. +Original-method demo aggregate (run in `scripts/foundation/fixtures/`, +`sha256sum demo/* | sha256sum`): `7000fdd9b2a5e92256429e148240541fab3f93d2ef009e47b08baddcbcef5216`. + +Source changes in words: `resolve.mjs` (isValidTime year ≥ 1000; `exitFor`; +`RESULT_KEYS` without exit; `buildResult` consistency guard; `evaluate` returns +exit beside result). `foundation-inspect.mjs` (no exit line; `withExit`; exit via +`process.exitCode` only). `verify-schema.py` (waiver list and waiver comparison +deleted; gate 3 platform witness; trailing-newline cases renamed +`pattern-*-trailing-newline` and kept; calendar boundary cases; separate +schema/profile column summary; every disagreement is a problem). +`test-foundation.sh` (JSON key-list assertion; oracle summary grep lines). +Tests as described under C3 and C2. No new dependency, no new file outside the +allowlist, no `__pycache__` (verified absent after all runs). + +## 3. Receipts (all run 2026-09-06 18:2x–18:30 UTC at HEAD 9a5fbdbd) + +| Check | Result | +|---|---| +| `node --check` on all 10 `.mjs` files; `ast.parse` on `verify-schema.py` | OK | +| `node --test scripts/foundation/` | 58 tests, 58 pass, 0 fail (was 57; +1 charter-derived field test) | +| `python3 scripts/foundation/verify-schema.py` | **FAIL, exit 1: exactly the 4 `pattern-*-trailing-newline` disagreements** (output quoted under C2); gates 1–3 PASS; 38 pinned fixtures agree | +| `NO_COLOR=1 scripts/test-foundation.sh` | **`selftest: 36 passed, 1 failed`**; the one failure is the oracle gate above; all other checks OK (syntax, fixture regeneration equality, node tests, demo exits 0/0/3/3/3, usage 2, I/O 4 ×3, oversize 2, disclaimer, JSON key list, golden byte-match, sandboxed inventory unchanged, canaries never printed) | +| `python3 docs/plans/foundation-v1-candidate/check.py` | exit 0 | +| `scripts/test-config.sh` / `test-task.sh` / `test-release.sh` / `test-conductor.sh` / `test-auth.sh` | 24/0, 90/0, 14/0, 17/0, 15/0 passed/failed | +| `git rev-parse HEAD`; `git status` | `9a5fbdbd…`; nothing staged; only the pre-existing entries plus the two r2 documents | +| `scripts/foundation/__pycache__`, `docs/plans/foundation-v1-candidate/__pycache__` | absent | + +Owner-demo receipt (corrected C4 procedure, verbatim outcome lines): + +``` +step 1 demo-read-w1.json → result: allowed … operation: work.read target null rc=0 +step 2 before manifest: 227 files, sha256 cf2eed27c5e5b311d40e5346af89fbc5fdc7781488bf8ea9d663e66e7dd50d59 + demo-file-change-src.json → result: allowed … operation: file.change target workspace:src/main.mjs rc=0 + sha256sum -c against saved BEFORE manifest: all 227 OK + inventory (path/type/size/mode/inode/mtime) unchanged + file count unchanged: no file added +step 3 adm-workspace-registration-missing.json → refused / not-authorized / workspace-registration-missing, assignment null rc=3 +step 4 demo-change-w1.json → unresolved / unknown-effects / runtime-reconciliation-required; selection keeps asg-a-w1 rev 1 rc=3 + prop-all-pass-restricted-contexts.json → unresolved / unknown-effects / runtime-reconciliation-required rc=3 +extra adm-registration-revoked → refused/registration-revoked rc=3; prop-message-is-not-authority → refused/message-is-not-authority rc=3 +json keys = [disclaimer, preview, bundleVersion, authentication, declarations, result, reason, rule, selection, operation, proposal, diagnostic] rc=0 +``` + +Every text rendering begins `SYNTHETIC PREVIEW — NO LIVE EFFECTS` and ends with +the `diagnostic:` line. These are bounded evidence (finite tests, inventory +comparison), not an OS-sandbox proof; the original report's §8 qualifications +stand. + +## 4. Corrected owner-demo commands (A9; replaces original §9 step 2) + +```sh +# 1. selected agent/project/workspace with a permitted read preview (exit 0) +node scripts/foundation-inspect.mjs scripts/foundation/fixtures/demo/demo-read-w1.json + +# 2. assigned file.change preview (exit 0); prove no fixture file changed: +# save the BEFORE manifest elsewhere first, run, then verify against that SAME manifest +BEFORE="$(mktemp)" +( cd scripts/foundation/fixtures && find . -type f | LC_ALL=C sort | xargs sha256sum ) > "$BEFORE" +node scripts/foundation-inspect.mjs scripts/foundation/fixtures/demo/demo-file-change-src.json +( cd scripts/foundation/fixtures && sha256sum -c --quiet "$BEFORE" ) && echo "all $(wc -l < "$BEFORE") files unchanged" +[ "$(cd scripts/foundation/fixtures && find . -type f | wc -l)" = "$(wc -l < "$BEFORE")" ] && echo "no file added" + +# 3. unregistered workspace selected: refusal without fallback (exit 3, assignment null) +node scripts/foundation-inspect.mjs scripts/foundation/fixtures/bundles/adm-workspace-registration-missing.json + +# 4. cross-lane reassignment preview: original assignment stays selected; even fully +# supplied mock declarations cannot yield allowed (exit 3, unresolved) +node scripts/foundation-inspect.mjs scripts/foundation/fixtures/demo/demo-change-w1.json +node scripts/foundation-inspect.mjs scripts/foundation/fixtures/bundles/prop-all-pass-restricted-contexts.json + +# machine-readable form; process exit status is the only exit signal +node scripts/foundation-inspect.mjs --json scripts/foundation/fixtures/demo/demo-read-w1.json; echo "exit $?" +``` + +Step 5 (Jason's answer on clarity and acceptance) is darkwing's to record; this +report claims no acceptance. + +## 5. Open item and freeze + +Open: the C2 pattern-class ruling (§1 C2, options a/b/c). Until ruled the +oracle and therefore `test-foundation.sh` are red on exactly those four named +cases; I have not weakened, waived or removed them. + +Frozen at the r2 manifest (`manifest-r2.json`, sha256 `2e8b5f19…4196`; 239 +files) for independent review. Rocko changes nothing under the allowlist until +darkwing returns a ruling or reconciled findings. No staging, commit, +checkout/reset, push, charter/schema/verdict/coordinator-record edit, live or +native/sync work, credential or `~/.mosaic` read, network access or engine +launch occurred. C1 (Archify rev 3) remains HELD; no lane action taken. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r3.md b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r3.md new file mode 100644 index 00000000..de66cff4 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r3.md @@ -0,0 +1,180 @@ +# Foundation inspector — rocko build report r3 (FI-ROCKO-5: C2 correction under addendum FI-C2-1) + +Author: rocko (Claude Fable 5.1). Coordinator: darkwing. Task: FI-ROCKO-5. +Written 2026-09-06 21:25 UTC. Supersedes nothing: the original report +(`…-rocko-build.md`, sha256 `857470d97af6aeae4e7d7942c2a1d8455bfcda74ff68b8e1dc4ba8d066521fa4`) +and the r2 report/manifest (`…-rocko-build-r2.md` `0dabd82fffdc3a56ebf9a1d8b851832c3acee2cb9332892bde9dbb13151d5e19`, +`…-rocko-build-manifest-r2.json` `2e8b5f1998a3be6cc7fcc3fba308724d2a29ca166c08f005e1bca88ddbc14196`) +are preserved unedited. This revision records the C2 correction only, what +changed, and the new frozen candidate. + +## 0. Compatibility statement + +FI-ROCKO-5 is compatible with the standing chain and with the FI-ROCKO-3 build +request; **no blocker**. The open item of r2 §5 (the C2 pattern-class ruling) +is closed by darkwing's written addendum FI-C2-1 as approved by filbert +(FI-FILBERT-5). Nothing outside the original implementation/test allowlist was +touched; C1 (Archify rev 3) remains HELD with no lane action. + +Inputs bound to this revision: + +| Input | sha256 | +|---|---| +| Charter candidate 3 `docs/plans/2026-09-06_foundation-inspector-charter.md` (unchanged) | `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` | +| Addendum FI-C2-1 `2026-09-06_foundation-inspector-pattern-profile-addendum.md` (exact bytes) | `afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5` | +| Filbert verdict `2026-09-06_foundation-inspector-pattern-profile-verdict.md` | `03c979b77cc6b03b6685ba51ed1ce24c3f1d7b274ce8f772263a103670050da7` | +| `records.schema.json` / `check.py` / `records.fixtures.json` (pinned, unchanged) | `05774aaf…72af6` / `82564a7d…4607` / `d433d06d…da85` (full values re-verified by oracle gate 1 and listed in the manifest) | +| Build request `2026-09-06_foundation-inspector-rocko-build-request.md` | `90a1f329e859152d4ce8e157cbd6c56e6bcced16b4ed757822d2309514fa9a15` | +| Original report / r2 report / r2 manifest (preserved) | `857470d9…21fa4` / `0dabd82f…1e19` / `2e8b5f19…4196` | +| Integration HEAD (unchanged, nothing staged) | `9a5fbdbda74b16adf488fe28138b2ba69ea5e669` | +| Machine-generated manifest `2026-09-06_foundation-inspector-rocko-build-manifest-r3.json` | `3c2253b6c9f31e448c77aaac53977d41baecfb30e15845dcfffd8dc694428547` | + +The charter, addendum and verdict hashes above are also asserted by a unit +test (`resolve.test.mjs`, "the unchanged charter, the exact addendum and its +verdict are bound"); a byte change to any of the three fails the suite. + +Toolchain measured: Node v26.8.1, CPython 3.12.8, jsonschema 4.26.0, Linux +7.2.2-1-cachyos x86_64, glibc 2.44 (`strftime("%Y")` for year 999 → `999`). + +## 1. Design of the correction (addendum FI-C2-1, point by point) + +**Schema column (genuine pinned compatibility).** The pinned checker validates +`pattern` with Python `re.search`, whose `$` matches at end of string *or* +before exactly one final `\n`. `resolve.mjs` now exports `PINNED_PATTERNS` +(`id`, `runtimeId`, `digest`), `pinnedPatternMatches(re, v)` = +`re.test(v) || (v.endsWith("\n") && re.test(v.slice(0, -1)))`, and +`strictPatternMatches(re, v)` = `re.test(v)`. The shape gate +(`checkPattern`) uses the pinned semantics for `shape-pattern-mismatch`, so the +four r2 witnesses become schema agreements and the schema column has **zero** +disagreements with no named exceptions (r2's `KNOWN_DIVERGENCES` set is gone). + +**Strict production profile.** After the pinned check, `checkPattern` applies +the strict check on every occurrence of the three typed families (records, +scope ids, actor ids, supersedes, dependency refs, registry refs, payload ids, +unselected records, registry entries, artifacts, authorization, selection, +proposal and delegation inputs). A violation is recorded into a per-call +`profileSink` (path only; never the value). `validateRecordShape` returns +`{ verdict: "valid", profileViolations: [...] }` so the schema and profile +verdicts are independent. `validateBundleShape` collects violations from every +record and wrapper field and, after shape validation succeeds and before any +identity index or registry-digest profile, refuses with exit 2, +`invalid-request`, rule `profile-pattern-mismatch`, path of the first +violation in validation order. Closed §7 fields are unchanged; selection and +operation are withheld (`null`); the offending value is never echoed. + +**No trimming, normalization or waiver.** The original string is preserved; +no identity index is built from a profile-invalid value; no case name is +whitelisted anywhere. Precedence: profile refusal wins over a dangling +reference on the same field, so a profile-invalid ref is distinguishable from +a missing one (unit test with `ref-missing-dependency` vs +`profile-record-dependency-ref-id-dangling-one-final-lf`). + +**Free-form text, time and path keep their semantics.** Escaped newlines in +`mission.objective` / `task.purpose` stay schema- and profile-valid +(`profile-escaped-newline-free-text-allowed`, exit 0). `time` with a final LF +fails `shape-pattern-mismatch` (strptime refuses it in the pinned checker +too); `relativePath` with a final LF fails `path-invalid`. Neither is in the +profile. + +**Bridge.** `validate-record.mjs` now reports `schemaValid` and +`profileValid` independently, with `rule: "profile-pattern-mismatch"` and the +first violating path when the record is schema-valid but profile-invalid. + +**Oracle.** `verify-schema.py` builds an in-memory strict variant of the +pinned schema (only the three `$defs` patterns, trailing `$` → `\Z`; +`check_schema` passes; pinned bytes untouched) and computes the profile +column with the real jsonschema validator, never by name. The four original +witnesses are preserved by name as declared probes (schema True / profile +False); a newline matrix (valid, one final LF, two final LF, CRLF, CR, +interior LF, U+2028, U+2029) runs across 8 sites of the three families with +declared schema/profile outcomes; every strict-only refusal must carry the +fixed rule and a path; a run with no refusals or an unobserved declared +refusal is a problem. + +**One incidental fix in the allowlist.** The eight payload-level scope +re-checks previously re-validated `rec.scope` under the bare path `scope`, +which would have double-counted a profile violation; they now use +`requireScopeKind` (kind-only check with the proper `record.scope.kind` path). +No verdict of the 204 pre-existing fixtures changed (`index.json` gained 55 +entries and nothing else; demo goldens byte-identical). + +## 2. Filbert's FI-FILBERT-5 matrix, as implemented + +Per family (`id`, `runtimeId`, `digest`): Python / Node schema / strict. + +| Value | Python (pinned) | Node schema column | Strict profile | Inspector verdict | +|---|---|---|---|---| +| valid | T | T | T | proceeds | +| one final LF | T | T | **F** | exit 2 `invalid-request` `profile-pattern-mismatch` | +| two final LF, CRLF, CR, interior LF, U+2028, U+2029 | F | F | F | exit 2 `invalid-request` `shape-pattern-mismatch` | + +Asserted three ways: unit test on the exported predicates, 55 CLI fixtures, +and the oracle's declared probes against the real Python validators. + +## 3. Changed files (r2 → r3 sha256; everything else byte-identical) + +| File | Lines | r2 sha256 | r3 sha256 | +|---|---|---|---| +| `scripts/foundation/resolve.mjs` | 1646→1713 | `aa842898ebb0bb2a911406314c4c3a2c4079b46bfd674c4ffba0176a1e32766c` | `eaa4a419618328915cd470ba192a88b8d313ee8fa48f600289ffe39df15280b2` | +| `scripts/foundation/validate-record.mjs` | →71 | `e4e70f60cce68e535ef98b0627647c440d620432cf8ddaed074df4e252ecde58` | `dcff28b53501b68fe7368adcbf02db0526ab4273d1c1c42e47df9a78a0bd9b4b` | +| `scripts/foundation/verify-schema.py` | 467→575 | `b61031b6c2cea126133afda70894e7f2429b08bf2cd50fc766ec6b99f348c966` | `e5fce462abd0e8c5be4e4543fd31146a35aba41a653d2aa105c28ca5a20deb67` | +| `scripts/foundation/resolve.test.mjs` | 333→425 | `6bb6d40fa6ec90fb52db658f77ca9fd27cc3eb8673f040f52fc126e67983a571` | `d7de059015edcf0bded7c4da901a7302394a42bf1e38b86bd403fbb01f5327ff` | +| `scripts/foundation/cli.test.mjs` | 281→317 | `ccec06c266e03d878c1ecd9e8c20ee3f1fb82f478daead25efa4661b7090d83f` | `a0bda7779739021da7cbe03b46209e370f7443100f6ea56a512468003d60b74c` | +| `scripts/foundation/fixtures/build-fixtures.mjs` | →979 | `094ecc811b85465cc0748a86b76b75c1784a2e0296f242b6ff2dbd1660b426a9` | `0386276f0e0ba8fbb3f4126ffabadd6afec90fc3a92749fe314783d26300aa5c` | +| `scripts/foundation/fixtures/index.json` | 204→259 cases | `74988a1dcd4b48b0be2243d3fefff3b6de5d90a947094be201c3486142ca12a2` | `c013090406bb6bbb7b490b952eb4020065b4c732e4aecb0e6cf5c5c8037a6663` | +| `scripts/foundation/fixtures/README.md` | →51 | `aba48ba054d09247b048a8955507b87a275cd585870f1f658b7c6b826fc892bd` | `ed0376589b203b1bcea6e1d82322311ec843eb7537756762bf917b8552d29523` | +| `scripts/test-foundation.sh` | 132→143 | `fdfa13ce247bc9ad8f3617e248913aef384029198924685ada3431006ffdf114` | `73417979d1f9320603b0244350f9665d2bdf1485084c0928002ba033929b3c19` | + +Added: 55 bundle fixtures `scripts/foundation/fixtures/bundles/profile-*.json` +(generator output; listed individually in the manifest). Removed: none. +Unchanged: `scripts/foundation-inspect.mjs`, `strict-json.mjs`, +`canonical.mjs`, `fixtures.test.mjs`, `canonical.test.mjs`, +`strict-json.test.mjs`, all 19 raw fixtures, all 20 demo files and goldens +(demo aggregate `6a32862b…8956` and raw aggregate `dbc620a7…60d3` identical to r2). + +Manifest r3 aggregates (sha256 of the LC_ALL=C sorted `sha256sum` listing): +`fixtures/bundles/` 240 files `aa4836a4a4f989ecc70acf8df770b894c6ef77e85c4e913c24bb422b1aef0afa`; +`fixtures/` 282 `3de4c896d63041db0b6b5beb961d9dfa6486f7681dd16f91abb5d8ef48c16bfb`; +`scripts/foundation/` 292 `4fbdcfb8d71612d4ac21dc0b7f5b60064847d7087bfbe8ec215a9f1abdbafb9a`; +`scripts/` 294 `e5f9039cf4614e8acc3f6c6a71f0a03dbc1c29002703029180d1ccef5757979c`. + +## 4. New fixture inventory (55 cases) + +| Group | Rule | Count | Cases | +|---|---|---|---| +| profile | `profile-pattern-mismatch` | 34 | one final LF at 3 family sites (`id-record-id`, `runtime-id-authorization-ref`, `digest-registry-ref`) plus 31 further occurrence sites: record scope project/workspace ids, actor principal/execution ids, supersedes, dangling dependency ref, registry ref id, agent type, file root id, registration/assignment agent ids, criterion id, decision subject ref, unselected record id and its scope, registry id and plain/content-bearing digests, artifact run/id/digest, authorization, selection agent/project/workspace/assignment-ref ids and assignment-ref scope, proposal requester/target/context ids, delegation input decision ref | +| shape | `shape-pattern-mismatch` | 19 | two-final-lf, crlf, cr, interior-lf, u2028, u2029 at each of the 3 family sites (18) + `profile-time-one-final-lf` | +| shape | `path-invalid` | 1 | `profile-path-one-final-lf` | +| positive | — (exit 0) | 1 | `profile-escaped-newline-free-text-allowed` | + +Every `profile` case is asserted to return `selection: null`, `operation: +null`, and no `\n` inside any result string (loop in `resolve.test.mjs`). + +## 5. Receipts (all run 2026-09-06 21:0x–21:23 UTC at HEAD 9a5fbdbd) + +| Check | Result | +|---|---| +| `node --check` on all 10 `.mjs` files; `ast.parse` on `verify-schema.py` | OK | +| `node --test scripts/foundation/` | 63 tests, 63 pass, 0 fail (was 58; +5: binding, matrix, independence/order, precedence, CLI negative control) | +| `python3 scripts/foundation/verify-schema.py` | **PASS**, exit 0. Corpus 1539 records (38 pinned fixtures, 449 unique bundle records, 1052 typeCase/mutation/lexical). Schema column: agree-valid 519, agree-invalid 983, **DISAGREEMENTS 0**; strict-only (parser-bound) 27; unsupported-kind not assessed 10. Profile column: profile-valid 489, profile-invalid 30. `profile refusals asserted: 30 … 12 declared by name; 73 named probes verified` | +| `NO_COLOR=1 scripts/test-foundation.sh` | **`selftest: 43 passed, 0 failed`** (was 36/1); new checks: zero schema disagreements, refusals counted, profile exits 2/2/0, JSON refusal shape with value never echoed | +| CLI negative controls | selection `agentId` + one LF → status 2, `invalid-request`, `profile-pattern-mismatch`, selection/operation null, `agent-a` absent from JSON and text; two LFs → `shape-pattern-mismatch`; escaped newlines in free text → exit 0 | +| `python3 docs/plans/foundation-v1-candidate/check.py` | exit 0, `PASS: 35` | +| `scripts/test-config.sh` / `test-task.sh` / `test-release.sh` / `test-conductor.sh` / `test-auth.sh` | 24/0, 90/0, 14/0, 17/0, 15/0 passed/failed | +| Fixture regeneration | `build-fixtures.mjs` into a sandbox equals checked-in `bundles/`, `raw/`, `index.json`, demo bundles | +| `git rev-parse HEAD`; `git status` | `9a5fbdbd…`; nothing staged; only the pre-existing tracked modifications (BUILD-LOG.md, docs/SESSIONS.md, docs/plans/CURRENT.md) plus untracked candidate/review files | +| `scripts/foundation/__pycache__`, `docs/plans/foundation-v1-candidate/__pycache__` | absent | + +## 6. Constraints honoured and freeze + +No edit to charter, addendum, verdict, pinned schema/checker/fixtures, prior +reports or manifests, CURRENT, shared logs, root/package files, policies or +runtime data. No new dependency. No staging, commit, checkout/reset or push +(Dewey's index untouched). No live, native/sync, credential or `~/.mosaic` +work; no network; no engine launch. Tests spawn the inspector; the inspector +spawns nothing. Finite tests and static flags are evidence, not sandbox proof. + +Frozen at the r3 manifest (`manifest-r3.json`, sha256 `3c2253b6…8547`; 294 +files) for filbert's full code review. Rocko changes nothing under the +allowlist until darkwing returns reconciled findings. C1 (Archify rev 3) +remains HELD; no lane action taken. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-request.md b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-request.md new file mode 100644 index 00000000..a4b1e73a --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-request.md @@ -0,0 +1,80 @@ +# FI-ROCKO-3 — authorized synthetic inspector build + +Jason explicitly answered yes to Rocko building the offline synthetic inspector, +Filbert independently reviewing the code, and darkwing bringing an owner demo. +No push, live registration/permission changes, migration or fleet work authorized. +Requester/integration owner: darkwing. Sole implementation writer: rocko. +Independent reviewer: filbert (not yet dispatched to code review). +Issue: #53. Recheck current assignment compatibility; do not displace held owner work. + +## Exact build contract + +Repository: /home/jwoltje/src/mosaic-stack-dev-test +Charter: docs/plans/2026-09-06_foundation-inspector-charter.md, candidate 3 +SHA-256 19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6 +Incorporated r2 sections 5–13, overridden by charter (especially §10): +docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md +SHA-256 f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1 +Independent charter verdict: reviews/2026-09-06_foundation-inspector-filbert-verdict-r3.md +SHA-256 15f3d04cb74a7296be6a1a26f2c0907b9dd2b08fdd1eb0ef51c95c7a52ff0399 +Source/schema baseline d4696d09eb1b5dcf1028f30db2cd63735f51cb16; +accepted map 7345f330fc6bfae5aa1d896c78cfb7cbe62efbae. + +## Only authorized implementation paths + +- scripts/foundation-inspect.mjs +- scripts/foundation/strict-json.mjs +- scripts/foundation/canonical.mjs +- scripts/foundation/resolve.mjs +- scripts/foundation/validate-record.mjs (test-only bridge) +- scripts/foundation/verify-schema.py (verification only) +- scripts/foundation/*.test.mjs +- scripts/foundation/fixtures/** +- scripts/test-foundation.sh +- Your build report only: docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build.md + +No edits to charter, incorporated notes, verdicts, CURRENT, shared logs, root/package +files, existing schemas, extension/native files, policies, runtime data or installations. +If another helper/path or specification decision is necessary, return a concrete +proposal rather than improvise outside the allowlist. Work only in these initially +unclaimed implementation paths; report any conflicting existing work before editing. + +## Implementation and verification obligations + +Implement the approved charter, not the superseded r1/r2 shorthand. Four supported +operations only; assignment.change has no allowed branch. All output is simulation- +labelled; no source of mock data becomes authenticated authority. Preserve exact +role/issuer/assignment/execution narrowing, supported-work scope, history/current +semantics, output privacy, closed shapes and lexical-versus-schema distinction. + +Build coherent fixtures plus positive/negative tests for A1–A8 and §§10.1–10.5. +Prepare simple commands for Jason's later A9 demo; do not claim owner acceptance. +Required verification: pinned schema/checker hashes; mandatory differential oracle +with existing explicit Python/jsonschema 4.26.0 (no installation or silent skip); +unit and isolated CLI/non-effect/privacy tests; syntax and diff checks; foundation +checker and all five repository suites. Report exact commands/toolchain/results. +Do not run native/sync tests against Dewey's installation. Use disposable synthetic +HOME/cwd/fixtures/data-root for new CLI tests. No credential, live-data or ~/.mosaic +reads/experiments, network access or engine launches. Tests may spawn test subprocesses; +the inspector must not. Do not report static flags or finite tests as sandbox proof. + +## Shared Git and review handoff + +Dewey owns the shared index per MS58-DW-1. NO staging, commit, checkout/reset or push. +Read-only git inspection is allowed. Other source changes may occur concurrently; +keep pinned contract inputs distinct from the measured integration HEAD. + +Return FI-ROCKO-3 admission/blocker, then completion with exact changed-file list, +SHA-256 per file, baseline/integration HEAD, test receipts, A1–A8 coverage, known +limitations and owner-demo commands. Freeze code/fixtures while Filbert reviews; +a delivered build is a review candidate, not accepted work. If blocked, report the +specific unmet gate; do not switch assignments or silently weaken tests. + +Direct tagged reply is the return mechanism. Follow-up darkwing. No deadline or +automatic timer/approval. Implementation authorization does not authorize dependent +live-registry/runtime increments, source migration, issue closure or publication. + +Transport (2026-09-06 17:02 UTC): FI-ROCKO-3 sent once to =rocko/mosaic-fleet; +exit 0, delivered. Await admission/blocker and then frozen build/test manifest. +FI-FILBERT-4 availability-only send to =filbert/default returned exit 2, unconfirmed. +No blind retry. Direct reply/manual steering is the return condition; no timer. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build.md b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build.md new file mode 100644 index 00000000..68de3f89 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build.md @@ -0,0 +1,320 @@ +# FI-ROCKO-3 — synthetic inspector build report (review candidate) + +Writer: rocko (sole implementation writer). Requester/integration owner: darkwing. +Independent reviewer: filbert (not yet dispatched to code review). Issue: #53. +Status: **delivered as a frozen review candidate, not accepted work.** No owner +acceptance is claimed. Code and fixtures are frozen at the hashes below until +darkwing reconciles filbert's findings; only rocko fixes owned code, producing a +newly hashed candidate. + +## 1. Admission (returned 2026-09-06T17:05Z; unchanged) + +- Compatible, no blocker. Archify C1 rev 3 stays bound and HELD for Jason's T2/T3 + rulings (waiting state, no due action); nothing was displaced. +- All authorized paths were absent at admission and are new untracked files now. + No other helper path or specification decision was needed; nothing outside the + allowlist was written. +- Build request identity: admitted at sha256 + `fd70962f36f81c515ffefae21fd9e56f90655718067bca8db11a9fc510fbb455` (17:01Z read). + The file on disk now hashes + `90a1f329e859152d4ce8e157cbd6c56e6bcced16b4ed757822d2309514fa9a15` (mtime 17:02:59Z). + Verified by diff against the copy read at admission: the only change is the + appended "Transport (2026-09-06 17:02 UTC)" footnote; the contract text is identical. + +## 2. Pinned contract inputs versus measured integration state + +| Input | Identity | +|---|---| +| Charter candidate 3 `docs/plans/2026-09-06_foundation-inspector-charter.md` | sha256 `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` | +| Filbert verdict r3 | sha256 `15f3d04cb74a7296be6a1a26f2c0907b9dd2b08fdd1eb0ef51c95c7a52ff0399` | +| r2 feasibility note (incorporated, overridden by charter §10) | sha256 `f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1` | +| Source/schema baseline | `d4696d09eb1b5dcf1028f30db2cd63735f51cb16` | +| Accepted map | `7345f330fc6bfae5aa1d896c78cfb7cbe62efbae` | +| `docs/plans/foundation-v1-candidate/records.schema.json` | sha256 `05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6` | +| `docs/plans/foundation-v1-candidate/check.py` | sha256 `82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607` | +| `docs/plans/foundation-v1-candidate/records.fixtures.json` | sha256 `d433d06da5cd38baf9e51c8857244ee70375db3b68e02a5325a6d1c2cc47da85` | +| Measured integration HEAD (unchanged throughout the build) | `9a5fbdbda74b16adf488fe28138b2ba69ea5e669` | + +The three pinned schema/checker files in the working tree hash identically to the +baseline; `verify-schema.py` re-checks these three hashes on every run and fails +closed on mismatch. + +Toolchain (measured on this host): Node `v26.8.1`, Python `3.12.8`, +`jsonschema 4.26.0` (existing installation; nothing installed). No repo Node pin +exists; `node --test` (built-in runner) is the only test framework. + +## 3. Changed-file list with SHA-256 (the frozen candidate manifest) + +All files are new and untracked. Nothing existing was edited. + +| File | Lines | SHA-256 | +|---|---|---| +| `scripts/foundation-inspect.mjs` (CLI) | 239 | `bfa1b78007c772c54fe1dab90a53e19e6bce7e4888a5adb2de0b2cfe43c5cddd` | +| `scripts/foundation/strict-json.mjs` | 327 | `7c31fe6be8cd29ee07662a21bb2e490a2ec799e263dec981ee257fcf7e6f6ebf` | +| `scripts/foundation/canonical.mjs` | 87 | `a7760882c4c49992b9d702eb125a3e8f63048be543516b0eba61231018b90172` | +| `scripts/foundation/resolve.mjs` | 1625 | `9ae8b4255b5dc1f1e9b0d36549865268c12dc53f010984eb1e5616b127d1d8a2` | +| `scripts/foundation/validate-record.mjs` (test-only bridge) | 66 | `e4e70f60cce68e535ef98b0627647c440d620432cf8ddaed074df4e252ecde58` | +| `scripts/foundation/verify-schema.py` (verification only) | 453 | `7e3098655b2e5f261391d788c2112a6ffb055895e357b427bc68e5f2fa7b52d7` | +| `scripts/foundation/strict-json.test.mjs` | 145 | `b40488edfc4eba6962e8c0949ddf1f92fdc15d630b7e9bdff72ac6d06bdb092e` | +| `scripts/foundation/canonical.test.mjs` | 106 | `f504321983b2c41eff5af7e6dc27e40e360e0aae299d0a9abc369c743f5384f7` | +| `scripts/foundation/resolve.test.mjs` | 294 | `05f27aa6c8a1b8ff2ee45e5de03a9aea5ed13cf011b2464c5865022dc9781449` | +| `scripts/foundation/cli.test.mjs` | 279 | `b7e9a13c11e3e6f487ada2779c892cdf848526de1ef8b21387d15d4a461ddb62` | +| `scripts/foundation/fixtures.test.mjs` | 93 | `2827de36214c8014471fed3478c42bf48eddb3fbdbff82cac9e27851646b15d2` | +| `scripts/foundation/fixtures/build-fixtures.mjs` (generator) | 908 | `094ecc811b85465cc0748a86b76b75c1784a2e0296f242b6ff2dbd1660b426a9` | +| `scripts/foundation/fixtures/index.json` (204 cases) | | `74988a1dcd4b48b0be2243d3fefff3b6de5d90a947094be201c3486142ca12a2` | +| `scripts/foundation/fixtures/README.md` | | `aba48ba054d09247b048a8955507b87a275cd585870f1f658b7c6b826fc892bd` | +| `scripts/test-foundation.sh` (executable) | 132 | `76fb7ba9da4345271b6ba93228a9da69c7e55c4e44b9f4033e84a8f4b430e8ec` | + +Generated fixture trees (deterministic output of `build-fixtures.mjs`; the suite +fails if a checked-in file differs from a fresh generation): + +| Tree | Files | Bytes | Manifest sha256 of `find -type f \| LC_ALL=C sort \| xargs sha256sum` (run in `scripts/foundation/fixtures/`) | +|---|---|---|---| +| `scripts/foundation/fixtures/bundles/` | 185 | 9,235,245 | `a804e4ab253839ba2bb8ad7475d27512b2ef88e70a9779f9093fee5478de4823` | +| `scripts/foundation/fixtures/raw/` | 19 | 1,336,985 | `508ad85208f4b69676f3d041faa4ff4cd4a2f8de74b7bde9b0b89123a8485cc4` | + +Owner-demo copies and goldens (`scripts/foundation/fixtures/demo/`, 249,096 bytes): + +| File | SHA-256 | +|---|---| +| `demo-read-w1.json` | `7a3cfc58c1356cc2a986e0a6ed8f9f2dffbc33277ea1b7800020bfc55624b750` | +| `demo-read-w1.expected.txt` | `8bfff519ce8275cfe59562efd04647c242c328a09b301b91d70491f030cf1600` | +| `demo-read-w1.expected.json` | `55e10c1693787cd8e39d3a66841d30e2336080d2ae4450a806a7ae8373db476b` | +| `demo-read-w1.expected.exit` (0) | `9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa` | +| `demo-file-change-src.json` | `7c0948d39abd3f1eeb0b0990766cbf584959712000faacaf47ae0d3501def3cc` | +| `demo-file-change-src.expected.txt` | `f5387217ca0a41d437468af33b7d87d06c0c5535ab5490b568f9866a13b2732e` | +| `demo-file-change-src.expected.json` | `88c7793c6af17ca255525451a499d9f8bb165155e50d2ee936bd68ba82a876a7` | +| `demo-file-change-src.expected.exit` (0) | `9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa` | +| `demo-change-w1.json` | `54aad9047f7fe86892889ead543403c42986f591722d0dd23e0e027c3b7191d5` | +| `demo-change-w1.expected.txt` | `2a1090e5f5ad08e2175830943a7c81928de970470893e803b1e440843152c348` | +| `demo-change-w1.expected.json` | `36c287cba327070f7ff3dd9846421bee3ebd0dd52e9c602b68e84fa620ef4fc5` | +| `demo-change-w1.expected.exit` (3) | `1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2` | +| `adm-registration-revoked.json` | `ff7b859cd959876b2b6ede97fff90383a38acde765a16294b095ba220290c579` | +| `adm-registration-revoked.expected.txt` | `624c9e5991597d59fc3379343b16e7eab9cb6434f054da3a4df7518742e3b36c` | +| `adm-registration-revoked.expected.json` | `b966d939e0d2851ef731462a0fda932e75f53b9aac406216ad440f781e036d0f` | +| `adm-registration-revoked.expected.exit` (3) | `1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2` | +| `prop-message-is-not-authority.json` | `f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548fc023378fd8ab` | +| `prop-message-is-not-authority.expected.txt` | `e7b0e9fa64abe0c0f8c91fbc9aa565988ce76cb3967672bfacafab350e20d8be` | +| `prop-message-is-not-authority.expected.json` | `53884bfdea21185141b9a06d52aa1c0fe8e7bfae6627b465929403521f9bc4d8` | +| `prop-message-is-not-authority.expected.exit` (3) | `1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2` | + +Reviewer re-derivation (from the repository root): + +```sh +sha256sum scripts/foundation-inspect.mjs scripts/test-foundation.sh scripts/foundation/*.mjs \ + scripts/foundation/verify-schema.py scripts/foundation/fixtures/build-fixtures.mjs \ + scripts/foundation/fixtures/index.json scripts/foundation/fixtures/README.md +(cd scripts/foundation/fixtures && sha256sum demo/*) +(cd scripts/foundation/fixtures && for d in bundles raw; do \ + echo "$d $(ls $d | wc -l) $(find $d -type f | LC_ALL=C sort | xargs sha256sum | sha256sum | cut -d' ' -f1)"; done) +``` + +## 4. What was built (charter mapping) + +- `strict-json.mjs` — byte-level strict JSON parser (charter §6, §10.5): UTF-8 + validation with distinct codes (`utf8-invalid`, `utf8-overlong`, `utf8-surrogate`, + `utf8-out-of-range`, `utf8-truncated`), duplicate-key refusal with byte offset, + safe-integer-only numbers (no fraction/exponent/`-0`), raw controls in strings + refused, BOM/trailing content refused, bounds: input 1 MiB, string 4096 bytes, + container items 1024, nesting 32 (container nesting; a scalar inside the 32nd + container is depth 32), all reported as `StrictJsonError` with `byteOffset`. + Objects are built with null prototypes (`__proto__`/`constructor` keys are plain + own keys and never pollute). +- `canonical.mjs` — canonical form and `sha256:` digest (charter §6, vectors V1–V5): + UTF-16 code-unit key ordering, ASCII-only strings, safe integers only, + depth 64, refusals typed as `CanonicalError` with reason `unsupported-capability`. +- `resolve.mjs` — pure evaluation (charter §§3–5, §7, §10.1–10.4): shape gate, + record validation (schema-equivalent field/pattern/enum/calendar/path rules), + identity/duplicate/reference/revision/cycle graph checks in the §10.4 fixed + sub-order, registration/delegation with explicit issuer bounds (§10.1), + structural ownership versus consulted work access (§10.2), direct declared + delegation inputs only (§10.3), mandatory ceilings (agent/project/workspace + policies, scope role, registration, execution, mission/task restrictions) + intersected by least privilege, four supported operations only, and the + reassignment proposal path whose only terminal outcomes are `refused` or + `unresolved` (assignment.change has no allowed branch). Closed vocabularies + `RULES` (108), `REASONS`, `RESULTS`, `PROPOSAL_STEPS`, `SUPPORTED_OPERATIONS`, + `RESULT_KEYS`; `buildResult` throws on any rule/reason outside them. +- `validate-record.mjs` — test-only bridge exposing per-record schema-shape + validity to the Python oracle (stdin JSON in, verdict JSON out). Not used by + the CLI. +- `foundation-inspect.mjs` — CLI: `node scripts/foundation-inspect.mjs [--json] `. + Opens the input with `O_RDONLY|O_NOFOLLOW`, requires a regular file, refuses + size changes between fstat and read, applies the 1 MiB gate before parsing, + renders text or JSON from one result object, escapes every risky code point in + echoed identifiers/paths, exits with the result's `exit`. Imports only + `node:fs`, `node:url`, `node:path` and the local modules; the only `process.` + uses are `argv`, `exitCode`, `stdout`. It never spawns, never reads env/config/ + HOME/cwd, never touches the network. Output starts with + `SYNTHETIC PREVIEW — NO LIVE EFFECTS` and carries the preview/authentication/ + declarations disclaimers in both renderings. +- `verify-schema.py` — mandatory differential oracle against the pinned + `records.schema.json` with the explicit `jsonschema 4.26.0`; missing dependency + or hash mismatch is a failure, never a skip. +- Fixtures — 204 deterministic synthetic cases (185 bundles, 19 raw byte-exact + files) generated by `build-fixtures.mjs`, indexed with expected + exit/result/reason/rule/proposalRule (and byteOffset for lexical cases); + 5 demo copies with byte-exact goldens. +- `test-foundation.sh` — repository-style selftest (syntax, fixture diff, + `node --test`, oracle, exit receipts, goldens, `env -i` sandbox non-effect and + canary checks). + +## 5. Commands and results (all run from the repository root at HEAD 9a5fbdb) + +```sh +node --version # v26.8.1 +python3 --version # 3.12.8 +python3 -c 'import importlib.metadata as m; print(m.version("jsonschema"))' # 4.26.0 + +node --test scripts/foundation/ # ℹ tests 57 ℹ pass 57 ℹ fail 0 +python3 scripts/foundation/verify-schema.py # PASS (see lines below) +NO_COLOR=1 scripts/test-foundation.sh # selftest: 37 passed, 0 failed (rc 0) +python3 docs/plans/foundation-v1-candidate/check.py # PASS: 35 synthetic ... cases (rc 0) +scripts/test-config.sh # selftest: 24 passed, 0 failed (rc 0) +scripts/test-task.sh # selftest: 90 passed, 0 failed (rc 0) +scripts/test-release.sh # selftest: 14 passed, 0 failed (rc 0) +scripts/test-conductor.sh # selftest: 17 passed, 0 failed (rc 0) +scripts/test-auth.sh # selftest: 15 passed, 0 failed (rc 0) +``` + +Oracle summary lines (verbatim from the final run): + +``` +PASS: python 3.12.8 jsonschema 4.26.0 +PASS: 38 pinned record fixtures agree with the pinned expectations +node v26.8.1; corpus 1431 records (38 pinned fixtures, 410 unique bundle records, 983 typeCase/mutation/lexical cases) +schema column agreement: 1388; strict-only (parser-bound) cases: 27; unsupported-kind records not schema-assessed by the inspector: 10 +known divergences reproduced: 6/6 +PASS: differential schema oracle (finite corpus; compatibility evidence, not equivalence proof) +``` + +Node test breakdown: strict-json 12, canonical 10, resolve 16, cli 14, fixtures 4 +(= 57). The five repository suites were run unchanged against the same working +tree; they do not exercise the new code and are reported as integration receipts +only. Unrelated concurrent working-tree changes (not mine, untouched): modified +`BUILD-LOG.md`, `docs/SESSIONS.md`, `docs/plans/CURRENT.md`; untracked +`docs/plans/2026-09-06_*.md`, `docs/plans/foundation-v1-candidate/`, +`docs/plans/reviews/*` (except this report), `skills/ms-*`, +`tasks/foundation-phase2-source-facts.json`. + +Git state: HEAD `9a5fbdbda74b16adf488fe28138b2ba69ea5e669` before and after; +nothing staged, committed, checked out, reset or pushed. Only read-only git +inspection was used. A stray `scripts/foundation/__pycache__/` produced by an +earlier `py_compile` syntax step was deleted and the suite now uses an +AST-only parse so no bytecode is written. + +## 6. A1–A8 coverage (named evidence, not aggregate counts) + +Fixture groups from `index.json` (204 cases): positive 14, shape 37, profile 3, +identity 5, structure 5, cycle 4, continuity 2, ownership 9, operation 7, +admission 49, registration-delegation 13, proposal 37, lexical 19. Expected +outcome classes: exit 0 allowed 14; exit 2 invalid 102; exit 3 refused 86; +exit 3 unresolved 2. Every rule in `RULES` except the five CLI/I-O rules is +exercised by at least one fixture (`resolve.test.mjs` enforces this); the CLI +rules are exercised by `cli.test.mjs`. + +| Gate | Evidence | +|---|---| +| A1 positive previews | Fixtures `demo-read-w1` (work.read), `demo-file-read-src`, `demo-file-change-src` (assigned file.change), `taskless-file-read`, `taskless-work-read`, `deleg-approved-file-read`, `mission-/execution-/registration-restrictions-narrow-ok`, `work-parent-project-mission`, `file-read-with-unaccepted-dependency`, `p2-inventory-unselected`. Byte-exact text/JSON/exit goldens (`fixtures.test.mjs` "owner demo goldens"); text derived from the same result as JSON (`cli.test.mjs` "text output is derived…"); determinism across HOME/config (`cli.test.mjs` "HOME/config independence"); disclaimer first line and closing `exit:` line checked for all 204 cases. | +| A2 unregistered/cross-project selection | `adm-workspace-registration-missing`, `adm-selected-workspace-missing`, `adm-project-registration-missing`, `adm-selected-project-missing`, `adm-cross-workspace-mission`, `adm-cross-project-dependency`, `adm-assignment-other-workspace`, `own-workspace-project-missing`, `prop-target-cross-project-*`. No fallback: selection shows `assignment null` and result is refused. No unrelated payload: every result is walked against the closed key vocabulary (`resolve.test.mjs` `unknownKeys`), and rendered text is scanned for raw risky code points for every case. | +| A3 graph negatives | Duplicates `dup-record-identity`, `dup-registry-identity`, `dup-artifact-identity`, `dup-authorization`, `dup-delegation-input`; references `ref-missing-*` (5); ownership `own-*` (9); revision/continuity `continuity-revision-gap`, `continuity-supersedes-other-identity`, `shape-record-rev1-with-supersedes`; cycles `cycle-dependency-self`, `cycle-dependency-pair`, `cycle-mission-self-parent`, `cycle-supersedes-self-rev2`. Detector unit tests (`findCycle` self/pair/diamond/missing/20000-node chain, `deepEqual`) are separate from the CLI fixture pass; §10.4 first-failure precedence asserted in `resolve.test.mjs`. | +| A4 ceilings and narrowing | Missing/empty authority: `adm-agent-policy-missing`, `adm-project-policy-missing`, `adm-workspace-policy-missing`, `adm-scope-role-missing`, `adm-authorization-undeclared`, `adm-dependency-grants-nothing`, `adm-policy-ceiling-stale`. Narrowing per layer: `adm-operation-not-permitted-{role,agent-policy,execution}`, `adm-path-not-permitted-{prefix-string,read-execution,task-narrows,write-outside}`, `rdeleg-issuer-ceiling-narrows-path`, `rdeleg-narrows-to-delegated-ops`, `rdeleg-exceeds-issuer-ceiling`. Cross-assignment union impossible: `adm-assignment-other-agent`, `adm-assignment-other-workspace`, `own-assignment-task-other-workspace`; unassigned change `adm-assignment-required-for-change`. Unit: `intersectLayers` (network none dominates, endpoint structural intersection, delegated ops), `intersectGrants`, `pathPermitted`. | +| A5 lexical versus schema/profile | Raw byte cases: `raw-duplicate-key`, `raw-bom-prefix`, `raw-invalid-utf8`, `raw-utf8-surrogate`, `raw-lone-escape-surrogate`, `raw-raw-control-in-string`, `raw-fraction-number`, `raw-exponent`, `raw-negative-zero`, `raw-unsafe-integer`, `raw-string-too-long`, `raw-array-too-long`, `raw-depth-33`, `raw-oversize-file`, `raw-empty-file`, `raw-not-object`, `raw-trailing-content`, `raw-proto-key`, `raw-constructor-key` (each with expected byteOffset). Schema/profile: `shape-record-bad-time`, `shape-record-calendar-invalid`, `shape-record-leap-second`, `shape-record-unknown-field`, `shape-unknown-top-field`, `shape-record-displayname-too-long`, `shape-target-{backslash,control-char,dotdot,empty-segment,wrong-root}`, `shape-registry-content-non-ascii`, `shape-unsupported-kind-session` (unsupported-kind, not invalid), `shape-unknown-kind`. Parser unit tests (12) and the oracle report schema agreement separately from parser-bound (27) and unsupported-kind (10) columns. | +| A6 no effects, no ambient lookup | Static import boundary test: pure modules import only `node:crypto` and local modules; the CLI imports only `node:fs`/`node:url`/`node:path` plus local; `process.` uses are exactly `argv`, `exitCode`, `stdout`; forbidden module names (`node:child_process`, `net`, `http`, `os`, `dns`, `tls`, `worker_threads`, `vm`, …) absent everywhere, and `process`, `Date`, `fetch`, `Math.random` and dynamic `import()` absent from the pure modules. Descriptor checks: symlink → exit 4 `input-open-failed` (O_NOFOLLOW), directory and FIFO → `input-not-regular`, chmod 000 → open failure, size change guard. Inventory comparison (path/type/size/mode/inode/mtime/sha256) of a disposable sandbox with fake HOME/.mosaic credentials, config, cwd, data-root before and after every run kind; canary strings never printed; `test-foundation.sh` repeats this under `env -i HOME= PATH=/nonexistent`. These are bounded evidence, not an OS sandbox proof (see §8). | +| A7 cross-lane proposal | 37 `prop-*` cases plus `demo-change-w1`, `op-change-without-proposal`. Both requester contexts: `prop-requester-context-wrong-{agent,scope}`, `prop-original-requester-{lacks-change,assignment-paused,registration-revoked}`, `prop-original-context-no-work-read`, `prop-target-requester-lacks-change`, `prop-target-{workspace-retired,task-stale,cross-project-*}`. Intent/delegation: `prop-intent-*`, `prop-delegation-*` (10), `prop-change-*`, `prop-message-is-not-authority`, `prop-subject-*`. Original selection preserved: `prop-selection-agent-mismatch`, `prop-selection-null-assignment`, and every proposal's `selectedAssignmentRef` equals the selection. Fully supplied mock evidence cannot yield allowed: `prop-all-pass-restricted-contexts` → `unresolved / unknown-effects / runtime-reconciliation-required`, exit 3. Index check: all 39 assignment.change bundles expect exit 2 or 3; the 14 exit-0 cases are work.read/file.read/file.change only. `PROPOSAL_STEPS` values are asserted to be only refused/unresolved. | +| A8 closed result contract | Result key order `RESULT_KEYS` and nested closed keys asserted for every case; `resultFor` mapping exit→result asserted; exit classes 0/2/3/4 all exercised: usage (2), oversize (2, null diagnostic), parse failure (2, byteOffset, inputPath null), I/O (4, inputPath echoed only there), refusals (3), unresolved (3), allowed (0). Escaping: ESC, U+2028, DEL, backslash and astral characters in agentId/paths are escaped in both renderings (`escapeText` unit vector), stdout is the only stream, stderr asserted empty for all 204 spawned runs. | + +§10.1–10.5 fixture mapping: 10.1 `rdeleg-*` (13) and `shape-delegation-*`, +`shape-plan-with-delegated-operations`; 10.2 `adm-consulted-work-not-readable`, +`adm-cross-workspace-mission`, `own-*`, `work-parent-project-mission`, +`file-read-with-unaccepted-dependency`; 10.3 `rdeleg-subject-form-task`, +`rdeleg-subject-form-three`, `rdeleg-scope-not-modelled`, `prop-delegation-input-missing`; +10.4 precedence tests and the four `cycle-*` cases; 10.5 the raw lexical corpus, +the oracle's typeCase/mutation/lexical corpus (983 cases) and the platform notes +in §8 below. + +## 7. Design decisions taken inside the charter (for reviewer attention) + +1. Nesting bound counts containers only (a scalar inside the 32nd container is + depth 32; a 33rd container fails at its opener offset). +2. Oversize input (>1 MiB) is exit 2 `invalid-request` / `input-too-large` with a + null diagnostic; exactly 1 MiB is parsed. +3. `diagnostic.inputPath` is set only on I/O failure (exit 4); `byteOffset` only on + parse failure. No other path, cwd, HOME or locator is ever emitted. +4. `registration-ambiguous` (two current registrations for one identity) is an + invalid bundle (exit 2), not a refusal. +5. U+2028/U+2029 in relative paths are accepted (the pinned checker accepts them) + but always escaped on output; astral characters pass through unescaped. +6. Unsupported record kinds are refused at the kind gate (`unsupported-kind`) and + are not schema-assessed; the oracle reports them in a separate column. +7. Strict parser string bound is 4096 UTF-8 bytes, tighter than the schema's + 4000 code points for non-ASCII text; the 27 oracle "strict-only" cases are + exactly that difference (parser refuses, schema would accept). +8. All generated fixtures are checked in (about 10.9 MB) rather than generated at + test time, so the reviewed candidate is byte-frozen; the suite diffs them + against a fresh generation. + +## 8. Known limitations and untested limits + +- Finite corpus: the oracle is compatibility evidence over 1431 records, not a + proof of schema equivalence. Six known, directional divergences are pinned and + must reproduce exactly: four trailing-newline pattern cases (python accepts, + inspector refuses, because Python `$` matches before a trailing newline) and + years 0001–0999 in `time` fields (python refuses because glibc `%Y` is unpadded + so its round-trip fails; the inspector accepts calendar-valid years 1–9999). +- Sandbox claims are bounded: canary/inventory/static-import checks and + `env -i` runs show no observed effect or lookup in the tested paths; they do not + prove absence of all reads, containment or crash safety. A temporary HOME is not + an OS sandbox. +- Node has no `fs.constants.O_CLOEXEC` on this host; the open flags are + `O_RDONLY|O_NOFOLLOW` plus fstat/regular-file/size-stability checks only. +- Authentication is not modelled; declarations are unverified simulation. No + mock evidence, however complete, reaches `allowed` for assignment.change. +- Hidden delegation chains are not detected (§10.3 by design); only direct + declared delegation inputs are evaluated. +- The FIFO test requires `mkfifo`; the chmod-000 test is skipped when run as root. +- Nothing native, sync, live-registry or runtime was touched or tested. + +## 9. Owner-demo commands (A9, for darkwing to run with Jason after review) + +All from the repository root; each prints the disclaimer first and changes no file. + +```sh +# 1. selected agent/project/workspace with a permitted read preview (exit 0) +node scripts/foundation-inspect.mjs scripts/foundation/fixtures/demo/demo-read-w1.json + +# 2. assigned file.change permission preview (exit 0), then show nothing changed +sha256sum -c <(sha256sum scripts/foundation/fixtures/demo/*.json) >/dev/null && \ + node scripts/foundation-inspect.mjs scripts/foundation/fixtures/demo/demo-file-change-src.json; \ + sha256sum -c <(sha256sum scripts/foundation/fixtures/demo/*.json) + +# 3. unregistered workspace selected: refusal without fallback (exit 3, assignment null) +node scripts/foundation-inspect.mjs scripts/foundation/fixtures/bundles/adm-workspace-registration-missing.json + +# 4. cross-lane reassignment preview: original assignment stays selected, mock evidence cannot yield allowed (exit 3, unresolved) +node scripts/foundation-inspect.mjs scripts/foundation/fixtures/demo/demo-change-w1.json +node scripts/foundation-inspect.mjs scripts/foundation/fixtures/bundles/prop-all-pass-restricted-contexts.json + +# additional negatives used in the goldens (exit 3) +node scripts/foundation-inspect.mjs scripts/foundation/fixtures/demo/adm-registration-revoked.json +node scripts/foundation-inspect.mjs scripts/foundation/fixtures/demo/prop-message-is-not-authority.json + +# machine-readable form of any of the above +node scripts/foundation-inspect.mjs --json scripts/foundation/fixtures/demo/demo-read-w1.json + +# full offline selftest +scripts/test-foundation.sh +``` + +Expected exits: step 1 → 0; step 2 → 0 with both checksum passes; step 3 → 3 +(`workspace-registration-missing`); step 4 → 3 twice (`runtime-reconciliation-required`, +result `unresolved`). Jason's answer on clarity and acceptance is to be recorded +separately by darkwing; this report claims no acceptance. + +## 10. Freeze + +Code, tests and fixtures are frozen at the manifest in §3 for filbert's +independent review. Rocko will change nothing under the allowlist until darkwing +returns reconciled findings; any fix produces a newly hashed candidate and a new +report revision. No dependent live-registry/runtime work, migration, staging, +commit, push or issue closure follows from this delivery. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-corrections.md b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-corrections.md new file mode 100644 index 00000000..6bdd0684 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-corrections.md @@ -0,0 +1,98 @@ +# FI-ROCKO-2 — feasibility reconciliation before charter freeze + +Coordinator: darkwing. FI-ROCKO-1 admitted; original note SHA-256 verified as +92fa7b3de2591ba24fb184ed8edbabedd30c54498fdaf101649e36aaebabe9b9. +Its measured charter hash fdcdf4df8bf30b9fbfff960f9b1d4160ce7e6bbc4b8bb601a93cda13b56c8996 +also matches. These are author/contributor checks, not independent approval. + +Please return a corrected, self-contained recommendation at only +`docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md`. +Preserve the original note. No implementation or other edits authorized. + +## Required corrections and decisions + +F1. The named accepted-map path is the foundation requirements document, not +2026-09-06_foundation-technical-map.md. Correct all affected citations against +actual committed bytes, including map lines 275/278 and proposal section. +`d4696d09:docs/plans/foundation-v1-candidate/FINDINGS.md` does not exist (git +cat-file check fails). Withdraw the AJV/fast-uri audit rationale unless supported +by an in-scope, exact source. No external fleet investigation to repair it. +package.json has no Node engines pin; distinguish measured host version from a +repository pin or a newly proposed inspector test baseline. + +F2. records.schema.json/$defs/recordRef has kind/id/scope/revision, no digest. +Registry references have registry/id/revision/digest. decisionPayload.basisRef +is artifactRef, NOT a reference to a delegation decision. envelope.authorizationRef +is runtimeId, not recordRef. Workspace parent comes from scope, not payload. +createdAt has the candidate time validation, not arbitrary string acceptance. +The charter's initial generic reference/digest sentence needs the same distinction; +darkwing will correct it during integration. Specify how simulation declares any +external authorization/artifact inputs and their limits; do not silently treat +missing referenced evidence as valid or claim real authentication. + +F3. Do not sort instruction arrays while claiming the accepted fingerprint rule: +README:268-285 explicitly preserves instruction order and check.py:115 sorts only +skills for those vectors. A new registry-content digest is a separately specified +restricted algorithm, not an established record-fingerprint rule. Prefer keeping +all input array order for the new mock content digest; distinguish structural +uniqueness and set intersection from serialization. Propose exact vectors. + +F4. Workspace policyRef is required and must be project-policy. There is no fallback +to the registration role. Each registration's scopeRoleRef must resolve and bound +its optional registration restrictions: using restrictions alone omits the reviewed +role ceiling. Nullable registration restrictions mean no additional narrowing, +not absent mandatory role/policy authority. Likewise nullable mission/task narrowing +must not erase required intent/status/scope checks. Assignment has no restrictions +field. Explicit empty arrays remain denial. Distinguish missing required launch +policy from an explicitly modelled unrestricted narrowing layer; do not default +missing launchRestrictions to null and silently skip required policy. + +F5. Define authority in both affected original and target scopes for reassignment, +not just target project membership. Approved decision outcome, actual delegation +recipient/subject bounds, reviewed ceilings and current original/target intent +must be checked or explicitly unsupported. A basis artifact is not automatically +an authorization decision. Caller-supplied runtime observations cannot establish +actual stopping/reconciliation. Prefer refusal/unresolved for all assignment-change +success paths in this first slice; useful negative previews need not implement an +authoritative change engine. Original selection always remains unchanged. + +F6. Limit implemented preview operations explicitly: recommend work.read, file.read, +file.change permission previews plus a bounded assignment.change negative check. +Other recognized catalog operations should return unsupported-capability, never +exit 0 as if executable. Do not invent execution.stop in the 29-operation enum +(it is not there; the catalog contains execution.control). Align the closed output +schema with every emitted field (the note adds scope without defining it). + +F7. Optional schema cross-check is insufficient for a hand-written validator. +check.py does not accept arbitrary bundle records as a validation API. Define a +required verification-only harness using the pinned candidate JSON Schema and +existing explicitly selected Python/jsonschema, with no dependency installation. +It must compare supported records/negative mutations, calendar/path boundaries, +conditionals and typed references. Runtime stays dependency-free if selected; +missing test dependency blocks verification rather than silently passing. + +F8. find -newer alone is not a no-effect proof and output captures themselves write. +Separate harness artifacts from observed roots; compare bounded before/after path, +type, content and relevant metadata inventories, plus static import/I/O boundaries. +State that canaries do not prove absence of all reads or OS containment. Regular-file +opening must refuse symlinks/FIFOs before blocking or following unsafe targets; +specify Linux descriptor-based checks/size bounds without introducing live tests. + +F9. Settle revision-history handling without inconsistent head-only/missing-predecessor +rules. Historical predecessor/decision references cannot all be treated as forbidden +stale active heads. Distinguish historical resolution from current-intent admission. +An explicit small revision-1-only supported subset is acceptable if later revisions +refuse unsupported-capability and the limitation/negative case is clear. Preserve +exact scope and duplicate/cycle checks; never silently invent the missing history. + +## Return + +Resolve D-A..D-J and F1..F9 into a concrete bounded recommendation, or identify the +remaining design choice precisely. No external investigation, code, dependencies, +commits, installation changes or contacts to Filbert. Do not displace the held +Archify assignment. Return FI-ROCKO-2 with corrected note hash and disposition per +finding. Darkwing owns integration; Filbert remains the later non-author reviewer. + +Transport (2026-09-06 08:25 UTC): one FI-ROCKO-2 send to =rocko on mosaic-fleet; +exit 0, delivered. Await direct corrected-note/hash/disposition or blocker. +No deadline/timer or automatic acceptance. Follow-up darkwing. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md new file mode 100644 index 00000000..3d210549 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md @@ -0,0 +1,496 @@ +# FI-ROCKO-2 — Foundation synthetic inspector: corrected feasibility note (r2) + +Author: rocko (Claude Fable 5.1, Archify lane author seat). Requested by darkwing +(FI-ROCKO-2, 2026-09-06), reconciling the FI-ROCKO-1 note against darkwing's +coordinator source check. Issue: #53. Status: planning evidence only. This note +proposes; it does not approve, implement, or bind. It supersedes the r1 note for +every point where the two differ; r1 is preserved unchanged as history. + +## 0. Admission and scope + +**FI-ROCKO-2 is admitted. No blocker.** My held owner goal (Archify C1 rev 3, +awaiting Jason's rulings) is not displaced. This file is the only repository +write. No implementation, dependency, commit, push, checkout, live test, +credential read, fleet investigation, or contact with filbert occurred. Every +citation below was re-read from committed bytes with `git show` during this +task; the only unpinned inputs are the untracked charter draft and darkwing's +corrections note. + +## 1. Pinned inputs + +| Input | Identity | +|---|---| +| Technical map `docs/plans/2026-09-06_foundation-technical-map.md` (the accepted map) and `docs/plans/2026-09-06_foundation-map-handoff.md` | commit `7345f330fc6bfae5aa1d896c78cfb7cbe62efbae` | +| Requirements document `docs/plans/2026-09-06_agent-project-workspace-foundation.md` (R1–R34), candidate `docs/plans/foundation-v1-candidate/{README.md, REVIEW.md, RUNTIME.md, records.schema.json, records.fixtures.json, fingerprint-vectors.json, check.py, semantic-model.py}`, `docs/plans/2026-09-06_foundation-phase2-contract.md`, `docs/plans/ROADMAP.md` | commit `d4696d09eb1b5dcf1028f30db2cd63735f51cb16` | +| Charter draft 1 `docs/plans/2026-09-06_foundation-inspector-charter.md` | untracked, SHA-256 `fdcdf4df8bf30b9fbfff960f9b1d4160ce7e6bbc4b8bb601a93cda13b56c8996` (unchanged since r1) | +| Corrections `docs/plans/reviews/2026-09-06_foundation-inspector-rocko-corrections.md` | untracked, SHA-256 `fe672fd6f0b745b5f64042a094f31463064ca436aeaeba956f9c15228df5f716` | +| r1 note `docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility.md` | untracked, SHA-256 `92fa7b3de2591ba24fb184ed8edbabedd30c54498fdaf101649e36aaebabe9b9` | + +Citation form: `commit:path:line`. `cand/` abbreviates +`docs/plans/foundation-v1-candidate/`; `map` abbreviates +`7345f33:docs/plans/2026-09-06_foundation-technical-map.md`. + +## 2. Disposition of F1–F9 + +| Finding | Disposition | Where resolved | +|---|---|---| +| F1 wrong map path, nonexistent FINDINGS.md, phantom Node pin | **Accepted in full.** Citations corrected; AJV/fast-uri rationale withdrawn; measured host version separated from a proposed test baseline | §3, §4 | +| F2 reference shapes (recordRef no digest, basisRef artifactRef, authorizationRef runtimeId, workspace parent from scope, createdAt calendar rule) | **Accepted in full.** Bundle gains declared `artifacts` and `authorizations` simulation inputs; resolver rules rewritten against the schema | §5, §6 | +| F3 instruction-order digest | **Accepted.** New digest is named separately, preserves all array order, never claims the README 6.1 fingerprint rule; exact vectors supplied | §6.1 | +| F4 mandatory role/policy layers, assignment has no restrictions, no launch default | **Accepted in full.** Layer table rebuilt; role ceilings mandatory; execution layer must be explicitly modelled | §7 | +| F5 reassignment authority in both scopes; no success path | **Accepted.** Proposal mode yields only refused or unresolved; caller-supplied observations removed | §8 | +| F6 bounded operations, no `execution.stop`, closed output | **Accepted.** Four supported operations; `execution.stop` withdrawn (catalog has `execution.control`); output schema enumerates every field | §9, §10 | +| F7 required differential schema verification | **Accepted.** Mandatory Python/jsonschema harness; missing dependency fails, never skips | §12.1 | +| F8 honest non-effect tests, descriptor-based open | **Accepted.** Inventory diff on separated roots, static import boundary, `O_NOFOLLOW|O_NONBLOCK` open then `fstat` | §12.2, §5.3 | +| F9 revision handling | **Accepted.** Contiguous full history or nothing per identity; historical vs current-admission resolution classes | §6.3 | + +No finding is disputed. Two places where I go slightly beyond the finding are +flagged inline (§9 exit class for unsupported operations; §6.1 ASCII limit on +mock-content paths). + +## 3. Corrected repository facts (F1) + +- The accepted map is the technical map at 7345f33. Its recommended increment + is `map:244-283`; exit classes `map:275-276`; "No npm/Turbo change is needed" + `map:278`; the inspector-must-not-bootstrap disposition `map:240`; the + cross-lane retasking scenario `map:290-314` with the adversarial acceptance + case at `map:305-314`. The document I cited in r1 under the map's name is the + requirements document (R1–R34) at d4696d09; R-number citations stay valid + against that file, the map citations did not. Corrected throughout. +- `d4696d09:cand/FINDINGS.md` does not exist (`git cat-file -e` fails) and no + file in the pinned tree or in `docs/plans/*.md` mentions `ajv` or + `fast-uri`. **The audit rationale is withdrawn.** The dependency-free + recommendation now rests only on in-scope facts: `package.json` declares one + dependency (pi 0.84.4), the map forbids an npm change for this boundary + (`map:278`), and the candidate's own checker states it "never installs + dependencies" (`d4696d09:cand/check.py:4`). +- There is no repository Node pin: no `engines` field, no `.nvmrc`, + `.node-version`, or `.tool-versions`, and no Node image pin in the build + scripts. The **measured host** runtime is Node v26.8.1, Python 3.12.8, + jsonschema 4.26.0. These are measurements, not pins. +- Proposed inspector test baseline (a new charter decision, not an existing + pin): the suite records `node --version` in its header and refuses to run + below a stated minimum. The features used (`node:test`, `node:crypto`, + `TextDecoder` with `fatal: true`, `fs.constants.O_NOFOLLOW`) are all present + in Node 22 LTS; I recommend the charter state "Node ≥ 22, measured on + v26.8.1" and that no `engines` field be added by this increment. + +## 4. Language and dependency recommendation (D-A resolved) + +Node ESM, zero new runtime dependencies, hand-rolled closed validation derived +field-by-field from `d4696d09:cand/records.schema.json`, **verified +differentially by a mandatory Python/jsonschema harness** (§12.1). The +Python-stdlib runtime alternative is closed: the candidate's `check.py` is a +script that executes assertions on import, not a validation API +(`d4696d09:cand/check.py:66-96` run at module level), so neither language +gets a free validator; Node keeps the CLI surface consistent with `scripts/`. + +## 5. Bundle contract (exact fields, proposed to freeze) + +Closed objects throughout; unknown keys refuse; duplicate JSON keys refuse at +parse time; identifiers follow `$defs/id` (`^[a-z0-9][a-z0-9._-]{0,63}$`). + +``` +{ + "bundleVersion": 1, + "kind": "foundation-inspector-bundle", + "simulation": true, // literal true or refuse + "records": [ , ... ], // ≤256, supported kinds only (§10) + "registries": [ , ... ], // ≤256 + "artifacts": [ {runId, artifactId, digest}, ... ], // ≤256, declared only + "authorizations": [ , ... ], // ≤256, declared only + "selection": { + "agentId": , "projectId": , "workspaceId": , + "assignmentRef": | null, + "execution": { "kind": "unrestricted-simulation" } + | { "kind": "restrictions", "restrictions": } + }, + "operation": { "name": , "target": | null }, + "proposal": null | { + "kind": "assignment-change", + "requesterAgentId": , + "subjectAssignmentRef": , + "targetTaskRef": , + "delegationRef": | null, + "changeDecisionRef": | null, + "message": | absent // informational, never authority + } +} +``` + +### 5.1 Type corrections (F2) + +- `` is exactly `$defs/envelope`: `authorizationRef` is a + `runtimeId` (UUID v4 pattern), not a recordRef; `supersedes` is `null` at + revision 1 and a recordRef otherwise (schema `allOf`); `createdAt` is + `$defs/time` (`YYYY-MM-DDTHH:MM:SS.mmmZ`) **and** must be a real calendar + instant with the same round-trip rule as `check.py:36-44` (2026-02-30 + refuses). It still takes no part in calculations. +- `` = `{kind, id, scope, revision}`. **No digest.** Record identity + is exact-match on those four fields; record content integrity is not + digest-checked in increment 1 (stated as a limitation in output docs). +- `` = `{registry, id, revision, digest}`; `` = + `{runId, artifactId, digest}`. `decision.basisRef` and `evidenceRefs` are + artifactRefs and are **evidence pointers, not authority**. +- Workspace ownership comes from `scope`: a workspace record has + `scope.kind = workspace`, `scope.projectId` names the owning project, and + `id` must equal `scope.workspaceId`; a project's `id` must equal + `scope.projectId` (`d4696d09:cand/README.md:64`). Registrations carry + project or workspace scope per the schema's conditional. + +### 5.2 Simulation-only external inputs (F2) + +`artifacts` and `authorizations` are the only way the bundle can satisfy an +`artifactRef` or `authorizationRef`. They are **declared, not verified**: the +inspector checks presence and exact match only, never content, signature, or +liveness, and the output labels them `declared-simulation-inputs`. A missing +declaration refuses `missing-state`; it is never treated as valid. Nothing in +the bundle asserts authentication; the inspector emits +`"authentication": "not-modelled"` in every result. + +### 5.3 Bounds and file handling (F8) + +| Bound | Value | +|---|---| +| File size | ≤ 1 MiB, checked from `fstat` **before** reading | +| `records`, `registries`, `artifacts`, `authorizations` | ≤ 256 each | +| Any array | ≤ 1024 (`d4696d09:docs/plans/2026-09-06_foundation-phase2-contract.md:116`) | +| Nesting depth | ≤ 32 | +| Strings | ≤ 4096 bytes; relative paths per `$defs/relativePath` and the `mosaic-relative-path` format (≤4096 UTF-8 bytes, no Cc/Cf/Cs, no backslash, no empty/`.`/`..` segment; `check.py:47-64`) | + +Open sequence (Linux, descriptor-based): `fs.openSync(path, O_RDONLY | +O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC)`; a symlink fails at open with `ELOOP` +and a FIFO cannot block; then `fstatSync(fd)` must report a regular file and a +size within bound; then read exactly `size` bytes from the descriptor and +refuse if more arrive. Any failure is exit 4 `io-failure` naming only the path +as given on argv. This is a design statement; no live test was run. + +## 6. Digest and reference algorithms + +### 6.1 Mock-content digest (F3): `inspector-content-digest/1` + +This is a **new, separately named** restricted algorithm for content-bearing +registry entries only. It is not the README 6.1 launch-fingerprint projection, +which preserves instruction order and ID-sorts skills +(`d4696d09:cand/README.md:268-285`, `check.py:115`); the inspector computes no +launch fingerprint in increment 1. + +Rule: domain = objects, arrays, ASCII strings, booleans, null, safe integers; +anything else refuses `unsupported-capability`. Object keys sorted by code +unit; compact separators; **all array order preserved**; digest = +`"sha256:" + hex(SHA-256(UTF-8 bytes))`. Structural uniqueness (`uniqueItems`) +and set intersection operate on parsed values and are independent of +serialization. Consequence flagged: pathGrant paths inside mock content must be +ASCII in increment 1, while record and target paths may be non-ASCII per the +candidate regex (which accepts `é/x`); the charter should state this asymmetry. + +Exact vectors (computed with Python stdlib `json.dumps(sort_keys=True, +separators=(",",":"))`, the same primitives as `check.py:116`): + +| Vector | Content | Canonical | Digest | +|---|---|---|---| +| V1 | `{"restrictions":{"operations":["work.read","file.read"],"readPaths":[{"root":"workspace","path":null}],"writePaths":[],"network":"none","endpointRefs":[]}}` | `{"restrictions":{"endpointRefs":[],"network":"none","operations":["work.read","file.read"],"readPaths":[{"path":null,"root":"workspace"}],"writePaths":[]}}` | `sha256:0bc44e14fd8354a8a85be879306a54881da7a0cb4d3dcf1f88bc4bc08a40dc9c` | +| V2 | V1 with `operations` reversed | `…"operations":["file.read","work.read"]…` | `sha256:63817bffc57803ca6ac5df971aa0a160d4be73646394b3bc536578bd66c82660` (differs from V1: order is significant) | +| V3 | V1 plus `file.change` and `writePaths:[{"root":"workspace","path":"docs"}]` | `{"restrictions":{"endpointRefs":[],"network":"none","operations":["work.read","file.read","file.change"],"readPaths":[{"path":null,"root":"workspace"}],"writePaths":[{"path":"docs","root":"workspace"}]}}` | `sha256:d538c865808cfe7665956615fb48f69819baa0833626d1ef6e1cb3614acbc7da` | +| V4 | V1 with a float `1.0` anywhere | refuse | `unsupported-capability` | +| V5 | V1 with a non-ASCII string | refuse | `unsupported-capability` | + +Registry entry shapes: declared `{registry, id, revision, digest}` for harness, +settings, context-content, endpoint; content-bearing +`{registry, id, revision, digest, content:{restrictions}}` for scope-role, +agent-policy, project-policy, where `digest` must equal the V-rule digest of +`content` or the bundle refuses `invalid-request`. The candidate defines no +registry content shapes; `{restrictions}` is a simulation-only stand-in (D-E). + +### 6.2 Reference resolution + +Index on `(kind, id, scope)`; duplicate `(kind, id, scope, revision)` refuses +`invalid-request`. Every recordRef resolves by exact four-field match; every +registryRef by exact four-field match including digest; every artifactRef and +authorizationRef by exact match against the declared lists (§5.2). Absent → +`missing-state`; kind mismatch against the schema's `const` constraints (for +example `policyRef` not `agent-policy`) → `invalid-request`. + +Graph rules (all refuse without repair, naming the rule): +- Project `id` = `scope.projectId`; workspace `id` = `scope.workspaceId`; the + workspace's `scope.projectId` must resolve to an active project. +- A workspace registration's `projectRegistrationRef` must resolve to an + **active** project registration in the workspace's owning project for the + same `agentId` (`README:65`). +- A workspace mission's `parentMissionRef` must be a project mission in that + project; project missions have no parent (`README:66-68`). +- A task's `missionRef` resolves in the selected project; `dependencies` are + tasks; cycle checks run over exactly three edge sets, independently: + `task.dependencies`, `mission.parentMissionRef`, `supersedes`. Excluded from + cycle checks: `intentRef`, `subjectRefs`, `projectRegistrationRef`, + `delegationRef`, all registryRefs and artifactRefs. +- Cross-project execution selection refuses (`README:71`). + +### 6.3 Revision history (F9, D-J resolved) + +Per identity `(kind, id, scope)` the bundle carries either **exactly one +record at revision 1** or a **complete contiguous chain** 1..n where each +revision r > 1 has `supersedes = {kind, id, scope, revision: r-1}`. A chain with +a missing predecessor, a skipped number, or two records superseding the same +predecessor refuses `invalid-request`; the inspector never invents history. +Head = highest revision. + +Two resolution classes: +- **Current-admission references** must name the head: `selection.*`, + `assignment.taskRef`, `assignment.intentRef`, `task.intentRef`, + `task.missionRef`, `task.dependencies`, `mission.parentMissionRef`, + `registration.projectRegistrationRef`, `registration.delegationRef`, and every + `proposal` ref. Naming a non-head revision refuses `stale-revision`. +- **Historical references** may name any revision present in the bundle: + `supersedes` and `decision.subjectRefs`. Absent → `missing-state`. + +This satisfies charter A3's stale-reference case with a real fixture (task +intent pointing at decision rev 1 while rev 2 exists) without treating all +history as forbidden. + +## 7. Permission algorithm (F4, D-D, D-F resolved) + +Supported operations for permission preview: `work.read`, `file.read`, +`file.change` (§10). Taskless set = `{work.read, file.read}` exactly +(`d4696d09:cand/semantic-model.py:24`); `file.change` requires +`selection.assignmentRef`. + +| # | Layer | Source | Mandatory? | +|---|---|---|---| +| L1 | agent ceiling | `agent-definition.policyRef` → `agent-policy` content | yes; `agent-definition.status` must be `enabled` | +| L2 | project registration | active registration in `projectScope(projectId)` for `agentId`: **`scopeRoleRef` → `scope-role` content is the ceiling**; `restrictions` (nullable) narrows it further | yes (`README:99-101`) | +| L3 | workspace registration | active registration in `workspaceScope(projectId, workspaceId)` for `agentId`, `projectRegistrationRef` = L2's exact record; `scopeRoleRef` ceiling; `restrictions` nullable narrowing | yes | +| L4 | project policy | `project.policyRef` → `project-policy` content | yes | +| L5 | workspace policy | `workspace.policyRef` → `project-policy` content (schema `const`) | yes; **no fallback to L3's role** | +| L6 | assignment binding | one `assignment` = `selection.assignmentRef`; `status: selected`, `agentId` = selected agent, `taskRef` head in the selected workspace scope, `intentRef` → approved decision (head) whose `subjectRefs` include the task | required for non-taskless operations; contributes checks only, **it has no restrictions field** | +| L7 | task | `task.restrictions` (nullable = no narrowing); independently `task.status ∈ {ready, active}` and `task.intentRef` → approved head decision | status/intent checks mandatory whenever L6 applies | +| L8 | mission chain | each mission from `task.missionRef` up the parent chain: `restrictions` (nullable = no narrowing); `status: active` mandatory | as L7 | +| L9 | execution | `selection.execution`: `restrictions` narrows; `unrestricted-simulation` is an explicit no-narrowing marker | yes; absent or null refuses `missing-state` (`README:132`, `semantic-model.py:21`) | + +Intersection: operations as set intersection; explicit empty array = none +(`README:101`); `restrictions: null` on L2/L3/L7/L8 = no additional narrowing +(`README:100`) but never satisfies a mandatory ceiling or status/intent check. +Path grants: `path: null` = whole root (`README:102`); component-prefix +matching on parsed segments (`semantic-model.py:30-34`); the intersection of +two grant lists keeps, for each pair where one grant is a segment-prefix of +the other, the narrower. Network: `none` dominates; `approved-endpoints` +intersect by exact endpoint registryRef. No union across assignments +(`contract:172`); exactly one assignment consulted (`README:134`). + +Refusal precedence: parse/shape/bounds (exit 2) → graph incoherence (exit 2) +→ unsupported operation or kind (exit 2) → mandatory layer or declaration +missing (exit 3, `missing-state`) → registration/role absent or revoked +(exit 3, `not-authorized`) → status/intent not current (exit 3, +`not-authorized`, rule named) → operation or target outside the intersection +(exit 3, `not-authorized`). First failure ends evaluation. + +## 8. Proposal mode: assignment-change negative check (F5, D-G, D-I resolved) + +Increment 1 implements **no success path**. The evaluation order is fixed and +every branch ends in `refused` or `unresolved`; `allowed` is unreachable by +construction, and a unit test asserts that. + +1. Original scope authority: the requester holds an active L2/L3 registration + in the subject assignment's workspace whose role ceiling ∩ restrictions + include `assignment.change`. Else `not-authorized` / + `requester-lacks-original-scope-authority`. +2. Target scope authority: the same in the target task's project and + workspace. Else `not-authorized` / `requester-lacks-target-scope-authority`. +3. Delegation: `delegationRef` → head decision, `decisionKind: delegation`, + `outcome: approved`, `delegatedOperations ∋ assignment.change`, + `subjectRefs` include the requester's agent-definition **and** the subject + assignment or its task (recipient and subject bounds). Else `not-authorized` + / `delegation-not-applicable`. A `message` with no delegation refuses with + rule `message-is-not-authority` (`map:310`). +4. Recorded change: `changeDecisionRef` → head decision, + `decisionKind: assignment-change`, `outcome: approved`, `subjectRefs` include + the subject assignment and the target task; its `basisRef` must be a + declared artifact but **is not itself authorization**. Else + `not-authorized` / `change-not-recorded`. +5. Current intent: the subject assignment's `intentRef` and the target task's + `intentRef` resolve to approved head decisions. Else `stale-revision` or + `not-authorized` as applicable. +6. If 1–5 pass: result `unresolved`, reason `unknown-effects`, rule + `runtime-reconciliation-required`. Stopping and reconciliation are runtime + facts (`map:311-314`); the bundle has no field to assert them and the r1 + `runtimeObservations` field is withdrawn. + +In every branch the output echoes `selection.assignmentRef` unchanged as +`selectedAssignmentRef` and the bundle bytes are untouched. Requester model is +agent-only in increment 1 (D-G); delegation chains are not modelled (D-I). + +## 9. Output and exit classes (F6) + +Closed result schema; every emitted field is listed here and nothing else is +emitted: + +``` +{ + "disclaimer": "SYNTHETIC PREVIEW — NO LIVE EFFECTS", + "preview": "preview: no live registrations or permission grants", // REVIEW.md:126 + "bundleVersion": 1, + "authentication": "not-modelled", + "declaredSimulationInputs": { "artifacts": , "authorizations": }, + "result": "allowed" | "refused" | "unresolved" | "invalid", + "reason": , + "rule": | null, + "selection": { "agentId", "projectId", "workspaceId", "assignmentRef" }, + "operation": { "name", "target" }, + "consulted": [ , ... ], // identities only, sorted + "proposal": null | { "result", "reason", "rule", "selectedAssignmentRef" } +} +``` + +Text output is a pure rendering of this object; both begin with the +disclaimer, on every exit class. No payload bodies, no parser input bytes +(byte offset and error class only), no timestamps, no random ids, keys sorted. + +Reason codes: the RUNTIME closed set (`d4696d09:cand/RUNTIME.md:97`) plus +inspector-only `unsupported-kind` and `io-failure`, documented as not runtime +API codes. Exit classes (`map:275-276`, charter): 0 allowed; 2 malformed, +graph-incoherent, unsupported kind or operation; 3 refused or unresolved; 4 +I/O failure. Flag: I place unsupported operations in exit 2 with reason +`unsupported-capability` because they are not simulated permission refusals; +if darkwing prefers exit 3 for them, nothing else in this note changes (D-C). + +## 10. Supported kinds and operations (F6) + +Record kinds: `agent-definition`, `project`, `workspace`, `registration`, +`mission`, `task`, `assignment`, `decision`. `session`, `context-source`, +`adapter-capability` present in `records` refuse `unsupported-kind`. + +Operations (from the 29-name catalog, `d4696d09:cand/records.schema.json` +`$defs/operation`): permission previews for `work.read` (target `null`), +`file.read` and `file.change` (target `{root:"workspace", path}`); proposal +negative check for `assignment.change` (§8). The other 25 catalog names are +recognized and refuse `unsupported-capability`; never exit 0. `execution.stop` +does not exist in the catalog (`execution.control` does); the r1 remark is +withdrawn. Names outside the catalog refuse `invalid-request`. + +## 11. Physical paths (D-B, D-H resolved) + +Unchanged from r1: `scripts/foundation-inspect.mjs` (CLI, future +`packages/mosaic`); `scripts/foundation/{strict-json,canonical,resolve}.mjs` +(pure, future `packages/config`; import only each other and `node:crypto`); +`scripts/foundation/fixtures/`; `scripts/foundation/*.test.mjs`; +`scripts/test-foundation.sh`; plus the new verification harness +`scripts/foundation/verify-schema.py` (§12.1). No `packages/` scaffolding, no +root file, no `.sh` shim, nothing imported from `scripts/mosaic-config.mjs` +(`map:240`). Layout follows the ROADMAP M20 doctrine +(`d4696d09:docs/plans/ROADMAP.md:142-159`). + +## 12. Test plan + +### 12.1 Required differential schema verification (F7) + +`scripts/foundation/verify-schema.py`: Python 3 stdlib plus the already +installed `jsonschema` (measured 4.26.0); **no installation**. If `import +jsonschema` fails the suite exits non-zero with `verification dependency +missing`; it never skips. The harness re-declares the two format checkers +exactly as `check.py:36-64` (calendar round-trip `date-time`, +`mosaic-relative-path`), loads the pinned `cand/records.schema.json` from the +tree, and compares, for every document in a corpus, the jsonschema verdict with +the Node validator's verdict (obtained by running +`node scripts/foundation/validate-record.mjs` over the corpus and reading its +JSON verdict list). Any disagreement fails. + +Corpus: every fixture record; the candidate's own `records.fixtures.json` +cases (schema-valid and invalid) for the eight supported kinds; and a mutation +set generated deterministically from each valid record: drop each required +field; add one unknown key at each object level; `createdAt` = 2026-02-30 and +2028-02-29; paths `../x`, `a//b`, `a/./b`, `/abs`, backslash, a control +character, 4097 bytes, `é/x` (must be **accepted** by both); revision 1 with +non-null `supersedes`; revision 2 with null `supersedes`; approved delegation +with empty `delegatedOperations`; non-delegation with non-empty +`delegatedOperations`; `network: none` with an endpoint; `approved-endpoints` +with none; `status: ended` with null `endReason` and vice versa; each typed +reference with the wrong `kind`/`registry`. The runtime remains +dependency-free; only verification needs Python. + +### 12.2 Non-effect and privacy observations (F8) + +- Roots are separated: observed roots `$SANDBOX/home`, `$SANDBOX/cwd`, + `$SANDBOX/fixtures`, `$SANDBOX/data-root`; harness writes go only to + `$SANDBOX/harness`. The CLI runs with `env -i PATH=… HOME=$SANDBOX/home + NO_COLOR=1`, cwd `$SANDBOX/cwd`, `MOSAIC_CONFIG` unset. +- Inventory before and after every invocation over each observed root: + `find -printf '%p %y %s %m %U %i\n' | sort` plus SHA-256 of every regular + file; compared exactly. A canary config path under `home/.config/mosaic-dev` + is asserted absent after a missing-file run (no bootstrap, A8). +- Static boundary: a unit test reads the three pure modules and asserts their + import specifiers are exactly the allowed set and that `process`, `fs`, and + `Date` do not appear; a second asserts the CLI imports no `mosaic-config`. +- Canaries (`CANARY-DO-NOT-PRINT-n` in every unrelated payload and in the + second workspace's records) are grepped from all captured output. Stated + limit: canaries and inventories demonstrate this tool's bounded behaviour on + these inputs; they do not prove absence of all reads or OS-level + containment (charter test-plan paragraph). +- Determinism: each fixture runs twice, byte-identical; `--json` and text agree + on `result`/`reason`/`rule`; golden files compared exactly. + +### 12.3 Units (`node --test`) + +Canonicalizer V1–V5; strict JSON (duplicate key, depth, size, fatal UTF-8); +each graph rule in §6.2–6.3; each layer in §7 including "null restrictions do +not satisfy a mandatory ceiling", "empty array is none", "no union across +assignments", "missing execution layer refuses"; §8 steps 1–6 and the +`allowed`-is-unreachable assertion. + +## 13. Fixtures and the first demonstration + +`demo.bundle.json`: project P1 with workspaces W1 and W2; project P2; agent A +enabled, registered in P1 and W1 only, with scope-role V1 (reader) at W1; +one active mission and one ready task in W1 with approved plan-approval +intents; one selected assignment for A; agent B registered in P2 with a +delegation decision that does not cover `assignment.change`; all revisions 1; +a second variant carries decision rev 1→2 for the stale case. + +| Fixture | Expected | +|---|---| +| `demo-read-w1` | 0 allowed `file.read docs/notes.md` | +| `demo-change-w1-refused` | 3 not-authorized, role ceiling V1 lacks `file.change` | +| `demo-read-w2` | 3 not-authorized, `workspace-registration-missing`, no W2 payload text | +| `demo-cross-project` | 3 not-authorized, cross-project selection | +| `demo-reassign-message-only` | 3 not-authorized, `message-is-not-authority`, selection unchanged | +| `demo-reassign-fully-recorded` | 3 unresolved, `unknown-effects`, `runtime-reconciliation-required` | +| `neg-stale-intent` | 3 stale-revision (intent names decision rev 1, rev 2 present) | +| `neg-missing-predecessor`, `neg-fork`, `neg-duplicate-identity`, `neg-cycle-{task,mission,supersedes}`, `neg-wrong-owner` | 2 invalid-request, rule named | +| `neg-no-execution-layer`, `neg-missing-role-content`, `neg-undeclared-artifact` | 3 missing-state | +| `neg-empty-ops`, `neg-two-assignments` | 3 not-authorized | +| `neg-unsupported-op-execution.control`, `neg-unsupported-kind-session` | 2 unsupported-capability / unsupported-kind | +| `neg-unknown-key`, `neg-dup-json-key`, `neg-bad-utf8.bin`, `neg-bad-path`, `neg-bad-calendar` | 2 invalid-request | +| symlink, FIFO, missing file | 4 io-failure, no bootstrap | + +## 14. Resolved decisions D-A..D-J + +| Id | Resolution | +|---|---| +| D-A | Node ESM, zero runtime deps; Python/jsonschema for mandatory verification only (§4, §12.1) | +| D-B | `scripts/foundation/` with M20 owner headers; no `packages/` (§11) | +| D-C | Graph incoherence and unsupported kind/operation → exit 2; permission refusal/unresolved → 3. Only open sub-choice: exit class for `unsupported-capability` operations (§9 flag) | +| D-D | Taskless = `{work.read, file.read}`; `work.propose` is not implemented at all in increment 1 (§10) | +| D-E | Registry content = `{restrictions}` simulation stand-in, digest per §6.1 | +| D-F | `selection.execution` is mandatory and explicit; no null default (§7 L9) | +| D-G | Requester is an agent with registrations in both scopes (§8) | +| D-H | `scripts/foundation-inspect.mjs`, no `.sh` shim | +| D-I | Delegation: recipient and subject bounds checked; no chains (§8 step 3) | +| D-J | Revision-1-only or complete contiguous chain; historical vs current-admission classes (§6.3) | + +Remaining design choice for darkwing, stated precisely: whether unsupported +catalog operations exit 2 or 3 (§9). Everything else in this note is a +concrete recommendation with no open alternative. + +## 15. Feasibility verdict + +Still feasible as a bounded, dependency-free increment. The corrections +increase scope in three places: mandatory role ceilings and execution layer +(§7), the full-history resolver with two reference classes (§6.3), and the +required differential verification harness (§12.1). None requires an npm +change, a package move, live state, or runtime coupling. The largest new risk +is the differential harness itself drifting from the candidate checker's +format semantics; re-declaring the two format checkers verbatim from +`check.py:36-64` and asserting the same four sentinel cases (`check.py:66-69`) +is the mitigation. + +This note is evidence for darkwing's charter. It is not approval, and it +authorizes no implementation. diff --git a/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility.md b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility.md new file mode 100644 index 00000000..de79dd84 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility.md @@ -0,0 +1,466 @@ +# FI-ROCKO-1 — Foundation synthetic inspector: measured feasibility note + +Author: rocko (Claude Fable 5.1, Archify lane author seat). Requested by: darkwing +(FI-ROCKO-1, 2026-09-06). Issue: #53. Status: planning evidence only. This note +proposes; it does not approve, implement, or bind. Every choice below is a +recommendation for darkwing to accept, alter, or reject in the frozen charter. + +## 0. Admission + +**FI-ROCKO-1 is admitted. No blocker.** + +- Compatibility: my current owner goal (Archify C1 rev 3, HELD for Jason's + T2/T3 rulings) is a waiting state with no lane action due; this note displaces + nothing. I take no supervisory authority over darkwing, filbert, or Jason's + queue; Jason may veto or discard this note at any time. +- Authority basis observed, not assumed: `docs/plans/CURRENT.md` (working tree) + records Jason's acceptance of the map and "continue with filbert/rocko"; the + charter draft restates it. I did not verify this with Jason directly. +- Scope honoured: this file is the only repository write. No commit, push, + checkout, reset, live/runtime test, credential read, or `~/.mosaic` + investigation was performed. Dewey's `extensions/**`, `.pi/**`, and scripts + were not touched. Filbert's verdict files were not opened for editing. + +## 1. Pinned inputs + +| Input | Identity | How read | +|---|---|---| +| Accepted map `docs/plans/2026-09-06_agent-project-workspace-foundation.md` | commit `7345f330fc6bfae5aa1d896c78cfb7cbe62efbae` | `git show 7345f33:…` | +| Source/plan baseline (candidate schema, semantic-model.py, check.py, README, REVIEW, RUNTIME, phase-2 contract, ROADMAP, foundation plan) | commit `d4696d09eb1b5dcf1028f30db2cd63735f51cb16` | `git show d4696d09:…` | +| Charter draft 1 `docs/plans/2026-09-06_foundation-inspector-charter.md` | untracked; SHA-256 `fdcdf4df8bf30b9fbfff960f9b1d4160ce7e6bbc4b8bb601a93cda13b56c8996` at write time | working tree | +| Filbert map verdict (FM-FILBERT-1) | SHA-256 `6b08c6fac0718d3db527cf9ffbfab49407e7b289d09782f5d1d0e26493eaabb3` (as cited in the charter) | read only | + +The charter is a moving draft: an earlier read in this session hashed to +`9c065ef1…`. Recommendations below target the `fdcdf4df…` text. If the frozen +charter differs materially, this note must be re-checked, not assumed valid. + +Citations use `commit:path:line`. `cand/` abbreviates +`docs/plans/foundation-v1-candidate/`. + +## 2. Repository facts that constrain the design + +- Host toolchain: Node v26.8.1 with `node:test` available; Python 3.12.8 with + `jsonschema` 4.26.0 importable. `package.json` declares one dependency + (pi 0.84.4); no `node_modules` is present in the tree. `RELEASE` = 0.0.12. +- `scripts/` is flat; no `packages/` tree exists yet. ROADMAP places the + package layout under M20 (`d4696d09:docs/plans/ROADMAP.md:114`) with the + layout doctrine and phase-1 sequencing at `:142-145` and the target tree at + `:152-159` (`packages/config` at `:159`). +- The map's recommended increment forbids npm or Turbo changes + (`7345f33:docs/plans/2026-09-06_agent-project-workspace-foundation.md:278`) + and proposes exit classes 0/2/3/4 (`:275`). +- Existing validation idiom is hand-rolled and closed: `scripts/mosaic-task.mjs` + (`rejectUnknownKeys`, `fail(2, …)`). `scripts/mosaic-config.mjs` reads + `$MOSAIC_CONFIG` (`:42-43`) and refuses symlinks (`:54`); importing it runs + config resolution, which the charter forbids for the inspector. +- Existing suite style: `scripts/test-config.sh` uses a `mktemp` sandbox, + `check`/`expect_exit` helpers, and `NO_COLOR`. +- `cand/FINDINGS.md` records an `ajv`/`fast-uri` audit concern; the candidate's + own checker uses Python `jsonschema` (`cand/check.py`). +- The candidate's fingerprint rule is restricted-domain canonicalization, not + full RFC 8785 (`d4696d09:cand/README.md:265-288`, ASCII-only vectors + `:281-282`; `check.py` sorts keys, uses compact separators, ASCII-only, + sorts skills by id, digest = `"sha256:" + hex(SHA-256(UTF-8))`). + +## 3. Language and dependency pin (recommendation) + +**Recommend: Node ESM (`.mjs`), zero new dependencies, hand-rolled closed +validation.** Pin: the repository's existing Node engine (v26.8.1 on host); no +`package.json` change; no `ajv`, no `jsonschema` at runtime. + +Why: +- Matches the map (`:278`, no npm/Turbo change) and the repo's validation idiom. +- Avoids the `ajv`/`fast-uri` audit issue and avoids adding a runtime dependency + for a preview tool that must be reproducible offline. +- Node gives `TextDecoder('utf-8', { fatal: true })` for malformed-UTF-8 + refusal, `node:crypto` for SHA-256, and `node:test` for units, all built in. +- A hand-rolled closed validator is smaller than the candidate schema but must + be **derived from** `cand/records.schema.json` field-by-field. To keep it + honest, the test suite should run the Python candidate checker over every + fixture bundle's records as a cross-check when `python3 -c "import jsonschema"` + succeeds, and skip with a visible notice otherwise (see §9). + +Alternative (viable, not preferred): Python 3.12 stdlib only, reusing +`check.py`'s canonicalizer verbatim. Rejected because the CLI surface of the +stack is Node/bash and because the charter says not to promote the author-only +Python model into the inspector. This is unresolved decision D-A. + +Explicitly not recommended: JSON Schema at runtime via `ajv` (audit issue, +dependency) or via Python `jsonschema` in a Node CLI (two runtimes). + +## 4. Physical source paths (recommendation, M20-consistent) + +No `packages/` scaffolding in this increment. Files land in `scripts/`, which +is the existing flat layout, with a comment header naming the logical owner so +M20 phase 1 can move them without rewriting. + +| Path | Logical owner (M20 target) | Contents | +|---|---|---| +| `scripts/foundation-inspect.mjs` | `packages/mosaic` (CLI presentation) | argv parsing, file read, output rendering, exit classes | +| `scripts/foundation/strict-json.mjs` | `packages/config` | strict JSON reader: fatal UTF-8, duplicate-key refusal, depth/size limits, byte-offset-only errors | +| `scripts/foundation/canonical.mjs` | `packages/config` | restricted-domain canonicalizer + `sha256:` digest, out-of-domain refusal | +| `scripts/foundation/resolve.mjs` | `packages/config` | bundle validation, reference resolution, graph checks, permission intersection, proposal evaluation. Pure: no I/O, no env, no clock | +| `scripts/foundation/fixtures/*.json` | test data | demo bundle plus negative fixtures | +| `scripts/test-foundation.sh` | suite | sandboxed CLI/privacy/non-effect suite, invokes `node --test scripts/foundation/*.test.mjs` | +| `scripts/foundation/*.test.mjs` | unit tests | `node:test` units for the three pure modules | + +Rules: +- `resolve.mjs`, `canonical.mjs`, `strict-json.mjs` import only each other and + `node:crypto`. Never `mosaic-config.mjs`, never `process.env`, never `Date`. +- `foundation-inspect.mjs` is the only file that touches `process.argv`, + `fs`, `stdout`, `stderr`, and `process.exit`. It reads `process.env` only to + honour `NO_COLOR`; it never reads `MOSAIC_CONFIG`, `HOME`, or the data root. +- Root stays bootstrap-only (AGENTS.md invariant 1): nothing is added to root. +- The command name `mosaic foundation inspect ` from REVIEW + (`d4696d09:cand/REVIEW.md:123`) is the eventual `packages/mosaic` surface. + In this increment the wrapper is `scripts/foundation-inspect.mjs`; a + `foundation-inspect.sh` shim is unnecessary. Naming is decision D-H. + +## 5. Bundle contract (exact fields, proposed to freeze) + +One file, one closed object. Every object is closed: unknown keys refuse. +Duplicate keys refuse at parse time. All strings must be ASCII printable when +they participate in digests (§6); identifiers are `^[a-z0-9][a-z0-9-]{0,63}$`. + +``` +{ + "bundleVersion": 1, + "kind": "foundation-inspector-bundle", + "simulation": true, // must be literally true; anything else refuses + "records": [ , ... ], // candidate envelope records, ≤256 + "registries": [ , ... ], // ≤256 + "selection": { + "agentId": "", + "projectId": "", + "workspaceId": "", + "assignmentRef": | null, + "launchRestrictions": | null // simulated execution layer, D-F + }, + "operation": { "name": "", "target": | null }, + "proposal": null | { + "kind": "assignment-change", + "requesterAgentId": "", + "subjectAssignmentRef": , + "targetTaskRef": , + "delegationRef": | null, // decision, decisionKind delegation + "changeDecisionRef": | null, // decision, decisionKind assignment-change + "message": "" | absent, // informational only; never authority + "runtimeObservations": { + "originalExecutionStopped": true|false|null, + "effectsReconciled": true|false|null + } + } +} +``` + +`` is exactly the candidate envelope (`d4696d09:cand/records.schema.json`): +`{schemaVersion:1, kind, id, scope, revision, createdAt, createdBy, supersedes, +authorizationRef, payload}`, closed. `createdAt` is carried and validated as a +string but never used in calculations (charter: no timestamps in results). + +`` = `{kind, id, scope, revision}`; `` = +`{registry, id, revision, digest}`; `` = `{operations[], +readPaths[], writePaths[], network, endpointRefs[]}` with `pathGrant` +`{root:"workspace", path|null}`; all as defined in the candidate schema. + +`` for file operations: `{root:"workspace", path:""}`. For +record operations: a ``. For operations that take no target: `null`. +An operation whose target shape does not match its name refuses `invalid-request`. + +`` has two shapes: +- Declared: `{registry, id, revision, digest}` for harness, settings, + context-content, endpoint. Existence and exact-match only. +- Content-bearing: `{registry, id, revision, digest, content}` for + `scope-role`, `agent-policy`, `project-policy`. `content` is + `{restrictions: }`; `digest` must equal the canonical digest of + `content` (§6) or the bundle refuses `invalid-request`. These are the + "separately identified mock policy inputs" the charter requires. The candidate + does not define registry content shapes; this is decision D-E. + +Bounds (refuse `invalid-request` before any calculation): + +| Bound | Value | +|---|---| +| File size | ≤ 1 MiB (aligns with RUNTIME frame limit `d4696d09:cand/RUNTIME.md:41` and contract `…phase2-contract.md:116`) | +| `records` | ≤ 256 | +| `registries` | ≤ 256 | +| Any array | ≤ 1024 items (contract `:116`) | +| Nesting depth | ≤ 32 | +| Any string | ≤ 4096 bytes; path strings ≤ 4096 bytes | +| Input file | regular file only; symlink, directory, FIFO, device refuse `invalid-request` (matches `mosaic-config.mjs:54` doctrine) | +| Path argument | exactly one positional bundle path; relative paths resolved against cwd but never searched; no defaults | + +Explicitly absent by design: no `$ref`, no includes, no URLs, no `env`, no +`credentials`, no `authenticated`/`authorized` booleans anywhere. Presence of +any of those keys is an unknown-key refusal, not a warning. + +## 6. Reference and digest algorithm + +### 6.1 Canonical digest (restricted domain) + +Implement `canonical.mjs` as the candidate's rule, not JCS: +1. Domain: objects, arrays, strings, booleans, null, and integers within + `Number.isSafeInteger`. Floats, `-0`, non-ASCII strings, control characters + other than those JSON must escape, and values outside the domain **refuse** + with `unsupported-capability`. This is stricter than JCS and is the documented + restricted domain (`d4696d09:cand/README.md:265-288`). +2. Object keys sorted by UTF-16 code unit order (same as `sort_keys=True` on + ASCII keys), compact separators, no whitespace. +3. Set-valued arrays are sorted by a stable key before serialization: + `skillRefs` by `id`, `instructionRefs` by `id`, `operations` lexically, + `readPaths`/`writePaths` by `path` with `null` first, `endpointRefs` by `id`. + Sequence-valued arrays (`dependencies`, `subjectRefs`, `evidenceRefs`) keep + order. The list of set-valued fields is enumerated in code and in the frozen + charter; anything not listed is a sequence. +4. Digest = `"sha256:" + lowercase hex SHA-256 of the UTF-8 bytes`. +5. Test vectors: reproduce the README's vectors (`:281-282`) and add one + out-of-domain vector per rejected class. + +No claim of RFC 8785 conformance is made in code, docs, or output. + +### 6.2 Reference resolution (bounded resolver, `resolve.mjs`) + +Index build: +- Key `(kind, id, scope)` → list of revisions. Two records with the same + `(kind, id, scope, revision)` refuse `invalid-request` (duplicate identity, A3). +- `supersedes` chains must be contiguous from revision 1: revision *n* must + supersede exactly `(kind, id, scope, n-1)`; gaps, forks (two records + superseding the same predecessor), or a supersedes pointing outside the + identity refuse `invalid-request`. The bundle may carry only the head + revision if it carries no history at all for that identity (D-J). +- `id` must agree with `scope` per README `:64`; mismatch refuses. + +Reference check (every `recordRef` and `registryRef` in every payload): +- Exact match on all fields; `digest` compared byte-for-byte after §6.1 + recomputation for content-bearing entries. A ref to a superseded revision + refuses `stale-revision`. A ref to an absent identity refuses `missing-state`. + Kind mismatch (e.g. `policyRef` not pointing at `agent-policy`) refuses + `invalid-request`. + +Graph rules (all refuse without repair; the violated rule name is emitted): +- `workspace.payload` must reference exactly one active `project` (README `:65`; + charter "exactly one project owns a workspace"). +- A workspace `registration` for agent X must reference, via + `projectRegistrationRef`, an **active** project `registration` for the same + agent X in the owning project (README `:65`). Missing or revoked → refuse. +- `mission.parentMissionRef` must resolve to a mission in the same project; + a task's `missionRef` must resolve to a mission in the selected project. +- `assignment` must bind one task and one agent; `intentRef` must resolve to a + `decision` with `decisionKind ∈ {plan-approval, delegation, assignment-change}` + whose `subjectRefs` include the task. Otherwise `not-authorized`. +- Cycle checks (A3, "document which edges participate"): DFS over exactly three + edge sets, evaluated independently: (i) `task.dependencies`, (ii) + `mission.parentMissionRef`, (iii) `supersedes`. A cycle in any of them + refuses `invalid-request`. Edges deliberately excluded from cycle checks: + `intentRef`, `authorizationRef`, `evidenceRefs`, `subjectRefs`, all + `registryRef`s (they point outside the record graph). +- Cross-project execution selection refuses (README `:71`). + +## 7. Permission algorithm + +Inputs: the resolved graph, `selection`, `operation`. Output: `allowed` or +`refused` + reason code + violated rule + the identities consulted. Never the +payload bodies. + +Taskless set: `{work.read, file.read}` (from `semantic-model.py`). Every other +operation requires `selection.assignmentRef` to be non-null (D-D asks whether +`work.propose` belongs in the taskless set; recommendation: no, keep the +candidate's set). + +Layers, in fixed order, each producing a `` view or a refusal: + +| # | Layer | Source | Missing → | +|---|---|---|---| +| L1 | agent policy | `agent-definition.policyRef` → registry `agent-policy.content.restrictions` | refuse `missing-state` | +| L2 | project registration | active `registration` for agent in `projectId`, `restrictions` | refuse `not-authorized` (A2) | +| L3 | workspace registration | active `registration` for agent in `workspaceId` whose `projectRegistrationRef` is L2's record | refuse `not-authorized` (A2) | +| L4 | project policy | `project.policyRef` → registry `project-policy` | refuse `missing-state` | +| L5 | workspace policy | `workspace.policyRef` if present in candidate payload; else scope-role of L3 | refuse `missing-state` | +| L6 | assignment | `selection.assignmentRef`; must be `status: selected`, agent = `agentId`, task in `projectId` | non-taskless op → refuse `not-authorized` | +| L7 | task | `task.restrictions` | null = no narrowing | +| L8 | mission chain | each mission up the `parentMissionRef` chain, `restrictions` | null = no narrowing | +| L9 | simulated execution layer | `selection.launchRestrictions` | null = no narrowing; when present, narrows only (D-F) | + +Intersection semantics (README `:96-142`, contract `:158-193`): +- `operations`: set intersection. An explicit empty array is **none** (`:101`). + A `null` restrictions object at L7–L9 means "no narrowing"; at L1–L5 a + `null` refuses (required layer, `:133`). +- `readPaths`/`writePaths`: a grant `{root:"workspace", path:null}` is the whole + root (`:102`). Intersection of two grant lists = the set of pairs where one + is a component-prefix of the other, keeping the narrower. Component-prefix + means path segments, not string prefix (`a/b` covers `a/b/c`, not `a/bc`). + Target paths must be relative, normalized, contain no `..`, no empty + segment, no leading `/`, no `\`, no NUL; otherwise refuse `invalid-request` + before any permission result (A5). +- `network`: `none` ∧ anything = `none`; `approved-endpoints` ∧ + `approved-endpoints` = intersection of `endpointRefs` by exact ref. +- Never union across assignments (contract `:172`); exactly one assignment is + consulted (README `:134`). A second `selected` assignment for the same + agent+task in the bundle is not an error, but only the selected one is used. +- Result for the operation: allowed iff `operation.name ∈ operations` and, + for file operations, the target path is covered by the corresponding + `readPaths`/`writePaths` after intersection, and for network operations the + endpoint is covered. + +Refusal precedence (deterministic): parse/shape errors (exit 2) → graph +incoherence (exit 2, D-C) → missing required layer (exit 3, `missing-state`) +→ registration absent (exit 3, `not-authorized`) → operation not in +intersection (exit 3, `not-authorized`). The first failing check ends +evaluation; the output names only that rule. + +## 8. Proposal mode (cross-lane reassignment, map `:290-314`) + +Evaluated only when `proposal !== null`, after the base permission result: +1. `requesterAgentId` must hold an active registration in the target task's + project (authority in target scope) — else refuse `not-authorized`. +2. `delegationRef` must resolve to a `decision` with `decisionKind: delegation`, + outcome approved, `delegatedOperations` including `assignment.change`, and + `subjectRefs` covering the subject assignment or its task — else refuse + `not-authorized`. A `message` with no delegation refuses with the same code + and the violated rule "message-is-not-authority" (A7). +3. `changeDecisionRef` must resolve to a `decision` with + `decisionKind: assignment-change` whose `subjectRefs` include both the + subject assignment and the target task and whose `basisRef` is the + delegation decision — else refuse `not-authorized`. +4. `runtimeObservations`: if either field is `null`, result is **unresolved** + with reason `unknown-effects` (charter: report reconciliation-required + rather than simulate success). If `originalExecutionStopped` is `false` + or `effectsReconciled` is `false`, refuse `unsafe-replacement`. +5. On any outcome, the output's `selection.assignmentRef` is echoed unchanged + and the bundle bytes are never written (A6, A7). + +Exit class for unresolved: 3 (it is a refusal to affirm), with +`result: "unresolved"` in JSON and text so it cannot be read as a permission +refusal. Requester model in increment 1 is agent-only (D-G). + +## 9. Output and exit classes + +- Text (default) and `--json` must be generated from the same result object; + the text renderer is a pure function of the JSON. First line of both, always: + `SYNTHETIC PREVIEW — NO LIVE EFFECTS` (text) / `"disclaimer": "SYNTHETIC + PREVIEW — NO LIVE EFFECTS"` (JSON), including on every refusal and on + exit 2/4. REVIEW's phrasing "preview: no live registrations or permission + grants" (`d4696d09:cand/REVIEW.md:126`) is emitted as the second line. +- JSON result shape (closed): `{disclaimer, bundleVersion, result: allowed | + refused | unresolved, reason: , rule: , selection: {agentId, + projectId, workspaceId, assignmentRef}, operation, consulted: [], proposal: null | {result, reason, rule, selectedAssignmentRef}}`. + No payload bodies, no paths other than the requested target, no input + snippets, no timestamps, no random ids, keys sorted. +- Reason codes: the RUNTIME closed set (`d4696d09:cand/RUNTIME.md:97`: + allowed, invalid-request, not-authorized, stale-revision, missing-state, + already-active, control-conflict, retired, unsupported-capability, + audit-unavailable, unknown-effects, unsafe-replacement, request-id-conflict, + expired) plus inspector-only codes `unsupported-kind`, `unresolved`, + `io-failure`. Inspector-only codes are documented as not being runtime API + codes (charter). +- Exit classes: 0 allowed; 2 malformed input (parse, shape, bounds, graph + incoherence, unsupported kind/operation); 3 simulated refusal or unresolved; + 4 I/O failure (missing file, unreadable, not a regular file). Exit 4 output + names the path as given on argv and nothing else; no bootstrap, no config + read, no directory creation (A8). +- Errors from `strict-json.mjs` report byte offset and error class only, never + the surrounding bytes. + +## 10. Supported record kinds and operations + +Supported kinds in increment 1: `agent-definition`, `project`, `workspace`, +`registration`, `mission`, `task`, `assignment`, `decision`. The remaining +candidate kinds refuse `unsupported-kind` (exit 2) when present in `records`, +rather than being ignored. Operation vocabulary is the candidate's 29-name enum +(`d4696d09:cand/RUNTIME.md:55`); a name outside it refuses `invalid-request`. +Operations whose semantics need runtime state the inspector cannot model +(stop, durability, audit) are accepted as names for permission intersection +only; the output states `"scope": "permission-only"` for them so a `0` is not +read as an executability claim. + +## 11. Fixtures and the first demonstration + +`scripts/foundation/fixtures/demo.bundle.json` implements the charter's +scenario: project P1 with workspaces W1 and W2; project P2; agent A registered +in P1 and W1 only; one mission, one task in W1, one selected assignment for A; +agent B registered in P2 with a delegation decision that does **not** cover +`assignment.change`. Derived bundles (same records, different selection or +proposal) cover: + +| Fixture | Expectation | +|---|---| +| `demo-read-w1` | exit 0, allowed, `file.read` on `docs/notes.md` | +| `demo-read-w2` | exit 3, not-authorized, rule workspace-registration-missing, no W2 payloads in output | +| `demo-cross-project-exec` | exit 3, not-authorized, cross-project selection | +| `demo-reassign-message-only` | exit 3, not-authorized, message-is-not-authority, selection unchanged | +| `demo-reassign-no-observations` | exit 3, unresolved, unknown-effects | +| `neg-duplicate-identity`, `neg-stale-ref`, `neg-missing-parent`, `neg-cycle-task`, `neg-cycle-mission`, `neg-fork-supersedes` | exit 2, named rule | +| `neg-unknown-key`, `neg-dup-json-key`, `neg-bad-utf8.bin`, `neg-bad-path` | exit 2, before any permission text | +| `neg-empty-ops-layer` | exit 3, explicit empty = none | +| `neg-union-two-assignments` | exit 3, second assignment does not widen | + +Fixture digests are generated by a checked-in helper +(`node scripts/foundation/canonical.mjs --digest `) and the suite fails +if a stored digest disagrees with a recomputed one, so fixtures cannot drift +silently. + +## 12. Test harness (isolated, non-effect, privacy) + +`scripts/test-foundation.sh`, same shape as `scripts/test-config.sh`: +- Runs under `env -i PATH=… HOME= NO_COLOR=1 node …`; `MOSAIC_CONFIG` + unset; no `~/.config/mosaic-dev` or data root exists in the sandbox. A + canary `HOME/.config/mosaic-dev/config.json` is **absent** and the test + asserts it stays absent (no bootstrap on missing input, A8). +- Non-effect: before and after every CLI invocation, `find -newer + ` must be empty and `sha256sum` of each bundle must be unchanged (A6). + Also asserts no `.pi`, `roles`, or `state` directory appears under the sandbox. +- Privacy: fixture payloads contain a canary string + (`CANARY-DO-NOT-PRINT-`) in every unrelated record body and in W2's + payload; every stdout/stderr capture is grepped for it and must be clean + (A2, charter diagnostics rule). Exit-2 parse errors are checked for absence of + any input bytes beyond the byte offset. +- Determinism: each fixture runs twice; outputs must be byte-identical; + `--json` and text must agree on `result`/`reason`/`rule` (A8). +- Golden files: `scripts/foundation/fixtures/expected/.{txt,json}`, + compared exactly. +- Units (`node --test scripts/foundation/*.test.mjs`): canonicalizer vectors + and out-of-domain refusals; strict-json duplicate key, depth, size, fatal + UTF-8; resolver graph rules one per test; permission intersection tables + (empty=none, null=whole root, component-prefix, no union); proposal rules. +- Cross-check (optional, skipped visibly when Python `jsonschema` is absent): + `python3 cand/check.py` over each fixture's `records` to confirm the + hand-rolled validator has not drifted from the candidate schema. +- The suite does not touch Dewey's extension installation, `~/.mosaic`, the + network, or any engine/process launch. It states this in its header. The + existing required suites remain untouched and must stay green. + +## 13. Unresolved decisions for the frozen charter + +| Id | Decision | Recommendation | +|---|---|---| +| D-A | Language: Node ESM vs Python stdlib | Node ESM, zero deps (§3) | +| D-B | Directory layout before M20 | `scripts/foundation/` with owner headers, no `packages/` (§4) | +| D-C | Exit class for graph incoherence (cycle, stale, duplicate) | 2 (malformed input), not 3, so it cannot be mistaken for a policy refusal | +| D-D | Taskless operation set | `{work.read, file.read}` exactly; `work.propose` stays assigned-only | +| D-E | Registry content shapes for scope-role / agent-policy / project-policy | `{restrictions}` only, declared simulation-only in the charter; candidate schema does not define these | +| D-F | Simulated execution layer | `selection.launchRestrictions`, narrowing-only, default null | +| D-G | Requester model in proposal mode | agent-only (agentId + registration); no human/operator principal in increment 1 | +| D-H | Wrapper naming | `scripts/foundation-inspect.mjs`, no `.sh` shim | +| D-I | Delegation enforcement depth | require `delegatedOperations ∋ assignment.change` and subject coverage; do not model delegation chains | +| D-J | Whether bundles carry revision history | permit either head-only or contiguous full history per identity; forbid partial history | + +One further point the charter should settle explicitly: whether a `0` result +for stop/durability/audit-class operations is acceptable at all in increment 1, +or whether those names should refuse `unsupported-capability` outright. My +recommendation is the latter for `execution.stop`-class names, to keep A9's +"understands the limitation" honest. + +## 14. Feasibility verdict + +Feasible as a bounded increment with no new dependencies, no package +migration, and no runtime coupling. Estimated size: three pure modules of a +few hundred lines each, one CLI wrapper, roughly twenty fixtures, one bash +suite, and unit tests. The main risk is drift between the hand-rolled validator +and the candidate schema; the Python cross-check in §12 and the enumerated +set-valued field list in §6.1 are the mitigations. Nothing here weakens the +accepted semantics; where the candidate is silent (D-E, D-F), the proposal is +narrowing-only and simulation-labelled. + +This note is evidence for darkwing's charter. It is not approval, and it +authorizes no implementation. diff --git a/docs/plans/reviews/2026-09-06_foundation-map-filbert-request.md b/docs/plans/reviews/2026-09-06_foundation-map-filbert-request.md new file mode 100644 index 00000000..9e55b092 --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-map-filbert-request.md @@ -0,0 +1,118 @@ +# FM-FILBERT-1 — independent written-map review request + +Owner authority: Jason explicitly said “You can have filbert review the map.” +Requester/follow-up owner: dragon-lin:darkwing. +Reviewer requested: dragon-lin:filbert, default tmux server. +Status: request prepared; transport and acknowledgement recorded separately below. + +## Admission before work + +Confirm you did not author/co-author the map and that this bounded review is +compatible with your existing owner-authorized assignments and scope. If not, +return a blocker; do not replace another goal, assume a new supervisory role, +or silently abandon current work. This request authorizes only this review. + +## Exact candidate + +Repository: /home/jwoltje/src/mosaic-stack-dev-test +Mapping commit: 7345f330fc6bfae5aa1d896c78cfb7cbe62efbae +Source/accepted-plan baseline: d4696d09eb1b5dcf1028f30db2cd63735f51cb16 +Foundation parent: 44f257cb06484feda3412d9382e3587393796353 + +- docs/plans/2026-09-06_foundation-technical-map.md + SHA-256: 772f9e61cb9fb7a31ce8187b12cdf1c4a5fb714ad517a9c12928901171a37db1 +- docs/plans/2026-09-06_foundation-map-handoff.md (MAP-HANDOFF-2) + SHA-256: 1fd1a89f982a31bb9db21b852df78be954323aa1668ab9752be34de853ee4999 + +Use git show at these commits, not mutable working-tree source. The handoff lists +69 SHA-256-pinned inputs. Subsequent uncommitted quiet-wait extension work belongs +to Dewey and is explicitly outside this historical candidate. + +## Scope and verdict + +Review the written current-versus-planned technical/component map, not a rendered +Archify deliverable. There is no architecture JSON, HTML, renderer receipt, visual +check or preview supplied. Do not certify those missing gates or label this full +Archify acceptance. Identify any limitation that prevents substantive review. + +1. Open every source/plan citation at the named baseline and verify every claimed + boundary/hop, reuse/change classification and gap. Mark each confirmed, wrong + or unsupported; external behavior without measurement must remain a hypothesis. +2. Check R1-R34 coverage against requirement meaning, not table counts, including + owner intent, reassignment, cross-scope messages and independent acceptance. +3. Check pure policy versus effectful publication, package versus process authority, + current extensions/** versus future packages/*, and single runtime/adapter owners. +4. Check the small synthetic inspector's dependencies, acceptance cases and clear + separation from live grants, session control and runtime security guarantees. +5. Check identity hashes and source/plan versus mapping-commit distinctions. +6. Run relevant author/repository checks in an isolated temporary export if needed. + Do not checkout/reset this shared tree or run synchronization/native tests against + Dewey's changing installation. Report commands, baseline and measured results; + do not treat previously reported tests as your independent execution. + +Return APPROVED or NOT APPROVED for the written map at the exact candidate hashes, +with per-item dispositions and numbered findings (severity, location, evidence, +required correction), test receipts and any unverified limits. A written-map +approval is neither owner acceptance nor a runtime/renderer verdict. + +## Boundaries and return + +Do not fix/edit the map, CURRENT, shared logs, source, policies or installations. +No commit, push, implementation, source moves, live workers or fleet investigation. +Never read credential contents. Jason's ~/.mosaic failure is only a reported negative +scenario; do not inspect or intervene in that environment. + +Reply directly tagged FM-FILBERT-1 to darkwing. If a durable detailed verdict is +needed, you may create only docs/plans/reviews/2026-09-06_foundation-map-filbert-verdict.md +in this repository; report its SHA-256 and reviewed candidate hashes. No commit +is requested. No automatic timer, deadline, retry or approval is assumed. + +## Transport receipt (2026-09-06 07:52 UTC) + +One tools/tmux/agent-send.sh invocation targeted =filbert on the default server. +Exit 2: submission could not be confirmed. Receipt is unconfirmed, not delivered +or acknowledged. No retry or private-pane poll. Await direct FM-FILBERT-1 +reply or manual owner steering; darkwing owns follow-up. + +## Admission clarification (2026-09-06 08:00 UTC) + +Filbert replied FM-FILBERT-1, resolving the original delivery uncertainty. He +verified candidate hashes, all 69 baseline inputs and foundation parent, but +stopped before substantive review/tests because assignment compatibility was +unestablished. His NOT APPROVED means incomplete review, not technical rejection. +He identified d4696d09's historical CURRENT.md as the uncertainty, not evidence +of an actual current competing personal assignment. + +Sent FM-FILBERT-1-C1 once: source baseline is not current assignment authority; +7345f33 CURRENT.md:8-25 names the mapping review gate, subsequently authorized +by Jason's explicit request for Filbert. Asked him to establish compatibility +from his own current instructions, or return the concrete conflict/uncertainty +for Jason to resolve. No permission to cancel, inspect other agents, or reprioritize. +Clarification delivery unconfirmed (exit 2); no retry. Candidate remains unchanged. +Await FM-FILBERT-1-C1 admission/blocker; darkwing owns follow-up. + +## FM-FILBERT-1 completed review (2026-09-06 08:06 UTC) + +Filbert confirmed non-authorship and no competing current assignment, withdrew +the historical-CURRENT blocker and returned APPROVED for the exact written map +at 7345f33 against d4696d09. Verified verdict SHA-256 +6b08c6fac0718d3db527cf9ffbfab49407e7b289d09782f5d1d0e26493eaabb3 and both +candidate hashes against committed/current map bytes. No blocking defect; five +informational findings/limits, 20 source-row and R1-R34 semantic dispositions. +Independent checks reported: 69 hashes, nine legacy identities, foundation checker, +config 24/24, syntax and mapping whitespace. Other full runtime/native/render +suites were explicitly not run by this reviewer. Earlier incomplete NOT APPROVED +is superseded, not rewritten. Owner acceptance and implementation remain gated. +Sent one non-actionable closeout; delivery unconfirmed, no reply obligation or +retry. Exact verdict remains unchanged. No commit, push or implementation. + +## Owner acceptance of reviewed technical map (2026-09-06 08:07 UTC) + +Jason answered "yes" to accepting the independently reviewed written map as the +technical planning baseline. Accepted mapping: 7345f330fc6bfae5aa1d896c78cfb7cbe62efbae; +source/plan baseline: d4696d09eb1b5dcf1028f30db2cd63735f51cb16. +Verified map/handoff and Filbert verdict identities unchanged. Verdict SHA-256: +6b08c6fac0718d3db527cf9ffbfab49407e7b289d09782f5d1d0e26493eaabb3. +Acceptance covers planning, not runtime/security/render proof, implementation, +migration, push or issue closure. Recommended next step: separately authorized +charter for the bounded synthetic inspector. No new phase started or commit made. diff --git a/docs/plans/reviews/2026-09-06_foundation-map-filbert-verdict.md b/docs/plans/reviews/2026-09-06_foundation-map-filbert-verdict.md new file mode 100644 index 00000000..33cef4aa --- /dev/null +++ b/docs/plans/reviews/2026-09-06_foundation-map-filbert-verdict.md @@ -0,0 +1,223 @@ +# FM-FILBERT-1 — independent written-map verdict + +Reviewer: filbert. Follow-up owner: darkwing. Date: 2026-09-06. + +## Admission and verdict + +**APPROVED for the bounded written technical map at the exact identities below.** +No blocking technical-map defect found. This is not full Archify acceptance, +owner acceptance, phase advancement, an implementation charter, or a runtime verdict. + +I did not author/co-author this candidate in my available session history. My +current instructions contain no competing personal owner-authorized assignment. +FM-FILBERT-1-C1 resolved my earlier mistaken use of the source baseline's historical +CURRENT.md as current task authority. That admission blocker and the resulting +incomplete NOT APPROVED are superseded by this completed review, not erased. +Mapping-commit CURRENT.md:8-25 records the later review gate; Jason's separately +communicated authorization admits only this bounded review. + +- Mapping commit: `7345f330fc6bfae5aa1d896c78cfb7cbe62efbae` +- Source/plan baseline: `d4696d09eb1b5dcf1028f30db2cd63735f51cb16` +- Foundation parent: `44f257cb06484feda3412d9382e3587393796353` +- Map: `docs/plans/2026-09-06_foundation-technical-map.md` + SHA-256 `772f9e61cb9fb7a31ce8187b12cdf1c4a5fb714ad517a9c12928901171a37db1` +- Handoff: `docs/plans/2026-09-06_foundation-map-handoff.md` + SHA-256 `1fd1a89f982a31bb9db21b852df78be954323aa1668ab9752be34de853ee4999` + +Both document hashes matched independent computation from `git show`. All 69 +handoff input hashes matched the source baseline. The mapping commit's parent is +the source baseline, whose parent is the foundation parent. The mapping commit +changes only map, handoff and CURRENT. All nine inspected legacy source files +are byte-identical to 69d1bb3 and to the isolated baseline export. + +## Numbered findings and limits + +1. **Informational / confirmed — legacy launch is not managed admission.** + Locations: map launch/mount/context trace tables; baseline `compose.yaml:38-43`, + `scripts/agent.sh:121-138,181-199`, `src/run-agent.sh:37-41`, + `src/load-contracts.sh:40-41,68-97`, `adapters/pi/adapter.sh:29-44,81-96`. + Evidence: broad writable data-root mount, shared SOUL/mission/prompt destinations, + fixed `.partial`, blanket user Markdown discovery, directory-nonempty continuation, + and native/print invocation are present. These support the proposed replacement + boundaries; a named workspace is not isolation. Required correction: none. + Limit: no race reproduction, engine discovery measurement or containment test. + +2. **Informational / confirmed — evidence and lifecycle reuse is correctly narrow.** + Locations: map evidence/lifecycle tables and ordering constraints; baseline + `scripts/mosaic-task.mjs:295-302,442-466,548-641`, `scripts/reset.sh:16-48`. + Evidence: exclusive-create writes lack fsync in the helper; retry starts a new + run without reconciliation; prune deletes before appending its receipt and + treats directory-read exceptions as an empty inventory; reset lacks foundation + claim/reference protection. Map preserves useful conventions without calling + them crash durability or recovery. Required correction: none. Limit: static + ordering inspection is not a measured crash/failure-injection result. + +3. **Informational / confirmed — policy, packaging and process privilege remain distinct.** + Locations: map component/placement matrices and integrated ownership section; + baseline ROADMAP:127-166, #55 layout plan, candidate README sections 2-3/6, + RUNTIME sections 1/4/7. Pure calculation belongs to proposed packages/config; + publication and process authority do not. CLI presentation does not own policy. + Runtime/adapter logic has one proposed packages/agent owner, with only unavoidable + retained src shims. Current extensions/** and generated .pi installation do not + replace the future packages/* decision. A shared package is explicitly not a + shared process privilege grant. Required correction: none. #55's historical + native-test/reviewer receipts were read as reports, not independently rerun or + recertified here; Dewey's current work is excluded. + +4. **Informational / confirmed with implementation limits — the inspector is appropriately bounded.** + Locations: map recommended-increment section and cross-lane scenario; candidate + REVIEW first-increment proposal, README sections 2-3/8, RUNTIME sections 2/5. + Coherent synthetic graph, explicit selection, required policy refusal, + least-privilege intersection, no assignment-union grants, deterministic preview, + no live writes and owner test gate are stated. The cross-lane case preserves the + original assignment unless a properly authorized, recorded change within owner + intent is reconciled. A message does not itself confer delegation or acceptance. + Required correction: none for this recommendation. A later charter must specify + executable graph/operation inputs and tests for those rules; the current small + model is not a real graph resolver, authenticator or reassignment implementation. + +5. **Informational / review limit — source flags and reported external behavior are not runtime proof.** + Locations: map adapter row, authority/coordination history and owner-reported + cross-lane scenario; handoff collaboration section. I confirm adapter flags and + command construction, not the pinned engine's complete discovery, exact-session, + fork-preservation or security behavior. Future reuse remains conditional on the + admission tests already required by the plan. Collaboration delivery, native + acceptance and the separate-environment incident are reported context, not + independently observed facts in this review. Required correction: none; preserve + those qualifications in downstream maps and charters. No external incident + diagnosis or investigation was performed. + +## Request-item dispositions + +| Item | Disposition | Independent basis | +|---|---|---| +| 1. Source/plan boundaries, hops, reuse and gaps | Confirmed at the written map's explicitly limited inventory level | All direct source-locator rows opened in the committed baseline; dispositions below. New responsibilities are proposals, not repository-wide absence claims. | +| 2. R1-R34 meaning | Confirmed as responsibility mapping, not a replacement specification | Each requirement checked against the foundation table, owner interview and accepted phase-2 rules; per-R dispositions below. | +| 3. Policy/effects, package/process, source/install, single owners | Confirmed | Placement matrix and integrated qualifications agree with ROADMAP, #55 and RUNTIME trust boundaries. | +| 4. Synthetic inspector | Confirmed as a recommendation | Seven core acceptance cases plus cross-lane case preserve the no-live-grants boundary; execution and enforcement unimplemented. | +| 5. Identity/commit distinction | Confirmed mechanically | Exact map/handoff hashes, 69 input hashes, both parent links and nine legacy identities verified. | +| 6. Independent checks | Passed within stated limits | Contract checker, config suite, syntax and mapping whitespace checks below; no native/synchronization/security suites claimed. | + +## Direct source-row dispositions + +Every row is **confirmed as a static source finding and justified reuse/change +recommendation**, subject to findings 1-5. No row is certified as external runtime +behavior. Paths/lines here resolve at d4696d09. + +| Map source row | Verified meaning / disposition | +|---|---| +| agent.sh:78-130 | Reads seat defaults, copies canonical SOUL to shared agent path, conditionally writes seat record. Reuse identity concept; change snapshot materialization. | +| agent.sh:132-170 | Global agent session default and role-tool narrowing. Replace scoped selection; retain narrowing principle only. | +| agent.sh:181-199 | Shared mission copy, name-default workspace, Compose TUI launch. Change orchestration and inputs. | +| adapter.sh:23-50 | cwd, fork/persistent/ephemeral flags and nonempty-directory `-c`; explicit tools/no-tools. Exact scoped binding remains new. | +| adapter.sh:63-96 | Native/print modes and explicit suppression/provider/model/prompt arguments. New mediated gateway remains required; engine behavior not exercised. | +| mosaic-task.mjs:252-273,670-676 | Closed role keys, filename identity, known unique tools, network enum and emitted metadata. Not network enforcement or scope RBAC. | +| mosaic-task.mjs:362-378 | Requested task tools intersect mission tools when both exist; empty intersection is tool-free. Absent task tools can inherit mission tools: this is narrower legacy semantics, not the new full policy resolver. | +| mosaic-task.mjs:295-325 | Exclusive-create snapshots/helper, no fsync in helper. Reuse intent, replace durable publisher. | +| mosaic-task.mjs:442-466 | Final response/provenance/process result fields, followed by writeOnce. Not invocation-level managed audit. | +| compose.yaml:38-43 | Writable whole-root mount and separate read-only auth mount. New managed isolation/credential boundary needed. | +| run-agent.sh:20-41 | Adapter path checks and shared generated prompt before dispatch. Retain dispatch validation, change context publication. | +| load-contracts.sh:18-58 | Required governance sources, optional seat SOUL and fixed staging file. Snapshot/publication changes warranted. | +| load-contracts.sh:68-77,81-98 | Blanket user Markdown selection precedes mission, contrary to header order. Replace discovery with authorized classified selection. | +| reset.sh:16-48 | Configured target, symlink/realpath/marker checks, recursive delete; no claim/reference/receipt integration. | +| mosaic-task.mjs:548-595 | Retry redirects relative mission references to snapshot and replays as a new run. Not uncertainty recovery. | +| mosaic-task.mjs:598-641 | Count-based preview/apply, caught directory errors, delete then receipt. Protected retention requires changes. | +| mosaic-config.mjs:39-61,76-174 | MOSAIC_CONFIG override, strict shape/file/root validation and lstat errors treated as missing. Sole-config reconciliation is explicitly required, not silently approved. | +| mosaic-config.mjs:194-239 | Exclusive bootstrap creation, existing-config validation and quoted env output. Synthetic inspector must not invoke bootstrap/live resolution. | +| auth.sh:19-96 | Config-backed account reporting; status parses credential JSON and parser diagnostics. Static source read only; no redaction guarantee or credential read performed by reviewer. | +| agent.sh:28-64 | Named auth account refusal checks and mount-source export; no project-selection parser. Future #50 binding must replace flat selection. | + +The nine files were read completely. Plan inputs read: foundation requirements, +workspace/schema interview, phase-2 contract, candidate README/REVIEW/RUNTIME, +ROADMAP, #55 layout, #54 native-development plan and #50 auth/provider registry. +Also read candidate check.py and semantic-model.py, extension/.pi READMEs, +Containerfile and adapter contract. The 69-entry identity audit is a byte audit, +not a claim of independent line-by-line review of every extension/schema fixture. +The schema/fixture inventory was additionally consumed by the author checker. + +## R1-R34 semantic dispositions + +C = confirmed responsibility allocation and planned gap, not implemented behavior. +The map's concise index is read with its named accepted-plan input; it does not +need to restate every normative clause to be a faithful responsibility map. + +| Requirement | Disposition and meaning checked | +|---|---| +| R1 | C — reusable definition retained; execution-specific identity binding changes. | +| R2 | C — project registration and bounded delegation require new resolver, not tool names. | +| R3 | C — exactly one project parent, explicit workspace membership; dependencies do not grant access. | +| R4 | C — one identity across scopes with distinct scoped sessions, replacing global default. | +| R5 | C — explicit agent/project/workspace selection, not cwd or seat-name inference. | +| R6 | C — reusable instructions, selected scoped work context and authorized snapshots. | +| R7 | C — exact Resume/Fresh/genuine-first-use distinction; damaged history is not first use. | +| R8 | C — assignment-only Abandon and explicit authorized prerequisite/selection transitions. | +| R9 | C — authorized human/service launch and recovery from checked work records. | +| R10 | C — claim key is scoped, not session-only; tuning/budgets/scaling are not implemented by the map. | +| R11 | C — shared client operations/work truth; no separate interface task list. | +| R12 | C — explicit scoped messaging, no identity-based conversation mixing; cross-lane text is not authority. | +| R13 | C — whole-root mount is not containment; actual enforcement remains a proof gate. | +| R14 | C — legacy provenance is useful but lacks trusted classified per-action evidence. | +| R15 | C — owner phase/user-test gates retained; independent written approval is not owner acceptance. | +| R16 | C — canonical SOUL retained, current approved launch revision snapshotted; no silent live reload. | +| R17 | C — comparable base hash and cross-interface notices are new, distinct from full launch identity. | +| R18 | C — single-owner mission/parent graph and exact references, not duplicated project truth. | +| R19 | C — bounded within-plan decomposition and authorized non-author acceptance; coordinator title is insufficient. | +| R20 | C — taskless permitted read/chat is distinct from recorded assigned changes. | +| R21 | C — active conflict plus explicitly authorized connection, not automatic attach/replacement. | +| R22 | C — transcript visibility/handoff is separate from work-record read and automatic context loading. | +| R23 | C — revoke affected scope, stop/fence and reconcile effects; independent other-scope authority survives. | +| R24 | C — one controller, separately authorized observers and explicit generation-fenced transfer. | +| R25 | C — controlled Fresh replacement requires stopping/safety evidence, not timeout/idle alone. | +| R26 | C — non-destructive authorized investigation, no blind replay or invented success. | +| R27 | C — audit failure closes affected admission; preauthorized fail-safe stop is not unaudited recovery. | +| R28 | C — classified relevant user context replaces blanket global Markdown discovery. | +| R29 | C — retirement/reopen preserves evidence, distinct from deletion and protected retention. | +| R30 | C — reviewed legacy adoption preserves originals; no inferred membership. | +| R31 | C — current approved intent pauses affected work for reconciliation; messages cannot silently retask it. | +| R32 | C — standard nonhierarchical scope roles narrow reviewed ceilings, not redefine identity. | +| R33 | C — invocation evidence plus actually enforced limits; no claim to enumerate every internal effect. | +| R34 | C — Mosaic-controlled client with Pi behind the single reviewed adapter; no native parity waiver of safety. | + +Owner-intent/reassignment was checked particularly against R8/R19/R23/R31/R32, +README reference/permission/lifecycle rules and RUNTIME assignment/message rules. +Independent acceptance uses actual author provenance and current reviewer authority, +not a fresh session of the same author or a message saying approved. The small +synthetic model cannot prove that enforcement; the map does not claim it does. + +## Independent test receipts + +Measured 2026-09-06 around 08:01 UTC. Isolated source export: +`/tmp/fm-filbert-1.6Acnih`, created with +`git archive d4696d09eb1b5dcf1028f30db2cd63735f51cb16 | tar -x -C `. +No shared-tree checkout/reset, dependency install or live runtime was used. + +1. Python/subprocess `git show :` plus `hashlib.sha256`: + both candidate hashes matched; 69/69 inventory matched; 9/9 legacy files matched + 69d1bb3 and the export. `git rev-list --parents -n 1` confirmed both parent links. +2. From export, with clean environment, temporary HOME and bytecode writes disabled: + `/home/jwoltje/.pyenv/versions/3.12.8/bin/python3 docs/plans/foundation-v1-candidate/check.py`. + **Exit 0:** 38 command shapes, 38 record shapes, 16 paths, 7 restricted-domain hash + vectors, 155 runtime/artifact shapes, 35 synthetic model cases; 5+5 deliberately + shape-valid semantic forgeries remain shape-valid. Python 3.12.8/jsonschema 4.26.0. + Initial attempt using `env -i PATH=/usr/bin:/bin ... python3` failed exit 1 because + that interpreter lacked jsonschema. No dependency was installed; the existing + explicit interpreter above supplied the documented dependency for the successful run. +3. From export: `env -i PATH=/usr/bin:/bin HOME=/tmp/fm-filbert-1.6Acnih-review-home bash scripts/test-config.sh`. + **Exit 0: 24 passed, 0 failed.** Suite uses its own temporary synthetic config/data. +4. `bash -n` for scripts/agent.sh, auth.sh, reset.sh; `sh -n` for + adapters/pi/adapter.sh, src/run-agent.sh, src/load-contracts.sh; + `node --check` for scripts/mosaic-config.mjs and scripts/mosaic-task.mjs. + **All exit 0.** Observed default Node v26.8.1; syntax checking is not pinned-runtime testing. +5. `git diff-tree --check 7345f330^ 7345f330`: **exit 0**. + +No test-task full suite, release/conductor/auth runtime suites, verify.sh, Docker, +native extension, sync/package, renderer, browser, process-stopping, sandbox, +credential separation, crash-durability or full JCS/Unicode enforcement tests ran. +In particular the author checker is independently executed author test code, not +an independent implementation of its validator and not proof of real authorization. +No architecture JSON/HTML, render receipt or visual preview was supplied or accepted. + +Only this offered verdict path was written in the repository. No shared logs, +CURRENT, source, policies, installations, commits or pushes were changed. No +credential contents, live worker state or separate ~/.mosaic environment were read. +No implementation or automatic next increment is authorized by this verdict. diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-code-r6-review-request.md b/docs/plans/reviews/2026-09-07_foundation-inspector-code-r6-review-request.md new file mode 100644 index 00000000..38a2de75 --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-code-r6-review-request.md @@ -0,0 +1,45 @@ +# FI-FILBERT-8 — r6 re-review after Unicode ordering correction + +Owner demo/build/review authority and FI-FILBERT-7 scope remain unchanged. +Reviewer filbert; sole code writer rocko; coordinator/follow-up darkwing. +Recheck assignment compatibility/non-authorship. No displacement of owner work. + +Repository /home/jwoltje/src/mosaic-stack-dev-test. +Frozen candidate report: +docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r6.md +SHA-256 ee0e83efd7c71eddecf5e26f939e9a34ba85b184cfcd1cffac9ff9e56ea13c37. +Manifest: docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r6.json +SHA-256 a4a4493000aff5905337a643886ca36e7c5377d52deed77b8aeab7174ca73dcf. +Coordinator verified both identities, 382 file hashes/modes/sizes and pinned inputs; +this is not independent execution of writer tests. Recheck exact scope/aggregates. + +Charter/addendum and owner test-gate decision are unchanged, with exact identities +in the manifest and FI-FILBERT-7 request. Prior NOT APPROVED verdict remains preserved +at hash 154e7b5d804c059d6fec4c936c78e4ae33bb7fc273ba3a5eec7b00d0a9ce1e59. + +Reproduce all six R5-1 Unicode pairs, inspect orderingForm over the actual strict- +JSON domain, and test malformed/equal-key cases beyond writer examples. Verify no +normalization, Unicode ban, digest-domain expansion, precedence/privacy change or +semantic-array reordering. Distinguish structural equality from byte-identical +serialization when assessing the writer's index-fallback claim. Retain original +F1–F6/C1–C5 closure and A1–A8 coverage; independently run authorized checks. + +Use isolated copies of exact candidate and required committed baseline dependencies. +Writer reports unrelated working-tree modifications to scripts/agent.sh and + docs/TOOLS.md: do not include or test them as though part of this frozen inspector. +If integration HEAD or relevant source identities changed, identify that boundary +explicitly rather than silently reviewing another session's work. + +As Jason ruled, test-task.sh and test-release.sh are NOT RUN / DEFERRED for this +offline demo. All other inspector/oracle/foundation/non-live checks remain required; +conductor fixture Git mutations allowed only in disposable test repos. No live model, +engine/container, native/sync, credential, install or ~/.mosaic activity. No shared +index, checkout/reset, staging, commit or push. Inspect commands before running. + +Only allowed repository write: +docs/plans/reviews/2026-09-07_foundation-inspector-code-verdict-r6.md. +Return FI-FILBERT-8 APPROVED/NOT APPROVED for exact candidate and bounded offline-demo +gate, per-finding dispositions, actual measurements, new findings and deferred limits. +Do not fix/co-author code or edit existing records. Owner A9 acceptance remains a +subsequent gate. Direct reply plus declared verdict are return paths; follow-up +darkwing; no deadline or automatic approval. diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-code-rereview-request.md b/docs/plans/reviews/2026-09-07_foundation-inspector-code-rereview-request.md new file mode 100644 index 00000000..6e222130 --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-code-rereview-request.md @@ -0,0 +1,57 @@ +# FI-FILBERT-7 — independent r5 code re-review for offline demo + +Owner authorized build, independent code review and demo. Recheck current assignment +compatibility/non-authorship; no displacement of other work. Writer rocko; coordinator +and follow-up darkwing. All FI-FILBERT-6 review boundaries remain except the explicit +test-gate adjustment below. + +Repository /home/jwoltje/src/mosaic-stack-dev-test. +Frozen r5 manifest: docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r5.json +SHA-256 a63bb103e4cfe51bbd8a42cd95545f935ac83c1da51cf469298375cf94ced135. +Report: docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r5.md +SHA-256 17c67427dfdf1bc5dac491c4d0223928e87fdfc67a26175ac239eb2b2f7b7dec. +Coordinator verified report/manifest identities, 369 file hashes/modes/sizes and all +pinned inputs. This is not independent test execution. Recheck exact scope/no extras, +aggregates, copies and candidate identity before/after review yourself. + +Charter 19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6 and +addendum afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5 remain +unchanged; full paths and all earlier identities are in the FI-FILBERT-6 request. +Source baseline d4696d09; integration HEAD reported 9a5fbdb, not a commit of this code. + +## Re-review scope + +Reproduce/reconstruct all F1–F5 witnesses from your original verdict, confirm F6 +ownership coverage and independently examine the fixes/interactions for regressions. +Do not accept writer CLOSED labels as your verdict. R4 fixed declarations/work.read/ +issuer narrowing/exact-revision cycles; r5 completes deterministic declaration +inventory traversal beyond records. Confirm new registry-declaration-missing rule +and admission stage/exit semantics against the charter. Inspect stableOrder and +malformed-entry/content tie-breaking, profile/digest/duplicate/reference precedence, +permutation coverage and unchanged semantic sequence arrays. Retain full A1–A8 +coverage and prior C1–C5 closure; expand adversarial probes where useful. + +## Explicit owner test-gate adjustment + +Read docs/plans/reviews/2026-09-07_foundation-inspector-demo-test-gate-decision.md. +Jason authorized test-task.sh and test-release.sh to be NOT RUN / DEFERRED for this +OFFLINE DEMO only. Do not execute their live branches, simulate a full pass or hide +the missing coverage. Full deployment testing remains a later gate. +Independently run inspector/oracle/foundation and authorized non-live config/auth/ +conductor verification in disposable copies. Conductor's fixture Git mutations +are authorized ONLY inside its disposable test repositories, never shared source +or index. No provider calls, engine/container launches, native/sync tests, credential +access, package installs or ~/.mosaic activity. Inspect commands first; report any +additional unsafe branch/blocker rather than broadening permission. + +## Exact return + +Only authorized repository write: +docs/plans/reviews/2026-09-07_foundation-inspector-code-verdict-r5.md. +Return FI-FILBERT-7 APPROVED/NOT APPROVED for the bounded offline-demo code gate, +exact manifest/contract identities, per-finding closure/reopening, new findings, +A1–A8 dispositions, commands/toolchain/results and explicitly deferred coverage. +Owner A9 acceptance remains separate. Preserve prior rejected verdict and evidence. +Do not fix/co-author code, change fixtures/charter, stage, commit, push or mutate the +shared index. Direct reply and declared verdict path are return mechanisms; follow-up +darkwing. No deadline, automatic approval or dependent runtime work. diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-code-verdict-r5.md b/docs/plans/reviews/2026-09-07_foundation-inspector-code-verdict-r5.md new file mode 100644 index 00000000..4b987c68 --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-code-verdict-r5.md @@ -0,0 +1,236 @@ +# FI-FILBERT-7 — r5 independent CODE verdict: NOT APPROVED + +Scope: **bounded offline-demo code gate**, not deployment or owner acceptance. +Reviewer: filbert. Sole code author: rocko. Coordinator/follow-up: darkwing. +Date: 2026-09-07. No competing assignment is known; no implementation authorship. + +All nine original F1–F5 witness inputs now produce corrected results. All executed +required suites pass. **F5 nevertheless remains open:** the new content tie-break +collapses distinct Unicode entries to the same fallback and again makes the emitted +first failure depend on inventory order. Six independent reversed-order witness +pairs demonstrate this. This is a deterministic-refusal defect, not a real permission +grant or demonstrated runtime-security exploit. + +## 1. Exact candidate, authority and identity checks + +| Input | SHA-256 / commit | +|---|---| +| r5 manifest `docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r5.json` | `a63bb103e4cfe51bbd8a42cd95545f935ac83c1da51cf469298375cf94ced135` | +| r5 report `docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r5.md` | `17c67427dfdf1bc5dac491c4d0223928e87fdfc67a26175ac239eb2b2f7b7dec` | +| Charter candidate 3 | `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` | +| Incorporated feasibility r2, §§5–13 subject to charter overrides | `f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1` | +| Pattern/profile addendum | `afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5` | +| Pinned record schema | `05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6` | +| Pinned checker | `82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607` | +| Owner demo test-gate decision | `62cea74bea59e69f29c8a29a9c0311fdc6feffa2c337bc6a141db55149204898` | +| Source/schema baseline | `d4696d09eb1b5dcf1028f30db2cd63735f51cb16` | +| Measured integration HEAD | `9a5fbdbda74b16adf488fe28138b2ba69ea5e669` | + +I independently verified **369 distinct regular candidate files**, sizes, modes, +SHA-256s, exact allowlist/no extras, all six aggregates, report/manifest hashes and +every manifest-pinned input. Copies were hash-verified before execution. Final +shared-tree/export recheck at **2026-09-07T15:15:57Z** passed with the same HEAD. +The code is uncommitted: HEAD is not falsely presented as its code identity. + +Export: `/tmp/fi-filbert-7.239u2bco`. +Separate evidence/harness root: `/tmp/fi-filbert-7.239u2bco-evidence`. +Required baseline bytes came from the committed source baseline, not moving owner +work. The non-live integration scripts and their relevant baseline dependencies +are unchanged between that baseline and measured HEAD. Five unrelated native/fleet/ +goal scripts differ between those commits; they were not executed or independently +reviewed here. No shared index or owner extension work was used as test scratch. + +## 2. Numbered finding + +### R5-1 / F5 reopened — BLOCKING, medium: partial canonicalizer is not a total ordering tie-break + +Sources in the frozen candidate: + +- `scripts/foundation/resolve.mjs:730–751`, especially `734–735` and `750`; + SHA-256 `892f95ab8a971d93060353e43d53cb6988e7e61f2a5bae71f6f2aaf2b7c1f09f`. +- `scripts/foundation/canonical.mjs:29–43`: the mock-content canonicalizer rejects + non-ASCII strings, as required for its separately bounded digest domain. +- New ordering tests: `scripts/foundation/resolve.test.mjs:548–712` exercise ASCII + tie-breaks and readable differing keys, but miss the colliding Unicode fallbacks. + +Contract: charter §10.4 and the pinned ordering follow-up require stable within-stage +ordering, including deterministic content tie-breaking for malformed entries. The +r5 report's assertion that only indistinguishable duplicates fall back to input index +is not true for this implementation. + +`stableOrder` catches a `CanonicalError` and assigns canonical content `""`. Two +**different** entries containing non-ASCII strings therefore compare equal whenever +their typed keys are equal or both unreadable. The final `a.i - b.i` makes input order +choose the first shape failure. This affects emitted CLI rules, not just internal +locators. + +#### Independent concrete witnesses + +Start with a copy of the frozen +`scripts/foundation/fixtures/demo/demo-file-change-src.json`. + +1. Replace `registries` with `[{"extra":"é"}, "é"]`. CLI `--json` returns + **exit 2 / invalid-request / shape-unknown-field**. Reverse only that array: + **exit 2 / invalid-request / shape-type-mismatch**. Both entries have unreadable + identity keys and both fail the ASCII canonicalizer. +2. The identical substitution/reversal independently produces the same differing + rules in **records, artifacts and delegationInputs**: four affected families. +3. For readable equal keys, duplicate `agent-a` at the same kind/id/scope/revision. + Give both copies the legitimate displayName `Café`; make the first copy's status + an invalid enum and give the other an unknown payload field. Forward/reversed + inventory gives **shape-enum-mismatch / shape-unknown-field**, both exit 2. +4. Duplicate `agent-policy/ap-full` with identical registry/id/revision/digest keys. + Both copies have readPaths `[{"root":"workspace","path":"café"}]`; give one + an invalid network enum and the other an unknown restrictions field. Reversal + again changes **shape-enum-mismatch / shape-unknown-field**, both exit 2, before + the later digest/duplicate stages. + +All six pairs were executed through the real exported CLI. Four matched ASCII-only +malformed-entry controls are stable under reversal. Separate valid Unicode displayName +and logical-path controls remain **allowed**, as the contract requires. All observed +shape failures remain privacy-safe; no body disclosure is alleged. + +Required correction: provide a deterministic tie-break over the relevant full +strict-JSON input domain without treating distinct unsupported canonical values as +identical. Preserve the ASCII-only **mock digest** domain, permitted Unicode record/ +path values, semantic sequence order, stage precedence and body-free diagnostics. +Do not fix this by blanket-rejecting Unicode or changing the charter. Add equal-key +and unreadable-key multi-failure Unicode permutation regressions. Rocko alone owns +any authorized implementation correction; none was made in this review. + +Exact equal-key record witness input hashes: + +| File under evidence `witnesses/` | SHA-256 | +|---|---| +| `equal-key-unicode-records-forward.json` | `372c5bf1fc0d600ed5d348dc3638c2206d9c6aa43b869f35b0699b7c836e63cf` | +| `equal-key-unicode-records-reversed.json` | `22ed3d21bc95b950af49f37b5c8f33b6be7db52ec4342542a04690696ed95134` | + +No additional numbered code finding is asserted. Finite passing tests are not a +claim that every other possible interaction is correct. + +## 3. Original findings and acceptance dispositions + +Original witness files were preserved byte-for-byte from FI-FILBERT-6; their hashes +match the prior verdict's listed inputs. Actual r5 CLI dispositions: + +| Finding | Independent result / disposition | +|---|---| +| F1 missing referenced declarations | Both original cases now refuse: exit 3 / missing-state / registry-declaration-missing; exit 3 / missing-state / authorization-undeclared. **Closed for reviewed consulted-declaration paths.** | +| F2 task-only work access | Assigned change and task-only proposal both refuse exit 3 / consulted-work-not-readable; proposal identifies original requester context. Taskless positives remain allowed. **Closed.** | +| F3 issuer narrowing | Original issuer-denies-work.read case now refuses exit 3 / consulted-work-not-readable, original requester context. Source rechecks the narrowed layers in both scopes. **Closed for reviewed narrowing behavior.** | +| F4 revision-collapsed cycles | Original acyclic exact-reference history now returns exit 0 / allowed. A further stale-selection mutation reaches assignment-stale, not a fabricated cycle. Real-cycle and cycle-before-continuity fixtures pass. **Closed.** | +| F5 ordering/message priority | Original forward/reversed shape cases both yield shape-enum-mismatch; original message case now yields message-is-not-authority. These witnesses close, but **F5 overall remains OPEN via R5-1**. | +| F6 ownership inventory | Both maintained inventories now include UID/GID; maintained and independent before/after tests pass. **Closed.** | + +The fixed `registry-declaration-missing` diagnostic is consistent with the pinned +coordinator ruling and the declaration/admission distinction: it is an exit-3 +missing-state refusal for a missing consulted external declaration, not the exit-2 +ordinary-record reference rule. I independently combined missing declarations with +structural missing records, duplicates, invalid typed profiles and unsupported +operations: each earlier gate still wins with its specified exit/rule. Registry +lookups remain exact in registry/id/revision/digest; no live authority is inferred. + +| Gate | r5 disposition | +|---|---| +| A1 | Tested positive read/assigned-change text and JSON outputs, goldens, disclaimers and no-effect observations pass. | +| A2 | Missing registration/cross-project selection and privacy/no-fallback fixtures pass. | +| A3 | Reference, ownership, duplicate, history and genuine-cycle detector/CLI tests pass; exact revision fix independently reproduced. | +| A4 | Tested role/policy/task/mission/execution/issuer intersections, path bounds and no-assignment-union cases pass; F1–F3 witnesses corrected. | +| A5 | Strict parser and separate schema/profile oracle pass tested domains; 831 independent typed-LF probes refuse before admission. Unicode/free-text positives remain valid. | +| A6 | Static runtime I/O/import review retained; descriptor, ownership-inclusive inventory and canary checks pass within bounded evidence limits. | +| A7 | Both requester contexts/narrowing checked in source/tests; original selection retained; no allowed reassignment branch. Original F2/F3/message witnesses corrected. | +| A8 | Closed fields, exits 0/2/3/4, escaping and body-free errors pass tested cases. **Not satisfied overall: R5-1 violates stable first-failure ordering.** | +| Offline-demo integration prerequisite | Inspector, oracle, checker, config/auth/conductor independently pass. Task/release **NOT RUN / DEFERRED**, not green. | +| A9 | Not performed. Jason's separate demo acceptance remains required and is not implied by this review. | + +Prior C1–C5 closures remain supported by r5 identity and rerun tests: corrected demo +digest/copy equality; genuine zero-waiver schema comparison plus strict production +profile; twelve closed result fields with process exit separate; saved-before versus +after comparisons; and required O_RDONLY/O_NOFOLLOW/O_NONBLOCK with FIFO refusal. +The calendar platform witness and original LF witnesses remain. No trimming or +normalized identity lookup replaces production refusal. + +## 4. Executed commands and independent receipts + +Commands were inspected before execution. From the isolated export, using `env -i`, +synthetic HOME/TMPDIR, `PYTHONDONTWRITEBYTECODE=1`, `NO_COLOR=1` and PATH +`/home/jwoltje/.pyenv/versions/3.12.8/bin:/usr/bin:/bin`: + +| Command | Exit and actual result | +|---|---| +| `node --test scripts/foundation/` | 0; **77 pass, 0 fail, 0 skipped** | +| `bash scripts/test-foundation.sh` | 0; **43 pass, 0 fail**, including scratch-only fixture regeneration equality | +| `python3 scripts/foundation/verify-schema.py` | 0; **1563 records**, 539 agree-valid / 987 agree-invalid / **0 disagreements**; 27 parser-bound unassessed, 10 unsupported-kind unassessed; 509 profile-valid / 30 profile-invalid; 73 named probes verified | +| `python3 docs/plans/foundation-v1-candidate/check.py` | 0; all pinned author checks pass, including 38 record shapes, 16 paths, 7 restricted fingerprints, 155 runtime/artifact shapes and 35 synthetic model cases; not runtime enforcement | + +Measured versions: **Node v26.8.1, Python 3.12.8, jsonschema 4.26.0**. The year-999 +`strftime('%Y')` witness is `999`, as required by the pinned checker on this platform. + +Non-live integration ran via `python3 integration.py` in the separate disposable +`/integration-fixture` copy. It seeded a **disposable test Git repository** +so the conductor suite could clone/commit/reset only its own test fixtures. Git +system/global configuration was disabled, HOME/TMPDIR synthetic, and no shared Git +mutation occurred. Commands `bash scripts/test-config.sh`, `bash scripts/test-auth.sh` +and `bash scripts/test-conductor.sh` each exited **0**, respectively **24/0, 15/0, +17/0 passed/failed**. Auth inputs were fabricated test canaries, never real credentials. +Failing guards for docker/podman/curl/wget/ssh were installed ahead of PATH and were +**never invoked**; they did not simulate services or supply passing branch results. + +Additional independent harnesses, all under the evidence root: + +- `python3 review-probes.py`: exit 0 verifies the nine corrected original witnesses, + **six remaining Unicode ordering counterexamples**, and four stable ASCII control + pairs (29 CLI executions). Exit 0 here means the recorded findings were reproduced, + **not** that the candidate passes the counterexamples. +- `python3 interactions.py`: exit 0; eight independently constructed stage-order, + message/issuer, history/currentness and Unicode-positive interactions pass. +- `python3 profile-probes.py`: exit 0; **831** typed-identity single-final-LF mutations + produce exit 2 / profile-pattern-mismatch with selection/operation/proposal/diagnostic + all null; a multiline mission objective remains allowed. +- `python3 non-effect.py`: exit 0; **15** text/JSON/parser/I/O/usage executions, **16** + unchanged inventory entries including path/type/size/mode/UID/GID/inode/mtime-ns/ + content-or-symlink-target; observed fixture/home/cwd/data roots separate from logs. +- `python3 recheck.py`: exit 0; final shared/export candidate identities and HEAD pass. + +Selected hashes, relative to the evidence root: + +| Artifact | SHA-256 | +|---|---| +| `node-tests.log` | `9cf6f45864e50b7c81e50c31e88d76bf41e6c046d54284205ea21f14f2bc7654` | +| `selftest.log` | `a9eacfc0f8679cd0a6688d2dd3f705528f5b0c1299cf822e61e7be33f578af1e` | +| `oracle.log` | `7bffe6dc27383ee65d2a6b39443aafccab24d2e9247982de2719d29411d929fb` | +| `integration-receipts.json` | `9f576d011b598fab9ac03c56ee68bf0d1ba5eba902d15a22a4742ebe06e8afcb` | +| `review-probe-receipts.json` | `4c46cd6ebd0fc6cb560172e9364f9a6e34a8182b1b869c58ab70f3b76de9ba91` | +| `review-probes.py` | `aa8132dd0a32878d3c94e0475bd34a2348d452af33538ee990a81283f53af107` | +| `profile-probe-receipts.json` | `6c067bcd6c4d88482b410e4e91f228ae5ef293156670b32c13d88544bcba463a` | +| `interaction-receipts.json` | `3e27aee6492ee121f88f28cc00e20af0f2c63d086772210a3030d054784301c6` | +| `inventory-before.json` and `inventory-after.json` (identical) | `5a4feeb061565506317b81dcc3af9bda310674bf0b8aa6ad0972286771ceda59` | +| `recheck.log` | `edad63227d0c0f7ef8fc08869334fd19dc8a2f0e5a1dba5298b4e907367775ed` | + +Scratch is local/disposable evidence, not a durable repository receipt. The minimal +recipes and frozen demo identity above permit reconstruction without modifying +shared fixtures. + +## 5. Deferred coverage, limits and handoff + +**`scripts/test-task.sh` and `scripts/test-release.sh`: NOT RUN / DEFERRED** under +Jason's 2026-09-07 offline-demo decision. They are not passed, skipped-as-green or +fully covered. Full deployment/integration testing remains a later gate before +dependent live runtime work. The recorded correction that r3 ran live branches +stands; the new decision neither retroactively authorizes nor relabels that history. +No such branches were executed in this review. + +Finite tests and inventories are not OS containment, proof of no reads, full schema +or Unicode equivalence, authentic delegation, crash safety, same-size-race defense +or parent-path containment. Only Node v26.8.1 was executed. No installation, +provider/engine/container/network/native/sync/live-data work or investigation of the +operator's actual credentials/HOME/`~/.mosaic` occurred. Git mutations were confined +to the explicitly authorized disposable conductor fixtures. No shared index, +implementation, fixture, charter, prior verdict, log or CURRENT changes; this verdict +is the only repository write for FI-FILBERT-7. + +**Return to darkwing:** reconcile R5-1/F5, authorize Rocko alone to correct owned +code if appropriate, then provide a newly hashed frozen candidate for re-review. +The offline-demo code gate is **NOT APPROVED**. No automatic implementation, +owner acceptance, demo completion, push, issue closure or dependent phase advance; +no deadline or timer is set. diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-code-verdict-r6.md b/docs/plans/reviews/2026-09-07_foundation-inspector-code-verdict-r6.md new file mode 100644 index 00000000..3aa8af1a --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-code-verdict-r6.md @@ -0,0 +1,248 @@ +# FI-FILBERT-8 — r6 independent CODE verdict: APPROVED + +**APPROVED for the bounded offline-demo code gate only.** +Reviewer: filbert. Sole implementation author: rocko. Coordinator/follow-up: darkwing. +Date: 2026-09-07. No competing assignment is known; I have not authored or fixed the +implementation. Owner A9/demo acceptance remains a separate subsequent gate. + +R5-1 is closed: all six exact prior Unicode witness pairs now have stable first +failures. Independent broader-domain and interaction checks support the correction. +No blocking inspector-code finding remains in this review. Two nonblocking +qualifications below correct the byte-identity claim and preserve an auxiliary +native-parser observation without mislabeling it as a passing check. + +## 1. Exact reviewed identities and source boundary + +| Input | SHA-256 / commit | +|---|---| +| `docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r6.json` | `a4a4493000aff5905337a643886ca36e7c5377d52deed77b8aeab7174ca73dcf` | +| `docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r6.md` | `ee0e83efd7c71eddecf5e26f939e9a34ba85b184cfcd1cffac9ff9e56ea13c37` | +| Charter candidate 3 | `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` | +| Incorporated feasibility r2 §§5–13, subject to charter overrides | `f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1` | +| Pattern/profile addendum | `afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5` | +| Pinned record schema | `05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6` | +| Pinned checker | `82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607` | +| Owner offline-demo test-gate decision | `62cea74bea59e69f29c8a29a9c0311fdc6feffa2c337bc6a141db55149204898` | +| Preserved r5 NOT APPROVED verdict | `154e7b5d804c059d6fec4c936c78e4ae33bb7fc273ba3a5eec7b00d0a9ce1e59` | +| Source/schema baseline | `d4696d09eb1b5dcf1028f30db2cd63735f51cb16` | +| Measured integration HEAD | `9a5fbdbda74b16adf488fe28138b2ba69ea5e669` | + +Independently verified before execution and rechecked at **2026-09-07T15:48:19Z**: +382 distinct regular candidate files, exact allowlist/no extras, sizes, modes, +SHA-256s, all six aggregates, report/manifest hashes and every pinned input. Both +shared candidate and exported copies pass. HEAD remains unchanged. This uncommitted +code is bound by the manifest, not falsely claimed to be committed at that HEAD. + +Export: `/tmp/fi-filbert-8.ehrv19oo`. +Separate harness/evidence: `/tmp/fi-filbert-8.ehrv19oo-evidence`. +Compared with r5: five candidate files changed, thirteen fixtures added, none removed. +The CLI, strict parser, mock canonicalizer, oracle and other unchanged implementation +paths retain their verified prior identities; changed source/tests/generator were +inspected before execution. + +The working-tree `scripts/agent.sh` and `docs/TOOLS.md` modifications were excluded. +Required integration dependencies were exported from the committed baseline. The +relevant agent/common/auth/config/conductor scripts, three authorized legacy tests, +package/RELEASE/policy/README dependencies have no committed difference between that +baseline and measured HEAD. Approval does not cover unrelated working-tree or +native/fleet/goal changes, nor a deployment of the entire current working tree. + +## 2. Findings and dispositions + +### 1. R5-1 / F5 — CLOSED: total ordering tie-break + +Frozen `scripts/foundation/resolve.mjs` SHA-256: +`c4951014828080caf9a5038845104afdac02465af10e94a2fddd3558b29621a3`. +`orderingForm` at approximately lines 730–739 replaces the partial ASCII +canonicalizer in `stableOrder`'s tie-break at approximately 755–770. + +Over the actual strict-parser domain, it preserves scalar distinctions, Unicode +strings, array order and object members while sorting object keys by UTF-16 code +unit. Safe integer bounds, paired surrogates, dense arrays and bounded acyclic objects +are supplied by the parser; arbitrary JavaScript objects/nonfinite numbers/getters +are not claimed as supported inputs to this helper. The former exception-to-empty- +string collapse is gone. No normalization, case folding or new Unicode ban appears. +The ordering form is internal, not a digest or emitted record body. + +I reran the **exact twelve prior Unicode witness files**, checking their input hashes +against the prior review receipts. All four unkeyed-family pairs now return exit 2 / +shape-type-mismatch; both equal-key pairs return exit 2 / shape-unknown-field in both +orders. The four prior ASCII control pairs also remain stable. + +Independent extension beyond writer examples: + +- **2,540 strict-parser values**, including safe-integer extrema, all JSON types, + NFC/NFD/case distinctions, BMP/non-BMP strings and keys, escaped controls, prototype- + named keys, numeric-looking keys, maximum-length strings, 1024-member arrays/objects + and depth-32 structures. Forms matched an independently implemented Python + UTF-16-key-sorted reference for every value; **1,663 distinct structural values/forms** + had no collisions. Strict-parser round trips and input immutability passed. +- **120 evaluations**: all 24 permutations of four further malformed entries in each + of the five inventory families; emitted first outcomes remained stable. +- **Ten additional equal-key malformed-record pairs / twenty CLI runs** spanning + Unicode and escaped control display names. Competing enum/missing-field failures + matched the first entry independently predicted by Python's ordering reference; + all pre-admission nulls remained intact. + +These are finite compatibility/regression measurements, not exhaustive proof. + +### 2. NONBLOCKING — “byte-identical” should say structurally equal parsed values + +The report §§2.2/3(a), `stableOrder` comment and test wording overstate the final +index fallback. For example, raw `{"é":1,"a":2}` and +`{"a":2,"\u00e9":1}` have different bytes and insertion orders but the same +ordering form. I independently asserted this distinction and the index tie. + +That is correct for JSON object structural equality: member order, whitespace and +escape spelling do not create different values. Array order and distinct string +values remain significant. Thus this is a prose qualification, **not a reopened code +ordering defect**. Future reports/comments should use “structurally equal parsed +values,” not claim byte identity or general JCS conformance. No file was fixed here. + +### 3. NONBLOCKING, scoped verification observation — native JSON.parse round trips + +An auxiliary warm-run test initially failed a native `JSON.parse`/deep-equality +round-trip comparison. With all anomalies retained, **19 of the 2,540 comparisons** +showed native reparse discrepancies involving object keys. For the initial case, +Python confirmed the raw input, strict-parser serialization and ordering form were +structurally equal; a separate cold native probe did not reproduce that discrepancy. +The full rerun independently verified **every ordering form against Python**, and +strict-parser round trips passed. Detailed raw/form/native-reparse evidence is saved +in `domain-native-disagreements.json`; underlying native-runtime cause is not claimed +as diagnosed or fixed. + +This is **not** relabeled as a passing native-parser test or a waived schema mismatch. +The required pinned record oracle was unmodified and independently reported zero +schema disagreements. Production inspector/strict-parser/resolver/canonicalizer +paths do not call native `JSON.parse`; their inspected parsing path uses `parseStrict`. +The observed auxiliary native-reparse behavior therefore does not demonstrate an +inspector-code defect or invalidate the independent form/reference comparison. +Approval remains limited to the tested offline inspector, not general native JSON +parsing, the platform or a live runtime. Preserve this evidence for separately +scoped follow-up rather than asserting universal parser equivalence. + +## 3. Retained original findings and A1–A8 + +The original nine F1–F5 witness inputs were also rerun unchanged. Actual outcomes: + +| Finding | r6 disposition | +|---|---| +| F1 declarations | Missing agent registry declarations: exit 3 / missing-state / registry-declaration-missing. Undeclared dependency authorization: exit 3 / missing-state / authorization-undeclared. **Closed.** | +| F2 work.read | Assigned task-only change and task-only proposal refuse consulted-work-not-readable; taskless positives preserved. **Closed.** | +| F3 issuer narrowing | Original issuer-denies-work.read witness refuses consulted-work-not-readable in original requester context; both narrowed contexts remain checked. **Closed.** | +| F4 exact-revision cycles | Original acyclic history allowed; stale selection subsequently reaches assignment-stale. Genuine-cycle/precedence fixtures pass. **Closed.** | +| F5 ordering/message | Original shape-order pair and message priority corrected; all R5-1 pairs now corrected with broader coverage above. **Closed**, subject to structural-equality wording qualification. | +| F6 ownership evidence | Maintained UID/GID checks and independent ownership-inclusive inventories pass. **Closed.** | + +The new fixed registry-declaration-missing diagnostic retains the reviewed admission- +stage exit-3 missing-state semantics. Eight independently rerun interactions preserve +structural/duplicate/profile/unsupported-operation precedence ahead of missing +external declarations, message priority, history/currentness and Unicode positives. + +| Acceptance group | Independent disposition within tested scope | +|---|---| +| A1 | Positive read/assigned-change previews, exact text/JSON goldens, disclaimers and bounded no-effects checks pass. | +| A2 | Missing registration/cross-project selection refusals, no fallback and body-free privacy checks pass. | +| A3 | Reference, duplicate, ownership, continuity and revision-exact cycle tests pass; detector and CLI precedence remain distinct. | +| A4 | Mandatory and optional policy layers, role/issuer/task/mission/execution narrowing, paths and no-assignment union tests pass; original F1–F3 witnesses corrected. | +| A5 | Parser/format/bounds negatives, zero-waiver record oracle, strict production identity profile and permitted Unicode/free-text controls pass tested domains. | +| A6 | Static I/O/import limits, descriptor tests, canaries and unchanged ownership-inclusive inventories pass; no containment/no-reads proof claimed. | +| A7 | Both requester contexts, issuer rechecks, original-selection retention and negative/unresolved-only reassignment tests pass; no allowed reassignment branch. | +| A8 | Closed output/exit classes, escaped diagnostics, pre-admission nulls and stable first-failure tests pass, with equality wording and auxiliary native-parser limits above. | + +C1–C5 remain closed for the reviewed candidate: corrected demo identity/copy equality; +genuine pinned schema agreement plus separate production profile; exactly twelve +serialized fields and process exit separate; saved-before versus after inventories; +required O_RDONLY/O_NOFOLLOW/O_NONBLOCK and FIFO refusal. No O_CLOEXEC, authentic +permission, runtime reconciliation or complete schema-equivalence claim is added. + +## 4. Actual commands, results and evidence + +Commands inspected first; all candidate executions used the isolated export. +Measured versions: **Node v26.8.1, Python 3.12.8, jsonschema 4.26.0**. +The pinned year-999 `strftime('%Y')` witness remains `999`. + +From the export, with `env -i`, synthetic HOME/TMPDIR, +`PYTHONDONTWRITEBYTECODE=1`, `NO_COLOR=1`, and PATH +`/home/jwoltje/.pyenv/versions/3.12.8/bin:/usr/bin:/bin`: + +| Command | Actual result | +|---|---| +| `node --test scripts/foundation/` | Exit 0; **80 passed, 0 failed, 0 skipped** | +| `bash scripts/test-foundation.sh` | Exit 0; **43 passed, 0 failed**; fixture regeneration only in disposable scratch | +| `python3 scripts/foundation/verify-schema.py` | Exit 0; **1568 records**; 540 agree-valid, 991 agree-invalid, **0 disagreements**; 27 parser-bound and 10 unsupported-kind unassessed; 510 profile-valid/30 profile-invalid; 73 named probes verified | +| `python3 docs/plans/foundation-v1-candidate/check.py` | Exit 0; all pinned author checks pass, including 38 record shapes, 16 paths, 7 restricted fingerprints, 155 runtime/artifact shapes and 35 synthetic model cases; not runtime enforcement | + +`python3 integration.py` independently ran the committed non-live tests in a separate +`/integration-fixture` copy: `bash scripts/test-config.sh` **24/0**, +`bash scripts/test-auth.sh` **15/0**, `bash scripts/test-conductor.sh` **17/0** +passed/failed, each exit 0. The authorized seed/clone/commit/reset operations occurred +only inside disposable conductor test repositories. Git global/system configuration +was disabled; HOME/TMPDIR were synthetic. Engine/network-command guards were never +invoked and did not substitute simulated successes. Auth data were fabricated test +canaries, not actual credentials. + +Additional scratch commands and receipts: + +- `python3 reproduce.py`: exit 0; 29 exact prior inputs, covering nine original + findings, six Unicode pairs and four ASCII pairs; preserved hashes checked. +- `python3 domain-probes.py`: initial auxiliary native-round-trip assertion failed; + preserved in `domain-probes.log`. The instrumented rerun, logged separately in + `domain-probes-rerun.log`, exited 0 after recording all native anomalies and + independently checking all 2,540 forms with Python and strict-parser round trips. + No candidate code or mandatory oracle was changed. +- `python3 equal-key-probes.py`: twenty final CLI checks pass, exit 0. The first + reviewer harness expected type-mismatch for numeric status; the established enum + checker emits enum-mismatch. That **reviewer expectation** was corrected and the + original failed log preserved; the candidate was unchanged. +- `python3 profile-probes.py`: exit 0; **831** typed single-final-LF probes refuse + exit 2 / profile-pattern-mismatch with selection/operation/proposal/diagnostic null; + multiline objective remains allowed. +- `python3 interactions.py`: exit 0; eight independent interactions pass. +- `python3 non-effect.py`: exit 0; fifteen text/JSON/parser/I/O/usage runs; sixteen + unchanged path/type/size/mode/UID/GID/inode/mtime-ns/content-or-symlink-target entries. + Observed roots and harness output are separate; no synthetic canary output. +- `python3 recheck.py`: exit 0; final shared/export identities, all pins and HEAD pass. + +Selected hashes, relative to `/tmp/fi-filbert-8.ehrv19oo-evidence`: + +| Artifact | SHA-256 | +|---|---| +| `node-tests.log` | `ca295bd80df32558d8d75d48c336ca6cc68bc74edb754ca4e5875247f8015c8d` | +| `selftest.log` | `e856f3fd68bcca7442f809e7a53af4aa674fd6483486120d429917688c4216a2` | +| `oracle.log` | `40e7311b1aed62c12aaba4ad4dd9eca3d43b46b2785f1abc4263be9d85e93653` | +| `integration-receipts.json` | `9f576d011b598fab9ac03c56ee68bf0d1ba5eba902d15a22a4742ebe06e8afcb` | +| `reproduction-receipts.json` | `a2677c32068ee62bd4bbdda89f44432252eeabfb6e433c97fccc28ff71d6b258` | +| `domain-summary.json` | `edd9c1f7f03d8c9249bf2c3627cd1c7c706c6cd90aefc24f67da7f655ccaa8cf` | +| `domain-native-disagreements.json` | `395ae878a3edfe481b22511d720d00e20064c5806f44cf95e597e8324fb3a254` | +| `equal-key-receipts.json` | `22f257f9145de8852255a547b14d79115d080f38bfbbcfde30c024c4afeb5ff3` | +| `profile-probe-receipts.json` | `6c067bcd6c4d88482b410e4e91f228ae5ef293156670b32c13d88544bcba463a` | +| `inventory-before.json` and `inventory-after.json` (identical) | `494f2dbf66a48d3aba5c6731508859b05414c80a52a855708a2859dc5f5df57c` | +| `recheck.log` | `c121172527c5ccb47e4ca6f9d5fb820a1d3580610bba2d34fb61aca9247d3f44` | + +Scratch is local/disposable evidence, not durable repository publication. + +## 5. Deferrals, limits and return + +**test-task.sh and test-release.sh: NOT RUN / DEFERRED** under Jason's offline-demo +ruling. They are not green or fully covered. Full deployment/integration testing +remains a later gate before dependent live runtime work. The historical correction +that r3 ran live branches remains in force; this decision does not retroactively +authorize or relabel those actions. No live branches were executed here. + +Finite tests/static review/inventories do not prove OS containment, absence of every +read, complete schema/native-parser equivalence, authentic delegation, crash safety, +parent-path containment or protection against same-size concurrent mutation. Only +Node v26.8.1 was executed. Approval covers no generalized JavaScript-call domain +outside strict-parser-produced values and no runtime permission engine. + +No code fixes/co-authorship, dependency installation, shared staging/index/commit/ +checkout/reset/push, provider/engine/container/network/native/sync/live-data work or +actual credential/HOME/`~/.mosaic` investigation occurred. Git mutations were solely +the authorized disposable conductor fixtures. This verdict is the only repository +write for FI-FILBERT-8; prior evidence and unrelated owner modifications are preserved. + +**Return to darkwing: APPROVED at the exact r6 manifest for the bounded offline-demo +code gate.** Carry the nonblocking qualifications and deferred tests into the handoff. +Jason's separate A9 acceptance is still required. No automatic demo acceptance, push, +issue closure, live/dependent implementation, reassignment, timer or deadline follows. diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-corrections-request.md b/docs/plans/reviews/2026-09-07_foundation-inspector-corrections-request.md new file mode 100644 index 00000000..414830ac --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-corrections-request.md @@ -0,0 +1,54 @@ +# FI-ROCKO-6 — independent code findings to demo readiness + +Jason directed: “Let's get this to demo.” Existing build/review authority continues; +it does not waive the independent approval or owner acceptance gates. +Sole code writer: rocko. Reviewer: filbert. Integration/follow-up: darkwing. +Recheck compatibility; no displacement of other owner work. + +## Exact rejected candidate and evidence + +Repository /home/jwoltje/src/mosaic-stack-dev-test. +R3 manifest SHA-256 3c2253b6c9f31e448c77aaac53977d41baecfb30e15845dcfffd8dc694428547. +Full verdict: docs/plans/reviews/2026-09-06_foundation-inspector-code-verdict.md +SHA-256 e4cc5970aab20240e6ea3a9a1513ef942ff167fefbb03356b9a32c89999adb3d. +Charter/addendum remain unchanged at 19b67211… / afe2980b…; use their full hashes +in the existing build/review requests. No specification relaxation is authorized. + +## Required corrections + +Read the FULL verdict and implement F1–F5, plus maintained ownership coverage F6: +1. Enforce exact referenced registry declarations and consulted dependency + authorization declarations, preserving the documented missing-state stages/exits. +2. Require work.read whenever a context consults its assigned task or proposal + subject/target, even without mission/dependency references. Preserve taskless reads. +3. Recheck applicable work access after proposal issuer narrowing in BOTH scopes. +4. Preserve exact reference revisions in cycle graphs; never union different + historical revisions into an invented cycle. Preserve cycle-before-continuity order. +5. Stable within-stage shape failure order independent of record inventory order; + message-without-delegation priority after structural validation as specified. +6. Include UID/GID in maintained before/after inventory checks. + +Use the review's concrete witness recipes as regression tests, checking intended +first failures and positive controls. If declared scratch evidence still exists, +verify its listed hashes before relying on it; otherwise reconstruct from frozen +demos and recipes. Do not inspect unrelated reviewer/fleet files. Do not edit the +verdict or claim a new rule where the contract is unclear: return a precise blocker. + +## Allowed work and freeze + +Original FI-ROCKO-3 code/test path allowlist ONLY. Additionally allowed new receipts: +- docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r4.md +- docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r4.json + +Preserve all previous reports, manifests, charter, addendum and verdicts. No staging, +commit, checkout/reset, push, installs, native/sync/live/credential work or ~/.mosaic +investigation. Isolated synthetic tests only. Do not silently run legacy live branches +or substitute stubs/skips to claim integration green; report any test-authorization +blocker. Darkwing owns arranging the independent isolated integration gate identified +in the review, without broadening live-operation authority. + +Return FI-ROCKO-6 admission/blocker, then exact full manifest, per-finding closure, +new witness receipts and all authorized required test results. Freeze the corrected +candidate for Filbert re-review. No owner-demo acceptance or dependent work is inferred. +Direct reply and declared report paths are the return mechanism; darkwing owns follow-up. +No timer, deadline or automatic approval. diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-demo-receipt.json b/docs/plans/reviews/2026-09-07_foundation-inspector-demo-receipt.json new file mode 100644 index 00000000..d9c391c3 --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-demo-receipt.json @@ -0,0 +1,55 @@ +{ + "manifestSha256": "a4a4493000aff5905337a643886ca36e7c5377d52deed77b8aeab7174ca73dcf", + "verdictSha256": "ab9dd5e5c3cad5c9263e873ff82cac444da2d36040e907e4798b208fa1c08b13", + "isolatedRoot": "/tmp/foundation-owner-demo-r6.sje97ajy", + "node": "v26.8.1", + "observedRootsUnchanged": true, + "sharedCandidateHashesUnchanged": true, + "ownerAcceptance": "pending", + "cases": [ + { + "case": "Permitted read", + "command": [ + "/usr/bin/node", + "scripts/foundation-inspect.mjs", + "scripts/foundation/fixtures/demo/demo-read-w1.json" + ], + "exit": 0, + "stdout": "SYNTHETIC PREVIEW \u2014 NO LIVE EFFECTS\npreview: no live registrations or permission grants\nauthentication: not-modelled; declarations: unverified-simulation\nresult: allowed\nreason: allowed\nrule: null\nselection: agent agent-a, project p1, workspace w1, assignment assignment asg-a-w1 @workspace:p1/w1 rev 1\noperation: work.read target null\nproposal: null\ndiagnostic: null\n", + "stderr": "" + }, + { + "case": "Assigned change preview", + "command": [ + "/usr/bin/node", + "scripts/foundation-inspect.mjs", + "scripts/foundation/fixtures/demo/demo-file-change-src.json" + ], + "exit": 0, + "stdout": "SYNTHETIC PREVIEW \u2014 NO LIVE EFFECTS\npreview: no live registrations or permission grants\nauthentication: not-modelled; declarations: unverified-simulation\nresult: allowed\nreason: allowed\nrule: null\nselection: agent agent-a, project p1, workspace w1, assignment assignment asg-a-w1 @workspace:p1/w1 rev 1\noperation: file.change target workspace:src/main.mjs\nproposal: null\ndiagnostic: null\n", + "stderr": "" + }, + { + "case": "Unregistered workspace", + "command": [ + "/usr/bin/node", + "scripts/foundation-inspect.mjs", + "scripts/foundation/fixtures/bundles/adm-workspace-registration-missing.json" + ], + "exit": 3, + "stdout": "SYNTHETIC PREVIEW \u2014 NO LIVE EFFECTS\npreview: no live registrations or permission grants\nauthentication: not-modelled; declarations: unverified-simulation\nresult: refused\nreason: not-authorized\nrule: workspace-registration-missing\nselection: agent agent-a, project p1, workspace w1, assignment null\noperation: work.read target null\nproposal: null\ndiagnostic: null\n", + "stderr": "" + }, + { + "case": "Reassignment cannot execute", + "command": [ + "/usr/bin/node", + "scripts/foundation-inspect.mjs", + "scripts/foundation/fixtures/bundles/prop-all-pass-restricted-contexts.json" + ], + "exit": 3, + "stdout": "SYNTHETIC PREVIEW \u2014 NO LIVE EFFECTS\npreview: no live registrations or permission grants\nauthentication: not-modelled; declarations: unverified-simulation\nresult: unresolved\nreason: unknown-effects\nrule: runtime-reconciliation-required\nselection: agent agent-a, project p1, workspace w1, assignment assignment asg-a-w1 @workspace:p1/w1 rev 1\noperation: assignment.change target null\nproposal: unresolved (unknown-effects; runtime-reconciliation-required) selected assignment assignment asg-a-w1 @workspace:p1/w1 rev 1\ndiagnostic: null\n", + "stderr": "" + } + ] +} diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-demo-test-gate-decision.md b/docs/plans/reviews/2026-09-07_foundation-inspector-demo-test-gate-decision.md new file mode 100644 index 00000000..4a6f1298 --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-demo-test-gate-decision.md @@ -0,0 +1,24 @@ +# Owner decision — bounded offline-demo test gate + +2026-09-07 14:47 UTC. Jason explicitly answered yes after clarification: +defer the two older mixed live suites for this offline inspector demo. + +Deferred: scripts/test-task.sh and scripts/test-release.sh. Report them as NOT RUN / +DEFERRED under this owner decision, never passed or fully covered. This changes only +the test prerequisite for the bounded offline demo. It does not authorize live model +calls, deployment actions, weaker inspector behavior or permanent removal of tests. + +Still required: all inspector unit/CLI/privacy/non-effect/differential checks, +foundation checker, authorized isolated non-live integration checks, Filbert's +independent code approval, and Jason's separate synthetic demo acceptance. +Disposable Git mutations required by conductor tests are confined to test copies, +never the shared index/repository. No credential/native/sync/live environment work. + +Full deployment/integration testing remains a later gate before dependent live +runtime work. Record exact tested versions, hashes, executed checks and deferred +coverage in the next build report, review verdict and demo handoff. Preserve the +historical correction that r3 did execute live branches; this decision does not +retroactively authorize or relabel that execution. + +FI-ROCKO-7 ordering corrections continue. No staging, commit, push, implementation +scope expansion, independent-review waiver or automatic owner acceptance follows. diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-demo.md b/docs/plans/reviews/2026-09-07_foundation-inspector-demo.md new file mode 100644 index 00000000..ceb7395b --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-demo.md @@ -0,0 +1,64 @@ +# Inspector r6 — owner demo + +Independent code verdict: APPROVED for the bounded offline demo (FI-FILBERT-8). +Code manifest: a4a4493000aff5905337a643886ca36e7c5377d52deed77b8aeab7174ca73dcf. +Verdict: ab9dd5e5c3cad5c9263e873ff82cac444da2d36040e907e4798b208fa1c08b13. +Coordinator ran all four examples in an isolated verified copy: expected outcomes +passed, observed copy/HOME unchanged, shared candidate hashes unchanged. Receipt: +2026-09-07_foundation-inspector-demo-receipt.json. This is not owner acceptance. + +## Try it + +From /home/jwoltje/src/mosaic-stack-dev-test, using the tested Node v26.8.1: + +```sh +# Helper only shortens these four commands; it does not install anything. +inspect_demo() { + node scripts/foundation-inspect.mjs "scripts/foundation/fixtures/$1" +} + +# 1. Permitted work-record read: allowed, exit 0. +inspect_demo demo/demo-read-w1.json + +# 2. Assigned change of src/main.mjs: allowed PREVIEW, exit 0; no file is changed. +inspect_demo demo/demo-file-change-src.json + +# 3. Workspace registration missing in this fixture: refused, exit 3. +inspect_demo bundles/adm-workspace-registration-missing.json + +# 4. Even fully supplied mock reassignment evidence: unresolved, exit 3. +inspect_demo bundles/prop-all-pass-restricted-contexts.json +``` + +Run individually or together without `set -e`/`&&`: exits 3 for the negative +examples are expected, not crashes. Each bundle is an independent synthetic +scenario, not successive edits to live state. The third fixture removes w1's +registration; it does not claim to switch selection to w2. + +Look for: +- The same explicit agent/project/workspace and selected assignment where applicable. +- `allowed` only as a hypothetical permission calculation, never an actual grant. +- `workspace-registration-missing` rather than a fallback to another workspace. +- `runtime-reconciliation-required` with the original assignment still selected. +- `SYNTHETIC PREVIEW — NO LIVE EFFECTS` on every result. + +Optional: add `--json` immediately after scripts/foundation-inspect.mjs; inspecting +JSON is not required for acceptance. Do not pass credentials or actual work records. + +## Your acceptance question + +Are the selected scope, refusals and no-live-effects limitation clear, and does +this meet your expectations for this first offline inspector increment? +Report confusing output or unexpected behavior; do not certify security. + +## Boundaries retained + +Two legacy suites (task/release) are NOT RUN / DEFERRED by owner decision, not green. +Other required offline checks passed independently. No live registration, sandbox, +authentication, durable runtime, restart recovery, deployment or federation is proved. +Reviewer qualifications remain: ordering equality means structurally equal parsed +values, not raw byte identity; auxiliary native-parser warm-run anomalies remain +unresolved separate evidence, not a passed universal parser-equivalence test. + +No code/comment fixes were made after approval. No commit, push or dependent runtime +work is authorized by this demo. Jason's A9 answer must be recorded separately. diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-integration-test-boundary.md b/docs/plans/reviews/2026-09-07_foundation-inspector-integration-test-boundary.md new file mode 100644 index 00000000..48d0f68b --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-integration-test-boundary.md @@ -0,0 +1,41 @@ +# Inspector integration verification boundary — measured planning gate + +Coordinator: darkwing. Date: 2026-09-07. +Status: source inspection, not test execution or a waiver of required coverage. + +## Measured boundaries + +- scripts/test-task.sh:408–458 contains real marker and session/fork launches via + run-task.sh when docker info succeeds. Missing Docker skips these cases; that is + incomplete coverage, not a full green integration gate. +- scripts/test-release.sh:10–15 backs up/restores RELEASE; :47–52 deliberately + changes/removes it. Run only in a disposable repository copy, never the frozen + shared source. :58–99 exercises activation/rollback against synthetic data when + Docker is available. Activation is health-gated; do not assume this is a purely + static test or harmless just because the release pointer is synthetic. +- scripts/test-conductor.sh:40–51 clones into its temporary sandbox; later commands + stage/commit/reset there. Those fixture mutations are different from staging the + shared index, but require an explicitly permitted disposable Git test context. + An archive without Git history alone is insufficient for this suite. + +## Required verification plan before full approval + +1. Verify the corrected candidate and reviewed contract hashes before execution. +2. Prepare a disposable repository/test context with the necessary baseline history + and exact candidate bytes. No shared checkout, RELEASE mutation or index use. +3. Select a verification mode explicitly: complete suites with separately authorized + Docker/provider/session effects and runtime-only auth, or accurately limited + non-live coverage. Do not label skips, substitutes or stubs as the full suites. +4. If complete live-provider testing is authorized, constrain it to synthetic tasks, + temporary data/config/session roots, bounded requests and existing pinned images. + No production pointer, actual work/session adoption, credential-content reading, + provider-account mutation, image installation or separate fleet intervention. + Obtain the necessary explicit permission before executing these branches. +5. Record executed/skipped/failed cases and independent versus writer receipts. + The code reviewer must see the scope and exact candidate tested. + +No new authorization is issued by this document. Current code fixes can proceed +independently under FI-ROCKO-6. At the 2026-09-07 14:28 UTC check, the declared r4 +build report had not returned. Do not poll private panes or retry the delivered task. +Owner/test-scope direction and Rocko's exact corrected candidate are the concrete +conditions needed to finish the corresponding remaining gates. diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-ordering-followup.md b/docs/plans/reviews/2026-09-07_foundation-inspector-ordering-followup.md new file mode 100644 index 00000000..515b3c64 --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-ordering-followup.md @@ -0,0 +1,38 @@ +# FI-ROCKO-7 — finish F5 across declaration inventories + +Owner-authorized build corrections continue. Coordinator: darkwing; sole writer: +rocko. No new feature, live test, staging, commit or push authority. + +Verified r4 report dff9f676ad0a97f6333a59d527e02ed55e7bcdca986fe9c1488280b84d4e677f +and manifest 2a2e885f9df3dd626a09fe5db6e28af67c289e54660872031c18f8aa40cb0826, +including all 331 file hashes/modes/sizes. Fixes remain author claims pending review. + +F5 is not yet closed in full. Your disclosure says registries/artifacts/ +authorizations/delegationInputs are still shape-validated in input order. Charter +§10.4 applies stable within-stage ordering, not just to the records array. Source +inspection also finds input-order registry digest-profile traversal at resolve.mjs:831. + +Complete stable traversal across the applicable declaration inventories/stages using +appropriate typed identity keys and deterministic content tie-breaking for malformed +entries. Preserve stage/field precedence, original values and error privacy. Do not +change semantically ordered arrays such as instruction lists or canonical content. +Add multi-failure permutation tests for all declaration families, including differing +shape errors and competing profile/digest failures; demonstrate intended first-rule +stability rather than only a consistent nonzero exit. Do not mutate frozen input files +or invent an exception for declaration lists. + +The new registry-declaration-missing rule is acceptable as a fixed diagnostic name +under existing missing-state refusal semantics; this is not an authority expansion. +Filbert must still confirm its application and stage/exit correctness in code review. + +Allowed correction paths remain FI-ROCKO-3's implementation/test allowlist. New receipts: +- docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r5.md +- docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r5.json +Preserve r4 and prior evidence. Return FI-ROCKO-7 exact hashes, per-family tests and +all authorized required receipts; freeze for independent re-review. If the contract +is ambiguous, report a precise blocker rather than narrowing it silently. + +Continue to withhold task/release live branches. Jason is being asked about deferring +those two mixed suites for this offline-only demo; no ruling exists yet. No fake full +suite pass, new waiver, credential access or live execution is permitted. The report's +correction that r3 included live branches must remain visible in history. diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r4.json b/docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r4.json new file mode 100644 index 00000000..e4a3afb4 --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r4.json @@ -0,0 +1,2085 @@ +{ + "candidate": "foundation-inspector rocko build r4 (FI-ROCKO-6)", + "generatedBy": "scratchpad/make-manifest-r4.py (machine-generated; no hand-transcribed hashes)", + "generatedAt": "2026-09-07T14:38:30Z", + "git": { + "head": "9a5fbdbda74b16adf488fe28138b2ba69ea5e669", + "branch": "main", + "note": "all candidate files untracked; no staging/commit/push" + }, + "toolchain": { + "node": "v26.8.1", + "python": "3.12.8", + "jsonschema": "4.26.0", + "kernel": "Linux 7.2.2-1-cachyos", + "strftime_year_999": "999" + }, + "pinnedInputs": { + "docs/plans/2026-09-06_foundation-inspector-charter.md": "19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6", + "docs/plans/foundation-v1-candidate/records.schema.json": "05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6", + "docs/plans/foundation-v1-candidate/check.py": "82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607", + "docs/plans/foundation-v1-candidate/records.fixtures.json": "d433d06da5cd38baf9e51c8857244ee70375db3b68e02a5325a6d1c2cc47da85", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-request.md": "90a1f329e859152d4ce8e157cbd6c56e6bcced16b4ed757822d2309514fa9a15", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build.md": "857470d97af6aeae4e7d7942c2a1d8455bfcda74ff68b8e1dc4ba8d066521fa4", + "docs/plans/reviews/2026-09-06_foundation-inspector-build-admission-findings.md": "8d9f7aab3b3bdf79345a07ba3595b966982b7667714ac7e3f669d65e328ca3d5", + "docs/plans/reviews/2026-09-06_foundation-inspector-code-review-gates.md": "6e7980186b2f49dec93d300f3681afd397ec7349c90806759a995695d9077b24", + "docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-addendum.md": "afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5", + "docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-verdict.md": "03c979b77cc6b03b6685ba51ed1ce24c3f1d7b274ce8f772263a103670050da7", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r2.md": "0dabd82fffdc3a56ebf9a1d8b851832c3acee2cb9332892bde9dbb13151d5e19", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r2.json": "2e8b5f1998a3be6cc7fcc3fba308724d2a29ca166c08f005e1bca88ddbc14196", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r3.md": "ec0444c94c9caf16472fdba1ff3fbc767dffd1a798b9a2da837598c9f4b25508", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r3.json": "3c2253b6c9f31e448c77aaac53977d41baecfb30e15845dcfffd8dc694428547", + "docs/plans/reviews/2026-09-06_foundation-inspector-code-verdict.md": "e4cc5970aab20240e6ea3a9a1513ef942ff167fefbb03356b9a32c89999adb3d", + "docs/plans/reviews/2026-09-07_foundation-inspector-corrections-request.md": "35c237f5c001832a0cfed23b03ff7530ffa78443612ffe11130fe456b968bd61" + }, + "counts": { + "source": 6, + "tests": 5, + "fixtures-demo": 20, + "fixtures-bundles": 277, + "fixtures-raw": 19, + "fixtures-meta": 3, + "suite": 1, + "total": 331 + }, + "aggregates": [ + { + "prefix": "scripts/foundation/fixtures/", + "files": 319, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "5432f7252b7d711062e98b8eefe373bc44985891513ad0cbf20417d2f5e9d2c2" + }, + { + "prefix": "scripts/foundation/fixtures/bundles/", + "files": 277, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "1291e9db83afa649efb1242b18b9eabeccd0eaf9d8af5e4a8f336bc54454287d" + }, + { + "prefix": "scripts/foundation/fixtures/raw/", + "files": 19, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "dbc620a7247aef198a3f502002d73fa8d598a5fc939f4bdb5352467fa50360d3" + }, + { + "prefix": "scripts/foundation/fixtures/demo/", + "files": 20, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "6a32862b8985e39a339a504338b3fb94558890152e04b64c155ebdc77e7a8956" + }, + { + "prefix": "scripts/foundation/", + "files": 329, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "e1286fcd077d86239dc269d54421ba75a54efa0b427e423650295fdfc9975eaa" + }, + { + "prefix": "scripts/", + "files": 331, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "f3364df1d3b9b706bfc637b13ddf3d0f59824d5d445defce6c1741e61c5cd29f" + } + ], + "files": { + "source": [ + { + "path": "scripts/foundation-inspect.mjs", + "mode": "0o644", + "size": 8597, + "sha256": "dad369490ca8396d3b4a7bd4a1b7fa87b677a2b8cf991bf61672d446e5aa3c93" + }, + { + "path": "scripts/foundation/canonical.mjs", + "mode": "0o644", + "size": 2936, + "sha256": "a7760882c4c49992b9d702eb125a3e8f63048be543516b0eba61231018b90172" + }, + { + "path": "scripts/foundation/resolve.mjs", + "mode": "0o644", + "size": 84403, + "sha256": "777dd415021a54a3c4b43097b830144ed6810b34ca525b28bc9badd4692c28c1" + }, + { + "path": "scripts/foundation/strict-json.mjs", + "mode": "0o644", + "size": 10437, + "sha256": "7c31fe6be8cd29ee07662a21bb2e490a2ec799e263dec981ee257fcf7e6f6ebf" + }, + { + "path": "scripts/foundation/validate-record.mjs", + "mode": "0o644", + "size": 3040, + "sha256": "dcff28b53501b68fe7368adcbf02db0526ab4273d1c1c42e47df9a78a0bd9b4b" + }, + { + "path": "scripts/foundation/verify-schema.py", + "mode": "0o644", + "size": 28331, + "sha256": "e5fce462abd0e8c5be4e4543fd31146a35aba41a653d2aa105c28ca5a20deb67" + } + ], + "tests": [ + { + "path": "scripts/foundation/canonical.test.mjs", + "mode": "0o644", + "size": 4197, + "sha256": "f504321983b2c41eff5af7e6dc27e40e360e0aae299d0a9abc369c743f5384f7" + }, + { + "path": "scripts/foundation/cli.test.mjs", + "mode": "0o644", + "size": 14666, + "sha256": "566abb49770b5d23ea74da663a0c64e37b078d1a793acd313e56e8612fbf05c8" + }, + { + "path": "scripts/foundation/fixtures.test.mjs", + "mode": "0o644", + "size": 5421, + "sha256": "94e7508717efcafd11585a288a5d791e1e48a993794e2d470c6097f904befdb3" + }, + { + "path": "scripts/foundation/resolve.test.mjs", + "mode": "0o644", + "size": 34462, + "sha256": "cab963cd7b80957d727d654585c7b1b657802d967fb4ac94c653acc55084e896" + }, + { + "path": "scripts/foundation/strict-json.test.mjs", + "mode": "0o644", + "size": 6837, + "sha256": "b40488edfc4eba6962e8c0949ddf1f92fdc15d630b7e9bdff72ac6d06bdb092e" + } + ], + "fixtures-demo": [ + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.json", + "mode": "0o644", + "size": 731, + "sha256": "c44b0935ed329c1a381f986997b1bc4be702fc4229166d8a0b49e4e80f9b2fa8" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.txt", + "mode": "0o644", + "size": 393, + "sha256": "c2fd118d44d21cbd709d30a2c2be2603740a81e628aa9d32f95d6eaf06d3a9a6" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.json", + "mode": "0o644", + "size": 48279, + "sha256": "ff7b859cd959876b2b6ede97fff90383a38acde765a16294b095ba220290c579" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.json", + "mode": "0o644", + "size": 1082, + "sha256": "ecf8313993ca27450d1753c6178be1a063fb0637f14be8f091de923b8b722516" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.txt", + "mode": "0o644", + "size": 536, + "sha256": "0e2807ab56d15670c51c8ad4a43f33b36c5672799937561f39e20c6e93be1dda" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.json", + "mode": "0o644", + "size": 50119, + "sha256": "54aad9047f7fe86892889ead543403c42986f591722d0dd23e0e027c3b7191d5" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.json", + "mode": "0o644", + "size": 767, + "sha256": "7ea412916404ec948c94e929cc7b2ce120b394944c66c7bfcc811d0721dd82db" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.txt", + "mode": "0o644", + "size": 390, + "sha256": "2cdd6d4e162fa904b03e8f8a88553a03065ac7fb646baabf21625d4f5962a79b" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.json", + "mode": "0o644", + "size": 47060, + "sha256": "7c0948d39abd3f1eeb0b0990766cbf584959712000faacaf47ae0d3501def3cc" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.json", + "mode": "0o644", + "size": 706, + "sha256": "42055bda71075ba5c710f011f83d470228f18097d93ac5585ba1b534cba0ef2a" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.txt", + "mode": "0o644", + "size": 370, + "sha256": "8ba4bbe92819ac8912c72e7c635730e99eac7916c0d924fc81b75115b5939b53" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.json", + "mode": "0o644", + "size": 46999, + "sha256": "7a3cfc58c1356cc2a986e0a6ed8f9f2dffbc33277ea1b7800020bfc55624b750" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.json", + "mode": "0o644", + "size": 1060, + "sha256": "742e479ddbb4cf2138d49ec0ac40cd038b6c20f8b9c0e2daffc5a859db9f4145" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.txt", + "mode": "0o644", + "size": 514, + "sha256": "388983ad6e4e31db6f5a688773ff2bf07d44d7ffe530eb7870e729a0f546278d" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.json", + "mode": "0o644", + "size": 49975, + "sha256": "f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab" + } + ], + "fixtures-bundles": [ + { + "path": "scripts/foundation/fixtures/bundles/adm-agent-disabled.json", + "mode": "0o644", + "size": 47000, + "sha256": "cb92e2f7c19b8d8133389f62393228c8d5471f1c21ee46166392ce7dd31a9c32" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-agent-policy-missing.json", + "mode": "0o644", + "size": 45528, + "sha256": "ace29f2529cc16edf21ccd828cb371febf1690c6c55fb9db6e129e7c19057799" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-artifact-undeclared.json", + "mode": "0o644", + "size": 46843, + "sha256": "50ddfbd0e192521c0bc146268d00b9a28fb32d28ec2c9cc7e519677f16387bfa" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assigned-task-without-work-read-read-op.json", + "mode": "0o644", + "size": 46859, + "sha256": "9f5aaa486ae3de752803cf58441f0dbc90480ac002225a6cdee043516155396f" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assigned-task-without-work-read.json", + "mode": "0o644", + "size": 46863, + "sha256": "35ee45e648387b9a8b0aa81b201b4eff61eb5a15bdc6eea30ecbfacecae77bd9" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-ended.json", + "mode": "0o644", + "size": 47003, + "sha256": "45e10ae6b5fc71617db1303155cac53e26854bf00524a45756cfcec066e9ae6e" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-other-subject.json", + "mode": "0o644", + "size": 47001, + "sha256": "3c9abc1bb5be9649de7c9c82bf50766ab533e35f715cc8658a5b256dd68d032a" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-rejected.json", + "mode": "0o644", + "size": 46999, + "sha256": "13127e14aa12c3d1b4ab7864bb2b1495c271aaf11c6d952105cb1f0a01c79181" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-stale.json", + "mode": "0o644", + "size": 48755, + "sha256": "297d062015d3fec28a8bdb1415106be963dd70ad7b367f00e2623ebfca7e0985" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-other-agent.json", + "mode": "0o644", + "size": 46999, + "sha256": "0f3f15457115e8ecc5f629b6d818f42491f0e484a01eaa981f053c71143e8c46" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-other-workspace.json", + "mode": "0o644", + "size": 46999, + "sha256": "c1a0021541ebc6c27a9f9b9ba9d0c4f062366a92bc52733384ea483b9a93b007" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-paused.json", + "mode": "0o644", + "size": 46997, + "sha256": "956fd1008a5161007bf74eb5eabd7dbcb23fd05236fac7122cf8d1733d18020b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-required-for-change.json", + "mode": "0o644", + "size": 46868, + "sha256": "d58b71364fa5d900fad552817f3e5ca87f8c2330972ea8fae40c817b31bb6eb3" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-stale.json", + "mode": "0o644", + "size": 48276, + "sha256": "ee369230403bc139e32e15eb121f623975c657bde5801adc2608bf704aca9b50" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-authorization-undeclared.json", + "mode": "0o644", + "size": 46999, + "sha256": "1bfc562d60c31c7dddaa43e0976861b30b64a67b69d338ec307c0936e597da74" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-consulted-work-not-readable.json", + "mode": "0o644", + "size": 47442, + "sha256": "e6f6edb8de4fa83895e854be796e7321c1c195c4431f6e3a56c11bdc804f38a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-cross-project-dependency.json", + "mode": "0o644", + "size": 47247, + "sha256": "e30e939819f7b2e05fd42efd02a22d8752e9cdb0fba82ed45d1b8bc93f128324" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-cross-workspace-mission.json", + "mode": "0o644", + "size": 46999, + "sha256": "88bca4ecf7f2cae37d92e0c6656b51c812a0df4546a44eeceb4494331afd63ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-authorization-undeclared.json", + "mode": "0o644", + "size": 46999, + "sha256": "931e62561be2a6391d31fe3dc262367241d07e87ecc3a9f013fd7952a4949fd4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-grants-nothing.json", + "mode": "0o644", + "size": 48729, + "sha256": "39c227de39c473f631ff94b56bcbd5b113de9364f9bddd3488ac3926eaec66a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-not-accepted-change.json", + "mode": "0o644", + "size": 47051, + "sha256": "bb9bcc18a733912ede338804219dd3316ff8240e0206de2d182051394721dc2d" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-stale.json", + "mode": "0o644", + "size": 48209, + "sha256": "b46f5667dfa0b652e9afe35b7895affeeea309a4c66635b3c66b6bb10a104f55" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-authorization-undeclared.json", + "mode": "0o644", + "size": 46999, + "sha256": "1c8adc38492eb91fe2928690354ed27a7d6b1fc0d411de9d3e0f9180b5b1c5b8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-blocked.json", + "mode": "0o644", + "size": 47000, + "sha256": "6fd722efaacb595940505ff3a0422ed0dcb4121460d1e1ead9d82ad9f1d2c400" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-stale.json", + "mode": "0o644", + "size": 48106, + "sha256": "034e7d5e51b02b19fb44db4840a7dfe31934fa100d227e96bae9b8522d7b0b17" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-agent-policy.json", + "mode": "0o644", + "size": 47055, + "sha256": "87f23f0296c0a2b309f35daca97a88630e391de09b1e3f19e6ec4710bb50473b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-execution.json", + "mode": "0o644", + "size": 47442, + "sha256": "d1921054dc83fc9c4b999cf12914b4eac51c814264bd96a370c80af7ace3d134" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-role.json", + "mode": "0o644", + "size": 47053, + "sha256": "41429de9ab146264b5b887ec8ee303cb373b13fdcc892d2ab8dd17b95b8babaa" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-parent-mission-accepted.json", + "mode": "0o644", + "size": 47001, + "sha256": "76b4fa2904c8bc4400b7a7b4ad92a9b5d0d0ddfd6645d18dd613b8a45b1bebd4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-parent-mission-stale.json", + "mode": "0o644", + "size": 47863, + "sha256": "8f85116b9278024d257bcda57a4ce0e0526744e9a73df53f0106de0d29a87062" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-prefix-string.json", + "mode": "0o644", + "size": 47057, + "sha256": "303379a7fd5315ffa38929af357e38447e4d5419c61ab4602dab42b79a63cc9b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-read-execution.json", + "mode": "0o644", + "size": 47351, + "sha256": "0d31922e61a2a433377dd398cae230f638b694a91e6a36795caad33d197d2112" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-task-narrows.json", + "mode": "0o644", + "size": 47502, + "sha256": "623ee44ebe8edb0943bb98b89a0ece148965fce669bd12202ff61bfa05068e61" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-write-outside.json", + "mode": "0o644", + "size": 47057, + "sha256": "fb40436ff51935c811e044a2fb01c6b160d88f48dfb4488368702314ae2fe087" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-policy-ceiling-stale.json", + "mode": "0o644", + "size": 47546, + "sha256": "7d0dd0314b7cdaa73031e069e6db0ba32f219b5b5b1e57ca231602e46c7c99d0" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-policy-missing.json", + "mode": "0o644", + "size": 47001, + "sha256": "01915e487576036117d92eeaeabfd8bcde56501cfe7c26e8dee5033fa747afa8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-registration-missing.json", + "mode": "0o644", + "size": 45959, + "sha256": "9fe8fc27cc6c83e2e85fbe449a6c74ca78a6c6f8101c60f7a37a6e01c2166086" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-retired.json", + "mode": "0o644", + "size": 47000, + "sha256": "b945bf5863105512d2ed75427eeb94037c0a66a52e77bccb4b1dbc2ecbc5f91f" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-ambiguous.json", + "mode": "0o644", + "size": 48077, + "sha256": "cd7322b10c7bda7ef5dccd2c0df7c472412ba35aaa0beb25de8a7b399f99ef8e" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-parent-not-current.json", + "mode": "0o644", + "size": 47863, + "sha256": "8283f6bd81ac0bb2d11fc46c0ee759e85ae87c4dc5f54a22ccafa41559faaa98" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-parent-stale.json", + "mode": "0o644", + "size": 48026, + "sha256": "e9dae21b733ab51636b8421fbbf41adb74aba250b4319ba8097d2aeff7b5c7ca" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-revoked.json", + "mode": "0o644", + "size": 48279, + "sha256": "ff7b859cd959876b2b6ede97fff90383a38acde765a16294b095ba220290c579" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-digest-mismatch.json", + "mode": "0o644", + "size": 46999, + "sha256": "51d0c87a91037a04b0a03ad5d817855d6b866b4dd63c0b378abaf98941e24fed" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-endpoint-declared.json", + "mode": "0o644", + "size": 47703, + "sha256": "37f537ffbca59aecd79c67b2ae72ac8fc7edd12e0205eab89be52af87144c1a0" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-agent-refs.json", + "mode": "0o644", + "size": 46470, + "sha256": "e39a153882ea7461381424424befbfc95e9c60bfb32094823126b45042efe9f1" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-endpoint-execution.json", + "mode": "0o644", + "size": 47529, + "sha256": "46c2ba7715c6ab54665a50b9f46d96af2fa65fa1e42f52798b40523cd2da5ef9" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-endpoint-task.json", + "mode": "0o644", + "size": 47554, + "sha256": "16e43339ec7135e4af64706c0cb49cf7e9bf6c7b3e5b77ad3cd406be3fc4606b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-instruction.json", + "mode": "0o644", + "size": 47227, + "sha256": "f2c60d88af3cc75daf41b2dd5dc5612b21d77876cabda28940f50fbaf85d5f00" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-settings.json", + "mode": "0o644", + "size": 46822, + "sha256": "c01760a2beb23fcb01cec99a4c95bf1398580e0c465ac1742721105ea0524058" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-skill.json", + "mode": "0o644", + "size": 47227, + "sha256": "7bf73e0154f78b1cdbb206e56745d2307a8cdebdcabfcd13426e6c3d6ee5e2c5" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-soul.json", + "mode": "0o644", + "size": 46818, + "sha256": "dbfa43f96b4b6a0cf74dcf6389b030b58bcdfeda876d9e439e0d17a35e5c65fb" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-revision-mismatch.json", + "mode": "0o644", + "size": 46999, + "sha256": "6b6de37b0fc56e455015b054e8c5774cd6691445a1212189065a91cde0ede1e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-unselected-agent-ignored.json", + "mode": "0o644", + "size": 46999, + "sha256": "db44fa0b4d1f2fa2fe2bc3f144d78d729decbaf335dbbff0f2015e8118042c60" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-scope-role-missing.json", + "mode": "0o644", + "size": 46321, + "sha256": "49dcd13d523295c852fe5327b1227ac40b0d1503c836ff9b236800e4abbee5bc" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-agent-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "c2bde4733d09f154ff913dad96bdad19b0ab01e6fcf7bf8b565b409ca86f103a" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-project-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "59340a02bf4759a88bd89d65790e8cd7108d7e6516a4b737c1f07f362f86f4a4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-workspace-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "aef0bfbb5e5605b48e9e2ecc7a358ea9cb0209f2687703a1b2f1701fd809c7ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-intent-not-plan.json", + "mode": "0o644", + "size": 47003, + "sha256": "d5a260a2ad091b9ff23aa3abb0ab59b9712467601e49b1e18f2aadad26082288" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-intent-stale.json", + "mode": "0o644", + "size": 48755, + "sha256": "5323e36a3123fe5cf995de10e5fba493f5935fbf3f7dfde7c95a56a9bae94801" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-proposed.json", + "mode": "0o644", + "size": 47001, + "sha256": "9201feda75c3c5069748c5f85ec065beb173884e4e5146045de01577ec2aeb61" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-ref-stale.json", + "mode": "0o644", + "size": 48667, + "sha256": "5f59548d4ae2363277aa1ac15a1b8bfa29fa89bd3547c741138b1e34531ac8e3" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-unconsulted-authorization-ignored.json", + "mode": "0o644", + "size": 46999, + "sha256": "b44818b153c93e9ad7719b74d962f38ca3bf2e68adbae0a4af0c9407c09ced85" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-policy-missing.json", + "mode": "0o644", + "size": 47001, + "sha256": "a0810fc2d9e8103e8c6065d977e729d7aad3cd8ee22851ab9486b93912ccbb80" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-registration-missing.json", + "mode": "0o644", + "size": 45740, + "sha256": "635dfad244da0d1da7cc3c12dc6a6b5983cf16526af12f6c104d96efed81377c" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-retiring.json", + "mode": "0o644", + "size": 47001, + "sha256": "6c229ce8d707d8221541362a93c36a7d32f46f8032cdc298d759aeefb9616e7a" + }, + { + "path": "scripts/foundation/fixtures/bundles/assigned-task-only-with-work-read.json", + "mode": "0o644", + "size": 46886, + "sha256": "3c7be7502592647259c5dd2e7c6675cb979ba0010aa103c47a0a11f0c18ce255" + }, + { + "path": "scripts/foundation/fixtures/bundles/continuity-revision-gap.json", + "mode": "0o644", + "size": 48201, + "sha256": "853129ae49f83ac334a45cd36e9ec4b2970f3fd5060794f0402f8459c9d814b1" + }, + { + "path": "scripts/foundation/fixtures/bundles/continuity-supersedes-other-identity.json", + "mode": "0o644", + "size": 48201, + "sha256": "475ff6eac6b455d305b9af1dbbdf15c09fe308240416dcee67890bba926ddb9b" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-acyclic-versioned-history-file-change.json", + "mode": "0o644", + "size": 54476, + "sha256": "e3dd1cd34e24c4d9ba0354203b7754c9e045966f0503d28ae1912e4e89eb2d15" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-acyclic-versioned-history.json", + "mode": "0o644", + "size": 54415, + "sha256": "05598f3c9fd10cb81d7c108eb343e42ecb8def4dc3e312367335e89265447de1" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-cross-revision.json", + "mode": "0o644", + "size": 54675, + "sha256": "3d85b8708f6b5b1f73c01bd5814e0d30184b966e9646391209bb632ec1ec3d76" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-pair.json", + "mode": "0o644", + "size": 47255, + "sha256": "e87ca56e0c3ae241dfe7d6c61e3841877a8bbe79b80fbbf9dc48f938a706feda" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-self.json", + "mode": "0o644", + "size": 46995, + "sha256": "419980fc700a4d4870a3aeef78948d1acae91aac62769f73bde3dae5051fb956" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-mission-parent-old-revision-only.json", + "mode": "0o644", + "size": 48141, + "sha256": "55f3e4b72234c9d1535db7fec65347f01c827125a65f50b1df614d9d80418925" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-mission-parent-previous-revision-not-a-cycle.json", + "mode": "0o644", + "size": 48141, + "sha256": "c7bea20df7a6d3c294c46ab9982e27540760cc7ef2b29944340c8f8feec26128" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-mission-self-parent.json", + "mode": "0o644", + "size": 47034, + "sha256": "90c872b66ed4a190bb29bf6c8c1c40dada8cc98211893393ea0519c399d13027" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-supersedes-self-rev2.json", + "mode": "0o644", + "size": 47195, + "sha256": "f717ef0f14db090af156a3f08a2f1268f55f5aa9418aafe7dbc5916d826465b5" + }, + { + "path": "scripts/foundation/fixtures/bundles/deleg-approved-file-read.json", + "mode": "0o644", + "size": 50277, + "sha256": "4d1564ad708acfac940fcbbeff548fad649dbc08c1bd3708c1af86f756f1800e" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-change-w1.json", + "mode": "0o644", + "size": 50119, + "sha256": "54aad9047f7fe86892889ead543403c42986f591722d0dd23e0e027c3b7191d5" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-file-change-src.json", + "mode": "0o644", + "size": 47060, + "sha256": "7c0948d39abd3f1eeb0b0990766cbf584959712000faacaf47ae0d3501def3cc" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-file-read-src.json", + "mode": "0o644", + "size": 47058, + "sha256": "0b987af8fa79f322db409b7071f65f2ddfdac782f726dcb88e12c32b61c0a526" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-read-w1.json", + "mode": "0o644", + "size": 46999, + "sha256": "7a3cfc58c1356cc2a986e0a6ed8f9f2dffbc33277ea1b7800020bfc55624b750" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-artifact-identity.json", + "mode": "0o644", + "size": 47155, + "sha256": "5a816c1cb4e902b5c8bf85cd18c6215c624cae83f7dac2cbbd97b1da9541bd85" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-authorization.json", + "mode": "0o644", + "size": 47043, + "sha256": "814dcc1d5097c42a2066eb7aa1560f24a2580ed4434ede20e8cf492d84ab0b44" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-delegation-input.json", + "mode": "0o644", + "size": 51563, + "sha256": "2a1ba16ae05c25c4d9d6960cb8641d29f5de322046400af6658cbbeff1b9186d" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-record-identity.json", + "mode": "0o644", + "size": 48471, + "sha256": "b0db30a49d17aed1e39c53a3d8c73b962b53f56816309c64b4cb93bbf376880f" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-registry-identity.json", + "mode": "0o644", + "size": 47677, + "sha256": "8b95dc95d744b86a93e20a2f9eab9c2192e7d077cc37c19424b008edde548bd8" + }, + { + "path": "scripts/foundation/fixtures/bundles/execution-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47362, + "sha256": "3fd7ac1c0d44810c9cb30cf9972d0330cef0379f4c0c394b517d9dcbdfbaf9d3" + }, + { + "path": "scripts/foundation/fixtures/bundles/file-read-with-unaccepted-dependency.json", + "mode": "0o644", + "size": 47056, + "sha256": "6ebd0dee9886ff5f2f81351a155d5c0b2e6e62beb6bd17dda0f740ce32d3f297" + }, + { + "path": "scripts/foundation/fixtures/bundles/mission-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47495, + "sha256": "6e4acb4436a03454e1e5913b649d75c4df33b24d2f1da1116a742405cf94a5c7" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-change-without-proposal.json", + "mode": "0o644", + "size": 47007, + "sha256": "79923ed22f0b10cae5539b94cf79350529733e322fb7075958fef10ca7d68967" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-file-read-without-target.json", + "mode": "0o644", + "size": 46999, + "sha256": "3c35d78bb7d9d5e7895f6b0f7ea6279bb87ac0ec88b8e516cd61b9c1acadeff7" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unknown-name.json", + "mode": "0o644", + "size": 47001, + "sha256": "185a49b6e9fa1e218cbcad79aba57542a9c6b08ee44a1c8562aaa3bfbb386ff2" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unsupported-catalog.json", + "mode": "0o644", + "size": 47005, + "sha256": "00b116393a818923d4c5be9bef3942339a9b6b2c3d429a02dcb4d4926ae2b74f" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unsupported-workspace-retire.json", + "mode": "0o644", + "size": 47006, + "sha256": "1041dda47094246bd07fc3a9ad68ec59d482a8d380f460cefb6ebdf5673dce6e" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-work-read-with-target.json", + "mode": "0o644", + "size": 47047, + "sha256": "5c7c93a1b232c208ab371891746aa57e6bfcabca89fdbd3e261ef72f233db17b" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-assignment-task-other-workspace.json", + "mode": "0o644", + "size": 46999, + "sha256": "fc5d7a1fb64247c378a9b105450dcc954d8bfb2bd35c43c4558d1ed0fb5dd3fb" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-owning-project-mismatch.json", + "mode": "0o644", + "size": 46964, + "sha256": "12ce91207b12ce3b0c7d9f8e1921095cfdab02832ed54c41f4ab5ff4a50ead69" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-parent-other-project.json", + "mode": "0o644", + "size": 46999, + "sha256": "2b59f55a278a3632079bf393949050daf281c44623849d8511f486966c8d3392" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-parent-workspace.json", + "mode": "0o644", + "size": 47034, + "sha256": "205c6b725eb19a2a795d8f4b4bc64c762a92a770f170cb07fb7cf42669d8886e" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-project-id-scope.json", + "mode": "0o644", + "size": 46999, + "sha256": "e3747cde436b485f4b7b0137313a5919a710ef86dd47681baaab487f85950c5e" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-registration-parent-other-agent.json", + "mode": "0o644", + "size": 46999, + "sha256": "a5f871898dc8c0d5b8ce67de17de588176c69140cbcf41e615bd2f58d350a90a" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-registration-parent-other-project.json", + "mode": "0o644", + "size": 46999, + "sha256": "9074b8298e25c5715235476caf66363ec7c721e953deb2dd7835ade6bcf29ea6" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-workspace-id-scope.json", + "mode": "0o644", + "size": 46999, + "sha256": "7de9e947dbd89bc703cd864ac3840e8b938f59a750c5d51ba9d6bf63854fa49c" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-workspace-project-missing.json", + "mode": "0o644", + "size": 45553, + "sha256": "3f38f7154d9cb72d1fe27321899953f6a16fee4c95aa2d253d82807b8ad75e6f" + }, + { + "path": "scripts/foundation/fixtures/bundles/p2-inventory-unselected.json", + "mode": "0o644", + "size": 47000, + "sha256": "46b56f9e999441451b722ac1f826df24c349fad606c29224e7fed4453f078be5" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-artifact-digest-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "4a2ebbff331d103c82ded30ef6648bd7b21c7893a2ecd3b54000e6531f3a23ef" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-artifact-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ccaa0b7b543168cdf647fbc638f7f04cc8a722d74dd59ea56c518337f3c27362" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-artifact-run-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "3d7d4fce68e440044862466a91811c4f1d8d42746f041abf69fe8e010c7b5940" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-authorization-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "bb20c0c27a9f2e7c1aa8a551e6a4aab0817ca992e5e59965e2e26232aff5ba00" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-delegation-input-decision-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 50223, + "sha256": "f06e95047a396b4e076651780d034391b7b67036d5d464d40c80fc1f6a795dab" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-cr.json", + "mode": "0o644", + "size": 47001, + "sha256": "30dcfc1ac5bec6983bc611240d67128374f5c27a49aa346740dd169fc95233d4" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-crlf.json", + "mode": "0o644", + "size": 47003, + "sha256": "c41d28c9ac000ee612562f99b02ad353b4e504c9fc95eb5a58d9a7ad21ed9d80" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-interior-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "91399148e681674f46351ecc5d5612f816f4dfcca5f41c881ea20d8168779071" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "128e1dde7dd30dcbc4b2a628ed708afcaa3dbd317f0b56f941a1c815af2be901" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-two-final-lf.json", + "mode": "0o644", + "size": 47003, + "sha256": "f9e155deaf0fe356470fd284e115ad27fb7e9fdc12d0daaf6da025505309de78" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-u2028.json", + "mode": "0o644", + "size": 47002, + "sha256": "ce2f0c27ccad7ccf422656fb5f3d7c1a597280bef78f977dc1118a672742b9db" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-u2029.json", + "mode": "0o644", + "size": 47002, + "sha256": "4b040b44d1f39d124b67b5c456979188bf8bf38e36b38f839f82be01287084fa" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-escaped-newline-free-text-allowed.json", + "mode": "0o644", + "size": 47008, + "sha256": "d53f005a9283b35c48e7093c7c84959e67d0b9d7703240451d61fece9d4a59fe" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-cr.json", + "mode": "0o644", + "size": 47001, + "sha256": "e5c13868b71b409f6dfe0cbf66ee6a847d58077fee210a1a0009484ccfd34c3a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-crlf.json", + "mode": "0o644", + "size": 47003, + "sha256": "cef6102987f8de847b8c7ee1a23aa5e72403b1fbb6d11189cdacb2cdb463957f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-interior-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "a4cb7e74b3ad77a000de77b43dd172d8a68f0e16abf1abc07d972b35fd9076e7" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "eede0a44305cc40aa15c5181105fce7c695ae7381696deb022d7dc64bdb8f8c8" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-two-final-lf.json", + "mode": "0o644", + "size": 47003, + "sha256": "42986229494c4d80104293639927b9e8bf15d5fea94abb6c684492f8d2c7471a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-u2028.json", + "mode": "0o644", + "size": 47002, + "sha256": "50da9b3aefe6163cc3f53dce63fd37a5a742501b31f0fed6d466b23653265ed1" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-u2029.json", + "mode": "0o644", + "size": 47002, + "sha256": "4e1adcaa3665bba405508e448cdfc6b6e42f0fb255309d0261a22af08362983b" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-path-one-final-lf.json", + "mode": "0o644", + "size": 47060, + "sha256": "11aa009e6435ec07cf2fc218d7b23e9fb7ec5e2a42627fedeb54f8ac9cd24dbb" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-proposal-requester-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 50121, + "sha256": "bc2c862ee7d033551a261502d33ea309c0e54a0b13027c0f0477cce4144fa70a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-proposal-requester-context-assignment-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 50121, + "sha256": "47bd3833eaa5b240a0bf974958a7b0dfe9f69541a4921a0df4aaa6288a3d093f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-proposal-target-task-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 50121, + "sha256": "5f0ee53fabe59d51355f19d7b4f6cfd8115e708b857bafc296d54bed0e07c33c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-actor-execution-id-one-final-lf.json", + "mode": "0o644", + "size": 47037, + "sha256": "c95c2002cd0e345ea5589fce6a2688780bd523b76bd406439fcb906c463e621c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-actor-principal-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "a5fad7a69c136738bf74042c96ff1bd2f176b1bf768ff45cea0d9d7245021d9d" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-agent-type-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ab5174ec3f9136fc0290bd15743db5c89414f33938d731fa74882b49ae7d5edf" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-assignment-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "b36bb80f4607cb173012ff4c462d0ebbdfbd0be2ce07594796fbb89117a20cec" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-criterion-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "6defe71fd655947c23cdaa7e0eede5befe8aa92b06cb5762e0fa3d373ab3ae3c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-decision-subject-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "c71ce20d13abdc757fff44643ce2e9d58049f3f25fddb761519cf5ec9e46d1e1" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-dependency-ref-id-dangling-one-final-lf.json", + "mode": "0o644", + "size": 46999, + "sha256": "c61d5e84fa5dd4f16232fb71fcedd0d2cb535f40e3d4d1a15c0f5c3246348a7f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-file-root-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "a11a5f59429bda53240f0bc00c98b327d6555b2039ca7f7fb06e4982af8d0187" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-registration-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "17367fb547e62e68be267330eb98e04dd4fe2febb3faea461984901a5e7dee46" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-registry-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "e5853ec5455477ce99b82eea55a4faa42b40126434c28de1000b13406f2d94cb" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-scope-project-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "537f70c753dc214a66087a1ccc10825df2312c28355bbc1a4fbf1a06cffa56d5" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-scope-workspace-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "feddd255c7abdcbac1369b63df555627576e5c9bb70535a2fc1d78966acded2a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-supersedes-id-one-final-lf.json", + "mode": "0o644", + "size": 48203, + "sha256": "69ee9f06c06d673334e55bc5356c094b88078f2f45a676d338f8e6afb4aa0119" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-registry-digest-content-bearing-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "8123d8856307c79838b9e67c5176bf6dcfd650555429646452e7a5edd29fbef8" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-registry-digest-plain-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "797beab4cecc709ca1010d88472819080369775a074e0db94cd4744891c51a3c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-registry-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "c068396afaeac858d93b114ee314a331abeee7197e81d30716353ae4c1d91bd3" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-cr.json", + "mode": "0o644", + "size": 47001, + "sha256": "51c38ea4f0d088869f96a44566c6fb83e3cfb98f9c27ca67f2555f6359345390" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-crlf.json", + "mode": "0o644", + "size": 47003, + "sha256": "28a2723cdc46e87b2407e6fd2fe944cf78a67739d9c88a2ef42a7e06386a1afb" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-interior-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "97cf8d143f7309717250c86784638ee69c6dda16c3ec609119c4abc4f7800404" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "64f7323e9bd799ff1f0e997aa4c33baffb677853921b71990fc0baeac94acc59" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-two-final-lf.json", + "mode": "0o644", + "size": 47003, + "sha256": "1cecf2c29720b272c7f1822abb7a037a66cd209fcd6af5f7c1248d8368e163b7" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-u2028.json", + "mode": "0o644", + "size": 47002, + "sha256": "935dfe037f4bf48085bb8ef86d1f5ac1287f2c4ba5eab789913216f2af4840b5" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-u2029.json", + "mode": "0o644", + "size": 47002, + "sha256": "641b359f8bb90db0f4dfea964d8d46acf408b29ee37a6cf8ced04b975e60fa58" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "1aa1b1dd878798fb5f8201861bee7f4ee2de39cd21f91f75c168f0224c2e6ea2" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-assignment-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "f07fe150fc578fe9fad603f96ed51e7969aee20e970f5abad4fd1ee49ab94692" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-assignment-ref-scope-workspace-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ecdb566ec563416d08647279b2be7b5f0368866b99057d52dfd952e5922a5500" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-project-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "233062e341b71e65c7b900b1da1f93b1a7cb9d6ea603919584e339246233234f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-workspace-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ab430903ebe13af3a8ec1bd57f925196bac1aac38b8f6f2ec4058f42fd110f0e" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-time-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "22776f383b20d2620dcc2731c1f7b5bbf4c2556c50cd04e2ffcb1b8bddad853d" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-unselected-record-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "c22ce5dec672c5ad5fe8e1cdd6b901b98d8ae7134ebe2c4865387aeb8d7cfd0d" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-unselected-record-scope-project-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "559c7d55bc1a88ac918922cfb7d0f0daf285c08cb6c68d27728dbe024a9ccf93" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-all-pass-restricted-contexts.json", + "mode": "0o644", + "size": 51185, + "sha256": "ccf22e319ada775b014be68687a4d54da2234b2c6e01b3507319012ad7b2b5b1" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-not-recorded.json", + "mode": "0o644", + "size": 49934, + "sha256": "abe2511b7006e56a91b4d40213075aacac2e08dbdba35a7b2e69c07c345cf68c" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-rejected.json", + "mode": "0o644", + "size": 50119, + "sha256": "b4a19d16a0a6d07e071663db371d77073a615319d1a1b4862a1aa7935a4cb251" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-stale.json", + "mode": "0o644", + "size": 51883, + "sha256": "e52970ec3675eda0bdff8742b453c109e848eeea9e2c6b9c1ad6db3a227a7ce0" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-subjects-mismatch.json", + "mode": "0o644", + "size": 49871, + "sha256": "6d726823ea3181892717f6bdd0cfc03ca6ed68c52d27874208e595a001c1b348" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-wrong-kind.json", + "mode": "0o644", + "size": 50118, + "sha256": "cc810af17db5661a2c2446e26da390b008f66a0a25c7513108ec0c21cc8e4807" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-artifact-undeclared.json", + "mode": "0o644", + "size": 50119, + "sha256": "33a7c5c4d7927f1875ed21931807b83700068b289256607a075881c2b45017bf" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-exceeds-issuer-ceiling.json", + "mode": "0o644", + "size": 49375, + "sha256": "dade48f2e5147037ae009e42acb1de4fe56fc2b53711de0fd0dc65ce6a4df0af" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-input-missing.json", + "mode": "0o644", + "size": 48673, + "sha256": "25c0a2fd08a2270dd8609abd709a0e8d5df96923e521ef0c9c6b9414b0eb6626" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-missing-after-requester-admission.json", + "mode": "0o644", + "size": 50266, + "sha256": "dba8f8890641aa54a24dc14f898c973ae73a364302fe59267e8eb9c3a418ddae" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-missing.json", + "mode": "0o644", + "size": 49935, + "sha256": "d76b138aac1f6138c6c4d5a3a057e20ea7dcc0488b625e037e6a97297527abc7" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-other-recipient.json", + "mode": "0o644", + "size": 50119, + "sha256": "79a6ce60aca3376e5ba3123a6a9f7515ef70ea6d3479261443bf02dc8518b8b9" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-other-subject.json", + "mode": "0o644", + "size": 50119, + "sha256": "2f83da99d4a915d0fb97e9198c082604821f0fd45c239d82075fee88b852dd02" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-rejected.json", + "mode": "0o644", + "size": 50080, + "sha256": "d5cbc12c8697f707f7538ae2d17777d159d5b646268e283ead10c355e10cc3b8" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-stale.json", + "mode": "0o644", + "size": 51854, + "sha256": "0e8815068566524de3f07221ada8c14b3224193cef9b50d4ebd4a34ce84cef8c" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-wrong-operation.json", + "mode": "0o644", + "size": 50111, + "sha256": "3f00f24d96c061e5a266a534119717facdeed620aef5577f7a119e00963df12e" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-subject-intent-stale.json", + "mode": "0o644", + "size": 51875, + "sha256": "05e3b3696194ad9d64b0c8279914ffa3543eab36e5203e4847ff6682836b6187" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-subject-paused.json", + "mode": "0o644", + "size": 50117, + "sha256": "28fe6c19dab8365ed95a15f09faefa3d85c1310e7ed5d50446e1938cb12d23cd" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-target-task-blocked.json", + "mode": "0o644", + "size": 50121, + "sha256": "2c0f02ea2130c90ee2e46d8c008f900da6a65e1f1a448b96c976873fcf4ab84b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-target-task-intent-rejected.json", + "mode": "0o644", + "size": 50119, + "sha256": "bd53add1593ca3ae27673256f814d5a8c1cbb34ffa1ba31ad06687126156d916" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-issuer-denies-work-read-task-only.json", + "mode": "0o644", + "size": 48647, + "sha256": "3f4fc74d678bd91b9023bc0661094c6edc9dd26572d3e6422dbb20c9d4da6081" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-issuer-denies-work-read.json", + "mode": "0o644", + "size": 49335, + "sha256": "34d1ed805d3d42098052be2b928404947bd2d3b7b4c1af0edd3ec344aaec88f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-issuer-grants-work-read.json", + "mode": "0o644", + "size": 49358, + "sha256": "aad1654ac0947ce2db7838872e5088792e583bfb3c24eaa750aa01a7122792fb" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-after-structural-failure.json", + "mode": "0o644", + "size": 49975, + "sha256": "3c86d9e9747f91388c16ae3ba17f2bab9d3a9a098e133921d5b3971a4a411669" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-is-not-authority.json", + "mode": "0o644", + "size": 49975, + "sha256": "f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-precedes-requester-admission.json", + "mode": "0o644", + "size": 50306, + "sha256": "1c9f7142646ed4e39daa5e96cab46d57a03aadd0b3f61d21b6a1179dbe906a3d" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-precedes-stale-subject.json", + "mode": "0o644", + "size": 51252, + "sha256": "3c008be9a1f35c5f976014e90afd591c82e0923775f291a0e683dfbd8b105152" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-context-no-work-read.json", + "mode": "0o644", + "size": 50596, + "sha256": "1fd82546b0e78663afd29d2fbbb2151dea8b4477d5d2085b6ca185a3cd45a536" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-assignment-paused.json", + "mode": "0o644", + "size": 50117, + "sha256": "97e1353813efa41e5f7afdca86ee71f878e1e5bb9de300f36532aa49016cdf84" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-lacks-change.json", + "mode": "0o644", + "size": 50118, + "sha256": "0a58eacc571a255ef355573e26a7c1d69aafe8435c0a779c667577874f0a7d89" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-registration-revoked.json", + "mode": "0o644", + "size": 51400, + "sha256": "e8f336a3ba50d1d17d8330c871ab80cc0823ca612f15359371c28737534099e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-agent-missing.json", + "mode": "0o644", + "size": 50119, + "sha256": "b5a9258c22c41aaf440add5cc4f030365942adba5c1f7b48c33f55698af90f75" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-context-wrong-agent.json", + "mode": "0o644", + "size": 50119, + "sha256": "2bf77e5d80aa3c7cd5c8a9c9d5632f841dddeff0b3b42325a8a938cb2e318f39" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-context-wrong-scope.json", + "mode": "0o644", + "size": 50119, + "sha256": "432d503f0e105d7aa3bc71547d7e88f621870a54a8837b73ae6941daf5d279cd" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-selection-agent-mismatch.json", + "mode": "0o644", + "size": 50119, + "sha256": "ae7138b549b3e1b0a212d4a859294c4492755b6e108777d4b42a35e44f01c46b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-selection-null-assignment.json", + "mode": "0o644", + "size": 49934, + "sha256": "f06fe01ffa553af1473a87497c8192ef2d786cc2031e33ff8e3c7a42852c4267" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-assignment-stale.json", + "mode": "0o644", + "size": 51396, + "sha256": "90ac6747e11416ba52fc6c3ea57d735ee2d2993e8720a81955fdc73ddd3197dc" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-not-selected-assignment.json", + "mode": "0o644", + "size": 50119, + "sha256": "6eddffc4fa618dfe25c758cf2165a47c30b6a5cb9daa63685c6896fc501f57a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-task-authorization-undeclared.json", + "mode": "0o644", + "size": 50119, + "sha256": "0cf96ef8fa1801828b709818947c2f6d771ee61a39232bfab60b4768f56f509b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-cross-project-context.json", + "mode": "0o644", + "size": 51449, + "sha256": "61b7a1f1c2f8f4e576c40a424df4b29136577b4aa0f6519bda789b8ae026969f" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-cross-project-task.json", + "mode": "0o644", + "size": 50119, + "sha256": "be88c9667e9d4077039d327f63ce20c3a9d7475aac80912538b675db27810ff7" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-requester-lacks-change.json", + "mode": "0o644", + "size": 50118, + "sha256": "5655309b8c4b21b3a60806f52e0eb9285680af0a033867db606fcad737e95803" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-task-stale.json", + "mode": "0o644", + "size": 51527, + "sha256": "77d3b1605bd66b361cb4b89d5e4f4452f6a6a922ecc79043e5e122ead7904e7d" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-workspace-retired.json", + "mode": "0o644", + "size": 50120, + "sha256": "47afa9bbd362d9514bce95924e45d8bed59b86edafe8a5dcec34b9a64e6a6909" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-task-only-contexts-with-work-read.json", + "mode": "0o644", + "size": 49941, + "sha256": "c98094486ea3463c9ca43ebef961b847ec4f84ab66c81d24aced5324296d726b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-task-only-contexts-without-work-read.json", + "mode": "0o644", + "size": 49887, + "sha256": "e1a9cd887f1bc64a8abdd8a0a1326df21b1ac0406ead978d2e6fc26e4eb0d683" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-task-only-target-context-without-work-read.json", + "mode": "0o644", + "size": 49914, + "sha256": "0f58694950a5eb2d5949f9fa7f608e702d8a3d50b30b32d2c123e8c5b1e78292" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-bounds-other-agent.json", + "mode": "0o644", + "size": 50273, + "sha256": "5f2b5ae9680c274c6d8dfe9df0a0ba00f3102f2b3d393f56358eef5a222046ea" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-bounds-other-registration.json", + "mode": "0o644", + "size": 50273, + "sha256": "bceaeb2aa35d12d66e3aa67928162a6b90485ed1800bf6c1068f6b90fcce27f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-exceeds-issuer-ceiling.json", + "mode": "0o644", + "size": 49506, + "sha256": "72649b1beb999e234e5f6bc8a0d0f97afb50221048de87e5742117202402a3c0" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-input-missing.json", + "mode": "0o644", + "size": 48825, + "sha256": "612f95f4efda53b423d3f91eb282cff12655e273c36e42ef7f3ab1ea5f734125" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-issuer-ceiling-narrows-path.json", + "mode": "0o644", + "size": 49415, + "sha256": "5b321508e396c175d87afe5298f6431a4e1de90545e07d0847964e163f56d813" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-narrows-to-delegated-ops.json", + "mode": "0o644", + "size": 50275, + "sha256": "2507c45e93894e3168d7d223c7c16e62b4f0506396532cf90bf4fd2f539c2666" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-not-approved.json", + "mode": "0o644", + "size": 50219, + "sha256": "e117ca5d24dc96b33efd7382460066fa4d869c0930e0be17c37f6ca6116eed57" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-policy-ceiling-stale.json", + "mode": "0o644", + "size": 50822, + "sha256": "7f4eeadff72d311f8eeba2005da48cbaf0158297c32b797e8fe564f6d21f654a" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-scope-not-modelled.json", + "mode": "0o644", + "size": 50174, + "sha256": "82754afdbd8e329c19e377050b64aa92c077528ffc7212cb9c07e3e73b17688f" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-stale.json", + "mode": "0o644", + "size": 52029, + "sha256": "32fbb55099b9a0e97cf7a0101f51cd43d8ba373eba48b3fc664332b89de9d412" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-subject-form-task.json", + "mode": "0o644", + "size": 50264, + "sha256": "4b67c67f0d2b23de599b8988745b39d3517c5f4d76f4c6a85d610a44d8f4ef67" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-subject-form-three.json", + "mode": "0o644", + "size": 50521, + "sha256": "c8529b73636366b52d023d4da4b2c2cdc9ea842a97bb2a345ff9f28c9b07ff79" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-wrong-kind.json", + "mode": "0o644", + "size": 50222, + "sha256": "6c81b577f70da7eec74977be72f625a29417495ff71e28b24cae5024087848ac" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-decision-subject.json", + "mode": "0o644", + "size": 46999, + "sha256": "77adf0a0c7033eb40ba2fe6bbb49a4d90153cf491ba33e6edbb2e075e68883a0" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-dependency.json", + "mode": "0o644", + "size": 46997, + "sha256": "c113550fec982779ed7d01b1900dee98709dc738447f7f02beaab88331979dbd" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-selection-assignment.json", + "mode": "0o644", + "size": 46999, + "sha256": "66510d5f82c0353f7a7223d992d248f67ab0aaa894f9e129e05044df343e9901" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-supersedes.json", + "mode": "0o644", + "size": 47195, + "sha256": "d27909e13bde230b9d1c92edd6048016c70eeddcbb8af727966aaa6e3a38ad28" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-task-intent.json", + "mode": "0o644", + "size": 46997, + "sha256": "c81c7c5c2802b88e594eedb378721cd4c2b970cc372f9c7ca5b4cee02def9345" + }, + { + "path": "scripts/foundation/fixtures/bundles/registration-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47493, + "sha256": "baea07d3ab6a92653c0d8f3e7d9ef24ece8eab05cd3f02ad702278951e58ba07" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-assignment-ended-without-reason.json", + "mode": "0o644", + "size": 46996, + "sha256": "d7850b97b4a1f355621a290d14e1b57fae55a7c5f0d7c63585fb12b3ba3fa6f1" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-bundle-version-2.json", + "mode": "0o644", + "size": 46999, + "sha256": "8fe4cf694ff5fee90bf195bb99cc954a153a92fa04eab7a8f43c34eea3d2806b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-input-other-mode.json", + "mode": "0o644", + "size": 48447, + "sha256": "8a58b8ce6547b351b69302ec31c7d16d2c26dc3801b44ec80a84b065c5ca5c45" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-input-parent-ref.json", + "mode": "0o644", + "size": 48480, + "sha256": "5b12d03072f33e05b59d0425647350dd6547584d105ab5835246b313a6be54a7" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-without-operations.json", + "mode": "0o644", + "size": 46960, + "sha256": "946584e5be25821e022cdff3a5b2787c2458c6ee1809ef0b630703815ac790df" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-missing-execution.json", + "mode": "0o644", + "size": 46933, + "sha256": "7b5bcecb69a4e88c44de482810887ed32b455deca9c97b32c52088918af67a1a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-missing-operation.json", + "mode": "0o644", + "size": 46933, + "sha256": "99934a0d7ce4d96575edce7276c8d31a89db3683e4afad29556bac9241232d37" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-forward.json", + "mode": "0o644", + "size": 47023, + "sha256": "2c201894ae0724568780e0147ced700c40e6d5577c980d9f834a85a65c6af937" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-malformed-record-sorts-last.json", + "mode": "0o644", + "size": 47038, + "sha256": "bcefb67872e63f98477369d9360659630cff7823878f305f8bf06bb4d551e6b0" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-only-malformed-record.json", + "mode": "0o644", + "size": 47037, + "sha256": "5a7f85a999d8e08f064a8b74fe7dccabe2b50bb1ff6458675261bba926d807c1" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-reversed.json", + "mode": "0o644", + "size": 47023, + "sha256": "cc11bcf72654a48ed451d49f6ab385a6cbbd59c1b0a12e1234272811f816f8be" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-path-grant-absolute.json", + "mode": "0o644", + "size": 47285, + "sha256": "b2f22d443464d52d0e809f596fd4a286139b7d637b5b746f26ffc7a9d65840aa" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-plan-with-delegated-operations.json", + "mode": "0o644", + "size": 47030, + "sha256": "7927734520f92ee53f8d9cc3244fcaf40224c1ad00f21c3796983e541aa827f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-project-mission-with-parent.json", + "mode": "0o644", + "size": 47178, + "sha256": "d96eec739e15ddab9c1aec3573829a9293a8bfb03f66a0e4a28100fe97e21d56" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-project-registration-with-parent.json", + "mode": "0o644", + "size": 47187, + "sha256": "d62b0f3612e8680a083860c5f4e2ffa377b7b7a71e3ca410f9f57fdae196820a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-proposal-on-read.json", + "mode": "0o644", + "size": 50111, + "sha256": "74d3aed956fb0e1ed49d7bf1bdf0fc670a62e70d032aefcf5588107945b9897a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-proto-key.json", + "mode": "0o644", + "size": 47018, + "sha256": "3521338f24e902c9dbafaf1a0af9a8be203b997ca5ba4d3de7e6e5f42a3e4f93" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-agent-actor-null-execution.json", + "mode": "0o644", + "size": 47001, + "sha256": "6aacb4bae667501f38d97b9cbe459d09bc887f749c80be04311e3fad328772cc" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-bad-id.json", + "mode": "0o644", + "size": 46999, + "sha256": "c38770ccc41af4f357f3eebcb602dd56255a8a90c9899a75d9e9be3f30bd4ddc" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-bad-time.json", + "mode": "0o644", + "size": 46995, + "sha256": "df248c9a003deb6d7feb77c414ef67190c3cd0f2084997d2e41b09dfbc3f53cf" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-calendar-invalid.json", + "mode": "0o644", + "size": 46999, + "sha256": "5db137c0843d7b7c87d4b8e06a8a7612cb17a98874379c4da03e41a00a2ff709" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-criteria-duplicate.json", + "mode": "0o644", + "size": 47075, + "sha256": "06f42f587fcd9c8e36df97f67155a4f1ab6a39d28ad4a7998af4231be72490c6" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-criteria-empty.json", + "mode": "0o644", + "size": 46915, + "sha256": "7bc8fb98e35c689fe7ce73a184056e5be70e11191fd461e42db619b8b5a48f2b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-displayname-too-long.json", + "mode": "0o644", + "size": 47118, + "sha256": "bbe6bfb36597210ea692f67bc35ea6f6409388beafd9e2e6af56bd57344db3c3" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-leap-second.json", + "mode": "0o644", + "size": 46999, + "sha256": "544f5f84a78021fa197ec8507edeefca58ca2cff18ca23284e9ee3c1d612b8df" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-missing-field.json", + "mode": "0o644", + "size": 46891, + "sha256": "aa520c95f7af8e81e0242711e33a610820908b7b0a7947977dbb62ff6bf039ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-rev1-with-supersedes.json", + "mode": "0o644", + "size": 47195, + "sha256": "c06fa51658d8a505e8836c2016d671955997f0ccc84ef8fa33e68084011ad9aa" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-status-enum.json", + "mode": "0o644", + "size": 46997, + "sha256": "8040becb0d4fc9cfef1e52247f0cd44d5b3f6fd9bb4dded8fa73baa9c1175b5b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-unknown-field.json", + "mode": "0o644", + "size": 47020, + "sha256": "a6702f7f22a94469084f05f79fce624445feae9909dc98e5912268c91e9683c4" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-content-non-ascii.json", + "mode": "0o644", + "size": 47002, + "sha256": "7b1cf22485682d612a4e74aa24a133ea859d1183958bfd78d9084d3dcd4cc179" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-digest-mismatch.json", + "mode": "0o644", + "size": 47030, + "sha256": "b3cb2f63220077df78bd0a83023300b8031c6b84afca9bbcda7d6ddf9989671f" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-missing-content.json", + "mode": "0o644", + "size": 46504, + "sha256": "393d89a31cf86a95e43a6a15cf950c382949a2aa7533998023865454b6c56461" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-plain-with-content.json", + "mode": "0o644", + "size": 48289, + "sha256": "de7fceecac43163b591300dcb29b18206e728edd9bd7d8c20a6e69c14366d43f" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-restrictions-none-with-endpoints.json", + "mode": "0o644", + "size": 47412, + "sha256": "09ece43156218d02e9b2ae467ff76310bd7e85080ed4a8ef55886e41ead9f5ed" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-restrictions-unknown-operation.json", + "mode": "0o644", + "size": 47184, + "sha256": "6bec9d250fa308cf524128d6a37db7c23ba53f27f269152833c5b9f0caafa56a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-simulation-false.json", + "mode": "0o644", + "size": 47000, + "sha256": "557da19b296380c61ce200473a11173a0805846c0496a2619b1c0d1757c2e15b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-backslash.json", + "mode": "0o644", + "size": 47052, + "sha256": "76668ec2c1bb0341ed5f1ab96e9f37d5201bafb4483e82af88f5fbad4ca24f26" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-control-char.json", + "mode": "0o644", + "size": 47061, + "sha256": "05fb3da905f93c975fbf6f5f8d7effa0df45997ba528d8070ffbd3cb915bf135" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-dotdot.json", + "mode": "0o644", + "size": 47063, + "sha256": "aeffd2e5d0362fa93b5b50445426dbfff2ee40056e128ae2c79c6fb19deca954" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-empty-segment.json", + "mode": "0o644", + "size": 47052, + "sha256": "3efdcae8c0691f77bc896ff5f6839882ac6ba26beb8ebe72f3579dd877980804" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-line-separator-echo-ok.json", + "mode": "0o644", + "size": 47055, + "sha256": "8fcee4457379e23fb2f92e92ab17a6e586acf95f1e504fed6a9b94ad3f783553" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-unicode-ok.json", + "mode": "0o644", + "size": 47064, + "sha256": "8040178585bb71bfb7a5e73b1d236d30bfee4358d1ec84d276705492d3a70055" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-wrong-root.json", + "mode": "0o644", + "size": 47042, + "sha256": "7ca0872b7e035b83d8adccfff7fed1669881629c9e5d248f82a9231120423a27" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-too-many-records.json", + "mode": "0o644", + "size": 385409, + "sha256": "69d89b94922c81f8a6aabfcaaeaf18cc64c0dfcf7399e0879dc2e35c99b863e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unknown-kind.json", + "mode": "0o644", + "size": 47485, + "sha256": "15abdcf2fab896e477facf78d6f58c237089d321480cf483ef03cac48d5756e6" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unknown-top-field.json", + "mode": "0o644", + "size": 47013, + "sha256": "fb62948772ee0297f951a53636667e166f6640dde611efe82b2f01103088d7cf" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unsupported-kind-session.json", + "mode": "0o644", + "size": 47486, + "sha256": "c2c6549b1088b007b031ebf30e56c7bc37503f7201f19f577e8a539e1c539da6" + }, + { + "path": "scripts/foundation/fixtures/bundles/taskless-file-read.json", + "mode": "0o644", + "size": 46875, + "sha256": "54b2d827b76e289754dd89c2b37a3bf22abe6bfe064b4ba9e53058eb627c8f9d" + }, + { + "path": "scripts/foundation/fixtures/bundles/taskless-work-read.json", + "mode": "0o644", + "size": 46814, + "sha256": "5eac10a34626b91eb881a86adb30042296df700218fd273a5cc1560fd205e61a" + }, + { + "path": "scripts/foundation/fixtures/bundles/work-parent-project-mission.json", + "mode": "0o644", + "size": 46964, + "sha256": "f13594287cf8a240bffcf47be56ed52c73f0c37343841b06aa5822aef81b8c69" + } + ], + "fixtures-raw": [ + { + "path": "scripts/foundation/fixtures/raw/raw-array-too-long.json", + "mode": "0o644", + "size": 2051, + "sha256": "617dbb4c661baa3f145bdf28ac60df6b868c172ddad965c8733e704204048b8b" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-bom-prefix.json", + "mode": "0o644", + "size": 47001, + "sha256": "b4a98e270b4024cb974cca5998a8c96e179441beb07c466649d67fc39abd7446" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-constructor-key.json", + "mode": "0o644", + "size": 50, + "sha256": "db542a3baaf43c88776789470e9df3c74409d6529ea21c503673229737ac5315" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-depth-33.json", + "mode": "0o644", + "size": 66, + "sha256": "ffba7a731546fa3b609b0503e5b88d1523824b0f082f1c2f9166b08b57933566" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-duplicate-key.json", + "mode": "0o644", + "size": 40, + "sha256": "d260762a322a0c015f31ea99777551042acf8ced23a8471d886376e8a5805063" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-empty-file.json", + "mode": "0o644", + "size": 0, + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-exponent.json", + "mode": "0o644", + "size": 47000, + "sha256": "909fe77e9bc4489366666eb4e16c5d966520bf753560ca2705a56cec319f2799" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-fraction-number.json", + "mode": "0o644", + "size": 47000, + "sha256": "d0ca3b6fcf776b9f605ae35ee00642e4dd78a4396124f46fe24a0d41fa10c174" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-invalid-utf8.json", + "mode": "0o644", + "size": 9, + "sha256": "375eaa6515e23b024e4feb1a132beaf9e35b865e54cca181d01a7a0527ea9791" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-lone-escape-surrogate.json", + "mode": "0o644", + "size": 15, + "sha256": "f6ce88b5d0b4f17a625764062775db270c469f9cdc94f09e66828315f5c547a9" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-negative-zero.json", + "mode": "0o644", + "size": 46999, + "sha256": "448a56829ffa3d4b120dc9437f7df4349a481e540a802e74b64907f0c5a5f026" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-not-object.json", + "mode": "0o644", + "size": 2, + "sha256": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-oversize-file.json", + "mode": "0o644", + "size": 1048577, + "sha256": "9fa2b407b667e7ce77587038b445ff3df704f6972572708dc18cf355f13a45f4" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-proto-key.json", + "mode": "0o644", + "size": 33, + "sha256": "9a62fc3db4305c0079d42bf9bbf062fc1f60e2cc5eec25a42164350d88550547" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-raw-control-in-string.json", + "mode": "0o644", + "size": 12, + "sha256": "d0e097db994e029efa27ecc5a3da2213f203f30cbb49d12d10c1b297ead8d9aa" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-string-too-long.json", + "mode": "0o644", + "size": 4106, + "sha256": "15dd16f02a269a3b62326cc91ae8199c23d756a42d986cca61c83f68ce519485" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-trailing-content.json", + "mode": "0o644", + "size": 47001, + "sha256": "433f22797e2c1eab343b1711c80c9249053487dba9df986cfcf4759356d7cf60" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-unsafe-integer.json", + "mode": "0o644", + "size": 47013, + "sha256": "daa5145f11272cbfcdc3115e6d397a6a82830099ad6c2db5d25ee0e16c5c8ad1" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-utf8-surrogate.json", + "mode": "0o644", + "size": 10, + "sha256": "957a49305a06fd66d2ef727af1f8d7fde39456593641835c0b640947d18895ac" + } + ], + "fixtures-meta": [ + { + "path": "scripts/foundation/fixtures/README.md", + "mode": "0o644", + "size": 3592, + "sha256": "9dc57df95eb6849d532d5f821f1876a30790002d72bc3b2c6bff3040f2859a23" + }, + { + "path": "scripts/foundation/fixtures/build-fixtures.mjs", + "mode": "0o644", + "size": 75471, + "sha256": "f731b1f1da04ecc2a4dacd4b00164c55f7e55b180d9aa8c596363aca0d31225b" + }, + { + "path": "scripts/foundation/fixtures/index.json", + "mode": "0o644", + "size": 105216, + "sha256": "9a963a0e58770e4f5bb8b6feb978d52921746bc99061bbe18a5d6f33de28d1d1" + } + ], + "suite": [ + { + "path": "scripts/test-foundation.sh", + "mode": "0o755", + "size": 8493, + "sha256": "6f808ea8f4a021e30b4c22a697ad62e28a6fac33a4370f93c02ec18505ca972c" + } + ] + } +} diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r5.json b/docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r5.json new file mode 100644 index 00000000..c7eb637f --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r5.json @@ -0,0 +1,2317 @@ +{ + "candidate": "foundation-inspector rocko build r5 (FI-ROCKO-7)", + "generatedBy": "scratchpad/make-manifest-r5.py (machine-generated; no hand-transcribed hashes)", + "generatedAt": "2026-09-07T15:01:23Z", + "git": { + "head": "9a5fbdbda74b16adf488fe28138b2ba69ea5e669", + "branch": "main", + "note": "all candidate files untracked; no staging/commit/push" + }, + "toolchain": { + "node": "v26.8.1", + "python": "3.12.8", + "jsonschema": "4.26.0", + "kernel": "Linux 7.2.2-1-cachyos", + "strftime_year_999": "999" + }, + "pinnedInputs": { + "docs/plans/2026-09-06_foundation-inspector-charter.md": "19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6", + "docs/plans/foundation-v1-candidate/records.schema.json": "05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6", + "docs/plans/foundation-v1-candidate/check.py": "82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607", + "docs/plans/foundation-v1-candidate/records.fixtures.json": "d433d06da5cd38baf9e51c8857244ee70375db3b68e02a5325a6d1c2cc47da85", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-request.md": "90a1f329e859152d4ce8e157cbd6c56e6bcced16b4ed757822d2309514fa9a15", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build.md": "857470d97af6aeae4e7d7942c2a1d8455bfcda74ff68b8e1dc4ba8d066521fa4", + "docs/plans/reviews/2026-09-06_foundation-inspector-build-admission-findings.md": "8d9f7aab3b3bdf79345a07ba3595b966982b7667714ac7e3f669d65e328ca3d5", + "docs/plans/reviews/2026-09-06_foundation-inspector-code-review-gates.md": "6e7980186b2f49dec93d300f3681afd397ec7349c90806759a995695d9077b24", + "docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-addendum.md": "afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5", + "docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-verdict.md": "03c979b77cc6b03b6685ba51ed1ce24c3f1d7b274ce8f772263a103670050da7", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r2.md": "0dabd82fffdc3a56ebf9a1d8b851832c3acee2cb9332892bde9dbb13151d5e19", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r2.json": "2e8b5f1998a3be6cc7fcc3fba308724d2a29ca166c08f005e1bca88ddbc14196", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r3.md": "ec0444c94c9caf16472fdba1ff3fbc767dffd1a798b9a2da837598c9f4b25508", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r3.json": "3c2253b6c9f31e448c77aaac53977d41baecfb30e15845dcfffd8dc694428547", + "docs/plans/reviews/2026-09-06_foundation-inspector-code-verdict.md": "e4cc5970aab20240e6ea3a9a1513ef942ff167fefbb03356b9a32c89999adb3d", + "docs/plans/reviews/2026-09-07_foundation-inspector-corrections-request.md": "35c237f5c001832a0cfed23b03ff7530ffa78443612ffe11130fe456b968bd61", + "docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r4.md": "dff9f676ad0a97f6333a59d527e02ed55e7bcdca986fe9c1488280b84d4e677f", + "docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r4.json": "2a2e885f9df3dd626a09fe5db6e28af67c289e54660872031c18f8aa40cb0826", + "docs/plans/reviews/2026-09-07_foundation-inspector-ordering-followup.md": "e93a65b94fd4df8bd6e74c2f38afaf02e0f86b36632ff5a820fd8ac464c22101", + "docs/plans/reviews/2026-09-07_foundation-inspector-demo-test-gate-decision.md": "62cea74bea59e69f29c8a29a9c0311fdc6feffa2c337bc6a141db55149204898" + }, + "counts": { + "source": 6, + "tests": 5, + "fixtures-demo": 20, + "fixtures-bundles": 315, + "fixtures-raw": 19, + "fixtures-meta": 3, + "suite": 1, + "total": 369 + }, + "aggregates": [ + { + "prefix": "scripts/foundation/fixtures/", + "files": 357, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "dfa1f62604dd048326a968bc27681bfb18cd893eb0af8c533d2d6350dca5a025" + }, + { + "prefix": "scripts/foundation/fixtures/bundles/", + "files": 315, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "36684cbc8e3173981500bedd98a820b9b154c5491497fed8abdc72a477463288" + }, + { + "prefix": "scripts/foundation/fixtures/raw/", + "files": 19, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "dbc620a7247aef198a3f502002d73fa8d598a5fc939f4bdb5352467fa50360d3" + }, + { + "prefix": "scripts/foundation/fixtures/demo/", + "files": 20, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "6a32862b8985e39a339a504338b3fb94558890152e04b64c155ebdc77e7a8956" + }, + { + "prefix": "scripts/foundation/", + "files": 367, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "126b05e44ab6a30ba20d7a5f76fbb086e9f535253e8dc62dad891e6d8b2982ae" + }, + { + "prefix": "scripts/", + "files": 369, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "77ff91516f97500f62652ead5f49ce88d132225f08d337e24ace3a1e7b39c877" + } + ], + "files": { + "source": [ + { + "path": "scripts/foundation-inspect.mjs", + "mode": "0o644", + "size": 8597, + "sha256": "dad369490ca8396d3b4a7bd4a1b7fa87b677a2b8cf991bf61672d446e5aa3c93" + }, + { + "path": "scripts/foundation/canonical.mjs", + "mode": "0o644", + "size": 2936, + "sha256": "a7760882c4c49992b9d702eb125a3e8f63048be543516b0eba61231018b90172" + }, + { + "path": "scripts/foundation/resolve.mjs", + "mode": "0o644", + "size": 86984, + "sha256": "892f95ab8a971d93060353e43d53cb6988e7e61f2a5bae71f6f2aaf2b7c1f09f" + }, + { + "path": "scripts/foundation/strict-json.mjs", + "mode": "0o644", + "size": 10437, + "sha256": "7c31fe6be8cd29ee07662a21bb2e490a2ec799e263dec981ee257fcf7e6f6ebf" + }, + { + "path": "scripts/foundation/validate-record.mjs", + "mode": "0o644", + "size": 3040, + "sha256": "dcff28b53501b68fe7368adcbf02db0526ab4273d1c1c42e47df9a78a0bd9b4b" + }, + { + "path": "scripts/foundation/verify-schema.py", + "mode": "0o644", + "size": 28331, + "sha256": "e5fce462abd0e8c5be4e4543fd31146a35aba41a653d2aa105c28ca5a20deb67" + } + ], + "tests": [ + { + "path": "scripts/foundation/canonical.test.mjs", + "mode": "0o644", + "size": 4197, + "sha256": "f504321983b2c41eff5af7e6dc27e40e360e0aae299d0a9abc369c743f5384f7" + }, + { + "path": "scripts/foundation/cli.test.mjs", + "mode": "0o644", + "size": 14666, + "sha256": "566abb49770b5d23ea74da663a0c64e37b078d1a793acd313e56e8612fbf05c8" + }, + { + "path": "scripts/foundation/fixtures.test.mjs", + "mode": "0o644", + "size": 5421, + "sha256": "94e7508717efcafd11585a288a5d791e1e48a993794e2d470c6097f904befdb3" + }, + { + "path": "scripts/foundation/resolve.test.mjs", + "mode": "0o644", + "size": 48741, + "sha256": "0fdcbf80edfc35e877132566b9af5b1256d5efd3e69d4fc809eb0ca259a5bba3" + }, + { + "path": "scripts/foundation/strict-json.test.mjs", + "mode": "0o644", + "size": 6837, + "sha256": "b40488edfc4eba6962e8c0949ddf1f92fdc15d630b7e9bdff72ac6d06bdb092e" + } + ], + "fixtures-demo": [ + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.json", + "mode": "0o644", + "size": 731, + "sha256": "c44b0935ed329c1a381f986997b1bc4be702fc4229166d8a0b49e4e80f9b2fa8" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.txt", + "mode": "0o644", + "size": 393, + "sha256": "c2fd118d44d21cbd709d30a2c2be2603740a81e628aa9d32f95d6eaf06d3a9a6" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.json", + "mode": "0o644", + "size": 48279, + "sha256": "ff7b859cd959876b2b6ede97fff90383a38acde765a16294b095ba220290c579" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.json", + "mode": "0o644", + "size": 1082, + "sha256": "ecf8313993ca27450d1753c6178be1a063fb0637f14be8f091de923b8b722516" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.txt", + "mode": "0o644", + "size": 536, + "sha256": "0e2807ab56d15670c51c8ad4a43f33b36c5672799937561f39e20c6e93be1dda" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.json", + "mode": "0o644", + "size": 50119, + "sha256": "54aad9047f7fe86892889ead543403c42986f591722d0dd23e0e027c3b7191d5" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.json", + "mode": "0o644", + "size": 767, + "sha256": "7ea412916404ec948c94e929cc7b2ce120b394944c66c7bfcc811d0721dd82db" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.txt", + "mode": "0o644", + "size": 390, + "sha256": "2cdd6d4e162fa904b03e8f8a88553a03065ac7fb646baabf21625d4f5962a79b" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.json", + "mode": "0o644", + "size": 47060, + "sha256": "7c0948d39abd3f1eeb0b0990766cbf584959712000faacaf47ae0d3501def3cc" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.json", + "mode": "0o644", + "size": 706, + "sha256": "42055bda71075ba5c710f011f83d470228f18097d93ac5585ba1b534cba0ef2a" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.txt", + "mode": "0o644", + "size": 370, + "sha256": "8ba4bbe92819ac8912c72e7c635730e99eac7916c0d924fc81b75115b5939b53" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.json", + "mode": "0o644", + "size": 46999, + "sha256": "7a3cfc58c1356cc2a986e0a6ed8f9f2dffbc33277ea1b7800020bfc55624b750" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.json", + "mode": "0o644", + "size": 1060, + "sha256": "742e479ddbb4cf2138d49ec0ac40cd038b6c20f8b9c0e2daffc5a859db9f4145" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.txt", + "mode": "0o644", + "size": 514, + "sha256": "388983ad6e4e31db6f5a688773ff2bf07d44d7ffe530eb7870e729a0f546278d" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.json", + "mode": "0o644", + "size": 49975, + "sha256": "f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab" + } + ], + "fixtures-bundles": [ + { + "path": "scripts/foundation/fixtures/bundles/adm-agent-disabled.json", + "mode": "0o644", + "size": 47000, + "sha256": "cb92e2f7c19b8d8133389f62393228c8d5471f1c21ee46166392ce7dd31a9c32" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-agent-policy-missing.json", + "mode": "0o644", + "size": 45528, + "sha256": "ace29f2529cc16edf21ccd828cb371febf1690c6c55fb9db6e129e7c19057799" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-artifact-undeclared.json", + "mode": "0o644", + "size": 46843, + "sha256": "50ddfbd0e192521c0bc146268d00b9a28fb32d28ec2c9cc7e519677f16387bfa" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assigned-task-without-work-read-read-op.json", + "mode": "0o644", + "size": 46859, + "sha256": "9f5aaa486ae3de752803cf58441f0dbc90480ac002225a6cdee043516155396f" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assigned-task-without-work-read.json", + "mode": "0o644", + "size": 46863, + "sha256": "35ee45e648387b9a8b0aa81b201b4eff61eb5a15bdc6eea30ecbfacecae77bd9" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-ended.json", + "mode": "0o644", + "size": 47003, + "sha256": "45e10ae6b5fc71617db1303155cac53e26854bf00524a45756cfcec066e9ae6e" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-other-subject.json", + "mode": "0o644", + "size": 47001, + "sha256": "3c9abc1bb5be9649de7c9c82bf50766ab533e35f715cc8658a5b256dd68d032a" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-rejected.json", + "mode": "0o644", + "size": 46999, + "sha256": "13127e14aa12c3d1b4ab7864bb2b1495c271aaf11c6d952105cb1f0a01c79181" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-stale.json", + "mode": "0o644", + "size": 48755, + "sha256": "297d062015d3fec28a8bdb1415106be963dd70ad7b367f00e2623ebfca7e0985" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-other-agent.json", + "mode": "0o644", + "size": 46999, + "sha256": "0f3f15457115e8ecc5f629b6d818f42491f0e484a01eaa981f053c71143e8c46" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-other-workspace.json", + "mode": "0o644", + "size": 46999, + "sha256": "c1a0021541ebc6c27a9f9b9ba9d0c4f062366a92bc52733384ea483b9a93b007" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-paused.json", + "mode": "0o644", + "size": 46997, + "sha256": "956fd1008a5161007bf74eb5eabd7dbcb23fd05236fac7122cf8d1733d18020b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-required-for-change.json", + "mode": "0o644", + "size": 46868, + "sha256": "d58b71364fa5d900fad552817f3e5ca87f8c2330972ea8fae40c817b31bb6eb3" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-stale.json", + "mode": "0o644", + "size": 48276, + "sha256": "ee369230403bc139e32e15eb121f623975c657bde5801adc2608bf704aca9b50" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-authorization-undeclared.json", + "mode": "0o644", + "size": 46999, + "sha256": "1bfc562d60c31c7dddaa43e0976861b30b64a67b69d338ec307c0936e597da74" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-consulted-work-not-readable.json", + "mode": "0o644", + "size": 47442, + "sha256": "e6f6edb8de4fa83895e854be796e7321c1c195c4431f6e3a56c11bdc804f38a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-cross-project-dependency.json", + "mode": "0o644", + "size": 47247, + "sha256": "e30e939819f7b2e05fd42efd02a22d8752e9cdb0fba82ed45d1b8bc93f128324" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-cross-workspace-mission.json", + "mode": "0o644", + "size": 46999, + "sha256": "88bca4ecf7f2cae37d92e0c6656b51c812a0df4546a44eeceb4494331afd63ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-authorization-undeclared.json", + "mode": "0o644", + "size": 46999, + "sha256": "931e62561be2a6391d31fe3dc262367241d07e87ecc3a9f013fd7952a4949fd4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-grants-nothing.json", + "mode": "0o644", + "size": 48729, + "sha256": "39c227de39c473f631ff94b56bcbd5b113de9364f9bddd3488ac3926eaec66a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-not-accepted-change.json", + "mode": "0o644", + "size": 47051, + "sha256": "bb9bcc18a733912ede338804219dd3316ff8240e0206de2d182051394721dc2d" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-stale.json", + "mode": "0o644", + "size": 48209, + "sha256": "b46f5667dfa0b652e9afe35b7895affeeea309a4c66635b3c66b6bb10a104f55" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-authorization-undeclared.json", + "mode": "0o644", + "size": 46999, + "sha256": "1c8adc38492eb91fe2928690354ed27a7d6b1fc0d411de9d3e0f9180b5b1c5b8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-blocked.json", + "mode": "0o644", + "size": 47000, + "sha256": "6fd722efaacb595940505ff3a0422ed0dcb4121460d1e1ead9d82ad9f1d2c400" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-stale.json", + "mode": "0o644", + "size": 48106, + "sha256": "034e7d5e51b02b19fb44db4840a7dfe31934fa100d227e96bae9b8522d7b0b17" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-agent-policy.json", + "mode": "0o644", + "size": 47055, + "sha256": "87f23f0296c0a2b309f35daca97a88630e391de09b1e3f19e6ec4710bb50473b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-execution.json", + "mode": "0o644", + "size": 47442, + "sha256": "d1921054dc83fc9c4b999cf12914b4eac51c814264bd96a370c80af7ace3d134" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-role.json", + "mode": "0o644", + "size": 47053, + "sha256": "41429de9ab146264b5b887ec8ee303cb373b13fdcc892d2ab8dd17b95b8babaa" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-parent-mission-accepted.json", + "mode": "0o644", + "size": 47001, + "sha256": "76b4fa2904c8bc4400b7a7b4ad92a9b5d0d0ddfd6645d18dd613b8a45b1bebd4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-parent-mission-stale.json", + "mode": "0o644", + "size": 47863, + "sha256": "8f85116b9278024d257bcda57a4ce0e0526744e9a73df53f0106de0d29a87062" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-prefix-string.json", + "mode": "0o644", + "size": 47057, + "sha256": "303379a7fd5315ffa38929af357e38447e4d5419c61ab4602dab42b79a63cc9b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-read-execution.json", + "mode": "0o644", + "size": 47351, + "sha256": "0d31922e61a2a433377dd398cae230f638b694a91e6a36795caad33d197d2112" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-task-narrows.json", + "mode": "0o644", + "size": 47502, + "sha256": "623ee44ebe8edb0943bb98b89a0ece148965fce669bd12202ff61bfa05068e61" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-write-outside.json", + "mode": "0o644", + "size": 47057, + "sha256": "fb40436ff51935c811e044a2fb01c6b160d88f48dfb4488368702314ae2fe087" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-policy-ceiling-stale.json", + "mode": "0o644", + "size": 47546, + "sha256": "7d0dd0314b7cdaa73031e069e6db0ba32f219b5b5b1e57ca231602e46c7c99d0" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-policy-missing.json", + "mode": "0o644", + "size": 47001, + "sha256": "01915e487576036117d92eeaeabfd8bcde56501cfe7c26e8dee5033fa747afa8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-registration-missing.json", + "mode": "0o644", + "size": 45959, + "sha256": "9fe8fc27cc6c83e2e85fbe449a6c74ca78a6c6f8101c60f7a37a6e01c2166086" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-retired.json", + "mode": "0o644", + "size": 47000, + "sha256": "b945bf5863105512d2ed75427eeb94037c0a66a52e77bccb4b1dbc2ecbc5f91f" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-ambiguous.json", + "mode": "0o644", + "size": 48077, + "sha256": "cd7322b10c7bda7ef5dccd2c0df7c472412ba35aaa0beb25de8a7b399f99ef8e" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-parent-not-current.json", + "mode": "0o644", + "size": 47863, + "sha256": "8283f6bd81ac0bb2d11fc46c0ee759e85ae87c4dc5f54a22ccafa41559faaa98" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-parent-stale.json", + "mode": "0o644", + "size": 48026, + "sha256": "e9dae21b733ab51636b8421fbbf41adb74aba250b4319ba8097d2aeff7b5c7ca" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-revoked.json", + "mode": "0o644", + "size": 48279, + "sha256": "ff7b859cd959876b2b6ede97fff90383a38acde765a16294b095ba220290c579" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-digest-mismatch.json", + "mode": "0o644", + "size": 46999, + "sha256": "51d0c87a91037a04b0a03ad5d817855d6b866b4dd63c0b378abaf98941e24fed" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-endpoint-declared.json", + "mode": "0o644", + "size": 47703, + "sha256": "37f537ffbca59aecd79c67b2ae72ac8fc7edd12e0205eab89be52af87144c1a0" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-agent-refs.json", + "mode": "0o644", + "size": 46470, + "sha256": "e39a153882ea7461381424424befbfc95e9c60bfb32094823126b45042efe9f1" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-endpoint-execution.json", + "mode": "0o644", + "size": 47529, + "sha256": "46c2ba7715c6ab54665a50b9f46d96af2fa65fa1e42f52798b40523cd2da5ef9" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-endpoint-task.json", + "mode": "0o644", + "size": 47554, + "sha256": "16e43339ec7135e4af64706c0cb49cf7e9bf6c7b3e5b77ad3cd406be3fc4606b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-instruction.json", + "mode": "0o644", + "size": 47227, + "sha256": "f2c60d88af3cc75daf41b2dd5dc5612b21d77876cabda28940f50fbaf85d5f00" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-settings.json", + "mode": "0o644", + "size": 46822, + "sha256": "c01760a2beb23fcb01cec99a4c95bf1398580e0c465ac1742721105ea0524058" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-skill.json", + "mode": "0o644", + "size": 47227, + "sha256": "7bf73e0154f78b1cdbb206e56745d2307a8cdebdcabfcd13426e6c3d6ee5e2c5" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-soul.json", + "mode": "0o644", + "size": 46818, + "sha256": "dbfa43f96b4b6a0cf74dcf6389b030b58bcdfeda876d9e439e0d17a35e5c65fb" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-revision-mismatch.json", + "mode": "0o644", + "size": 46999, + "sha256": "6b6de37b0fc56e455015b054e8c5774cd6691445a1212189065a91cde0ede1e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-unselected-agent-ignored.json", + "mode": "0o644", + "size": 46999, + "sha256": "db44fa0b4d1f2fa2fe2bc3f144d78d729decbaf335dbbff0f2015e8118042c60" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-scope-role-missing.json", + "mode": "0o644", + "size": 46321, + "sha256": "49dcd13d523295c852fe5327b1227ac40b0d1503c836ff9b236800e4abbee5bc" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-agent-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "c2bde4733d09f154ff913dad96bdad19b0ab01e6fcf7bf8b565b409ca86f103a" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-project-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "59340a02bf4759a88bd89d65790e8cd7108d7e6516a4b737c1f07f362f86f4a4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-workspace-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "aef0bfbb5e5605b48e9e2ecc7a358ea9cb0209f2687703a1b2f1701fd809c7ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-intent-not-plan.json", + "mode": "0o644", + "size": 47003, + "sha256": "d5a260a2ad091b9ff23aa3abb0ab59b9712467601e49b1e18f2aadad26082288" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-intent-stale.json", + "mode": "0o644", + "size": 48755, + "sha256": "5323e36a3123fe5cf995de10e5fba493f5935fbf3f7dfde7c95a56a9bae94801" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-proposed.json", + "mode": "0o644", + "size": 47001, + "sha256": "9201feda75c3c5069748c5f85ec065beb173884e4e5146045de01577ec2aeb61" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-ref-stale.json", + "mode": "0o644", + "size": 48667, + "sha256": "5f59548d4ae2363277aa1ac15a1b8bfa29fa89bd3547c741138b1e34531ac8e3" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-unconsulted-authorization-ignored.json", + "mode": "0o644", + "size": 46999, + "sha256": "b44818b153c93e9ad7719b74d962f38ca3bf2e68adbae0a4af0c9407c09ced85" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-policy-missing.json", + "mode": "0o644", + "size": 47001, + "sha256": "a0810fc2d9e8103e8c6065d977e729d7aad3cd8ee22851ab9486b93912ccbb80" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-registration-missing.json", + "mode": "0o644", + "size": 45740, + "sha256": "635dfad244da0d1da7cc3c12dc6a6b5983cf16526af12f6c104d96efed81377c" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-retiring.json", + "mode": "0o644", + "size": 47001, + "sha256": "6c229ce8d707d8221541362a93c36a7d32f46f8032cdc298d759aeefb9616e7a" + }, + { + "path": "scripts/foundation/fixtures/bundles/assigned-task-only-with-work-read.json", + "mode": "0o644", + "size": 46886, + "sha256": "3c7be7502592647259c5dd2e7c6675cb979ba0010aa103c47a0a11f0c18ce255" + }, + { + "path": "scripts/foundation/fixtures/bundles/continuity-revision-gap.json", + "mode": "0o644", + "size": 48201, + "sha256": "853129ae49f83ac334a45cd36e9ec4b2970f3fd5060794f0402f8459c9d814b1" + }, + { + "path": "scripts/foundation/fixtures/bundles/continuity-supersedes-other-identity.json", + "mode": "0o644", + "size": 48201, + "sha256": "475ff6eac6b455d305b9af1dbbdf15c09fe308240416dcee67890bba926ddb9b" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-acyclic-versioned-history-file-change.json", + "mode": "0o644", + "size": 54476, + "sha256": "e3dd1cd34e24c4d9ba0354203b7754c9e045966f0503d28ae1912e4e89eb2d15" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-acyclic-versioned-history.json", + "mode": "0o644", + "size": 54415, + "sha256": "05598f3c9fd10cb81d7c108eb343e42ecb8def4dc3e312367335e89265447de1" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-cross-revision.json", + "mode": "0o644", + "size": 54675, + "sha256": "3d85b8708f6b5b1f73c01bd5814e0d30184b966e9646391209bb632ec1ec3d76" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-pair.json", + "mode": "0o644", + "size": 47255, + "sha256": "e87ca56e0c3ae241dfe7d6c61e3841877a8bbe79b80fbbf9dc48f938a706feda" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-self.json", + "mode": "0o644", + "size": 46995, + "sha256": "419980fc700a4d4870a3aeef78948d1acae91aac62769f73bde3dae5051fb956" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-mission-parent-old-revision-only.json", + "mode": "0o644", + "size": 48141, + "sha256": "55f3e4b72234c9d1535db7fec65347f01c827125a65f50b1df614d9d80418925" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-mission-parent-previous-revision-not-a-cycle.json", + "mode": "0o644", + "size": 48141, + "sha256": "c7bea20df7a6d3c294c46ab9982e27540760cc7ef2b29944340c8f8feec26128" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-mission-self-parent.json", + "mode": "0o644", + "size": 47034, + "sha256": "90c872b66ed4a190bb29bf6c8c1c40dada8cc98211893393ea0519c399d13027" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-supersedes-self-rev2.json", + "mode": "0o644", + "size": 47195, + "sha256": "f717ef0f14db090af156a3f08a2f1268f55f5aa9418aafe7dbc5916d826465b5" + }, + { + "path": "scripts/foundation/fixtures/bundles/deleg-approved-file-read.json", + "mode": "0o644", + "size": 50277, + "sha256": "4d1564ad708acfac940fcbbeff548fad649dbc08c1bd3708c1af86f756f1800e" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-change-w1.json", + "mode": "0o644", + "size": 50119, + "sha256": "54aad9047f7fe86892889ead543403c42986f591722d0dd23e0e027c3b7191d5" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-file-change-src.json", + "mode": "0o644", + "size": 47060, + "sha256": "7c0948d39abd3f1eeb0b0990766cbf584959712000faacaf47ae0d3501def3cc" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-file-read-src.json", + "mode": "0o644", + "size": 47058, + "sha256": "0b987af8fa79f322db409b7071f65f2ddfdac782f726dcb88e12c32b61c0a526" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-read-w1.json", + "mode": "0o644", + "size": 46999, + "sha256": "7a3cfc58c1356cc2a986e0a6ed8f9f2dffbc33277ea1b7800020bfc55624b750" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-artifact-identity.json", + "mode": "0o644", + "size": 47155, + "sha256": "5a816c1cb4e902b5c8bf85cd18c6215c624cae83f7dac2cbbd97b1da9541bd85" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-authorization.json", + "mode": "0o644", + "size": 47043, + "sha256": "814dcc1d5097c42a2066eb7aa1560f24a2580ed4434ede20e8cf492d84ab0b44" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-delegation-input.json", + "mode": "0o644", + "size": 51563, + "sha256": "2a1ba16ae05c25c4d9d6960cb8641d29f5de322046400af6658cbbeff1b9186d" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-order-delegation-inputs-reversed.json", + "mode": "0o644", + "size": 54785, + "sha256": "97ac80408cab9eb70315486d740ef963f89b30f54cc0e4d7f2a49e6e865c3251" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-order-registries-precede-artifacts.json", + "mode": "0o644", + "size": 47833, + "sha256": "f675692092da22ffd8008044c4bd5287bcb77ba8ffb0b433cf65f5bcc1dff7c0" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-record-identity.json", + "mode": "0o644", + "size": 48471, + "sha256": "b0db30a49d17aed1e39c53a3d8c73b962b53f56816309c64b4cb93bbf376880f" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-registry-identity.json", + "mode": "0o644", + "size": 47677, + "sha256": "8b95dc95d744b86a93e20a2f9eab9c2192e7d077cc37c19424b008edde548bd8" + }, + { + "path": "scripts/foundation/fixtures/bundles/execution-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47362, + "sha256": "3fd7ac1c0d44810c9cb30cf9972d0330cef0379f4c0c394b517d9dcbdfbaf9d3" + }, + { + "path": "scripts/foundation/fixtures/bundles/file-read-with-unaccepted-dependency.json", + "mode": "0o644", + "size": 47056, + "sha256": "6ebd0dee9886ff5f2f81351a155d5c0b2e6e62beb6bd17dda0f740ce32d3f297" + }, + { + "path": "scripts/foundation/fixtures/bundles/mission-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47495, + "sha256": "6e4acb4436a03454e1e5913b649d75c4df33b24d2f1da1116a742405cf94a5c7" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-change-without-proposal.json", + "mode": "0o644", + "size": 47007, + "sha256": "79923ed22f0b10cae5539b94cf79350529733e322fb7075958fef10ca7d68967" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-file-read-without-target.json", + "mode": "0o644", + "size": 46999, + "sha256": "3c35d78bb7d9d5e7895f6b0f7ea6279bb87ac0ec88b8e516cd61b9c1acadeff7" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unknown-name.json", + "mode": "0o644", + "size": 47001, + "sha256": "185a49b6e9fa1e218cbcad79aba57542a9c6b08ee44a1c8562aaa3bfbb386ff2" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unsupported-catalog.json", + "mode": "0o644", + "size": 47005, + "sha256": "00b116393a818923d4c5be9bef3942339a9b6b2c3d429a02dcb4d4926ae2b74f" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unsupported-workspace-retire.json", + "mode": "0o644", + "size": 47006, + "sha256": "1041dda47094246bd07fc3a9ad68ec59d482a8d380f460cefb6ebdf5673dce6e" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-work-read-with-target.json", + "mode": "0o644", + "size": 47047, + "sha256": "5c7c93a1b232c208ab371891746aa57e6bfcabca89fdbd3e261ef72f233db17b" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-assignment-task-other-workspace.json", + "mode": "0o644", + "size": 46999, + "sha256": "fc5d7a1fb64247c378a9b105450dcc954d8bfb2bd35c43c4558d1ed0fb5dd3fb" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-owning-project-mismatch.json", + "mode": "0o644", + "size": 46964, + "sha256": "12ce91207b12ce3b0c7d9f8e1921095cfdab02832ed54c41f4ab5ff4a50ead69" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-parent-other-project.json", + "mode": "0o644", + "size": 46999, + "sha256": "2b59f55a278a3632079bf393949050daf281c44623849d8511f486966c8d3392" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-parent-workspace.json", + "mode": "0o644", + "size": 47034, + "sha256": "205c6b725eb19a2a795d8f4b4bc64c762a92a770f170cb07fb7cf42669d8886e" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-project-id-scope.json", + "mode": "0o644", + "size": 46999, + "sha256": "e3747cde436b485f4b7b0137313a5919a710ef86dd47681baaab487f85950c5e" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-registration-parent-other-agent.json", + "mode": "0o644", + "size": 46999, + "sha256": "a5f871898dc8c0d5b8ce67de17de588176c69140cbcf41e615bd2f58d350a90a" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-registration-parent-other-project.json", + "mode": "0o644", + "size": 46999, + "sha256": "9074b8298e25c5715235476caf66363ec7c721e953deb2dd7835ade6bcf29ea6" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-workspace-id-scope.json", + "mode": "0o644", + "size": 46999, + "sha256": "7de9e947dbd89bc703cd864ac3840e8b938f59a750c5d51ba9d6bf63854fa49c" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-workspace-project-missing.json", + "mode": "0o644", + "size": 45553, + "sha256": "3f38f7154d9cb72d1fe27321899953f6a16fee4c95aa2d253d82807b8ad75e6f" + }, + { + "path": "scripts/foundation/fixtures/bundles/p2-inventory-unselected.json", + "mode": "0o644", + "size": 47000, + "sha256": "46b56f9e999441451b722ac1f826df24c349fad606c29224e7fed4453f078be5" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-artifact-digest-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "4a2ebbff331d103c82ded30ef6648bd7b21c7893a2ecd3b54000e6531f3a23ef" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-artifact-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ccaa0b7b543168cdf647fbc638f7f04cc8a722d74dd59ea56c518337f3c27362" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-artifact-run-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "3d7d4fce68e440044862466a91811c4f1d8d42746f041abf69fe8e010c7b5940" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-authorization-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "bb20c0c27a9f2e7c1aa8a551e6a4aab0817ca992e5e59965e2e26232aff5ba00" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-delegation-input-decision-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 50223, + "sha256": "f06e95047a396b4e076651780d034391b7b67036d5d464d40c80fc1f6a795dab" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-cr.json", + "mode": "0o644", + "size": 47001, + "sha256": "30dcfc1ac5bec6983bc611240d67128374f5c27a49aa346740dd169fc95233d4" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-crlf.json", + "mode": "0o644", + "size": 47003, + "sha256": "c41d28c9ac000ee612562f99b02ad353b4e504c9fc95eb5a58d9a7ad21ed9d80" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-interior-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "91399148e681674f46351ecc5d5612f816f4dfcca5f41c881ea20d8168779071" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "128e1dde7dd30dcbc4b2a628ed708afcaa3dbd317f0b56f941a1c815af2be901" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-two-final-lf.json", + "mode": "0o644", + "size": 47003, + "sha256": "f9e155deaf0fe356470fd284e115ad27fb7e9fdc12d0daaf6da025505309de78" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-u2028.json", + "mode": "0o644", + "size": 47002, + "sha256": "ce2f0c27ccad7ccf422656fb5f3d7c1a597280bef78f977dc1118a672742b9db" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-u2029.json", + "mode": "0o644", + "size": 47002, + "sha256": "4b040b44d1f39d124b67b5c456979188bf8bf38e36b38f839f82be01287084fa" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-escaped-newline-free-text-allowed.json", + "mode": "0o644", + "size": 47008, + "sha256": "d53f005a9283b35c48e7093c7c84959e67d0b9d7703240451d61fece9d4a59fe" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-cr.json", + "mode": "0o644", + "size": 47001, + "sha256": "e5c13868b71b409f6dfe0cbf66ee6a847d58077fee210a1a0009484ccfd34c3a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-crlf.json", + "mode": "0o644", + "size": 47003, + "sha256": "cef6102987f8de847b8c7ee1a23aa5e72403b1fbb6d11189cdacb2cdb463957f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-interior-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "a4cb7e74b3ad77a000de77b43dd172d8a68f0e16abf1abc07d972b35fd9076e7" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "eede0a44305cc40aa15c5181105fce7c695ae7381696deb022d7dc64bdb8f8c8" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-two-final-lf.json", + "mode": "0o644", + "size": 47003, + "sha256": "42986229494c4d80104293639927b9e8bf15d5fea94abb6c684492f8d2c7471a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-u2028.json", + "mode": "0o644", + "size": 47002, + "sha256": "50da9b3aefe6163cc3f53dce63fd37a5a742501b31f0fed6d466b23653265ed1" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-u2029.json", + "mode": "0o644", + "size": 47002, + "sha256": "4e1adcaa3665bba405508e448cdfc6b6e42f0fb255309d0261a22af08362983b" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-order-artifacts-reversed.json", + "mode": "0o644", + "size": 47003, + "sha256": "3d2ef2f7220207cd4e3e1c6590435cd4550f27aa6091810fe6dc251b56eb9c56" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-order-authorizations-reversed.json", + "mode": "0o644", + "size": 47047, + "sha256": "1fbb9633bab6354982a160dc926bcc181272e328820e1fa2e68a5aa986e94443" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-order-registries-forward.json", + "mode": "0o644", + "size": 47003, + "sha256": "d692dfccb79f7668fbc55b5a3afdf9b85b8f1b8dd6073b811378526c572ba901" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-order-registries-reversed.json", + "mode": "0o644", + "size": 47003, + "sha256": "272d55d187f04a971f76c1ffb57befdb8b99fe9bc5b2b74e85d7ec482ff8c8f8" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-order-shape-precedes-profile-authorizations.json", + "mode": "0o644", + "size": 47047, + "sha256": "c8e9b50b1e216071069f32876bf814d95bf17dc500ffe3dfac9fb197ddf4a44f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-order-shape-precedes-profile-registries.json", + "mode": "0o644", + "size": 47022, + "sha256": "95ad1a8e2bf412ef61f6cd4a671c4735833619f7310e8f33b70f9a9658c7645a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-path-one-final-lf.json", + "mode": "0o644", + "size": 47060, + "sha256": "11aa009e6435ec07cf2fc218d7b23e9fb7ec5e2a42627fedeb54f8ac9cd24dbb" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-proposal-requester-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 50121, + "sha256": "bc2c862ee7d033551a261502d33ea309c0e54a0b13027c0f0477cce4144fa70a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-proposal-requester-context-assignment-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 50121, + "sha256": "47bd3833eaa5b240a0bf974958a7b0dfe9f69541a4921a0df4aaa6288a3d093f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-proposal-target-task-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 50121, + "sha256": "5f0ee53fabe59d51355f19d7b4f6cfd8115e708b857bafc296d54bed0e07c33c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-actor-execution-id-one-final-lf.json", + "mode": "0o644", + "size": 47037, + "sha256": "c95c2002cd0e345ea5589fce6a2688780bd523b76bd406439fcb906c463e621c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-actor-principal-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "a5fad7a69c136738bf74042c96ff1bd2f176b1bf768ff45cea0d9d7245021d9d" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-agent-type-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ab5174ec3f9136fc0290bd15743db5c89414f33938d731fa74882b49ae7d5edf" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-assignment-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "b36bb80f4607cb173012ff4c462d0ebbdfbd0be2ce07594796fbb89117a20cec" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-criterion-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "6defe71fd655947c23cdaa7e0eede5befe8aa92b06cb5762e0fa3d373ab3ae3c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-decision-subject-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "c71ce20d13abdc757fff44643ce2e9d58049f3f25fddb761519cf5ec9e46d1e1" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-dependency-ref-id-dangling-one-final-lf.json", + "mode": "0o644", + "size": 46999, + "sha256": "c61d5e84fa5dd4f16232fb71fcedd0d2cb535f40e3d4d1a15c0f5c3246348a7f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-file-root-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "a11a5f59429bda53240f0bc00c98b327d6555b2039ca7f7fb06e4982af8d0187" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-registration-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "17367fb547e62e68be267330eb98e04dd4fe2febb3faea461984901a5e7dee46" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-registry-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "e5853ec5455477ce99b82eea55a4faa42b40126434c28de1000b13406f2d94cb" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-scope-project-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "537f70c753dc214a66087a1ccc10825df2312c28355bbc1a4fbf1a06cffa56d5" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-scope-workspace-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "feddd255c7abdcbac1369b63df555627576e5c9bb70535a2fc1d78966acded2a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-supersedes-id-one-final-lf.json", + "mode": "0o644", + "size": 48203, + "sha256": "69ee9f06c06d673334e55bc5356c094b88078f2f45a676d338f8e6afb4aa0119" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-registry-digest-content-bearing-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "8123d8856307c79838b9e67c5176bf6dcfd650555429646452e7a5edd29fbef8" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-registry-digest-plain-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "797beab4cecc709ca1010d88472819080369775a074e0db94cd4744891c51a3c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-registry-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "c068396afaeac858d93b114ee314a331abeee7197e81d30716353ae4c1d91bd3" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-cr.json", + "mode": "0o644", + "size": 47001, + "sha256": "51c38ea4f0d088869f96a44566c6fb83e3cfb98f9c27ca67f2555f6359345390" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-crlf.json", + "mode": "0o644", + "size": 47003, + "sha256": "28a2723cdc46e87b2407e6fd2fe944cf78a67739d9c88a2ef42a7e06386a1afb" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-interior-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "97cf8d143f7309717250c86784638ee69c6dda16c3ec609119c4abc4f7800404" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "64f7323e9bd799ff1f0e997aa4c33baffb677853921b71990fc0baeac94acc59" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-two-final-lf.json", + "mode": "0o644", + "size": 47003, + "sha256": "1cecf2c29720b272c7f1822abb7a037a66cd209fcd6af5f7c1248d8368e163b7" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-u2028.json", + "mode": "0o644", + "size": 47002, + "sha256": "935dfe037f4bf48085bb8ef86d1f5ac1287f2c4ba5eab789913216f2af4840b5" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-u2029.json", + "mode": "0o644", + "size": 47002, + "sha256": "641b359f8bb90db0f4dfea964d8d46acf408b29ee37a6cf8ced04b975e60fa58" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "1aa1b1dd878798fb5f8201861bee7f4ee2de39cd21f91f75c168f0224c2e6ea2" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-assignment-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "f07fe150fc578fe9fad603f96ed51e7969aee20e970f5abad4fd1ee49ab94692" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-assignment-ref-scope-workspace-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ecdb566ec563416d08647279b2be7b5f0368866b99057d52dfd952e5922a5500" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-project-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "233062e341b71e65c7b900b1da1f93b1a7cb9d6ea603919584e339246233234f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-workspace-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ab430903ebe13af3a8ec1bd57f925196bac1aac38b8f6f2ec4058f42fd110f0e" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-time-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "22776f383b20d2620dcc2731c1f7b5bbf4c2556c50cd04e2ffcb1b8bddad853d" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-unselected-record-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "c22ce5dec672c5ad5fe8e1cdd6b901b98d8ae7134ebe2c4865387aeb8d7cfd0d" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-unselected-record-scope-project-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "559c7d55bc1a88ac918922cfb7d0f0daf285c08cb6c68d27728dbe024a9ccf93" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-all-pass-restricted-contexts.json", + "mode": "0o644", + "size": 51185, + "sha256": "ccf22e319ada775b014be68687a4d54da2234b2c6e01b3507319012ad7b2b5b1" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-not-recorded.json", + "mode": "0o644", + "size": 49934, + "sha256": "abe2511b7006e56a91b4d40213075aacac2e08dbdba35a7b2e69c07c345cf68c" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-rejected.json", + "mode": "0o644", + "size": 50119, + "sha256": "b4a19d16a0a6d07e071663db371d77073a615319d1a1b4862a1aa7935a4cb251" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-stale.json", + "mode": "0o644", + "size": 51883, + "sha256": "e52970ec3675eda0bdff8742b453c109e848eeea9e2c6b9c1ad6db3a227a7ce0" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-subjects-mismatch.json", + "mode": "0o644", + "size": 49871, + "sha256": "6d726823ea3181892717f6bdd0cfc03ca6ed68c52d27874208e595a001c1b348" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-wrong-kind.json", + "mode": "0o644", + "size": 50118, + "sha256": "cc810af17db5661a2c2446e26da390b008f66a0a25c7513108ec0c21cc8e4807" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-artifact-undeclared.json", + "mode": "0o644", + "size": 50119, + "sha256": "33a7c5c4d7927f1875ed21931807b83700068b289256607a075881c2b45017bf" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-exceeds-issuer-ceiling.json", + "mode": "0o644", + "size": 49375, + "sha256": "dade48f2e5147037ae009e42acb1de4fe56fc2b53711de0fd0dc65ce6a4df0af" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-input-missing.json", + "mode": "0o644", + "size": 48673, + "sha256": "25c0a2fd08a2270dd8609abd709a0e8d5df96923e521ef0c9c6b9414b0eb6626" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-missing-after-requester-admission.json", + "mode": "0o644", + "size": 50266, + "sha256": "dba8f8890641aa54a24dc14f898c973ae73a364302fe59267e8eb9c3a418ddae" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-missing.json", + "mode": "0o644", + "size": 49935, + "sha256": "d76b138aac1f6138c6c4d5a3a057e20ea7dcc0488b625e037e6a97297527abc7" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-other-recipient.json", + "mode": "0o644", + "size": 50119, + "sha256": "79a6ce60aca3376e5ba3123a6a9f7515ef70ea6d3479261443bf02dc8518b8b9" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-other-subject.json", + "mode": "0o644", + "size": 50119, + "sha256": "2f83da99d4a915d0fb97e9198c082604821f0fd45c239d82075fee88b852dd02" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-rejected.json", + "mode": "0o644", + "size": 50080, + "sha256": "d5cbc12c8697f707f7538ae2d17777d159d5b646268e283ead10c355e10cc3b8" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-stale.json", + "mode": "0o644", + "size": 51854, + "sha256": "0e8815068566524de3f07221ada8c14b3224193cef9b50d4ebd4a34ce84cef8c" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-wrong-operation.json", + "mode": "0o644", + "size": 50111, + "sha256": "3f00f24d96c061e5a266a534119717facdeed620aef5577f7a119e00963df12e" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-subject-intent-stale.json", + "mode": "0o644", + "size": 51875, + "sha256": "05e3b3696194ad9d64b0c8279914ffa3543eab36e5203e4847ff6682836b6187" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-subject-paused.json", + "mode": "0o644", + "size": 50117, + "sha256": "28fe6c19dab8365ed95a15f09faefa3d85c1310e7ed5d50446e1938cb12d23cd" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-target-task-blocked.json", + "mode": "0o644", + "size": 50121, + "sha256": "2c0f02ea2130c90ee2e46d8c008f900da6a65e1f1a448b96c976873fcf4ab84b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-target-task-intent-rejected.json", + "mode": "0o644", + "size": 50119, + "sha256": "bd53add1593ca3ae27673256f814d5a8c1cbb34ffa1ba31ad06687126156d916" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-issuer-denies-work-read-task-only.json", + "mode": "0o644", + "size": 48647, + "sha256": "3f4fc74d678bd91b9023bc0661094c6edc9dd26572d3e6422dbb20c9d4da6081" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-issuer-denies-work-read.json", + "mode": "0o644", + "size": 49335, + "sha256": "34d1ed805d3d42098052be2b928404947bd2d3b7b4c1af0edd3ec344aaec88f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-issuer-grants-work-read.json", + "mode": "0o644", + "size": 49358, + "sha256": "aad1654ac0947ce2db7838872e5088792e583bfb3c24eaa750aa01a7122792fb" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-after-structural-failure.json", + "mode": "0o644", + "size": 49975, + "sha256": "3c86d9e9747f91388c16ae3ba17f2bab9d3a9a098e133921d5b3971a4a411669" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-is-not-authority.json", + "mode": "0o644", + "size": 49975, + "sha256": "f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-precedes-requester-admission.json", + "mode": "0o644", + "size": 50306, + "sha256": "1c9f7142646ed4e39daa5e96cab46d57a03aadd0b3f61d21b6a1179dbe906a3d" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-precedes-stale-subject.json", + "mode": "0o644", + "size": 51252, + "sha256": "3c008be9a1f35c5f976014e90afd591c82e0923775f291a0e683dfbd8b105152" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-context-no-work-read.json", + "mode": "0o644", + "size": 50596, + "sha256": "1fd82546b0e78663afd29d2fbbb2151dea8b4477d5d2085b6ca185a3cd45a536" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-assignment-paused.json", + "mode": "0o644", + "size": 50117, + "sha256": "97e1353813efa41e5f7afdca86ee71f878e1e5bb9de300f36532aa49016cdf84" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-lacks-change.json", + "mode": "0o644", + "size": 50118, + "sha256": "0a58eacc571a255ef355573e26a7c1d69aafe8435c0a779c667577874f0a7d89" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-registration-revoked.json", + "mode": "0o644", + "size": 51400, + "sha256": "e8f336a3ba50d1d17d8330c871ab80cc0823ca612f15359371c28737534099e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-agent-missing.json", + "mode": "0o644", + "size": 50119, + "sha256": "b5a9258c22c41aaf440add5cc4f030365942adba5c1f7b48c33f55698af90f75" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-context-wrong-agent.json", + "mode": "0o644", + "size": 50119, + "sha256": "2bf77e5d80aa3c7cd5c8a9c9d5632f841dddeff0b3b42325a8a938cb2e318f39" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-context-wrong-scope.json", + "mode": "0o644", + "size": 50119, + "sha256": "432d503f0e105d7aa3bc71547d7e88f621870a54a8837b73ae6941daf5d279cd" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-selection-agent-mismatch.json", + "mode": "0o644", + "size": 50119, + "sha256": "ae7138b549b3e1b0a212d4a859294c4492755b6e108777d4b42a35e44f01c46b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-selection-null-assignment.json", + "mode": "0o644", + "size": 49934, + "sha256": "f06fe01ffa553af1473a87497c8192ef2d786cc2031e33ff8e3c7a42852c4267" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-assignment-stale.json", + "mode": "0o644", + "size": 51396, + "sha256": "90ac6747e11416ba52fc6c3ea57d735ee2d2993e8720a81955fdc73ddd3197dc" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-not-selected-assignment.json", + "mode": "0o644", + "size": 50119, + "sha256": "6eddffc4fa618dfe25c758cf2165a47c30b6a5cb9daa63685c6896fc501f57a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-task-authorization-undeclared.json", + "mode": "0o644", + "size": 50119, + "sha256": "0cf96ef8fa1801828b709818947c2f6d771ee61a39232bfab60b4768f56f509b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-cross-project-context.json", + "mode": "0o644", + "size": 51449, + "sha256": "61b7a1f1c2f8f4e576c40a424df4b29136577b4aa0f6519bda789b8ae026969f" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-cross-project-task.json", + "mode": "0o644", + "size": 50119, + "sha256": "be88c9667e9d4077039d327f63ce20c3a9d7475aac80912538b675db27810ff7" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-requester-lacks-change.json", + "mode": "0o644", + "size": 50118, + "sha256": "5655309b8c4b21b3a60806f52e0eb9285680af0a033867db606fcad737e95803" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-task-stale.json", + "mode": "0o644", + "size": 51527, + "sha256": "77d3b1605bd66b361cb4b89d5e4f4452f6a6a922ecc79043e5e122ead7904e7d" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-workspace-retired.json", + "mode": "0o644", + "size": 50120, + "sha256": "47afa9bbd362d9514bce95924e45d8bed59b86edafe8a5dcec34b9a64e6a6909" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-task-only-contexts-with-work-read.json", + "mode": "0o644", + "size": 49941, + "sha256": "c98094486ea3463c9ca43ebef961b847ec4f84ab66c81d24aced5324296d726b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-task-only-contexts-without-work-read.json", + "mode": "0o644", + "size": 49887, + "sha256": "e1a9cd887f1bc64a8abdd8a0a1326df21b1ac0406ead978d2e6fc26e4eb0d683" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-task-only-target-context-without-work-read.json", + "mode": "0o644", + "size": 49914, + "sha256": "0f58694950a5eb2d5949f9fa7f608e702d8a3d50b30b32d2c123e8c5b1e78292" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-bounds-other-agent.json", + "mode": "0o644", + "size": 50273, + "sha256": "5f2b5ae9680c274c6d8dfe9df0a0ba00f3102f2b3d393f56358eef5a222046ea" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-bounds-other-registration.json", + "mode": "0o644", + "size": 50273, + "sha256": "bceaeb2aa35d12d66e3aa67928162a6b90485ed1800bf6c1068f6b90fcce27f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-exceeds-issuer-ceiling.json", + "mode": "0o644", + "size": 49506, + "sha256": "72649b1beb999e234e5f6bc8a0d0f97afb50221048de87e5742117202402a3c0" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-input-missing.json", + "mode": "0o644", + "size": 48825, + "sha256": "612f95f4efda53b423d3f91eb282cff12655e273c36e42ef7f3ab1ea5f734125" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-issuer-ceiling-narrows-path.json", + "mode": "0o644", + "size": 49415, + "sha256": "5b321508e396c175d87afe5298f6431a4e1de90545e07d0847964e163f56d813" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-narrows-to-delegated-ops.json", + "mode": "0o644", + "size": 50275, + "sha256": "2507c45e93894e3168d7d223c7c16e62b4f0506396532cf90bf4fd2f539c2666" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-not-approved.json", + "mode": "0o644", + "size": 50219, + "sha256": "e117ca5d24dc96b33efd7382460066fa4d869c0930e0be17c37f6ca6116eed57" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-policy-ceiling-stale.json", + "mode": "0o644", + "size": 50822, + "sha256": "7f4eeadff72d311f8eeba2005da48cbaf0158297c32b797e8fe564f6d21f654a" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-scope-not-modelled.json", + "mode": "0o644", + "size": 50174, + "sha256": "82754afdbd8e329c19e377050b64aa92c077528ffc7212cb9c07e3e73b17688f" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-stale.json", + "mode": "0o644", + "size": 52029, + "sha256": "32fbb55099b9a0e97cf7a0101f51cd43d8ba373eba48b3fc664332b89de9d412" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-subject-form-task.json", + "mode": "0o644", + "size": 50264, + "sha256": "4b67c67f0d2b23de599b8988745b39d3517c5f4d76f4c6a85d610a44d8f4ef67" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-subject-form-three.json", + "mode": "0o644", + "size": 50521, + "sha256": "c8529b73636366b52d023d4da4b2c2cdc9ea842a97bb2a345ff9f28c9b07ff79" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-wrong-kind.json", + "mode": "0o644", + "size": 50222, + "sha256": "6c81b577f70da7eec74977be72f625a29417495ff71e28b24cae5024087848ac" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-decision-subject.json", + "mode": "0o644", + "size": 46999, + "sha256": "77adf0a0c7033eb40ba2fe6bbb49a4d90153cf491ba33e6edbb2e075e68883a0" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-dependency.json", + "mode": "0o644", + "size": 46997, + "sha256": "c113550fec982779ed7d01b1900dee98709dc738447f7f02beaab88331979dbd" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-selection-assignment.json", + "mode": "0o644", + "size": 46999, + "sha256": "66510d5f82c0353f7a7223d992d248f67ab0aaa894f9e129e05044df343e9901" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-supersedes.json", + "mode": "0o644", + "size": 47195, + "sha256": "d27909e13bde230b9d1c92edd6048016c70eeddcbb8af727966aaa6e3a38ad28" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-task-intent.json", + "mode": "0o644", + "size": 46997, + "sha256": "c81c7c5c2802b88e594eedb378721cd4c2b970cc372f9c7ca5b4cee02def9345" + }, + { + "path": "scripts/foundation/fixtures/bundles/registration-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47493, + "sha256": "baea07d3ab6a92653c0d8f3e7d9ef24ece8eab05cd3f02ad702278951e58ba07" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-assignment-ended-without-reason.json", + "mode": "0o644", + "size": 46996, + "sha256": "d7850b97b4a1f355621a290d14e1b57fae55a7c5f0d7c63585fb12b3ba3fa6f1" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-bundle-version-2.json", + "mode": "0o644", + "size": 46999, + "sha256": "8fe4cf694ff5fee90bf195bb99cc954a153a92fa04eab7a8f43c34eea3d2806b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-input-other-mode.json", + "mode": "0o644", + "size": 48447, + "sha256": "8a58b8ce6547b351b69302ec31c7d16d2c26dc3801b44ec80a84b065c5ca5c45" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-input-parent-ref.json", + "mode": "0o644", + "size": 48480, + "sha256": "5b12d03072f33e05b59d0425647350dd6547584d105ab5835246b313a6be54a7" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-without-operations.json", + "mode": "0o644", + "size": 46960, + "sha256": "946584e5be25821e022cdff3a5b2787c2458c6ee1809ef0b630703815ac790df" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-missing-execution.json", + "mode": "0o644", + "size": 46933, + "sha256": "7b5bcecb69a4e88c44de482810887ed32b455deca9c97b32c52088918af67a1a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-missing-operation.json", + "mode": "0o644", + "size": 46933, + "sha256": "99934a0d7ce4d96575edce7276c8d31a89db3683e4afad29556bac9241232d37" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-artifacts-forward.json", + "mode": "0o644", + "size": 46961, + "sha256": "1fdb5c40147d503251725d79abcf96492fdd0db40653ecfb643e9f219d89c5ef" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-artifacts-malformed-sorts-last.json", + "mode": "0o644", + "size": 46970, + "sha256": "c2d2141e61f7610ccaa12bf41afa511db2a3a0add4aca21a734f717414288a39" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-artifacts-reversed.json", + "mode": "0o644", + "size": 46961, + "sha256": "10ccc8bf3ab966aa53d3f98a12de26bdb275aa882b29fba3c611a710ad3fbda9" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-artifacts-swapped-forward.json", + "mode": "0o644", + "size": 46961, + "sha256": "3ad709be601fb6ce955f64f8294d0de9f3eefb73f0b81dcd57e1853bb6b5acf0" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-artifacts-swapped-reversed.json", + "mode": "0o644", + "size": 46961, + "sha256": "cf4a22da0dceab1416a0b208a47afba7720391435a92c76eee3de5e1fe50c5d1" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-authorizations-forward.json", + "mode": "0o644", + "size": 47045, + "sha256": "7e9bfe427a04931d75535c8d40e714c1c97910b7205f459e45ae1960109409bb" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-authorizations-malformed-sorts-last.json", + "mode": "0o644", + "size": 47008, + "sha256": "e06a2d26e580424873717b34538823c7d24be5360356dc081220c3043e8319af" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-authorizations-reversed.json", + "mode": "0o644", + "size": 47045, + "sha256": "d3615d51c20bb2e96c4665c1f90406e251bb097adea61a54434ef3d55154792c" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-delegation-inputs-forward.json", + "mode": "0o644", + "size": 52171, + "sha256": "f823ad69a089b242d8bc6a65129463cb3e384e2b46bfd3a5e4ec011231a95f49" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-delegation-inputs-malformed-sorts-last.json", + "mode": "0o644", + "size": 50160, + "sha256": "0b4ea49d146fe187ee4551a50143723ea2ac8343f1aa3434b8226921a2bfa0a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-delegation-inputs-reversed.json", + "mode": "0o644", + "size": 52171, + "sha256": "a4390d0a81c7d219ee3a95a25d8a53c0ad09808ba7fe4a4a254d0ec7a6322701" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-delegation-inputs-swapped-forward.json", + "mode": "0o644", + "size": 52171, + "sha256": "12e2acd24c0c18393e998f26e7ba69e09545dac98285c7ea4b47fcba03049077" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-delegation-inputs-swapped-reversed.json", + "mode": "0o644", + "size": 52171, + "sha256": "ac8ded6a43248f2c87adde783f3c434cf6ad79c0275531907e9619377334acfe" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-family-precedence-artifacts-before-authorizations.json", + "mode": "0o644", + "size": 46903, + "sha256": "6822d56262f8cc8bf0b923799b7569ce15f4f6c0829cf97f5da85c3f4aaa0ea0" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-family-precedence-authorizations-before-delegation-inputs.json", + "mode": "0o644", + "size": 50084, + "sha256": "017e9ce810757ad61c6359cdbf180f38123aeda45a0117c3c6b45ccd58f71939" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-family-precedence-registries-before-artifacts.json", + "mode": "0o644", + "size": 46961, + "sha256": "ac2f616b4dffd4355e263813407dd4c7ec26c1c206b81bdfe7629a0b57ed44c8" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-forward.json", + "mode": "0o644", + "size": 47023, + "sha256": "2c201894ae0724568780e0147ced700c40e6d5577c980d9f834a85a65c6af937" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-malformed-record-sorts-last.json", + "mode": "0o644", + "size": 47038, + "sha256": "bcefb67872e63f98477369d9360659630cff7823878f305f8bf06bb4d551e6b0" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-only-malformed-record.json", + "mode": "0o644", + "size": 47037, + "sha256": "5a7f85a999d8e08f064a8b74fe7dccabe2b50bb1ff6458675261bba926d807c1" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-profile-precedes-digest-registries.json", + "mode": "0o644", + "size": 46972, + "sha256": "66489a988af8cd90d2a1cf31b5be745587b31202f236a0215716ac034b4a44e8" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registries-forward.json", + "mode": "0o644", + "size": 46929, + "sha256": "927384590d2fdba4be2d49e6642f3bf849485f33d0e99c5d197abf772419a18d" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registries-malformed-sorts-last.json", + "mode": "0o644", + "size": 47038, + "sha256": "8ef33de63b44086d49573823581650e444f2a93071c167b96585dbc2f44ab09f" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registries-only-malformed.json", + "mode": "0o644", + "size": 47019, + "sha256": "67aec4480fde142eb87d9dee32c470132cc1eba6cc36a3deeae89638678d29fd" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registries-reversed.json", + "mode": "0o644", + "size": 46929, + "sha256": "b76b6a14f070c6f45f84f62de11e745ec3df81aa0582bc848ee93c548ab1e189" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registries-swapped-forward.json", + "mode": "0o644", + "size": 46929, + "sha256": "862e07624e9a5014425b2dd4c142acda22967d8ea318a313d751d3c37efb2246" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registries-swapped-reversed.json", + "mode": "0o644", + "size": 46929, + "sha256": "965bb9f5623510d3c914e0ee75203a50e8ab53e2b59fa262e18837379c8002d8" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registry-digest-forward.json", + "mode": "0o644", + "size": 47033, + "sha256": "c7335387235aa44ec744b98c9d7c029eafbce71bf86ffdc7956ae167b7c454f4" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registry-digest-reversed.json", + "mode": "0o644", + "size": 47033, + "sha256": "011736b868ca5235d0a3fbe211e67c765d328e06d6d059709e508391c65a292e" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registry-digest-swapped-forward.json", + "mode": "0o644", + "size": 46973, + "sha256": "15fc47278093d7c48000b87db3765bc48eb67a31f527f5303810bb4b30373fda" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registry-digest-swapped-reversed.json", + "mode": "0o644", + "size": 46973, + "sha256": "f1869a386cbca5b609d7f51003bf1cf0232baee1151f73982c7668bd4421bd3e" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-reversed.json", + "mode": "0o644", + "size": 47023, + "sha256": "cc11bcf72654a48ed451d49f6ab385a6cbbd59c1b0a12e1234272811f816f8be" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-two-digest-mismatches-reversed.json", + "mode": "0o644", + "size": 47061, + "sha256": "899498936e2ba95a5875748014c76193265c096d7684190850ac6581b0a1c638" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-path-grant-absolute.json", + "mode": "0o644", + "size": 47285, + "sha256": "b2f22d443464d52d0e809f596fd4a286139b7d637b5b746f26ffc7a9d65840aa" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-plan-with-delegated-operations.json", + "mode": "0o644", + "size": 47030, + "sha256": "7927734520f92ee53f8d9cc3244fcaf40224c1ad00f21c3796983e541aa827f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-project-mission-with-parent.json", + "mode": "0o644", + "size": 47178, + "sha256": "d96eec739e15ddab9c1aec3573829a9293a8bfb03f66a0e4a28100fe97e21d56" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-project-registration-with-parent.json", + "mode": "0o644", + "size": 47187, + "sha256": "d62b0f3612e8680a083860c5f4e2ffa377b7b7a71e3ca410f9f57fdae196820a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-proposal-on-read.json", + "mode": "0o644", + "size": 50111, + "sha256": "74d3aed956fb0e1ed49d7bf1bdf0fc670a62e70d032aefcf5588107945b9897a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-proto-key.json", + "mode": "0o644", + "size": 47018, + "sha256": "3521338f24e902c9dbafaf1a0af9a8be203b997ca5ba4d3de7e6e5f42a3e4f93" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-agent-actor-null-execution.json", + "mode": "0o644", + "size": 47001, + "sha256": "6aacb4bae667501f38d97b9cbe459d09bc887f749c80be04311e3fad328772cc" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-bad-id.json", + "mode": "0o644", + "size": 46999, + "sha256": "c38770ccc41af4f357f3eebcb602dd56255a8a90c9899a75d9e9be3f30bd4ddc" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-bad-time.json", + "mode": "0o644", + "size": 46995, + "sha256": "df248c9a003deb6d7feb77c414ef67190c3cd0f2084997d2e41b09dfbc3f53cf" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-calendar-invalid.json", + "mode": "0o644", + "size": 46999, + "sha256": "5db137c0843d7b7c87d4b8e06a8a7612cb17a98874379c4da03e41a00a2ff709" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-criteria-duplicate.json", + "mode": "0o644", + "size": 47075, + "sha256": "06f42f587fcd9c8e36df97f67155a4f1ab6a39d28ad4a7998af4231be72490c6" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-criteria-empty.json", + "mode": "0o644", + "size": 46915, + "sha256": "7bc8fb98e35c689fe7ce73a184056e5be70e11191fd461e42db619b8b5a48f2b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-displayname-too-long.json", + "mode": "0o644", + "size": 47118, + "sha256": "bbe6bfb36597210ea692f67bc35ea6f6409388beafd9e2e6af56bd57344db3c3" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-leap-second.json", + "mode": "0o644", + "size": 46999, + "sha256": "544f5f84a78021fa197ec8507edeefca58ca2cff18ca23284e9ee3c1d612b8df" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-missing-field.json", + "mode": "0o644", + "size": 46891, + "sha256": "aa520c95f7af8e81e0242711e33a610820908b7b0a7947977dbb62ff6bf039ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-rev1-with-supersedes.json", + "mode": "0o644", + "size": 47195, + "sha256": "c06fa51658d8a505e8836c2016d671955997f0ccc84ef8fa33e68084011ad9aa" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-status-enum.json", + "mode": "0o644", + "size": 46997, + "sha256": "8040becb0d4fc9cfef1e52247f0cd44d5b3f6fd9bb4dded8fa73baa9c1175b5b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-unknown-field.json", + "mode": "0o644", + "size": 47020, + "sha256": "a6702f7f22a94469084f05f79fce624445feae9909dc98e5912268c91e9683c4" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-content-non-ascii.json", + "mode": "0o644", + "size": 47002, + "sha256": "7b1cf22485682d612a4e74aa24a133ea859d1183958bfd78d9084d3dcd4cc179" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-digest-mismatch.json", + "mode": "0o644", + "size": 47030, + "sha256": "b3cb2f63220077df78bd0a83023300b8031c6b84afca9bbcda7d6ddf9989671f" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-missing-content.json", + "mode": "0o644", + "size": 46504, + "sha256": "393d89a31cf86a95e43a6a15cf950c382949a2aa7533998023865454b6c56461" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-plain-with-content.json", + "mode": "0o644", + "size": 48289, + "sha256": "de7fceecac43163b591300dcb29b18206e728edd9bd7d8c20a6e69c14366d43f" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-restrictions-none-with-endpoints.json", + "mode": "0o644", + "size": 47412, + "sha256": "09ece43156218d02e9b2ae467ff76310bd7e85080ed4a8ef55886e41ead9f5ed" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-restrictions-unknown-operation.json", + "mode": "0o644", + "size": 47184, + "sha256": "6bec9d250fa308cf524128d6a37db7c23ba53f27f269152833c5b9f0caafa56a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-simulation-false.json", + "mode": "0o644", + "size": 47000, + "sha256": "557da19b296380c61ce200473a11173a0805846c0496a2619b1c0d1757c2e15b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-backslash.json", + "mode": "0o644", + "size": 47052, + "sha256": "76668ec2c1bb0341ed5f1ab96e9f37d5201bafb4483e82af88f5fbad4ca24f26" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-control-char.json", + "mode": "0o644", + "size": 47061, + "sha256": "05fb3da905f93c975fbf6f5f8d7effa0df45997ba528d8070ffbd3cb915bf135" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-dotdot.json", + "mode": "0o644", + "size": 47063, + "sha256": "aeffd2e5d0362fa93b5b50445426dbfff2ee40056e128ae2c79c6fb19deca954" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-empty-segment.json", + "mode": "0o644", + "size": 47052, + "sha256": "3efdcae8c0691f77bc896ff5f6839882ac6ba26beb8ebe72f3579dd877980804" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-line-separator-echo-ok.json", + "mode": "0o644", + "size": 47055, + "sha256": "8fcee4457379e23fb2f92e92ab17a6e586acf95f1e504fed6a9b94ad3f783553" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-unicode-ok.json", + "mode": "0o644", + "size": 47064, + "sha256": "8040178585bb71bfb7a5e73b1d236d30bfee4358d1ec84d276705492d3a70055" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-wrong-root.json", + "mode": "0o644", + "size": 47042, + "sha256": "7ca0872b7e035b83d8adccfff7fed1669881629c9e5d248f82a9231120423a27" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-too-many-records.json", + "mode": "0o644", + "size": 385409, + "sha256": "69d89b94922c81f8a6aabfcaaeaf18cc64c0dfcf7399e0879dc2e35c99b863e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unknown-kind.json", + "mode": "0o644", + "size": 47485, + "sha256": "15abdcf2fab896e477facf78d6f58c237089d321480cf483ef03cac48d5756e6" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unknown-top-field.json", + "mode": "0o644", + "size": 47013, + "sha256": "fb62948772ee0297f951a53636667e166f6640dde611efe82b2f01103088d7cf" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unsupported-kind-session.json", + "mode": "0o644", + "size": 47486, + "sha256": "c2c6549b1088b007b031ebf30e56c7bc37503f7201f19f577e8a539e1c539da6" + }, + { + "path": "scripts/foundation/fixtures/bundles/struct-order-delegation-inputs-forward.json", + "mode": "0o644", + "size": 53339, + "sha256": "5ee150d138cd8f58683f058a264bc5af0806857880de1b4026cd65279b0668cb" + }, + { + "path": "scripts/foundation/fixtures/bundles/struct-order-delegation-inputs-reversed.json", + "mode": "0o644", + "size": 53339, + "sha256": "a3ac4ad161b7a465943bfe5d61a4f7aaf46f3a43cea8ce3cfe112b98b740c241" + }, + { + "path": "scripts/foundation/fixtures/bundles/taskless-file-read.json", + "mode": "0o644", + "size": 46875, + "sha256": "54b2d827b76e289754dd89c2b37a3bf22abe6bfe064b4ba9e53058eb627c8f9d" + }, + { + "path": "scripts/foundation/fixtures/bundles/taskless-work-read.json", + "mode": "0o644", + "size": 46814, + "sha256": "5eac10a34626b91eb881a86adb30042296df700218fd273a5cc1560fd205e61a" + }, + { + "path": "scripts/foundation/fixtures/bundles/work-parent-project-mission.json", + "mode": "0o644", + "size": 46964, + "sha256": "f13594287cf8a240bffcf47be56ed52c73f0c37343841b06aa5822aef81b8c69" + } + ], + "fixtures-raw": [ + { + "path": "scripts/foundation/fixtures/raw/raw-array-too-long.json", + "mode": "0o644", + "size": 2051, + "sha256": "617dbb4c661baa3f145bdf28ac60df6b868c172ddad965c8733e704204048b8b" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-bom-prefix.json", + "mode": "0o644", + "size": 47001, + "sha256": "b4a98e270b4024cb974cca5998a8c96e179441beb07c466649d67fc39abd7446" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-constructor-key.json", + "mode": "0o644", + "size": 50, + "sha256": "db542a3baaf43c88776789470e9df3c74409d6529ea21c503673229737ac5315" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-depth-33.json", + "mode": "0o644", + "size": 66, + "sha256": "ffba7a731546fa3b609b0503e5b88d1523824b0f082f1c2f9166b08b57933566" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-duplicate-key.json", + "mode": "0o644", + "size": 40, + "sha256": "d260762a322a0c015f31ea99777551042acf8ced23a8471d886376e8a5805063" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-empty-file.json", + "mode": "0o644", + "size": 0, + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-exponent.json", + "mode": "0o644", + "size": 47000, + "sha256": "909fe77e9bc4489366666eb4e16c5d966520bf753560ca2705a56cec319f2799" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-fraction-number.json", + "mode": "0o644", + "size": 47000, + "sha256": "d0ca3b6fcf776b9f605ae35ee00642e4dd78a4396124f46fe24a0d41fa10c174" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-invalid-utf8.json", + "mode": "0o644", + "size": 9, + "sha256": "375eaa6515e23b024e4feb1a132beaf9e35b865e54cca181d01a7a0527ea9791" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-lone-escape-surrogate.json", + "mode": "0o644", + "size": 15, + "sha256": "f6ce88b5d0b4f17a625764062775db270c469f9cdc94f09e66828315f5c547a9" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-negative-zero.json", + "mode": "0o644", + "size": 46999, + "sha256": "448a56829ffa3d4b120dc9437f7df4349a481e540a802e74b64907f0c5a5f026" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-not-object.json", + "mode": "0o644", + "size": 2, + "sha256": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-oversize-file.json", + "mode": "0o644", + "size": 1048577, + "sha256": "9fa2b407b667e7ce77587038b445ff3df704f6972572708dc18cf355f13a45f4" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-proto-key.json", + "mode": "0o644", + "size": 33, + "sha256": "9a62fc3db4305c0079d42bf9bbf062fc1f60e2cc5eec25a42164350d88550547" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-raw-control-in-string.json", + "mode": "0o644", + "size": 12, + "sha256": "d0e097db994e029efa27ecc5a3da2213f203f30cbb49d12d10c1b297ead8d9aa" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-string-too-long.json", + "mode": "0o644", + "size": 4106, + "sha256": "15dd16f02a269a3b62326cc91ae8199c23d756a42d986cca61c83f68ce519485" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-trailing-content.json", + "mode": "0o644", + "size": 47001, + "sha256": "433f22797e2c1eab343b1711c80c9249053487dba9df986cfcf4759356d7cf60" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-unsafe-integer.json", + "mode": "0o644", + "size": 47013, + "sha256": "daa5145f11272cbfcdc3115e6d397a6a82830099ad6c2db5d25ee0e16c5c8ad1" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-utf8-surrogate.json", + "mode": "0o644", + "size": 10, + "sha256": "957a49305a06fd66d2ef727af1f8d7fde39456593641835c0b640947d18895ac" + } + ], + "fixtures-meta": [ + { + "path": "scripts/foundation/fixtures/README.md", + "mode": "0o644", + "size": 5085, + "sha256": "f3d548908f8bde629525ac0be90df40bbfaf01faff79980474ef4164f306ec7e" + }, + { + "path": "scripts/foundation/fixtures/build-fixtures.mjs", + "mode": "0o644", + "size": 85914, + "sha256": "273f3f12d1911aaa067a1046bbea20c5eb27b5b80c9913a833c0863b8e06ab7c" + }, + { + "path": "scripts/foundation/fixtures/index.json", + "mode": "0o644", + "size": 119273, + "sha256": "31c6fab4d27f3e9c3e26cdcf343171f9c744404d359d042c80dc5a8566a57ea0" + } + ], + "suite": [ + { + "path": "scripts/test-foundation.sh", + "mode": "0o755", + "size": 8493, + "sha256": "6f808ea8f4a021e30b4c22a697ad62e28a6fac33a4370f93c02ec18505ca972c" + } + ] + } +} diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r6.json b/docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r6.json new file mode 100644 index 00000000..1d759db9 --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r6.json @@ -0,0 +1,2398 @@ +{ + "candidate": "foundation-inspector rocko build r6 (FI-ROCKO-8)", + "generatedBy": "scratchpad/make-manifest-r6.py (machine-generated; no hand-transcribed hashes)", + "generatedAt": "2026-09-07T15:32:37Z", + "git": { + "head": "9a5fbdbda74b16adf488fe28138b2ba69ea5e669", + "branch": "main", + "note": "all candidate files untracked; no staging/commit/push" + }, + "toolchain": { + "node": "v26.8.1", + "python": "3.12.8", + "jsonschema": "4.26.0", + "kernel": "Linux 7.2.2-1-cachyos", + "strftime_year_999": "999" + }, + "pinnedInputs": { + "docs/plans/2026-09-06_foundation-inspector-charter.md": "19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6", + "docs/plans/foundation-v1-candidate/records.schema.json": "05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6", + "docs/plans/foundation-v1-candidate/check.py": "82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607", + "docs/plans/foundation-v1-candidate/records.fixtures.json": "d433d06da5cd38baf9e51c8857244ee70375db3b68e02a5325a6d1c2cc47da85", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-request.md": "90a1f329e859152d4ce8e157cbd6c56e6bcced16b4ed757822d2309514fa9a15", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build.md": "857470d97af6aeae4e7d7942c2a1d8455bfcda74ff68b8e1dc4ba8d066521fa4", + "docs/plans/reviews/2026-09-06_foundation-inspector-build-admission-findings.md": "8d9f7aab3b3bdf79345a07ba3595b966982b7667714ac7e3f669d65e328ca3d5", + "docs/plans/reviews/2026-09-06_foundation-inspector-code-review-gates.md": "6e7980186b2f49dec93d300f3681afd397ec7349c90806759a995695d9077b24", + "docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-addendum.md": "afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5", + "docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-verdict.md": "03c979b77cc6b03b6685ba51ed1ce24c3f1d7b274ce8f772263a103670050da7", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r2.md": "0dabd82fffdc3a56ebf9a1d8b851832c3acee2cb9332892bde9dbb13151d5e19", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r2.json": "2e8b5f1998a3be6cc7fcc3fba308724d2a29ca166c08f005e1bca88ddbc14196", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r3.md": "ec0444c94c9caf16472fdba1ff3fbc767dffd1a798b9a2da837598c9f4b25508", + "docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r3.json": "3c2253b6c9f31e448c77aaac53977d41baecfb30e15845dcfffd8dc694428547", + "docs/plans/reviews/2026-09-06_foundation-inspector-code-verdict.md": "e4cc5970aab20240e6ea3a9a1513ef942ff167fefbb03356b9a32c89999adb3d", + "docs/plans/reviews/2026-09-07_foundation-inspector-corrections-request.md": "35c237f5c001832a0cfed23b03ff7530ffa78443612ffe11130fe456b968bd61", + "docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r4.md": "dff9f676ad0a97f6333a59d527e02ed55e7bcdca986fe9c1488280b84d4e677f", + "docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r4.json": "2a2e885f9df3dd626a09fe5db6e28af67c289e54660872031c18f8aa40cb0826", + "docs/plans/reviews/2026-09-07_foundation-inspector-ordering-followup.md": "e93a65b94fd4df8bd6e74c2f38afaf02e0f86b36632ff5a820fd8ac464c22101", + "docs/plans/reviews/2026-09-07_foundation-inspector-demo-test-gate-decision.md": "62cea74bea59e69f29c8a29a9c0311fdc6feffa2c337bc6a141db55149204898", + "docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r5.md": "17c67427dfdf1bc5dac491c4d0223928e87fdfc67a26175ac239eb2b2f7b7dec", + "docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r5.json": "a63bb103e4cfe51bbd8a42cd95545f935ac83c1da51cf469298375cf94ced135", + "docs/plans/reviews/2026-09-07_foundation-inspector-code-verdict-r5.md": "154e7b5d804c059d6fec4c936c78e4ae33bb7fc273ba3a5eec7b00d0a9ce1e59" + }, + "counts": { + "source": 6, + "tests": 5, + "fixtures-demo": 20, + "fixtures-bundles": 328, + "fixtures-raw": 19, + "fixtures-meta": 3, + "suite": 1, + "total": 382 + }, + "aggregates": [ + { + "prefix": "scripts/foundation/fixtures/", + "files": 370, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "e2b6b1401f87ea8dcba4e8e4c7dd3f010474c6ec222edf433dde9434697d54bf" + }, + { + "prefix": "scripts/foundation/fixtures/bundles/", + "files": 328, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "00834464a96622f51d6d68070c990228aa7263d367806687b17e7d7f2d668fa9" + }, + { + "prefix": "scripts/foundation/fixtures/raw/", + "files": 19, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "dbc620a7247aef198a3f502002d73fa8d598a5fc939f4bdb5352467fa50360d3" + }, + { + "prefix": "scripts/foundation/fixtures/demo/", + "files": 20, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "6a32862b8985e39a339a504338b3fb94558890152e04b64c155ebdc77e7a8956" + }, + { + "prefix": "scripts/foundation/", + "files": 380, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "e9d406b3ec7a3918aeab94fe509d158a8f4593ea4fc3218ce06f3834b92b3dff" + }, + { + "prefix": "scripts/", + "files": 382, + "method": "sha256 of the LC_ALL=C sorted `sha256sum` listing (repo-relative paths)", + "sha256": "7e86afc100963579b26b88676d45ba0696407e7e7c9f185b27501002191cbc4e" + } + ], + "files": { + "source": [ + { + "path": "scripts/foundation-inspect.mjs", + "mode": "0o644", + "size": 8597, + "sha256": "dad369490ca8396d3b4a7bd4a1b7fa87b677a2b8cf991bf61672d446e5aa3c93" + }, + { + "path": "scripts/foundation/canonical.mjs", + "mode": "0o644", + "size": 2936, + "sha256": "a7760882c4c49992b9d702eb125a3e8f63048be543516b0eba61231018b90172" + }, + { + "path": "scripts/foundation/resolve.mjs", + "mode": "0o644", + "size": 88242, + "sha256": "c4951014828080caf9a5038845104afdac02465af10e94a2fddd3558b29621a3" + }, + { + "path": "scripts/foundation/strict-json.mjs", + "mode": "0o644", + "size": 10437, + "sha256": "7c31fe6be8cd29ee07662a21bb2e490a2ec799e263dec981ee257fcf7e6f6ebf" + }, + { + "path": "scripts/foundation/validate-record.mjs", + "mode": "0o644", + "size": 3040, + "sha256": "dcff28b53501b68fe7368adcbf02db0526ab4273d1c1c42e47df9a78a0bd9b4b" + }, + { + "path": "scripts/foundation/verify-schema.py", + "mode": "0o644", + "size": 28331, + "sha256": "e5fce462abd0e8c5be4e4543fd31146a35aba41a653d2aa105c28ca5a20deb67" + } + ], + "tests": [ + { + "path": "scripts/foundation/canonical.test.mjs", + "mode": "0o644", + "size": 4197, + "sha256": "f504321983b2c41eff5af7e6dc27e40e360e0aae299d0a9abc369c743f5384f7" + }, + { + "path": "scripts/foundation/cli.test.mjs", + "mode": "0o644", + "size": 14666, + "sha256": "566abb49770b5d23ea74da663a0c64e37b078d1a793acd313e56e8612fbf05c8" + }, + { + "path": "scripts/foundation/fixtures.test.mjs", + "mode": "0o644", + "size": 5421, + "sha256": "94e7508717efcafd11585a288a5d791e1e48a993794e2d470c6097f904befdb3" + }, + { + "path": "scripts/foundation/resolve.test.mjs", + "mode": "0o644", + "size": 54854, + "sha256": "dca397f268cfd39feffae3839f57afc61fe74ca324645dd1d916219f38d4b15b" + }, + { + "path": "scripts/foundation/strict-json.test.mjs", + "mode": "0o644", + "size": 6837, + "sha256": "b40488edfc4eba6962e8c0949ddf1f92fdc15d630b7e9bdff72ac6d06bdb092e" + } + ], + "fixtures-demo": [ + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.json", + "mode": "0o644", + "size": 731, + "sha256": "c44b0935ed329c1a381f986997b1bc4be702fc4229166d8a0b49e4e80f9b2fa8" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.expected.txt", + "mode": "0o644", + "size": 393, + "sha256": "c2fd118d44d21cbd709d30a2c2be2603740a81e628aa9d32f95d6eaf06d3a9a6" + }, + { + "path": "scripts/foundation/fixtures/demo/adm-registration-revoked.json", + "mode": "0o644", + "size": 48279, + "sha256": "ff7b859cd959876b2b6ede97fff90383a38acde765a16294b095ba220290c579" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.json", + "mode": "0o644", + "size": 1082, + "sha256": "ecf8313993ca27450d1753c6178be1a063fb0637f14be8f091de923b8b722516" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.expected.txt", + "mode": "0o644", + "size": 536, + "sha256": "0e2807ab56d15670c51c8ad4a43f33b36c5672799937561f39e20c6e93be1dda" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-change-w1.json", + "mode": "0o644", + "size": 50119, + "sha256": "54aad9047f7fe86892889ead543403c42986f591722d0dd23e0e027c3b7191d5" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.json", + "mode": "0o644", + "size": 767, + "sha256": "7ea412916404ec948c94e929cc7b2ce120b394944c66c7bfcc811d0721dd82db" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.expected.txt", + "mode": "0o644", + "size": 390, + "sha256": "2cdd6d4e162fa904b03e8f8a88553a03065ac7fb646baabf21625d4f5962a79b" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-file-change-src.json", + "mode": "0o644", + "size": 47060, + "sha256": "7c0948d39abd3f1eeb0b0990766cbf584959712000faacaf47ae0d3501def3cc" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.json", + "mode": "0o644", + "size": 706, + "sha256": "42055bda71075ba5c710f011f83d470228f18097d93ac5585ba1b534cba0ef2a" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.expected.txt", + "mode": "0o644", + "size": 370, + "sha256": "8ba4bbe92819ac8912c72e7c635730e99eac7916c0d924fc81b75115b5939b53" + }, + { + "path": "scripts/foundation/fixtures/demo/demo-read-w1.json", + "mode": "0o644", + "size": 46999, + "sha256": "7a3cfc58c1356cc2a986e0a6ed8f9f2dffbc33277ea1b7800020bfc55624b750" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.exit", + "mode": "0o644", + "size": 2, + "sha256": "1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.json", + "mode": "0o644", + "size": 1060, + "sha256": "742e479ddbb4cf2138d49ec0ac40cd038b6c20f8b9c0e2daffc5a859db9f4145" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.txt", + "mode": "0o644", + "size": 514, + "sha256": "388983ad6e4e31db6f5a688773ff2bf07d44d7ffe530eb7870e729a0f546278d" + }, + { + "path": "scripts/foundation/fixtures/demo/prop-message-is-not-authority.json", + "mode": "0o644", + "size": 49975, + "sha256": "f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab" + } + ], + "fixtures-bundles": [ + { + "path": "scripts/foundation/fixtures/bundles/adm-agent-disabled.json", + "mode": "0o644", + "size": 47000, + "sha256": "cb92e2f7c19b8d8133389f62393228c8d5471f1c21ee46166392ce7dd31a9c32" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-agent-policy-missing.json", + "mode": "0o644", + "size": 45528, + "sha256": "ace29f2529cc16edf21ccd828cb371febf1690c6c55fb9db6e129e7c19057799" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-artifact-undeclared.json", + "mode": "0o644", + "size": 46843, + "sha256": "50ddfbd0e192521c0bc146268d00b9a28fb32d28ec2c9cc7e519677f16387bfa" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assigned-task-without-work-read-read-op.json", + "mode": "0o644", + "size": 46859, + "sha256": "9f5aaa486ae3de752803cf58441f0dbc90480ac002225a6cdee043516155396f" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assigned-task-without-work-read.json", + "mode": "0o644", + "size": 46863, + "sha256": "35ee45e648387b9a8b0aa81b201b4eff61eb5a15bdc6eea30ecbfacecae77bd9" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-ended.json", + "mode": "0o644", + "size": 47003, + "sha256": "45e10ae6b5fc71617db1303155cac53e26854bf00524a45756cfcec066e9ae6e" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-other-subject.json", + "mode": "0o644", + "size": 47001, + "sha256": "3c9abc1bb5be9649de7c9c82bf50766ab533e35f715cc8658a5b256dd68d032a" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-rejected.json", + "mode": "0o644", + "size": 46999, + "sha256": "13127e14aa12c3d1b4ab7864bb2b1495c271aaf11c6d952105cb1f0a01c79181" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-intent-stale.json", + "mode": "0o644", + "size": 48755, + "sha256": "297d062015d3fec28a8bdb1415106be963dd70ad7b367f00e2623ebfca7e0985" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-other-agent.json", + "mode": "0o644", + "size": 46999, + "sha256": "0f3f15457115e8ecc5f629b6d818f42491f0e484a01eaa981f053c71143e8c46" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-other-workspace.json", + "mode": "0o644", + "size": 46999, + "sha256": "c1a0021541ebc6c27a9f9b9ba9d0c4f062366a92bc52733384ea483b9a93b007" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-paused.json", + "mode": "0o644", + "size": 46997, + "sha256": "956fd1008a5161007bf74eb5eabd7dbcb23fd05236fac7122cf8d1733d18020b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-required-for-change.json", + "mode": "0o644", + "size": 46868, + "sha256": "d58b71364fa5d900fad552817f3e5ca87f8c2330972ea8fae40c817b31bb6eb3" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-assignment-stale.json", + "mode": "0o644", + "size": 48276, + "sha256": "ee369230403bc139e32e15eb121f623975c657bde5801adc2608bf704aca9b50" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-authorization-undeclared.json", + "mode": "0o644", + "size": 46999, + "sha256": "1bfc562d60c31c7dddaa43e0976861b30b64a67b69d338ec307c0936e597da74" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-consulted-work-not-readable.json", + "mode": "0o644", + "size": 47442, + "sha256": "e6f6edb8de4fa83895e854be796e7321c1c195c4431f6e3a56c11bdc804f38a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-cross-project-dependency.json", + "mode": "0o644", + "size": 47247, + "sha256": "e30e939819f7b2e05fd42efd02a22d8752e9cdb0fba82ed45d1b8bc93f128324" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-cross-workspace-mission.json", + "mode": "0o644", + "size": 46999, + "sha256": "88bca4ecf7f2cae37d92e0c6656b51c812a0df4546a44eeceb4494331afd63ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-authorization-undeclared.json", + "mode": "0o644", + "size": 46999, + "sha256": "931e62561be2a6391d31fe3dc262367241d07e87ecc3a9f013fd7952a4949fd4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-grants-nothing.json", + "mode": "0o644", + "size": 48729, + "sha256": "39c227de39c473f631ff94b56bcbd5b113de9364f9bddd3488ac3926eaec66a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-not-accepted-change.json", + "mode": "0o644", + "size": 47051, + "sha256": "bb9bcc18a733912ede338804219dd3316ff8240e0206de2d182051394721dc2d" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-dependency-stale.json", + "mode": "0o644", + "size": 48209, + "sha256": "b46f5667dfa0b652e9afe35b7895affeeea309a4c66635b3c66b6bb10a104f55" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-authorization-undeclared.json", + "mode": "0o644", + "size": 46999, + "sha256": "1c8adc38492eb91fe2928690354ed27a7d6b1fc0d411de9d3e0f9180b5b1c5b8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-blocked.json", + "mode": "0o644", + "size": 47000, + "sha256": "6fd722efaacb595940505ff3a0422ed0dcb4121460d1e1ead9d82ad9f1d2c400" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-mission-stale.json", + "mode": "0o644", + "size": 48106, + "sha256": "034e7d5e51b02b19fb44db4840a7dfe31934fa100d227e96bae9b8522d7b0b17" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-agent-policy.json", + "mode": "0o644", + "size": 47055, + "sha256": "87f23f0296c0a2b309f35daca97a88630e391de09b1e3f19e6ec4710bb50473b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-execution.json", + "mode": "0o644", + "size": 47442, + "sha256": "d1921054dc83fc9c4b999cf12914b4eac51c814264bd96a370c80af7ace3d134" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-operation-not-permitted-role.json", + "mode": "0o644", + "size": 47053, + "sha256": "41429de9ab146264b5b887ec8ee303cb373b13fdcc892d2ab8dd17b95b8babaa" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-parent-mission-accepted.json", + "mode": "0o644", + "size": 47001, + "sha256": "76b4fa2904c8bc4400b7a7b4ad92a9b5d0d0ddfd6645d18dd613b8a45b1bebd4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-parent-mission-stale.json", + "mode": "0o644", + "size": 47863, + "sha256": "8f85116b9278024d257bcda57a4ce0e0526744e9a73df53f0106de0d29a87062" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-prefix-string.json", + "mode": "0o644", + "size": 47057, + "sha256": "303379a7fd5315ffa38929af357e38447e4d5419c61ab4602dab42b79a63cc9b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-read-execution.json", + "mode": "0o644", + "size": 47351, + "sha256": "0d31922e61a2a433377dd398cae230f638b694a91e6a36795caad33d197d2112" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-task-narrows.json", + "mode": "0o644", + "size": 47502, + "sha256": "623ee44ebe8edb0943bb98b89a0ece148965fce669bd12202ff61bfa05068e61" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-path-not-permitted-write-outside.json", + "mode": "0o644", + "size": 47057, + "sha256": "fb40436ff51935c811e044a2fb01c6b160d88f48dfb4488368702314ae2fe087" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-policy-ceiling-stale.json", + "mode": "0o644", + "size": 47546, + "sha256": "7d0dd0314b7cdaa73031e069e6db0ba32f219b5b5b1e57ca231602e46c7c99d0" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-policy-missing.json", + "mode": "0o644", + "size": 47001, + "sha256": "01915e487576036117d92eeaeabfd8bcde56501cfe7c26e8dee5033fa747afa8" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-registration-missing.json", + "mode": "0o644", + "size": 45959, + "sha256": "9fe8fc27cc6c83e2e85fbe449a6c74ca78a6c6f8101c60f7a37a6e01c2166086" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-project-retired.json", + "mode": "0o644", + "size": 47000, + "sha256": "b945bf5863105512d2ed75427eeb94037c0a66a52e77bccb4b1dbc2ecbc5f91f" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-ambiguous.json", + "mode": "0o644", + "size": 48077, + "sha256": "cd7322b10c7bda7ef5dccd2c0df7c472412ba35aaa0beb25de8a7b399f99ef8e" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-parent-not-current.json", + "mode": "0o644", + "size": 47863, + "sha256": "8283f6bd81ac0bb2d11fc46c0ee759e85ae87c4dc5f54a22ccafa41559faaa98" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-parent-stale.json", + "mode": "0o644", + "size": 48026, + "sha256": "e9dae21b733ab51636b8421fbbf41adb74aba250b4319ba8097d2aeff7b5c7ca" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registration-revoked.json", + "mode": "0o644", + "size": 48279, + "sha256": "ff7b859cd959876b2b6ede97fff90383a38acde765a16294b095ba220290c579" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-digest-mismatch.json", + "mode": "0o644", + "size": 46999, + "sha256": "51d0c87a91037a04b0a03ad5d817855d6b866b4dd63c0b378abaf98941e24fed" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-endpoint-declared.json", + "mode": "0o644", + "size": 47703, + "sha256": "37f537ffbca59aecd79c67b2ae72ac8fc7edd12e0205eab89be52af87144c1a0" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-agent-refs.json", + "mode": "0o644", + "size": 46470, + "sha256": "e39a153882ea7461381424424befbfc95e9c60bfb32094823126b45042efe9f1" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-endpoint-execution.json", + "mode": "0o644", + "size": 47529, + "sha256": "46c2ba7715c6ab54665a50b9f46d96af2fa65fa1e42f52798b40523cd2da5ef9" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-endpoint-task.json", + "mode": "0o644", + "size": 47554, + "sha256": "16e43339ec7135e4af64706c0cb49cf7e9bf6c7b3e5b77ad3cd406be3fc4606b" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-instruction.json", + "mode": "0o644", + "size": 47227, + "sha256": "f2c60d88af3cc75daf41b2dd5dc5612b21d77876cabda28940f50fbaf85d5f00" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-settings.json", + "mode": "0o644", + "size": 46822, + "sha256": "c01760a2beb23fcb01cec99a4c95bf1398580e0c465ac1742721105ea0524058" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-skill.json", + "mode": "0o644", + "size": 47227, + "sha256": "7bf73e0154f78b1cdbb206e56745d2307a8cdebdcabfcd13426e6c3d6ee5e2c5" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-missing-soul.json", + "mode": "0o644", + "size": 46818, + "sha256": "dbfa43f96b4b6a0cf74dcf6389b030b58bcdfeda876d9e439e0d17a35e5c65fb" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-revision-mismatch.json", + "mode": "0o644", + "size": 46999, + "sha256": "6b6de37b0fc56e455015b054e8c5774cd6691445a1212189065a91cde0ede1e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-registry-declaration-unselected-agent-ignored.json", + "mode": "0o644", + "size": 46999, + "sha256": "db44fa0b4d1f2fa2fe2bc3f144d78d729decbaf335dbbff0f2015e8118042c60" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-scope-role-missing.json", + "mode": "0o644", + "size": 46321, + "sha256": "49dcd13d523295c852fe5327b1227ac40b0d1503c836ff9b236800e4abbee5bc" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-agent-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "c2bde4733d09f154ff913dad96bdad19b0ab01e6fcf7bf8b565b409ca86f103a" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-project-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "59340a02bf4759a88bd89d65790e8cd7108d7e6516a4b737c1f07f362f86f4a4" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-selected-workspace-missing.json", + "mode": "0o644", + "size": 46814, + "sha256": "aef0bfbb5e5605b48e9e2ecc7a358ea9cb0209f2687703a1b2f1701fd809c7ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-intent-not-plan.json", + "mode": "0o644", + "size": 47003, + "sha256": "d5a260a2ad091b9ff23aa3abb0ab59b9712467601e49b1e18f2aadad26082288" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-intent-stale.json", + "mode": "0o644", + "size": 48755, + "sha256": "5323e36a3123fe5cf995de10e5fba493f5935fbf3f7dfde7c95a56a9bae94801" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-proposed.json", + "mode": "0o644", + "size": 47001, + "sha256": "9201feda75c3c5069748c5f85ec065beb173884e4e5146045de01577ec2aeb61" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-task-ref-stale.json", + "mode": "0o644", + "size": 48667, + "sha256": "5f59548d4ae2363277aa1ac15a1b8bfa29fa89bd3547c741138b1e34531ac8e3" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-unconsulted-authorization-ignored.json", + "mode": "0o644", + "size": 46999, + "sha256": "b44818b153c93e9ad7719b74d962f38ca3bf2e68adbae0a4af0c9407c09ced85" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-policy-missing.json", + "mode": "0o644", + "size": 47001, + "sha256": "a0810fc2d9e8103e8c6065d977e729d7aad3cd8ee22851ab9486b93912ccbb80" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-registration-missing.json", + "mode": "0o644", + "size": 45740, + "sha256": "635dfad244da0d1da7cc3c12dc6a6b5983cf16526af12f6c104d96efed81377c" + }, + { + "path": "scripts/foundation/fixtures/bundles/adm-workspace-retiring.json", + "mode": "0o644", + "size": 47001, + "sha256": "6c229ce8d707d8221541362a93c36a7d32f46f8032cdc298d759aeefb9616e7a" + }, + { + "path": "scripts/foundation/fixtures/bundles/assigned-task-only-with-work-read.json", + "mode": "0o644", + "size": 46886, + "sha256": "3c7be7502592647259c5dd2e7c6675cb979ba0010aa103c47a0a11f0c18ce255" + }, + { + "path": "scripts/foundation/fixtures/bundles/continuity-revision-gap.json", + "mode": "0o644", + "size": 48201, + "sha256": "853129ae49f83ac334a45cd36e9ec4b2970f3fd5060794f0402f8459c9d814b1" + }, + { + "path": "scripts/foundation/fixtures/bundles/continuity-supersedes-other-identity.json", + "mode": "0o644", + "size": 48201, + "sha256": "475ff6eac6b455d305b9af1dbbdf15c09fe308240416dcee67890bba926ddb9b" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-acyclic-versioned-history-file-change.json", + "mode": "0o644", + "size": 54476, + "sha256": "e3dd1cd34e24c4d9ba0354203b7754c9e045966f0503d28ae1912e4e89eb2d15" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-acyclic-versioned-history.json", + "mode": "0o644", + "size": 54415, + "sha256": "05598f3c9fd10cb81d7c108eb343e42ecb8def4dc3e312367335e89265447de1" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-cross-revision.json", + "mode": "0o644", + "size": 54675, + "sha256": "3d85b8708f6b5b1f73c01bd5814e0d30184b966e9646391209bb632ec1ec3d76" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-pair.json", + "mode": "0o644", + "size": 47255, + "sha256": "e87ca56e0c3ae241dfe7d6c61e3841877a8bbe79b80fbbf9dc48f938a706feda" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-dependency-self.json", + "mode": "0o644", + "size": 46995, + "sha256": "419980fc700a4d4870a3aeef78948d1acae91aac62769f73bde3dae5051fb956" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-mission-parent-old-revision-only.json", + "mode": "0o644", + "size": 48141, + "sha256": "55f3e4b72234c9d1535db7fec65347f01c827125a65f50b1df614d9d80418925" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-mission-parent-previous-revision-not-a-cycle.json", + "mode": "0o644", + "size": 48141, + "sha256": "c7bea20df7a6d3c294c46ab9982e27540760cc7ef2b29944340c8f8feec26128" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-mission-self-parent.json", + "mode": "0o644", + "size": 47034, + "sha256": "90c872b66ed4a190bb29bf6c8c1c40dada8cc98211893393ea0519c399d13027" + }, + { + "path": "scripts/foundation/fixtures/bundles/cycle-supersedes-self-rev2.json", + "mode": "0o644", + "size": 47195, + "sha256": "f717ef0f14db090af156a3f08a2f1268f55f5aa9418aafe7dbc5916d826465b5" + }, + { + "path": "scripts/foundation/fixtures/bundles/deleg-approved-file-read.json", + "mode": "0o644", + "size": 50277, + "sha256": "4d1564ad708acfac940fcbbeff548fad649dbc08c1bd3708c1af86f756f1800e" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-change-w1.json", + "mode": "0o644", + "size": 50119, + "sha256": "54aad9047f7fe86892889ead543403c42986f591722d0dd23e0e027c3b7191d5" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-file-change-src.json", + "mode": "0o644", + "size": 47060, + "sha256": "7c0948d39abd3f1eeb0b0990766cbf584959712000faacaf47ae0d3501def3cc" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-file-read-src.json", + "mode": "0o644", + "size": 47058, + "sha256": "0b987af8fa79f322db409b7071f65f2ddfdac782f726dcb88e12c32b61c0a526" + }, + { + "path": "scripts/foundation/fixtures/bundles/demo-read-w1.json", + "mode": "0o644", + "size": 46999, + "sha256": "7a3cfc58c1356cc2a986e0a6ed8f9f2dffbc33277ea1b7800020bfc55624b750" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-artifact-identity.json", + "mode": "0o644", + "size": 47155, + "sha256": "5a816c1cb4e902b5c8bf85cd18c6215c624cae83f7dac2cbbd97b1da9541bd85" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-authorization.json", + "mode": "0o644", + "size": 47043, + "sha256": "814dcc1d5097c42a2066eb7aa1560f24a2580ed4434ede20e8cf492d84ab0b44" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-delegation-input.json", + "mode": "0o644", + "size": 51563, + "sha256": "2a1ba16ae05c25c4d9d6960cb8641d29f5de322046400af6658cbbeff1b9186d" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-order-delegation-inputs-reversed.json", + "mode": "0o644", + "size": 54785, + "sha256": "97ac80408cab9eb70315486d740ef963f89b30f54cc0e4d7f2a49e6e865c3251" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-order-registries-precede-artifacts.json", + "mode": "0o644", + "size": 47833, + "sha256": "f675692092da22ffd8008044c4bd5287bcb77ba8ffb0b433cf65f5bcc1dff7c0" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-record-identity.json", + "mode": "0o644", + "size": 48471, + "sha256": "b0db30a49d17aed1e39c53a3d8c73b962b53f56816309c64b4cb93bbf376880f" + }, + { + "path": "scripts/foundation/fixtures/bundles/dup-registry-identity.json", + "mode": "0o644", + "size": 47677, + "sha256": "8b95dc95d744b86a93e20a2f9eab9c2192e7d077cc37c19424b008edde548bd8" + }, + { + "path": "scripts/foundation/fixtures/bundles/execution-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47362, + "sha256": "3fd7ac1c0d44810c9cb30cf9972d0330cef0379f4c0c394b517d9dcbdfbaf9d3" + }, + { + "path": "scripts/foundation/fixtures/bundles/file-read-with-unaccepted-dependency.json", + "mode": "0o644", + "size": 47056, + "sha256": "6ebd0dee9886ff5f2f81351a155d5c0b2e6e62beb6bd17dda0f740ce32d3f297" + }, + { + "path": "scripts/foundation/fixtures/bundles/mission-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47495, + "sha256": "6e4acb4436a03454e1e5913b649d75c4df33b24d2f1da1116a742405cf94a5c7" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-change-without-proposal.json", + "mode": "0o644", + "size": 47007, + "sha256": "79923ed22f0b10cae5539b94cf79350529733e322fb7075958fef10ca7d68967" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-file-read-without-target.json", + "mode": "0o644", + "size": 46999, + "sha256": "3c35d78bb7d9d5e7895f6b0f7ea6279bb87ac0ec88b8e516cd61b9c1acadeff7" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unknown-name.json", + "mode": "0o644", + "size": 47001, + "sha256": "185a49b6e9fa1e218cbcad79aba57542a9c6b08ee44a1c8562aaa3bfbb386ff2" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unsupported-catalog.json", + "mode": "0o644", + "size": 47005, + "sha256": "00b116393a818923d4c5be9bef3942339a9b6b2c3d429a02dcb4d4926ae2b74f" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-unsupported-workspace-retire.json", + "mode": "0o644", + "size": 47006, + "sha256": "1041dda47094246bd07fc3a9ad68ec59d482a8d380f460cefb6ebdf5673dce6e" + }, + { + "path": "scripts/foundation/fixtures/bundles/op-work-read-with-target.json", + "mode": "0o644", + "size": 47047, + "sha256": "5c7c93a1b232c208ab371891746aa57e6bfcabca89fdbd3e261ef72f233db17b" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-assignment-task-other-workspace.json", + "mode": "0o644", + "size": 46999, + "sha256": "fc5d7a1fb64247c378a9b105450dcc954d8bfb2bd35c43c4558d1ed0fb5dd3fb" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-owning-project-mismatch.json", + "mode": "0o644", + "size": 46964, + "sha256": "12ce91207b12ce3b0c7d9f8e1921095cfdab02832ed54c41f4ab5ff4a50ead69" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-parent-other-project.json", + "mode": "0o644", + "size": 46999, + "sha256": "2b59f55a278a3632079bf393949050daf281c44623849d8511f486966c8d3392" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-mission-parent-workspace.json", + "mode": "0o644", + "size": 47034, + "sha256": "205c6b725eb19a2a795d8f4b4bc64c762a92a770f170cb07fb7cf42669d8886e" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-project-id-scope.json", + "mode": "0o644", + "size": 46999, + "sha256": "e3747cde436b485f4b7b0137313a5919a710ef86dd47681baaab487f85950c5e" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-registration-parent-other-agent.json", + "mode": "0o644", + "size": 46999, + "sha256": "a5f871898dc8c0d5b8ce67de17de588176c69140cbcf41e615bd2f58d350a90a" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-registration-parent-other-project.json", + "mode": "0o644", + "size": 46999, + "sha256": "9074b8298e25c5715235476caf66363ec7c721e953deb2dd7835ade6bcf29ea6" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-workspace-id-scope.json", + "mode": "0o644", + "size": 46999, + "sha256": "7de9e947dbd89bc703cd864ac3840e8b938f59a750c5d51ba9d6bf63854fa49c" + }, + { + "path": "scripts/foundation/fixtures/bundles/own-workspace-project-missing.json", + "mode": "0o644", + "size": 45553, + "sha256": "3f38f7154d9cb72d1fe27321899953f6a16fee4c95aa2d253d82807b8ad75e6f" + }, + { + "path": "scripts/foundation/fixtures/bundles/p2-inventory-unselected.json", + "mode": "0o644", + "size": 47000, + "sha256": "46b56f9e999441451b722ac1f826df24c349fad606c29224e7fed4453f078be5" + }, + { + "path": "scripts/foundation/fixtures/bundles/positive-unicode-display-name-allowed.json", + "mode": "0o644", + "size": 46996, + "sha256": "1222fa9def25efb10a947792608442eb195dd59301d7c1378a271da531cf4bcc" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-artifact-digest-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "4a2ebbff331d103c82ded30ef6648bd7b21c7893a2ecd3b54000e6531f3a23ef" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-artifact-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ccaa0b7b543168cdf647fbc638f7f04cc8a722d74dd59ea56c518337f3c27362" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-artifact-run-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "3d7d4fce68e440044862466a91811c4f1d8d42746f041abf69fe8e010c7b5940" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-authorization-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "bb20c0c27a9f2e7c1aa8a551e6a4aab0817ca992e5e59965e2e26232aff5ba00" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-delegation-input-decision-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 50223, + "sha256": "f06e95047a396b4e076651780d034391b7b67036d5d464d40c80fc1f6a795dab" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-cr.json", + "mode": "0o644", + "size": 47001, + "sha256": "30dcfc1ac5bec6983bc611240d67128374f5c27a49aa346740dd169fc95233d4" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-crlf.json", + "mode": "0o644", + "size": 47003, + "sha256": "c41d28c9ac000ee612562f99b02ad353b4e504c9fc95eb5a58d9a7ad21ed9d80" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-interior-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "91399148e681674f46351ecc5d5612f816f4dfcca5f41c881ea20d8168779071" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "128e1dde7dd30dcbc4b2a628ed708afcaa3dbd317f0b56f941a1c815af2be901" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-two-final-lf.json", + "mode": "0o644", + "size": 47003, + "sha256": "f9e155deaf0fe356470fd284e115ad27fb7e9fdc12d0daaf6da025505309de78" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-u2028.json", + "mode": "0o644", + "size": 47002, + "sha256": "ce2f0c27ccad7ccf422656fb5f3d7c1a597280bef78f977dc1118a672742b9db" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-digest-registry-ref-u2029.json", + "mode": "0o644", + "size": 47002, + "sha256": "4b040b44d1f39d124b67b5c456979188bf8bf38e36b38f839f82be01287084fa" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-escaped-newline-free-text-allowed.json", + "mode": "0o644", + "size": 47008, + "sha256": "d53f005a9283b35c48e7093c7c84959e67d0b9d7703240451d61fece9d4a59fe" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-cr.json", + "mode": "0o644", + "size": 47001, + "sha256": "e5c13868b71b409f6dfe0cbf66ee6a847d58077fee210a1a0009484ccfd34c3a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-crlf.json", + "mode": "0o644", + "size": 47003, + "sha256": "cef6102987f8de847b8c7ee1a23aa5e72403b1fbb6d11189cdacb2cdb463957f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-interior-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "a4cb7e74b3ad77a000de77b43dd172d8a68f0e16abf1abc07d972b35fd9076e7" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "eede0a44305cc40aa15c5181105fce7c695ae7381696deb022d7dc64bdb8f8c8" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-two-final-lf.json", + "mode": "0o644", + "size": 47003, + "sha256": "42986229494c4d80104293639927b9e8bf15d5fea94abb6c684492f8d2c7471a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-u2028.json", + "mode": "0o644", + "size": 47002, + "sha256": "50da9b3aefe6163cc3f53dce63fd37a5a742501b31f0fed6d466b23653265ed1" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-id-record-id-u2029.json", + "mode": "0o644", + "size": 47002, + "sha256": "4e1adcaa3665bba405508e448cdfc6b6e42f0fb255309d0261a22af08362983b" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-order-artifacts-reversed.json", + "mode": "0o644", + "size": 47003, + "sha256": "3d2ef2f7220207cd4e3e1c6590435cd4550f27aa6091810fe6dc251b56eb9c56" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-order-authorizations-reversed.json", + "mode": "0o644", + "size": 47047, + "sha256": "1fbb9633bab6354982a160dc926bcc181272e328820e1fa2e68a5aa986e94443" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-order-registries-forward.json", + "mode": "0o644", + "size": 47003, + "sha256": "d692dfccb79f7668fbc55b5a3afdf9b85b8f1b8dd6073b811378526c572ba901" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-order-registries-reversed.json", + "mode": "0o644", + "size": 47003, + "sha256": "272d55d187f04a971f76c1ffb57befdb8b99fe9bc5b2b74e85d7ec482ff8c8f8" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-order-shape-precedes-profile-authorizations.json", + "mode": "0o644", + "size": 47047, + "sha256": "c8e9b50b1e216071069f32876bf814d95bf17dc500ffe3dfac9fb197ddf4a44f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-order-shape-precedes-profile-registries.json", + "mode": "0o644", + "size": 47022, + "sha256": "95ad1a8e2bf412ef61f6cd4a671c4735833619f7310e8f33b70f9a9658c7645a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-path-one-final-lf.json", + "mode": "0o644", + "size": 47060, + "sha256": "11aa009e6435ec07cf2fc218d7b23e9fb7ec5e2a42627fedeb54f8ac9cd24dbb" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-proposal-requester-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 50121, + "sha256": "bc2c862ee7d033551a261502d33ea309c0e54a0b13027c0f0477cce4144fa70a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-proposal-requester-context-assignment-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 50121, + "sha256": "47bd3833eaa5b240a0bf974958a7b0dfe9f69541a4921a0df4aaa6288a3d093f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-proposal-target-task-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 50121, + "sha256": "5f0ee53fabe59d51355f19d7b4f6cfd8115e708b857bafc296d54bed0e07c33c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-actor-execution-id-one-final-lf.json", + "mode": "0o644", + "size": 47037, + "sha256": "c95c2002cd0e345ea5589fce6a2688780bd523b76bd406439fcb906c463e621c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-actor-principal-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "a5fad7a69c136738bf74042c96ff1bd2f176b1bf768ff45cea0d9d7245021d9d" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-agent-type-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ab5174ec3f9136fc0290bd15743db5c89414f33938d731fa74882b49ae7d5edf" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-assignment-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "b36bb80f4607cb173012ff4c462d0ebbdfbd0be2ce07594796fbb89117a20cec" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-criterion-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "6defe71fd655947c23cdaa7e0eede5befe8aa92b06cb5762e0fa3d373ab3ae3c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-decision-subject-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "c71ce20d13abdc757fff44643ce2e9d58049f3f25fddb761519cf5ec9e46d1e1" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-dependency-ref-id-dangling-one-final-lf.json", + "mode": "0o644", + "size": 46999, + "sha256": "c61d5e84fa5dd4f16232fb71fcedd0d2cb535f40e3d4d1a15c0f5c3246348a7f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-file-root-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "a11a5f59429bda53240f0bc00c98b327d6555b2039ca7f7fb06e4982af8d0187" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-registration-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "17367fb547e62e68be267330eb98e04dd4fe2febb3faea461984901a5e7dee46" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-registry-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "e5853ec5455477ce99b82eea55a4faa42b40126434c28de1000b13406f2d94cb" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-scope-project-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "537f70c753dc214a66087a1ccc10825df2312c28355bbc1a4fbf1a06cffa56d5" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-scope-workspace-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "feddd255c7abdcbac1369b63df555627576e5c9bb70535a2fc1d78966acded2a" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-record-supersedes-id-one-final-lf.json", + "mode": "0o644", + "size": 48203, + "sha256": "69ee9f06c06d673334e55bc5356c094b88078f2f45a676d338f8e6afb4aa0119" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-registry-digest-content-bearing-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "8123d8856307c79838b9e67c5176bf6dcfd650555429646452e7a5edd29fbef8" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-registry-digest-plain-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "797beab4cecc709ca1010d88472819080369775a074e0db94cd4744891c51a3c" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-registry-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "c068396afaeac858d93b114ee314a331abeee7197e81d30716353ae4c1d91bd3" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-cr.json", + "mode": "0o644", + "size": 47001, + "sha256": "51c38ea4f0d088869f96a44566c6fb83e3cfb98f9c27ca67f2555f6359345390" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-crlf.json", + "mode": "0o644", + "size": 47003, + "sha256": "28a2723cdc46e87b2407e6fd2fe944cf78a67739d9c88a2ef42a7e06386a1afb" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-interior-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "97cf8d143f7309717250c86784638ee69c6dda16c3ec609119c4abc4f7800404" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "64f7323e9bd799ff1f0e997aa4c33baffb677853921b71990fc0baeac94acc59" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-two-final-lf.json", + "mode": "0o644", + "size": 47003, + "sha256": "1cecf2c29720b272c7f1822abb7a037a66cd209fcd6af5f7c1248d8368e163b7" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-u2028.json", + "mode": "0o644", + "size": 47002, + "sha256": "935dfe037f4bf48085bb8ef86d1f5ac1287f2c4ba5eab789913216f2af4840b5" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-runtime-id-authorization-ref-u2029.json", + "mode": "0o644", + "size": 47002, + "sha256": "641b359f8bb90db0f4dfea964d8d46acf408b29ee37a6cf8ced04b975e60fa58" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-agent-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "1aa1b1dd878798fb5f8201861bee7f4ee2de39cd21f91f75c168f0224c2e6ea2" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-assignment-ref-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "f07fe150fc578fe9fad603f96ed51e7969aee20e970f5abad4fd1ee49ab94692" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-assignment-ref-scope-workspace-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ecdb566ec563416d08647279b2be7b5f0368866b99057d52dfd952e5922a5500" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-project-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "233062e341b71e65c7b900b1da1f93b1a7cb9d6ea603919584e339246233234f" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-selection-workspace-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "ab430903ebe13af3a8ec1bd57f925196bac1aac38b8f6f2ec4058f42fd110f0e" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-time-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "22776f383b20d2620dcc2731c1f7b5bbf4c2556c50cd04e2ffcb1b8bddad853d" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-unselected-record-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "c22ce5dec672c5ad5fe8e1cdd6b901b98d8ae7134ebe2c4865387aeb8d7cfd0d" + }, + { + "path": "scripts/foundation/fixtures/bundles/profile-unselected-record-scope-project-id-one-final-lf.json", + "mode": "0o644", + "size": 47001, + "sha256": "559c7d55bc1a88ac918922cfb7d0f0daf285c08cb6c68d27728dbe024a9ccf93" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-all-pass-restricted-contexts.json", + "mode": "0o644", + "size": 51185, + "sha256": "ccf22e319ada775b014be68687a4d54da2234b2c6e01b3507319012ad7b2b5b1" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-not-recorded.json", + "mode": "0o644", + "size": 49934, + "sha256": "abe2511b7006e56a91b4d40213075aacac2e08dbdba35a7b2e69c07c345cf68c" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-rejected.json", + "mode": "0o644", + "size": 50119, + "sha256": "b4a19d16a0a6d07e071663db371d77073a615319d1a1b4862a1aa7935a4cb251" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-stale.json", + "mode": "0o644", + "size": 51883, + "sha256": "e52970ec3675eda0bdff8742b453c109e848eeea9e2c6b9c1ad6db3a227a7ce0" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-subjects-mismatch.json", + "mode": "0o644", + "size": 49871, + "sha256": "6d726823ea3181892717f6bdd0cfc03ca6ed68c52d27874208e595a001c1b348" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-change-wrong-kind.json", + "mode": "0o644", + "size": 50118, + "sha256": "cc810af17db5661a2c2446e26da390b008f66a0a25c7513108ec0c21cc8e4807" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-artifact-undeclared.json", + "mode": "0o644", + "size": 50119, + "sha256": "33a7c5c4d7927f1875ed21931807b83700068b289256607a075881c2b45017bf" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-exceeds-issuer-ceiling.json", + "mode": "0o644", + "size": 49375, + "sha256": "dade48f2e5147037ae009e42acb1de4fe56fc2b53711de0fd0dc65ce6a4df0af" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-input-missing.json", + "mode": "0o644", + "size": 48673, + "sha256": "25c0a2fd08a2270dd8609abd709a0e8d5df96923e521ef0c9c6b9414b0eb6626" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-missing-after-requester-admission.json", + "mode": "0o644", + "size": 50266, + "sha256": "dba8f8890641aa54a24dc14f898c973ae73a364302fe59267e8eb9c3a418ddae" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-missing.json", + "mode": "0o644", + "size": 49935, + "sha256": "d76b138aac1f6138c6c4d5a3a057e20ea7dcc0488b625e037e6a97297527abc7" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-other-recipient.json", + "mode": "0o644", + "size": 50119, + "sha256": "79a6ce60aca3376e5ba3123a6a9f7515ef70ea6d3479261443bf02dc8518b8b9" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-other-subject.json", + "mode": "0o644", + "size": 50119, + "sha256": "2f83da99d4a915d0fb97e9198c082604821f0fd45c239d82075fee88b852dd02" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-rejected.json", + "mode": "0o644", + "size": 50080, + "sha256": "d5cbc12c8697f707f7538ae2d17777d159d5b646268e283ead10c355e10cc3b8" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-stale.json", + "mode": "0o644", + "size": 51854, + "sha256": "0e8815068566524de3f07221ada8c14b3224193cef9b50d4ebd4a34ce84cef8c" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-delegation-wrong-operation.json", + "mode": "0o644", + "size": 50111, + "sha256": "3f00f24d96c061e5a266a534119717facdeed620aef5577f7a119e00963df12e" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-subject-intent-stale.json", + "mode": "0o644", + "size": 51875, + "sha256": "05e3b3696194ad9d64b0c8279914ffa3543eab36e5203e4847ff6682836b6187" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-subject-paused.json", + "mode": "0o644", + "size": 50117, + "sha256": "28fe6c19dab8365ed95a15f09faefa3d85c1310e7ed5d50446e1938cb12d23cd" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-target-task-blocked.json", + "mode": "0o644", + "size": 50121, + "sha256": "2c0f02ea2130c90ee2e46d8c008f900da6a65e1f1a448b96c976873fcf4ab84b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-intent-target-task-intent-rejected.json", + "mode": "0o644", + "size": 50119, + "sha256": "bd53add1593ca3ae27673256f814d5a8c1cbb34ffa1ba31ad06687126156d916" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-issuer-denies-work-read-task-only.json", + "mode": "0o644", + "size": 48647, + "sha256": "3f4fc74d678bd91b9023bc0661094c6edc9dd26572d3e6422dbb20c9d4da6081" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-issuer-denies-work-read.json", + "mode": "0o644", + "size": 49335, + "sha256": "34d1ed805d3d42098052be2b928404947bd2d3b7b4c1af0edd3ec344aaec88f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-issuer-grants-work-read.json", + "mode": "0o644", + "size": 49358, + "sha256": "aad1654ac0947ce2db7838872e5088792e583bfb3c24eaa750aa01a7122792fb" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-after-structural-failure.json", + "mode": "0o644", + "size": 49975, + "sha256": "3c86d9e9747f91388c16ae3ba17f2bab9d3a9a098e133921d5b3971a4a411669" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-is-not-authority.json", + "mode": "0o644", + "size": 49975, + "sha256": "f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-precedes-requester-admission.json", + "mode": "0o644", + "size": 50306, + "sha256": "1c9f7142646ed4e39daa5e96cab46d57a03aadd0b3f61d21b6a1179dbe906a3d" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-message-precedes-stale-subject.json", + "mode": "0o644", + "size": 51252, + "sha256": "3c008be9a1f35c5f976014e90afd591c82e0923775f291a0e683dfbd8b105152" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-context-no-work-read.json", + "mode": "0o644", + "size": 50596, + "sha256": "1fd82546b0e78663afd29d2fbbb2151dea8b4477d5d2085b6ca185a3cd45a536" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-assignment-paused.json", + "mode": "0o644", + "size": 50117, + "sha256": "97e1353813efa41e5f7afdca86ee71f878e1e5bb9de300f36532aa49016cdf84" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-lacks-change.json", + "mode": "0o644", + "size": 50118, + "sha256": "0a58eacc571a255ef355573e26a7c1d69aafe8435c0a779c667577874f0a7d89" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-original-requester-registration-revoked.json", + "mode": "0o644", + "size": 51400, + "sha256": "e8f336a3ba50d1d17d8330c871ab80cc0823ca612f15359371c28737534099e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-agent-missing.json", + "mode": "0o644", + "size": 50119, + "sha256": "b5a9258c22c41aaf440add5cc4f030365942adba5c1f7b48c33f55698af90f75" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-context-wrong-agent.json", + "mode": "0o644", + "size": 50119, + "sha256": "2bf77e5d80aa3c7cd5c8a9c9d5632f841dddeff0b3b42325a8a938cb2e318f39" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-requester-context-wrong-scope.json", + "mode": "0o644", + "size": 50119, + "sha256": "432d503f0e105d7aa3bc71547d7e88f621870a54a8837b73ae6941daf5d279cd" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-selection-agent-mismatch.json", + "mode": "0o644", + "size": 50119, + "sha256": "ae7138b549b3e1b0a212d4a859294c4492755b6e108777d4b42a35e44f01c46b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-selection-null-assignment.json", + "mode": "0o644", + "size": 49934, + "sha256": "f06fe01ffa553af1473a87497c8192ef2d786cc2031e33ff8e3c7a42852c4267" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-assignment-stale.json", + "mode": "0o644", + "size": 51396, + "sha256": "90ac6747e11416ba52fc6c3ea57d735ee2d2993e8720a81955fdc73ddd3197dc" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-not-selected-assignment.json", + "mode": "0o644", + "size": 50119, + "sha256": "6eddffc4fa618dfe25c758cf2165a47c30b6a5cb9daa63685c6896fc501f57a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-subject-task-authorization-undeclared.json", + "mode": "0o644", + "size": 50119, + "sha256": "0cf96ef8fa1801828b709818947c2f6d771ee61a39232bfab60b4768f56f509b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-cross-project-context.json", + "mode": "0o644", + "size": 51449, + "sha256": "61b7a1f1c2f8f4e576c40a424df4b29136577b4aa0f6519bda789b8ae026969f" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-cross-project-task.json", + "mode": "0o644", + "size": 50119, + "sha256": "be88c9667e9d4077039d327f63ce20c3a9d7475aac80912538b675db27810ff7" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-requester-lacks-change.json", + "mode": "0o644", + "size": 50118, + "sha256": "5655309b8c4b21b3a60806f52e0eb9285680af0a033867db606fcad737e95803" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-task-stale.json", + "mode": "0o644", + "size": 51527, + "sha256": "77d3b1605bd66b361cb4b89d5e4f4452f6a6a922ecc79043e5e122ead7904e7d" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-target-workspace-retired.json", + "mode": "0o644", + "size": 50120, + "sha256": "47afa9bbd362d9514bce95924e45d8bed59b86edafe8a5dcec34b9a64e6a6909" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-task-only-contexts-with-work-read.json", + "mode": "0o644", + "size": 49941, + "sha256": "c98094486ea3463c9ca43ebef961b847ec4f84ab66c81d24aced5324296d726b" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-task-only-contexts-without-work-read.json", + "mode": "0o644", + "size": 49887, + "sha256": "e1a9cd887f1bc64a8abdd8a0a1326df21b1ac0406ead978d2e6fc26e4eb0d683" + }, + { + "path": "scripts/foundation/fixtures/bundles/prop-task-only-target-context-without-work-read.json", + "mode": "0o644", + "size": 49914, + "sha256": "0f58694950a5eb2d5949f9fa7f608e702d8a3d50b30b32d2c123e8c5b1e78292" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-bounds-other-agent.json", + "mode": "0o644", + "size": 50273, + "sha256": "5f2b5ae9680c274c6d8dfe9df0a0ba00f3102f2b3d393f56358eef5a222046ea" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-bounds-other-registration.json", + "mode": "0o644", + "size": 50273, + "sha256": "bceaeb2aa35d12d66e3aa67928162a6b90485ed1800bf6c1068f6b90fcce27f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-exceeds-issuer-ceiling.json", + "mode": "0o644", + "size": 49506, + "sha256": "72649b1beb999e234e5f6bc8a0d0f97afb50221048de87e5742117202402a3c0" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-input-missing.json", + "mode": "0o644", + "size": 48825, + "sha256": "612f95f4efda53b423d3f91eb282cff12655e273c36e42ef7f3ab1ea5f734125" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-issuer-ceiling-narrows-path.json", + "mode": "0o644", + "size": 49415, + "sha256": "5b321508e396c175d87afe5298f6431a4e1de90545e07d0847964e163f56d813" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-narrows-to-delegated-ops.json", + "mode": "0o644", + "size": 50275, + "sha256": "2507c45e93894e3168d7d223c7c16e62b4f0506396532cf90bf4fd2f539c2666" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-not-approved.json", + "mode": "0o644", + "size": 50219, + "sha256": "e117ca5d24dc96b33efd7382460066fa4d869c0930e0be17c37f6ca6116eed57" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-policy-ceiling-stale.json", + "mode": "0o644", + "size": 50822, + "sha256": "7f4eeadff72d311f8eeba2005da48cbaf0158297c32b797e8fe564f6d21f654a" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-scope-not-modelled.json", + "mode": "0o644", + "size": 50174, + "sha256": "82754afdbd8e329c19e377050b64aa92c077528ffc7212cb9c07e3e73b17688f" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-stale.json", + "mode": "0o644", + "size": 52029, + "sha256": "32fbb55099b9a0e97cf7a0101f51cd43d8ba373eba48b3fc664332b89de9d412" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-subject-form-task.json", + "mode": "0o644", + "size": 50264, + "sha256": "4b67c67f0d2b23de599b8988745b39d3517c5f4d76f4c6a85d610a44d8f4ef67" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-subject-form-three.json", + "mode": "0o644", + "size": 50521, + "sha256": "c8529b73636366b52d023d4da4b2c2cdc9ea842a97bb2a345ff9f28c9b07ff79" + }, + { + "path": "scripts/foundation/fixtures/bundles/rdeleg-wrong-kind.json", + "mode": "0o644", + "size": 50222, + "sha256": "6c81b577f70da7eec74977be72f625a29417495ff71e28b24cae5024087848ac" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-decision-subject.json", + "mode": "0o644", + "size": 46999, + "sha256": "77adf0a0c7033eb40ba2fe6bbb49a4d90153cf491ba33e6edbb2e075e68883a0" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-dependency.json", + "mode": "0o644", + "size": 46997, + "sha256": "c113550fec982779ed7d01b1900dee98709dc738447f7f02beaab88331979dbd" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-selection-assignment.json", + "mode": "0o644", + "size": 46999, + "sha256": "66510d5f82c0353f7a7223d992d248f67ab0aaa894f9e129e05044df343e9901" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-supersedes.json", + "mode": "0o644", + "size": 47195, + "sha256": "d27909e13bde230b9d1c92edd6048016c70eeddcbb8af727966aaa6e3a38ad28" + }, + { + "path": "scripts/foundation/fixtures/bundles/ref-missing-task-intent.json", + "mode": "0o644", + "size": 46997, + "sha256": "c81c7c5c2802b88e594eedb378721cd4c2b970cc372f9c7ca5b4cee02def9345" + }, + { + "path": "scripts/foundation/fixtures/bundles/registration-restrictions-narrow-ok.json", + "mode": "0o644", + "size": 47493, + "sha256": "baea07d3ab6a92653c0d8f3e7d9ef24ece8eab05cd3f02ad702278951e58ba07" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-assignment-ended-without-reason.json", + "mode": "0o644", + "size": 46996, + "sha256": "d7850b97b4a1f355621a290d14e1b57fae55a7c5f0d7c63585fb12b3ba3fa6f1" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-bundle-version-2.json", + "mode": "0o644", + "size": 46999, + "sha256": "8fe4cf694ff5fee90bf195bb99cc954a153a92fa04eab7a8f43c34eea3d2806b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-input-other-mode.json", + "mode": "0o644", + "size": 48447, + "sha256": "8a58b8ce6547b351b69302ec31c7d16d2c26dc3801b44ec80a84b065c5ca5c45" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-input-parent-ref.json", + "mode": "0o644", + "size": 48480, + "sha256": "5b12d03072f33e05b59d0425647350dd6547584d105ab5835246b313a6be54a7" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-delegation-without-operations.json", + "mode": "0o644", + "size": 46960, + "sha256": "946584e5be25821e022cdff3a5b2787c2458c6ee1809ef0b630703815ac790df" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-missing-execution.json", + "mode": "0o644", + "size": 46933, + "sha256": "7b5bcecb69a4e88c44de482810887ed32b455deca9c97b32c52088918af67a1a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-missing-operation.json", + "mode": "0o644", + "size": 46933, + "sha256": "99934a0d7ce4d96575edce7276c8d31a89db3683e4afad29556bac9241232d37" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-artifacts-forward.json", + "mode": "0o644", + "size": 46961, + "sha256": "1fdb5c40147d503251725d79abcf96492fdd0db40653ecfb643e9f219d89c5ef" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-artifacts-malformed-sorts-last.json", + "mode": "0o644", + "size": 46970, + "sha256": "c2d2141e61f7610ccaa12bf41afa511db2a3a0add4aca21a734f717414288a39" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-artifacts-reversed.json", + "mode": "0o644", + "size": 46961, + "sha256": "10ccc8bf3ab966aa53d3f98a12de26bdb275aa882b29fba3c611a710ad3fbda9" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-artifacts-swapped-forward.json", + "mode": "0o644", + "size": 46961, + "sha256": "3ad709be601fb6ce955f64f8294d0de9f3eefb73f0b81dcd57e1853bb6b5acf0" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-artifacts-swapped-reversed.json", + "mode": "0o644", + "size": 46961, + "sha256": "cf4a22da0dceab1416a0b208a47afba7720391435a92c76eee3de5e1fe50c5d1" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-authorizations-forward.json", + "mode": "0o644", + "size": 47045, + "sha256": "7e9bfe427a04931d75535c8d40e714c1c97910b7205f459e45ae1960109409bb" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-authorizations-malformed-sorts-last.json", + "mode": "0o644", + "size": 47008, + "sha256": "e06a2d26e580424873717b34538823c7d24be5360356dc081220c3043e8319af" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-authorizations-reversed.json", + "mode": "0o644", + "size": 47045, + "sha256": "d3615d51c20bb2e96c4665c1f90406e251bb097adea61a54434ef3d55154792c" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-delegation-inputs-forward.json", + "mode": "0o644", + "size": 52171, + "sha256": "f823ad69a089b242d8bc6a65129463cb3e384e2b46bfd3a5e4ec011231a95f49" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-delegation-inputs-malformed-sorts-last.json", + "mode": "0o644", + "size": 50160, + "sha256": "0b4ea49d146fe187ee4551a50143723ea2ac8343f1aa3434b8226921a2bfa0a8" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-delegation-inputs-reversed.json", + "mode": "0o644", + "size": 52171, + "sha256": "a4390d0a81c7d219ee3a95a25d8a53c0ad09808ba7fe4a4a254d0ec7a6322701" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-delegation-inputs-swapped-forward.json", + "mode": "0o644", + "size": 52171, + "sha256": "12e2acd24c0c18393e998f26e7ba69e09545dac98285c7ea4b47fcba03049077" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-delegation-inputs-swapped-reversed.json", + "mode": "0o644", + "size": 52171, + "sha256": "ac8ded6a43248f2c87adde783f3c434cf6ad79c0275531907e9619377334acfe" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-equal-key-unicode-records-forward.json", + "mode": "0o644", + "size": 48476, + "sha256": "5c8ccb004c0ea99ce734d491456c995153ad71527a37a64c955e6bd4a2b3b17d" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-equal-key-unicode-records-reversed.json", + "mode": "0o644", + "size": 48476, + "sha256": "e03415a8771465c5fd029fb8b5c0152bc983b12866ac22d65ffa61ed3652f057" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-equal-key-unicode-registries-forward.json", + "mode": "0o644", + "size": 48507, + "sha256": "cc8d1687a3dabb56be58067db731d41d3b2ede8c6e995600eb1e1ffada1c25fc" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-equal-key-unicode-registries-reversed.json", + "mode": "0o644", + "size": 48507, + "sha256": "af02fc8956f6b1ce13df75e900303611fc05eb59516fd04400692e3fb1c4e59e" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-family-precedence-artifacts-before-authorizations.json", + "mode": "0o644", + "size": 46903, + "sha256": "6822d56262f8cc8bf0b923799b7569ce15f4f6c0829cf97f5da85c3f4aaa0ea0" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-family-precedence-authorizations-before-delegation-inputs.json", + "mode": "0o644", + "size": 50084, + "sha256": "017e9ce810757ad61c6359cdbf180f38123aeda45a0117c3c6b45ccd58f71939" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-family-precedence-registries-before-artifacts.json", + "mode": "0o644", + "size": 46961, + "sha256": "ac2f616b4dffd4355e263813407dd4c7ec26c1c206b81bdfe7629a0b57ed44c8" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-forward.json", + "mode": "0o644", + "size": 47023, + "sha256": "2c201894ae0724568780e0147ced700c40e6d5577c980d9f834a85a65c6af937" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-malformed-record-sorts-last.json", + "mode": "0o644", + "size": 47038, + "sha256": "bcefb67872e63f98477369d9360659630cff7823878f305f8bf06bb4d551e6b0" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-only-malformed-record.json", + "mode": "0o644", + "size": 47037, + "sha256": "5a7f85a999d8e08f064a8b74fe7dccabe2b50bb1ff6458675261bba926d807c1" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-profile-precedes-digest-registries.json", + "mode": "0o644", + "size": 46972, + "sha256": "66489a988af8cd90d2a1cf31b5be745587b31202f236a0215716ac034b4a44e8" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registries-forward.json", + "mode": "0o644", + "size": 46929, + "sha256": "927384590d2fdba4be2d49e6642f3bf849485f33d0e99c5d197abf772419a18d" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registries-malformed-sorts-last.json", + "mode": "0o644", + "size": 47038, + "sha256": "8ef33de63b44086d49573823581650e444f2a93071c167b96585dbc2f44ab09f" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registries-only-malformed.json", + "mode": "0o644", + "size": 47019, + "sha256": "67aec4480fde142eb87d9dee32c470132cc1eba6cc36a3deeae89638678d29fd" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registries-reversed.json", + "mode": "0o644", + "size": 46929, + "sha256": "b76b6a14f070c6f45f84f62de11e745ec3df81aa0582bc848ee93c548ab1e189" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registries-swapped-forward.json", + "mode": "0o644", + "size": 46929, + "sha256": "862e07624e9a5014425b2dd4c142acda22967d8ea318a313d751d3c37efb2246" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registries-swapped-reversed.json", + "mode": "0o644", + "size": 46929, + "sha256": "965bb9f5623510d3c914e0ee75203a50e8ab53e2b59fa262e18837379c8002d8" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registry-digest-forward.json", + "mode": "0o644", + "size": 47033, + "sha256": "c7335387235aa44ec744b98c9d7c029eafbce71bf86ffdc7956ae167b7c454f4" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registry-digest-reversed.json", + "mode": "0o644", + "size": 47033, + "sha256": "011736b868ca5235d0a3fbe211e67c765d328e06d6d059709e508391c65a292e" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registry-digest-swapped-forward.json", + "mode": "0o644", + "size": 46973, + "sha256": "15fc47278093d7c48000b87db3765bc48eb67a31f527f5303810bb4b30373fda" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-registry-digest-swapped-reversed.json", + "mode": "0o644", + "size": 46973, + "sha256": "f1869a386cbca5b609d7f51003bf1cf0232baee1151f73982c7668bd4421bd3e" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-reversed.json", + "mode": "0o644", + "size": 47023, + "sha256": "cc11bcf72654a48ed451d49f6ab385a6cbbd59c1b0a12e1234272811f816f8be" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-two-digest-mismatches-reversed.json", + "mode": "0o644", + "size": 47061, + "sha256": "899498936e2ba95a5875748014c76193265c096d7684190850ac6581b0a1c638" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-unkeyed-unicode-artifacts-forward.json", + "mode": "0o644", + "size": 46730, + "sha256": "816d4c1c39d264c614bd1f66ffac8ffb4e286bceb717d1bbfe271e7ea778c3d5" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-unkeyed-unicode-artifacts-reversed.json", + "mode": "0o644", + "size": 46730, + "sha256": "4065344552521b25027499026a7501d490b3f16e257093e44f15a5acd1ec3fa5" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-unkeyed-unicode-delegation-inputs-forward.json", + "mode": "0o644", + "size": 47044, + "sha256": "ffc19f50f8bec22396917dcaeafa07a61fdd715f6d3716545ec91cea51a3f984" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-unkeyed-unicode-delegation-inputs-reversed.json", + "mode": "0o644", + "size": 47044, + "sha256": "7f0a65902d921a2916e93e2467793cb0bed8e518ff0728bd3ff2c5a664a870d0" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-unkeyed-unicode-records-forward.json", + "mode": "0o644", + "size": 8489, + "sha256": "09b892d9f2027ecd6032d8c6e9a542dd2ac7b5fccd6a08baf145d53850f33734" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-unkeyed-unicode-records-reversed.json", + "mode": "0o644", + "size": 8489, + "sha256": "e5ddfb38fba307d4e8f97c142d2018450cee512575cad3586683187e9129b081" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-unkeyed-unicode-registries-forward.json", + "mode": "0o644", + "size": 39613, + "sha256": "83684746b0e05afe08804bfd8bb0ce7dd687110296b57b0e9f8b59576715ec45" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-order-unkeyed-unicode-registries-reversed.json", + "mode": "0o644", + "size": 39613, + "sha256": "8001aa920a6e98a322a28f4121c53ab68d3b5ed2897191eb711deed0acfeadb7" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-path-grant-absolute.json", + "mode": "0o644", + "size": 47285, + "sha256": "b2f22d443464d52d0e809f596fd4a286139b7d637b5b746f26ffc7a9d65840aa" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-plan-with-delegated-operations.json", + "mode": "0o644", + "size": 47030, + "sha256": "7927734520f92ee53f8d9cc3244fcaf40224c1ad00f21c3796983e541aa827f2" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-project-mission-with-parent.json", + "mode": "0o644", + "size": 47178, + "sha256": "d96eec739e15ddab9c1aec3573829a9293a8bfb03f66a0e4a28100fe97e21d56" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-project-registration-with-parent.json", + "mode": "0o644", + "size": 47187, + "sha256": "d62b0f3612e8680a083860c5f4e2ffa377b7b7a71e3ca410f9f57fdae196820a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-proposal-on-read.json", + "mode": "0o644", + "size": 50111, + "sha256": "74d3aed956fb0e1ed49d7bf1bdf0fc670a62e70d032aefcf5588107945b9897a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-proto-key.json", + "mode": "0o644", + "size": 47018, + "sha256": "3521338f24e902c9dbafaf1a0af9a8be203b997ca5ba4d3de7e6e5f42a3e4f93" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-agent-actor-null-execution.json", + "mode": "0o644", + "size": 47001, + "sha256": "6aacb4bae667501f38d97b9cbe459d09bc887f749c80be04311e3fad328772cc" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-bad-id.json", + "mode": "0o644", + "size": 46999, + "sha256": "c38770ccc41af4f357f3eebcb602dd56255a8a90c9899a75d9e9be3f30bd4ddc" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-bad-time.json", + "mode": "0o644", + "size": 46995, + "sha256": "df248c9a003deb6d7feb77c414ef67190c3cd0f2084997d2e41b09dfbc3f53cf" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-calendar-invalid.json", + "mode": "0o644", + "size": 46999, + "sha256": "5db137c0843d7b7c87d4b8e06a8a7612cb17a98874379c4da03e41a00a2ff709" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-criteria-duplicate.json", + "mode": "0o644", + "size": 47075, + "sha256": "06f42f587fcd9c8e36df97f67155a4f1ab6a39d28ad4a7998af4231be72490c6" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-criteria-empty.json", + "mode": "0o644", + "size": 46915, + "sha256": "7bc8fb98e35c689fe7ce73a184056e5be70e11191fd461e42db619b8b5a48f2b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-displayname-too-long.json", + "mode": "0o644", + "size": 47118, + "sha256": "bbe6bfb36597210ea692f67bc35ea6f6409388beafd9e2e6af56bd57344db3c3" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-leap-second.json", + "mode": "0o644", + "size": 46999, + "sha256": "544f5f84a78021fa197ec8507edeefca58ca2cff18ca23284e9ee3c1d612b8df" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-missing-field.json", + "mode": "0o644", + "size": 46891, + "sha256": "aa520c95f7af8e81e0242711e33a610820908b7b0a7947977dbb62ff6bf039ba" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-rev1-with-supersedes.json", + "mode": "0o644", + "size": 47195, + "sha256": "c06fa51658d8a505e8836c2016d671955997f0ccc84ef8fa33e68084011ad9aa" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-status-enum.json", + "mode": "0o644", + "size": 46997, + "sha256": "8040becb0d4fc9cfef1e52247f0cd44d5b3f6fd9bb4dded8fa73baa9c1175b5b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-record-unknown-field.json", + "mode": "0o644", + "size": 47020, + "sha256": "a6702f7f22a94469084f05f79fce624445feae9909dc98e5912268c91e9683c4" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-content-non-ascii.json", + "mode": "0o644", + "size": 47002, + "sha256": "7b1cf22485682d612a4e74aa24a133ea859d1183958bfd78d9084d3dcd4cc179" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-digest-mismatch.json", + "mode": "0o644", + "size": 47030, + "sha256": "b3cb2f63220077df78bd0a83023300b8031c6b84afca9bbcda7d6ddf9989671f" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-missing-content.json", + "mode": "0o644", + "size": 46504, + "sha256": "393d89a31cf86a95e43a6a15cf950c382949a2aa7533998023865454b6c56461" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-registry-plain-with-content.json", + "mode": "0o644", + "size": 48289, + "sha256": "de7fceecac43163b591300dcb29b18206e728edd9bd7d8c20a6e69c14366d43f" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-restrictions-none-with-endpoints.json", + "mode": "0o644", + "size": 47412, + "sha256": "09ece43156218d02e9b2ae467ff76310bd7e85080ed4a8ef55886e41ead9f5ed" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-restrictions-unknown-operation.json", + "mode": "0o644", + "size": 47184, + "sha256": "6bec9d250fa308cf524128d6a37db7c23ba53f27f269152833c5b9f0caafa56a" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-simulation-false.json", + "mode": "0o644", + "size": 47000, + "sha256": "557da19b296380c61ce200473a11173a0805846c0496a2619b1c0d1757c2e15b" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-backslash.json", + "mode": "0o644", + "size": 47052, + "sha256": "76668ec2c1bb0341ed5f1ab96e9f37d5201bafb4483e82af88f5fbad4ca24f26" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-control-char.json", + "mode": "0o644", + "size": 47061, + "sha256": "05fb3da905f93c975fbf6f5f8d7effa0df45997ba528d8070ffbd3cb915bf135" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-dotdot.json", + "mode": "0o644", + "size": 47063, + "sha256": "aeffd2e5d0362fa93b5b50445426dbfff2ee40056e128ae2c79c6fb19deca954" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-empty-segment.json", + "mode": "0o644", + "size": 47052, + "sha256": "3efdcae8c0691f77bc896ff5f6839882ac6ba26beb8ebe72f3579dd877980804" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-line-separator-echo-ok.json", + "mode": "0o644", + "size": 47055, + "sha256": "8fcee4457379e23fb2f92e92ab17a6e586acf95f1e504fed6a9b94ad3f783553" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-unicode-ok.json", + "mode": "0o644", + "size": 47064, + "sha256": "8040178585bb71bfb7a5e73b1d236d30bfee4358d1ec84d276705492d3a70055" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-target-wrong-root.json", + "mode": "0o644", + "size": 47042, + "sha256": "7ca0872b7e035b83d8adccfff7fed1669881629c9e5d248f82a9231120423a27" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-too-many-records.json", + "mode": "0o644", + "size": 385409, + "sha256": "69d89b94922c81f8a6aabfcaaeaf18cc64c0dfcf7399e0879dc2e35c99b863e4" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unknown-kind.json", + "mode": "0o644", + "size": 47485, + "sha256": "15abdcf2fab896e477facf78d6f58c237089d321480cf483ef03cac48d5756e6" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unknown-top-field.json", + "mode": "0o644", + "size": 47013, + "sha256": "fb62948772ee0297f951a53636667e166f6640dde611efe82b2f01103088d7cf" + }, + { + "path": "scripts/foundation/fixtures/bundles/shape-unsupported-kind-session.json", + "mode": "0o644", + "size": 47486, + "sha256": "c2c6549b1088b007b031ebf30e56c7bc37503f7201f19f577e8a539e1c539da6" + }, + { + "path": "scripts/foundation/fixtures/bundles/struct-order-delegation-inputs-forward.json", + "mode": "0o644", + "size": 53339, + "sha256": "5ee150d138cd8f58683f058a264bc5af0806857880de1b4026cd65279b0668cb" + }, + { + "path": "scripts/foundation/fixtures/bundles/struct-order-delegation-inputs-reversed.json", + "mode": "0o644", + "size": 53339, + "sha256": "a3ac4ad161b7a465943bfe5d61a4f7aaf46f3a43cea8ce3cfe112b98b740c241" + }, + { + "path": "scripts/foundation/fixtures/bundles/taskless-file-read.json", + "mode": "0o644", + "size": 46875, + "sha256": "54b2d827b76e289754dd89c2b37a3bf22abe6bfe064b4ba9e53058eb627c8f9d" + }, + { + "path": "scripts/foundation/fixtures/bundles/taskless-work-read.json", + "mode": "0o644", + "size": 46814, + "sha256": "5eac10a34626b91eb881a86adb30042296df700218fd273a5cc1560fd205e61a" + }, + { + "path": "scripts/foundation/fixtures/bundles/work-parent-project-mission.json", + "mode": "0o644", + "size": 46964, + "sha256": "f13594287cf8a240bffcf47be56ed52c73f0c37343841b06aa5822aef81b8c69" + } + ], + "fixtures-raw": [ + { + "path": "scripts/foundation/fixtures/raw/raw-array-too-long.json", + "mode": "0o644", + "size": 2051, + "sha256": "617dbb4c661baa3f145bdf28ac60df6b868c172ddad965c8733e704204048b8b" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-bom-prefix.json", + "mode": "0o644", + "size": 47001, + "sha256": "b4a98e270b4024cb974cca5998a8c96e179441beb07c466649d67fc39abd7446" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-constructor-key.json", + "mode": "0o644", + "size": 50, + "sha256": "db542a3baaf43c88776789470e9df3c74409d6529ea21c503673229737ac5315" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-depth-33.json", + "mode": "0o644", + "size": 66, + "sha256": "ffba7a731546fa3b609b0503e5b88d1523824b0f082f1c2f9166b08b57933566" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-duplicate-key.json", + "mode": "0o644", + "size": 40, + "sha256": "d260762a322a0c015f31ea99777551042acf8ced23a8471d886376e8a5805063" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-empty-file.json", + "mode": "0o644", + "size": 0, + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-exponent.json", + "mode": "0o644", + "size": 47000, + "sha256": "909fe77e9bc4489366666eb4e16c5d966520bf753560ca2705a56cec319f2799" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-fraction-number.json", + "mode": "0o644", + "size": 47000, + "sha256": "d0ca3b6fcf776b9f605ae35ee00642e4dd78a4396124f46fe24a0d41fa10c174" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-invalid-utf8.json", + "mode": "0o644", + "size": 9, + "sha256": "375eaa6515e23b024e4feb1a132beaf9e35b865e54cca181d01a7a0527ea9791" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-lone-escape-surrogate.json", + "mode": "0o644", + "size": 15, + "sha256": "f6ce88b5d0b4f17a625764062775db270c469f9cdc94f09e66828315f5c547a9" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-negative-zero.json", + "mode": "0o644", + "size": 46999, + "sha256": "448a56829ffa3d4b120dc9437f7df4349a481e540a802e74b64907f0c5a5f026" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-not-object.json", + "mode": "0o644", + "size": 2, + "sha256": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-oversize-file.json", + "mode": "0o644", + "size": 1048577, + "sha256": "9fa2b407b667e7ce77587038b445ff3df704f6972572708dc18cf355f13a45f4" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-proto-key.json", + "mode": "0o644", + "size": 33, + "sha256": "9a62fc3db4305c0079d42bf9bbf062fc1f60e2cc5eec25a42164350d88550547" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-raw-control-in-string.json", + "mode": "0o644", + "size": 12, + "sha256": "d0e097db994e029efa27ecc5a3da2213f203f30cbb49d12d10c1b297ead8d9aa" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-string-too-long.json", + "mode": "0o644", + "size": 4106, + "sha256": "15dd16f02a269a3b62326cc91ae8199c23d756a42d986cca61c83f68ce519485" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-trailing-content.json", + "mode": "0o644", + "size": 47001, + "sha256": "433f22797e2c1eab343b1711c80c9249053487dba9df986cfcf4759356d7cf60" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-unsafe-integer.json", + "mode": "0o644", + "size": 47013, + "sha256": "daa5145f11272cbfcdc3115e6d397a6a82830099ad6c2db5d25ee0e16c5c8ad1" + }, + { + "path": "scripts/foundation/fixtures/raw/raw-utf8-surrogate.json", + "mode": "0o644", + "size": 10, + "sha256": "957a49305a06fd66d2ef727af1f8d7fde39456593641835c0b640947d18895ac" + } + ], + "fixtures-meta": [ + { + "path": "scripts/foundation/fixtures/README.md", + "mode": "0o644", + "size": 6230, + "sha256": "c69c64a15b0a20105c46d6b8e04e32a80d8c9b025f9f47aa9e18679a69da8ed2" + }, + { + "path": "scripts/foundation/fixtures/build-fixtures.mjs", + "mode": "0o644", + "size": 88635, + "sha256": "ea5a54028b75cc6f3fbce1666f6fad04b3df774a137b0fd281da0a1abb0d0cab" + }, + { + "path": "scripts/foundation/fixtures/index.json", + "mode": "0o644", + "size": 124162, + "sha256": "e5b2cf8d6ad0bab6aa232edf80492ca58dae260940f52cf87e34525b166b459a" + } + ], + "suite": [ + { + "path": "scripts/test-foundation.sh", + "mode": "0o755", + "size": 8493, + "sha256": "6f808ea8f4a021e30b4c22a697ad62e28a6fac33a4370f93c02ec18505ca972c" + } + ] + } +} diff --git a/docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r4.md b/docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r4.md new file mode 100644 index 00000000..97084bf0 --- /dev/null +++ b/docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r4.md @@ -0,0 +1,319 @@ +# Foundation inspector — rocko build report r4 (FI-ROCKO-6: corrections for FI-FILBERT-6 findings F1–F6) + +Author: rocko (Claude Fable 5.1). Coordinator: darkwing. Reviewer: filbert. Task: FI-ROCKO-6. +Written 2026-09-07 14:40 UTC. Supersedes nothing: the original report, r2 and r3 +reports/manifests, the charter, the addendum and both verdicts are preserved unedited. +This revision records the corrections to filbert's NOT APPROVED code verdict +(FI-FILBERT-6), what changed r3 → r4, the new witness receipts, and the frozen +candidate for independent re-review. + +## 0. Admission, compatibility and blockers + +FI-ROCKO-6 is **admitted and compatible** with the standing chain, the FI-ROCKO-3 +build request and the corrections request; the code/test work is complete under the +original allowlist plus the two new r4 receipt paths. C1 (Archify rev 3) remains HELD +with no lane action. + +**One test-authorization blocker is reported, not worked around (details in §7):** +`scripts/test-task.sh` and `scripts/test-release.sh` were **not run** in r4. In this +session `docker info` succeeds, so both suites would execute their Docker branches, +and `test-task.sh` would additionally execute its live branch (real `run-task.sh` +engine launches with the operator's configuration and credentials). The corrections +request forbids silently running legacy live branches and forbids substituting skips or +stubs to claim the gate green. Darkwing owns arranging that isolated integration gate. +The three suites without Docker/live/credential branches (`test-config.sh`, +`test-conductor.sh`, `test-auth.sh`) were run and pass (§6). + +Inputs bound to this revision: + +| Input | sha256 | +|---|---| +| Charter candidate 3 `docs/plans/2026-09-06_foundation-inspector-charter.md` (unchanged) | `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` | +| Addendum FI-C2-1 (unchanged) | `afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5` | +| Filbert code verdict FI-FILBERT-6 `2026-09-06_foundation-inspector-code-verdict.md` | `e4cc5970aab20240e6ea3a9a1513ef942ff167fefbb03356b9a32c89999adb3d` | +| Corrections request `2026-09-07_foundation-inspector-corrections-request.md` | `35c237f5c001832a0cfed23b03ff7530ffa78443612ffe11130fe456b968bd61` | +| `records.schema.json` / `check.py` / `records.fixtures.json` (pinned, unchanged) | `05774aaf…72af6` / `82564a7d…4607` / `d433d06d…da85` (full values in the manifest; re-verified by oracle gate 1) | +| r3 report / r3 manifest (preserved) | `ec0444c94c9caf16472fdba1ff3fbc767dffd1a798b9a2da837598c9f4b25508` / `3c2253b6c9f31e448c77aaac53977d41baecfb30e15845dcfffd8dc694428547` | +| Integration HEAD (unchanged, nothing staged) | `9a5fbdbda74b16adf488fe28138b2ba69ea5e669` | +| Machine-generated manifest `2026-09-07_foundation-inspector-rocko-build-manifest-r4.json` | `2a2e885f9df3dd626a09fe5db6e28af67c289e54660872031c18f8aa40cb0826` (331 files) | + +Toolchain measured: Node v26.8.1, CPython 3.12.8, jsonschema 4.26.0, Linux +7.2.2-1-cachyos x86_64. + +## 1. Evidence preservation + +The declared scratch evidence still exists at +`/tmp/fi-filbert-6.42ru903e-evidence/witnesses/`. All nine witness bundles named in +the verdict were re-hashed before use and match the verdict's listed values: +`missing-agent-registry-declarations` 78efd6fb…, `consulted-dependency-undeclared-authorization` cc78be28…, +`assigned-change-without-work-read` 35ee45e6…, `proposal-task-only-contexts-without-work-read` e1a9cd88…, +`proposal-issuer-denies-work-read` 34d1ed80…, `acyclic-versioned-history-false-cycle` e3dd1cd3…, +`shape-order-forward` 689f9aa9…, `shape-order-reversed` d14fca5e…, +`message-priority-after-structural-validation` 9e2ec77b…. Each recipe was rebuilt from +the frozen demo bundles inside `build-fixtures.mjs`; four rebuilt fixtures are +byte-identical to the corresponding witness files +(`adm-assigned-task-without-work-read`, `cycle-acyclic-versioned-history-file-change`, +`prop-issuer-denies-work-read`, `prop-task-only-contexts-without-work-read`), the +other five are semantically equivalent reconstructions. No other reviewer/fleet files +were inspected. Prior r1–r3 evidence, fixtures and goldens are preserved: all 259 +previously indexed cases keep their expectations, the five demo bundles and their +goldens are byte-identical to r3. + +## 2. Per-finding closure + +Pre-fix outcomes below were measured on the r3 candidate against the witness files; +post-fix outcomes are the r4 receipts (§6, all with empty stderr). + +### F1 — referenced declarations incompletely enforced → CLOSED + +Root cause: `harnessRef`, `settingsRef`, `soulRef`, `instructionRefs`, `skillRefs` +and `endpointRefs` were shape-checked but never resolved against the declared +`registries`; consulted dependency/mission authorizations were used without a +declaration check. + +Change (`resolve.mjs`): new `Model.requireRegistryDeclaration(ref, where)` resolves a +reference by **exact four-field match** (registry, id, revision, digest) against the +declared registries and refuses `3 / missing-state / registry-declaration-missing` +otherwise; new `Model.declaredLayer(restrictions, where)` resolves every +`endpointRefs[i]` before computing a layer, and every layer computation in the Model +(registry content, registration, delegation issuer ceiling, task, mission, execution, +proposal issuer) now goes through it. `computeContext` resolves the selected agent's +harness/settings/soul/instruction/skill references at the admission stage (after the +agent-status check, before the mandatory policy ceiling) and calls +`requireAuthorization` for each consulted dependency (mission authorization was already +checked). `evaluateProposal` step 5 additionally requires the **subject** task's +authorization (previously only the target task's). + +Witnesses: `missing-agent-registry-declarations` exit 0 allowed → **3 refused / +missing-state / registry-declaration-missing**; `consulted-dependency-undeclared-authorization` +exit 0 allowed → **3 refused / missing-state / authorization-undeclared**. +Fixtures (14): nine absence/mismatch negatives (`adm-registry-declaration-missing-agent-refs`, +`-missing-settings`, `-missing-soul`, `-missing-instruction`, `-missing-skill`, +`-missing-endpoint-execution`, `-missing-endpoint-task`, `-digest-mismatch`, +`-revision-mismatch`), `adm-dependency-authorization-undeclared`, +`adm-mission-authorization-undeclared`, `prop-subject-task-authorization-undeclared`, +and positive controls `adm-registry-declaration-unselected-agent-ignored`, +`adm-registry-declaration-endpoint-declared`, `adm-unconsulted-authorization-ignored`. +Unit tests: "F1: consulted registry references resolve by exact four-field declaration +at the admission stage", "F1: consulted dependency and mission authorizations must be +declared". + +### F2 — task-only contexts evade required work.read → CLOSED + +Root cause: `consultedWork` was set only when a mission or dependency was resolved, so +a bound task without those references was never treated as consulted work; the same +condition was in `checkWorkAccess`. + +Change: the assigned task is consulted work by definition; `computeContext` sets +`consultedWork` when the task is bound (L7), and `checkWorkAccess` requires `work.read` +unconditionally after its scope guards. Genuinely taskless reads (no assignment) are +unchanged. + +Witnesses: `assigned-change-without-work-read` exit 0 allowed → **3 refused / +not-authorized / consulted-work-not-readable**; `proposal-task-only-contexts-without-work-read` +exit 3 unresolved → **3 refused / consulted-work-not-readable**, proposal step +`requester-lacks-original-scope-authority`. Fixtures (6): `adm-assigned-task-without-work-read`, +`adm-assigned-task-without-work-read-read-op` (a `read` operation still needs +`work.read`), `prop-task-only-contexts-without-work-read` (original step), +`prop-task-only-target-context-without-work-read` (target step, +`requester-lacks-target-scope-authority`), positives `assigned-task-only-with-work-read` +(exit 0) and `prop-task-only-contexts-with-work-read` (unresolved). Unit test: "F2: a +bound task is consulted work; work.read is required even without mission/dependency +references". + +### F3 — issuer narrowing does not recheck work access → CLOSED + +Root cause: work access was checked before the issuer ceiling was applied; only +`assignment.change` was rechecked on the narrowed layers. + +Change: `evaluateProposal` now runs `recheck(id, context, work, scope, label)` for +**both** requester contexts on the issuer-narrowed layer +(`intersectLayers(context.layer, issuer)`): `work.read` on the narrowed layer +(`consulted-work-not-readable`), `assignment.change` on the narrowed layer +(`operation-not-permitted`, where `