feat(foundation): offline synthetic scope/permission inspector (FI-FILBERT-8 APPROVED r6)

Rocko-authored, Filbert-reviewed inspector (r6 manifest a4a44930...) with full review/build/verdict evidence under docs/plans/reviews. 43/0 selftests, oracle zero-disagreement, foundation checker PASS. Owner A9 acceptance recorded separately.
2026-09-07 14:06:35 -05:00
parent 127a54fdff
commit 8ebddd6f93
423 changed files with 665972 additions and 0 deletions
@@ -0,0 +1 @@
+3
@@ -0,0 +1,31 @@
+{
+  "disclaimer": "SYNTHETIC PREVIEW — NO LIVE EFFECTS",
+  "preview": "preview: no live registrations or permission grants",
+  "bundleVersion": 1,
+  "authentication": "not-modelled",
+  "declarations": "unverified-simulation",
+  "result": "refused",
+  "reason": "not-authorized",
+  "rule": "registration-revoked",
+  "selection": {
+    "agentId": "agent-a",
+    "projectId": "p1",
+    "workspaceId": "w1",
+    "assignmentRef": {
+      "kind": "assignment",
+      "id": "asg-a-w1",
+      "scope": {
+        "kind": "workspace",
+        "projectId": "p1",
+        "workspaceId": "w1"
+      },
+      "revision": 1
+    }
+  },
+  "operation": {
+    "name": "work.read",
+    "target": null
+  },
+  "proposal": null,
+  "diagnostic": null
+}
@@ -0,0 +1,10 @@
+SYNTHETIC PREVIEW — NO LIVE EFFECTS
+preview: no live registrations or permission grants
+authentication: not-modelled; declarations: unverified-simulation
+result: refused
+reason: not-authorized
+rule: registration-revoked
+selection: agent agent-a, project p1, workspace w1, assignment assignment asg-a-w1 @workspace:p1/w1 rev 1
+operation: work.read target null
+proposal: null
+diagnostic: null
@@ -0,0 +1 @@
+3
@@ -0,0 +1,45 @@
+{
+  "disclaimer": "SYNTHETIC PREVIEW — NO LIVE EFFECTS",
+  "preview": "preview: no live registrations or permission grants",
+  "bundleVersion": 1,
+  "authentication": "not-modelled",
+  "declarations": "unverified-simulation",
+  "result": "unresolved",
+  "reason": "unknown-effects",
+  "rule": "runtime-reconciliation-required",
+  "selection": {
+    "agentId": "agent-a",
+    "projectId": "p1",
+    "workspaceId": "w1",
+    "assignmentRef": {
+      "kind": "assignment",
+      "id": "asg-a-w1",
+      "scope": {
+        "kind": "workspace",
+        "projectId": "p1",
+        "workspaceId": "w1"
+      },
+      "revision": 1
+    }
+  },
+  "operation": {
+    "name": "assignment.change",
+    "target": null
+  },
+  "proposal": {
+    "result": "unresolved",
+    "reason": "unknown-effects",
+    "rule": "runtime-reconciliation-required",
+    "selectedAssignmentRef": {
+      "kind": "assignment",
+      "id": "asg-a-w1",
+      "scope": {
+        "kind": "workspace",
+        "projectId": "p1",
+        "workspaceId": "w1"
+      },
+      "revision": 1
+    }
+  },
+  "diagnostic": null
+}
@@ -0,0 +1,10 @@
+SYNTHETIC PREVIEW — NO LIVE EFFECTS
+preview: no live registrations or permission grants
+authentication: not-modelled; declarations: unverified-simulation
+result: unresolved
+reason: unknown-effects
+rule: runtime-reconciliation-required
+selection: agent agent-a, project p1, workspace w1, assignment assignment asg-a-w1 @workspace:p1/w1 rev 1
+operation: assignment.change target null
+proposal: unresolved (unknown-effects; runtime-reconciliation-required) selected assignment assignment asg-a-w1 @workspace:p1/w1 rev 1
+diagnostic: null
@@ -0,0 +1 @@
+0
@@ -0,0 +1,34 @@
+{
+  "disclaimer": "SYNTHETIC PREVIEW — NO LIVE EFFECTS",
+  "preview": "preview: no live registrations or permission grants",
+  "bundleVersion": 1,
+  "authentication": "not-modelled",
+  "declarations": "unverified-simulation",
+  "result": "allowed",
+  "reason": "allowed",
+  "rule": null,
+  "selection": {
+    "agentId": "agent-a",
+    "projectId": "p1",
+    "workspaceId": "w1",
+    "assignmentRef": {
+      "kind": "assignment",
+      "id": "asg-a-w1",
+      "scope": {
+        "kind": "workspace",
+        "projectId": "p1",
+        "workspaceId": "w1"
+      },
+      "revision": 1
+    }
+  },
+  "operation": {
+    "name": "file.change",
+    "target": {
+      "root": "workspace",
+      "path": "src/main.mjs"
+    }
+  },
+  "proposal": null,
+  "diagnostic": null
+}
@@ -0,0 +1,10 @@
+SYNTHETIC PREVIEW — NO LIVE EFFECTS
+preview: no live registrations or permission grants
+authentication: not-modelled; declarations: unverified-simulation
+result: allowed
+reason: allowed
+rule: null
+selection: agent agent-a, project p1, workspace w1, assignment assignment asg-a-w1 @workspace:p1/w1 rev 1
+operation: file.change target workspace:src/main.mjs
+proposal: null
+diagnostic: null
@@ -0,0 +1 @@
+0
@@ -0,0 +1,31 @@
+{
+  "disclaimer": "SYNTHETIC PREVIEW — NO LIVE EFFECTS",
+  "preview": "preview: no live registrations or permission grants",
+  "bundleVersion": 1,
+  "authentication": "not-modelled",
+  "declarations": "unverified-simulation",
+  "result": "allowed",
+  "reason": "allowed",
+  "rule": null,
+  "selection": {
+    "agentId": "agent-a",
+    "projectId": "p1",
+    "workspaceId": "w1",
+    "assignmentRef": {
+      "kind": "assignment",
+      "id": "asg-a-w1",
+      "scope": {
+        "kind": "workspace",
+        "projectId": "p1",
+        "workspaceId": "w1"
+      },
+      "revision": 1
+    }
+  },
+  "operation": {
+    "name": "work.read",
+    "target": null
+  },
+  "proposal": null,
+  "diagnostic": null
+}
@@ -0,0 +1,10 @@
+SYNTHETIC PREVIEW — NO LIVE EFFECTS
+preview: no live registrations or permission grants
+authentication: not-modelled; declarations: unverified-simulation
+result: allowed
+reason: allowed
+rule: null
+selection: agent agent-a, project p1, workspace w1, assignment assignment asg-a-w1 @workspace:p1/w1 rev 1
+operation: work.read target null
+proposal: null
+diagnostic: null
@@ -0,0 +1 @@
+3
@@ -0,0 +1,45 @@
+{
+  "disclaimer": "SYNTHETIC PREVIEW — NO LIVE EFFECTS",
+  "preview": "preview: no live registrations or permission grants",
+  "bundleVersion": 1,
+  "authentication": "not-modelled",
+  "declarations": "unverified-simulation",
+  "result": "refused",
+  "reason": "not-authorized",
+  "rule": "message-is-not-authority",
+  "selection": {
+    "agentId": "agent-a",
+    "projectId": "p1",
+    "workspaceId": "w1",
+    "assignmentRef": {
+      "kind": "assignment",
+      "id": "asg-a-w1",
+      "scope": {
+        "kind": "workspace",
+        "projectId": "p1",
+        "workspaceId": "w1"
+      },
+      "revision": 1
+    }
+  },
+  "operation": {
+    "name": "assignment.change",
+    "target": null
+  },
+  "proposal": {
+    "result": "refused",
+    "reason": "not-authorized",
+    "rule": "message-is-not-authority",
+    "selectedAssignmentRef": {
+      "kind": "assignment",
+      "id": "asg-a-w1",
+      "scope": {
+        "kind": "workspace",
+        "projectId": "p1",
+        "workspaceId": "w1"
+      },
+      "revision": 1
+    }
+  },
+  "diagnostic": null
+}
@@ -0,0 +1,10 @@
+SYNTHETIC PREVIEW — NO LIVE EFFECTS
+preview: no live registrations or permission grants
+authentication: not-modelled; declarations: unverified-simulation
+result: refused
+reason: not-authorized
+rule: message-is-not-authority
+selection: agent agent-a, project p1, workspace w1, assignment assignment asg-a-w1 @workspace:p1/w1 rev 1
+operation: assignment.change target null
+proposal: refused (not-authorized; message-is-not-authority) selected assignment assignment asg-a-w1 @workspace:p1/w1 rev 1
+diagnostic: null