# Foundation inspector — rocko build report r4 (FI-ROCKO-6: corrections for FI-FILBERT-6 findings F1–F6)

Author: rocko (Claude Fable 5.1). Coordinator: darkwing. Reviewer: filbert. Task: FI-ROCKO-6.
Written 2026-09-07 14:40 UTC. Supersedes nothing: the original report, r2 and r3
reports/manifests, the charter, the addendum and both verdicts are preserved unedited.
This revision records the corrections to filbert's NOT APPROVED code verdict
(FI-FILBERT-6), what changed r3 → r4, the new witness receipts, and the frozen
candidate for independent re-review.

## 0. Admission, compatibility and blockers

FI-ROCKO-6 is **admitted and compatible** with the standing chain, the FI-ROCKO-3
build request and the corrections request; the code/test work is complete under the
original allowlist plus the two new r4 receipt paths. C1 (Archify rev 3) remains HELD
with no lane action.

**One test-authorization blocker is reported, not worked around (details in §7):**
`scripts/test-task.sh` and `scripts/test-release.sh` were **not run** in r4. In this
session `docker info` succeeds, so both suites would execute their Docker branches,
and `test-task.sh` would additionally execute its live branch (real `run-task.sh`
engine launches with the operator's configuration and credentials). The corrections
request forbids silently running legacy live branches and forbids substituting skips or
stubs to claim the gate green. Darkwing owns arranging that isolated integration gate.
The three suites without Docker/live/credential branches (`test-config.sh`,
`test-conductor.sh`, `test-auth.sh`) were run and pass (§6).

Inputs bound to this revision:

| Input | sha256 |
|---|---|
| Charter candidate 3 `docs/plans/2026-09-06_foundation-inspector-charter.md` (unchanged) | `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` |
| Addendum FI-C2-1 (unchanged) | `afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5` |
| Filbert code verdict FI-FILBERT-6 `2026-09-06_foundation-inspector-code-verdict.md` | `e4cc5970aab20240e6ea3a9a1513ef942ff167fefbb03356b9a32c89999adb3d` |
| Corrections request `2026-09-07_foundation-inspector-corrections-request.md` | `35c237f5c001832a0cfed23b03ff7530ffa78443612ffe11130fe456b968bd61` |
| `records.schema.json` / `check.py` / `records.fixtures.json` (pinned, unchanged) | `05774aaf…72af6` / `82564a7d…4607` / `d433d06d…da85` (full values in the manifest; re-verified by oracle gate 1) |
| r3 report / r3 manifest (preserved) | `ec0444c94c9caf16472fdba1ff3fbc767dffd1a798b9a2da837598c9f4b25508` / `3c2253b6c9f31e448c77aaac53977d41baecfb30e15845dcfffd8dc694428547` |
| Integration HEAD (unchanged, nothing staged) | `9a5fbdbda74b16adf488fe28138b2ba69ea5e669` |
| Machine-generated manifest `2026-09-07_foundation-inspector-rocko-build-manifest-r4.json` | `2a2e885f9df3dd626a09fe5db6e28af67c289e54660872031c18f8aa40cb0826` (331 files) |

Toolchain measured: Node v26.8.1, CPython 3.12.8, jsonschema 4.26.0, Linux
7.2.2-1-cachyos x86_64.

## 1. Evidence preservation

The declared scratch evidence still exists at
`/tmp/fi-filbert-6.42ru903e-evidence/witnesses/`. All nine witness bundles named in
the verdict were re-hashed before use and match the verdict's listed values:
`missing-agent-registry-declarations` 78efd6fb…, `consulted-dependency-undeclared-authorization` cc78be28…,
`assigned-change-without-work-read` 35ee45e6…, `proposal-task-only-contexts-without-work-read` e1a9cd88…,
`proposal-issuer-denies-work-read` 34d1ed80…, `acyclic-versioned-history-false-cycle` e3dd1cd3…,
`shape-order-forward` 689f9aa9…, `shape-order-reversed` d14fca5e…,
`message-priority-after-structural-validation` 9e2ec77b…. Each recipe was rebuilt from
the frozen demo bundles inside `build-fixtures.mjs`; four rebuilt fixtures are
byte-identical to the corresponding witness files
(`adm-assigned-task-without-work-read`, `cycle-acyclic-versioned-history-file-change`,
`prop-issuer-denies-work-read`, `prop-task-only-contexts-without-work-read`), the
other five are semantically equivalent reconstructions. No other reviewer/fleet files
were inspected. Prior r1–r3 evidence, fixtures and goldens are preserved: all 259
previously indexed cases keep their expectations, the five demo bundles and their
goldens are byte-identical to r3.

## 2. Per-finding closure

Pre-fix outcomes below were measured on the r3 candidate against the witness files;
post-fix outcomes are the r4 receipts (§6, all with empty stderr).

### F1 — referenced declarations incompletely enforced → CLOSED

Root cause: `harnessRef`, `settingsRef`, `soulRef`, `instructionRefs`, `skillRefs`
and `endpointRefs` were shape-checked but never resolved against the declared
`registries`; consulted dependency/mission authorizations were used without a
declaration check.

Change (`resolve.mjs`): new `Model.requireRegistryDeclaration(ref, where)` resolves a
reference by **exact four-field match** (registry, id, revision, digest) against the
declared registries and refuses `3 / missing-state / registry-declaration-missing`
otherwise; new `Model.declaredLayer(restrictions, where)` resolves every
`endpointRefs[i]` before computing a layer, and every layer computation in the Model
(registry content, registration, delegation issuer ceiling, task, mission, execution,
proposal issuer) now goes through it. `computeContext` resolves the selected agent's
harness/settings/soul/instruction/skill references at the admission stage (after the
agent-status check, before the mandatory policy ceiling) and calls
`requireAuthorization` for each consulted dependency (mission authorization was already
checked). `evaluateProposal` step 5 additionally requires the **subject** task's
authorization (previously only the target task's).

Witnesses: `missing-agent-registry-declarations` exit 0 allowed → **3 refused /
missing-state / registry-declaration-missing**; `consulted-dependency-undeclared-authorization`
exit 0 allowed → **3 refused / missing-state / authorization-undeclared**.
Fixtures (14): nine absence/mismatch negatives (`adm-registry-declaration-missing-agent-refs`,
`-missing-settings`, `-missing-soul`, `-missing-instruction`, `-missing-skill`,
`-missing-endpoint-execution`, `-missing-endpoint-task`, `-digest-mismatch`,
`-revision-mismatch`), `adm-dependency-authorization-undeclared`,
`adm-mission-authorization-undeclared`, `prop-subject-task-authorization-undeclared`,
and positive controls `adm-registry-declaration-unselected-agent-ignored`,
`adm-registry-declaration-endpoint-declared`, `adm-unconsulted-authorization-ignored`.
Unit tests: "F1: consulted registry references resolve by exact four-field declaration
at the admission stage", "F1: consulted dependency and mission authorizations must be
declared".

### F2 — task-only contexts evade required work.read → CLOSED

Root cause: `consultedWork` was set only when a mission or dependency was resolved, so
a bound task without those references was never treated as consulted work; the same
condition was in `checkWorkAccess`.

Change: the assigned task is consulted work by definition; `computeContext` sets
`consultedWork` when the task is bound (L7), and `checkWorkAccess` requires `work.read`
unconditionally after its scope guards. Genuinely taskless reads (no assignment) are
unchanged.

Witnesses: `assigned-change-without-work-read` exit 0 allowed → **3 refused /
not-authorized / consulted-work-not-readable**; `proposal-task-only-contexts-without-work-read`
exit 3 unresolved → **3 refused / consulted-work-not-readable**, proposal step
`requester-lacks-original-scope-authority`. Fixtures (6): `adm-assigned-task-without-work-read`,
`adm-assigned-task-without-work-read-read-op` (a `read` operation still needs
`work.read`), `prop-task-only-contexts-without-work-read` (original step),
`prop-task-only-target-context-without-work-read` (target step,
`requester-lacks-target-scope-authority`), positives `assigned-task-only-with-work-read`
(exit 0) and `prop-task-only-contexts-with-work-read` (unresolved). Unit test: "F2: a
bound task is consulted work; work.read is required even without mission/dependency
references".

### F3 — issuer narrowing does not recheck work access → CLOSED

Root cause: work access was checked before the issuer ceiling was applied; only
`assignment.change` was rechecked on the narrowed layers.

Change: `evaluateProposal` now runs `recheck(id, context, work, scope, label)` for
**both** requester contexts on the issuer-narrowed layer
(`intersectLayers(context.layer, issuer)`): `work.read` on the narrowed layer
(`consulted-work-not-readable`), `assignment.change` on the narrowed layer
(`operation-not-permitted`, where `<label>+issuer`), then the full `checkWorkAccess`
path/network intersection.

Witness: `proposal-issuer-denies-work-read` exit 3 unresolved → **3 refused /
not-authorized / consulted-work-not-readable**, step
`requester-lacks-original-scope-authority`. Fixtures (3): `prop-issuer-denies-work-read`,
`prop-issuer-denies-work-read-task-only` (F2+F3 combined), positive
`prop-issuer-grants-work-read` (unresolved). Unit test: "F3: the issuer ceiling
narrows both requester calculations and work access is rechecked" (includes an
`intersectLayers` algebra witness for the target scope; see §3(c)).

### F4 — cycle construction merges historical revisions → CLOSED

Root cause: `checkCycles` keyed dependency/parent/supersedes nodes by identity without
revision and unioned edges over every historical record.

Change: nodes are exact record keys (identity **and** revision) and edges are the
exact four-field references of each record; the identity-merged union and its
post-sort loop were removed. Cycle-before-continuity precedence is unchanged.

Witness: `acyclic-versioned-history-false-cycle` exit 2 dependency-cycle → **exit 0
allowed**. Fixtures (5): positives `cycle-acyclic-versioned-history` (read) and
`cycle-acyclic-versioned-history-file-change` (byte-identical to the witness);
`cycle-dependency-cross-revision` still detects a real cycle through exact revisions
(`dependency-cycle`); `cycle-mission-parent-old-revision-only` (self-parent in a
superseded revision remains `mission-parent-cycle`);
`cycle-mission-parent-previous-revision-not-a-cycle` (a workspace mission whose parent
is its own previous revision is acyclic in the exact graph and fails the ownership
stage as `mission-parent-scope-mismatch`). Unit test: "F4: cycle graphs are
revision-exact; contiguous history with reversed edges is not a cycle" (compares
`findCycle` on the exact graph versus the old merged graph).

### F5 — first-failure ordering not preserved → CLOSED

Root causes: (1) record shape validation walked the input array before the Model's
stable sort; (2) the `message-is-not-authority` check ran after requester admission.

Change: (1) new `shapeValidationOrder(records)` orders records **before** shape
validation using a tolerant key (kind, id, scope, revision when present; identified
records first, then a canonical-content tie-break, then input index) so the first
shape failure is independent of input order even when a record is too malformed to
key; (2) `evaluateProposal` performs the §5 message check immediately after both
requester contexts bind (structural validation) and before any head/authority step;
step 3 keeps only `delegation-missing`.

Witnesses: `shape-order-forward` / `shape-order-reversed` (`shape-enum-mismatch` /
`shape-unknown-field`) → **both `shape-enum-mismatch`**;
`message-priority-after-structural-validation` exit 3 operation-not-permitted /
`requester-lacks-original-scope-authority` → **3 refused / not-authorized /
message-is-not-authority**, proposal rule `message-is-not-authority`. Fixtures (8):
`shape-order-forward`, `shape-order-reversed`, `shape-order-malformed-record-sorts-last`,
`shape-order-only-malformed-record`, `prop-message-precedes-requester-admission`,
`prop-message-precedes-stale-subject`, `prop-message-after-structural-failure`
(structural failure still wins: `requester-context-mismatch`),
`prop-delegation-missing-after-requester-admission` (no message: requester admission
still precedes `delegation-missing`). Unit tests: "F5: the first shape failure is
independent of record input order, including malformed records" (four permutations,
malformed record moved, two unidentified records), "F5: message-is-not-authority
follows structural validation and precedes requester admission".

### F6 — inventories omit ownership → CLOSED

`cli.test.mjs` inventory rows now include `uid` and `gid`; `test-foundation.sh`
inventories with `stat -c '%n %F %s %a %u %g %i %Y'` and the check is labelled
"sandbox inventory (path/type/size/mode/uid/gid/inode/mtime/sha256) unchanged by runs".

## 3. Design decisions and disclosures for the reviewer

- (a) **Rule identifier `registry-declaration-missing` is writer-chosen.** The charter
  names the outcome (missing declaration → missing-state admission refusal) but not an
  identifier; the vocabulary entry sits in the stage-9 group next to
  `authorization-undeclared`/`artifact-undeclared`. No new contract rule is claimed;
  if darkwing/filbert prefer an existing identifier, the rename is mechanical.
- (b) **Declared lists are still shape-validated in input order.** `shapeValidationOrder`
  applies to `bundle.records` only; `registries`, `artifacts`, `authorizations` and
  `delegationInputs` remain in inventory order. The verdict's F5 witnesses concern
  records; extending the sort to declaration lists is a small follow-up if required.
- (c) **The target-scope post-issuer failure is unreachable through the CLI.** Issuer
  narrowing is scope-independent, so whenever the narrowed target layer lacks
  `work.read` the original scope has already failed first. The target branch is covered
  by the `intersectLayers` algebra assertion in the F3 unit test, not by a CLI fixture.
- (d) **Subject-task authorization** is now required at step 5 alongside the target
  task's. This follows the F1 principle (consulted work must be declared); it was not an
  explicit verdict witness and is flagged in case the reviewer reads §5 more narrowly.
- (e) **No currentness rule** was added for harness/settings/context-content/endpoint
  references: they must match a declaration exactly (§10.1); only the mandatory policy
  keeps its `policy-ceiling-stale` currentness check.
- (f) Agent declaration checks run after the agent-status check and before the policy
  ceiling; a disabled agent therefore still refuses as `agent-disabled` first.
- (g) **Correction to r3 §6.** r3 stated "no engine launch". That was true of the
  inspector work, but the r3 `test-task.sh` receipt (90/0) included the suite's Docker
  and live branches (live hello, session fork, onboarding recall) because Docker was
  reachable during that run. r3's receipt therefore rested on a live legacy branch that
  FI-ROCKO-6 identifies as unauthorized; r4 does not repeat it (§7). The r3 report is
  preserved unedited; this entry is the correction.

## 4. Changed files (r3 → r4 sha256; everything else byte-identical, 37 fixtures added)

| File | r3 | r4 |
|---|---|---|
| `scripts/foundation/resolve.mjs` | `eaa4a41961832891…` | `777dd415021a54a3…` |
| `scripts/foundation/resolve.test.mjs` | `d7de059015edcf0b…` | `cab963cd7b80957d…` |
| `scripts/foundation/cli.test.mjs` | `a0bda7779739021d…` | `566abb49770b5d23…` |
| `scripts/foundation/fixtures/build-fixtures.mjs` | `0386276f0e0ba8fb…` | `f731b1f1da04ecc2…` |
| `scripts/foundation/fixtures/index.json` | `c013090406bb6bbb…` | `9a963a0e58770e4f…` |
| `scripts/foundation/fixtures/README.md` | `ed0376589b203b1b…` | `9dc57df95eb6849d…` |
| `scripts/test-foundation.sh` | `73417979d1f93206…` | `6f808ea8f4a021e3…` |

Full hashes for every file, plus per-directory aggregates, are in the r4 manifest.
Untouched: `foundation-inspect.mjs`, `strict-json.mjs`, `canonical.mjs`,
`validate-record.mjs`, `verify-schema.py`, `fixtures.test.mjs`, all 259 prior
bundles/raw cases, all demo bundles and goldens.

## 5. New fixture inventory (37 cases; 296 total)

Groups after r4: admission 62, positive 21, continuity 2, cycle 6, ownership 10,
proposal 48, identity 5, operation 7, profile 37, shape 61, lexical 19,
registration-delegation 13, structure 5.

| Case | Group | exit result / reason / rule [/ proposal rule] |
|---|---|---|
| adm-registry-declaration-missing-agent-refs, -missing-settings, -missing-soul, -missing-instruction, -missing-skill, -missing-endpoint-execution, -missing-endpoint-task, -digest-mismatch, -revision-mismatch | admission | 3 refused / missing-state / registry-declaration-missing |
| adm-dependency-authorization-undeclared, adm-mission-authorization-undeclared | admission | 3 refused / missing-state / authorization-undeclared |
| adm-registry-declaration-unselected-agent-ignored, adm-registry-declaration-endpoint-declared, adm-unconsulted-authorization-ignored | positive | 0 allowed |
| adm-assigned-task-without-work-read, adm-assigned-task-without-work-read-read-op | admission | 3 refused / not-authorized / consulted-work-not-readable |
| assigned-task-only-with-work-read | positive | 0 allowed |
| prop-task-only-contexts-without-work-read, prop-issuer-denies-work-read, prop-issuer-denies-work-read-task-only | proposal | 3 refused / not-authorized / consulted-work-not-readable / requester-lacks-original-scope-authority |
| prop-task-only-target-context-without-work-read | proposal | 3 refused / not-authorized / consulted-work-not-readable / requester-lacks-target-scope-authority |
| prop-task-only-contexts-with-work-read, prop-issuer-grants-work-read | proposal | 3 unresolved / unknown-effects / runtime-reconciliation-required / runtime-reconciliation-required |
| prop-subject-task-authorization-undeclared | proposal | 3 refused / missing-state / authorization-undeclared / intent-not-current |
| cycle-acyclic-versioned-history, cycle-acyclic-versioned-history-file-change | positive | 0 allowed |
| cycle-dependency-cross-revision | cycle | 2 invalid / invalid-request / dependency-cycle |
| cycle-mission-parent-old-revision-only | cycle | 2 invalid / invalid-request / mission-parent-cycle |
| cycle-mission-parent-previous-revision-not-a-cycle | ownership | 2 invalid / invalid-request / mission-parent-scope-mismatch |
| shape-order-forward, shape-order-reversed, shape-order-malformed-record-sorts-last | shape | 2 invalid / invalid-request / shape-enum-mismatch |
| shape-order-only-malformed-record | shape | 2 invalid / invalid-request / shape-missing-field |
| prop-message-precedes-requester-admission, prop-message-precedes-stale-subject | proposal | 3 refused / not-authorized / message-is-not-authority / message-is-not-authority |
| prop-message-after-structural-failure | proposal | 2 invalid / invalid-request / requester-context-mismatch |
| prop-delegation-missing-after-requester-admission | proposal | 3 refused / not-authorized / operation-not-permitted / requester-lacks-original-scope-authority |

## 6. Receipts (run 2026-09-07 09:2x–14:39 UTC at HEAD 9a5fbdbd)

| Check | Result |
|---|---|
| Verdict witness files (nine, hashes verified), run with `env -i HOME=/nonexistent PATH=/nonexistent` | missing-agent-registry-declarations → 3 refused/missing-state/registry-declaration-missing; consulted-dependency-undeclared-authorization → 3 refused/missing-state/authorization-undeclared; assigned-change-without-work-read → 3 refused/not-authorized/consulted-work-not-readable; proposal-task-only-contexts-without-work-read → 3 refused/consulted-work-not-readable (step requester-lacks-original-scope-authority); proposal-issuer-denies-work-read → same; acyclic-versioned-history-false-cycle → 0 allowed; shape-order-forward and shape-order-reversed → 2 shape-enum-mismatch; message-priority-after-structural-validation → 3 refused/not-authorized/message-is-not-authority (proposal rule message-is-not-authority); positive-control → 0 allowed. stderr empty for all. The three exploratory blocked-subject/target probes in the same directory remain unresolved/runtime-reconciliation-required, as the verdict §5 expects. |
| `node --check` on all 10 `.mjs` files; `ast.parse` on `verify-schema.py` | OK |
| `node --test scripts/foundation/` | 70 tests, 70 pass, 0 fail (was 63; +7 F1–F5 tests) |
| `python3 scripts/foundation/verify-schema.py` | **PASS**, exit 0. Corpus 1563 records (38 pinned fixtures, 473 unique bundle records, 1052 typeCase/mutation/lexical). Schema column: agree-valid 539, agree-invalid 987, **DISAGREEMENTS 0**; strict-only 27; unsupported-kind not assessed 10. Profile column: profile-valid 509, profile-invalid 30; 30 refusals asserted, 73 named probes verified |
| `NO_COLOR=1 scripts/test-foundation.sh` | **`selftest: 43 passed, 0 failed`**, including "sandbox inventory (path/type/size/mode/uid/gid/inode/mtime/sha256) unchanged by runs" |
| `python3 docs/plans/foundation-v1-candidate/check.py` | exit 0, `PASS: 35` |
| `scripts/test-config.sh` / `test-conductor.sh` / `test-auth.sh` | 24/0, 17/0, 15/0 passed/failed (no Docker, no network, no credentials; conductor commits only inside its sandbox clones) |
| `scripts/test-task.sh` / `scripts/test-release.sh` | **NOT RUN — test-authorization blocker, §7** |
| Fixture regeneration | `build-fixtures.mjs` into a sandbox equals checked-in `bundles/`, `raw/`, `index.json`, demo bundles (296/296 cases match through the CLI) |
| `git rev-parse HEAD`; `git status` | `9a5fbdbd…`; nothing staged; only the pre-existing tracked modifications (BUILD-LOG.md, docs/SESSIONS.md, docs/plans/CURRENT.md) plus untracked candidate/review files |
| `__pycache__` directories | none created (`PYTHONDONTWRITEBYTECODE=1`) |

## 7. Integration-gate blocker (reported, not skipped)

- `scripts/test-task.sh` gates two sections on `docker info`: the adapter-seam mock
  cases (container launches, no provider) and the live cases (`run-task.sh run` with
  the real engine, provider credentials, session forks and onboarding recall). In this
  session `docker info` returns 0, so an unmodified run executes both sections.
- `scripts/test-release.sh` gates its state-machine cases on `docker info` (package /
  activate / rollback against Docker images).
- Running either suite would launch containers and, for `test-task.sh`, a live engine
  under the operator's configuration: outside FI-ROCKO-6's authorization. Masking Docker
  (for example an empty `PATH`) would print the suites' own "skip … (docker unavailable)"
  lines and additionally fail `test-task.sh`'s unconditional onboarding recall; that is
  the substitute-skip the request forbids. The suites are outside the allowlist, so no
  fast-only entry point can be added by the writer.
- Required from darkwing: an explicitly authorized, isolated, non-live run of the two
  suites (or a ruling that the fast sections are sufficient for this gate), as the
  verdict §5 already identified. Nothing in r4 touches the code those suites exercise.

## 8. Constraints honoured and freeze

No edit to charter, addendum, verdicts, corrections request, pinned schema/checker/
fixtures, prior reports or manifests, CURRENT, shared logs, root/package files,
policies or runtime data. No new dependency. No staging, commit, checkout/reset or
push (Dewey's index untouched). No live, native/sync, credential or `~/.mosaic` work;
no network; no engine launch in r4. Tests spawn the inspector; the inspector spawns
nothing. Finite tests and static flags are evidence, not sandbox proof.

Frozen at the r4 manifest (`…-rocko-build-manifest-r4.json`, sha256 `2a2e885f…0826`;
331 files) for filbert's independent re-review. Rocko changes nothing under the
allowlist until darkwing returns reconciled findings. C1 (Archify rev 3) remains HELD;
no lane action taken.