# FI-FILBERT-8 — r6 independent CODE verdict: APPROVED

**APPROVED for the bounded offline-demo code gate only.**
Reviewer: filbert. Sole implementation author: rocko. Coordinator/follow-up: darkwing.
Date: 2026-09-07. No competing assignment is known; I have not authored or fixed the
implementation. Owner A9/demo acceptance remains a separate subsequent gate.

R5-1 is closed: all six exact prior Unicode witness pairs now have stable first
failures. Independent broader-domain and interaction checks support the correction.
No blocking inspector-code finding remains in this review. Two nonblocking
qualifications below correct the byte-identity claim and preserve an auxiliary
native-parser observation without mislabeling it as a passing check.

## 1. Exact reviewed identities and source boundary

| Input | SHA-256 / commit |
|---|---|
| `docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r6.json` | `a4a4493000aff5905337a643886ca36e7c5377d52deed77b8aeab7174ca73dcf` |
| `docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r6.md` | `ee0e83efd7c71eddecf5e26f939e9a34ba85b184cfcd1cffac9ff9e56ea13c37` |
| Charter candidate 3 | `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` |
| Incorporated feasibility r2 §§5–13, subject to charter overrides | `f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1` |
| Pattern/profile addendum | `afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5` |
| Pinned record schema | `05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6` |
| Pinned checker | `82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607` |
| Owner offline-demo test-gate decision | `62cea74bea59e69f29c8a29a9c0311fdc6feffa2c337bc6a141db55149204898` |
| Preserved r5 NOT APPROVED verdict | `154e7b5d804c059d6fec4c936c78e4ae33bb7fc273ba3a5eec7b00d0a9ce1e59` |
| Source/schema baseline | `d4696d09eb1b5dcf1028f30db2cd63735f51cb16` |
| Measured integration HEAD | `9a5fbdbda74b16adf488fe28138b2ba69ea5e669` |

Independently verified before execution and rechecked at **2026-09-07T15:48:19Z**:
382 distinct regular candidate files, exact allowlist/no extras, sizes, modes,
SHA-256s, all six aggregates, report/manifest hashes and every pinned input. Both
shared candidate and exported copies pass. HEAD remains unchanged. This uncommitted
code is bound by the manifest, not falsely claimed to be committed at that HEAD.

Export: `/tmp/fi-filbert-8.ehrv19oo`.
Separate harness/evidence: `/tmp/fi-filbert-8.ehrv19oo-evidence`.
Compared with r5: five candidate files changed, thirteen fixtures added, none removed.
The CLI, strict parser, mock canonicalizer, oracle and other unchanged implementation
paths retain their verified prior identities; changed source/tests/generator were
inspected before execution.

The working-tree `scripts/agent.sh` and `docs/TOOLS.md` modifications were excluded.
Required integration dependencies were exported from the committed baseline. The
relevant agent/common/auth/config/conductor scripts, three authorized legacy tests,
package/RELEASE/policy/README dependencies have no committed difference between that
baseline and measured HEAD. Approval does not cover unrelated working-tree or
native/fleet/goal changes, nor a deployment of the entire current working tree.

## 2. Findings and dispositions

### 1. R5-1 / F5 — CLOSED: total ordering tie-break

Frozen `scripts/foundation/resolve.mjs` SHA-256:
`c4951014828080caf9a5038845104afdac02465af10e94a2fddd3558b29621a3`.
`orderingForm` at approximately lines 730–739 replaces the partial ASCII
canonicalizer in `stableOrder`'s tie-break at approximately 755–770.

Over the actual strict-parser domain, it preserves scalar distinctions, Unicode
strings, array order and object members while sorting object keys by UTF-16 code
unit. Safe integer bounds, paired surrogates, dense arrays and bounded acyclic objects
are supplied by the parser; arbitrary JavaScript objects/nonfinite numbers/getters
are not claimed as supported inputs to this helper. The former exception-to-empty-
string collapse is gone. No normalization, case folding or new Unicode ban appears.
The ordering form is internal, not a digest or emitted record body.

I reran the **exact twelve prior Unicode witness files**, checking their input hashes
against the prior review receipts. All four unkeyed-family pairs now return exit 2 /
shape-type-mismatch; both equal-key pairs return exit 2 / shape-unknown-field in both
orders. The four prior ASCII control pairs also remain stable.

Independent extension beyond writer examples:

- **2,540 strict-parser values**, including safe-integer extrema, all JSON types,
  NFC/NFD/case distinctions, BMP/non-BMP strings and keys, escaped controls, prototype-
  named keys, numeric-looking keys, maximum-length strings, 1024-member arrays/objects
  and depth-32 structures. Forms matched an independently implemented Python
  UTF-16-key-sorted reference for every value; **1,663 distinct structural values/forms**
  had no collisions. Strict-parser round trips and input immutability passed.
- **120 evaluations**: all 24 permutations of four further malformed entries in each
  of the five inventory families; emitted first outcomes remained stable.
- **Ten additional equal-key malformed-record pairs / twenty CLI runs** spanning
  Unicode and escaped control display names. Competing enum/missing-field failures
  matched the first entry independently predicted by Python's ordering reference;
  all pre-admission nulls remained intact.

These are finite compatibility/regression measurements, not exhaustive proof.

### 2. NONBLOCKING — “byte-identical” should say structurally equal parsed values

The report §§2.2/3(a), `stableOrder` comment and test wording overstate the final
index fallback. For example, raw `{"é":1,"a":2}` and
`{"a":2,"\u00e9":1}` have different bytes and insertion orders but the same
ordering form. I independently asserted this distinction and the index tie.

That is correct for JSON object structural equality: member order, whitespace and
escape spelling do not create different values. Array order and distinct string
values remain significant. Thus this is a prose qualification, **not a reopened code
ordering defect**. Future reports/comments should use “structurally equal parsed
values,” not claim byte identity or general JCS conformance. No file was fixed here.

### 3. NONBLOCKING, scoped verification observation — native JSON.parse round trips

An auxiliary warm-run test initially failed a native `JSON.parse`/deep-equality
round-trip comparison. With all anomalies retained, **19 of the 2,540 comparisons**
showed native reparse discrepancies involving object keys. For the initial case,
Python confirmed the raw input, strict-parser serialization and ordering form were
structurally equal; a separate cold native probe did not reproduce that discrepancy.
The full rerun independently verified **every ordering form against Python**, and
strict-parser round trips passed. Detailed raw/form/native-reparse evidence is saved
in `domain-native-disagreements.json`; underlying native-runtime cause is not claimed
as diagnosed or fixed.

This is **not** relabeled as a passing native-parser test or a waived schema mismatch.
The required pinned record oracle was unmodified and independently reported zero
schema disagreements. Production inspector/strict-parser/resolver/canonicalizer
paths do not call native `JSON.parse`; their inspected parsing path uses `parseStrict`.
The observed auxiliary native-reparse behavior therefore does not demonstrate an
inspector-code defect or invalidate the independent form/reference comparison.
Approval remains limited to the tested offline inspector, not general native JSON
parsing, the platform or a live runtime. Preserve this evidence for separately
scoped follow-up rather than asserting universal parser equivalence.

## 3. Retained original findings and A1–A8

The original nine F1–F5 witness inputs were also rerun unchanged. Actual outcomes:

| Finding | r6 disposition |
|---|---|
| F1 declarations | Missing agent registry declarations: exit 3 / missing-state / registry-declaration-missing. Undeclared dependency authorization: exit 3 / missing-state / authorization-undeclared. **Closed.** |
| F2 work.read | Assigned task-only change and task-only proposal refuse consulted-work-not-readable; taskless positives preserved. **Closed.** |
| F3 issuer narrowing | Original issuer-denies-work.read witness refuses consulted-work-not-readable in original requester context; both narrowed contexts remain checked. **Closed.** |
| F4 exact-revision cycles | Original acyclic history allowed; stale selection subsequently reaches assignment-stale. Genuine-cycle/precedence fixtures pass. **Closed.** |
| F5 ordering/message | Original shape-order pair and message priority corrected; all R5-1 pairs now corrected with broader coverage above. **Closed**, subject to structural-equality wording qualification. |
| F6 ownership evidence | Maintained UID/GID checks and independent ownership-inclusive inventories pass. **Closed.** |

The new fixed registry-declaration-missing diagnostic retains the reviewed admission-
stage exit-3 missing-state semantics. Eight independently rerun interactions preserve
structural/duplicate/profile/unsupported-operation precedence ahead of missing
external declarations, message priority, history/currentness and Unicode positives.

| Acceptance group | Independent disposition within tested scope |
|---|---|
| A1 | Positive read/assigned-change previews, exact text/JSON goldens, disclaimers and bounded no-effects checks pass. |
| A2 | Missing registration/cross-project selection refusals, no fallback and body-free privacy checks pass. |
| A3 | Reference, duplicate, ownership, continuity and revision-exact cycle tests pass; detector and CLI precedence remain distinct. |
| A4 | Mandatory and optional policy layers, role/issuer/task/mission/execution narrowing, paths and no-assignment union tests pass; original F1–F3 witnesses corrected. |
| A5 | Parser/format/bounds negatives, zero-waiver record oracle, strict production identity profile and permitted Unicode/free-text controls pass tested domains. |
| A6 | Static I/O/import limits, descriptor tests, canaries and unchanged ownership-inclusive inventories pass; no containment/no-reads proof claimed. |
| A7 | Both requester contexts, issuer rechecks, original-selection retention and negative/unresolved-only reassignment tests pass; no allowed reassignment branch. |
| A8 | Closed output/exit classes, escaped diagnostics, pre-admission nulls and stable first-failure tests pass, with equality wording and auxiliary native-parser limits above. |

C1–C5 remain closed for the reviewed candidate: corrected demo identity/copy equality;
genuine pinned schema agreement plus separate production profile; exactly twelve
serialized fields and process exit separate; saved-before versus after inventories;
required O_RDONLY/O_NOFOLLOW/O_NONBLOCK and FIFO refusal. No O_CLOEXEC, authentic
permission, runtime reconciliation or complete schema-equivalence claim is added.

## 4. Actual commands, results and evidence

Commands inspected first; all candidate executions used the isolated export.
Measured versions: **Node v26.8.1, Python 3.12.8, jsonschema 4.26.0**.
The pinned year-999 `strftime('%Y')` witness remains `999`.

From the export, with `env -i`, synthetic HOME/TMPDIR,
`PYTHONDONTWRITEBYTECODE=1`, `NO_COLOR=1`, and PATH
`/home/jwoltje/.pyenv/versions/3.12.8/bin:/usr/bin:/bin`:

| Command | Actual result |
|---|---|
| `node --test scripts/foundation/` | Exit 0; **80 passed, 0 failed, 0 skipped** |
| `bash scripts/test-foundation.sh` | Exit 0; **43 passed, 0 failed**; fixture regeneration only in disposable scratch |
| `python3 scripts/foundation/verify-schema.py` | Exit 0; **1568 records**; 540 agree-valid, 991 agree-invalid, **0 disagreements**; 27 parser-bound and 10 unsupported-kind unassessed; 510 profile-valid/30 profile-invalid; 73 named probes verified |
| `python3 docs/plans/foundation-v1-candidate/check.py` | Exit 0; all pinned author checks pass, including 38 record shapes, 16 paths, 7 restricted fingerprints, 155 runtime/artifact shapes and 35 synthetic model cases; not runtime enforcement |

`python3 integration.py` independently ran the committed non-live tests in a separate
`<evidence>/integration-fixture` copy: `bash scripts/test-config.sh` **24/0**,
`bash scripts/test-auth.sh` **15/0**, `bash scripts/test-conductor.sh` **17/0**
passed/failed, each exit 0. The authorized seed/clone/commit/reset operations occurred
only inside disposable conductor test repositories. Git global/system configuration
was disabled; HOME/TMPDIR were synthetic. Engine/network-command guards were never
invoked and did not substitute simulated successes. Auth data were fabricated test
canaries, not actual credentials.

Additional scratch commands and receipts:

- `python3 reproduce.py`: exit 0; 29 exact prior inputs, covering nine original
  findings, six Unicode pairs and four ASCII pairs; preserved hashes checked.
- `python3 domain-probes.py`: initial auxiliary native-round-trip assertion failed;
  preserved in `domain-probes.log`. The instrumented rerun, logged separately in
  `domain-probes-rerun.log`, exited 0 after recording all native anomalies and
  independently checking all 2,540 forms with Python and strict-parser round trips.
  No candidate code or mandatory oracle was changed.
- `python3 equal-key-probes.py`: twenty final CLI checks pass, exit 0. The first
  reviewer harness expected type-mismatch for numeric status; the established enum
  checker emits enum-mismatch. That **reviewer expectation** was corrected and the
  original failed log preserved; the candidate was unchanged.
- `python3 profile-probes.py`: exit 0; **831** typed single-final-LF probes refuse
  exit 2 / profile-pattern-mismatch with selection/operation/proposal/diagnostic null;
  multiline objective remains allowed.
- `python3 interactions.py`: exit 0; eight independent interactions pass.
- `python3 non-effect.py`: exit 0; fifteen text/JSON/parser/I/O/usage runs; sixteen
  unchanged path/type/size/mode/UID/GID/inode/mtime-ns/content-or-symlink-target entries.
  Observed roots and harness output are separate; no synthetic canary output.
- `python3 recheck.py`: exit 0; final shared/export identities, all pins and HEAD pass.

Selected hashes, relative to `/tmp/fi-filbert-8.ehrv19oo-evidence`:

| Artifact | SHA-256 |
|---|---|
| `node-tests.log` | `ca295bd80df32558d8d75d48c336ca6cc68bc74edb754ca4e5875247f8015c8d` |
| `selftest.log` | `e856f3fd68bcca7442f809e7a53af4aa674fd6483486120d429917688c4216a2` |
| `oracle.log` | `40e7311b1aed62c12aaba4ad4dd9eca3d43b46b2785f1abc4263be9d85e93653` |
| `integration-receipts.json` | `9f576d011b598fab9ac03c56ee68bf0d1ba5eba902d15a22a4742ebe06e8afcb` |
| `reproduction-receipts.json` | `a2677c32068ee62bd4bbdda89f44432252eeabfb6e433c97fccc28ff71d6b258` |
| `domain-summary.json` | `edd9c1f7f03d8c9249bf2c3627cd1c7c706c6cd90aefc24f67da7f655ccaa8cf` |
| `domain-native-disagreements.json` | `395ae878a3edfe481b22511d720d00e20064c5806f44cf95e597e8324fb3a254` |
| `equal-key-receipts.json` | `22f257f9145de8852255a547b14d79115d080f38bfbbcfde30c024c4afeb5ff3` |
| `profile-probe-receipts.json` | `6c067bcd6c4d88482b410e4e91f228ae5ef293156670b32c13d88544bcba463a` |
| `inventory-before.json` and `inventory-after.json` (identical) | `494f2dbf66a48d3aba5c6731508859b05414c80a52a855708a2859dc5f5df57c` |
| `recheck.log` | `c121172527c5ccb47e4ca6f9d5fb820a1d3580610bba2d34fb61aca9247d3f44` |

Scratch is local/disposable evidence, not durable repository publication.

## 5. Deferrals, limits and return

**test-task.sh and test-release.sh: NOT RUN / DEFERRED** under Jason's offline-demo
ruling. They are not green or fully covered. Full deployment/integration testing
remains a later gate before dependent live runtime work. The historical correction
that r3 ran live branches remains in force; this decision does not retroactively
authorize or relabel those actions. No live branches were executed here.

Finite tests/static review/inventories do not prove OS containment, absence of every
read, complete schema/native-parser equivalence, authentic delegation, crash safety,
parent-path containment or protection against same-size concurrent mutation. Only
Node v26.8.1 was executed. Approval covers no generalized JavaScript-call domain
outside strict-parser-produced values and no runtime permission engine.

No code fixes/co-authorship, dependency installation, shared staging/index/commit/
checkout/reset/push, provider/engine/container/network/native/sync/live-data work or
actual credential/HOME/`~/.mosaic` investigation occurred. Git mutations were solely
the authorized disposable conductor fixtures. This verdict is the only repository
write for FI-FILBERT-8; prior evidence and unrelated owner modifications are preserved.

**Return to darkwing: APPROVED at the exact r6 manifest for the bounded offline-demo
code gate.** Carry the nonblocking qualifications and deferred tests into the handoff.
Jason's separate A9 acceptance is still required. No automatic demo acceptance, push,
issue closure, live/dependent implementation, reassignment, timer or deadline follows.