stack/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict-r3.md

FI-FILBERT-3 — independent charter candidate 3 verdict

Reviewer: filbert. Author/integrator and follow-up owner: darkwing. Contributor: rocko. Date: 2026-09-06.

Admission and exact verdict

APPROVED for the written implementation charter at the exact identities below. All five FI-FILBERT-2 findings are closed at specification level. No new blocking charter defect found. Implementation authorization remains Jason's separate gate; this is neither implementation approval nor runtime/security/owner-demo acceptance.

No competing current personal owner-authorized assignment appeared. I remain a non-author of the charter and incorporated feasibility note. I reviewed the complete candidate, its changes from candidate 2, the incorporated rules and their interactions; Rocko's contribution was not treated as approval of the integrated charter.

Independently verified identities:

Input	SHA-256
docs/plans/2026-09-06_foundation-inspector-charter.md, candidate 3	19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6
docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md	f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1
Archived docs/plans/reviews/2026-09-06_foundation-inspector-charter-candidate2.md	cbd0487a2ab699722924e2f91367bf556facb015752ce3b5a76ad474977df791
Preserved docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict.md	2f3858c81d32b1305cb7fd49b0d8860153d8d592ac62df2c45dd25d30af7a722

Map commit: 7345f330fc6bfae5aa1d896c78cfb7cbe62efbae. Source/plan baseline: d4696d09eb1b5dcf1028f30db2cd63735f51cb16. Candidate and incorporated note remain frozen uncommitted planning inputs. Sections 10.1–10.5 explicitly override earlier shorthand, including the incorporated note. The earlier NOT APPROVED remains an accurate historical verdict on candidate 2.

Per-finding disposition

1. CLOSED — registration delegation semantics and issuer limits

Evidence: charter §10.1 supplies the missing ordinary L2/L3 checks: current active registration, approved current delegation, exact registration scope, exact current agent/registration subject pair, and explicit missing/stale/rejected/bounds outcomes. Null delegation is expressly an unverified owner-origin fixture assumption, not an unrestricted grant. A newer rejected head cannot be bypassed with an old approved reference. Current consulted policy registries also have an explicit head rule.

The new closed delegationInputs wrapper does not mutate accepted records. Its issuerCeiling and delegated operations narrow, rather than replace, mandatory role, registration, project/workspace, task/mission and execution restrictions. Required issuer input and subset checks apply to proposal delegation too; issuer restrictions additionally narrow both requester contexts. This closes the previous ordinary registration gap without treating a declaration as authenticated authority.

Independent shape/identity probes confirmed that same-scope approved decisions with exact agent/registration subjects, and rejected successor decisions plus registration successors, can be represented by the unchanged candidate schema. In a rejected decision fixture, delegatedOperations must be empty to reach the intended semantic rejection rather than fail its earlier schema conditional. This is a fixture detail, not a new field or authority mechanism.

2. CLOSED — per-record ownership and consulted work access

Evidence: §10.2 replaces global selected-project graph interpretation with each record's own project. It distinguishes structural existence from consulted access. Unselected P2 task/mission inventory is no longer coerced into the P1 selection.

Consulted work supports only the current workspace or its parent project. Another workspace/project receives the specified unsupported-capability refusal, even if a separate registration exists. Thus no extra visibility context, cross-assignment union or permission borrowing is silently introduced. Supported consulted work requires work.read in the caller's full applicable intersection in addition to the requested operation. Dependencies cannot be skipped when their scope is unsupported; accepted status is required for file.change and proposal requester authority.

The subject and target proposal checks explicitly use original and target requester contexts respectively. Taskless read does not traverse unrelated work. These are bounded conservative limitations, consistent with baseline README:57–71,124–136; they are not a promise to implement all future cross-scope dependency behavior.

3. CLOSED — hidden-chain detection claim withdrawn

Evidence: §§5 and 10.3 now expressly deny detection of a chain hidden behind opaque artifacts, declarations or omitted records. The only wrapper mode is direct-declared. Unknown parent fields and modes are structural invalid-request failures, not claimed chain detections. A subject reference to a decision is not invented into a parent edge. Artifact bodies remain unread and their presence remains unauthenticated.

This resolves the unobservable-predicate defect honestly. A valid direct declaration can pass synthetic checks without proving absence of chaining. It still cannot produce an allowed reassignment result: the final proposal branch is unresolved / unknown-effects / runtime-reconciliation-required.

4. CLOSED — graph sub-order and fixture reachability

Evidence: §10.4 orders ordinary structural reference checks, then task/mission/ supersedes cycle checks, then revision continuity and ownership/parent-scope checks. It also separates admission-time missing declarations from ordinary missing records. The cycle order is no longer inferred from unordered requirements.

Independent schema probes confirmed a workspace mission self-parent and a revision-2 self-supersedes are shape-valid. Their references can resolve to themselves, allowing the now-earlier cycle stage to run before parent-scope/continuity rejection. Detector unit coverage and CLI first-failure coverage remain explicitly distinct. Stable identity/field ordering, rather than inventory order, governs within-stage traversal.

5. CLOSED — differential corpus and platform boundaries

Evidence: §10.5 adds scalar types, null/absence, integer bounds and booleans, 1.0, object-key-order-insensitive uniqueness, BMP/non-BMP lengths, byte-path limits and escaped surrogates. Schema and strict input-profile verdicts occupy separate expected columns; finite-corpus success is explicitly not a complete equivalence proof.

Independent probes confirmed representative distinctions: boolean revision invalid; 1.0 valid as a schema integer; maximum safe revision valid and the next integer invalid; 128 non-BMP display-name code points valid and 129 invalid; duplicate path objects invalid despite key-order reversal. A lone surrogate in an unformatted schema string can be shape-valid while the strict inspector profile must refuse it. O_RDONLY's zero value is now correctly handled with presence/type checks.

New interaction findings and limits

1. Informational / nonblocking — declaration authority remains an assumption. Location: §§3,7,10.1,10.3. An issuerCeiling is caller-supplied synthetic data; its addition does not authenticate an issuer or model a real delegation chain. The unconditional not-modelled/unverified-simulation output and the no-success proposal endpoint preserve that distinction. No correction required. Code review must ensure no diagnostic or positive preview upgrades this assumption into a real authorization claim.

2. Informational / nonblocking — added work.read is an intentional additional guard. Location: §§4,5,10.2. An assigned operation permitted by file.change alone must still refuse when the context lacks work.read for consulted work. Taskless file.read does not acquire an unrelated assignment/mission layer. Proposal original/target contexts retain their own assignments and execution limits; one context cannot supply another's missing permission. No correction required; positive and negative tests must distinguish these cases.

3. Informational / nonblocking — bounded scope, but substantial validator work. Location: §§6,8,10.1–10.5. The new inventory is capped at 256, graph/profile limits remain finite, and no live source lookup, artifact-body loading, chain traversal, runtime observer or publication component has been added. This remains feasible as an offline increment, not a trivial schema wrapper. The mandatory differential oracle, coherent fixtures and independent code review remain necessary. No implementation-size or completion-time estimate was measured.

4. Informational / nonblocking — testability is not implemented enforcement. Location: §§6,8–9. Descriptor flags, byte limits, Unicode handling, immutable observed roots, privacy-safe outputs and fail-closed exits are obligations for later code/tests. This review did not execute those mechanisms. No correction required; do not promote schema probes or constants inspection into a security, no-read, complete-mediation or crash-durability receipt.

Full review-question dispositions

Area	Disposition
Coherence/feasibility/faithfulness	Approved as a bounded written charter; prior substantive gaps are resolved without a runtime implementation or implicit phase advance.
Types, subset, history and mandatory layers	Closed wrapper addition, unchanged eight supported record shapes, complete histories versus consulted heads, explicit role/policy/execution ceilings and optional narrowing remain coherent.
Requester/subject/target, intent and delegation	Both requester scopes retain full contexts; ordinary/proposal delegation now has explicit bounded synthetic checks; subject selection is preserved; proposal success remains unreachable by specification.
Privacy/output/exits/profile	Closed body-free output, safe pre-validation nulls, fixed disclaimers, escaped text, documented refusal exceptions and separate number/Unicode profile remain intact.
Filesystem/no-live-effects	Proposed Linux descriptor boundary and its parent-path/concurrent-write/read-observation limitations remain explicit. No unsupported O_CLOEXEC or O_RDONLY truthiness assumption remains.
Differential verification/reachability	Mandatory pinned oracle, expanded corpus and explicit cycle precedence are adequate charter requirements; their implementation and actual coverage remain unverified.
First slice and owner gates	No implementation, live grants, source moves, package scaffolds, credentials, native integration or runtime security mechanisms added. Jason's build authorization and later demo acceptance remain separate.

Independent receipts for this FI-FILBERT-3 cycle

• sha256sum verified all four planning/history identities listed above.
• diff -u <archived-candidate2> <candidate3> showed the title change, replacement of the hidden-chain claim in §5, and addition of normative §10. Exit 1 denotes these expected differences, not a failed verification command.
• git show d4696d09:<path> read committed schema/checker and relevant accepted README rules. Independent hashes again matched:
  • records.schema.json: 05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6
  • check.py: 82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607
• Inline Python read committed records fixtures/schema with git show, made only in-memory synthetic mutations, and ran 14 asserted schema probes: all passed, exit 0, using Python 3.12.8 and existing jsonschema 4.26.0. Four probes covered direct delegation/registration and rejected successors, two covered cycle shapes, four covered revision type/bounds, two covered non-BMP length, one lone-surrogate schema string, and one object-order-independent uniqueItems check. Identity assertions also distinguished the old approved reference from the rejected head. These are shape/identity witnesses, not a complete coherent bundle or an inspector implementation. Custom calendar/path formats were not exercised in this run.
• node -e independently observed Node v26.8.1; O_RDONLY=0 with numeric presence, O_NOFOLLOW=131072, O_NONBLOCK=2048, and no exposed O_CLOEXEC. No descriptor was opened for a filesystem behavior test.

No proposed CLI/differential harness, five repository suites, author checker, canonicalizer implementation, symlink/FIFO tests, native/sync tests or live runtime ran in this cycle. Earlier receipts are not relabelled as current execution. No new dependencies or helper implementation files were installed/written; schema calculations were inline and in memory. No credential contents or separate ~/.mosaic environment were accessed.

Only this offered verdict path was written in the repository. Candidate, incorporated note, prior verdict, source, logs, policies, installations and shared index were not edited. No checkout/reset, commit or push occurred. Follow-up remains darkwing; this approval does not automatically authorize code or advance the phase.