stack/docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md

FI-ROCKO-2 — Foundation synthetic inspector: corrected feasibility note (r2)

Author: rocko (Claude Fable 5.1, Archify lane author seat). Requested by darkwing (FI-ROCKO-2, 2026-09-06), reconciling the FI-ROCKO-1 note against darkwing's coordinator source check. Issue: #53. Status: planning evidence only. This note proposes; it does not approve, implement, or bind. It supersedes the r1 note for every point where the two differ; r1 is preserved unchanged as history.

0. Admission and scope

FI-ROCKO-2 is admitted. No blocker. My held owner goal (Archify C1 rev 3, awaiting Jason's rulings) is not displaced. This file is the only repository write. No implementation, dependency, commit, push, checkout, live test, credential read, fleet investigation, or contact with filbert occurred. Every citation below was re-read from committed bytes with git show during this task; the only unpinned inputs are the untracked charter draft and darkwing's corrections note.

1. Pinned inputs

Input	Identity
Technical map docs/plans/2026-09-06_foundation-technical-map.md (the accepted map) and docs/plans/2026-09-06_foundation-map-handoff.md	commit 7345f330fc6bfae5aa1d896c78cfb7cbe62efbae
Requirements document docs/plans/2026-09-06_agent-project-workspace-foundation.md (R1–R34), candidate docs/plans/foundation-v1-candidate/{README.md, REVIEW.md, RUNTIME.md, records.schema.json, records.fixtures.json, fingerprint-vectors.json, check.py, semantic-model.py}, docs/plans/2026-09-06_foundation-phase2-contract.md, docs/plans/ROADMAP.md	commit d4696d09eb1b5dcf1028f30db2cd63735f51cb16
Charter draft 1 docs/plans/2026-09-06_foundation-inspector-charter.md	untracked, SHA-256 fdcdf4df8bf30b9fbfff960f9b1d4160ce7e6bbc4b8bb601a93cda13b56c8996 (unchanged since r1)
Corrections docs/plans/reviews/2026-09-06_foundation-inspector-rocko-corrections.md	untracked, SHA-256 fe672fd6f0b745b5f64042a094f31463064ca436aeaeba956f9c15228df5f716
r1 note docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility.md	untracked, SHA-256 92fa7b3de2591ba24fb184ed8edbabedd30c54498fdaf101649e36aaebabe9b9

Citation form: commit:path:line. cand/ abbreviates docs/plans/foundation-v1-candidate/; map abbreviates 7345f33:docs/plans/2026-09-06_foundation-technical-map.md.

2. Disposition of F1–F9

Finding	Disposition	Where resolved
F1 wrong map path, nonexistent FINDINGS.md, phantom Node pin	Accepted in full. Citations corrected; AJV/fast-uri rationale withdrawn; measured host version separated from a proposed test baseline	§3, §4
F2 reference shapes (recordRef no digest, basisRef artifactRef, authorizationRef runtimeId, workspace parent from scope, createdAt calendar rule)	Accepted in full. Bundle gains declared artifacts and authorizations simulation inputs; resolver rules rewritten against the schema	§5, §6
F3 instruction-order digest	Accepted. New digest is named separately, preserves all array order, never claims the README 6.1 fingerprint rule; exact vectors supplied	§6.1
F4 mandatory role/policy layers, assignment has no restrictions, no launch default	Accepted in full. Layer table rebuilt; role ceilings mandatory; execution layer must be explicitly modelled	§7
F5 reassignment authority in both scopes; no success path	Accepted. Proposal mode yields only refused or unresolved; caller-supplied observations removed	§8
F6 bounded operations, no execution.stop, closed output	Accepted. Four supported operations; execution.stop withdrawn (catalog has execution.control); output schema enumerates every field	§9, §10
F7 required differential schema verification	Accepted. Mandatory Python/jsonschema harness; missing dependency fails, never skips	§12.1
F8 honest non-effect tests, descriptor-based open	Accepted. Inventory diff on separated roots, static import boundary, `O_NOFOLLOW	O_NONBLOCKopen thenfstat`
F9 revision handling	Accepted. Contiguous full history or nothing per identity; historical vs current-admission resolution classes	§6.3

No finding is disputed. Two places where I go slightly beyond the finding are flagged inline (§9 exit class for unsupported operations; §6.1 ASCII limit on mock-content paths).

3. Corrected repository facts (F1)

• The accepted map is the technical map at 7345f33. Its recommended increment is map:244-283; exit classes map:275-276; "No npm/Turbo change is needed" map:278; the inspector-must-not-bootstrap disposition map:240; the cross-lane retasking scenario map:290-314 with the adversarial acceptance case at map:305-314. The document I cited in r1 under the map's name is the requirements document (R1–R34) at d4696d09; R-number citations stay valid against that file, the map citations did not. Corrected throughout.
• d4696d09:cand/FINDINGS.md does not exist (git cat-file -e fails) and no file in the pinned tree or in docs/plans/*.md mentions ajv or fast-uri. The audit rationale is withdrawn. The dependency-free recommendation now rests only on in-scope facts: package.json declares one dependency (pi 0.84.4), the map forbids an npm change for this boundary (map:278), and the candidate's own checker states it "never installs dependencies" (d4696d09:cand/check.py:4).
• There is no repository Node pin: no engines field, no .nvmrc, .node-version, or .tool-versions, and no Node image pin in the build scripts. The measured host runtime is Node v26.8.1, Python 3.12.8, jsonschema 4.26.0. These are measurements, not pins.
• Proposed inspector test baseline (a new charter decision, not an existing pin): the suite records node --version in its header and refuses to run below a stated minimum. The features used (node:test, node:crypto, TextDecoder with fatal: true, fs.constants.O_NOFOLLOW) are all present in Node 22 LTS; I recommend the charter state "Node ≥ 22, measured on v26.8.1" and that no engines field be added by this increment.

4. Language and dependency recommendation (D-A resolved)

Node ESM, zero new runtime dependencies, hand-rolled closed validation derived field-by-field from d4696d09:cand/records.schema.json, verified differentially by a mandatory Python/jsonschema harness (§12.1). The Python-stdlib runtime alternative is closed: the candidate's check.py is a script that executes assertions on import, not a validation API (d4696d09:cand/check.py:66-96 run at module level), so neither language gets a free validator; Node keeps the CLI surface consistent with scripts/.

5. Bundle contract (exact fields, proposed to freeze)

Closed objects throughout; unknown keys refuse; duplicate JSON keys refuse at parse time; identifiers follow $defs/id (^[a-z0-9][a-z0-9._-]{0,63}$).

{
  "bundleVersion": 1,
  "kind": "foundation-inspector-bundle",
  "simulation": true,                          // literal true or refuse
  "records": [ <envelope record>, ... ],       // ≤256, supported kinds only (§10)
  "registries": [ <registryEntry>, ... ],      // ≤256
  "artifacts": [ {runId, artifactId, digest}, ... ],   // ≤256, declared only
  "authorizations": [ <runtimeId>, ... ],      // ≤256, declared only
  "selection": {
    "agentId": <id>, "projectId": <id>, "workspaceId": <id>,
    "assignmentRef": <recordRef> | null,
    "execution": { "kind": "unrestricted-simulation" }
               | { "kind": "restrictions", "restrictions": <restrictions> }
  },
  "operation": { "name": <supported operation>, "target": <target> | null },
  "proposal": null | {
    "kind": "assignment-change",
    "requesterAgentId": <id>,
    "subjectAssignmentRef": <recordRef>,
    "targetTaskRef": <recordRef>,
    "delegationRef": <recordRef> | null,
    "changeDecisionRef": <recordRef> | null,
    "message": <string, ≤4000> | absent        // informational, never authority
  }
}

5.1 Type corrections (F2)

• <envelope record> is exactly $defs/envelope: authorizationRef is a runtimeId (UUID v4 pattern), not a recordRef; supersedes is null at revision 1 and a recordRef otherwise (schema allOf); createdAt is $defs/time (YYYY-MM-DDTHH:MM:SS.mmmZ) and must be a real calendar instant with the same round-trip rule as check.py:36-44 (2026-02-30 refuses). It still takes no part in calculations.
• <recordRef> = {kind, id, scope, revision}. No digest. Record identity is exact-match on those four fields; record content integrity is not digest-checked in increment 1 (stated as a limitation in output docs).
• <registryRef> = {registry, id, revision, digest}; <artifactRef> = {runId, artifactId, digest}. decision.basisRef and evidenceRefs are artifactRefs and are evidence pointers, not authority.
• Workspace ownership comes from scope: a workspace record has scope.kind = workspace, scope.projectId names the owning project, and id must equal scope.workspaceId; a project's id must equal scope.projectId (d4696d09:cand/README.md:64). Registrations carry project or workspace scope per the schema's conditional.

5.2 Simulation-only external inputs (F2)

artifacts and authorizations are the only way the bundle can satisfy an artifactRef or authorizationRef. They are declared, not verified: the inspector checks presence and exact match only, never content, signature, or liveness, and the output labels them declared-simulation-inputs. A missing declaration refuses missing-state; it is never treated as valid. Nothing in the bundle asserts authentication; the inspector emits "authentication": "not-modelled" in every result.

5.3 Bounds and file handling (F8)

Bound	Value
File size	≤ 1 MiB, checked from fstat before reading
records, registries, artifacts, authorizations	≤ 256 each
Any array	≤ 1024 (d4696d09:docs/plans/2026-09-06_foundation-phase2-contract.md:116)
Nesting depth	≤ 32
Strings	≤ 4096 bytes; relative paths per $defs/relativePath and the mosaic-relative-path format (≤4096 UTF-8 bytes, no Cc/Cf/Cs, no backslash, no empty/./.. segment; check.py:47-64)

Open sequence (Linux, descriptor-based): fs.openSync(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC); a symlink fails at open with ELOOP and a FIFO cannot block; then fstatSync(fd) must report a regular file and a size within bound; then read exactly size bytes from the descriptor and refuse if more arrive. Any failure is exit 4 io-failure naming only the path as given on argv. This is a design statement; no live test was run.

6. Digest and reference algorithms

6.1 Mock-content digest (F3): inspector-content-digest/1

This is a new, separately named restricted algorithm for content-bearing registry entries only. It is not the README 6.1 launch-fingerprint projection, which preserves instruction order and ID-sorts skills (d4696d09:cand/README.md:268-285, check.py:115); the inspector computes no launch fingerprint in increment 1.

Rule: domain = objects, arrays, ASCII strings, booleans, null, safe integers; anything else refuses unsupported-capability. Object keys sorted by code unit; compact separators; all array order preserved; digest = "sha256:" + hex(SHA-256(UTF-8 bytes)). Structural uniqueness (uniqueItems) and set intersection operate on parsed values and are independent of serialization. Consequence flagged: pathGrant paths inside mock content must be ASCII in increment 1, while record and target paths may be non-ASCII per the candidate regex (which accepts é/x); the charter should state this asymmetry.

Exact vectors (computed with Python stdlib json.dumps(sort_keys=True, separators=(",",":")), the same primitives as check.py:116):

Vector	Content	Canonical	Digest
V1	{"restrictions":{"operations":["work.read","file.read"],"readPaths":[{"root":"workspace","path":null}],"writePaths":[],"network":"none","endpointRefs":[]}}	{"restrictions":{"endpointRefs":[],"network":"none","operations":["work.read","file.read"],"readPaths":[{"path":null,"root":"workspace"}],"writePaths":[]}}	sha256:0bc44e14fd8354a8a85be879306a54881da7a0cb4d3dcf1f88bc4bc08a40dc9c
V2	V1 with operations reversed	…"operations":["file.read","work.read"]…	sha256:63817bffc57803ca6ac5df971aa0a160d4be73646394b3bc536578bd66c82660 (differs from V1: order is significant)
V3	V1 plus file.change and writePaths:[{"root":"workspace","path":"docs"}]	{"restrictions":{"endpointRefs":[],"network":"none","operations":["work.read","file.read","file.change"],"readPaths":[{"path":null,"root":"workspace"}],"writePaths":[{"path":"docs","root":"workspace"}]}}	sha256:d538c865808cfe7665956615fb48f69819baa0833626d1ef6e1cb3614acbc7da
V4	V1 with a float 1.0 anywhere	refuse	unsupported-capability
V5	V1 with a non-ASCII string	refuse	unsupported-capability

Registry entry shapes: declared {registry, id, revision, digest} for harness, settings, context-content, endpoint; content-bearing {registry, id, revision, digest, content:{restrictions}} for scope-role, agent-policy, project-policy, where digest must equal the V-rule digest of content or the bundle refuses invalid-request. The candidate defines no registry content shapes; {restrictions} is a simulation-only stand-in (D-E).

6.2 Reference resolution

Index on (kind, id, scope); duplicate (kind, id, scope, revision) refuses invalid-request. Every recordRef resolves by exact four-field match; every registryRef by exact four-field match including digest; every artifactRef and authorizationRef by exact match against the declared lists (§5.2). Absent → missing-state; kind mismatch against the schema's const constraints (for example policyRef not agent-policy) → invalid-request.

Graph rules (all refuse without repair, naming the rule):

• Project id = scope.projectId; workspace id = scope.workspaceId; the workspace's scope.projectId must resolve to an active project.
• A workspace registration's projectRegistrationRef must resolve to an active project registration in the workspace's owning project for the same agentId (README:65).
• A workspace mission's parentMissionRef must be a project mission in that project; project missions have no parent (README:66-68).
• A task's missionRef resolves in the selected project; dependencies are tasks; cycle checks run over exactly three edge sets, independently: task.dependencies, mission.parentMissionRef, supersedes. Excluded from cycle checks: intentRef, subjectRefs, projectRegistrationRef, delegationRef, all registryRefs and artifactRefs.
• Cross-project execution selection refuses (README:71).

6.3 Revision history (F9, D-J resolved)

Per identity (kind, id, scope) the bundle carries either exactly one record at revision 1 or a complete contiguous chain 1..n where each revision r > 1 has supersedes = {kind, id, scope, revision: r-1}. A chain with a missing predecessor, a skipped number, or two records superseding the same predecessor refuses invalid-request; the inspector never invents history. Head = highest revision.

Two resolution classes:

• Current-admission references must name the head: selection.*, assignment.taskRef, assignment.intentRef, task.intentRef, task.missionRef, task.dependencies, mission.parentMissionRef, registration.projectRegistrationRef, registration.delegationRef, and every proposal ref. Naming a non-head revision refuses stale-revision.
• Historical references may name any revision present in the bundle: supersedes and decision.subjectRefs. Absent → missing-state.

This satisfies charter A3's stale-reference case with a real fixture (task intent pointing at decision rev 1 while rev 2 exists) without treating all history as forbidden.

7. Permission algorithm (F4, D-D, D-F resolved)

Supported operations for permission preview: work.read, file.read, file.change (§10). Taskless set = {work.read, file.read} exactly (d4696d09:cand/semantic-model.py:24); file.change requires selection.assignmentRef.

#	Layer	Source	Mandatory?
L1	agent ceiling	agent-definition.policyRef → agent-policy content	yes; agent-definition.status must be enabled
L2	project registration	active registration in projectScope(projectId) for agentId: scopeRoleRef → scope-role content is the ceiling; restrictions (nullable) narrows it further	yes (README:99-101)
L3	workspace registration	active registration in workspaceScope(projectId, workspaceId) for agentId, projectRegistrationRef = L2's exact record; scopeRoleRef ceiling; restrictions nullable narrowing	yes
L4	project policy	project.policyRef → project-policy content	yes
L5	workspace policy	workspace.policyRef → project-policy content (schema const)	yes; no fallback to L3's role
L6	assignment binding	one assignment = selection.assignmentRef; status: selected, agentId = selected agent, taskRef head in the selected workspace scope, intentRef → approved decision (head) whose subjectRefs include the task	required for non-taskless operations; contributes checks only, it has no restrictions field
L7	task	task.restrictions (nullable = no narrowing); independently task.status ∈ {ready, active} and task.intentRef → approved head decision	status/intent checks mandatory whenever L6 applies
L8	mission chain	each mission from task.missionRef up the parent chain: restrictions (nullable = no narrowing); status: active mandatory	as L7
L9	execution	selection.execution: restrictions narrows; unrestricted-simulation is an explicit no-narrowing marker	yes; absent or null refuses missing-state (README:132, semantic-model.py:21)

Intersection: operations as set intersection; explicit empty array = none (README:101); restrictions: null on L2/L3/L7/L8 = no additional narrowing (README:100) but never satisfies a mandatory ceiling or status/intent check. Path grants: path: null = whole root (README:102); component-prefix matching on parsed segments (semantic-model.py:30-34); the intersection of two grant lists keeps, for each pair where one grant is a segment-prefix of the other, the narrower. Network: none dominates; approved-endpoints intersect by exact endpoint registryRef. No union across assignments (contract:172); exactly one assignment consulted (README:134).

Refusal precedence: parse/shape/bounds (exit 2) → graph incoherence (exit 2) → unsupported operation or kind (exit 2) → mandatory layer or declaration missing (exit 3, missing-state) → registration/role absent or revoked (exit 3, not-authorized) → status/intent not current (exit 3, not-authorized, rule named) → operation or target outside the intersection (exit 3, not-authorized). First failure ends evaluation.

8. Proposal mode: assignment-change negative check (F5, D-G, D-I resolved)

Increment 1 implements no success path. The evaluation order is fixed and every branch ends in refused or unresolved; allowed is unreachable by construction, and a unit test asserts that.

1. Original scope authority: the requester holds an active L2/L3 registration in the subject assignment's workspace whose role ceiling ∩ restrictions include assignment.change. Else not-authorized / requester-lacks-original-scope-authority.
2. Target scope authority: the same in the target task's project and workspace. Else not-authorized / requester-lacks-target-scope-authority.
3. Delegation: delegationRef → head decision, decisionKind: delegation, outcome: approved, delegatedOperations ∋ assignment.change, subjectRefs include the requester's agent-definition and the subject assignment or its task (recipient and subject bounds). Else not-authorized / delegation-not-applicable. A message with no delegation refuses with rule message-is-not-authority (map:310).
4. Recorded change: changeDecisionRef → head decision, decisionKind: assignment-change, outcome: approved, subjectRefs include the subject assignment and the target task; its basisRef must be a declared artifact but is not itself authorization. Else not-authorized / change-not-recorded.
5. Current intent: the subject assignment's intentRef and the target task's intentRef resolve to approved head decisions. Else stale-revision or not-authorized as applicable.
6. If 1–5 pass: result unresolved, reason unknown-effects, rule runtime-reconciliation-required. Stopping and reconciliation are runtime facts (map:311-314); the bundle has no field to assert them and the r1 runtimeObservations field is withdrawn.

In every branch the output echoes selection.assignmentRef unchanged as selectedAssignmentRef and the bundle bytes are untouched. Requester model is agent-only in increment 1 (D-G); delegation chains are not modelled (D-I).

9. Output and exit classes (F6)

Closed result schema; every emitted field is listed here and nothing else is emitted:

{
  "disclaimer": "SYNTHETIC PREVIEW — NO LIVE EFFECTS",
  "preview": "preview: no live registrations or permission grants",   // REVIEW.md:126
  "bundleVersion": 1,
  "authentication": "not-modelled",
  "declaredSimulationInputs": { "artifacts": <count>, "authorizations": <count> },
  "result": "allowed" | "refused" | "unresolved" | "invalid",
  "reason": <reason code>,
  "rule": <rule name> | null,
  "selection": { "agentId", "projectId", "workspaceId", "assignmentRef" },
  "operation": { "name", "target" },
  "consulted": [ <recordRef | registryRef>, ... ],       // identities only, sorted
  "proposal": null | { "result", "reason", "rule", "selectedAssignmentRef" }
}

Text output is a pure rendering of this object; both begin with the disclaimer, on every exit class. No payload bodies, no parser input bytes (byte offset and error class only), no timestamps, no random ids, keys sorted.

Reason codes: the RUNTIME closed set (d4696d09:cand/RUNTIME.md:97) plus inspector-only unsupported-kind and io-failure, documented as not runtime API codes. Exit classes (map:275-276, charter): 0 allowed; 2 malformed, graph-incoherent, unsupported kind or operation; 3 refused or unresolved; 4 I/O failure. Flag: I place unsupported operations in exit 2 with reason unsupported-capability because they are not simulated permission refusals; if darkwing prefers exit 3 for them, nothing else in this note changes (D-C).

10. Supported kinds and operations (F6)

Record kinds: agent-definition, project, workspace, registration, mission, task, assignment, decision. session, context-source, adapter-capability present in records refuse unsupported-kind.

Operations (from the 29-name catalog, d4696d09:cand/records.schema.json $defs/operation): permission previews for work.read (target null), file.read and file.change (target {root:"workspace", path}); proposal negative check for assignment.change (§8). The other 25 catalog names are recognized and refuse unsupported-capability; never exit 0. execution.stop does not exist in the catalog (execution.control does); the r1 remark is withdrawn. Names outside the catalog refuse invalid-request.

11. Physical paths (D-B, D-H resolved)

Unchanged from r1: scripts/foundation-inspect.mjs (CLI, future packages/mosaic); scripts/foundation/{strict-json,canonical,resolve}.mjs (pure, future packages/config; import only each other and node:crypto); scripts/foundation/fixtures/; scripts/foundation/*.test.mjs; scripts/test-foundation.sh; plus the new verification harness scripts/foundation/verify-schema.py (§12.1). No packages/ scaffolding, no root file, no .sh shim, nothing imported from scripts/mosaic-config.mjs (map:240). Layout follows the ROADMAP M20 doctrine (d4696d09:docs/plans/ROADMAP.md:142-159).

12. Test plan

12.1 Required differential schema verification (F7)

scripts/foundation/verify-schema.py: Python 3 stdlib plus the already installed jsonschema (measured 4.26.0); no installation. If import jsonschema fails the suite exits non-zero with verification dependency missing; it never skips. The harness re-declares the two format checkers exactly as check.py:36-64 (calendar round-trip date-time, mosaic-relative-path), loads the pinned cand/records.schema.json from the tree, and compares, for every document in a corpus, the jsonschema verdict with the Node validator's verdict (obtained by running node scripts/foundation/validate-record.mjs over the corpus and reading its JSON verdict list). Any disagreement fails.

Corpus: every fixture record; the candidate's own records.fixtures.json cases (schema-valid and invalid) for the eight supported kinds; and a mutation set generated deterministically from each valid record: drop each required field; add one unknown key at each object level; createdAt = 2026-02-30 and 2028-02-29; paths ../x, a//b, a/./b, /abs, backslash, a control character, 4097 bytes, é/x (must be accepted by both); revision 1 with non-null supersedes; revision 2 with null supersedes; approved delegation with empty delegatedOperations; non-delegation with non-empty delegatedOperations; network: none with an endpoint; approved-endpoints with none; status: ended with null endReason and vice versa; each typed reference with the wrong kind/registry. The runtime remains dependency-free; only verification needs Python.

12.2 Non-effect and privacy observations (F8)

• Roots are separated: observed roots $SANDBOX/home, $SANDBOX/cwd, $SANDBOX/fixtures, $SANDBOX/data-root; harness writes go only to $SANDBOX/harness. The CLI runs with env -i PATH=… HOME=$SANDBOX/home NO_COLOR=1, cwd $SANDBOX/cwd, MOSAIC_CONFIG unset.
• Inventory before and after every invocation over each observed root: find -printf '%p %y %s %m %U %i\n' | sort plus SHA-256 of every regular file; compared exactly. A canary config path under home/.config/mosaic-dev is asserted absent after a missing-file run (no bootstrap, A8).
• Static boundary: a unit test reads the three pure modules and asserts their import specifiers are exactly the allowed set and that process, fs, and Date do not appear; a second asserts the CLI imports no mosaic-config.
• Canaries (CANARY-DO-NOT-PRINT-n in every unrelated payload and in the second workspace's records) are grepped from all captured output. Stated limit: canaries and inventories demonstrate this tool's bounded behaviour on these inputs; they do not prove absence of all reads or OS-level containment (charter test-plan paragraph).
• Determinism: each fixture runs twice, byte-identical; --json and text agree on result/reason/rule; golden files compared exactly.

12.3 Units (node --test)

Canonicalizer V1–V5; strict JSON (duplicate key, depth, size, fatal UTF-8); each graph rule in §6.2–6.3; each layer in §7 including "null restrictions do not satisfy a mandatory ceiling", "empty array is none", "no union across assignments", "missing execution layer refuses"; §8 steps 1–6 and the allowed-is-unreachable assertion.

13. Fixtures and the first demonstration

demo.bundle.json: project P1 with workspaces W1 and W2; project P2; agent A enabled, registered in P1 and W1 only, with scope-role V1 (reader) at W1; one active mission and one ready task in W1 with approved plan-approval intents; one selected assignment for A; agent B registered in P2 with a delegation decision that does not cover assignment.change; all revisions 1; a second variant carries decision rev 1→2 for the stale case.

Fixture	Expected
demo-read-w1	0 allowed file.read docs/notes.md
demo-change-w1-refused	3 not-authorized, role ceiling V1 lacks file.change
demo-read-w2	3 not-authorized, workspace-registration-missing, no W2 payload text
demo-cross-project	3 not-authorized, cross-project selection
demo-reassign-message-only	3 not-authorized, message-is-not-authority, selection unchanged
demo-reassign-fully-recorded	3 unresolved, unknown-effects, runtime-reconciliation-required
neg-stale-intent	3 stale-revision (intent names decision rev 1, rev 2 present)
neg-missing-predecessor, neg-fork, neg-duplicate-identity, neg-cycle-{task,mission,supersedes}, neg-wrong-owner	2 invalid-request, rule named
neg-no-execution-layer, neg-missing-role-content, neg-undeclared-artifact	3 missing-state
neg-empty-ops, neg-two-assignments	3 not-authorized
neg-unsupported-op-execution.control, neg-unsupported-kind-session	2 unsupported-capability / unsupported-kind
neg-unknown-key, neg-dup-json-key, neg-bad-utf8.bin, neg-bad-path, neg-bad-calendar	2 invalid-request
symlink, FIFO, missing file	4 io-failure, no bootstrap

14. Resolved decisions D-A..D-J

Id	Resolution
D-A	Node ESM, zero runtime deps; Python/jsonschema for mandatory verification only (§4, §12.1)
D-B	scripts/foundation/ with M20 owner headers; no packages/ (§11)
D-C	Graph incoherence and unsupported kind/operation → exit 2; permission refusal/unresolved → 3. Only open sub-choice: exit class for unsupported-capability operations (§9 flag)
D-D	Taskless = {work.read, file.read}; work.propose is not implemented at all in increment 1 (§10)
D-E	Registry content = {restrictions} simulation stand-in, digest per §6.1
D-F	selection.execution is mandatory and explicit; no null default (§7 L9)
D-G	Requester is an agent with registrations in both scopes (§8)
D-H	scripts/foundation-inspect.mjs, no .sh shim
D-I	Delegation: recipient and subject bounds checked; no chains (§8 step 3)
D-J	Revision-1-only or complete contiguous chain; historical vs current-admission classes (§6.3)

Remaining design choice for darkwing, stated precisely: whether unsupported catalog operations exit 2 or 3 (§9). Everything else in this note is a concrete recommendation with no open alternative.

15. Feasibility verdict

Still feasible as a bounded, dependency-free increment. The corrections increase scope in three places: mandatory role ceilings and execution layer (§7), the full-history resolver with two reference classes (§6.3), and the required differential verification harness (§12.1). None requires an npm change, a package move, live state, or runtime coupling. The largest new risk is the differential harness itself drifting from the candidate checker's format semantics; re-declaring the two format checkers verbatim from check.py:36-64 and asserting the same four sentinel cases (check.py:66-69) is the mitigation.

This note is evidence for darkwing's charter. It is not approval, and it authorizes no implementation.