stack/docs/plans/reviews/2026-09-06_foundation-inspector-pattern-profile-addendum.md

FI-C2-1 — proposed schema/profile clarification

Author: darkwing. Status: frozen proposal for independent review, not yet approved or authority to edit code. Scope: resolve FI-ROCKO-4 C2 without a mismatch waiver or weaker CLI admission. No live permissions, new dependencies or source-schema changes.

Bound context

Charter candidate 3 SHA-256: 19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6. Pinned schema/checker baseline: d4696d09eb. Rocko r2 report SHA-256: 0dabd82fffdc3a56ebf9a1d8b851832c3acee2cb9332892bde9dbb13151d5e19. Frozen r2 manifest SHA-256: 2e8b5f1998a3be6cc7fcc3fba308724d2a29ca166c08f005e1bca88ddbc14196. The coordinator verified all 239 file identities/modes/sizes, aggregates and pinned inputs. This establishes the candidate identity, not functional acceptance.

Problem

Python re's end anchor permits matching immediately before a final LF; the inspector's ECMAScript patterns reject it. Four shape-oracle cases therefore currently disagree. The earlier waiver was removed and the gate correctly fails. The choice is not limited to permitting unsafe identifiers or waiving disagreements: the charter already distinguishes schema-only verdicts from strict input profiles.

Proposed normative clarification

1. Keep the pinned Python/jsonschema oracle and schema/checker bytes unchanged. The Node schema-only validator must reproduce the pinned shape verdict, including its pattern semantics. Every schema-column disagreement still fails; no named exceptions, suppressed mutations or green artifact-difference class.
2. Define an explicit stricter inspector profile for values using candidate $defs/id, $defs/runtimeId and $defs/digest: the entire string must satisfy the declared grammar under strict end-of-string semantics. A final LF must fail the profile even if the schema-only oracle accepts it. This covers all occurrences of those types, including scopes, actors, record/registry/artifact references, authorizations and simulation wrapper fields—not merely the four current probes.
3. Preserve the original value throughout both checks. Do not trim, normalize, silently substitute or create an identity index from a newline-stripped value. No schema-only pass can bypass the profile before graph/admission evaluation.
4. A well-decoded, schema-valid but profile-invalid value returns process exit 2, invalid-request, a fixed documented profile-pattern-mismatch rule, and safe pre-admission output. No newline-bearing identifier/authority/digest reaches a permitted preview. Existing closed output fields/disclaimers remain unchanged.
5. The test bridge exposes schema and profile verdicts independently. For the four reported cases: Python schema true, Node schema true, inspector profile false, actual CLI refusal. These are schema AGREEMENTS plus tested profile refusals, not allowed schema disagreements under another label. Other stricter documented lexical/byte/Unicode profile rules retain their separate expected columns.
6. Implement schema-pattern compatibility as real bounded validator behavior, not case-name/path whitelisting or a harness-only answer adjustment. A copied oracle answer is not an independent Node shape verdict. The production admission path must actually enforce the profile, not rely on a test-only wrapper to reject it.

This clarification changes validation-layer classification, not the CLI's accepted identity grammar. It does not introduce a broader accepted record profile, change a runtime policy, or require Jason to adjudicate regex dialect details. Independent review must confirm that this remains within the authorized offline build scope.

Required evidence

• Preserve all four existing disagreement witnesses; do not delete/rename them out of coverage. Test valid values, one/two final LF, CRLF, interior LF and relevant Unicode line separators across every affected type family, with independent expected shape/profile/CLI outcomes. Do not assume all separators share semantics.
• Include both records and wrapper/reference inventories, including unselected records and declared inputs. Reject before identity lookup or permission result; tests must distinguish profile refusal from a later missing-reference mismatch.
• Ordinary free-form text that legitimately permits escaped newlines must not be blanket-rejected by this targeted identifier profile. Path/time custom formats keep their existing semantics and separate tests.
• Differential oracle has zero unapproved schema disagreements; strict-only/profile refusals are visibly counted and asserted. All other mandatory tests remain green.
• No normalization, extra output fields, dependency install, modified pinned inputs or exceptions to required gates. Retain actual toolchain/platform receipts.

Gate

Filbert reviews this exact proposal as a non-author. Rocko keeps code frozen pending that verdict and coordinator instruction. If approved, record it as an explicit addendum to the unchanged charter, update bound test identities deliberately, then implement only within existing source/test paths and return a new frozen candidate. Full independent CODE review and Jason's demo remain subsequent separate gates.