jason.woltje
8ebddd6f93
Rocko-authored, Filbert-reviewed inspector (r6 manifest a4a44930...) with full review/build/verdict evidence under docs/plans/reviews. 43/0 selftests, oracle zero-disagreement, foundation checker PASS. Owner A9 acceptance recorded separately.
237 lines
16 KiB
Markdown
237 lines
16 KiB
Markdown
# FI-FILBERT-7 — r5 independent CODE verdict: NOT APPROVED
|
||
|
||
Scope: **bounded offline-demo code gate**, not deployment or owner acceptance.
|
||
Reviewer: filbert. Sole code author: rocko. Coordinator/follow-up: darkwing.
|
||
Date: 2026-09-07. No competing assignment is known; no implementation authorship.
|
||
|
||
All nine original F1–F5 witness inputs now produce corrected results. All executed
|
||
required suites pass. **F5 nevertheless remains open:** the new content tie-break
|
||
collapses distinct Unicode entries to the same fallback and again makes the emitted
|
||
first failure depend on inventory order. Six independent reversed-order witness
|
||
pairs demonstrate this. This is a deterministic-refusal defect, not a real permission
|
||
grant or demonstrated runtime-security exploit.
|
||
|
||
## 1. Exact candidate, authority and identity checks
|
||
|
||
| Input | SHA-256 / commit |
|
||
|---|---|
|
||
| r5 manifest `docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r5.json` | `a63bb103e4cfe51bbd8a42cd95545f935ac83c1da51cf469298375cf94ced135` |
|
||
| r5 report `docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r5.md` | `17c67427dfdf1bc5dac491c4d0223928e87fdfc67a26175ac239eb2b2f7b7dec` |
|
||
| Charter candidate 3 | `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` |
|
||
| Incorporated feasibility r2, §§5–13 subject to charter overrides | `f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1` |
|
||
| Pattern/profile addendum | `afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5` |
|
||
| Pinned record schema | `05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6` |
|
||
| Pinned checker | `82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607` |
|
||
| Owner demo test-gate decision | `62cea74bea59e69f29c8a29a9c0311fdc6feffa2c337bc6a141db55149204898` |
|
||
| Source/schema baseline | `d4696d09eb1b5dcf1028f30db2cd63735f51cb16` |
|
||
| Measured integration HEAD | `9a5fbdbda74b16adf488fe28138b2ba69ea5e669` |
|
||
|
||
I independently verified **369 distinct regular candidate files**, sizes, modes,
|
||
SHA-256s, exact allowlist/no extras, all six aggregates, report/manifest hashes and
|
||
every manifest-pinned input. Copies were hash-verified before execution. Final
|
||
shared-tree/export recheck at **2026-09-07T15:15:57Z** passed with the same HEAD.
|
||
The code is uncommitted: HEAD is not falsely presented as its code identity.
|
||
|
||
Export: `/tmp/fi-filbert-7.239u2bco`.
|
||
Separate evidence/harness root: `/tmp/fi-filbert-7.239u2bco-evidence`.
|
||
Required baseline bytes came from the committed source baseline, not moving owner
|
||
work. The non-live integration scripts and their relevant baseline dependencies
|
||
are unchanged between that baseline and measured HEAD. Five unrelated native/fleet/
|
||
goal scripts differ between those commits; they were not executed or independently
|
||
reviewed here. No shared index or owner extension work was used as test scratch.
|
||
|
||
## 2. Numbered finding
|
||
|
||
### R5-1 / F5 reopened — BLOCKING, medium: partial canonicalizer is not a total ordering tie-break
|
||
|
||
Sources in the frozen candidate:
|
||
|
||
- `scripts/foundation/resolve.mjs:730–751`, especially `734–735` and `750`;
|
||
SHA-256 `892f95ab8a971d93060353e43d53cb6988e7e61f2a5bae71f6f2aaf2b7c1f09f`.
|
||
- `scripts/foundation/canonical.mjs:29–43`: the mock-content canonicalizer rejects
|
||
non-ASCII strings, as required for its separately bounded digest domain.
|
||
- New ordering tests: `scripts/foundation/resolve.test.mjs:548–712` exercise ASCII
|
||
tie-breaks and readable differing keys, but miss the colliding Unicode fallbacks.
|
||
|
||
Contract: charter §10.4 and the pinned ordering follow-up require stable within-stage
|
||
ordering, including deterministic content tie-breaking for malformed entries. The
|
||
r5 report's assertion that only indistinguishable duplicates fall back to input index
|
||
is not true for this implementation.
|
||
|
||
`stableOrder` catches a `CanonicalError` and assigns canonical content `""`. Two
|
||
**different** entries containing non-ASCII strings therefore compare equal whenever
|
||
their typed keys are equal or both unreadable. The final `a.i - b.i` makes input order
|
||
choose the first shape failure. This affects emitted CLI rules, not just internal
|
||
locators.
|
||
|
||
#### Independent concrete witnesses
|
||
|
||
Start with a copy of the frozen
|
||
`scripts/foundation/fixtures/demo/demo-file-change-src.json`.
|
||
|
||
1. Replace `registries` with `[{"extra":"é"}, "é"]`. CLI `--json` returns
|
||
**exit 2 / invalid-request / shape-unknown-field**. Reverse only that array:
|
||
**exit 2 / invalid-request / shape-type-mismatch**. Both entries have unreadable
|
||
identity keys and both fail the ASCII canonicalizer.
|
||
2. The identical substitution/reversal independently produces the same differing
|
||
rules in **records, artifacts and delegationInputs**: four affected families.
|
||
3. For readable equal keys, duplicate `agent-a` at the same kind/id/scope/revision.
|
||
Give both copies the legitimate displayName `Café`; make the first copy's status
|
||
an invalid enum and give the other an unknown payload field. Forward/reversed
|
||
inventory gives **shape-enum-mismatch / shape-unknown-field**, both exit 2.
|
||
4. Duplicate `agent-policy/ap-full` with identical registry/id/revision/digest keys.
|
||
Both copies have readPaths `[{"root":"workspace","path":"café"}]`; give one
|
||
an invalid network enum and the other an unknown restrictions field. Reversal
|
||
again changes **shape-enum-mismatch / shape-unknown-field**, both exit 2, before
|
||
the later digest/duplicate stages.
|
||
|
||
All six pairs were executed through the real exported CLI. Four matched ASCII-only
|
||
malformed-entry controls are stable under reversal. Separate valid Unicode displayName
|
||
and logical-path controls remain **allowed**, as the contract requires. All observed
|
||
shape failures remain privacy-safe; no body disclosure is alleged.
|
||
|
||
Required correction: provide a deterministic tie-break over the relevant full
|
||
strict-JSON input domain without treating distinct unsupported canonical values as
|
||
identical. Preserve the ASCII-only **mock digest** domain, permitted Unicode record/
|
||
path values, semantic sequence order, stage precedence and body-free diagnostics.
|
||
Do not fix this by blanket-rejecting Unicode or changing the charter. Add equal-key
|
||
and unreadable-key multi-failure Unicode permutation regressions. Rocko alone owns
|
||
any authorized implementation correction; none was made in this review.
|
||
|
||
Exact equal-key record witness input hashes:
|
||
|
||
| File under evidence `witnesses/` | SHA-256 |
|
||
|---|---|
|
||
| `equal-key-unicode-records-forward.json` | `372c5bf1fc0d600ed5d348dc3638c2206d9c6aa43b869f35b0699b7c836e63cf` |
|
||
| `equal-key-unicode-records-reversed.json` | `22ed3d21bc95b950af49f37b5c8f33b6be7db52ec4342542a04690696ed95134` |
|
||
|
||
No additional numbered code finding is asserted. Finite passing tests are not a
|
||
claim that every other possible interaction is correct.
|
||
|
||
## 3. Original findings and acceptance dispositions
|
||
|
||
Original witness files were preserved byte-for-byte from FI-FILBERT-6; their hashes
|
||
match the prior verdict's listed inputs. Actual r5 CLI dispositions:
|
||
|
||
| Finding | Independent result / disposition |
|
||
|---|---|
|
||
| F1 missing referenced declarations | Both original cases now refuse: exit 3 / missing-state / registry-declaration-missing; exit 3 / missing-state / authorization-undeclared. **Closed for reviewed consulted-declaration paths.** |
|
||
| F2 task-only work access | Assigned change and task-only proposal both refuse exit 3 / consulted-work-not-readable; proposal identifies original requester context. Taskless positives remain allowed. **Closed.** |
|
||
| F3 issuer narrowing | Original issuer-denies-work.read case now refuses exit 3 / consulted-work-not-readable, original requester context. Source rechecks the narrowed layers in both scopes. **Closed for reviewed narrowing behavior.** |
|
||
| F4 revision-collapsed cycles | Original acyclic exact-reference history now returns exit 0 / allowed. A further stale-selection mutation reaches assignment-stale, not a fabricated cycle. Real-cycle and cycle-before-continuity fixtures pass. **Closed.** |
|
||
| F5 ordering/message priority | Original forward/reversed shape cases both yield shape-enum-mismatch; original message case now yields message-is-not-authority. These witnesses close, but **F5 overall remains OPEN via R5-1**. |
|
||
| F6 ownership inventory | Both maintained inventories now include UID/GID; maintained and independent before/after tests pass. **Closed.** |
|
||
|
||
The fixed `registry-declaration-missing` diagnostic is consistent with the pinned
|
||
coordinator ruling and the declaration/admission distinction: it is an exit-3
|
||
missing-state refusal for a missing consulted external declaration, not the exit-2
|
||
ordinary-record reference rule. I independently combined missing declarations with
|
||
structural missing records, duplicates, invalid typed profiles and unsupported
|
||
operations: each earlier gate still wins with its specified exit/rule. Registry
|
||
lookups remain exact in registry/id/revision/digest; no live authority is inferred.
|
||
|
||
| Gate | r5 disposition |
|
||
|---|---|
|
||
| A1 | Tested positive read/assigned-change text and JSON outputs, goldens, disclaimers and no-effect observations pass. |
|
||
| A2 | Missing registration/cross-project selection and privacy/no-fallback fixtures pass. |
|
||
| A3 | Reference, ownership, duplicate, history and genuine-cycle detector/CLI tests pass; exact revision fix independently reproduced. |
|
||
| A4 | Tested role/policy/task/mission/execution/issuer intersections, path bounds and no-assignment-union cases pass; F1–F3 witnesses corrected. |
|
||
| A5 | Strict parser and separate schema/profile oracle pass tested domains; 831 independent typed-LF probes refuse before admission. Unicode/free-text positives remain valid. |
|
||
| A6 | Static runtime I/O/import review retained; descriptor, ownership-inclusive inventory and canary checks pass within bounded evidence limits. |
|
||
| A7 | Both requester contexts/narrowing checked in source/tests; original selection retained; no allowed reassignment branch. Original F2/F3/message witnesses corrected. |
|
||
| A8 | Closed fields, exits 0/2/3/4, escaping and body-free errors pass tested cases. **Not satisfied overall: R5-1 violates stable first-failure ordering.** |
|
||
| Offline-demo integration prerequisite | Inspector, oracle, checker, config/auth/conductor independently pass. Task/release **NOT RUN / DEFERRED**, not green. |
|
||
| A9 | Not performed. Jason's separate demo acceptance remains required and is not implied by this review. |
|
||
|
||
Prior C1–C5 closures remain supported by r5 identity and rerun tests: corrected demo
|
||
digest/copy equality; genuine zero-waiver schema comparison plus strict production
|
||
profile; twelve closed result fields with process exit separate; saved-before versus
|
||
after comparisons; and required O_RDONLY/O_NOFOLLOW/O_NONBLOCK with FIFO refusal.
|
||
The calendar platform witness and original LF witnesses remain. No trimming or
|
||
normalized identity lookup replaces production refusal.
|
||
|
||
## 4. Executed commands and independent receipts
|
||
|
||
Commands were inspected before execution. From the isolated export, using `env -i`,
|
||
synthetic HOME/TMPDIR, `PYTHONDONTWRITEBYTECODE=1`, `NO_COLOR=1` and PATH
|
||
`/home/jwoltje/.pyenv/versions/3.12.8/bin:/usr/bin:/bin`:
|
||
|
||
| Command | Exit and actual result |
|
||
|---|---|
|
||
| `node --test scripts/foundation/` | 0; **77 pass, 0 fail, 0 skipped** |
|
||
| `bash scripts/test-foundation.sh` | 0; **43 pass, 0 fail**, including scratch-only fixture regeneration equality |
|
||
| `python3 scripts/foundation/verify-schema.py` | 0; **1563 records**, 539 agree-valid / 987 agree-invalid / **0 disagreements**; 27 parser-bound unassessed, 10 unsupported-kind unassessed; 509 profile-valid / 30 profile-invalid; 73 named probes verified |
|
||
| `python3 docs/plans/foundation-v1-candidate/check.py` | 0; all pinned author checks pass, including 38 record shapes, 16 paths, 7 restricted fingerprints, 155 runtime/artifact shapes and 35 synthetic model cases; not runtime enforcement |
|
||
|
||
Measured versions: **Node v26.8.1, Python 3.12.8, jsonschema 4.26.0**. The year-999
|
||
`strftime('%Y')` witness is `999`, as required by the pinned checker on this platform.
|
||
|
||
Non-live integration ran via `python3 integration.py` in the separate disposable
|
||
`<evidence>/integration-fixture` copy. It seeded a **disposable test Git repository**
|
||
so the conductor suite could clone/commit/reset only its own test fixtures. Git
|
||
system/global configuration was disabled, HOME/TMPDIR synthetic, and no shared Git
|
||
mutation occurred. Commands `bash scripts/test-config.sh`, `bash scripts/test-auth.sh`
|
||
and `bash scripts/test-conductor.sh` each exited **0**, respectively **24/0, 15/0,
|
||
17/0 passed/failed**. Auth inputs were fabricated test canaries, never real credentials.
|
||
Failing guards for docker/podman/curl/wget/ssh were installed ahead of PATH and were
|
||
**never invoked**; they did not simulate services or supply passing branch results.
|
||
|
||
Additional independent harnesses, all under the evidence root:
|
||
|
||
- `python3 review-probes.py`: exit 0 verifies the nine corrected original witnesses,
|
||
**six remaining Unicode ordering counterexamples**, and four stable ASCII control
|
||
pairs (29 CLI executions). Exit 0 here means the recorded findings were reproduced,
|
||
**not** that the candidate passes the counterexamples.
|
||
- `python3 interactions.py`: exit 0; eight independently constructed stage-order,
|
||
message/issuer, history/currentness and Unicode-positive interactions pass.
|
||
- `python3 profile-probes.py`: exit 0; **831** typed-identity single-final-LF mutations
|
||
produce exit 2 / profile-pattern-mismatch with selection/operation/proposal/diagnostic
|
||
all null; a multiline mission objective remains allowed.
|
||
- `python3 non-effect.py`: exit 0; **15** text/JSON/parser/I/O/usage executions, **16**
|
||
unchanged inventory entries including path/type/size/mode/UID/GID/inode/mtime-ns/
|
||
content-or-symlink-target; observed fixture/home/cwd/data roots separate from logs.
|
||
- `python3 recheck.py`: exit 0; final shared/export candidate identities and HEAD pass.
|
||
|
||
Selected hashes, relative to the evidence root:
|
||
|
||
| Artifact | SHA-256 |
|
||
|---|---|
|
||
| `node-tests.log` | `9cf6f45864e50b7c81e50c31e88d76bf41e6c046d54284205ea21f14f2bc7654` |
|
||
| `selftest.log` | `a9eacfc0f8679cd0a6688d2dd3f705528f5b0c1299cf822e61e7be33f578af1e` |
|
||
| `oracle.log` | `7bffe6dc27383ee65d2a6b39443aafccab24d2e9247982de2719d29411d929fb` |
|
||
| `integration-receipts.json` | `9f576d011b598fab9ac03c56ee68bf0d1ba5eba902d15a22a4742ebe06e8afcb` |
|
||
| `review-probe-receipts.json` | `4c46cd6ebd0fc6cb560172e9364f9a6e34a8182b1b869c58ab70f3b76de9ba91` |
|
||
| `review-probes.py` | `aa8132dd0a32878d3c94e0475bd34a2348d452af33538ee990a81283f53af107` |
|
||
| `profile-probe-receipts.json` | `6c067bcd6c4d88482b410e4e91f228ae5ef293156670b32c13d88544bcba463a` |
|
||
| `interaction-receipts.json` | `3e27aee6492ee121f88f28cc00e20af0f2c63d086772210a3030d054784301c6` |
|
||
| `inventory-before.json` and `inventory-after.json` (identical) | `5a4feeb061565506317b81dcc3af9bda310674bf0b8aa6ad0972286771ceda59` |
|
||
| `recheck.log` | `edad63227d0c0f7ef8fc08869334fd19dc8a2f0e5a1dba5298b4e907367775ed` |
|
||
|
||
Scratch is local/disposable evidence, not a durable repository receipt. The minimal
|
||
recipes and frozen demo identity above permit reconstruction without modifying
|
||
shared fixtures.
|
||
|
||
## 5. Deferred coverage, limits and handoff
|
||
|
||
**`scripts/test-task.sh` and `scripts/test-release.sh`: NOT RUN / DEFERRED** under
|
||
Jason's 2026-09-07 offline-demo decision. They are not passed, skipped-as-green or
|
||
fully covered. Full deployment/integration testing remains a later gate before
|
||
dependent live runtime work. The recorded correction that r3 ran live branches
|
||
stands; the new decision neither retroactively authorizes nor relabels that history.
|
||
No such branches were executed in this review.
|
||
|
||
Finite tests and inventories are not OS containment, proof of no reads, full schema
|
||
or Unicode equivalence, authentic delegation, crash safety, same-size-race defense
|
||
or parent-path containment. Only Node v26.8.1 was executed. No installation,
|
||
provider/engine/container/network/native/sync/live-data work or investigation of the
|
||
operator's actual credentials/HOME/`~/.mosaic` occurred. Git mutations were confined
|
||
to the explicitly authorized disposable conductor fixtures. No shared index,
|
||
implementation, fixture, charter, prior verdict, log or CURRENT changes; this verdict
|
||
is the only repository write for FI-FILBERT-7.
|
||
|
||
**Return to darkwing:** reconcile R5-1/F5, authorize Rocko alone to correct owned
|
||
code if appropriate, then provide a newly hashed frozen candidate for re-review.
|
||
The offline-demo code gate is **NOT APPROVED**. No automatic implementation,
|
||
owner acceptance, demo completion, push, issue closure or dependent phase advance;
|
||
no deadline or timer is set.
|