stack/docs/plans/reviews/2026-09-06_foundation-inspector-code-verdict.md

# FI-FILBERT-6 — independent CODE verdict: NOT APPROVED

Reviewer: filbert. Author: rocko. Coordinator/follow-up: darkwing.
Date: 2026-09-06. Authority: the exact FI-FILBERT-6 request under Jason's authorization.

No competing assignment is known. I have not authored the implementation. This is
review of the full frozen inspector candidate, not just the regex correction.
The supplied tests pass, but independent adversarial CLI witnesses expose failures
of reference completeness, work-access narrowing, revision handling and specified
first-failure ordering. No real permission grant or runtime exploit is claimed.

## 1. Exact subject and admission

| Input | SHA-256 / commit |
|---|---|
| `2026-09-06_foundation-inspector-rocko-build-manifest-r3.json` | `3c2253b6c9f31e448c77aaac53977d41baecfb30e15845dcfffd8dc694428547` |
| `2026-09-06_foundation-inspector-rocko-build-r3.md` | `ec0444c94c9caf16472fdba1ff3fbc767dffd1a798b9a2da837598c9f4b25508` |
| Charter candidate 3 | `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` |
| Incorporated feasibility r2, §§5–13 subject to overrides | `f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1` |
| Pattern/profile addendum | `afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5` |
| Addendum verdict | `03c979b77cc6b03b6685ba51ed1ce24c3f1d7b274ce8f772263a103670050da7` |
| `records.schema.json` | `05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6` |
| `check.py` | `82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607` |
| Source/schema baseline | `d4696d09eb1b5dcf1028f30db2cd63735f51cb16` |
| Accepted map | `7345f330fc6bfae5aa1d896c78cfb7cbe62efbae` |
| Measured integration HEAD | `9a5fbdbda74b16adf488fe28138b2ba69ea5e669` |

Report/manifest paths above are under `docs/plans/reviews/`. Code is uncommitted;
HEAD alone is not its identity. I independently verified all 294 distinct regular
files, modes, sizes, hashes, the exact implementation allowlist with no extras,
all six aggregates and every pinned input before execution. Source baseline
package bytes were exported from the committed baseline, not mutable extensions.

Final recheck at **2026-09-06T21:49:22Z** verified the same identities in both the
shared tree and isolated export, and the same HEAD. No candidate drift found.
The all-candidate aggregate is
`e5f9039cf4614e8acc3f6c6a71f0a03dbc1c29002703029180d1ccef5757979c`.

## 2. Numbered findings and required dispositions

All source locations below refer to the frozen `scripts/foundation/resolve.mjs`
(SHA-256 `eaa4a419618328915cd470ba192a88b8d313ee8fa48f600289ffe39df15280b2`)
unless another file is named. Witnesses use copies of the frozen demos; no shared
fixture was edited. `B` means `fixtures/demo/demo-file-change-src.json`; `P` means
`fixtures/demo/demo-change-w1.json`, under `scripts/foundation/`.

### F1 — BLOCKING / high: referenced declarations are incompletely enforced

Locations: `checkStructuralReferences`, lines 1043–1083; `computeContext`,
1324–1347 and 1403–1407; declaration helpers at 1213 onward.
Contract: charter §3 and incorporated r2 §6.2 require exact registry-reference
resolution and declared authorization inputs; charter §§7/10.4 preserve the
special admission-stage missing-declaration exits.

Two independent witnesses:

- From B, remove registry declarations whose registry is `harness`, `settings`
  or `context-content`, leaving the agent's references intact. Actual: **exit 0,
  allowed**. These references are shape-checked but never resolved.
- From B, set `task-w1-dep.authorizationRef` to the undeclared, well-formed UUID
  `00000000-0000-4000-8000-000000000099`. Actual: **exit 0, allowed**. The dependency
  is consulted and its accepted status used, but its authorization is not checked.
  Required result is a missing-state refusal, not an allowed preview; the
  authorization case has the charter's exit-3 admission exception.

Required correction: enforce the applicable exact declaration checks, including
consulted dependencies, without turning missing declarations into unrestricted
facts or swallowing their documented admission exits. Add independent negatives
for absence and mismatched references, not just missing policy ceilings.

### F2 — BLOCKING / high: task-only contexts evade required `work.read`

Locations: `computeContext` lines 1354–1356, 1385–1417;
`checkWorkAccess` lines 1426–1434.
Contract: charter §10.2 requires work.read for consulted task references within
the supported workspace/project relation, in the full applicable intersection.

- From B, clear the selected task's `missionRef` and `dependencies`. Set execution
  restrictions to operations `["file.change"]`, readPaths `[]`, writePaths
  `[{"root":"workspace","path":null}]`, network `none`, endpointRefs `[]`.
  Actual: **exit 0, allowed**, despite consulting the assigned task without
  work.read. The boolean `consultedWork` is set only for missions/dependencies,
  not the task bound by the assignment.
- From P, clear every task's mission/dependency references and set both requester
  execution restrictions to operations `["assignment.change"]`, empty paths,
  network `none`, no endpoints. Actual: **exit 3, unresolved /
  runtime-reconciliation-required**, rather than consulted-work-not-readable.
  `checkWorkAccess` similarly conditions work.read on the task having other refs.

Required correction: distinguish genuinely taskless reads from calculations
which consult a task. Require work.read for the latter, including proposal
subject/target work, even when that task has no mission or dependency.

### F3 — BLOCKING / high: proposal issuer narrowing does not recheck work access

Locations: `evaluateProposal`, lines 1504–1535 and 1555–1563.
Contract: charter §10.1 says the explicit delegation issuer's restrictions
additionally narrow the requester calculations in **both** scopes; §10.2 requires
work.read in that full intersection.

From P, change only `delegationInputs[0].issuerCeiling.operations` to
`["assignment.change"]`. Its delegated operation remains within the issuer ceiling,
but the resulting intersection excludes work.read. Original subject work includes
mission/dependency references, so this case does not depend on F2's task-only edge.
Actual: **exit 3, unresolved / runtime-reconciliation-required**.

The code checks work access before applying the issuer, then checks only
assignment.change against the narrowed layers. Required correction: enforce all
applicable access conditions against the issuer-narrowed contexts, with coherent
negative coverage in both scopes. An unresolved preview must not falsely claim
that all modeled checks passed.

### F4 — BLOCKING / medium: cycle construction merges distinct historical revisions

Location: `checkCycles`, lines 1087–1109.
Contract: exact four-field references, contiguous history, and separate edge
relations in charter §3 / §10.4 and incorporated r2 §6.2–6.3.

The dependency graph keys tasks by identity **without revision** and unions edges
from every historical record. Independent witness:

- Keep B's revision-1 history: T1 (`task-w1`) depends on D1 (`task-w1-dep`).
- Add contiguous T2 with no dependencies, and D2 depending on T2.
- Add revision 2 of the selected assignment and the two relevant plan decisions;
  bind the assignment/selection and plan subjects to the new exact revisions.
  Each new record supersedes its own revision 1. All old references still exist.

All records pass the pinned schema/formats. Independent exact-reference DFS finds
**no cycle** in dependencies, mission parents or supersedes, and independently
asserts contiguous histories. The selected current task T2 has no dependencies.
Actual CLI: **exit 2, invalid-request / dependency-cycle** because the implementation
constructs the different graph T→D→T by discarding revision distinctions.

Required correction: do not infer cycles by unioning temporally distinct edges.
Preserve the approved exact-reference/history semantics and required cycle-before-
continuity precedence. If a stronger, identity-wide historical prohibition is
intended, obtain an explicit contract ruling instead of silently adding it.

### F5 — BLOCKING / medium: specified first-failure ordering is not preserved

Locations: `validateBundleShapeScoped`, approximately 719–733 (before Model's
record sort at 988); `evaluateProposal`, 1504–1541.
Contract: charter §10.4 requires stable kind/id/scope/revision/field ordering within
a stage, not inventory input order; §5 gives missing delegation plus message its
named rule after structural validation.

1. From B, set `agent-a.payload.status` to an invalid enum and add an unknown
   `extra` field to `agent-b.payload`. Forward record inventory yields
   **exit 2 / shape-enum-mismatch**. Reverse only the top-level record array:
   **exit 2 / shape-unknown-field**. Both identities remain well-formed. Validation
   returns the first array member's error before the later stable sorting applies.
2. From P, set delegationRef null, supply a synthetic message, and restrict original
   requester execution to work.read only. Structural validation succeeds. Actual:
   **exit 3 / operation-not-permitted**, proposal rule
   `requester-lacks-original-scope-authority`, rather than `message-is-not-authority`.
   The special message check is deferred until after requester admission.

Required correction: implement the frozen first-failure contract and add independent
multi-failure/permutation tests. If message precedence is meant differently, darkwing
must reconcile the explicit §5 exception; the writer must not guess an override.

### F6 — NONBLOCKING evidence improvement: writer inventories omit ownership

`cli.test.mjs:31–39` and `test-foundation.sh:123` inventory path/type/size/mode/
inode/mtime/content, but omit UID/GID despite charter §8 naming ownership.
My separate 15-run inventory includes UID/GID and passes (see §4), so this is not
an observed owner change or an additional code rejection. Preserve ownership
coverage in the maintained regression harness rather than relying on this review's
one-off receipt.

## 3. Acceptance and historical-finding dispositions

| Gate | Independent disposition |
|---|---|
| A1 | Positive text/JSON read and assigned-change demos pass exact-output tests; disclaimers present; bounded no-effect observation passes. Does not rescue F1/F2's additional false-positive cases. |
| A2 | Named missing-workspace-registration/cross-project fixtures pass; no fallback or unrelated payload emission observed. |
| A3 | Supplied duplicate/reference/ownership/revision/cycle negatives pass, including separate detector and CLI-precedence tests. **Not satisfied generally: F1/F4.** |
| A4 | Supplied role, mandatory policy, optional task/mission/execution, registration-delegation, path-prefix and no-assignment-union tests pass. **Not satisfied: F1–F3.** |
| A5 | Strict-parser, bounded canonical domain, separate pinned schema/profile oracle and production LF refusals pass the tested finite domains. |
| A6 | Static runtime import/I/O review and independent descriptor/non-effect tests pass within stated limits; see F6. No OS-containment claim. |
| A7 | No allowed reassignment branch found; original selection is preserved and supplied requester negatives pass. **Not satisfied: F2/F3 and F5's proposal ordering.** |
| A8 | Closed fields, exits 0/2/3/4, parser/I/O diagnostics, escaping and body-free outputs pass supplied tests. **Not fully satisfied: F5.** |
| Required integration verification | Foundation checker independently green. **Five repository suites not independently rerun; writer receipts only. Gate remains uncleared.** |
| A9 | Not performed; Jason's demo/acceptance remains separate and cannot proceed as an accepted-code gate from this verdict. |

Prior admission findings against the older candidates:

- **C1 closed for r3 identity.** The corrected message-demo digest is
  `f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab`;
  manifest and demo-copy equality verify. I do not independently attest the writer's
  historical scratch timestamps or reconstruct authorship of the original typo.
- **C2 closed for the tested r3 corpus/profile implementation.** The actual Node
  schema column agrees with pinned Python; no disagreement waiver or copied oracle
  answer supplies the Node result. Strict production validation remains separate,
  rejects rather than normalizes identities, and precedes graph admission.
  Original four LF witnesses remain, as do the low-year calendar witnesses.
- **C3 closed.** Exactly the twelve charter result fields; process exit is separate.
  Contract-derived assertions and spawned outputs pass, including pre-validation.
- **C4 closed as bounded evidence.** Before inventories are captured before runs
  and compared afterwards, not regenerated as the expected baseline. My separate
  ownership-inclusive observation confirms the measured result.
- **C5 closed.** Actual CLI requires O_RDONLY/O_NOFOLLOW/O_NONBLOCK, including the
  valid zero-valued O_RDONLY; FIFO refusal passes. No O_CLOEXEC claim is made.

## 4. Independent commands, receipts and reproducibility

Isolated candidate export: `/tmp/fi-filbert-6.42ru903e`.
Separate harness/evidence root: `/tmp/fi-filbert-6.42ru903e-evidence`.
Source/test commands were inspected before execution. Candidate fixture generation
ran only into the suite's disposable scratch, never the shared frozen tree.

Measured toolchain: Node **v26.8.1**, Python **3.12.8**, jsonschema **4.26.0**.
The pinned low-year platform witness is `strftime('%Y', year 999) == '999'`.

From the isolated export, the following commands each exited **0**, under `env -i`
with PATH `/home/jwoltje/.pyenv/versions/3.12.8/bin:/usr/bin:/bin`, synthetic HOME
and TMPDIR beneath the evidence root, `PYTHONDONTWRITEBYTECODE=1`, `NO_COLOR=1`:

| Command | Actual result |
|---|---|
| `node --test scripts/foundation/` | 63 tests, 63 pass, 0 fail, 0 skipped |
| `python3 scripts/foundation/verify-schema.py` | 3 pins match; 38 pinned fixtures; 1539 corpus records; 519 agree-valid / 983 agree-invalid / **0 disagreements**; 27 parser-only; 10 unsupported-kind unassessed; 489 profile-valid / 30 profile-invalid among schema-valid records; 73 named probes verified |
| `bash scripts/test-foundation.sh` | 43 passed, 0 failed; scratch regeneration equality, suites/oracle, goldens, I/O and non-effect checks |
| `python3 docs/plans/foundation-v1-candidate/check.py` | Exit 0: command 38+5, records 38, paths 16, restricted fingerprints 7, runtime/artifact 155+5, synthetic semantic model 35; not runtime enforcement |

Additional independent harnesses in the evidence root:

- `python3 reproduce.py` and `python3 additional-probes.py`: exact CLI witnesses
  described above, plus the allowed B positive control. Captured result JSON and
  input hashes are in `witnesses/`; all CLI stderr was empty.
- `python3 witness-validation.py`: 390 record-shape checks across exploratory and
  finding witnesses pass using the pinned schema and independently redeclared
  checker formats. The intentional shape-order negatives are excluded. Also checks
  exact graph acyclicity and complete histories for F4; exit 0.
- `python3 profile-probes.py`: **831** independently enumerated typed-identity
  occurrences/probes across B/P and a non-null agent execution-ID control. Each
  single-final-LF mutation gives exit 2, invalid-request/profile-pattern-mismatch,
  with selection/operation/proposal/diagnostic all null. A multiline mission
  objective remains allowed. This extends, not replaces, the supplied record oracle.
- `python3 non-effect.py`: 15 independent text/JSON, parser, missing-file,
  final-symlink, FIFO and usage runs. All expected exits pass. **16 inventory
  entries unchanged**, including path/type/size/mode/UID/GID/inode/mtime-ns and
  content or symlink target, with fixture/home/cwd/data roots separated from logs.
  Absolute Node executable, PATH `/nonexistent`, synthetic HOME/config canaries;
  no canary output. Exit 0.
- `python3 recheck.py`: final shared-tree/export identities and HEAD pass, exit 0.

Selected evidence hashes (paths relative to the evidence root):

| Artifact | SHA-256 |
|---|---|
| `node-tests.log` | `36c59ae491eec2d97909912f3fe4141b44e6473f0640b2141c460e2089a8a1df` |
| `oracle.log` | `18774c031f6e2bea64c45112fc23e29984db4923a74b365eaafed912746481ad` |
| `selftest.log` | `fafe1f016eaa8d150119902f2bec5ca2a83a78ccaf06501dbc5db9e9b0979a05` |
| `foundation-check.log` | `42ddd578b4f2be0c0b7b5b78a95de3a94e7d372661f634eb6f5209aa55e0c60a` |
| `profile-probe-receipts.json` | `6c067bcd6c4d88482b410e4e91f228ae5ef293156670b32c13d88544bcba463a` |
| `witnesses/receipts.json` | `db77081d5f0acf6f9f2744c48ea208a5363a688ec363db19a8767c32ef02b773` |
| `witnesses/additional-receipts.json` | `04c3945df8de33e0ed7b44a760703c19cb9d1a27dcc1e31b5678be1d630a7df1` |
| `inventory-before.json` and `inventory-after.json` (identical) | `78d5da15db9f0ae1501f7a24dccb14208eb9ba8b80c6e96d243fb850daced47c` |
| `recheck.log` | `66a96b5d044180515a717551a26ec75adaa109d0765eeb3a74ef3081b43c7d37` |

Witness input SHA-256s, for exact reproduction/audit:

| Witness basename under `witnesses/` | SHA-256 |
|---|---|
| `missing-agent-registry-declarations.json` | `78efd6fb46960079423eacc5cc9f469f0856a945137b03808e64b98add50bf56` |
| `consulted-dependency-undeclared-authorization.json` | `cc78be2811d49e6d56d67a009cac532e559a901e9a960834f64121d154e75299` |
| `assigned-change-without-work-read.json` | `35ee45e648387b9a8b0aa81b201b4eff61eb5a15bdc6eea30ecbfacecae77bd9` |
| `proposal-task-only-contexts-without-work-read.json` | `e1a9cd887f1bc64a8abdd8a0a1326df21b1ac0406ead978d2e6fc26e4eb0d683` |
| `proposal-issuer-denies-work-read.json` | `34d1ed805d3d42098052be2b928404947bd2d3b7b4c1af0edd3ec344aaec88f2` |
| `acyclic-versioned-history-false-cycle.json` | `e3dd1cd34e24c4d9ba0354203b7754c9e045966f0503d28ae1912e4e89eb2d15` |
| `shape-order-forward.json` | `689f9aa9713e53d7b10f9a9e263d16a2ff7e83d3056060c37c79c4e30bd11d6c` |
| `shape-order-reversed.json` | `d14fca5e43632c3283f1bcda772f9940dcd234afdfa43fe19bf5faa336eff062` |
| `message-priority-after-structural-validation.json` | `9e2ec77b87fb99fa602876fb5ffd52bbcd2142a4f7224cf1cdf7ec223a89d6fe` |

Scratch paths are local, disposable evidence, not durable repository artifacts.
The mutation recipes above and the frozen demo identities permit reconstruction.

## 5. Limits, corrections and handoff

- The five legacy repository suites were **not independently rerun**. Their green
  results remain Rocko's receipts. Inspection found Docker/live branches in legacy
  task/release tests and git mutation fixtures in the conductor test; I did not
  widen this already-failing review into those activities or invent a skip/stub
  and call the integration gate green. That required gate still needs an explicitly
  authorized, isolated, non-live verification run before approval.
- Exploratory scratch receipts also contain blocked-subject-task, unrelated
  subject-task-intent and blocked-target-mission probes reaching unresolved.
  **Correction to their provisional expected-from-contract labels and my early
  progress wording:** these are not counted as established violations here.
  §5 specifically names subject-assignment and target-task checks; I do not infer
  an additional full subject/target L1–L9 calculation from those experiments.
- An exploratory Unicode probe agreed (both rejected U+13439); no Unicode
  disagreement is claimed. Exhaustive comparison of the host Python/Node
  Cc/Cf/Cs category sets found the same 2283 code points. This does not establish
  general equivalence of their Unicode or schema implementations.
- Finite tests, static import review and unchanged inventories do not prove absence
  of every read, complete schema equivalence, OS containment, authentic delegation,
  crash safety, parent-path containment or resistance to same-size concurrent
  input mutation. Only Node v26.8.1 was executed; no Node 22/24 portability claim.
- No shared implementation, fixture, charter, log, CURRENT or index edits; no
  installation, staging/commit/checkout/reset/push, engine/network/native/sync or
  live-data work. Synthetic canary files used by tests are not real credentials;
  the operator's actual HOME/credentials/`~/.mosaic` were not investigated.
  This verdict is the only repository write for FI-FILBERT-6.

**Return to darkwing:** reconcile F1–F5 with the frozen contract, let Rocko alone
make any authorized corrections, then supply a newly hashed frozen candidate and
complete verification receipts for independent re-review. No implementation,
reassignment, acceptance, owner demo, push, issue closure or next phase follows
automatically. No timer or deadline is set.