stack/docs/plans/reviews/2026-09-07_foundation-inspector-code-verdict-r5.md

FI-FILBERT-7 — r5 independent CODE verdict: NOT APPROVED

Scope: bounded offline-demo code gate, not deployment or owner acceptance. Reviewer: filbert. Sole code author: rocko. Coordinator/follow-up: darkwing. Date: 2026-09-07. No competing assignment is known; no implementation authorship.

All nine original F1–F5 witness inputs now produce corrected results. All executed required suites pass. F5 nevertheless remains open: the new content tie-break collapses distinct Unicode entries to the same fallback and again makes the emitted first failure depend on inventory order. Six independent reversed-order witness pairs demonstrate this. This is a deterministic-refusal defect, not a real permission grant or demonstrated runtime-security exploit.

1. Exact candidate, authority and identity checks

Input	SHA-256 / commit
r5 manifest docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r5.json	a63bb103e4cfe51bbd8a42cd95545f935ac83c1da51cf469298375cf94ced135
r5 report docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r5.md	17c67427dfdf1bc5dac491c4d0223928e87fdfc67a26175ac239eb2b2f7b7dec
Charter candidate 3	19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6
Incorporated feasibility r2, §§5–13 subject to charter overrides	f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1
Pattern/profile addendum	afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5
Pinned record schema	05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6
Pinned checker	82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607
Owner demo test-gate decision	62cea74bea59e69f29c8a29a9c0311fdc6feffa2c337bc6a141db55149204898
Source/schema baseline	d4696d09eb1b5dcf1028f30db2cd63735f51cb16
Measured integration HEAD	9a5fbdbda74b16adf488fe28138b2ba69ea5e669

I independently verified 369 distinct regular candidate files, sizes, modes, SHA-256s, exact allowlist/no extras, all six aggregates, report/manifest hashes and every manifest-pinned input. Copies were hash-verified before execution. Final shared-tree/export recheck at 2026-09-07T15:15:57Z passed with the same HEAD. The code is uncommitted: HEAD is not falsely presented as its code identity.

Export: /tmp/fi-filbert-7.239u2bco. Separate evidence/harness root: /tmp/fi-filbert-7.239u2bco-evidence. Required baseline bytes came from the committed source baseline, not moving owner work. The non-live integration scripts and their relevant baseline dependencies are unchanged between that baseline and measured HEAD. Five unrelated native/fleet/ goal scripts differ between those commits; they were not executed or independently reviewed here. No shared index or owner extension work was used as test scratch.

2. Numbered finding

R5-1 / F5 reopened — BLOCKING, medium: partial canonicalizer is not a total ordering tie-break

Sources in the frozen candidate:

• scripts/foundation/resolve.mjs:730–751, especially 734–735 and 750; SHA-256 892f95ab8a971d93060353e43d53cb6988e7e61f2a5bae71f6f2aaf2b7c1f09f.
• scripts/foundation/canonical.mjs:29–43: the mock-content canonicalizer rejects non-ASCII strings, as required for its separately bounded digest domain.
• New ordering tests: scripts/foundation/resolve.test.mjs:548–712 exercise ASCII tie-breaks and readable differing keys, but miss the colliding Unicode fallbacks.

Contract: charter §10.4 and the pinned ordering follow-up require stable within-stage ordering, including deterministic content tie-breaking for malformed entries. The r5 report's assertion that only indistinguishable duplicates fall back to input index is not true for this implementation.

stableOrder catches a CanonicalError and assigns canonical content "". Two different entries containing non-ASCII strings therefore compare equal whenever their typed keys are equal or both unreadable. The final a.i - b.i makes input order choose the first shape failure. This affects emitted CLI rules, not just internal locators.

Independent concrete witnesses

Start with a copy of the frozen scripts/foundation/fixtures/demo/demo-file-change-src.json.

1. Replace registries with [{"extra":"é"}, "é"]. CLI --json returns exit 2 / invalid-request / shape-unknown-field. Reverse only that array: exit 2 / invalid-request / shape-type-mismatch. Both entries have unreadable identity keys and both fail the ASCII canonicalizer.
2. The identical substitution/reversal independently produces the same differing rules in records, artifacts and delegationInputs: four affected families.
3. For readable equal keys, duplicate agent-a at the same kind/id/scope/revision. Give both copies the legitimate displayName Café; make the first copy's status an invalid enum and give the other an unknown payload field. Forward/reversed inventory gives shape-enum-mismatch / shape-unknown-field, both exit 2.
4. Duplicate agent-policy/ap-full with identical registry/id/revision/digest keys. Both copies have readPaths [{"root":"workspace","path":"café"}]; give one an invalid network enum and the other an unknown restrictions field. Reversal again changes shape-enum-mismatch / shape-unknown-field, both exit 2, before the later digest/duplicate stages.

All six pairs were executed through the real exported CLI. Four matched ASCII-only malformed-entry controls are stable under reversal. Separate valid Unicode displayName and logical-path controls remain allowed, as the contract requires. All observed shape failures remain privacy-safe; no body disclosure is alleged.

Required correction: provide a deterministic tie-break over the relevant full strict-JSON input domain without treating distinct unsupported canonical values as identical. Preserve the ASCII-only mock digest domain, permitted Unicode record/ path values, semantic sequence order, stage precedence and body-free diagnostics. Do not fix this by blanket-rejecting Unicode or changing the charter. Add equal-key and unreadable-key multi-failure Unicode permutation regressions. Rocko alone owns any authorized implementation correction; none was made in this review.

Exact equal-key record witness input hashes:

File under evidence witnesses/	SHA-256
equal-key-unicode-records-forward.json	372c5bf1fc0d600ed5d348dc3638c2206d9c6aa43b869f35b0699b7c836e63cf
equal-key-unicode-records-reversed.json	22ed3d21bc95b950af49f37b5c8f33b6be7db52ec4342542a04690696ed95134

No additional numbered code finding is asserted. Finite passing tests are not a claim that every other possible interaction is correct.

3. Original findings and acceptance dispositions

Original witness files were preserved byte-for-byte from FI-FILBERT-6; their hashes match the prior verdict's listed inputs. Actual r5 CLI dispositions:

Finding	Independent result / disposition
F1 missing referenced declarations	Both original cases now refuse: exit 3 / missing-state / registry-declaration-missing; exit 3 / missing-state / authorization-undeclared. Closed for reviewed consulted-declaration paths.
F2 task-only work access	Assigned change and task-only proposal both refuse exit 3 / consulted-work-not-readable; proposal identifies original requester context. Taskless positives remain allowed. Closed.
F3 issuer narrowing	Original issuer-denies-work.read case now refuses exit 3 / consulted-work-not-readable, original requester context. Source rechecks the narrowed layers in both scopes. Closed for reviewed narrowing behavior.
F4 revision-collapsed cycles	Original acyclic exact-reference history now returns exit 0 / allowed. A further stale-selection mutation reaches assignment-stale, not a fabricated cycle. Real-cycle and cycle-before-continuity fixtures pass. Closed.
F5 ordering/message priority	Original forward/reversed shape cases both yield shape-enum-mismatch; original message case now yields message-is-not-authority. These witnesses close, but F5 overall remains OPEN via R5-1.
F6 ownership inventory	Both maintained inventories now include UID/GID; maintained and independent before/after tests pass. Closed.

The fixed registry-declaration-missing diagnostic is consistent with the pinned coordinator ruling and the declaration/admission distinction: it is an exit-3 missing-state refusal for a missing consulted external declaration, not the exit-2 ordinary-record reference rule. I independently combined missing declarations with structural missing records, duplicates, invalid typed profiles and unsupported operations: each earlier gate still wins with its specified exit/rule. Registry lookups remain exact in registry/id/revision/digest; no live authority is inferred.

Gate	r5 disposition
A1	Tested positive read/assigned-change text and JSON outputs, goldens, disclaimers and no-effect observations pass.
A2	Missing registration/cross-project selection and privacy/no-fallback fixtures pass.
A3	Reference, ownership, duplicate, history and genuine-cycle detector/CLI tests pass; exact revision fix independently reproduced.
A4	Tested role/policy/task/mission/execution/issuer intersections, path bounds and no-assignment-union cases pass; F1–F3 witnesses corrected.
A5	Strict parser and separate schema/profile oracle pass tested domains; 831 independent typed-LF probes refuse before admission. Unicode/free-text positives remain valid.
A6	Static runtime I/O/import review retained; descriptor, ownership-inclusive inventory and canary checks pass within bounded evidence limits.
A7	Both requester contexts/narrowing checked in source/tests; original selection retained; no allowed reassignment branch. Original F2/F3/message witnesses corrected.
A8	Closed fields, exits 0/2/3/4, escaping and body-free errors pass tested cases. Not satisfied overall: R5-1 violates stable first-failure ordering.
Offline-demo integration prerequisite	Inspector, oracle, checker, config/auth/conductor independently pass. Task/release NOT RUN / DEFERRED, not green.
A9	Not performed. Jason's separate demo acceptance remains required and is not implied by this review.

Prior C1–C5 closures remain supported by r5 identity and rerun tests: corrected demo digest/copy equality; genuine zero-waiver schema comparison plus strict production profile; twelve closed result fields with process exit separate; saved-before versus after comparisons; and required O_RDONLY/O_NOFOLLOW/O_NONBLOCK with FIFO refusal. The calendar platform witness and original LF witnesses remain. No trimming or normalized identity lookup replaces production refusal.

4. Executed commands and independent receipts

Commands were inspected before execution. From the isolated export, using env -i, synthetic HOME/TMPDIR, PYTHONDONTWRITEBYTECODE=1, NO_COLOR=1 and PATH /home/jwoltje/.pyenv/versions/3.12.8/bin:/usr/bin:/bin:

Command	Exit and actual result
node --test scripts/foundation/	0; 77 pass, 0 fail, 0 skipped
bash scripts/test-foundation.sh	0; 43 pass, 0 fail, including scratch-only fixture regeneration equality
python3 scripts/foundation/verify-schema.py	0; 1563 records, 539 agree-valid / 987 agree-invalid / 0 disagreements; 27 parser-bound unassessed, 10 unsupported-kind unassessed; 509 profile-valid / 30 profile-invalid; 73 named probes verified
python3 docs/plans/foundation-v1-candidate/check.py	0; all pinned author checks pass, including 38 record shapes, 16 paths, 7 restricted fingerprints, 155 runtime/artifact shapes and 35 synthetic model cases; not runtime enforcement

Measured versions: Node v26.8.1, Python 3.12.8, jsonschema 4.26.0. The year-999 strftime('%Y') witness is 999, as required by the pinned checker on this platform.

Non-live integration ran via python3 integration.py in the separate disposable <evidence>/integration-fixture copy. It seeded a disposable test Git repository so the conductor suite could clone/commit/reset only its own test fixtures. Git system/global configuration was disabled, HOME/TMPDIR synthetic, and no shared Git mutation occurred. Commands bash scripts/test-config.sh, bash scripts/test-auth.sh and bash scripts/test-conductor.sh each exited 0, respectively 24/0, 15/0, 17/0 passed/failed. Auth inputs were fabricated test canaries, never real credentials. Failing guards for docker/podman/curl/wget/ssh were installed ahead of PATH and were never invoked; they did not simulate services or supply passing branch results.

Additional independent harnesses, all under the evidence root:

• python3 review-probes.py: exit 0 verifies the nine corrected original witnesses, six remaining Unicode ordering counterexamples, and four stable ASCII control pairs (29 CLI executions). Exit 0 here means the recorded findings were reproduced, not that the candidate passes the counterexamples.
• python3 interactions.py: exit 0; eight independently constructed stage-order, message/issuer, history/currentness and Unicode-positive interactions pass.
• python3 profile-probes.py: exit 0; 831 typed-identity single-final-LF mutations produce exit 2 / profile-pattern-mismatch with selection/operation/proposal/diagnostic all null; a multiline mission objective remains allowed.
• python3 non-effect.py: exit 0; 15 text/JSON/parser/I/O/usage executions, 16 unchanged inventory entries including path/type/size/mode/UID/GID/inode/mtime-ns/ content-or-symlink-target; observed fixture/home/cwd/data roots separate from logs.
• python3 recheck.py: exit 0; final shared/export candidate identities and HEAD pass.

Selected hashes, relative to the evidence root:

Artifact	SHA-256
node-tests.log	9cf6f45864e50b7c81e50c31e88d76bf41e6c046d54284205ea21f14f2bc7654
selftest.log	a9eacfc0f8679cd0a6688d2dd3f705528f5b0c1299cf822e61e7be33f578af1e
oracle.log	7bffe6dc27383ee65d2a6b39443aafccab24d2e9247982de2719d29411d929fb
integration-receipts.json	9f576d011b598fab9ac03c56ee68bf0d1ba5eba902d15a22a4742ebe06e8afcb
review-probe-receipts.json	4c46cd6ebd0fc6cb560172e9364f9a6e34a8182b1b869c58ab70f3b76de9ba91
review-probes.py	aa8132dd0a32878d3c94e0475bd34a2348d452af33538ee990a81283f53af107
profile-probe-receipts.json	6c067bcd6c4d88482b410e4e91f228ae5ef293156670b32c13d88544bcba463a
interaction-receipts.json	3e27aee6492ee121f88f28cc00e20af0f2c63d086772210a3030d054784301c6
inventory-before.json and inventory-after.json (identical)	5a4feeb061565506317b81dcc3af9bda310674bf0b8aa6ad0972286771ceda59
recheck.log	edad63227d0c0f7ef8fc08869334fd19dc8a2f0e5a1dba5298b4e907367775ed

Scratch is local/disposable evidence, not a durable repository receipt. The minimal recipes and frozen demo identity above permit reconstruction without modifying shared fixtures.

5. Deferred coverage, limits and handoff

scripts/test-task.sh and scripts/test-release.sh: NOT RUN / DEFERRED under Jason's 2026-09-07 offline-demo decision. They are not passed, skipped-as-green or fully covered. Full deployment/integration testing remains a later gate before dependent live runtime work. The recorded correction that r3 ran live branches stands; the new decision neither retroactively authorizes nor relabels that history. No such branches were executed in this review.

Finite tests and inventories are not OS containment, proof of no reads, full schema or Unicode equivalence, authentic delegation, crash safety, same-size-race defense or parent-path containment. Only Node v26.8.1 was executed. No installation, provider/engine/container/network/native/sync/live-data work or investigation of the operator's actual credentials/HOME/~/.mosaic occurred. Git mutations were confined to the explicitly authorized disposable conductor fixtures. No shared index, implementation, fixture, charter, prior verdict, log or CURRENT changes; this verdict is the only repository write for FI-FILBERT-7.

Return to darkwing: reconcile R5-1/F5, authorize Rocko alone to correct owned code if appropriate, then provide a newly hashed frozen candidate for re-review. The offline-demo code gate is NOT APPROVED. No automatic implementation, owner acceptance, demo completion, push, issue closure or dependent phase advance; no deadline or timer is set.