stack/docs/plans/reviews/2026-09-07_foundation-inspector-code-verdict-r6.md

FI-FILBERT-8 — r6 independent CODE verdict: APPROVED

APPROVED for the bounded offline-demo code gate only. Reviewer: filbert. Sole implementation author: rocko. Coordinator/follow-up: darkwing. Date: 2026-09-07. No competing assignment is known; I have not authored or fixed the implementation. Owner A9/demo acceptance remains a separate subsequent gate.

R5-1 is closed: all six exact prior Unicode witness pairs now have stable first failures. Independent broader-domain and interaction checks support the correction. No blocking inspector-code finding remains in this review. Two nonblocking qualifications below correct the byte-identity claim and preserve an auxiliary native-parser observation without mislabeling it as a passing check.

1. Exact reviewed identities and source boundary

Input	SHA-256 / commit
docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-manifest-r6.json	a4a4493000aff5905337a643886ca36e7c5377d52deed77b8aeab7174ca73dcf
docs/plans/reviews/2026-09-07_foundation-inspector-rocko-build-r6.md	ee0e83efd7c71eddecf5e26f939e9a34ba85b184cfcd1cffac9ff9e56ea13c37
Charter candidate 3	19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6
Incorporated feasibility r2 §§5–13, subject to charter overrides	f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1
Pattern/profile addendum	afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5
Pinned record schema	05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6
Pinned checker	82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607
Owner offline-demo test-gate decision	62cea74bea59e69f29c8a29a9c0311fdc6feffa2c337bc6a141db55149204898
Preserved r5 NOT APPROVED verdict	154e7b5d804c059d6fec4c936c78e4ae33bb7fc273ba3a5eec7b00d0a9ce1e59
Source/schema baseline	d4696d09eb1b5dcf1028f30db2cd63735f51cb16
Measured integration HEAD	9a5fbdbda74b16adf488fe28138b2ba69ea5e669

Independently verified before execution and rechecked at 2026-09-07T15:48:19Z: 382 distinct regular candidate files, exact allowlist/no extras, sizes, modes, SHA-256s, all six aggregates, report/manifest hashes and every pinned input. Both shared candidate and exported copies pass. HEAD remains unchanged. This uncommitted code is bound by the manifest, not falsely claimed to be committed at that HEAD.

Export: /tmp/fi-filbert-8.ehrv19oo. Separate harness/evidence: /tmp/fi-filbert-8.ehrv19oo-evidence. Compared with r5: five candidate files changed, thirteen fixtures added, none removed. The CLI, strict parser, mock canonicalizer, oracle and other unchanged implementation paths retain their verified prior identities; changed source/tests/generator were inspected before execution.

The working-tree scripts/agent.sh and docs/TOOLS.md modifications were excluded. Required integration dependencies were exported from the committed baseline. The relevant agent/common/auth/config/conductor scripts, three authorized legacy tests, package/RELEASE/policy/README dependencies have no committed difference between that baseline and measured HEAD. Approval does not cover unrelated working-tree or native/fleet/goal changes, nor a deployment of the entire current working tree.

2. Findings and dispositions

1. R5-1 / F5 — CLOSED: total ordering tie-break

Frozen scripts/foundation/resolve.mjs SHA-256: c4951014828080caf9a5038845104afdac02465af10e94a2fddd3558b29621a3. orderingForm at approximately lines 730–739 replaces the partial ASCII canonicalizer in stableOrder's tie-break at approximately 755–770.

Over the actual strict-parser domain, it preserves scalar distinctions, Unicode strings, array order and object members while sorting object keys by UTF-16 code unit. Safe integer bounds, paired surrogates, dense arrays and bounded acyclic objects are supplied by the parser; arbitrary JavaScript objects/nonfinite numbers/getters are not claimed as supported inputs to this helper. The former exception-to-empty- string collapse is gone. No normalization, case folding or new Unicode ban appears. The ordering form is internal, not a digest or emitted record body.

I reran the exact twelve prior Unicode witness files, checking their input hashes against the prior review receipts. All four unkeyed-family pairs now return exit 2 / shape-type-mismatch; both equal-key pairs return exit 2 / shape-unknown-field in both orders. The four prior ASCII control pairs also remain stable.

Independent extension beyond writer examples:

• 2,540 strict-parser values, including safe-integer extrema, all JSON types, NFC/NFD/case distinctions, BMP/non-BMP strings and keys, escaped controls, prototype- named keys, numeric-looking keys, maximum-length strings, 1024-member arrays/objects and depth-32 structures. Forms matched an independently implemented Python UTF-16-key-sorted reference for every value; 1,663 distinct structural values/forms had no collisions. Strict-parser round trips and input immutability passed.
• 120 evaluations: all 24 permutations of four further malformed entries in each of the five inventory families; emitted first outcomes remained stable.
• Ten additional equal-key malformed-record pairs / twenty CLI runs spanning Unicode and escaped control display names. Competing enum/missing-field failures matched the first entry independently predicted by Python's ordering reference; all pre-admission nulls remained intact.

These are finite compatibility/regression measurements, not exhaustive proof.

2. NONBLOCKING — “byte-identical” should say structurally equal parsed values

The report §§2.2/3(a), stableOrder comment and test wording overstate the final index fallback. For example, raw {"é":1,"a":2} and {"a":2,"\u00e9":1} have different bytes and insertion orders but the same ordering form. I independently asserted this distinction and the index tie.

That is correct for JSON object structural equality: member order, whitespace and escape spelling do not create different values. Array order and distinct string values remain significant. Thus this is a prose qualification, not a reopened code ordering defect. Future reports/comments should use “structurally equal parsed values,” not claim byte identity or general JCS conformance. No file was fixed here.

3. NONBLOCKING, scoped verification observation — native JSON.parse round trips

An auxiliary warm-run test initially failed a native JSON.parse/deep-equality round-trip comparison. With all anomalies retained, 19 of the 2,540 comparisons showed native reparse discrepancies involving object keys. For the initial case, Python confirmed the raw input, strict-parser serialization and ordering form were structurally equal; a separate cold native probe did not reproduce that discrepancy. The full rerun independently verified every ordering form against Python, and strict-parser round trips passed. Detailed raw/form/native-reparse evidence is saved in domain-native-disagreements.json; underlying native-runtime cause is not claimed as diagnosed or fixed.

This is not relabeled as a passing native-parser test or a waived schema mismatch. The required pinned record oracle was unmodified and independently reported zero schema disagreements. Production inspector/strict-parser/resolver/canonicalizer paths do not call native JSON.parse; their inspected parsing path uses parseStrict. The observed auxiliary native-reparse behavior therefore does not demonstrate an inspector-code defect or invalidate the independent form/reference comparison. Approval remains limited to the tested offline inspector, not general native JSON parsing, the platform or a live runtime. Preserve this evidence for separately scoped follow-up rather than asserting universal parser equivalence.

3. Retained original findings and A1–A8

The original nine F1–F5 witness inputs were also rerun unchanged. Actual outcomes:

Finding	r6 disposition
F1 declarations	Missing agent registry declarations: exit 3 / missing-state / registry-declaration-missing. Undeclared dependency authorization: exit 3 / missing-state / authorization-undeclared. Closed.
F2 work.read	Assigned task-only change and task-only proposal refuse consulted-work-not-readable; taskless positives preserved. Closed.
F3 issuer narrowing	Original issuer-denies-work.read witness refuses consulted-work-not-readable in original requester context; both narrowed contexts remain checked. Closed.
F4 exact-revision cycles	Original acyclic history allowed; stale selection subsequently reaches assignment-stale. Genuine-cycle/precedence fixtures pass. Closed.
F5 ordering/message	Original shape-order pair and message priority corrected; all R5-1 pairs now corrected with broader coverage above. Closed, subject to structural-equality wording qualification.
F6 ownership evidence	Maintained UID/GID checks and independent ownership-inclusive inventories pass. Closed.

The new fixed registry-declaration-missing diagnostic retains the reviewed admission- stage exit-3 missing-state semantics. Eight independently rerun interactions preserve structural/duplicate/profile/unsupported-operation precedence ahead of missing external declarations, message priority, history/currentness and Unicode positives.

Acceptance group	Independent disposition within tested scope
A1	Positive read/assigned-change previews, exact text/JSON goldens, disclaimers and bounded no-effects checks pass.
A2	Missing registration/cross-project selection refusals, no fallback and body-free privacy checks pass.
A3	Reference, duplicate, ownership, continuity and revision-exact cycle tests pass; detector and CLI precedence remain distinct.
A4	Mandatory and optional policy layers, role/issuer/task/mission/execution narrowing, paths and no-assignment union tests pass; original F1–F3 witnesses corrected.
A5	Parser/format/bounds negatives, zero-waiver record oracle, strict production identity profile and permitted Unicode/free-text controls pass tested domains.
A6	Static I/O/import limits, descriptor tests, canaries and unchanged ownership-inclusive inventories pass; no containment/no-reads proof claimed.
A7	Both requester contexts, issuer rechecks, original-selection retention and negative/unresolved-only reassignment tests pass; no allowed reassignment branch.
A8	Closed output/exit classes, escaped diagnostics, pre-admission nulls and stable first-failure tests pass, with equality wording and auxiliary native-parser limits above.

C1–C5 remain closed for the reviewed candidate: corrected demo identity/copy equality; genuine pinned schema agreement plus separate production profile; exactly twelve serialized fields and process exit separate; saved-before versus after inventories; required O_RDONLY/O_NOFOLLOW/O_NONBLOCK and FIFO refusal. No O_CLOEXEC, authentic permission, runtime reconciliation or complete schema-equivalence claim is added.

4. Actual commands, results and evidence

Commands inspected first; all candidate executions used the isolated export. Measured versions: Node v26.8.1, Python 3.12.8, jsonschema 4.26.0. The pinned year-999 strftime('%Y') witness remains 999.

From the export, with env -i, synthetic HOME/TMPDIR, PYTHONDONTWRITEBYTECODE=1, NO_COLOR=1, and PATH /home/jwoltje/.pyenv/versions/3.12.8/bin:/usr/bin:/bin:

Command	Actual result
node --test scripts/foundation/	Exit 0; 80 passed, 0 failed, 0 skipped
bash scripts/test-foundation.sh	Exit 0; 43 passed, 0 failed; fixture regeneration only in disposable scratch
python3 scripts/foundation/verify-schema.py	Exit 0; 1568 records; 540 agree-valid, 991 agree-invalid, 0 disagreements; 27 parser-bound and 10 unsupported-kind unassessed; 510 profile-valid/30 profile-invalid; 73 named probes verified
python3 docs/plans/foundation-v1-candidate/check.py	Exit 0; all pinned author checks pass, including 38 record shapes, 16 paths, 7 restricted fingerprints, 155 runtime/artifact shapes and 35 synthetic model cases; not runtime enforcement

python3 integration.py independently ran the committed non-live tests in a separate <evidence>/integration-fixture copy: bash scripts/test-config.sh 24/0, bash scripts/test-auth.sh 15/0, bash scripts/test-conductor.sh 17/0 passed/failed, each exit 0. The authorized seed/clone/commit/reset operations occurred only inside disposable conductor test repositories. Git global/system configuration was disabled; HOME/TMPDIR were synthetic. Engine/network-command guards were never invoked and did not substitute simulated successes. Auth data were fabricated test canaries, not actual credentials.

Additional scratch commands and receipts:

• python3 reproduce.py: exit 0; 29 exact prior inputs, covering nine original findings, six Unicode pairs and four ASCII pairs; preserved hashes checked.
• python3 domain-probes.py: initial auxiliary native-round-trip assertion failed; preserved in domain-probes.log. The instrumented rerun, logged separately in domain-probes-rerun.log, exited 0 after recording all native anomalies and independently checking all 2,540 forms with Python and strict-parser round trips. No candidate code or mandatory oracle was changed.
• python3 equal-key-probes.py: twenty final CLI checks pass, exit 0. The first reviewer harness expected type-mismatch for numeric status; the established enum checker emits enum-mismatch. That reviewer expectation was corrected and the original failed log preserved; the candidate was unchanged.
• python3 profile-probes.py: exit 0; 831 typed single-final-LF probes refuse exit 2 / profile-pattern-mismatch with selection/operation/proposal/diagnostic null; multiline objective remains allowed.
• python3 interactions.py: exit 0; eight independent interactions pass.
• python3 non-effect.py: exit 0; fifteen text/JSON/parser/I/O/usage runs; sixteen unchanged path/type/size/mode/UID/GID/inode/mtime-ns/content-or-symlink-target entries. Observed roots and harness output are separate; no synthetic canary output.
• python3 recheck.py: exit 0; final shared/export identities, all pins and HEAD pass.

Selected hashes, relative to /tmp/fi-filbert-8.ehrv19oo-evidence:

Artifact	SHA-256
node-tests.log	ca295bd80df32558d8d75d48c336ca6cc68bc74edb754ca4e5875247f8015c8d
selftest.log	e856f3fd68bcca7442f809e7a53af4aa674fd6483486120d429917688c4216a2
oracle.log	40e7311b1aed62c12aaba4ad4dd9eca3d43b46b2785f1abc4263be9d85e93653
integration-receipts.json	9f576d011b598fab9ac03c56ee68bf0d1ba5eba902d15a22a4742ebe06e8afcb
reproduction-receipts.json	a2677c32068ee62bd4bbdda89f44432252eeabfb6e433c97fccc28ff71d6b258
domain-summary.json	edd9c1f7f03d8c9249bf2c3627cd1c7c706c6cd90aefc24f67da7f655ccaa8cf
domain-native-disagreements.json	395ae878a3edfe481b22511d720d00e20064c5806f44cf95e597e8324fb3a254
equal-key-receipts.json	22f257f9145de8852255a547b14d79115d080f38bfbbcfde30c024c4afeb5ff3
profile-probe-receipts.json	6c067bcd6c4d88482b410e4e91f228ae5ef293156670b32c13d88544bcba463a
inventory-before.json and inventory-after.json (identical)	494f2dbf66a48d3aba5c6731508859b05414c80a52a855708a2859dc5f5df57c
recheck.log	c121172527c5ccb47e4ca6f9d5fb820a1d3580610bba2d34fb61aca9247d3f44

Scratch is local/disposable evidence, not durable repository publication.

5. Deferrals, limits and return

test-task.sh and test-release.sh: NOT RUN / DEFERRED under Jason's offline-demo ruling. They are not green or fully covered. Full deployment/integration testing remains a later gate before dependent live runtime work. The historical correction that r3 ran live branches remains in force; this decision does not retroactively authorize or relabel those actions. No live branches were executed here.

Finite tests/static review/inventories do not prove OS containment, absence of every read, complete schema/native-parser equivalence, authentic delegation, crash safety, parent-path containment or protection against same-size concurrent mutation. Only Node v26.8.1 was executed. Approval covers no generalized JavaScript-call domain outside strict-parser-produced values and no runtime permission engine.

No code fixes/co-authorship, dependency installation, shared staging/index/commit/ checkout/reset/push, provider/engine/container/network/native/sync/live-data work or actual credential/HOME/~/.mosaic investigation occurred. Git mutations were solely the authorized disposable conductor fixtures. This verdict is the only repository write for FI-FILBERT-8; prior evidence and unrelated owner modifications are preserved.

Return to darkwing: APPROVED at the exact r6 manifest for the bounded offline-demo code gate. Carry the nonblocking qualifications and deferred tests into the handoff. Jason's separate A9 acceptance is still required. No automatic demo acceptance, push, issue closure, live/dependent implementation, reassignment, timer or deadline follows.