stack/docs/plans/reviews/2026-09-06_foundation-map-filbert-verdict.md

# FM-FILBERT-1 — independent written-map verdict

Reviewer: filbert. Follow-up owner: darkwing. Date: 2026-09-06.

## Admission and verdict

**APPROVED for the bounded written technical map at the exact identities below.**
No blocking technical-map defect found. This is not full Archify acceptance,
owner acceptance, phase advancement, an implementation charter, or a runtime verdict.

I did not author/co-author this candidate in my available session history. My
current instructions contain no competing personal owner-authorized assignment.
FM-FILBERT-1-C1 resolved my earlier mistaken use of the source baseline's historical
CURRENT.md as current task authority. That admission blocker and the resulting
incomplete NOT APPROVED are superseded by this completed review, not erased.
Mapping-commit CURRENT.md:8-25 records the later review gate; Jason's separately
communicated authorization admits only this bounded review.

- Mapping commit: `7345f330fc6bfae5aa1d896c78cfb7cbe62efbae`
- Source/plan baseline: `d4696d09eb1b5dcf1028f30db2cd63735f51cb16`
- Foundation parent: `44f257cb06484feda3412d9382e3587393796353`
- Map: `docs/plans/2026-09-06_foundation-technical-map.md`
  SHA-256 `772f9e61cb9fb7a31ce8187b12cdf1c4a5fb714ad517a9c12928901171a37db1`
- Handoff: `docs/plans/2026-09-06_foundation-map-handoff.md`
  SHA-256 `1fd1a89f982a31bb9db21b852df78be954323aa1668ab9752be34de853ee4999`

Both document hashes matched independent computation from `git show`. All 69
handoff input hashes matched the source baseline. The mapping commit's parent is
the source baseline, whose parent is the foundation parent. The mapping commit
changes only map, handoff and CURRENT. All nine inspected legacy source files
are byte-identical to 69d1bb3 and to the isolated baseline export.

## Numbered findings and limits

1. **Informational / confirmed — legacy launch is not managed admission.**
   Locations: map launch/mount/context trace tables; baseline `compose.yaml:38-43`,
   `scripts/agent.sh:121-138,181-199`, `src/run-agent.sh:37-41`,
   `src/load-contracts.sh:40-41,68-97`, `adapters/pi/adapter.sh:29-44,81-96`.
   Evidence: broad writable data-root mount, shared SOUL/mission/prompt destinations,
   fixed `.partial`, blanket user Markdown discovery, directory-nonempty continuation,
   and native/print invocation are present. These support the proposed replacement
   boundaries; a named workspace is not isolation. Required correction: none.
   Limit: no race reproduction, engine discovery measurement or containment test.

2. **Informational / confirmed — evidence and lifecycle reuse is correctly narrow.**
   Locations: map evidence/lifecycle tables and ordering constraints; baseline
   `scripts/mosaic-task.mjs:295-302,442-466,548-641`, `scripts/reset.sh:16-48`.
   Evidence: exclusive-create writes lack fsync in the helper; retry starts a new
   run without reconciliation; prune deletes before appending its receipt and
   treats directory-read exceptions as an empty inventory; reset lacks foundation
   claim/reference protection. Map preserves useful conventions without calling
   them crash durability or recovery. Required correction: none. Limit: static
   ordering inspection is not a measured crash/failure-injection result.

3. **Informational / confirmed — policy, packaging and process privilege remain distinct.**
   Locations: map component/placement matrices and integrated ownership section;
   baseline ROADMAP:127-166, #55 layout plan, candidate README sections 2-3/6,
   RUNTIME sections 1/4/7. Pure calculation belongs to proposed packages/config;
   publication and process authority do not. CLI presentation does not own policy.
   Runtime/adapter logic has one proposed packages/agent owner, with only unavoidable
   retained src shims. Current extensions/** and generated .pi installation do not
   replace the future packages/* decision. A shared package is explicitly not a
   shared process privilege grant. Required correction: none. #55's historical
   native-test/reviewer receipts were read as reports, not independently rerun or
   recertified here; Dewey's current work is excluded.

4. **Informational / confirmed with implementation limits — the inspector is appropriately bounded.**
   Locations: map recommended-increment section and cross-lane scenario; candidate
   REVIEW first-increment proposal, README sections 2-3/8, RUNTIME sections 2/5.
   Coherent synthetic graph, explicit selection, required policy refusal,
   least-privilege intersection, no assignment-union grants, deterministic preview,
   no live writes and owner test gate are stated. The cross-lane case preserves the
   original assignment unless a properly authorized, recorded change within owner
   intent is reconciled. A message does not itself confer delegation or acceptance.
   Required correction: none for this recommendation. A later charter must specify
   executable graph/operation inputs and tests for those rules; the current small
   model is not a real graph resolver, authenticator or reassignment implementation.

5. **Informational / review limit — source flags and reported external behavior are not runtime proof.**
   Locations: map adapter row, authority/coordination history and owner-reported
   cross-lane scenario; handoff collaboration section. I confirm adapter flags and
   command construction, not the pinned engine's complete discovery, exact-session,
   fork-preservation or security behavior. Future reuse remains conditional on the
   admission tests already required by the plan. Collaboration delivery, native
   acceptance and the separate-environment incident are reported context, not
   independently observed facts in this review. Required correction: none; preserve
   those qualifications in downstream maps and charters. No external incident
   diagnosis or investigation was performed.

## Request-item dispositions

| Item | Disposition | Independent basis |
|---|---|---|
| 1. Source/plan boundaries, hops, reuse and gaps | Confirmed at the written map's explicitly limited inventory level | All direct source-locator rows opened in the committed baseline; dispositions below. New responsibilities are proposals, not repository-wide absence claims. |
| 2. R1-R34 meaning | Confirmed as responsibility mapping, not a replacement specification | Each requirement checked against the foundation table, owner interview and accepted phase-2 rules; per-R dispositions below. |
| 3. Policy/effects, package/process, source/install, single owners | Confirmed | Placement matrix and integrated qualifications agree with ROADMAP, #55 and RUNTIME trust boundaries. |
| 4. Synthetic inspector | Confirmed as a recommendation | Seven core acceptance cases plus cross-lane case preserve the no-live-grants boundary; execution and enforcement unimplemented. |
| 5. Identity/commit distinction | Confirmed mechanically | Exact map/handoff hashes, 69 input hashes, both parent links and nine legacy identities verified. |
| 6. Independent checks | Passed within stated limits | Contract checker, config suite, syntax and mapping whitespace checks below; no native/synchronization/security suites claimed. |

## Direct source-row dispositions

Every row is **confirmed as a static source finding and justified reuse/change
recommendation**, subject to findings 1-5. No row is certified as external runtime
behavior. Paths/lines here resolve at d4696d09.

| Map source row | Verified meaning / disposition |
|---|---|
| agent.sh:78-130 | Reads seat defaults, copies canonical SOUL to shared agent path, conditionally writes seat record. Reuse identity concept; change snapshot materialization. |
| agent.sh:132-170 | Global agent session default and role-tool narrowing. Replace scoped selection; retain narrowing principle only. |
| agent.sh:181-199 | Shared mission copy, name-default workspace, Compose TUI launch. Change orchestration and inputs. |
| adapter.sh:23-50 | cwd, fork/persistent/ephemeral flags and nonempty-directory `-c`; explicit tools/no-tools. Exact scoped binding remains new. |
| adapter.sh:63-96 | Native/print modes and explicit suppression/provider/model/prompt arguments. New mediated gateway remains required; engine behavior not exercised. |
| mosaic-task.mjs:252-273,670-676 | Closed role keys, filename identity, known unique tools, network enum and emitted metadata. Not network enforcement or scope RBAC. |
| mosaic-task.mjs:362-378 | Requested task tools intersect mission tools when both exist; empty intersection is tool-free. Absent task tools can inherit mission tools: this is narrower legacy semantics, not the new full policy resolver. |
| mosaic-task.mjs:295-325 | Exclusive-create snapshots/helper, no fsync in helper. Reuse intent, replace durable publisher. |
| mosaic-task.mjs:442-466 | Final response/provenance/process result fields, followed by writeOnce. Not invocation-level managed audit. |
| compose.yaml:38-43 | Writable whole-root mount and separate read-only auth mount. New managed isolation/credential boundary needed. |
| run-agent.sh:20-41 | Adapter path checks and shared generated prompt before dispatch. Retain dispatch validation, change context publication. |
| load-contracts.sh:18-58 | Required governance sources, optional seat SOUL and fixed staging file. Snapshot/publication changes warranted. |
| load-contracts.sh:68-77,81-98 | Blanket user Markdown selection precedes mission, contrary to header order. Replace discovery with authorized classified selection. |
| reset.sh:16-48 | Configured target, symlink/realpath/marker checks, recursive delete; no claim/reference/receipt integration. |
| mosaic-task.mjs:548-595 | Retry redirects relative mission references to snapshot and replays as a new run. Not uncertainty recovery. |
| mosaic-task.mjs:598-641 | Count-based preview/apply, caught directory errors, delete then receipt. Protected retention requires changes. |
| mosaic-config.mjs:39-61,76-174 | MOSAIC_CONFIG override, strict shape/file/root validation and lstat errors treated as missing. Sole-config reconciliation is explicitly required, not silently approved. |
| mosaic-config.mjs:194-239 | Exclusive bootstrap creation, existing-config validation and quoted env output. Synthetic inspector must not invoke bootstrap/live resolution. |
| auth.sh:19-96 | Config-backed account reporting; status parses credential JSON and parser diagnostics. Static source read only; no redaction guarantee or credential read performed by reviewer. |
| agent.sh:28-64 | Named auth account refusal checks and mount-source export; no project-selection parser. Future #50 binding must replace flat selection. |

The nine files were read completely. Plan inputs read: foundation requirements,
workspace/schema interview, phase-2 contract, candidate README/REVIEW/RUNTIME,
ROADMAP, #55 layout, #54 native-development plan and #50 auth/provider registry.
Also read candidate check.py and semantic-model.py, extension/.pi READMEs,
Containerfile and adapter contract. The 69-entry identity audit is a byte audit,
not a claim of independent line-by-line review of every extension/schema fixture.
The schema/fixture inventory was additionally consumed by the author checker.

## R1-R34 semantic dispositions

C = confirmed responsibility allocation and planned gap, not implemented behavior.
The map's concise index is read with its named accepted-plan input; it does not
need to restate every normative clause to be a faithful responsibility map.

| Requirement | Disposition and meaning checked |
|---|---|
| R1 | C — reusable definition retained; execution-specific identity binding changes. |
| R2 | C — project registration and bounded delegation require new resolver, not tool names. |
| R3 | C — exactly one project parent, explicit workspace membership; dependencies do not grant access. |
| R4 | C — one identity across scopes with distinct scoped sessions, replacing global default. |
| R5 | C — explicit agent/project/workspace selection, not cwd or seat-name inference. |
| R6 | C — reusable instructions, selected scoped work context and authorized snapshots. |
| R7 | C — exact Resume/Fresh/genuine-first-use distinction; damaged history is not first use. |
| R8 | C — assignment-only Abandon and explicit authorized prerequisite/selection transitions. |
| R9 | C — authorized human/service launch and recovery from checked work records. |
| R10 | C — claim key is scoped, not session-only; tuning/budgets/scaling are not implemented by the map. |
| R11 | C — shared client operations/work truth; no separate interface task list. |
| R12 | C — explicit scoped messaging, no identity-based conversation mixing; cross-lane text is not authority. |
| R13 | C — whole-root mount is not containment; actual enforcement remains a proof gate. |
| R14 | C — legacy provenance is useful but lacks trusted classified per-action evidence. |
| R15 | C — owner phase/user-test gates retained; independent written approval is not owner acceptance. |
| R16 | C — canonical SOUL retained, current approved launch revision snapshotted; no silent live reload. |
| R17 | C — comparable base hash and cross-interface notices are new, distinct from full launch identity. |
| R18 | C — single-owner mission/parent graph and exact references, not duplicated project truth. |
| R19 | C — bounded within-plan decomposition and authorized non-author acceptance; coordinator title is insufficient. |
| R20 | C — taskless permitted read/chat is distinct from recorded assigned changes. |
| R21 | C — active conflict plus explicitly authorized connection, not automatic attach/replacement. |
| R22 | C — transcript visibility/handoff is separate from work-record read and automatic context loading. |
| R23 | C — revoke affected scope, stop/fence and reconcile effects; independent other-scope authority survives. |
| R24 | C — one controller, separately authorized observers and explicit generation-fenced transfer. |
| R25 | C — controlled Fresh replacement requires stopping/safety evidence, not timeout/idle alone. |
| R26 | C — non-destructive authorized investigation, no blind replay or invented success. |
| R27 | C — audit failure closes affected admission; preauthorized fail-safe stop is not unaudited recovery. |
| R28 | C — classified relevant user context replaces blanket global Markdown discovery. |
| R29 | C — retirement/reopen preserves evidence, distinct from deletion and protected retention. |
| R30 | C — reviewed legacy adoption preserves originals; no inferred membership. |
| R31 | C — current approved intent pauses affected work for reconciliation; messages cannot silently retask it. |
| R32 | C — standard nonhierarchical scope roles narrow reviewed ceilings, not redefine identity. |
| R33 | C — invocation evidence plus actually enforced limits; no claim to enumerate every internal effect. |
| R34 | C — Mosaic-controlled client with Pi behind the single reviewed adapter; no native parity waiver of safety. |

Owner-intent/reassignment was checked particularly against R8/R19/R23/R31/R32,
README reference/permission/lifecycle rules and RUNTIME assignment/message rules.
Independent acceptance uses actual author provenance and current reviewer authority,
not a fresh session of the same author or a message saying approved. The small
synthetic model cannot prove that enforcement; the map does not claim it does.

## Independent test receipts

Measured 2026-09-06 around 08:01 UTC. Isolated source export:
`/tmp/fm-filbert-1.6Acnih`, created with
`git archive d4696d09eb1b5dcf1028f30db2cd63735f51cb16 | tar -x -C <export>`.
No shared-tree checkout/reset, dependency install or live runtime was used.

1. Python/subprocess `git show <commit>:<path>` plus `hashlib.sha256`:
   both candidate hashes matched; 69/69 inventory matched; 9/9 legacy files matched
   69d1bb3 and the export. `git rev-list --parents -n 1` confirmed both parent links.
2. From export, with clean environment, temporary HOME and bytecode writes disabled:
   `/home/jwoltje/.pyenv/versions/3.12.8/bin/python3 docs/plans/foundation-v1-candidate/check.py`.
   **Exit 0:** 38 command shapes, 38 record shapes, 16 paths, 7 restricted-domain hash
   vectors, 155 runtime/artifact shapes, 35 synthetic model cases; 5+5 deliberately
   shape-valid semantic forgeries remain shape-valid. Python 3.12.8/jsonschema 4.26.0.
   Initial attempt using `env -i PATH=/usr/bin:/bin ... python3` failed exit 1 because
   that interpreter lacked jsonschema. No dependency was installed; the existing
   explicit interpreter above supplied the documented dependency for the successful run.
3. From export: `env -i PATH=/usr/bin:/bin HOME=/tmp/fm-filbert-1.6Acnih-review-home bash scripts/test-config.sh`.
   **Exit 0: 24 passed, 0 failed.** Suite uses its own temporary synthetic config/data.
4. `bash -n` for scripts/agent.sh, auth.sh, reset.sh; `sh -n` for
   adapters/pi/adapter.sh, src/run-agent.sh, src/load-contracts.sh;
   `node --check` for scripts/mosaic-config.mjs and scripts/mosaic-task.mjs.
   **All exit 0.** Observed default Node v26.8.1; syntax checking is not pinned-runtime testing.
5. `git diff-tree --check 7345f330^ 7345f330`: **exit 0**.

No test-task full suite, release/conductor/auth runtime suites, verify.sh, Docker,
native extension, sync/package, renderer, browser, process-stopping, sandbox,
credential separation, crash-durability or full JCS/Unicode enforcement tests ran.
In particular the author checker is independently executed author test code, not
an independent implementation of its validator and not proof of real authorization.
No architecture JSON/HTML, render receipt or visual preview was supplied or accepted.

Only this offered verdict path was written in the repository. No shared logs,
CURRENT, source, policies, installations, commits or pushes were changed. No
credential contents, live worker state or separate ~/.mosaic environment were read.
No implementation or automatic next increment is authorized by this verdict.