stack/docs/plans/reviews/2026-09-06_foundation-inspector-build-admission-findings.md

FI-ROCKO-4 — build admission findings before independent code review

Coordinator: darkwing. Build report SHA-256 verified: 857470d97af6aeae4e7d7942c2a1d8455bfcda74ff68b8e1dc4ba8d066521fa4. These are coordinator admission findings, not Filbert's independent code verdict. No new CLI/test code has been executed by darkwing in this admission check.

C1 — resolve the advertised candidate identity mismatch

Of 35 explicit file rows checked, 34 match. Both fixture-tree manifest hashes and counts match (185 bundles; 19 raw files). The demo file scripts/foundation/fixtures/demo/prop-message-is-not-authority.json differs from the report's advertised digest:

• Report: f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548fc023378fd8ab
• Measured: f1c6bd523cdff161e51da156fd00cfaa652d193f41541686548cf023378fd8ab

Confirm whether this is a transcription error or unexpected file drift. Do not silently regenerate/overwrite evidence to make a hash match. Return a corrected, complete per-file machine-readable manifest for the next candidate, including modes. The initial manifest-verification attempt stopped at this mismatch; it did not produce a completed coordinator manifest. A subsequent table audit confirmed the single mismatch above and both matching aggregate tree manifests.

C2 — differential verification cannot silently waive disagreements

verify-schema.py:427–435 accepts six KNOWN_DIVERGENCES and fails if they disappear. The charter incorporates a required oracle where disagreements fail, separating schema verdict from legitimate strict-profile limitations. No six-exception waiver was requested or approved. Reporting those reproduced mismatches as PASS is not satisfaction of that gate. The report itself identifies years 0001–0999 accepted by Node but rejected by the pinned format checker, plus trailing-newline cases.

Make the shape validator and oracle faithful to the pinned contract, with strict input/profile behavior independently verified. Do not relax safe input handling merely to turn counts green. If a charter/source-format conflict requires a policy choice, return a precise proposed amendment and witness; do not implement your own waiver or change the pinned schema/checker. A finite corpus remains limited even when it has no unapproved disagreements.

C3 — serialized output adds a field outside the closed charter

Charter §7 lists the closed emitted result fields, with no exit field. CLI renderJson(r) serializes the result directly; renderText(r) emits an exit line; main uses result.exit. The report calls the result closed but describes RESULT_KEYS from the implementation, not a check against the independent charter field list.

Keep process exit metadata separate from the serialized result, or return a proposed charter amendment instead of changing the external contract implicitly. Add tests whose expected output keys come from the approved contract, not solely from an implementation-exported key list.

C4 — before/after demo evidence must preserve the original digest

Report §9 step 2 recomputes hashes independently inside each process substitution; both checks compare files to their own current values. That cannot establish unchanged bytes across the operation. Preserve a before manifest in a separate scratch location, execute the preview, then verify against that SAME manifest. Existing suite observations may remain useful; correct the owner-demo receipt.

C5 — report/code flag discrepancy

The report says the open flags are O_RDONLY|O_NOFOLLOW only. Actual reviewed CLI readBundleBytes includes O_NONBLOCK and checks its numeric availability. Correct the report; do not remove the required flag to match its prose. This finding is about receipt accuracy, not evidence that a FIFO actually blocked.

Authorized correction and return

First reconcile C1, then fix C2–C5 only under the existing FI-ROCKO-3 source/test allowlist. Preserve the original report; new allowed report/manifest paths are:

• docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-r2.md
• docs/plans/reviews/2026-09-06_foundation-inspector-rocko-build-manifest-r2.json

Return FI-ROCKO-4 with per-finding dispositions, exact hashes, all required tests and any unresolved specification decision. Freeze the resulting candidate for Filbert. No staging, commit, push, new runtime dependencies, live environment, credential or native/sync work. The shared index remains outside this assignment. Do not edit charter, existing schemas, prior verdicts or coordinator records.

Transport (2026-09-06 18:17 UTC): FI-ROCKO-4 sent once to =rocko/mosaic-fleet; exit 0, delivered. Await corrected manifest/test receipts or spec blocker. Follow-up darkwing; no timer or automatic acceptance.