stack/docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict-r3.md

# FI-FILBERT-3 — independent charter candidate 3 verdict

Reviewer: filbert. Author/integrator and follow-up owner: darkwing.
Contributor: rocko. Date: 2026-09-06.

## Admission and exact verdict

**APPROVED for the written implementation charter at the exact identities below.**
All five FI-FILBERT-2 findings are closed at specification level. No new blocking
charter defect found. Implementation authorization remains Jason's separate gate;
this is neither implementation approval nor runtime/security/owner-demo acceptance.

No competing current personal owner-authorized assignment appeared. I remain a
non-author of the charter and incorporated feasibility note. I reviewed the complete
candidate, its changes from candidate 2, the incorporated rules and their interactions;
Rocko's contribution was not treated as approval of the integrated charter.

Independently verified identities:

| Input | SHA-256 |
|---|---|
| `docs/plans/2026-09-06_foundation-inspector-charter.md`, candidate 3 | `19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6` |
| `docs/plans/reviews/2026-09-06_foundation-inspector-rocko-feasibility-r2.md` | `f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1` |
| Archived `docs/plans/reviews/2026-09-06_foundation-inspector-charter-candidate2.md` | `cbd0487a2ab699722924e2f91367bf556facb015752ce3b5a76ad474977df791` |
| Preserved `docs/plans/reviews/2026-09-06_foundation-inspector-filbert-verdict.md` | `2f3858c81d32b1305cb7fd49b0d8860153d8d592ac62df2c45dd25d30af7a722` |

Map commit: `7345f330fc6bfae5aa1d896c78cfb7cbe62efbae`.
Source/plan baseline: `d4696d09eb1b5dcf1028f30db2cd63735f51cb16`.
Candidate and incorporated note remain frozen uncommitted planning inputs. Sections
10.1–10.5 explicitly override earlier shorthand, including the incorporated note.
The earlier NOT APPROVED remains an accurate historical verdict on candidate 2.

## Per-finding disposition

### 1. CLOSED — registration delegation semantics and issuer limits

Evidence: charter §10.1 supplies the missing ordinary L2/L3 checks: current active
registration, approved current delegation, exact registration scope, exact current
agent/registration subject pair, and explicit missing/stale/rejected/bounds outcomes.
Null delegation is expressly an unverified owner-origin fixture assumption, not an
unrestricted grant. A newer rejected head cannot be bypassed with an old approved
reference. Current consulted policy registries also have an explicit head rule.

The new closed `delegationInputs` wrapper does not mutate accepted records. Its
issuerCeiling and delegated operations narrow, rather than replace, mandatory role,
registration, project/workspace, task/mission and execution restrictions. Required
issuer input and subset checks apply to proposal delegation too; issuer restrictions
additionally narrow both requester contexts. This closes the previous ordinary
registration gap without treating a declaration as authenticated authority.

Independent shape/identity probes confirmed that same-scope approved decisions with
exact agent/registration subjects, and rejected successor decisions plus registration
successors, can be represented by the unchanged candidate schema. In a rejected
decision fixture, delegatedOperations must be empty to reach the intended semantic
rejection rather than fail its earlier schema conditional. This is a fixture detail,
not a new field or authority mechanism.

### 2. CLOSED — per-record ownership and consulted work access

Evidence: §10.2 replaces global selected-project graph interpretation with each
record's own project. It distinguishes structural existence from consulted access.
Unselected P2 task/mission inventory is no longer coerced into the P1 selection.

Consulted work supports only the current workspace or its parent project. Another
workspace/project receives the specified unsupported-capability refusal, even if a
separate registration exists. Thus no extra visibility context, cross-assignment
union or permission borrowing is silently introduced. Supported consulted work
requires work.read in the caller's full applicable intersection in addition to the
requested operation. Dependencies cannot be skipped when their scope is unsupported;
accepted status is required for file.change and proposal requester authority.

The subject and target proposal checks explicitly use original and target requester
contexts respectively. Taskless read does not traverse unrelated work. These are
bounded conservative limitations, consistent with baseline README:57–71,124–136;
they are not a promise to implement all future cross-scope dependency behavior.

### 3. CLOSED — hidden-chain detection claim withdrawn

Evidence: §§5 and 10.3 now expressly deny detection of a chain hidden behind opaque
artifacts, declarations or omitted records. The only wrapper mode is direct-declared.
Unknown parent fields and modes are structural invalid-request failures, not claimed
chain detections. A subject reference to a decision is not invented into a parent
edge. Artifact bodies remain unread and their presence remains unauthenticated.

This resolves the unobservable-predicate defect honestly. A valid direct declaration
can pass synthetic checks without proving absence of chaining. It still cannot
produce an allowed reassignment result: the final proposal branch is unresolved /
unknown-effects / runtime-reconciliation-required.

### 4. CLOSED — graph sub-order and fixture reachability

Evidence: §10.4 orders ordinary structural reference checks, then task/mission/
supersedes cycle checks, then revision continuity and ownership/parent-scope checks.
It also separates admission-time missing declarations from ordinary missing records.
The cycle order is no longer inferred from unordered requirements.

Independent schema probes confirmed a workspace mission self-parent and a revision-2
self-supersedes are shape-valid. Their references can resolve to themselves, allowing
the now-earlier cycle stage to run before parent-scope/continuity rejection. Detector
unit coverage and CLI first-failure coverage remain explicitly distinct. Stable
identity/field ordering, rather than inventory order, governs within-stage traversal.

### 5. CLOSED — differential corpus and platform boundaries

Evidence: §10.5 adds scalar types, null/absence, integer bounds and booleans, 1.0,
object-key-order-insensitive uniqueness, BMP/non-BMP lengths, byte-path limits and
escaped surrogates. Schema and strict input-profile verdicts occupy separate expected
columns; finite-corpus success is explicitly not a complete equivalence proof.

Independent probes confirmed representative distinctions: boolean revision invalid;
1.0 valid as a schema integer; maximum safe revision valid and the next integer
invalid; 128 non-BMP display-name code points valid and 129 invalid; duplicate path
objects invalid despite key-order reversal. A lone surrogate in an unformatted
schema string can be shape-valid while the strict inspector profile must refuse it.
O_RDONLY's zero value is now correctly handled with presence/type checks.

## New interaction findings and limits

1. **Informational / nonblocking — declaration authority remains an assumption.**
   Location: §§3,7,10.1,10.3. An issuerCeiling is caller-supplied synthetic data;
   its addition does not authenticate an issuer or model a real delegation chain.
   The unconditional not-modelled/unverified-simulation output and the no-success
   proposal endpoint preserve that distinction. No correction required. Code review
   must ensure no diagnostic or positive preview upgrades this assumption into a
   real authorization claim.

2. **Informational / nonblocking — added work.read is an intentional additional guard.**
   Location: §§4,5,10.2. An assigned operation permitted by file.change alone must
   still refuse when the context lacks work.read for consulted work. Taskless
   file.read does not acquire an unrelated assignment/mission layer. Proposal
   original/target contexts retain their own assignments and execution limits;
   one context cannot supply another's missing permission. No correction required;
   positive and negative tests must distinguish these cases.

3. **Informational / nonblocking — bounded scope, but substantial validator work.**
   Location: §§6,8,10.1–10.5. The new inventory is capped at 256, graph/profile limits
   remain finite, and no live source lookup, artifact-body loading, chain traversal,
   runtime observer or publication component has been added. This remains feasible
   as an offline increment, not a trivial schema wrapper. The mandatory differential
   oracle, coherent fixtures and independent code review remain necessary. No
   implementation-size or completion-time estimate was measured.

4. **Informational / nonblocking — testability is not implemented enforcement.**
   Location: §§6,8–9. Descriptor flags, byte limits, Unicode handling, immutable
   observed roots, privacy-safe outputs and fail-closed exits are obligations for
   later code/tests. This review did not execute those mechanisms. No correction
   required; do not promote schema probes or constants inspection into a security,
   no-read, complete-mediation or crash-durability receipt.

## Full review-question dispositions

| Area | Disposition |
|---|---|
| Coherence/feasibility/faithfulness | Approved as a bounded written charter; prior substantive gaps are resolved without a runtime implementation or implicit phase advance. |
| Types, subset, history and mandatory layers | Closed wrapper addition, unchanged eight supported record shapes, complete histories versus consulted heads, explicit role/policy/execution ceilings and optional narrowing remain coherent. |
| Requester/subject/target, intent and delegation | Both requester scopes retain full contexts; ordinary/proposal delegation now has explicit bounded synthetic checks; subject selection is preserved; proposal success remains unreachable by specification. |
| Privacy/output/exits/profile | Closed body-free output, safe pre-validation nulls, fixed disclaimers, escaped text, documented refusal exceptions and separate number/Unicode profile remain intact. |
| Filesystem/no-live-effects | Proposed Linux descriptor boundary and its parent-path/concurrent-write/read-observation limitations remain explicit. No unsupported O_CLOEXEC or O_RDONLY truthiness assumption remains. |
| Differential verification/reachability | Mandatory pinned oracle, expanded corpus and explicit cycle precedence are adequate charter requirements; their implementation and actual coverage remain unverified. |
| First slice and owner gates | No implementation, live grants, source moves, package scaffolds, credentials, native integration or runtime security mechanisms added. Jason's build authorization and later demo acceptance remain separate. |

## Independent receipts for this FI-FILBERT-3 cycle

- `sha256sum` verified all four planning/history identities listed above.
- `diff -u <archived-candidate2> <candidate3>` showed the title change, replacement
  of the hidden-chain claim in §5, and addition of normative §10. Exit 1 denotes
  these expected differences, not a failed verification command.
- `git show d4696d09:<path>` read committed schema/checker and relevant accepted
  README rules. Independent hashes again matched:
  - records.schema.json: `05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6`
  - check.py: `82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607`
- Inline Python read committed records fixtures/schema with `git show`, made only
  in-memory synthetic mutations, and ran **14 asserted schema probes: all passed,
  exit 0**, using Python 3.12.8 and existing jsonschema 4.26.0. Four probes covered
  direct delegation/registration and rejected successors, two covered cycle shapes,
  four covered revision type/bounds, two covered non-BMP length, one lone-surrogate
  schema string, and one object-order-independent uniqueItems check. Identity
  assertions also distinguished the old approved reference from the rejected head.
  These are shape/identity witnesses, not a complete coherent bundle or an inspector
  implementation. Custom calendar/path formats were not exercised in this run.
- `node -e` independently observed Node v26.8.1; O_RDONLY=0 with numeric presence,
  O_NOFOLLOW=131072, O_NONBLOCK=2048, and no exposed O_CLOEXEC. No descriptor was
  opened for a filesystem behavior test.

No proposed CLI/differential harness, five repository suites, author checker,
canonicalizer implementation, symlink/FIFO tests, native/sync tests or live runtime
ran in this cycle. Earlier receipts are not relabelled as current execution. No
new dependencies or helper implementation files were installed/written; schema
calculations were inline and in memory. No credential contents or separate
~/.mosaic environment were accessed.

Only this offered verdict path was written in the repository. Candidate, incorporated
note, prior verdict, source, logs, policies, installations and shared index were not
edited. No checkout/reset, commit or push occurred. Follow-up remains darkwing;
this approval does not automatically authorize code or advance the phase.