Preflight explicit read-only Researcher inputs before provider dispatch #689

Problem

A necessary current-source pre-merge review placed complete, checksum-bound public source diffs in a parent-owned data file instead of repeatedly embedding them in a long task. The file existed and matched its declared SHA256 in the Linux parent environment, but the supervised Researcher's inspection returned FileNotFoundError inside its confined process. The root's task text declared the input, but text does not grant a filesystem capability. This was an operator preparation error, not proof that either reviewed implementation was defective.

On source 4a5a711b971fac854c6fdfe23722949aca3c686c, ExternalCommandSpec::with_read_only_input_file and safe-target preflight exist. The supervisor assignment launch does not expose a typed, operator-bound arbitrary Researcher input manifest; its current input binding is used for the generated report schema. Do not infer authority by parsing paths from natural-language tasks or make ambient parent directories visible.

The corrected live run failed closed with complete usage of 195,972 tokens (41,321 Researcher and 154,651 Auditor). All default lenses ran; none inspected the missing source packet. This demonstrates the need to reject an unavailable declared input before a paid dispatch, separate from #633's authentication of command observations and #680's review-lens behavior.

Acceptance

• Provide an explicit operator-authorized, bounded read-only Researcher input contract, either an exact staged snapshot in the approved workspace or typed file capabilities. Bind source identity and content hash to the assignment and receipt; reject missing, changed, symlink-substituted or undeclared inputs.
• Verify input visibility under the actual child containment profile before invoking a provider. On failure return a typed preparation failure with no provider dispatch or invented zero-usage claim.
• Preserve read-only/no-delegation authority, network and credential confinement, exact path limits and all existing command-evidence/independent-review gates. A prose path never becomes a mount authorization.
• Cover successful input inspection plus missing/invisible input, hash/identity change and attempted input write. Demonstrate a bounded real managed review of a supplied source snapshot; an empty fixture diff does not establish source review.

Do not broaden the filesystem to solve this. Do not close #629 or promote the affected PRs based on the existing failed review.