VFS Federation Studio — Engineering Handoff after v0.0.9 P3

Continue development from VFS Federation Studio v0.0.9 P3 — Named Search + Validation Runtime. Do not restart, redesign, or replace the existing preservation-first architecture. Preserve all passing functionality and advance it incrementally with executable evidence.

CURRENT VERIFIED FOUNDATION

v0.0.9 preserves the full v0.0.8 P2 foundation: deterministic Federation Image v2 images, exact indexes, bounded embedded VFS views, recursive federation, preservation-first writable generations, independently operational generated pure-Perl VFS products, process-isolation architecture, authenticated IPC foundations, profile-v1 compatibility, profile-v2 federation-scoped Monk with strict ownership boundaries, headless/worker-backed Rule Lab, Path Resolution Lens, custom frameless Studio UI contracts, application-owned SVG iconography and stable-message-ID i18n architecture.

Monk remains a policy/routing layer around exact federation ownership/index resolution, not a replacement index. READ/STAT/LIST exact hits resolve before FALLBACK policy. WRITE policy may execute in PRE phase before ownership resolution. Version-2 path-changing rules fail closed across ownership boundaries unless cross_mounts is explicitly granted.

P3 adds optional named search_profiles and validation_policies to Monk profile v2. They are serialized only when present, so an existing v2 profile with neither preserves its previous canonical Monk JSON bytes/fingerprint. Adding either deliberately changes canonical Monk identity and therefore the containing VFS identity.

A named MonkSearchProfile persists stable ID/name, canonical root, recursion, file/directory kinds, glob, selected SEARCH rule IDs, ANY/ALL rule mode, phase, max_results and max_candidates. Referenced rules must exist, use SEARCH, allow SEARCH operation and match the profile phase. Production search enumerates exact federation paths first. Regex evaluation occurs only when a selected named profile actually references SEARCH rules. Candidate/result ceilings and cooperative cancellation bound bulk search work.

MonkValidationPolicy persists stable ID/name, selected rule IDs, operation, phase and ANY/ALL mode. It references the existing VALIDATE/DENY rule language rather than creating a parallel validator. Validation returns a deterministic non-mutating MonkValidationReport with profile identity/fingerprint, overall pass/error state and ordered per-rule eligibility/match/pass checks. DENY is a veto; positive VALIDATE checks combine under policy mode.

V2FederationRuntime now has real exact-first STAT and LIST fallback semantics. Deterministic walk/search/glob traverse embedded federation ownership. Named search can return root-owned and child-owned paths in one ordered result while keeping ordinary exact reads outside regex scans.

Python and generated pure-Perl runtimes are in parity for P3 profile parsing, named SEARCH, diagnostic result_limit caps, validation reports, STAT/LIST fallback and Monk fingerprinting. Generated package README/API files enumerate that package's actual named search profiles, validation policies, budgets and typed errors.

The Path Resolution Lens now supports production READ, WRITE, STAT, LIST and named SEARCH. SEARCH requires a real embedded search_profile_id and invokes V2FederationRuntime.search(); the Lens does not implement matching. Its serializable report can include result_count/result_paths. The graphical Qt Lens merely submits worker requests and renders reports.

Two new supervisor task kinds are protocol-visible: SEARCH_VFS and VALIDATE_MONK_POLICY. Workers load the V2 image, run production search/validation, honor cooperative cancellation boundaries, return JSON-safe typed results and preserve Monk fingerprints. TRACE_PATH_RESOLUTION accepts the P3 SEARCH profile/result-limit inputs.

EXECUTABLE EVIDENCE FOR THIS CUT

Working-tree Python suite: 134 passed, 2 skipped in the assembly environment. The two skips are PySide6 runtime/platform tests because PySide6 is unavailable; they are not GUI passes.

Generated-runtime Perl suites: 73/73 assertions PASS across five test files.

P3 Search + Validation proof: PASS. It crosses direct Python runtime semantics, named search candidate budget, STAT/LIST/SEARCH Lens, spawned SEARCH/validation/Lens workers, pure-Perl parity, generated-package P3 documentation and an independent generated Perl package API invocation. It verifies the diagnostic operations leave the source image byte-for-byte unchanged.

Recorded P3 proof values:
- Monk profile SHA-256: 954a0c95789eedf5d34cf8b746b0f99e2eb87a63aae7df650b616a8b6f0846f4
- root image SHA-256: c6b4154efb99cb0f12eb0f5ad5bfa25dc19cbb16bf6bf6b445b39e00c794b5a9
- search results: 2
- SEARCH Lens steps: 6
- validation checks: 2
- Perl parity: PASS
- generated package P3 proof: PASS
- source image non-mutation: PASS

The preserved P2 Rule Lab/Path Resolution Lens proof, P1 Monk scope/i18n proof and P0 vertical/writable-Perl/Monk proofs remain release gates. Final acceptance must repeat these from a clean extraction of the final archive.

ENVIRONMENT-LIMITED / INCOMPLETE QUALIFICATION

PySide6 is unavailable in the assembly environment. P3 Qt changes have static architecture/syntax coverage but actual runtime layout, dock interaction, focus/keyboard behavior, accessibility tree, high-DPI/text expansion, platform frameless chrome and locale retranslation are not passed here.

P3 search has max_candidates/max_results/result_limit ceilings and cooperative cancellation between candidates. Do not claim that this safely preempts one pathological regular-expression engine call. Current worker isolation prevents the GUI process itself from doing evaluation, but a single worker regex call can still outlive a cooperative cancellation checkpoint. A hard, safely preemptible regex evaluation/time budget remains required.

Rule Lab requests already support multiple fixtures, but project persistence/history and a complete multi-fixture authoring workflow are not claimed complete. Do not conflate an IPC tuple of fixtures with durable project fixture management.

Worker queued/running progress exists, but fine-grained candidate/check progress from long SEARCH/validation jobs is not yet streamed back to the supervisor.

Diagnostic workers currently read the selected image bytes into the worker process. Do not claim bounded-memory open for very large VFS instrumentation yet.

The exact four requested Asian languages/scripts are still unconfirmed. Do not claim a supported-language matrix until exact locales, Qt catalogs, fallback fonts, input/search behavior, text expansion/high-DPI behavior and generated documentation are qualified. Display locale remains presentation-only and must not change canonical VFS bytes/semantics unless localized content is deliberately payload/configuration content.

PRESERVATION REQUIREMENTS

Never weaken preservation-first behavior for feature convenience. Authoritative sources remain read-only. Committed .vfsbin images are immutable generations. Writes create candidates, candidates are independently verified, and only the controlled commit path promotes them. Worker failure/cancellation cannot corrupt the last known-good destination. Embedded children remain bounded complete images.

Keep exact lookup out of regex scans. Named SEARCH may deliberately enumerate candidates and invoke selected SEARCH rules, but exact READ/STAT/LIST hits must not pay a global regex-scan cost.

Keep Qt as presentation/controller. Substantial VFS open/build/write/rebuild/search/hash/verify/export/policy work belongs in supervisor/workers. New Qt surfaces use stable MessageId localization and application-owned SVGs; do not introduce QFileDialog/QMessageBox/native default dialogs or OS/default product icons.

Keep Python reference semantics and generated Perl semantics in parity. Add regression tests for every material contract extension/defect. Claims require executable evidence, including independent generated package use and clean-extraction testing. Separate environment-unavailable tests from passes.

IMMEDIATE NEXT DEVELOPMENT — P4

1. Build durable Rule Lab fixture suites outside canonical VFS identity: project-scoped multi-fixture authoring, atomic persistence, revision/history and run-history records. Only make fixtures semantic VFS content when explicitly configured that way.
2. Add safely preemptible Monk regex resource controls. Define a cross-platform evaluation/time budget strategy that can terminate or quarantine a stuck evaluation without corrupting worker/supervisor state; provide compatible generated-Perl behavior or explicitly version the semantic difference. Prove pathological patterns, loop/application/depth/trace budgets and worker recovery.
3. Add intra-task worker progress for long named search and validation (candidate/check counts, bounded totals where knowable) without moving work to Qt. Preserve cancellation and typed terminal states.
4. Move diagnostic VFS opening toward bounded/mapped access instead of reading entire large images into worker bytes. Preserve bounded child views and integrity verification.
5. Integrate named search profiles into the Federation Explorer/search UI and validation policies into a professional validation surface, always through worker tasks. Keep the Path Lens explanatory rather than turning it into an editor.
6. Expand generated package executable tests so when an image actually embeds P3 search/validation contracts, its own generated t/ suite exercises those package-specific IDs in addition to generic API tests.
7. Run Rule Lab/Lens/P3 search/validation UI in a real PySide6 host and qualify frameless/dock behavior, focus/keyboard navigation, accessibility text, high-DPI/text expansion and locale retranslation. Record unavailable platform cases separately.
8. Continue i18n catalogs only after the exact four target Asian languages/scripts are confirmed. Preserve language-neutral API names, error IDs, semantic enums and canonical build behavior.
9. Preserve all writable Perl capabilities, deterministic Federation Image v2 identity, strict v2 ownership routing, exact lookup and clean-extraction evidence throughout P4.

END PRODUCT CONTRACT

VFS Federation Studio is an engineering environment for creating a distinct, writable, programmable, federated virtual filesystem; exporting it as an independently operational Perl package; and proving exactly how that filesystem resolves, routes, searches, validates, mutates and verifies policy and data.
