docs(827): Mos byte-scope-verify CO-ATTESTATION v-final — probe-3 PASS @2d54a9dd

Independent provider-byte verify of harness 2d54a9dd (sha256 15a154df, 27366B) +
review-v6 23c0caca. VERDICT: byte-scope + mechanism + hygiene PASS. NEW-5 closed via
approach (i) [exec-adjacent re-hash, in-place, (ii) reverted]; NEW-6 closed [portable
resolve_gated_wi_root, off-by-one gone]; creds-scrub + source-invalid-purge confirmed;
all mechanism/assertion/fidelity/isolation invariants byte-stable; R1 boundary held.
Committed under distinct mos-orchestrator identity = distinct-identity co-attestation of
record (resolves shared ms-lead-reviewer signer gap). Byte-clear ONLY — FIRE still gated
on homelab third-principal verify + transparency-to-Jason + explicit Mos FIRE GO.

docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v-final.md

@@ -0,0 +1,86 @@
+# GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v-final)
+
+**Principal:** Mos (orchestrator, merge authority for the mosaic-stack governance lane).
+**Committed under a DISTINCT git identity** (`mos-orchestrator@mosaic.local`) — deliberately NOT the
+`ms-lead-reviewer@mosaic.local` lane signer — so this record stands as a *distinct-identity*
+co-attestation, not a same-signer duplicate. See "Independence" below.
+
+**Verify class:** independent provider-byte read (guarded `git show <full-40>:path | sha256sum` from a
+read-only clone of `mosaicstack/stack`). Not a re-build, not a re-run — a byte/scope/hygiene audit of
+the exact committed objects on the provider branch.
+
+## Package under attestation
+
+| Artifact | Ref |
+|---|---|
+| Branch | `feat/827-gate0-probe` |
+| Harness commit-40 | `2d54a9dd14cb924701b2ae4ed72dae4df760c4e3` |
+| Harness `p3_d4_focused_run.py` sha256 | `15a154df55273f51301763a984485fd63813f6d1f05d2728abb9fb8b9c040b1a` (27366 B) |
+| §3-review-v6 commit-40 | `23c0caca9b5d44002e6184cd7f2b6c837e8795b2` |
+| Review path | `docs/compaction-refresh/reviews/GATE0-PROBE3-NEW56-S3-REVIEW-v6.md` |
+
+sha256 re-confirmed against the checked-out object at `HEAD:docs/compaction-refresh/probes/p3_d4_focused_run.py`
+(git object id `8c68cd07…`) — matches the relayed value byte-for-byte.
+
+## Findings — VERDICT: byte-scope + mechanism + hygiene **PASS**
+
+**Anchors.** Harness sha256 matches (27366 B). review-v6 (`23c0caca`) parent == harness commit
+`2d54a9dd`; review touches only the review `.md` (+82 lines, 1 file). Broker
+(`p3_generation_broker.py`) delta vs `48484938…` = **exactly** the 16-line `action=="source-invalid"`
+handler purge, byte-stable otherwise.
+
+**NEW-6 (GATED_WI_ROOT off-by-one) — CLOSED.** `resolve_gated_wi_root()` selects the worktree by
+`git worktree list --porcelain` enumeration, requires a UNIQUE match on `HEAD==GATED_WI_HEAD`
+(`f400830738998db105107a2a4c69c7f2a2a6fd5d`) AND `branch==refs/heads/feat/830-compaction-revoke`,
+then fail-closed re-validates (`is-inside-work-tree==true`, `rev-parse HEAD==GATED_WI_HEAD`);
+`RuntimeError` on ambiguity/mismatch. The `HERE.parents[3].parent / "stack-cr-wi3-revoke"` off-by-one
+and the hardcoded `/home/hermes/...` literal are **gone** — portable, zero hardcoded path.
+
+**NEW-5 (TOCTOU / pinned-executed-bytes) — CLOSED via approach (i), as mandated.** The `git`-object
+sha256 pin (`GATED_LAUNCHER_SHA256 = e950e422…`) is the trust anchor. Ordering/marker `.find()`
+heuristics are downgraded to explicitly diagnostic-only ("never a substitute for the pin"). In
+`launch_verified_pi()` the executed working-tree file is re-hashed against the pin **in the statement
+immediately before `Popen`** (no interleaved yield/IO), and the launcher is executed **in place at the
+pinned worktree path** — the higher-risk approach (ii) copy-to-fixture (previously at `7ff63cd5` /
+`6164dc07`) is **reverted** (the only remaining `shutil.copy2` is the legitimate credential copy, not a
+launcher copy). Residual sub-statement TOCTOU window on a local file inside a non-adversarial operator
+fixture is within this probe's threat model; the gross precondition→much-later-exec gap homelab flagged
+is closed.
+
+**Hygiene — CLOSED.** `scrub_fixture_credentials(root)` removes the entire `.pi/agent` subtree in a
+`finally` block (nested try/finally, after `pi.close()` + broker shutdown, before `return root`) and
+`RuntimeError`s if the scrub fails — credentials are removed from retained evidence; logs retained.
+
+**Invariants byte-stable (all INTACT):** assertion `lease_anchor_registered`; file-backed fidelity
+checks (`generation_source=="state-file"`, `state_file_in_fixture_root`, `MUTATOR_UNVERIFIED`,
+`STALE_GENERATION`); `-O`-safe (0 bare `assert`); allow-list env (0 `os.environ.copy`); single broker;
+`--runs choices=(3,)`; ABSENT-sweep (`yolo`/`execRuntime`/`p3_bank`/`promote_p2`/`retry`) = 0.
+
+**R1 mechanism-fidelity boundary — HELD.** D4 exercises #830's real file-backed revocation
+(`generation-{sid}.state` / `MOSAIC_LEASE_GENERATION_FILE`, from `66b1e0a0`); `.state` stays inside the
+fixture temp root; fixture-socket / child-write-escape / gettempdir isolation preconditions preserved;
+launcher exec is in place at the pinned worktree (same surface as R1, not a new production/live
+surface). **No path escapes the fixture root.** BEYOND-R1 tripwire NOT tripped.
+
+## Independence
+
+- **Substantive principal-independence** of review-v6 is satisfied by an orchestrator-dispatched,
+  builder-distinct Opus SECREV (`ms-secrev-828`, byte-only, non-builder) — that IS the substance of
+  Gate-16.
+- The shared `ms-lead-reviewer` git signer on harness+review commits is **evidentiary, not
+  substantive**. It is resolved by (1) this Mos co-attestation committed under a **distinct** identity
+  (`mos-orchestrator`), and (2) a homelab third-principal verify under its own distinct identity —
+  i.e. three distinct-identity principals of record.
+- The shared signer is a tracked **fleet-infra tooling-gap** (durable fix = per-lane distinct signers),
+  **not a blocker**.
+
+## Scope of this record — byte-clear, NOT fire-authorization
+
+Producing probe evidence **executes** the Gate0 mechanism; a byte-clear is not a fire-authorization.
+This co-attestation clears the **bytes/scope/hygiene**. FIRE remains gated on: **homelab
+third-principal verify** + **Mos transparency-to-Jason** (real-Pi consumes operator model creds inside
+the isolated fixture, scrubbed post-run, never emitted) + **Mos explicit FIRE GO**. Until then: nothing
+banked, WI-3 #830 held at `f4008307` (unmoved), C-hatch armed (if 3× isolation still no-fire /
+wrong-value / isolation-FAIL → possible Case-C → STOP + escalate to Jason).
+
+**Mos verdict: byte-scope + mechanism + hygiene PASS. Co-attestation of record — committed.**