From 12914d8edd7edd1221cfffd6a881fc15da2eeec7 Mon Sep 17 00:00:00 2001 From: mos-orchestrator Date: Sat, 18 Jul 2026 17:06:58 -0500 Subject: [PATCH] =?UTF-8?q?docs(827):=20Mos=20byte-scope-verify=20CO-ATTES?= =?UTF-8?q?TATION=20v-final=20=E2=80=94=20probe-3=20PASS=20@2d54a9dd?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Independent provider-byte verify of harness 2d54a9dd (sha256 15a154df, 27366B) + review-v6 23c0caca. VERDICT: byte-scope + mechanism + hygiene PASS. NEW-5 closed via approach (i) [exec-adjacent re-hash, in-place, (ii) reverted]; NEW-6 closed [portable resolve_gated_wi_root, off-by-one gone]; creds-scrub + source-invalid-purge confirmed; all mechanism/assertion/fidelity/isolation invariants byte-stable; R1 boundary held. Committed under distinct mos-orchestrator identity = distinct-identity co-attestation of record (resolves shared ms-lead-reviewer signer gap). Byte-clear ONLY — FIRE still gated on homelab third-principal verify + transparency-to-Jason + explicit Mos FIRE GO. --- .../GATE0-PROBE3-MOS-COATTEST-v-final.md | 86 +++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v-final.md diff --git a/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v-final.md b/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v-final.md new file mode 100644 index 0000000..827e9d2 --- /dev/null +++ b/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v-final.md @@ -0,0 +1,86 @@ +# GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v-final) + +**Principal:** Mos (orchestrator, merge authority for the mosaic-stack governance lane). +**Committed under a DISTINCT git identity** (`mos-orchestrator@mosaic.local`) — deliberately NOT the +`ms-lead-reviewer@mosaic.local` lane signer — so this record stands as a *distinct-identity* +co-attestation, not a same-signer duplicate. See "Independence" below. + +**Verify class:** independent provider-byte read (guarded `git show :path | sha256sum` from a +read-only clone of `mosaicstack/stack`). Not a re-build, not a re-run — a byte/scope/hygiene audit of +the exact committed objects on the provider branch. + +## Package under attestation + +| Artifact | Ref | +|---|---| +| Branch | `feat/827-gate0-probe` | +| Harness commit-40 | `2d54a9dd14cb924701b2ae4ed72dae4df760c4e3` | +| Harness `p3_d4_focused_run.py` sha256 | `15a154df55273f51301763a984485fd63813f6d1f05d2728abb9fb8b9c040b1a` (27366 B) | +| §3-review-v6 commit-40 | `23c0caca9b5d44002e6184cd7f2b6c837e8795b2` | +| Review path | `docs/compaction-refresh/reviews/GATE0-PROBE3-NEW56-S3-REVIEW-v6.md` | + +sha256 re-confirmed against the checked-out object at `HEAD:docs/compaction-refresh/probes/p3_d4_focused_run.py` +(git object id `8c68cd07…`) — matches the relayed value byte-for-byte. + +## Findings — VERDICT: byte-scope + mechanism + hygiene **PASS** + +**Anchors.** Harness sha256 matches (27366 B). review-v6 (`23c0caca`) parent == harness commit +`2d54a9dd`; review touches only the review `.md` (+82 lines, 1 file). Broker +(`p3_generation_broker.py`) delta vs `48484938…` = **exactly** the 16-line `action=="source-invalid"` +handler purge, byte-stable otherwise. + +**NEW-6 (GATED_WI_ROOT off-by-one) — CLOSED.** `resolve_gated_wi_root()` selects the worktree by +`git worktree list --porcelain` enumeration, requires a UNIQUE match on `HEAD==GATED_WI_HEAD` +(`f400830738998db105107a2a4c69c7f2a2a6fd5d`) AND `branch==refs/heads/feat/830-compaction-revoke`, +then fail-closed re-validates (`is-inside-work-tree==true`, `rev-parse HEAD==GATED_WI_HEAD`); +`RuntimeError` on ambiguity/mismatch. The `HERE.parents[3].parent / "stack-cr-wi3-revoke"` off-by-one +and the hardcoded `/home/hermes/...` literal are **gone** — portable, zero hardcoded path. + +**NEW-5 (TOCTOU / pinned-executed-bytes) — CLOSED via approach (i), as mandated.** The `git`-object +sha256 pin (`GATED_LAUNCHER_SHA256 = e950e422…`) is the trust anchor. Ordering/marker `.find()` +heuristics are downgraded to explicitly diagnostic-only ("never a substitute for the pin"). In +`launch_verified_pi()` the executed working-tree file is re-hashed against the pin **in the statement +immediately before `Popen`** (no interleaved yield/IO), and the launcher is executed **in place at the +pinned worktree path** — the higher-risk approach (ii) copy-to-fixture (previously at `7ff63cd5` / +`6164dc07`) is **reverted** (the only remaining `shutil.copy2` is the legitimate credential copy, not a +launcher copy). Residual sub-statement TOCTOU window on a local file inside a non-adversarial operator +fixture is within this probe's threat model; the gross precondition→much-later-exec gap homelab flagged +is closed. + +**Hygiene — CLOSED.** `scrub_fixture_credentials(root)` removes the entire `.pi/agent` subtree in a +`finally` block (nested try/finally, after `pi.close()` + broker shutdown, before `return root`) and +`RuntimeError`s if the scrub fails — credentials are removed from retained evidence; logs retained. + +**Invariants byte-stable (all INTACT):** assertion `lease_anchor_registered`; file-backed fidelity +checks (`generation_source=="state-file"`, `state_file_in_fixture_root`, `MUTATOR_UNVERIFIED`, +`STALE_GENERATION`); `-O`-safe (0 bare `assert`); allow-list env (0 `os.environ.copy`); single broker; +`--runs choices=(3,)`; ABSENT-sweep (`yolo`/`execRuntime`/`p3_bank`/`promote_p2`/`retry`) = 0. + +**R1 mechanism-fidelity boundary — HELD.** D4 exercises #830's real file-backed revocation +(`generation-{sid}.state` / `MOSAIC_LEASE_GENERATION_FILE`, from `66b1e0a0`); `.state` stays inside the +fixture temp root; fixture-socket / child-write-escape / gettempdir isolation preconditions preserved; +launcher exec is in place at the pinned worktree (same surface as R1, not a new production/live +surface). **No path escapes the fixture root.** BEYOND-R1 tripwire NOT tripped. + +## Independence + +- **Substantive principal-independence** of review-v6 is satisfied by an orchestrator-dispatched, + builder-distinct Opus SECREV (`ms-secrev-828`, byte-only, non-builder) — that IS the substance of + Gate-16. +- The shared `ms-lead-reviewer` git signer on harness+review commits is **evidentiary, not + substantive**. It is resolved by (1) this Mos co-attestation committed under a **distinct** identity + (`mos-orchestrator`), and (2) a homelab third-principal verify under its own distinct identity — + i.e. three distinct-identity principals of record. +- The shared signer is a tracked **fleet-infra tooling-gap** (durable fix = per-lane distinct signers), + **not a blocker**. + +## Scope of this record — byte-clear, NOT fire-authorization + +Producing probe evidence **executes** the Gate0 mechanism; a byte-clear is not a fire-authorization. +This co-attestation clears the **bytes/scope/hygiene**. FIRE remains gated on: **homelab +third-principal verify** + **Mos transparency-to-Jason** (real-Pi consumes operator model creds inside +the isolated fixture, scrubbed post-run, never emitted) + **Mos explicit FIRE GO**. Until then: nothing +banked, WI-3 #830 held at `f4008307` (unmoved), C-hatch armed (if 3× isolation still no-fire / +wrong-value / isolation-FAIL → possible Case-C → STOP + escalate to Jason). + +**Mos verdict: byte-scope + mechanism + hygiene PASS. Co-attestation of record — committed.**