From 61126c74738a6c3c596d95f986c70af90d971e18 Mon Sep 17 00:00:00 2001 From: mos-orchestrator Date: Sat, 18 Jul 2026 19:24:54 -0500 Subject: [PATCH] =?UTF-8?q?co-attest:=20probe-3=20v10=20byte-scope-verify?= =?UTF-8?q?=20PASS=20@ce5ba762=20(B9=20no-site,=20exact=202-line=20-S=20de?= =?UTF-8?q?lta)=20=E2=80=94=20supersedes=20f320d075?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../reviews/GATE0-PROBE3-MOS-COATTEST-v10.md | 97 +++++++++++++++++++ 1 file changed, 97 insertions(+) create mode 100644 docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v10.md diff --git a/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v10.md b/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v10.md new file mode 100644 index 0000000..d91e071 --- /dev/null +++ b/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v10.md @@ -0,0 +1,97 @@ +# GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v10 no-site startup closure) + +**Principal:** Mos (orchestrator, merge authority for the mosaic-stack governance lane). +**Committed under a DISTINCT git identity** (`mos-orchestrator@mosaic.local`) — deliberately NOT the +`ms-lead-reviewer@mosaic.local` lane signer that authored the harness and the §3 review — so this +record stands as a *distinct-identity* co-attestation. See "Independence". + +**Verify class:** independent provider-byte read (`git show :path | sha256sum`) plus a +git-diff byte-comparison of the v9→v10 delta and source inspection of the executed command lines. Not +a re-build, not a re-run. This SUPERSEDES the v9 co-attestation `f320d075` (byte-clear on the v9 +env-iso + bytecode-pin bar), which was overtaken by homelab's 4th-round FAIL @1c34e3cb +(site-startup-closure hole) and the resulting B9 bar. + +## Package under attestation + +| Artifact | Ref | +|---|---| +| Branch | `feat/827-gate0-probe` (mosaicstack/stack) | +| Harness commit-40 | `ce5ba762051354338889959bfce2b0381f4a4e2a` | +| Harness `p3_d4_focused_run.py` sha256 | `7e14ead89a7b2a297fcc17e7653291b3bcace1d2002a8f90a989db74f6985b6f` (32753 B) | +| §3-review-v10 commit-40 | `ffc3b573a8258a86e3ece9ef92bac925fb5a7a5b` (parent == harness `ce5ba762`, byte-stable; adds only the review `.md`, +86; ms-secrev-828 authored) | +| Review path | `docs/compaction-refresh/reviews/GATE0-PROBE3-V10-NOSITE-S3-REVIEW-v10.md` | + +**Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins == embedded harness constants; UNCHANGED from v9):** + +| Member | Source (commit:path) | Pin sha256 | Size | +|---|---|---|---| +| launcher `launch-runtime.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py` | `e950e422…` | 4237 B | +| helper `lease_generation.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py` | `061625402f…` | 3769 B | +| broker `p3_generation_broker.py` | `23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py` | `4db4fef1…` | — | + +> `f4008307` (held WI-3 #830 gated head) is **not on origin** — recomputed launcher+helper from the +> local `stack-cr-wi3-revoke` worktree (HEAD == `f4008307`); broker from origin `23c0caca`. + +## Findings — VERDICT: byte-scope + mechanism + hygiene **PASS** (v10 = v9 + B9 no-site) + +The v9→v10 delta is **exactly 2 insertions / 0 deletions** (git-diff byte-compared), a `+28 B` +harness growth **fully accounted** (2 × ` "-S",\n` = 14 B each). Every prior invariant is +byte-stable — the diff touches nothing outside the two command lists. + +**B9 — no-site startup closure (homelab 4th-round finding CLOSED).** Both child command lists now +carry `-S`, which disables the `site` module entirely (no `.pth` executable lines, no +`sitecustomize`/`usercustomize`) so no unpinned startup code runs before the exact launcher/broker or +outside `closure_import_guard`: +- launcher `launch_verified_pi` (`:515`): `-s` + **`-S`** + `-B`, **no `-I`** (`-I` appears exactly + once in the harness, `:553`, the broker only). +- broker `launch_verified_broker` (`:554`): `-I` + **`-S`** + `-B`. + +Homelab's finding was **independently reproduced by Mos** and the fix **empirically verified** on host +Py3.11.2 (throwaway, not the harness): `[-s -B]`→`no_site=0, site imported` (the v9 hole); `[-I -B]`→ +`no_site=0, site imported` (proves `-I` does **not** imply `-S`); `[-s -S -B]`→`no_site=1`, `site` not +in `sys.modules`, **and the launcher's bare `from lease_generation import` still resolves** (`sys.path[0]` +untouched by `-S` → no B6c regression); `[-I -S -B]`→`no_site=1`. The launcher deliberately omits `-I` +(B6c: on 3.11+ `-I` implies `-P`, dropping the script dir from `sys.path[0]` → sibling import breaks); +its env isolation comes from the `PiRpc` `env=` allow-list, not `-I`. + +**All priors — byte-stable (outside the 2-line delta, re-confirmed from the v9 verify):** +B5 conjunction (materialize-from-pin / `mkdir(0o700)`+`O_EXCL` no-writer-window / re-hash==pin +immediately-before-exec); B6 (single pinned helper bound; `closure_import_guard` AST-reject); B6c +(launcher no `-I`); B7 (broker `env=environment` strict allow-list `:570`); B8 (`reject_pinned_bytecode` +fail-closed `:498-501` before each consumer `:535/:562` + `PYTHONDONTWRITEBYTECODE=1` `:729` + `-B` on +both); fidelity asserts (`generation_source=='state-file'`, `state_file_in_fixture_root`, +`MUTATOR_UNVERIFIED`, `STALE_GENERATION`); `lease_anchor_registered`; BAR1 `GATED_WI_HEAD==f4008307` +(`:36`) + `merge-base --is-ancestor 66b1e0a0 f4008307` = **YES**; `--runs choices=(3,)`; `-O`-safe +(0 bare `assert`); allow-list env (0 `os.environ.copy`); single broker (1 def + 1 call); the only +`shutil.copy2` is the `.pi/agent` credential copy. + +**Closure = exactly 3 files, materialized inside the fixture root.** No path escapes the fixture temp +root; no live/default broker; `.state` fixture-bound. **R1 owner tripwire NOT tripped** — `-S` +deepens startup-closure isolation of an already-authorized touch; it does not widen the touched surface. + +## Independence + +Substantive principal-independence of review-v10 is satisfied by an orchestrator-dispatched, +builder-distinct Opus SECREV (`ms-secrev-828`, byte-only, non-builder, non-Mos). The shared +`ms-lead-reviewer` git signer on harness+review commits is evidentiary, not substantive — resolved by +(1) this Mos co-attestation under a **distinct** identity (`mos-orchestrator`) and (2) a homelab +third-principal verify under its own distinct identity = three distinct-identity principals of record. +The prior 2-of-3 (`ms-secrev-828` v9 §3 PASS + `f320d075`) does **not** carry — all three re-verify +this v10 SHA. Shared signer = tracked fleet-infra tooling-gap, not a blocker. + +## Scope of this record — byte-clear, NOT fire-authorization + +Producing probe evidence **executes** the Gate0 mechanism; a byte-clear is not a fire-authorization. +This clears **bytes / scope / mechanism / hygiene on the v10 (v9 + B9 no-site) bar**. FIRE remains +gated on: **homelab third-principal re-verify** (5th round, own distinct identity) + **Mos +transparency-to-Jason** + **Mos explicit FIRE GO**. The FIRE GO additionally carries an +**execution-procedure constraint**: the 3× isolation dispatch must launch the runner under +externally-enforced **`python -I -S -B p3_d4_focused_run.py`** — a self-reexec is too late, the +harness's own `site` runs before it could re-add `-S` to itself. Until FIRE GO: nothing banked, WI-3 +#830 held at `f4008307` (unmoved), C-hatch armed (fired-rig only: no-fire / wrong-value / +assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason). + +Prior v10-superseded set: `1c34e3cb` / `e1c9a468` / `f320d075` (and transitively the v7 chain). + +**Mos verdict: v10 (v9 + B9 no-site) byte-scope + mechanism + hygiene PASS. Co-attestation of +record — committed.**