co-attest: probe-3 v10 byte-scope-verify PASS @ce5ba762 (B9 no-site, exact 2-line -S delta) — supersedes f320d075

docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v10.md

@@ -0,0 +1,97 @@
+# GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v10 no-site startup closure)
+
+**Principal:** Mos (orchestrator, merge authority for the mosaic-stack governance lane).
+**Committed under a DISTINCT git identity** (`mos-orchestrator@mosaic.local`) — deliberately NOT the
+`ms-lead-reviewer@mosaic.local` lane signer that authored the harness and the §3 review — so this
+record stands as a *distinct-identity* co-attestation. See "Independence".
+
+**Verify class:** independent provider-byte read (`git show <full-40>:path | sha256sum`) plus a
+git-diff byte-comparison of the v9→v10 delta and source inspection of the executed command lines. Not
+a re-build, not a re-run. This SUPERSEDES the v9 co-attestation `f320d075` (byte-clear on the v9
+env-iso + bytecode-pin bar), which was overtaken by homelab's 4th-round FAIL @1c34e3cb
+(site-startup-closure hole) and the resulting B9 bar.
+
+## Package under attestation
+
+| Artifact | Ref |
+|---|---|
+| Branch | `feat/827-gate0-probe` (mosaicstack/stack) |
+| Harness commit-40 | `ce5ba762051354338889959bfce2b0381f4a4e2a` |
+| Harness `p3_d4_focused_run.py` sha256 | `7e14ead89a7b2a297fcc17e7653291b3bcace1d2002a8f90a989db74f6985b6f` (32753 B) |
+| §3-review-v10 commit-40 | `ffc3b573a8258a86e3ece9ef92bac925fb5a7a5b` (parent == harness `ce5ba762`, byte-stable; adds only the review `.md`, +86; ms-secrev-828 authored) |
+| Review path | `docs/compaction-refresh/reviews/GATE0-PROBE3-V10-NOSITE-S3-REVIEW-v10.md` |
+
+**Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins == embedded harness constants; UNCHANGED from v9):**
+
+| Member | Source (commit:path) | Pin sha256 | Size |
+|---|---|---|---|
+| launcher `launch-runtime.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py` | `e950e422…` | 4237 B |
+| helper `lease_generation.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py` | `061625402f…` | 3769 B |
+| broker `p3_generation_broker.py` | `23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py` | `4db4fef1…` | — |
+
+> `f4008307` (held WI-3 #830 gated head) is **not on origin** — recomputed launcher+helper from the
+> local `stack-cr-wi3-revoke` worktree (HEAD == `f4008307`); broker from origin `23c0caca`.
+
+## Findings — VERDICT: byte-scope + mechanism + hygiene **PASS** (v10 = v9 + B9 no-site)
+
+The v9→v10 delta is **exactly 2 insertions / 0 deletions** (git-diff byte-compared), a `+28 B`
+harness growth **fully accounted** (2 × `        "-S",\n` = 14 B each). Every prior invariant is
+byte-stable — the diff touches nothing outside the two command lists.
+
+**B9 — no-site startup closure (homelab 4th-round finding CLOSED).** Both child command lists now
+carry `-S`, which disables the `site` module entirely (no `.pth` executable lines, no
+`sitecustomize`/`usercustomize`) so no unpinned startup code runs before the exact launcher/broker or
+outside `closure_import_guard`:
+- launcher `launch_verified_pi` (`:515`): `-s` + **`-S`** + `-B`, **no `-I`** (`-I` appears exactly
+  once in the harness, `:553`, the broker only).
+- broker `launch_verified_broker` (`:554`): `-I` + **`-S`** + `-B`.
+
+Homelab's finding was **independently reproduced by Mos** and the fix **empirically verified** on host
+Py3.11.2 (throwaway, not the harness): `[-s -B]`→`no_site=0, site imported` (the v9 hole); `[-I -B]`→
+`no_site=0, site imported` (proves `-I` does **not** imply `-S`); `[-s -S -B]`→`no_site=1`, `site` not
+in `sys.modules`, **and the launcher's bare `from lease_generation import` still resolves** (`sys.path[0]`
+untouched by `-S` → no B6c regression); `[-I -S -B]`→`no_site=1`. The launcher deliberately omits `-I`
+(B6c: on 3.11+ `-I` implies `-P`, dropping the script dir from `sys.path[0]` → sibling import breaks);
+its env isolation comes from the `PiRpc` `env=` allow-list, not `-I`.
+
+**All priors — byte-stable (outside the 2-line delta, re-confirmed from the v9 verify):**
+B5 conjunction (materialize-from-pin / `mkdir(0o700)`+`O_EXCL` no-writer-window / re-hash==pin
+immediately-before-exec); B6 (single pinned helper bound; `closure_import_guard` AST-reject); B6c
+(launcher no `-I`); B7 (broker `env=environment` strict allow-list `:570`); B8 (`reject_pinned_bytecode`
+fail-closed `:498-501` before each consumer `:535/:562` + `PYTHONDONTWRITEBYTECODE=1` `:729` + `-B` on
+both); fidelity asserts (`generation_source=='state-file'`, `state_file_in_fixture_root`,
+`MUTATOR_UNVERIFIED`, `STALE_GENERATION`); `lease_anchor_registered`; BAR1 `GATED_WI_HEAD==f4008307`
+(`:36`) + `merge-base --is-ancestor 66b1e0a0 f4008307` = **YES**; `--runs choices=(3,)`; `-O`-safe
+(0 bare `assert`); allow-list env (0 `os.environ.copy`); single broker (1 def + 1 call); the only
+`shutil.copy2` is the `.pi/agent` credential copy.
+
+**Closure = exactly 3 files, materialized inside the fixture root.** No path escapes the fixture temp
+root; no live/default broker; `.state` fixture-bound. **R1 owner tripwire NOT tripped** — `-S`
+deepens startup-closure isolation of an already-authorized touch; it does not widen the touched surface.
+
+## Independence
+
+Substantive principal-independence of review-v10 is satisfied by an orchestrator-dispatched,
+builder-distinct Opus SECREV (`ms-secrev-828`, byte-only, non-builder, non-Mos). The shared
+`ms-lead-reviewer` git signer on harness+review commits is evidentiary, not substantive — resolved by
+(1) this Mos co-attestation under a **distinct** identity (`mos-orchestrator`) and (2) a homelab
+third-principal verify under its own distinct identity = three distinct-identity principals of record.
+The prior 2-of-3 (`ms-secrev-828` v9 §3 PASS + `f320d075`) does **not** carry — all three re-verify
+this v10 SHA. Shared signer = tracked fleet-infra tooling-gap, not a blocker.
+
+## Scope of this record — byte-clear, NOT fire-authorization
+
+Producing probe evidence **executes** the Gate0 mechanism; a byte-clear is not a fire-authorization.
+This clears **bytes / scope / mechanism / hygiene on the v10 (v9 + B9 no-site) bar**. FIRE remains
+gated on: **homelab third-principal re-verify** (5th round, own distinct identity) + **Mos
+transparency-to-Jason** + **Mos explicit FIRE GO**. The FIRE GO additionally carries an
+**execution-procedure constraint**: the 3× isolation dispatch must launch the runner under
+externally-enforced **`python -I -S -B p3_d4_focused_run.py`** — a self-reexec is too late, the
+harness's own `site` runs before it could re-add `-S` to itself. Until FIRE GO: nothing banked, WI-3
+#830 held at `f4008307` (unmoved), C-hatch armed (fired-rig only: no-fire / wrong-value /
+assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason).
+
+Prior v10-superseded set: `1c34e3cb` / `e1c9a468` / `f320d075` (and transitively the v7 chain).
+
+**Mos verdict: v10 (v9 + B9 no-site) byte-scope + mechanism + hygiene PASS. Co-attestation of
+record — committed.**