docs(review): record independent glm-5.3 auth-registry spec review (#50)

Verdict ACCEPT WITH CHANGES. Persist ten-gate recommendations and three
P0 blockers: per-seat launch provider/model resolution; rotating OAuth
persistence for long-running seats; role auth ceiling ∩ settings profile
plus data-map/reset alignment. Reviewer made no repo edits.

Implementation remains blocked pending owner/conductor adjudication.
Prior gate remains green: suites 24/15/90/14/17 + verify.

BUILD-LOG.md

@@ -614,3 +614,24 @@ root.
 
 Spec is ready for owner/conductor review; CURRENT.md points only to that
 review. Implementation remains blocked until all ten gates are resolved.
+
+## Phase 25 independent review receipt (#50)
+
+- Reviewer: live ms-test seat, zai/glm-5.3; read-only, no files edited.
+- Verdict: ACCEPT WITH CHANGES. Taxonomy and reusable-profile/no-seat-
+  registration model are sound; two technical P0 gaps plus one policy P0
+  block implementation.
+- P0: define per-seat launch provider/model resolution; resolve rotating
+  OAuth-token persistence for long-running seats with read-only generated
+  auth; enforce role auth ceiling ∩ settings profile in phase 1 and repair
+  AGENTS.md data map/reset warnings.
+- Ten-gate recommendations persisted in Gitea #50. Important additions:
+  mandatory settingsProfile for v2 seats; session account pinning sidecar;
+  Node secret-handling core; remote Ollama HTTPS; dataRoot reset semantics;
+  hard-delete stale generated credentials; per-account refresh locking.
+- Comms note: acknowledgment returned rc=2 (submission not confirmed), but
+  pane evidence showed it was submitted, read, and acted on. No retry was
+  sent because duplicate delivery would be worse; watch retired.
+
+Implementation remains blocked pending owner/conductor adjudication and a
+revised spec.

docs/SESSIONS.md

@@ -16,3 +16,4 @@ are never rewritten or removed; corrections are new entries.
 | 2026-09-03 | assistant (conductor) | M19 harness auth tooling (#47): pi auth investigation (native provider stacking, no native multi-account), scripts/auth.sh status/accounts (never prints credential material), agent.sh --auth per-launch injection via PI_AUTH_FILE, test-auth.sh suite (13 cases incl. secret-never-printed assertions) | scripts/auth.sh, scripts/agent.sh, scripts/test-auth.sh, docs/TOOLS.md, AGENTS.md; suites 24/90/14/17/13 + verify green |
 | 2026-09-03 | owner (direction) + assistant (conductor) | M19 correction (#48): mosaic-managed auth moved from ~/.pi to the data root (auth/<account>.json, 0600 enforced); ~/.pi read-only to the stack as a ROADMAP standing decision; auth.sh config-driven; test-auth 15 cases | scripts/auth.sh, scripts/agent.sh, scripts/test-auth.sh, docs/TOOLS.md, docs/plans/ROADMAP.md, README.md; suites 24/15/90/14/17 + verify green |
 | 2026-09-03 | owner (requirements) + assistant (conductor/spec author) | Harness/provider/auth registry specification (#49): agent.json harness declaration, centralized providers/accounts/settings profiles, audited runtime selection, per-seat auth/models materialization, centralized OAuth lifecycle, local/remote Ollama, target mosaic CLI | docs/plans/2026-09-03_auth-provider-harness-registry.md; implementation blocked pending ten-gate review; unslop clean |
+| 2026-09-03 | ms-test (independent reviewer, zai/glm-5.3) + assistant (conductor) | Independent read-only review of auth/provider/harness registry spec (#50): answered ten gates; verdict ACCEPT WITH CHANGES; P0 launch provider/model resolution, rotating-OAuth persistence, role ceiling ∩ profile/data-map/reset alignment | Findings persisted in #50 + BUILD-LOG Phase 25; no repo edits by reviewer; implementation remains blocked pending adjudication |