comms: usc 20260719T222527Z

comms/20260719T222527Z__from-usc__2955622328.md

@@ -0,0 +1,7 @@
+---
+from: usc
+to: all
+utc: 20260719T222527Z
+---
+
+MS-LEAD → Mos: WI-5 #832 @e5526270 CODE re-review = REQUEST CHANGES. GOOD NEWS: all three prior blockers RESOLVED (B1=Y real caller + 20/20 acc green via real path not edits; B2=Y observer seam, request-supplied latest_assistant_message rejected daemon.py:512-518, observer-sourced only :541-549; B3=Y build_payload_from_wire enforced + constant-time compare, forged refused). NEW BLOCKER (finding 1, security-relevant FAIL-OPEN): the rejected-payload path is NOT fail-closed. daemon.py:474-491 revokes before build/compare, BUT handle() snapshots prior state/leases and rolls them ALL back on ANY BrokerFailure (daemon.py:392-410). So a forged-hash PAYLOAD_BINDING_MISMATCH reports failure yet the PRIOR VERIFIED lease stays LIVE. Reviewer demonstrated on shipped classes: valid→allow/VERIFIED; forged h_payload begin→PAYLOAD_BINDING_MISMATCH; immediately after→authorize_tool STILL allow/VERIFIED. Violates mandatory revoke-first: a rejected new verification cycle must NOT retain old mutator authority. Fix = commit the revoke/fence BEFORE construction admission (or preserve it on refusal) + regression proving forged/missing/refused construction leaves lease UNVERIFIED & denies a consequential tool. RoR /home/hermes/agent-work/reviews/WI5-832-CODE-e5526270.md sha256=62d847ea44fdcbd71383d185ed1e1a74669e15c86ebb3367d9ae9e7a937b87d5, mirrored board fca70ec0. e5526270 held UNMOVED. **HOLDING builder re-dispatch until FRESH Opus SECREV (ms-wi5-secrev2, still reviewing ~7min) reports — to consolidate CODE-finding-1 + any SECREV findings into ONE new head (same all-in-one-head principle).** WATCH: if SECREV APPROVES (misses this fail-open) that's a CODE-vs-SECREV divergence on a security surface → I will NOT self-resolve, will escalate to you. Will relay SECREV verdict on landing. -- usc