From b6bd0cd91c883685f9092347f64caa7ca89e017d Mon Sep 17 00:00:00 2001 From: mos-orchestrator Date: Sat, 18 Jul 2026 17:27:05 -0500 Subject: [PATCH] =?UTF-8?q?docs(827):=20SUPERSEDE=20Mos=20co-attest=201291?= =?UTF-8?q?4d8=20=E2=80=94=20homelab=203rd-principal=20FAIL=20upheld,=20st?= =?UTF-8?q?ricter=20hashed=3D=3Dexecuted-full-closure=20bar;=20live=20targ?= =?UTF-8?q?et=3Dv7=20(ii)-materialization?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../GATE0-PROBE3-MOS-COATTEST-v-final.md | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v-final.md b/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v-final.md index 827e9d2..da7f686 100644 --- a/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v-final.md +++ b/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v-final.md @@ -84,3 +84,33 @@ banked, WI-3 #830 held at `f4008307` (unmoved), C-hatch armed (if 3× isolation wrong-value / isolation-FAIL → possible Case-C → STOP + escalate to Jason). **Mos verdict: byte-scope + mechanism + hygiene PASS. Co-attestation of record — committed.** + +--- + +## ⚠️ SUPERSEDED — homelab third-principal FAIL raised a stricter bar (evidence-integrity note) + +This co-attestation was **byte-clear on the v6 bar ONLY** and self-limited above to *"byte-clear +ONLY, NOT fire-authorization; FIRE remains gated on homelab third-principal verify."* Homelab (the +required third principal) subsequently returned **FAIL @2d54a9dd**, and Mos **UPHELD** it — so the v6 +byte-clear this document records is **SUPERSEDED** and does **NOT** authorize FIRE. + +Homelab's substantively-correct deepening (accepted as gate-**strengthening**, not softening): +1. `launch_verified_pi` hashes the launcher then `Popen`/execve **reopens the path** → statement + adjacency shrinks but does not eliminate TOCTOU; hashed-snapshot ≠ executed-bytes. +2. `lease_generation.py` helper is unpinned, loaded from the mutable worktree → HEAD + launcher-pin + do not bind the helper bytes. +3. `p3_generation_broker.py` executes from the mutable worktree unhashed → reviewed broker bytes need + not be the evidence-producing bytes. + +For a fail-closed DO-178C evidence gate, **hashed==executed must hold on the FULL executed closure** +(launcher + helper + broker), which v6 (approach (i) adjacency) does not meet. Mos therefore +**authorized approach (ii) full-closure materialization** (SHA-pin + materialize the full closure into +a fixture-private 0700/0600 dir or held verified fds, exec from there, launcher+broker consume the same +pinned helper; re-hash==f4008307 pins immediately before exec, fail-closed). This rides the existing R1 +authorization + Mos adjudication authority (it deepens isolation of already-authorized touch and stays +inside the fixture temp root → R1 owner tripwire not tripped; no fresh owner window). + +**Live target = v7** (materialized-closure harness, forthcoming). `2d54a9dd` / `23c0caca` / this +co-attestation (`12914d8`) are **SUPERSEDED**. A fresh Mos co-attestation will be committed on v7 +byte-verify PASS. WI-3 #830 remains HELD at `f4008307`; nothing banked; C-hatch armed. +