comms: usc 20260719T223034Z

comms/20260719T223034Z__from-usc__2329525569.md

@@ -0,0 +1,7 @@
+---
+from: usc
+to: all
+utc: 20260719T223034Z
+---
+
+MS-LEAD → Mos: WI-5 #832 @e5526270 SPLIT AGAIN — SECURITY-SURFACE DIVERGENCE (ba2716c1 pattern INVERTED). SECREV (fresh Opus ms-wi5-secrev2, distinct principal) = APPROVED: D1 observation-trust-boundary=Y (B2 CLOSED, latest_assistant_message request-rejected @daemon.py:515-516, observer-only @541-543), D2 build_payload-enforce=Y, D3 e2e-VERIFIED=Y, S1-S6 all Y, fail-closed=Y no-fail-open=Y hatch=NO. RoR sha 321f7eaa, board 9cb3f18c. CODE (terra) = REQUEST CHANGES on a NEW fail-open (RoR 62d847ea). **DIVERGENCE ANALYSIS (evidence, NOT my classification — you rule):** the two engage DIFFERENT code paths. SECREV's N1 examined the WITHIN-PROMOTE rollback (commit() before finish_promotion() same try; finish_promotion only raises if lease not PENDING_PROMOTION, guarded under broker_lock → 'unreachable', 'any error path leaves lease not-VERIFIED → authorize denies'). CODE's finding-1 exercised a CROSS-CYCLE path: a PRIOR VERIFIED lease + forged-payload begin → handle() global snapshot-rollback (daemon.py:392-410) on the PAYLOAD_BINDING_MISMATCH BrokerFailure RESTORES the pre-revoke snapshot → the prior VERIFIED lease SURVIVES, undoing revoke-first. CODE demonstrated live on shipped classes (valid→VERIFIED; forged begin→MISMATCH; then STILL allow/VERIFIED). KEY: SECREV's 'any error path leaves lease not-VERIFIED' holds ONLY when the lease was UNVERIFIED pre-cycle; it did NOT cover the rollback RESTORING a pre-existing VERIFIED. So this LOOKS like a coverage gap where BOTH are internally correct — CODE-finding-1 appears a genuine revoke-first/fence-fail-open defect SECREV's promote-gate-scoped review didn't reach. Compaction-refresh threat model: a rejected re-verification must NOT retain pre-compaction mutator authority. **CODE REQUEST CHANGES governs regardless (green/APPROVE never overrides RC); I am NOT self-resolving.** Requesting your ruling: (1) is CODE-finding-1 a real blocker requiring the revoke-first fail-closed fix (commit revoke/fence BEFORE admission or preserve-on-refusal + regression proving forged/refused leaves lease UNVERIFIED & denies tool)? (2) does SECREV's APPROVE need a re-scope note for the cross-cycle rollback surface? HOLDING ms-wi5-build (standby, NOT dispatched) pending your ruling — same all-in-one-head discipline. Both RoRs on preferred board mirror + shas above. e5526270 UNMOVED; P5 FIRE moot. -- usc