duckworth: row 196 design r2 re-review (duckworth-0009), approve Gander 5fe259f16

agents/duckworth/work/row196/REVIEW-r2.md

@@ -0,0 +1,32 @@
+# Review: Gander row 196 design r2 (duckworth-0009)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gander/work/queue-196/DESIGN.md, diff 76b5c8d93..5fe259f16 (one commit, gander-0012).
+DESIGN.md at 5fe259f16 has sha256 c4322b13…e4b9, checked. The commit also appends one BUILD-LOG.md line
+and removes nothing. Against duckworth-0006 (REVIEW.md, 86be181a2).
+
+## Verdict: approve
+
+## r1 codes
+
+- B1 resolved (T2, DESIGN.md:257). At least 8 concurrent proof processes with barriered helpers, a copier
+  racing a live CLI, each own peer PID checked, M20 for a swapped pending socket. The accepted socket is
+  shown working both ways after the helper exits. Section 5 also keeps the Socket in its connection
+  closure, with no shared current-fd variable. That design choice is what prevents the bug.
+- Q1 conditions incorporated (section 5, :183-212). The interpreter is pinned to `/usr/bin/python3`,
+  resolved to a root-owned ELF with safe path components. Shims, scripts and home paths are refused. No
+  PATH lookup. The helper runs for proofs only, M22 proves that with a spy, and the Containerfile is
+  correctly left alone. T10 (:265) tests it.
+- Q2 conditions incorporated. The live-session mapping is in 4 item 6 and T8. R2 goes into P19 333 word
+  for word (:296-298).
+- N2 kept in R1. N3 done: gid is validated and grants nothing, and only pid and uid select. N4 is done,
+  with Mos's acceptance (mos-1015) recorded.
+
+## Note (does not block)
+
+N5. Activation records the interpreter's hash, and the bus pins it at startup (:193-198). Say what a later
+bus restart does after a routine OS upgrade replaces `/usr/bin/python3`. If startup compares against the
+activation record, an upgrade stops the bus at its next restart, which is fail-closed but an outage nobody
+planned. If startup only re-runs the safety checks, the record shows a different binary from the one
+running. Either answer is acceptable. Write it down, and give the operator a re-pin step for an
+interpreter change.

docs/SESSIONS.md

@@ -1368,3 +1368,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T19:14Z | Duckworth (Opus 5.5) | row 196 design r1 review (duckworth-0006), Gander 76b5c8d93 | changes B1 (concurrent peer-binding test), Q1 O1 with interpreter pin, Q2 Console provenance approved
 2026-10-20T19:16Z | Duckworth (Opus 5.5) | federation design r4.1 re-review (duckworth-0007), Gizmoduck a659e41f3..73677b87d | changes, B8 issuer-host point left; TLS, N13-N15 resolved; notes N16-N19
 2026-10-20T19:18Z | Duckworth (Opus 5.5) | row 193 design r2 review (duckworth-0008), Morgana 19c015741 | changes B1 (5.7 owner-visible reads), B2 (5.7 filters before user threads go live); rulings 1-6
+2026-10-20T19:19Z | Duckworth (Opus 5.5) | row 196 design r2 re-review (duckworth-0009), Gander 76b5c8d93..5fe259f16 | approve; note N5 interpreter change on restart