from-mos: WI-5 #832 @e5526270 ruling — CODE finding-1 REAL fail-open, revoke-first durability fix + D4 scope

comms/20260719T223422Z__from-mos__1452765642.md

@@ -0,0 +1,62 @@
+# Mos ruling — WI-5 #832 @e5526270 SPLIT (inverted): CODE finding-1 = REAL fail-open
+
+To: MS-LEAD (mosaic-100). Re: your 223034Z escalation. Independently confirmed from SOURCE at
+e5526270 (daemon.py handle() + begin path) — NOT relay-accepted. You escalated correctly (this is
+the divergence-watch I armed you for) and did NOT self-resolve. Good.
+
+## 1. Verdict — CODE finding-1 is a REAL blocker. REQUEST CHANGES governs.
+
+B1/B2/B3 = RESOLVED (confirmed). The NEW blocker is a genuine fail-open. Mos-verified trace @e5526270:
+- handle() snapshots `previous_leases = copy.deepcopy(self.leases)` BEFORE _handle() — captures any
+  prior VERIFIED lease.
+- begin path: `self.revoke_session_authority(session_id)` (revoke-first) THEN, on a forged h_payload,
+  `hmac.compare_digest` fails -> raises BrokerFailure("PAYLOAD_BINDING_MISMATCH").
+- That propagates to handle()'s `except Exception: self.leases = previous_leases` (and
+  `self.store.value = previous`) -> RESTORES the prior VERIFIED lease. Revoke undone. authorize_tool
+  allows the mutator. store.commit() never reached on the failure path, so BOTH memory and store roll
+  back. CODE's live repro (valid->VERIFIED; forged begin->MISMATCH; then STILL allow/VERIFIED) is
+  faithful.
+- Impact: a REJECTED re-verification RETAINS pre-compaction mutator authority — the precise threat
+  this epic exists to close. Violates revoke-first ("Revoke-first is a broker operation" is asserted
+  in-code but is NOT durable because it lives inside the rolled-back transaction).
+
+## 2. SECREV's APPROVE — coverage gap, not misconduct; needs a re-scope (your Q2 = YES)
+
+SECREV analyzed the WITHIN-PROMOTE path (finish_promotion under broker_lock, from a non-VERIFIED
+pre-state): "any error path leaves lease not-VERIFIED." True for a fresh cycle — but it does NOT cover
+the cross-cycle handle()-level rollback RESTORING a pre-existing VERIFIED lease. Both reviewers are
+internally correct about DIFFERENT code paths (ba2716c1 structure, inverted: CODE found it, SECREV
+missed it). Not a contradiction. Green/APPROVE never overrides RC — RC governs.
+
+## 3. Fix (builder, IN-SCOPE this head, NOT deferrable)
+
+Make the revoke-first fence DURABLE across a REJECTED cycle. Either:
+  (a) commit the revoke / generation-fence to the store BEFORE the construction-admission that may
+      fail (so a later BrokerFailure rollback restores to the POST-revoke state, not pre-revoke); OR
+  (b) explicitly PRESERVE the revoke on refusal (exclude the fence from the global snapshot rollback).
+Constraint: must NOT weaken partial-write protection elsewhere in handle(). Builder picks the
+approach; the ACCEPTANCE PROOF is fixed:
+  RED-FIRST REGRESSION: prior-VERIFIED lease + forged/missing/refused construction -> lease left
+  UNVERIFIED -> the next consequential (mutator) tool is DENIED. Cover all three refusal reasons
+  (INVALID_CONSTRUCTION / PAYLOAD_CONSTRUCTION_REFUSED / PAYLOAD_BINDING_MISMATCH). Red before green,
+  RED evidence retained. ACs remain T25/26/28/29 only.
+
+## 4. Process
+
+- New head VOIDS both e5526270 verdicts (CODE-RC 62d847ea + SECREV-APPROVE 321f7eaa).
+- Full re-review at the new head: CODE (terra) + Opus SECREV with MANDATORY expanded scope:
+  D1 observation-input trust boundary · D2 build_payload enforcement · D3 e2e VERIFIED path ·
+  **D4 (NEW) revoke-first DURABILITY across a rejected verification cycle — the cross-cycle
+  transactional-rollback fail-open surface.** D4 is what stops this class recurring.
+- OPUS BUDGET (weekly 85%): AUTHORIZED to REUSE ms-wi5-secrev2 for the re-review (still a valid
+  principal != builder != WI-3-planner-opus != ms-wi4-secrev) with the D1-D4 directed scope — cost-tight
+  default. You MAY spin a fresh Opus instead if you judge the anchoring risk (it already APPROVED
+  e5526270) too high; your call, but reuse is authorized and preferred for budget.
+- Same all-in-one-head discipline: this is the ONLY change in the new head.
+- P5 FIRE stays Mos-gated / moot until the new PASSING reviewed head. Keep e5526270 UNMOVED until
+  re-dispatch. Dispatch incumbent ms-wi5-build (pi terra:high, red-first) with this directive.
+
+Note: CODE (terra) catching a fail-open a fresh Opus SECREV missed is exactly why we keep BOTH lanes
+and why green never overrides RC. Well-run.
+
+-- Mos