From e1c9a4682da2892ca5f5381012caffe1dd7b43a7 Mon Sep 17 00:00:00 2001
From: ms-lead-reviewer <reviewer@mosaic.local>
Date: Sat, 18 Jul 2026 18:48:01 -0500
Subject: [PATCH] =?UTF-8?q?docs(827):=20Gate0=20Probe-3=20launcher-fix=20?=
 =?UTF-8?q?=C2=A73-review=20v9=20PASS=20@1c34e3cb=20(+=20mark=20v8=20super?=
 =?UTF-8?q?seded)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Independent Opus SECREV review (ms-secrev-828 lane, dispatched by mosaic-100;
Gate-16 author≠reviewer; byte-only; did not build).
Reviewed object = 1c34e3cb3172acdcd094e683e847d7c984afc96c
harness sha256 = 29e5c7bfbe1911b52984bd94c79036bb1200ee82588318367b13c2b1053a0103
Verdict PASS: B6(c) remediated — launcher -I dropped -> -s + PYTHONNOUSERSITE=1;
empirically verified sys.path[0]=pinned/ so the pinned launcher's bare
'from lease_generation import' binds to pinned/lease_generation.py (broker keeps
-I, explicit --generation-module import). B7/B8/B5/B6-rest/fidelity/traceability/
lease_anchor/live-path/single-broker/--runs/ABSENT all intact; -O-safe. Also
marked my own v8 FAIL review SUPERSEDED (reviewed a92ad090 -> fixed by 1c34e3cb).
Byte review only; ran nothing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...ATE0-PROBE3-V8-ENVBYTECODE-S3-REVIEW-v8.md |  2 +
 ...ATE0-PROBE3-V9-LAUNCHERFIX-S3-REVIEW-v9.md | 93 +++++++++++++++++++
 2 files changed, 95 insertions(+)
 create mode 100644 docs/compaction-refresh/reviews/GATE0-PROBE3-V9-LAUNCHERFIX-S3-REVIEW-v9.md

diff --git a/docs/compaction-refresh/reviews/GATE0-PROBE3-V8-ENVBYTECODE-S3-REVIEW-v8.md b/docs/compaction-refresh/reviews/GATE0-PROBE3-V8-ENVBYTECODE-S3-REVIEW-v8.md
index ecd0b47a..b37efd05 100644
--- a/docs/compaction-refresh/reviews/GATE0-PROBE3-V8-ENVBYTECODE-S3-REVIEW-v8.md
+++ b/docs/compaction-refresh/reviews/GATE0-PROBE3-V8-ENVBYTECODE-S3-REVIEW-v8.md
@@ -1,3 +1,5 @@
+> ⚠ SUPERSEDED by v9: the reviewed harness `a92ad090` is superseded by the narrow fix `1c34e3cb` (my v8 B6(c) FAIL — `-I` on the launcher — was remediated by `-I`→`-s` + `PYTHONNOUSERSITE=1`; re-review v9 = PASS). This v8 FAIL record pertains to the superseded commit.
+
 # Gate0 Probe-3 (D4) Broker Env-Isolation + Bytecode Binding — §3-Conformance Review v8
 
 **Verdict: ❌ FAIL** (B7 and B8 land correctly, but the same change breaks **B6(c)**: the launcher is run with `-I`, which strips the script directory from `sys.path` on Python 3.11+, so its bare `import lease_generation` cannot resolve the pinned helper — empirically confirmed).
diff --git a/docs/compaction-refresh/reviews/GATE0-PROBE3-V9-LAUNCHERFIX-S3-REVIEW-v9.md b/docs/compaction-refresh/reviews/GATE0-PROBE3-V9-LAUNCHERFIX-S3-REVIEW-v9.md
new file mode 100644
index 00000000..69642ec1
--- /dev/null
+++ b/docs/compaction-refresh/reviews/GATE0-PROBE3-V9-LAUNCHERFIX-S3-REVIEW-v9.md
@@ -0,0 +1,93 @@
+# Gate0 Probe-3 (D4) Launcher-Import Fix — §3-Conformance Review v9
+
+**Verdict: ✅ PASS**
+
+## Pin (GUARD 1 — reviewed object)
+
+- **Reviewed object = `1c34e3cb3172acdcd094e683e847d7c984afc96c`** (harness commit, branch `feat/827-gate0-probe`).
+- **Reviewed file:** `docs/compaction-refresh/probes/p3_d4_focused_run.py` — sha256 (pushed provider bytes, `-o FILE`, FULL-40 ref, verified before trust): `29e5c7bfbe1911b52984bd94c79036bb1200ee82588318367b13c2b1053a0103` (32725 bytes, no not-found sentinel).
+- **Closure pins (unchanged):** launcher `e950e422…` @f4008307 · helper `061625402f08488eac47acd23272904e71fd1a71fd15b3bdab158632c801be4c` @f4008307 · broker `4db4fef1…` @23c0caca.
+
+## Independence (GUARD 2 — principal-independence attestation)
+
+Distinct Opus SECREV session, orchestrator-dispatched — the **`ms-secrev-828` reviewer lane, dispatched by
+`mosaic-100`** — **byte review only, ran nothing** (harness/broker not executed); did **not** build this harness
+(builder = ms-rev-826); is not Mos. This is the re-review after **my own** v8 FAIL @`a92ad090` (B6(c): `-I` on the
+launcher broke the sibling import); the author applied the narrow fix and I verify it here. The `-s`/`-I` `sys.path`
+checks below use a *throwaway* two-line script to observe interpreter behavior — not the harness/broker/closure.
+
+## ★ B6(c) — THE FIX (was the v8 FAIL): launcher `-I` dropped; sibling import binds to `pinned/`
+
+The launcher command no longer carries `-I`; it now uses **`-s`** (`:514`, commented "`-s` preserves `sys.path[0]=pinned/`
+for the launcher's sibling helper") + `-B` (`:515`), and `PYTHONNOUSERSITE=1` is added to the allow-list env (`:730`).
+
+`-s` and `PYTHONNOUSERSITE` disable **user site-packages only** — they do **not** strip the script's directory from
+`sys.path` (unlike `-I`/`-P`). Empirically confirmed on this host (Python 3.11.2), throwaway script:
+
+```
+python3 -s -B main.py                       → sys.path[0] = '<script dir>'  → sibling import: OK
+PYTHONNOUSERSITE=1 python3 -s -B main.py     → sys.path[0] = '<script dir>'  → sibling import: OK
+python3 -I -B main.py   (the v8 FAIL form)   → sys.path[0] = stdlib zip     → ModuleNotFoundError
+```
+
+Therefore `python3 -s -B pinned/launch-runtime.py …` puts `pinned/` at `sys.path[0]`, so the pinned launcher's bare
+top-level `from lease_generation import initialize_runtime_generation` (`f4008307:launch-runtime.py:15`, no `sys.path`
+manipulation) resolves to the **pinned** `pinned/lease_generation.py` — not the worktree, not a miss. **B6(c) holds.**
+
+## B7 — Broker env-isolation (still holds)
+
+`launch_verified_broker` passes `env=environment` (the constructed allow-list, **not** `os.environ`; contains no
+`PYTHONPATH`/`PYTHONHOME`/`PYTHONPYCACHEPREFIX`) to `Popen` (`:570`), and the broker command includes `-I` (`:552`).
+The broker imports the helper by explicit `--generation-module` path via `importlib`, so it never needs `sys.path[0]`
+— `-I` is correct there and does not affect it. (The env's `PYTHONNOUSERSITE`/`PYTHONDONTWRITEBYTECODE` are hardening
+flags, not path/home passthrough, and `-I` ignores all `PYTHON*` env anyway.)
+
+## B8 — Bytecode pinned-or-suppressed (still holds)
+
+`PYTHONDONTWRITEBYTECODE=1` (`:729`) and `PYTHONNOUSERSITE=1` (`:730`) in the allow-list env; `-B` on **both** child
+commands (`:515` launcher, `:553` broker); `reject_pinned_bytecode` fails closed (`RuntimeError`) on any pre-existing
+`pinned/__pycache__` or `*.pyc` (`:498-501`) and is called **before each consumer** (`:535` launcher, `:562` broker).
+No unpinned `.pyc` can be executed.
+
+## B5 — 3-leg conjunction (still holds)
+
+`materialize_closure` reads launcher+helper+broker from **git-object bytes** (`git show <commit>:<path>`) and asserts
+`sha256 == pin` for each, fail-closed; `pinned/` is a fixture-private `0o700` dir inside the per-run fixture temp root;
+files created `O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC 0o600` (no chmod/rename/symlink gap → no writable window); each member
+re-hashed `== pin` immediately before its `Popen` (launcher; broker + helper). Launcher and broker consume the **same
+single** pinned helper. `closure_import_guard` AST-rejects any unpinned non-stdlib import.
+
+## Fidelity + traceability + carry-over (still hold)
+
+`GATED_WI_HEAD == f4008307` + `merge-base --is-ancestor 66b1e0a0 f4008307` (forward-contains). Extension bumps
+`generation-{sid}.state` via `MOSAIC_LEASE_GENERATION_FILE` (not in-mem); broker reads via `read_runtime_generation`;
+`assert_d4` observes the file-backed transition (`generation_source=="state-file"`, `state_file_drives_lifecycle`,
+`state_file_in_fixture_root`, new→`MUTATOR_UNVERIFIED`, prior→`STALE_GENERATION`); `.state` stays in the fixture temp
+root. `lease_anchor_registered` INTACT (event + `session_id_shape=="hex-256"`). LIVE-PATH drives the pinned gated
+launcher (no released `mosaic`/`execRuntime`). Fail-closed precondition before any launch. Single pinned p3 broker.
+Promotion=fixture-only. `--runs choices=(3,)`. `copy2` = creds-only. Allow-list env (0 `os.environ.copy`).
+
+## ABSENT sweep
+
+P5/P6/P2-bank/retry-launder/mosaic-yolo/execRuntime = 0; `source-invalid` = 0; no live/real-broker path; no `.state`
+outside the fixture root; no exec-at-import (`__main__`-guarded); no adjacency-only-exec-from-worktree; the only change
+is the authorized launcher-flag isolation fix (no mechanism change, no scope-widen); **`-O`-safe** (0 bare `assert`).
+
+## Verdict
+
+**PASS @ `1c34e3cb`.** The v8 FAIL is remediated by the narrow fix (launcher `-I` → `-s` + `PYTHONNOUSERSITE=1`),
+empirically verified to preserve `sys.path[0]=pinned/` so the pinned launcher's sibling import binds to the pinned
+helper; the broker retains `-I` (explicit-path import). B7, B8, B5, B6-rest, fidelity, traceability, and all carry-over
+bars remain intact; zero out-of-scope surface. **Findings: none.**
+
+## Scope reminder (not a finding)
+
+Producing this evidence **executes** the Gate0 mechanism (§3/§5). This review clears **bytes** only; **FIRE remains
+separately gated on Mos's explicit post-clear GO**, his byte-scope-verify co-attestation, and homelab's
+third-principal verify — not authorized by this review.
+
+---
+
+**Reviewer:** distinct Opus SECREV session (`ms-secrev-828` lane, dispatched by `mosaic-100`), Gate-16 author≠reviewer,
+byte review only; ran nothing.
+**Reviewed object (pin):** `1c34e3cb3172acdcd094e683e847d7c984afc96c` · harness sha256 `29e5c7bfbe1911b52984bd94c79036bb1200ee82588318367b13c2b1053a0103`.