From e6c3b830fdf360608ff02195ff08257fa489d391 Mon Sep 17 00:00:00 2001
From: ms-lead-reviewer <reviewer@mosaic.local>
Date: Sat, 18 Jul 2026 18:38:30 -0500
Subject: [PATCH] =?UTF-8?q?docs(827):=20Gate0=20Probe-3=20env+bytecode=20?=
 =?UTF-8?q?=C2=A73-review=20v8=20FAIL=20@a92ad090?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Independent Opus SECREV review (ms-secrev-828 lane, dispatched by mosaic-100;
Gate-16 author≠reviewer; byte-only; did not build).
Reviewed object = a92ad090ae3828c643f961c7628d809b8521185f
harness sha256 = 915ebeb5aeab108cb60c5f629c1db520623ab4914eed427ca34ee66f9aa08390
Verdict FAIL: B7 (broker env=allowlist not os.environ + -I) and B8
(PYTHONDONTWRITEBYTECODE + -B both children + __pycache__/.pyc reject
fail-closed) land correctly, BUT the -I added to the LAUNCHER command
(p3_d4_focused_run.py:512) breaks B6(c): launcher's bare
'from lease_generation import' (@f4008307 launch-runtime.py:15) cannot
resolve the pinned helper because -I implies -P (Py 3.11+) which strips the
script dir from sys.path — empirically confirmed on Python 3.11.2
(ModuleNotFoundError). Fix: drop -I from the launcher command (keep -B +
allow-list env); keep -I on the broker (explicit --generation-module import).
Byte review only; ran nothing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...ATE0-PROBE3-V8-ENVBYTECODE-S3-REVIEW-v8.md | 90 +++++++++++++++++++
 1 file changed, 90 insertions(+)
 create mode 100644 docs/compaction-refresh/reviews/GATE0-PROBE3-V8-ENVBYTECODE-S3-REVIEW-v8.md

diff --git a/docs/compaction-refresh/reviews/GATE0-PROBE3-V8-ENVBYTECODE-S3-REVIEW-v8.md b/docs/compaction-refresh/reviews/GATE0-PROBE3-V8-ENVBYTECODE-S3-REVIEW-v8.md
new file mode 100644
index 0000000..ecd0b47
--- /dev/null
+++ b/docs/compaction-refresh/reviews/GATE0-PROBE3-V8-ENVBYTECODE-S3-REVIEW-v8.md
@@ -0,0 +1,90 @@
+# Gate0 Probe-3 (D4) Broker Env-Isolation + Bytecode Binding — §3-Conformance Review v8
+
+**Verdict: ❌ FAIL** (B7 and B8 land correctly, but the same change breaks **B6(c)**: the launcher is run with `-I`, which strips the script directory from `sys.path` on Python 3.11+, so its bare `import lease_generation` cannot resolve the pinned helper — empirically confirmed).
+
+## Pin (GUARD 1 — reviewed object)
+
+- **Reviewed object = `a92ad090ae3828c643f961c7628d809b8521185f`** (harness commit, branch `feat/827-gate0-probe`).
+- **Reviewed file:** `docs/compaction-refresh/probes/p3_d4_focused_run.py` — sha256 (pushed provider bytes, `-o FILE`, FULL-40 ref, verified before trust): `915ebeb5aeab108cb60c5f629c1db520623ab4914eed427ca34ee66f9aa08390` (32614 bytes, no not-found sentinel).
+- **Closure pins (unchanged from v7):** launcher `e950e422…` @f4008307 · helper `061625402f08488eac47acd23272904e71fd1a71fd15b3bdab158632c801be4c` @f4008307 · broker `4db4fef1…` @23c0caca.
+
+## Independence (GUARD 2 — principal-independence attestation)
+
+Distinct Opus SECREV session, orchestrator-dispatched — the **`ms-secrev-828` reviewer lane, dispatched by
+`mosaic-100`** — **byte review only, ran nothing** (the harness/broker were not executed); did **not** build this
+harness (builder = ms-rev-826); is not Mos. This verdict is my own. (The `-I` semantics check below runs a *throwaway*
+two-line script to observe the interpreter's `sys.path` behavior — it does not run the harness, broker, or any part of
+the reviewed closure.)
+
+## 🔴 BLOCKING FINDING — B6(c) broken: `-I` on the launcher strips the pinned-helper import path
+
+**File:line — `p3_d4_focused_run.py:512`** (the `"-I"` added to `launch_verified_pi`'s launcher command).
+
+The pinned launcher `launch-runtime.py` @`f4008307` imports its helper with a **bare top-level import**:
+`from lease_generation import initialize_runtime_generation` (launcher line 15) — no `sys.path` manipulation. Under
+v7 this bound because `python3 pinned/launch-runtime.py` put the script's directory (`pinned/`) at `sys.path[0]`, so
+the sibling `lease_generation` resolved to `pinned/lease_generation.py`.
+
+v8 now runs the launcher as `python3 -I -B pinned/launch-runtime.py …` (:512-513). **`-I` implies `-P` (Python 3.11+),
+which does NOT prepend the script's directory to `sys.path`.** Empirically confirmed on this host (Python 3.11.2),
+using a throwaway script (not the harness):
+
+```
+python3 -I -B main.py  → sys.path[0] = '/usr/lib/python311.zip'
+                          import sibling → ModuleNotFoundError: No module named '…'
+python3    -B main.py  → sys.path[0] = '<script dir>'  → sibling import: OK
+```
+
+Therefore, at FIRE on Python 3.11+, the launcher's line-15 `from lease_generation import …` raises
+`ModuleNotFoundError` at module load — the pinned helper does **not** resolve (neither pinned nor worktree; the import
+simply fails). **B6(c) — "launcher sibling-import to `pinned/` via `sys.path[0]` STILL BINDS" — does not hold.** The
+build report's assertion "`-I` keeps script dir" is false on 3.11+, and could not have been observed under the
+correct "never run" boundary.
+
+Note: the env allow-list carries no `PYTHONPATH` (correct for B7), and `-I` ignores `PYTHON*` env regardless, so there
+is no alternate resolution path — the launcher import is unrecoverable under `-I`.
+
+**Fix:** remove `-I` from the **launcher** command only (keep `-B` + the `env=` allow-list — the launcher's
+env-isolation is already provided by the constructed allow-list, which contains no `PYTHONPATH`/`PYTHONHOME`/
+`PYTHONPYCACHEPREFIX`, and it needs `pinned/` at `sys.path[0]` for the sibling import). Keep `-I` on the **broker**
+command (it loads the helper by explicit `--generation-module` path via `importlib`, so it never needs the script
+dir on `sys.path`). Alternatively, inject the pinned dir explicitly (e.g. `PYTHONPATH=pinned/` — but that reintroduces
+a `PYTHON*` passthrough B7 forbids, so dropping `-I` on the launcher is the clean fix).
+
+## What DID land correctly (for the author's fast turnaround)
+
+- **B7 — broker child env-isolated: correct.** `launch_verified_broker` now takes `environment` and passes
+  `env=environment` (the constructed allow-list, **not** `os.environ`) to `Popen` (:566-568); the broker command
+  includes `-I` (:551); the allow-list contains no `PYTHONPATH`/`PYTHONHOME`/`PYTHONPYCACHEPREFIX` passthrough. The
+  broker child cannot inherit ambient env or resolve stdlib imports to ambient code. ✅
+- **B8 — bytecode pinned-or-suppressed: correct.** `PYTHONDONTWRITEBYTECODE=1` is in the allow-list env (:728) and
+  `-B` is on **both** child commands (:512-513 launcher, :551-552 broker); `reject_pinned_bytecode` fails closed
+  (`RuntimeError`) on any pre-existing `pinned/__pycache__` or `*.pyc` (:498-501) and is called **before each
+  consumer** (:534 launcher, :561 broker). No unpinned `.pyc` can be executed. ✅
+- **B5 conjunction / B6 single-helper / closure-import-guard / BAR1 / BAR2 (`.state` fidelity untouched) / BAR3
+  (live-path, fail-closed precondition, fixture-socket isolation, `lease_anchor_registered` + hex-256) / single p3
+  broker / `-O`-safe / allow-list env / `--runs==(3,)` / ABSENT sweep:** all intact/unperturbed (the delta touches only
+  the env/`-I`/`-B`/bytecode-reject surfaces). These are **not** the failing item.
+
+## Verdict
+
+**FAIL @ `a92ad090`.** B7 (broker env isolation) and B8 (bytecode pinned-or-suppressed) are correctly implemented,
+but the `-I` added to the **launcher** command breaks B6(c): the launcher's bare `from lease_generation import` at
+`f4008307:launch-runtime.py:15` cannot resolve the pinned helper because `-I`/`-P` strips `sys.path[0]` on Python
+3.11+ (empirically confirmed, 3.11.2 → `ModuleNotFoundError`). PASS requires **all** of B7+B8+B5+B6+BAR1/2/3; B6(c)
+does not hold. Not softened → returns to author (ms-rev-826). The fix is narrow: drop `-I` from the launcher command
+(retain `-B` + allow-list env), keep `-I` on the broker.
+
+**Findings:** B6(c) — `p3_d4_focused_run.py:512` (`-I` on the launcher command; breaks the pinned-helper sibling
+import under Python 3.11+).
+
+## Scope reminder (not a finding)
+
+Producing this evidence **executes** the Gate0 mechanism (§3/§5). This review clears **bytes** only; FIRE remains
+separately gated on Mos's post-clear GO — moot until this FAIL is remediated.
+
+---
+
+**Reviewer:** distinct Opus SECREV session (`ms-secrev-828` lane, dispatched by `mosaic-100`), Gate-16 author≠reviewer,
+byte review only; ran nothing (harness/broker not executed).
+**Reviewed object (pin):** `a92ad090ae3828c643f961c7628d809b8521185f` · harness sha256 `915ebeb5aeab108cb60c5f629c1db520623ab4914eed427ca34ee66f9aa08390`.