co-attest: probe-3 v9 byte-scope-verify PASS (full-closure + B7 broker-env-iso + B8 bytecode-pinned); supersedes e08ad03/2ae379e

docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v9.md

@@ -0,0 +1,105 @@
+# GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v9 full-closure, env-isolated + bytecode-pinned)
+
+**Principal:** Mos (orchestrator, merge authority for the mosaic-stack governance lane).
+**Committed under a DISTINCT git identity** (`mos-orchestrator@mosaic.local`) — deliberately NOT the
+`ms-lead-reviewer@mosaic.local` lane signer that authored the harness and the §3 review — so this
+record stands as a *distinct-identity* co-attestation. See "Independence".
+
+**Verify class:** independent provider-byte read (`git show <full-40>:path | sha256sum`) plus
+source-level inspection of the executed mechanism and the v7→v9 delta. Not a re-build, not a re-run.
+This SUPERSEDES the v7 co-attestation `e08ad03` (and its SUPERSEDED note `2ae379e`), which was
+byte-clear on the v7 bar and was overtaken by homelab's third-principal FAIL @f609a449 (broker
+env-isolation + executed-bytecode-cache) and the resulting B7/B8 bar.
+
+## Package under attestation
+
+| Artifact | Ref |
+|---|---|
+| Branch | `feat/827-gate0-probe` |
+| Harness commit-40 | `1c34e3cb3172acdcd094e683e847d7c984afc96c` |
+| Harness `p3_d4_focused_run.py` sha256 | `29e5c7bfbe1911b52984bd94c79036bb1200ee82588318367b13c2b1053a0103` (32725 B) |
+| §3-review-v9 commit-40 | `e1c9a4682da2892ca5f5381012caffe1dd7b43a7` (parent == harness `1c34e3cb`, byte-stable; adds only the review `.md`; ms-secrev-828 authored) |
+| Review path | `docs/compaction-refresh/reviews/GATE0-PROBE3-V9-LAUNCHERFIX-S3-REVIEW-v9.md` |
+
+**Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins == embedded harness constants):**
+
+| Member | Source (commit:path) | Pin sha256 | Size |
+|---|---|---|---|
+| launcher `launch-runtime.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py` | `e950e422…` | 4237 B |
+| helper `lease_generation.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py` | `061625402f…` | 3769 B |
+| broker `p3_generation_broker.py` | `23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py` | `4db4fef1…` | — |
+
+> `f4008307` (held WI-3 #830 gated head) is **not on origin** — recomputed launcher+helper from the
+> local `stack-cr-wi3-revoke` worktree (HEAD == `f4008307`); broker from origin `23c0caca`.
+
+## Findings — VERDICT: byte-scope + mechanism + hygiene **PASS** (v9 = v7 full-closure + B7 + B8)
+
+The v7→v9 delta is **exactly 22 insertions / 2 deletions**, confined to the intended B7+B8+B6c
+surface; every prior invariant is byte-stable (outside the delta) from the v7 verify.
+
+**B7 — broker child env-ISOLATED (homelab finding 1 CLOSED).** `launch_verified_broker` (`:568`) now
+passes `env=environment` (the strict allow-list, `:570`) — the ambient-`os.environ`-inheritance hole
+is gone — AND runs the broker with `-I` (`:552`, isolated: ignores `PYTHON*`/user-site) + `-B`
+(`:553`). Both children are env-controlled: the launcher was already `env=env` at `PiRpc` (`:53`).
+
+**B8 — executed bytecode PINNED/SUPPRESSED (homelab finding 2 CLOSED).** `reject_pinned_bytecode`
+(`:498`) raises `RuntimeError` fail-closed if a `__pycache__` dir or any `*.pyc` exists in the pinned
+dir, and is called before **each** consumer (launcher `:535`, broker `:562`). Bytecode writes are
+disabled via `PYTHONDONTWRITEBYTECODE=1` (`:729`) in the allow-list env **and** `-B` on both command
+lines. No unpinned `.pyc` can be executed; only the pinned `.py` re-hash governs.
+
+**B6c — launcher sibling-import PRESERVED (v8 regression FIXED).** v8 over-applied `-I` to the
+launcher; on Py3.11+ `-I` implies `-P`, dropping the script dir from `sys.path[0]`, so the pinned
+launcher's bare `from lease_generation import` (launch-runtime.py:15) would `ModuleNotFoundError`. v9
+uses `-s` (`:514`) + `-B` (`:515`) on the launcher (NO `-I`) — neither touches `sys.path[0]`, so the
+sibling import still resolves to `pinned/lease_generation.py`. **Mos empirically re-verified on host
+Py3.11.2** (throwaway, not the harness): `-I` launcher → `ModuleNotFoundError`; `-s`+`PYTHONNOUSERSITE`
+→ import OK. The launcher's env isolation comes from the `PiRpc` `env=` allow-list, NOT `-I`, so
+dropping `-I` does **not** reopen B7. My earlier constraint-(c) assumption ("`-I` does not strip the
+script dir") was FALSIFIED for 3.11+; the author≠reviewer gate (ms-secrev-828) caught it — recorded.
+
+**B5 conjunction (load-bearing repair) — HELD, all three legs (byte-stable from v7):**
+(a) materialized from pinned git-object bytes via `materialize_closure`/`git_object_bytes`, `sha256==pin`
+fail-closed; (b) `pinned/` `mkdir(0o700)` + `O_EXCL|O_CLOEXEC` `0o600`, no writable window — now also
+`reject_pinned_bytecode` closes the `.pyc` side-channel; (c) re-hash == pin IMMEDIATELY before each
+exec, no interleaved yield: launcher re-hash (`:538`) → `return PiRpc(command,…)` whose `__init__`
+first statement is `Popen` (`:50`); broker re-hash (`:563`) + helper re-hash (`:566`) → `Popen`
+(`:568`) on the next line.
+
+**B6 — single pinned helper, complete closure.** Broker gets `--generation-module {closure.generation}`;
+launcher resolves `import lease_generation` to the sibling pinned copy via `sys.path[0]`.
+`closure_import_guard` (`:351`, called `:433`) AST-rejects any non-stdlib import other than
+`lease_generation`. Single broker: `launch_verified_broker` 1 def (`:543`) + 1 call (`:766`).
+
+**Invariants (all INTACT):** BAR1 `GATED_WI_HEAD == f4008307` (`:36`) and `merge-base --is-ancestor
+66b1e0a0 f4008307` = YES (file-backed `.state` revocation fidelity present); fidelity
+`generation_source=='state-file'` (`:639`), `state_file_in_fixture_root` (`:641`),
+`MUTATOR_UNVERIFIED` (`:650`), `STALE_GENERATION` (`:651`); `lease_anchor_registered` (`:593`);
+`-O`-safe (0 bare `assert`); `--runs choices=(3,)` (`:838`); allow-list env (0 `os.environ.copy`);
+ABSENT-sweep (`yolo`/`execRuntime`/`p3_bank`/`promote_p2`/`retry`) = 0; the only `shutil.copy2`
+(`:708`) is the `.pi/agent` credential copy, not a closure copy.
+
+**Closure = exactly 3 files, materialized inside the fixture root.** No path escapes the fixture temp
+root; no live/default broker; `.state` fixture-bound. **R1 owner tripwire NOT tripped** — B7/B8
+deepen isolation/binding of an already-authorized touch, they do not widen the touched surface.
+
+## Independence
+
+Substantive principal-independence of review-v9 is satisfied by an orchestrator-dispatched,
+builder-distinct Opus SECREV (`ms-secrev-828`, byte-only, non-builder, non-Mos). The shared
+`ms-lead-reviewer` git signer on harness+review commits is evidentiary, not substantive — resolved by
+(1) this Mos co-attestation under a **distinct** identity (`mos-orchestrator`) and (2) a homelab
+third-principal verify under its own distinct identity = three distinct-identity principals of record.
+Shared signer = tracked fleet-infra tooling-gap (durable fix = per-lane distinct signers), not a blocker.
+
+## Scope of this record — byte-clear, NOT fire-authorization
+
+Producing probe evidence **executes** the Gate0 mechanism; a byte-clear is not a fire-authorization.
+This clears **bytes / scope / mechanism / hygiene on the v9 (full-closure + B7 + B8) bar**. FIRE
+remains gated on: **homelab third-principal re-verify** (4th round, own distinct identity) + **Mos
+transparency-to-Jason** + **Mos explicit FIRE GO**. Until then: nothing banked, WI-3 #830 held at
+`f4008307` (unmoved), C-hatch armed (materialized-closure rig still no-fire / wrong-value /
+assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason).
+
+**Mos verdict: v9 full-closure + B7 + B8 byte-scope + mechanism + hygiene PASS. Co-attestation of
+record — committed.**