From f320d075df1737933e4a3ece0e85c9401b03d1fa Mon Sep 17 00:00:00 2001 From: mos-orchestrator Date: Sat, 18 Jul 2026 18:52:56 -0500 Subject: [PATCH] co-attest: probe-3 v9 byte-scope-verify PASS (full-closure + B7 broker-env-iso + B8 bytecode-pinned); supersedes e08ad03/2ae379e --- .../reviews/GATE0-PROBE3-MOS-COATTEST-v9.md | 105 ++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v9.md diff --git a/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v9.md b/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v9.md new file mode 100644 index 00000000..458927de --- /dev/null +++ b/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v9.md @@ -0,0 +1,105 @@ +# GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v9 full-closure, env-isolated + bytecode-pinned) + +**Principal:** Mos (orchestrator, merge authority for the mosaic-stack governance lane). +**Committed under a DISTINCT git identity** (`mos-orchestrator@mosaic.local`) — deliberately NOT the +`ms-lead-reviewer@mosaic.local` lane signer that authored the harness and the §3 review — so this +record stands as a *distinct-identity* co-attestation. See "Independence". + +**Verify class:** independent provider-byte read (`git show :path | sha256sum`) plus +source-level inspection of the executed mechanism and the v7→v9 delta. Not a re-build, not a re-run. +This SUPERSEDES the v7 co-attestation `e08ad03` (and its SUPERSEDED note `2ae379e`), which was +byte-clear on the v7 bar and was overtaken by homelab's third-principal FAIL @f609a449 (broker +env-isolation + executed-bytecode-cache) and the resulting B7/B8 bar. + +## Package under attestation + +| Artifact | Ref | +|---|---| +| Branch | `feat/827-gate0-probe` | +| Harness commit-40 | `1c34e3cb3172acdcd094e683e847d7c984afc96c` | +| Harness `p3_d4_focused_run.py` sha256 | `29e5c7bfbe1911b52984bd94c79036bb1200ee82588318367b13c2b1053a0103` (32725 B) | +| §3-review-v9 commit-40 | `e1c9a4682da2892ca5f5381012caffe1dd7b43a7` (parent == harness `1c34e3cb`, byte-stable; adds only the review `.md`; ms-secrev-828 authored) | +| Review path | `docs/compaction-refresh/reviews/GATE0-PROBE3-V9-LAUNCHERFIX-S3-REVIEW-v9.md` | + +**Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins == embedded harness constants):** + +| Member | Source (commit:path) | Pin sha256 | Size | +|---|---|---|---| +| launcher `launch-runtime.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py` | `e950e422…` | 4237 B | +| helper `lease_generation.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py` | `061625402f…` | 3769 B | +| broker `p3_generation_broker.py` | `23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py` | `4db4fef1…` | — | + +> `f4008307` (held WI-3 #830 gated head) is **not on origin** — recomputed launcher+helper from the +> local `stack-cr-wi3-revoke` worktree (HEAD == `f4008307`); broker from origin `23c0caca`. + +## Findings — VERDICT: byte-scope + mechanism + hygiene **PASS** (v9 = v7 full-closure + B7 + B8) + +The v7→v9 delta is **exactly 22 insertions / 2 deletions**, confined to the intended B7+B8+B6c +surface; every prior invariant is byte-stable (outside the delta) from the v7 verify. + +**B7 — broker child env-ISOLATED (homelab finding 1 CLOSED).** `launch_verified_broker` (`:568`) now +passes `env=environment` (the strict allow-list, `:570`) — the ambient-`os.environ`-inheritance hole +is gone — AND runs the broker with `-I` (`:552`, isolated: ignores `PYTHON*`/user-site) + `-B` +(`:553`). Both children are env-controlled: the launcher was already `env=env` at `PiRpc` (`:53`). + +**B8 — executed bytecode PINNED/SUPPRESSED (homelab finding 2 CLOSED).** `reject_pinned_bytecode` +(`:498`) raises `RuntimeError` fail-closed if a `__pycache__` dir or any `*.pyc` exists in the pinned +dir, and is called before **each** consumer (launcher `:535`, broker `:562`). Bytecode writes are +disabled via `PYTHONDONTWRITEBYTECODE=1` (`:729`) in the allow-list env **and** `-B` on both command +lines. No unpinned `.pyc` can be executed; only the pinned `.py` re-hash governs. + +**B6c — launcher sibling-import PRESERVED (v8 regression FIXED).** v8 over-applied `-I` to the +launcher; on Py3.11+ `-I` implies `-P`, dropping the script dir from `sys.path[0]`, so the pinned +launcher's bare `from lease_generation import` (launch-runtime.py:15) would `ModuleNotFoundError`. v9 +uses `-s` (`:514`) + `-B` (`:515`) on the launcher (NO `-I`) — neither touches `sys.path[0]`, so the +sibling import still resolves to `pinned/lease_generation.py`. **Mos empirically re-verified on host +Py3.11.2** (throwaway, not the harness): `-I` launcher → `ModuleNotFoundError`; `-s`+`PYTHONNOUSERSITE` +→ import OK. The launcher's env isolation comes from the `PiRpc` `env=` allow-list, NOT `-I`, so +dropping `-I` does **not** reopen B7. My earlier constraint-(c) assumption ("`-I` does not strip the +script dir") was FALSIFIED for 3.11+; the author≠reviewer gate (ms-secrev-828) caught it — recorded. + +**B5 conjunction (load-bearing repair) — HELD, all three legs (byte-stable from v7):** +(a) materialized from pinned git-object bytes via `materialize_closure`/`git_object_bytes`, `sha256==pin` +fail-closed; (b) `pinned/` `mkdir(0o700)` + `O_EXCL|O_CLOEXEC` `0o600`, no writable window — now also +`reject_pinned_bytecode` closes the `.pyc` side-channel; (c) re-hash == pin IMMEDIATELY before each +exec, no interleaved yield: launcher re-hash (`:538`) → `return PiRpc(command,…)` whose `__init__` +first statement is `Popen` (`:50`); broker re-hash (`:563`) + helper re-hash (`:566`) → `Popen` +(`:568`) on the next line. + +**B6 — single pinned helper, complete closure.** Broker gets `--generation-module {closure.generation}`; +launcher resolves `import lease_generation` to the sibling pinned copy via `sys.path[0]`. +`closure_import_guard` (`:351`, called `:433`) AST-rejects any non-stdlib import other than +`lease_generation`. Single broker: `launch_verified_broker` 1 def (`:543`) + 1 call (`:766`). + +**Invariants (all INTACT):** BAR1 `GATED_WI_HEAD == f4008307` (`:36`) and `merge-base --is-ancestor +66b1e0a0 f4008307` = YES (file-backed `.state` revocation fidelity present); fidelity +`generation_source=='state-file'` (`:639`), `state_file_in_fixture_root` (`:641`), +`MUTATOR_UNVERIFIED` (`:650`), `STALE_GENERATION` (`:651`); `lease_anchor_registered` (`:593`); +`-O`-safe (0 bare `assert`); `--runs choices=(3,)` (`:838`); allow-list env (0 `os.environ.copy`); +ABSENT-sweep (`yolo`/`execRuntime`/`p3_bank`/`promote_p2`/`retry`) = 0; the only `shutil.copy2` +(`:708`) is the `.pi/agent` credential copy, not a closure copy. + +**Closure = exactly 3 files, materialized inside the fixture root.** No path escapes the fixture temp +root; no live/default broker; `.state` fixture-bound. **R1 owner tripwire NOT tripped** — B7/B8 +deepen isolation/binding of an already-authorized touch, they do not widen the touched surface. + +## Independence + +Substantive principal-independence of review-v9 is satisfied by an orchestrator-dispatched, +builder-distinct Opus SECREV (`ms-secrev-828`, byte-only, non-builder, non-Mos). The shared +`ms-lead-reviewer` git signer on harness+review commits is evidentiary, not substantive — resolved by +(1) this Mos co-attestation under a **distinct** identity (`mos-orchestrator`) and (2) a homelab +third-principal verify under its own distinct identity = three distinct-identity principals of record. +Shared signer = tracked fleet-infra tooling-gap (durable fix = per-lane distinct signers), not a blocker. + +## Scope of this record — byte-clear, NOT fire-authorization + +Producing probe evidence **executes** the Gate0 mechanism; a byte-clear is not a fire-authorization. +This clears **bytes / scope / mechanism / hygiene on the v9 (full-closure + B7 + B8) bar**. FIRE +remains gated on: **homelab third-principal re-verify** (4th round, own distinct identity) + **Mos +transparency-to-Jason** + **Mos explicit FIRE GO**. Until then: nothing banked, WI-3 #830 held at +`f4008307` (unmoved), C-hatch armed (materialized-closure rig still no-fire / wrong-value / +assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason). + +**Mos verdict: v9 full-closure + B7 + B8 byte-scope + mechanism + hygiene PASS. Co-attestation of +record — committed.**