# M20-I2-PUBLICATION-GATES-FILBERT-1 (#1500) — regression applicability verdict

Reviewer: Filbert. Candidate unchanged at manifest `11255dd4…`; execution in a disposable baseline `27e4873a` + reviewed-overlay tree with clean HOME and scrubbed `MOSAIC_*` environment. No real Pi, credentials, network model calls, Docker builds/releases, services, source edits, commits, or shared logs. This verdict owns regression applicability/reconciliation feedback; publication decisions remain the coordinator's and the owner's.

## Independently executed, exact reviewed overlay

- **Foundation:** `scripts/test-foundation.sh` — 43 passed, 0 failed. Inspected first: sandboxed mkdtemp, synthetic fixtures, subprocess spawns of the inspector only, canary non-disclosure checks; no Docker/network/credential surface.
- **Conductor:** `scripts/test-conductor.sh` — 17 passed, 0 failed. Inspected first: all git operations target sandbox clones with a sandbox config and mock adapter. Two failures during my runs were artifacts of my own disposable method, documented for the record: an archive tree lacks `.git` (fixed with a scratch init) and a scrubbed HOME lacks the git identity the apply step needs (fixed with explicit identity env). Neither touched the candidate.
- **Config:** 24/24; **Auth:** 15/15 — both in the isolated environment. Package+launcher 74/74 was reproduced in this same overlay tree during the final increment review.

These four gates are satisfied by independent evidence on the exact reviewed bytes.

## Not executed, with source evidence

- **test-task.sh** requires the real container path with a real model and live Pi recall ("Live recall: real pi, real phrasing", the unconditional block at lines ~480+). Executing it would exceed this review's authorization (real Docker, model calls, credentials). Applicability analysis instead:
  - Nothing outside the package references it: no `packages/mosaic`/`@mosaic/registry` import exists in `scripts/`, `src/`, `compose.yaml`, or the root manifest. The fixture-only package is unintegrated; the task pipeline cannot execute any changed code.
  - The suite's one failing check ("no agent identity on headless run") predates this work entirely — increment 1 recorded byte-identical failure parity at stashed baseline `54c12312`.
  - The mechanism is now independently reproduced by me, not just asserted: `compose.yaml:26` forwards host `MOSAIC_AGENT_NAME` into the container, and `src/load-contracts.sh` emits an `AGENT IDENTITY` section if and only if that variable is set (my synthetic control: set → section present; unset → absent). The variable is present in the host environment. The historical failure is host-environment contamination through compose, unrelated to this package; its fix (env hygiene in the task launch path) is separate scoped work.
- **test-release.sh** with Docker available (it is up on this host) takes the real-activation path: image builds and activation drills. The increment's diff is `packages/mosaic` plus review documents only — no `RELEASE`, compose, scripts, or packaging-surface change — and image rebuild is out of charter scope. The release-relevant surface (the pi pin) was last changed in increment 1, whose release run was independently green at that candidate and is published.

## Recommendation — owner disposition required, no waiver

The charter's task and release gates cannot be satisfied by offline evidence for this slice, and I do not waive them. Two honest paths, either of which needs an explicit owner record before publication:

1. **Task gate:** record that the suite is not applicable to this unintegrated fixture-only package (zero shared code paths), that its single failure is pre-existing with a now-reproduced contamination mechanism and a separately scoped fix, and that a full rerun requires an authorized Docker/model window if the owner wants end-to-end evidence.
2. **Release gate:** record that the release surface is unchanged since increment 1's green run and image rebuild is out of scope — or, if the owner wants release evidence against the integrated tree, authorize a Docker window for the real-activation suite.

A silent "baseline waiver" would be the wrong record: it would paper over a real, reproduced environment leak that deserves its own fix task regardless of this increment.

## Bottom line

Foundation, conductor, config, auth, package, and launcher gates: green by independent rerun on the exact reviewed overlay. Task and release: not executable within this review's safety envelope; applicability is documented above with source evidence and a reproduced mechanism; the owner should choose the disposition path before publication. Production refresh remains excluded.