stack/docs/compaction-refresh/reviews/GATE0-PROBE3-V9-LAUNCHERFIX-S3-REVIEW-v9.md

⚠ SUPERSEDED: homelab 4th-round FAIL @1c34e3cb — no -S → Python imports site at startup, running unpinned system-site .pth executable lines + sitecustomize/usercustomize before the pinned launcher/broker (site startup-closure hole). This v9 PASS record is overtaken by the stricter B9 (no-site) bar and is NOT fire-authorization; superseded by v10.

Gate0 Probe-3 (D4) Launcher-Import Fix — §3-Conformance Review v9

Verdict: ✅ PASS (superseded — see banner above)

Pin (GUARD 1 — reviewed object)

• Reviewed object = 1c34e3cb3172acdcd094e683e847d7c984afc96c (harness commit, branch feat/827-gate0-probe).
• Reviewed file: docs/compaction-refresh/probes/p3_d4_focused_run.py — sha256 (pushed provider bytes, -o FILE, FULL-40 ref, verified before trust): 29e5c7bfbe1911b52984bd94c79036bb1200ee82588318367b13c2b1053a0103 (32725 bytes, no not-found sentinel).
• Closure pins (unchanged): launcher e950e422… @f4008307 · helper 061625402f08488eac47acd23272904e71fd1a71fd15b3bdab158632c801be4c @f4008307 · broker 4db4fef1… @23c0caca.

Independence (GUARD 2 — principal-independence attestation)

Distinct Opus SECREV session, orchestrator-dispatched — the ms-secrev-828 reviewer lane, dispatched by mosaic-100 — byte review only, ran nothing (harness/broker not executed); did not build this harness (builder = ms-rev-826); is not Mos. This is the re-review after my own v8 FAIL @a92ad090 (B6(c): -I on the launcher broke the sibling import); the author applied the narrow fix and I verify it here. The -s/-I sys.path checks below use a throwaway two-line script to observe interpreter behavior — not the harness/broker/closure.

★ B6(c) — THE FIX (was the v8 FAIL): launcher -I dropped; sibling import binds to pinned/

The launcher command no longer carries -I; it now uses -s (:514, commented "-s preserves sys.path[0]=pinned/ for the launcher's sibling helper") + -B (:515), and PYTHONNOUSERSITE=1 is added to the allow-list env (:730).

-s and PYTHONNOUSERSITE disable user site-packages only — they do not strip the script's directory from sys.path (unlike -I/-P). Empirically confirmed on this host (Python 3.11.2), throwaway script:

python3 -s -B main.py                       → sys.path[0] = '<script dir>'  → sibling import: OK
PYTHONNOUSERSITE=1 python3 -s -B main.py     → sys.path[0] = '<script dir>'  → sibling import: OK
python3 -I -B main.py   (the v8 FAIL form)   → sys.path[0] = stdlib zip     → ModuleNotFoundError

Therefore python3 -s -B pinned/launch-runtime.py … puts pinned/ at sys.path[0], so the pinned launcher's bare top-level from lease_generation import initialize_runtime_generation (f4008307:launch-runtime.py:15, no sys.path manipulation) resolves to the pinned pinned/lease_generation.py — not the worktree, not a miss. B6(c) holds.

B7 — Broker env-isolation (still holds)

launch_verified_broker passes env=environment (the constructed allow-list, not os.environ; contains no PYTHONPATH/PYTHONHOME/PYTHONPYCACHEPREFIX) to Popen (:570), and the broker command includes -I (:552). The broker imports the helper by explicit --generation-module path via importlib, so it never needs sys.path[0] — -I is correct there and does not affect it. (The env's PYTHONNOUSERSITE/PYTHONDONTWRITEBYTECODE are hardening flags, not path/home passthrough, and -I ignores all PYTHON* env anyway.)

B8 — Bytecode pinned-or-suppressed (still holds)

PYTHONDONTWRITEBYTECODE=1 (:729) and PYTHONNOUSERSITE=1 (:730) in the allow-list env; -B on both child commands (:515 launcher, :553 broker); reject_pinned_bytecode fails closed (RuntimeError) on any pre-existing pinned/__pycache__ or *.pyc (:498-501) and is called before each consumer (:535 launcher, :562 broker). No unpinned .pyc can be executed.

B5 — 3-leg conjunction (still holds)

materialize_closure reads launcher+helper+broker from git-object bytes (git show <commit>:<path>) and asserts sha256 == pin for each, fail-closed; pinned/ is a fixture-private 0o700 dir inside the per-run fixture temp root; files created O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC 0o600 (no chmod/rename/symlink gap → no writable window); each member re-hashed == pin immediately before its Popen (launcher; broker + helper). Launcher and broker consume the same single pinned helper. closure_import_guard AST-rejects any unpinned non-stdlib import.

Fidelity + traceability + carry-over (still hold)

GATED_WI_HEAD == f4008307 + merge-base --is-ancestor 66b1e0a0 f4008307 (forward-contains). Extension bumps generation-{sid}.state via MOSAIC_LEASE_GENERATION_FILE (not in-mem); broker reads via read_runtime_generation; assert_d4 observes the file-backed transition (generation_source=="state-file", state_file_drives_lifecycle, state_file_in_fixture_root, new→MUTATOR_UNVERIFIED, prior→STALE_GENERATION); .state stays in the fixture temp root. lease_anchor_registered INTACT (event + session_id_shape=="hex-256"). LIVE-PATH drives the pinned gated launcher (no released mosaic/execRuntime). Fail-closed precondition before any launch. Single pinned p3 broker. Promotion=fixture-only. --runs choices=(3,). copy2 = creds-only. Allow-list env (0 os.environ.copy).

ABSENT sweep

P5/P6/P2-bank/retry-launder/mosaic-yolo/execRuntime = 0; source-invalid = 0; no live/real-broker path; no .state outside the fixture root; no exec-at-import (__main__-guarded); no adjacency-only-exec-from-worktree; the only change is the authorized launcher-flag isolation fix (no mechanism change, no scope-widen); -O-safe (0 bare assert).

Verdict

PASS @ 1c34e3cb. The v8 FAIL is remediated by the narrow fix (launcher -I → -s + PYTHONNOUSERSITE=1), empirically verified to preserve sys.path[0]=pinned/ so the pinned launcher's sibling import binds to the pinned helper; the broker retains -I (explicit-path import). B7, B8, B5, B6-rest, fidelity, traceability, and all carry-over bars remain intact; zero out-of-scope surface. Findings: none.

Scope reminder (not a finding)

Producing this evidence executes the Gate0 mechanism (§3/§5). This review clears bytes only; FIRE remains separately gated on Mos's explicit post-clear GO, his byte-scope-verify co-attestation, and homelab's third-principal verify — not authorized by this review.

---

Reviewer: distinct Opus SECREV session (ms-secrev-828 lane, dispatched by mosaic-100), Gate-16 author≠reviewer, byte review only; ran nothing. Reviewed object (pin): 1c34e3cb3172acdcd094e683e847d7c984afc96c · harness sha256 29e5c7bfbe1911b52984bd94c79036bb1200ee82588318367b13c2b1053a0103.