stack/docs/compaction-refresh/reviews/GATE0-PROBE3-V7-FULLCLOSURE-S3-REVIEW-v7.md

Gate0 Probe-3 (D4) Full-Closure Materialization — §3-Conformance Review v7

Verdict: ✅ PASS

Pin (GUARD 1 — reviewed object)

• Reviewed object = f609a44953f5ae61916805fcb45ca337de00b0b0 (harness commit, branch feat/827-gate0-probe).
• Reviewed file: docs/compaction-refresh/probes/p3_d4_focused_run.py — sha256 (pushed provider bytes, -o FILE, FULL-40 ref, verified before trust): 0f1bd1b39399b32f243d901230e2d840794a2144edd723a095dab716833a7a9b (32071 bytes, no not-found sentinel).
• Closure pins (independently recomputed from the git objects):
  • launcher packages/mosaic/framework/tools/lease-broker/launch-runtime.py @ f4008307 = e950e4224e280f16979d90cabb89aa1896c5ee28bed2df957e14d018d43cda82 ✓
  • helper packages/mosaic/framework/tools/lease-broker/lease_generation.py @ f4008307 = 061625402f08488eac47acd23272904e71fd1a71fd15b3bdab158632c801be4c ✓
  • broker docs/compaction-refresh/probes/p3_generation_broker.py @ 23c0caca = 4db4fef1ac6658a8ca79ad5091cefc901d2aa26003265c3d6726c294cf895cad ✓

Independence (GUARD 2 — principal-independence attestation)

This review is produced by a distinct Opus SECREV session, orchestrator-dispatched — the ms-secrev-828 reviewer lane, dispatched by mosaic-100 — byte review only, ran nothing, that did NOT build this harness (builder = ms-rev-826) and is not Mos. Three distinct principals: this reviewer, the builder, and Mos (whose own distinct-identity byte-scope-verify follows); homelab's independent verify is a further principal — it is homelab's third-principal FAIL @2d54a9dd (upheld by Mos) that correctly retired the approach-(i) adjacency re-hash and authorized this full-closure. v6/2d54a9dd/23c0caca/12914d8 are superseded.

Why v7 (the reopen-after-hash hole)

Approach (i) re-hashed the launcher then let Popen reopen the worktree path — hashed-snapshot ≠ executed-bytes (the worktree file is a shared, same-UID-mutable path). Statement adjacency alone did not bind. v7 closes it for the full project-code closure (launcher + lease_generation.py helper + p3_generation_broker.py).

B5 — HASHED == EXECUTED on the full closure (binding conjunction, stated verbatim)

The reopen-after-hash shape is unavoidable for imported/exec'd files, so closure rests on the conjunction of all three legs, each byte-verified here:

(a) bytes are materialized from the pinned git-object @ f4008307 (helper/launcher) and @ 23c0caca (broker) — git show <commit>:<path>, the trusted immutable object, never the mutable worktree file; AND (b) into a fixture-private 0o700 dir with 0o600 files created via O_CREAT|O_EXCL — no writer exists in the threat model between hash and exec; AND (c) each member is re-hashed == its pin IMMEDIATELY before exec/import, fail-closed (RuntimeError).

Byte evidence:

• (a) git_object_bytes(git_root, commit, relative) = git show <commit>:<path> (:322-327); materialize_closure reads all three members from git objects and asserts sha256(data) == digest else RuntimeError (:415-433). Worktree working-tree files are never read.
• (b) pinned = root / "pinned"; pinned.mkdir(mode=0o700) (:435-436); write_pinned_file uses os.open(path, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0o600) (:379-382). No os.chmod/os.rename/shutil.move anywhere (grep=0); O_EXCL refuses a pre-planted file/symlink, so no symlink-follow or hijack gap; the dir is a fresh per-run mkdtemp child, owner-only. No code re-opens the pinned files for write between materialize and consume — there is no writable window.
• (c) launcher re-hash sha256(launcher.read_bytes()) == GATED_LAUNCHER_SHA256 is the statement immediately before return PiRpc(command,…) (:528-530); broker and helper re-hashes (== GATED_BROKER_SHA256, == GATED_GENERATION_SHA256) are the two statements immediately before return subprocess.Popen(command,…) (:546-551). No interleaved harness yield.

Adjacency-only exec-from-worktree is absent for every member (all three exec/import from pinned/; grep worktree-exec=0).

B6 — helper + broker pinned and bound to execution (one shared helper)

materialize_closure writes exactly one pinned/lease_generation.py (:442). The broker executes the pinned broker with --generation-module = closure.generation = that pinned helper (launch_verified_broker, :533-551, called :746-747). The launcher executes the pinned launcher (python3 pinned/launch-runtime.py), whose import lease_generation resolves via sys.path[0] = the script's own pinned/ dir to the same sibling pinned/lease_generation.py. Launcher-import and broker---generation-module therefore resolve the same single pinned helper copy, not two copies and not the worktree. Worktree helper/broker are not re-read at runtime.

Closure-import guard: closure_import_guard AST-parses each member and refuses any non-stdlib import outside the allow-set {"lease_generation"} (and any relative import) → RuntimeError (:341-364). The 3-member closure is therefore provably complete — no unpinned project-code dependency can slip in.

BAR1 — Traceability

GATED_WI_HEAD == f4008307; the precondition asserts git merge-base --is-ancestor 66b1e0a0 f4008307 (:315-330), independently confirmed YES — the pinned launcher forward-contains the 66b1e0a0 file-backed generation mechanism.

BAR2 — Fidelity file-backed, .state in fixture root, UNTOUCHED

pinned/ holds code bytes only (launcher/helper/broker). The .state generation file is written by the launcher to socket_path.parent (the fixture root), not pinned/. The broker (pinned, byte-identical 4db4fef1) still enforces generation_environment raising if state_path.parent != socket_path.parent (grep=2), and assert_d4 still checks state_file_source == "state-file" / state_file_drives_lifecycle / state_file_in_fixture_root + new→MUTATOR_UNVERIFIED / prior→STALE_GENERATION (grep=4, unchanged). The v7 change did not move .state into pinned/ or perturb these asserts.

BAR3 — Carry-over

(a) live-path: Pi launched via python3 pinned/launch-runtime.py --runtime pi -- pi … (gated register-before-exec); mosaic yolo/execRuntime = 0. (b) fail-closed precondition: gated_launcher_precondition (resolve+materialize+ verify) runs before any launch, fail-closed. (c) fixture-socket isolation: MOSAIC_LEASE_BROKER_SOCKET = per-run fixture socket; single pinned p3 broker serves register_anchor; no live/default broker reachable; non-destructive. (d) lease_anchor_registered INTACT: event + session_id_shape=="hex-256" unchanged (broker byte-identical); assert_d4 folds it into the single-identity set — not deleted/softened/optional/repointed.

Re-confirm + ABSENT sweep

Spawns ONLY the single pinned p3 broker; promotion=fixture-only; full D4 asserts; --runs choices=(3,); allow-list env (0 os.environ.copy); -O-safe (all new checks RuntimeError, 0 bare assert); creds-scrub intact; non-destructive (fixture tempdir only); deterministic (git objects + fixed pins); closure-import guard present. ABSENT = 0: P5/P6/P2-bank/retry-launder/mosaic-yolo/execRuntime/pi_gate0; source-invalid grep=0; no live/real-broker path; no .state/gen path outside the fixture root; no extra broker/socket; no exec-at-import (__main__-guarded); no adjacency-only exec-from-worktree for any member; the only mechanism change is materialization; no scope-widen.

Verdict

PASS @ f609a449. B5 (full-closure hashed==executed via the (a)+(b)+(c) conjunction with no writable window), B6 (one shared pinned helper bound to both launcher-import and broker---generation-module; complete closure), BAR1, BAR2 (fidelity .state-in-fixture-root untouched), and BAR3 all hold, with zero out-of-scope surface. Findings: none.

Scope reminder (not a finding)

Producing this evidence executes the Gate0 mechanism (§3/§5). This review clears bytes only; FIRE remains separately gated on Mos's explicit post-clear GO, his v-final byte-scope-verify co-attestation, and homelab's third-principal verify — not authorized by this review.

---

Reviewer: distinct Opus SECREV session (ms-secrev-828 lane, dispatched by mosaic-100), Gate-16 author≠reviewer, byte review only; ran nothing; did not build. Reviewed object (pin): f609a44953f5ae61916805fcb45ca337de00b0b0 · harness sha256 0f1bd1b39399b32f243d901230e2d840794a2144edd723a095dab716833a7a9b. Pinned closure: launcher e950e422… @f4008307 · helper 06162540…be4c @f4008307 · broker 4db4fef1… @23c0caca.