GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v9 full-closure, env-isolated + bytecode-pinned)

Principal: Mos (orchestrator, merge authority for the mosaic-stack governance lane). Committed under a DISTINCT git identity (mos-orchestrator@mosaic.local) — deliberately NOT the ms-lead-reviewer@mosaic.local lane signer that authored the harness and the §3 review — so this record stands as a distinct-identity co-attestation. See "Independence".

Verify class: independent provider-byte read (git show <full-40>:path | sha256sum) plus source-level inspection of the executed mechanism and the v7→v9 delta. Not a re-build, not a re-run. This SUPERSEDES the v7 co-attestation e08ad03 (and its SUPERSEDED note 2ae379e), which was byte-clear on the v7 bar and was overtaken by homelab's third-principal FAIL @f609a449 (broker env-isolation + executed-bytecode-cache) and the resulting B7/B8 bar.

Package under attestation

Artifact	Ref
Branch	`feat/827-gate0-probe`
Harness commit-40	`1c34e3cb3172acdcd094e683e847d7c984afc96c`
Harness `p3_d4_focused_run.py` sha256	`29e5c7bfbe1911b52984bd94c79036bb1200ee82588318367b13c2b1053a0103` (32725 B)
§3-review-v9 commit-40	`e1c9a4682da2892ca5f5381012caffe1dd7b43a7` (parent == harness `1c34e3cb`, byte-stable; adds only the review `.md`; ms-secrev-828 authored)
Review path	`docs/compaction-refresh/reviews/GATE0-PROBE3-V9-LAUNCHERFIX-S3-REVIEW-v9.md`

Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins == embedded harness constants):

Member	Source (commit:path)	Pin sha256	Size
launcher `launch-runtime.py`	`f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py`	`e950e422…`	4237 B
helper `lease_generation.py`	`f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py`	`061625402f…`	3769 B
broker `p3_generation_broker.py`	`23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py`	`4db4fef1…`	—

f4008307 (held WI-3 #830 gated head) is not on origin — recomputed launcher+helper from the local stack-cr-wi3-revoke worktree (HEAD == f4008307); broker from origin 23c0caca.

Findings — VERDICT: byte-scope + mechanism + hygiene PASS (v9 = v7 full-closure + B7 + B8)

The v7→v9 delta is exactly 22 insertions / 2 deletions, confined to the intended B7+B8+B6c surface; every prior invariant is byte-stable (outside the delta) from the v7 verify.

B7 — broker child env-ISOLATED (homelab finding 1 CLOSED). launch_verified_broker (:568) now passes env=environment (the strict allow-list, :570) — the ambient-os.environ-inheritance hole is gone — AND runs the broker with -I (:552, isolated: ignores PYTHON*/user-site) + -B (:553). Both children are env-controlled: the launcher was already env=env at PiRpc (:53).

B8 — executed bytecode PINNED/SUPPRESSED (homelab finding 2 CLOSED). reject_pinned_bytecode (:498) raises RuntimeError fail-closed if a __pycache__ dir or any *.pyc exists in the pinned dir, and is called before each consumer (launcher :535, broker :562). Bytecode writes are disabled via PYTHONDONTWRITEBYTECODE=1 (:729) in the allow-list env and -B on both command lines. No unpinned .pyc can be executed; only the pinned .py re-hash governs.

B6c — launcher sibling-import PRESERVED (v8 regression FIXED). v8 over-applied -I to the launcher; on Py3.11+ -I implies -P, dropping the script dir from sys.path[0], so the pinned launcher's bare from lease_generation import (launch-runtime.py:15) would ModuleNotFoundError. v9 uses -s (:514) + -B (:515) on the launcher (NO -I) — neither touches sys.path[0], so the sibling import still resolves to pinned/lease_generation.py. Mos empirically re-verified on host Py3.11.2 (throwaway, not the harness): -I launcher → ModuleNotFoundError; -s+PYTHONNOUSERSITE → import OK. The launcher's env isolation comes from the PiRpc env= allow-list, NOT -I, so dropping -I does not reopen B7. My earlier constraint-(c) assumption ("-I does not strip the script dir") was FALSIFIED for 3.11+; the author≠reviewer gate (ms-secrev-828) caught it — recorded.

B5 conjunction (load-bearing repair) — HELD, all three legs (byte-stable from v7): (a) materialized from pinned git-object bytes via materialize_closure/git_object_bytes, sha256==pin fail-closed; (b) pinned/ mkdir(0o700) + O_EXCL|O_CLOEXEC 0o600, no writable window — now also reject_pinned_bytecode closes the .pyc side-channel; (c) re-hash == pin IMMEDIATELY before each exec, no interleaved yield: launcher re-hash (:538) → return PiRpc(command,…) whose __init__ first statement is Popen (:50); broker re-hash (:563) + helper re-hash (:566) → Popen (:568) on the next line.

B6 — single pinned helper, complete closure. Broker gets --generation-module {closure.generation}; launcher resolves import lease_generation to the sibling pinned copy via sys.path[0]. closure_import_guard (:351, called :433) AST-rejects any non-stdlib import other than lease_generation. Single broker: launch_verified_broker 1 def (:543) + 1 call (:766).

Invariants (all INTACT): BAR1 GATED_WI_HEAD == f4008307 (:36) and merge-base --is-ancestor 66b1e0a0 f4008307 = YES (file-backed .state revocation fidelity present); fidelity generation_source=='state-file' (:639), state_file_in_fixture_root (:641), MUTATOR_UNVERIFIED (:650), STALE_GENERATION (:651); lease_anchor_registered (:593); -O-safe (0 bare assert); --runs choices=(3,) (:838); allow-list env (0 os.environ.copy); ABSENT-sweep (yolo/execRuntime/p3_bank/promote_p2/retry) = 0; the only shutil.copy2 (:708) is the .pi/agent credential copy, not a closure copy.

Closure = exactly 3 files, materialized inside the fixture root. No path escapes the fixture temp root; no live/default broker; .state fixture-bound. R1 owner tripwire NOT tripped — B7/B8 deepen isolation/binding of an already-authorized touch, they do not widen the touched surface.

Independence

Substantive principal-independence of review-v9 is satisfied by an orchestrator-dispatched, builder-distinct Opus SECREV (ms-secrev-828, byte-only, non-builder, non-Mos). The shared ms-lead-reviewer git signer on harness+review commits is evidentiary, not substantive — resolved by (1) this Mos co-attestation under a distinct identity (mos-orchestrator) and (2) a homelab third-principal verify under its own distinct identity = three distinct-identity principals of record. Shared signer = tracked fleet-infra tooling-gap (durable fix = per-lane distinct signers), not a blocker.

Scope of this record — byte-clear, NOT fire-authorization

Producing probe evidence executes the Gate0 mechanism; a byte-clear is not a fire-authorization. This clears bytes / scope / mechanism / hygiene on the v9 (full-closure + B7 + B8) bar. FIRE remains gated on: homelab third-principal re-verify (4th round, own distinct identity) + Mos transparency-to-Jason + Mos explicit FIRE GO. Until then: nothing banked, WI-3 #830 held at f4008307 (unmoved), C-hatch armed (materialized-closure rig still no-fire / wrong-value / assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason).

Mos verdict: v9 full-closure + B7 + B8 byte-scope + mechanism + hygiene PASS. Co-attestation of record — committed.

⚠️ SUPERSEDED — homelab v9 4th-round FAIL @1c34e3cb raised a stricter startup-closure bar

This co-attestation was byte-clear on the v9 (env-iso + bytecode-pin) bar ONLY and self-limited above to "byte-clear NOT fire-authorization; FIRE remains gated on homelab 4th-round re-verify." Homelab (the required third principal) returned FAIL @1c34e3cb (static, nothing executed), and Mos UPHELD it after independently confirming the finding in-source AND empirically on host Py3.11.2 — so the v9 byte-clear this document records is SUPERSEDED and does NOT authorize FIRE.

Residual startup-closure hole (empirically reproduced by Mos; accepted as gate-STRENGTHENING): neither child carries -S, so CPython imports the site module before the script runs. -s (launcher) suppresses only user-site; -I (broker) implies -s -E -P but NOT -S. Proven:

[-s  -B ]  no_site=0  site_imported=True    ← v9 launcher: site runs
[-I  -B ]  no_site=0  site_imported=True    ← v9 broker: -I does NOT imply -S
[-s -S -B] no_site=1  site_imported=False   ← v10 launcher fix (sibling import STILL resolves)
[-I -S -B] no_site=1  site_imported=False   ← v10 broker fix (additive)

System-site executable .pth lines + sitecustomize/usercustomize can therefore run unpinned startup code before the exact launcher/broker and outside closure_import_guard, while every hash + reject_pinned_bytecode + import-guard still pass — defeating hashed==executed on the full startup closure (strictly wider than the module-import closure v9 cleared). A genuine fidelity hole for a fail-closed DO-178C evidence gate.

Mos authorized the bounded v10 repair: add -S to the launcher (keep -s -B, NOT -I) and to the broker (keep -I -B) — a minimal 2-line delta; no B6c regression (launcher -s -S -B sibling import empirically intact; -S does not touch sys.path[0]). Added review bar B9 (no-site startup closure). This rides the existing (ii)-full-closure authorization + R1 + Mos adjudication (deepens startup-closure isolation of an already-authorized touch, inside the fixture temp root, no fresh Jason owner-window) and is NOT a Case-C escalation (static pre-fire catch, no probe fired). A separate FIRE-time constraint is captured: the 3× isolation dispatch must launch the runner under externally-enforced python -I -S -B (a self-reexec is too late).

Live target = v10 (no-site harness, forthcoming). 1c34e3cb / e1c9a468 / this co-attestation (f320d075) are SUPERSEDED; the prior 2-of-3 (ms-secrev-828 v9 §3 PASS + f320d075) does NOT carry — all three distinct-identity principals re-verify the new v10 SHA. A fresh Mos co-attestation will be committed on v10 byte-verify PASS. WI-3 #830 remains HELD at f4008307; nothing banked; C-hatch armed (fired-rig only); NO FIRE.

10 KiB Raw Blame History Unescape Escape