stack/docs/compaction-refresh/reviews/GATE0-PROBE3-FIDELITY-S3-REVIEW-v4.md

Gate0 Probe-3 (D4) Observation-Fidelity — §3-Conformance Review v4

Verdict: ✅ PASS

Pin (G1 — reviewed object, mandatory)

• Reviewed object = 484849387006ab5561798506fd6042ddbd5617de (harness commit, branch feat/827-gate0-probe, mosaicstack/stack @ git.mosaicstack.dev).
• Reviewed file: docs/compaction-refresh/probes/p3_d4_focused_run.py — sha256 (pushed provider bytes, -o FILE, FULL-40 ref, verified before trust): 9095eab7a4ddf11bb92bb5971d49e1facad12f4692ce2081665b0af47cbe5098 (23698 bytes, no not-found sentinel). Worktree bytes at 48484938 re-hashed identical.
• Co-reviewed fixture broker: docs/compaction-refresh/probes/p3_generation_broker.py (sha256 fd5327d2e9a2808282cbc9c4a4ccef42d2a806482b27cc48035191b9b11607c8).
• Traceability anchor (independently recomputed): GATED_LAUNCHER_SHA256 = e950e4224e280f16979d90cabb89aa1896c5ee28bed2df957e14d018d43cda82 equals the sha256 of packages/mosaic/framework/tools/lease-broker/launch-runtime.py at WI-3 #830 reviewed head f400830738998db105107a2a4c69c7f2a2a6fd5d (computed from two independent worktrees).

Independence (G2)

Distinct Opus §3-conformance reviewer (Gate-16 author≠reviewer). I did not build this harness (author = ms-rev-826); I am not Mos. This verdict is my own; the author did not author or edit it. Byte review only — ran nothing (no harness, no broker, no sockets/state). Prior v3 PASS (ace60667, pinned abd2791f) is correctly superseded: pinning a pre-66b1e0a0 ancestor made D4 an in-memory socket simulation (hollow gate). v4 requires mechanism-fidelity within isolation (Jason R1).

BAR1 — Traceability (evidence attests the SHIPPED WI-3 D4 mechanism)

Check	Result	Evidence
GATED_WI_HEAD == f4008307 (not abd2791f)	✅	:33
Launcher pinned by git-HEAD and sha256	✅	precondition :285-288 (head != GATED_WI_HEAD raise; sha256(launcher) != GATED_LAUNCHER_SHA256 raise); sha256 independently == f4008307's launch-runtime.py
Launcher bytes contain the file-backed mechanism	✅	precondition requires register_anchor :290, initialize_runtime_generation(generation_file, generation) :291, generation-{session_id}.state :294, MOSAIC_LEASE_GENERATION_FILE :295, read_runtime_generation+bump_runtime_generation in lease_generation.py :296-299; order register < initialize < execute :302-303

BAR2 — Fidelity (file-backed generation, not in-memory simulation)

#	Requirement	Result	Evidence
i	Extension bumps generation-{sid}.state via the real helper, not in-mem	✅	ext lifecycle() calls broker({action:'bump-generation'}) at every post-start boundary (harness :200-205); broker bump-generation → bump_runtime_generation(generation_environment(identity)) (broker :119-120)
ii	Broker reads generation via read_runtime_generation, not an in-mem counter	✅	broker loads the pinned module (--generation-module, :52-54); file_generation() = read_runtime_generation(...) (:77-78); authorize-probe reads current_generation = file_generation(identity) (:154); lifecycle new_generation = file_generation(identity) (:201). The in-mem generations dict is only an old-value cache for the monotonic guard (:199-204), never the authorization authority
iii	assert_d4 observes the FILE-BACKED transition	✅	state_file_source = all records generation_source=="state-file" (harness :370-372); state_file_drives_lifecycle = state-bumps == lifecycle generations[1:] (:368-369); new_generation_unverified→MUTATOR_UNVERIFIED :382; prior_generation_stale→STALE_GENERATION :383; verified_revoked_on_reload :380-381 — not a socket-only bump
iv	.state bound to per-run fixture temp root	✅	broker generation_environment raises if state_path.parent != socket_path.parent (:73-74); state_file_in_fixture_root (:373-376); precondition forbids inherited MOSAIC_LEASE_GENERATION_FILE (:255-256) and requires socket in gettempdir() (:274-275); launcher/broker agree on socket_path.parent / generation-{sid}.state

BAR3 — Carry-over

#	Result	Evidence
a LIVE-PATH (gated launcher @f4008307 at runtime, not released/plain execRuntime)	✅	Pi launched via python3 <GATED_LAUNCHER> --runtime pi -- pi … :502-505; mosaic yolo/execRuntime = 0 hits; register-before-exec producer in the invoked chain (precondition order gate)
b Fail-closed precondition present+correct	✅	gated_launcher_precondition :250-306, invoked :485 before broker/Pi; raises on socket≠fixture / gen-file-inherited / write-path-escape / head-mismatch / hash-mismatch / not-register-before-exec-file-bound
c Fixture-socket isolation, single p3 broker	✅	one broker Popen :486-500; MOSAIC_LEASE_BROKER_SOCKET=socket_path (fixture); direct launcher invocation ⇒ no default/XDG//run/user fallback in path
d lease_anchor_registered INTACT	✅	broker emits event + session_id_shape=="hex-256" (:102-107); record_where requires it (:324-326); lease_anchor_fixture check (:379) — not deleted/softened/optional/repointed (not Case-C)

BAR4 — Homelab Gate-B carry-forward findings

#	Result	Evidence
b4-1 gated launcher @f4008307, not released/plain execRuntime	✅	:502-505; 0 mosaic yolo/execRuntime
b4-2 affirmative no-escape (allow-list base, not deny-list)	✅	isolated_environment builds the child env from a literal allow-list dict (:442-461), NOT os.environ.copy(); only PATH/LANG/TERM/PI_CODING_AGENT (non-write-bearing) pass through; every write-bearing var (HOME/XDG*/TMPDIR/MOSAIC_AGENT_WORKDIR/HEARTBEAT_RUN_DIR/MOSAIC_HOME/D4_PI_LOG/socket) redirected under root; precondition double-checks each is is_relative_to(root) (:257-273). No unnamed/future inherited var survives
b4-3 --runs exactly 3, fail-closed otherwise	✅	add_argument("--runs", type=int, default=3, choices=(3,)) :591 (argparse rejects any other value)
b4-4 cleanup try/finally spans the whole launch	✅	broker=pi=None :479-480; try opens before precondition/broker/PiRpc :482; nested finally always closes pi then broker+socket even on early wait_path/PiRpc failure :571-585
b4-5 -O-safe integrity + derived PASS	✅	load-bearing checks in a checks dict; if failed: raise AssertionError :385-387 and if not passed: raise :388-390 (NO bare assert anywhere — grep-confirmed); PASS = "PASS" if passed else "FAIL" derived from all(checks.values()) :393, re-derived+checked in run_once :550-553

MUST-BE-ABSENT sweep

P5 / P6 / P2-bank / retry-launder / mosaic yolo / execRuntime / run_open / atomic-observation / pi_gate0_run = 0 hits (both files). Extension invokes only bump-generation / lifecycle / authorize-probe / promote-probe. No live/prod/real-broker path (single fixture broker; allow-list env; launcher pinned to fixture socket). No .state/gen-file path outside the fixture temp root (broker generation_environment raises otherwise). §4 live effect: none. No extra broker/socket beyond the single p3. No exec-at-import (both files __main__-guarded). Mechanism change is confined to the mandated R1 observation-fidelity deepening + BAR4 hardening; no scope-widen of what the probe touches.

Observations (transparency — not findings)

1. The fixture broker retains a dormant source-invalid action (:179-194, P5-adjacent, in-mem). It is never invoked by the harness or its embedded extension (verified: extension actions are only bump/lifecycle/authorize/promote), and assert_d4 never observes it — so the probe does not exercise or bank P5. Pre-existing shared-fixture code, unchanged. Surfaced so Mos may, if desired, apply a stricter purge-dormant-P5-from-the-fixture standard; under the "what the probe TOUCHES/does" framing it is not a violation.
2. Fixture HOME receives a read-only copy of the operator's ~/.pi/agent settings.json/auth.json/bin/fd (:430-440, shutil.copy2 into the fixture) so real Pi can authenticate to the model provider. It reads operator state; it does not write/mutate operator HOME and does not emit/log credential material. Confined to the fixture.

Verdict

PASS @ 48484938 — BAR1 (traceability to shipped f4008307 mechanism) + BAR2 (genuine file-backed generation, i–iv) + BAR3 (live-path / fail-closed precondition / isolation / intact assertion) + BAR4 (b4-1..b4-5) all hold, with zero out-of-scope surface exercised. The v3 hollow-gate (ancestor pin, in-mem simulation) is structurally closed: evidence now attests the shipped WI-3 D4 file-backed generation mechanism, launcher pinned by head+sha256, child env write-confined by allow-list, integrity -O-safe with a derived PASS.

Findings: none.

Scope reminder (not a finding)

Per §3/§5 of the amendment, producing this evidence executes the Gate0 mechanism. This review clears the bytes; FIRE remains separately gated on Mos's explicit post-clear GO and is not authorized by this review.

---

Reviewer: independent Opus §3-conformance reviewer (Gate-16 author≠reviewer). Byte review only; ran nothing. Reviewed object (pin): 484849387006ab5561798506fd6042ddbd5617de · harness sha256 9095eab7a4ddf11bb92bb5971d49e1facad12f4692ce2081665b0af47cbe5098.