stack/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v10.md

GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v10 no-site startup closure)

Principal: Mos (orchestrator, merge authority for the mosaic-stack governance lane). Committed under a DISTINCT git identity (mos-orchestrator@mosaic.local) — deliberately NOT the ms-lead-reviewer@mosaic.local lane signer that authored the harness and the §3 review — so this record stands as a distinct-identity co-attestation. See "Independence".

Verify class: independent provider-byte read (git show <full-40>:path | sha256sum) plus a git-diff byte-comparison of the v9→v10 delta and source inspection of the executed command lines. Not a re-build, not a re-run. This SUPERSEDES the v9 co-attestation f320d075 (byte-clear on the v9 env-iso + bytecode-pin bar), which was overtaken by homelab's 4th-round FAIL @1c34e3cb (site-startup-closure hole) and the resulting B9 bar.

Package under attestation

Artifact	Ref
Branch	feat/827-gate0-probe (mosaicstack/stack)
Harness commit-40	ce5ba762051354338889959bfce2b0381f4a4e2a
Harness p3_d4_focused_run.py sha256	7e14ead89a7b2a297fcc17e7653291b3bcace1d2002a8f90a989db74f6985b6f (32753 B)
§3-review-v10 commit-40	ffc3b573a8258a86e3ece9ef92bac925fb5a7a5b (parent == harness ce5ba762, byte-stable; adds only the review .md, +86; ms-secrev-828 authored)
Review path	docs/compaction-refresh/reviews/GATE0-PROBE3-V10-NOSITE-S3-REVIEW-v10.md

Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins == embedded harness constants; UNCHANGED from v9):

Member	Source (commit:path)	Pin sha256	Size
launcher launch-runtime.py	f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py	e950e422…	4237 B
helper lease_generation.py	f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py	061625402f…	3769 B
broker p3_generation_broker.py	23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py	4db4fef1…	—

f4008307 (held WI-3 #830 gated head) is not on origin — recomputed launcher+helper from the local stack-cr-wi3-revoke worktree (HEAD == f4008307); broker from origin 23c0caca.

Findings — VERDICT: byte-scope + mechanism + hygiene PASS (v10 = v9 + B9 no-site)

The v9→v10 delta is exactly 2 insertions / 0 deletions (git-diff byte-compared), a +28 B harness growth fully accounted (2 × "-S",\n = 14 B each). Every prior invariant is byte-stable — the diff touches nothing outside the two command lists.

B9 — no-site startup closure (homelab 4th-round finding CLOSED). Both child command lists now carry -S, which disables the site module entirely (no .pth executable lines, no sitecustomize/usercustomize) so no unpinned startup code runs before the exact launcher/broker or outside closure_import_guard:

• launcher launch_verified_pi (:515): -s + -S + -B, no -I (-I appears exactly once in the harness, :553, the broker only).
• broker launch_verified_broker (:554): -I + -S + -B.

Homelab's finding was independently reproduced by Mos and the fix empirically verified on host Py3.11.2 (throwaway, not the harness): [-s -B]→no_site=0, site imported (the v9 hole); [-I -B]→ no_site=0, site imported (proves -I does not imply -S); [-s -S -B]→no_site=1, site not in sys.modules, and the launcher's bare from lease_generation import still resolves (sys.path[0] untouched by -S → no B6c regression); [-I -S -B]→no_site=1. The launcher deliberately omits -I (B6c: on 3.11+ -I implies -P, dropping the script dir from sys.path[0] → sibling import breaks); its env isolation comes from the PiRpc env= allow-list, not -I.

All priors — byte-stable (outside the 2-line delta, re-confirmed from the v9 verify): B5 conjunction (materialize-from-pin / mkdir(0o700)+O_EXCL no-writer-window / re-hash==pin immediately-before-exec); B6 (single pinned helper bound; closure_import_guard AST-reject); B6c (launcher no -I); B7 (broker env=environment strict allow-list :570); B8 (reject_pinned_bytecode fail-closed :498-501 before each consumer :535/:562 + PYTHONDONTWRITEBYTECODE=1 :729 + -B on both); fidelity asserts (generation_source=='state-file', state_file_in_fixture_root, MUTATOR_UNVERIFIED, STALE_GENERATION); lease_anchor_registered; BAR1 GATED_WI_HEAD==f4008307 (:36) + merge-base --is-ancestor 66b1e0a0 f4008307 = YES; --runs choices=(3,); -O-safe (0 bare assert); allow-list env (0 os.environ.copy); single broker (1 def + 1 call); the only shutil.copy2 is the .pi/agent credential copy.

Closure = exactly 3 files, materialized inside the fixture root. No path escapes the fixture temp root; no live/default broker; .state fixture-bound. R1 owner tripwire NOT tripped — -S deepens startup-closure isolation of an already-authorized touch; it does not widen the touched surface.

Independence

Substantive principal-independence of review-v10 is satisfied by an orchestrator-dispatched, builder-distinct Opus SECREV (ms-secrev-828, byte-only, non-builder, non-Mos). The shared ms-lead-reviewer git signer on harness+review commits is evidentiary, not substantive — resolved by (1) this Mos co-attestation under a distinct identity (mos-orchestrator) and (2) a homelab third-principal verify under its own distinct identity = three distinct-identity principals of record. The prior 2-of-3 (ms-secrev-828 v9 §3 PASS + f320d075) does not carry — all three re-verify this v10 SHA. Shared signer = tracked fleet-infra tooling-gap, not a blocker.

Scope of this record — byte-clear, NOT fire-authorization

Producing probe evidence executes the Gate0 mechanism; a byte-clear is not a fire-authorization. This clears bytes / scope / mechanism / hygiene on the v10 (v9 + B9 no-site) bar. FIRE remains gated on: homelab third-principal re-verify (5th round, own distinct identity) + Mos transparency-to-Jason + Mos explicit FIRE GO. The FIRE GO additionally carries an execution-procedure constraint: the 3× isolation dispatch must launch the runner under externally-enforced python -I -S -B p3_d4_focused_run.py — a self-reexec is too late, the harness's own site runs before it could re-add -S to itself. Until FIRE GO: nothing banked, WI-3 #830 held at f4008307 (unmoved), C-hatch armed (fired-rig only: no-fire / wrong-value / assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason).

Prior v10-superseded set: 1c34e3cb / e1c9a468 / f320d075 (and transitively the v7 chain).

Mos verdict: v10 (v9 + B9 no-site) byte-scope + mechanism + hygiene PASS. Co-attestation of record — committed.