98 lines
6.8 KiB
Markdown
98 lines
6.8 KiB
Markdown
# GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v10 no-site startup closure)
|
||
|
||
**Principal:** Mos (orchestrator, merge authority for the mosaic-stack governance lane).
|
||
**Committed under a DISTINCT git identity** (`mos-orchestrator@mosaic.local`) — deliberately NOT the
|
||
`ms-lead-reviewer@mosaic.local` lane signer that authored the harness and the §3 review — so this
|
||
record stands as a *distinct-identity* co-attestation. See "Independence".
|
||
|
||
**Verify class:** independent provider-byte read (`git show <full-40>:path | sha256sum`) plus a
|
||
git-diff byte-comparison of the v9→v10 delta and source inspection of the executed command lines. Not
|
||
a re-build, not a re-run. This SUPERSEDES the v9 co-attestation `f320d075` (byte-clear on the v9
|
||
env-iso + bytecode-pin bar), which was overtaken by homelab's 4th-round FAIL @1c34e3cb
|
||
(site-startup-closure hole) and the resulting B9 bar.
|
||
|
||
## Package under attestation
|
||
|
||
| Artifact | Ref |
|
||
|---|---|
|
||
| Branch | `feat/827-gate0-probe` (mosaicstack/stack) |
|
||
| Harness commit-40 | `ce5ba762051354338889959bfce2b0381f4a4e2a` |
|
||
| Harness `p3_d4_focused_run.py` sha256 | `7e14ead89a7b2a297fcc17e7653291b3bcace1d2002a8f90a989db74f6985b6f` (32753 B) |
|
||
| §3-review-v10 commit-40 | `ffc3b573a8258a86e3ece9ef92bac925fb5a7a5b` (parent == harness `ce5ba762`, byte-stable; adds only the review `.md`, +86; ms-secrev-828 authored) |
|
||
| Review path | `docs/compaction-refresh/reviews/GATE0-PROBE3-V10-NOSITE-S3-REVIEW-v10.md` |
|
||
|
||
**Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins == embedded harness constants; UNCHANGED from v9):**
|
||
|
||
| Member | Source (commit:path) | Pin sha256 | Size |
|
||
|---|---|---|---|
|
||
| launcher `launch-runtime.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py` | `e950e422…` | 4237 B |
|
||
| helper `lease_generation.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py` | `061625402f…` | 3769 B |
|
||
| broker `p3_generation_broker.py` | `23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py` | `4db4fef1…` | — |
|
||
|
||
> `f4008307` (held WI-3 #830 gated head) is **not on origin** — recomputed launcher+helper from the
|
||
> local `stack-cr-wi3-revoke` worktree (HEAD == `f4008307`); broker from origin `23c0caca`.
|
||
|
||
## Findings — VERDICT: byte-scope + mechanism + hygiene **PASS** (v10 = v9 + B9 no-site)
|
||
|
||
The v9→v10 delta is **exactly 2 insertions / 0 deletions** (git-diff byte-compared), a `+28 B`
|
||
harness growth **fully accounted** (2 × ` "-S",\n` = 14 B each). Every prior invariant is
|
||
byte-stable — the diff touches nothing outside the two command lists.
|
||
|
||
**B9 — no-site startup closure (homelab 4th-round finding CLOSED).** Both child command lists now
|
||
carry `-S`, which disables the `site` module entirely (no `.pth` executable lines, no
|
||
`sitecustomize`/`usercustomize`) so no unpinned startup code runs before the exact launcher/broker or
|
||
outside `closure_import_guard`:
|
||
- launcher `launch_verified_pi` (`:515`): `-s` + **`-S`** + `-B`, **no `-I`** (`-I` appears exactly
|
||
once in the harness, `:553`, the broker only).
|
||
- broker `launch_verified_broker` (`:554`): `-I` + **`-S`** + `-B`.
|
||
|
||
Homelab's finding was **independently reproduced by Mos** and the fix **empirically verified** on host
|
||
Py3.11.2 (throwaway, not the harness): `[-s -B]`→`no_site=0, site imported` (the v9 hole); `[-I -B]`→
|
||
`no_site=0, site imported` (proves `-I` does **not** imply `-S`); `[-s -S -B]`→`no_site=1`, `site` not
|
||
in `sys.modules`, **and the launcher's bare `from lease_generation import` still resolves** (`sys.path[0]`
|
||
untouched by `-S` → no B6c regression); `[-I -S -B]`→`no_site=1`. The launcher deliberately omits `-I`
|
||
(B6c: on 3.11+ `-I` implies `-P`, dropping the script dir from `sys.path[0]` → sibling import breaks);
|
||
its env isolation comes from the `PiRpc` `env=` allow-list, not `-I`.
|
||
|
||
**All priors — byte-stable (outside the 2-line delta, re-confirmed from the v9 verify):**
|
||
B5 conjunction (materialize-from-pin / `mkdir(0o700)`+`O_EXCL` no-writer-window / re-hash==pin
|
||
immediately-before-exec); B6 (single pinned helper bound; `closure_import_guard` AST-reject); B6c
|
||
(launcher no `-I`); B7 (broker `env=environment` strict allow-list `:570`); B8 (`reject_pinned_bytecode`
|
||
fail-closed `:498-501` before each consumer `:535/:562` + `PYTHONDONTWRITEBYTECODE=1` `:729` + `-B` on
|
||
both); fidelity asserts (`generation_source=='state-file'`, `state_file_in_fixture_root`,
|
||
`MUTATOR_UNVERIFIED`, `STALE_GENERATION`); `lease_anchor_registered`; BAR1 `GATED_WI_HEAD==f4008307`
|
||
(`:36`) + `merge-base --is-ancestor 66b1e0a0 f4008307` = **YES**; `--runs choices=(3,)`; `-O`-safe
|
||
(0 bare `assert`); allow-list env (0 `os.environ.copy`); single broker (1 def + 1 call); the only
|
||
`shutil.copy2` is the `.pi/agent` credential copy.
|
||
|
||
**Closure = exactly 3 files, materialized inside the fixture root.** No path escapes the fixture temp
|
||
root; no live/default broker; `.state` fixture-bound. **R1 owner tripwire NOT tripped** — `-S`
|
||
deepens startup-closure isolation of an already-authorized touch; it does not widen the touched surface.
|
||
|
||
## Independence
|
||
|
||
Substantive principal-independence of review-v10 is satisfied by an orchestrator-dispatched,
|
||
builder-distinct Opus SECREV (`ms-secrev-828`, byte-only, non-builder, non-Mos). The shared
|
||
`ms-lead-reviewer` git signer on harness+review commits is evidentiary, not substantive — resolved by
|
||
(1) this Mos co-attestation under a **distinct** identity (`mos-orchestrator`) and (2) a homelab
|
||
third-principal verify under its own distinct identity = three distinct-identity principals of record.
|
||
The prior 2-of-3 (`ms-secrev-828` v9 §3 PASS + `f320d075`) does **not** carry — all three re-verify
|
||
this v10 SHA. Shared signer = tracked fleet-infra tooling-gap, not a blocker.
|
||
|
||
## Scope of this record — byte-clear, NOT fire-authorization
|
||
|
||
Producing probe evidence **executes** the Gate0 mechanism; a byte-clear is not a fire-authorization.
|
||
This clears **bytes / scope / mechanism / hygiene on the v10 (v9 + B9 no-site) bar**. FIRE remains
|
||
gated on: **homelab third-principal re-verify** (5th round, own distinct identity) + **Mos
|
||
transparency-to-Jason** + **Mos explicit FIRE GO**. The FIRE GO additionally carries an
|
||
**execution-procedure constraint**: the 3× isolation dispatch must launch the runner under
|
||
externally-enforced **`python -I -S -B p3_d4_focused_run.py`** — a self-reexec is too late, the
|
||
harness's own `site` runs before it could re-add `-S` to itself. Until FIRE GO: nothing banked, WI-3
|
||
#830 held at `f4008307` (unmoved), C-hatch armed (fired-rig only: no-fire / wrong-value /
|
||
assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason).
|
||
|
||
Prior v10-superseded set: `1c34e3cb` / `e1c9a468` / `f320d075` (and transitively the v7 chain).
|
||
|
||
**Mos verdict: v10 (v9 + B9 no-site) byte-scope + mechanism + hygiene PASS. Co-attestation of
|
||
record — committed.**
|