stack/docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v7.md

GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v7 full-closure)

Principal: Mos (orchestrator, merge authority for the mosaic-stack governance lane). Committed under a DISTINCT git identity (mos-orchestrator@mosaic.local) — deliberately NOT the ms-lead-reviewer@mosaic.local lane signer that authored both the harness and the §3 review — so this record stands as a distinct-identity co-attestation. See "Independence" below.

Verify class: independent provider-byte read (guarded git show <full-40>:path | sha256sum) plus source-level inspection of the executed mechanism. Not a re-build, not a re-run. This SUPERSEDES the v6 co-attestation 12914d8 (and its SUPERSEDED-note b6bd0cd), which was byte-clear on the v6 bar only and was overtaken by homelab's third-principal FAIL @2d54a9dd + the resulting stricter full-closure bar.

Package under attestation

Artifact	Ref
Branch	feat/827-gate0-probe
Harness commit-40	f609a44953f5ae61916805fcb45ca337de00b0b0
Harness p3_d4_focused_run.py sha256	0f1bd1b39399b32f243d901230e2d840794a2144edd723a095dab716833a7a9b (32071 B)
§3-review-v7 commit-40	2bba933f67c821899d320a938a9473a73a136422 (adds only the review .md; harness parent byte-stable)
Review path	docs/compaction-refresh/reviews/GATE0-PROBE3-V7-FULLCLOSURE-S3-REVIEW-v7.md

Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins):

Member	Source (commit:path)	Pin sha256	Size
launcher launch-runtime.py	f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py	e950e422…	4237 B
helper lease_generation.py	f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py	061625402f…	3769 B
broker p3_generation_broker.py	23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py	4db4fef1…	—

Note: f4008307 (the held WI-3 #830 gated head) is not on origin — it exists only as a local git worktree on the build host. Mos recomputed the launcher+helper pins from that worktree (stack-cr-wi3-revoke, HEAD == f4008307) rather than passing over a clone-completeness gap. The broker pin was recomputed from origin 23c0caca.

Findings — VERDICT: byte-scope + mechanism + hygiene PASS (v7 full-closure bar)

Homelab's stricter bar — hashed==executed on the FULL executed closure (launcher + helper + broker) — is met. Verified at the source, not accepted on the review's assertion:

B5 conjunction (the load-bearing repair) — HELD, all three legs:

• (a) materialized from pinned git-object bytes, NOT the mutable worktree. materialize_closure fetches each member via git_object_bytes (git show {commit}:{path}), then sha256(data) == pin fail-closed (RuntimeError on mismatch) before use.
• (b) no writable window hash→consume. pinned/ is mkdir(mode=0o700); each file is written with os.open(O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0o600) — O_EXCL refuses a pre-planted file. No chmod, no os.rename/replace, no symlink, and nothing re-opens a pinned file for write (grep = 0). The pinned bytes are immutable within the fixture threat model between hash and exec.
• (c) re-hash == pin IMMEDIATELY before each exec, no interleaved yield. Launcher: re-hash then return PiRpc(command,…) whose __init__ first statement is subprocess.Popen(command,…) — zero IO/yield/reopen between. Broker + helper: both re-hashed then subprocess.Popen on the next line. Adjacency-alone-without-materialization (the v6 defect) is absent — all three exec from pinned/.

B6 — helper pinned AND bound to the SAME single copy. The broker receives --generation-module {closure.generation} (the pinned helper); the launcher runs from pinned/ so its import lease_generation resolves to the sibling pinned copy via sys.path[0]. closure_import_guard AST-parses every member and raises on any non-stdlib import other than the allowed lease_generation — proving the dependency closure is complete and no unpinned module can enter at runtime.

Closure = exactly 3 files, materialized inside the fixture root (root / "pinned"). No path escapes the fixture temp root; no live/default broker; .state remains fixture-bound. R1 owner tripwire NOT tripped — this deepened isolation of an already-authorized touch, it did not widen the touched surface.

Invariants (all INTACT): BAR1 GATED_WI_HEAD == f4008307 and merge-base --is-ancestor 66b1e0a0 f4008307 = YES (file-backed .state revocation fidelity present); BAR2 .state = socket_path.parent / generation-{sid}.state, state_file_in_fixture_root + generation_source == "state-file" checks present; BAR3 lease_anchor_registered / live-path / fixture-socket isolation intact. -O-safe (0 bare assert); ABSENT-sweep (yolo/execRuntime/p3_bank/promote_p2/retry) = 0; single broker (1 def + 1 call site); --runs choices=(3,); allow-list env (0 os.environ.copy); the only shutil.copy2 is the legitimate .pi/agent credential copy (settings/auth/fd), not a launcher/helper/broker copy — the v6 copy-to-fixture concern is gone.

Independence

• Substantive principal-independence of review-v7 is satisfied by an orchestrator-dispatched, builder-distinct Opus SECREV (ms-secrev-828, byte-only, non-builder) — that IS the substance of Gate-16.
• The shared ms-lead-reviewer git signer on both the harness (ms-rev-826 build) and the review commit is evidentiary, not substantive. It is resolved by (1) this Mos co-attestation under a distinct identity (mos-orchestrator), and (2) a homelab third-principal verify under its own distinct identity — three distinct-identity principals of record. Tracked fleet-infra tooling-gap (durable fix = per-lane distinct signers), not a blocker.

Scope of this record — byte-clear, NOT fire-authorization

Producing probe evidence executes the Gate0 mechanism; a byte-clear is not a fire-authorization. This co-attestation clears the bytes / scope / mechanism / hygiene on the v7 full-closure bar. FIRE remains gated on: homelab third-principal re-verify (under its own distinct identity) + Mos transparency-to-Jason + Mos explicit FIRE GO. Until then: nothing banked, WI-3 #830 held at f4008307 (unmoved), C-hatch armed (if the materialized-closure rig still no-fire / wrong-value / assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason).

Mos verdict: v7 full-closure byte-scope + mechanism + hygiene PASS. Co-attestation of record — committed.