132 lines
9.2 KiB
Markdown
132 lines
9.2 KiB
Markdown
# GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v7 full-closure)
|
|
|
|
**Principal:** Mos (orchestrator, merge authority for the mosaic-stack governance lane).
|
|
**Committed under a DISTINCT git identity** (`mos-orchestrator@mosaic.local`) — deliberately NOT the
|
|
`ms-lead-reviewer@mosaic.local` lane signer that authored both the harness and the §3 review — so this
|
|
record stands as a *distinct-identity* co-attestation. See "Independence" below.
|
|
|
|
**Verify class:** independent provider-byte read (guarded `git show <full-40>:path | sha256sum`) plus
|
|
source-level inspection of the executed mechanism. Not a re-build, not a re-run. This SUPERSEDES the v6
|
|
co-attestation `12914d8` (and its SUPERSEDED-note `b6bd0cd`), which was byte-clear on the v6 bar only
|
|
and was overtaken by homelab's third-principal FAIL @2d54a9dd + the resulting stricter full-closure bar.
|
|
|
|
## Package under attestation
|
|
|
|
| Artifact | Ref |
|
|
|---|---|
|
|
| Branch | `feat/827-gate0-probe` |
|
|
| Harness commit-40 | `f609a44953f5ae61916805fcb45ca337de00b0b0` |
|
|
| Harness `p3_d4_focused_run.py` sha256 | `0f1bd1b39399b32f243d901230e2d840794a2144edd723a095dab716833a7a9b` (32071 B) |
|
|
| §3-review-v7 commit-40 | `2bba933f67c821899d320a938a9473a73a136422` (adds only the review `.md`; harness parent byte-stable) |
|
|
| Review path | `docs/compaction-refresh/reviews/GATE0-PROBE3-V7-FULLCLOSURE-S3-REVIEW-v7.md` |
|
|
|
|
**Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins):**
|
|
|
|
| Member | Source (commit:path) | Pin sha256 | Size |
|
|
|---|---|---|---|
|
|
| launcher `launch-runtime.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py` | `e950e422…` | 4237 B |
|
|
| helper `lease_generation.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py` | `061625402f…` | 3769 B |
|
|
| broker `p3_generation_broker.py` | `23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py` | `4db4fef1…` | — |
|
|
|
|
> Note: `f4008307` (the held WI-3 #830 gated head) is **not on origin** — it exists only as a local
|
|
> `git worktree` on the build host. Mos recomputed the launcher+helper pins from that worktree
|
|
> (`stack-cr-wi3-revoke`, HEAD == `f4008307`) rather than passing over a clone-completeness gap. The
|
|
> broker pin was recomputed from origin `23c0caca`.
|
|
|
|
## Findings — VERDICT: byte-scope + mechanism + hygiene **PASS** (v7 full-closure bar)
|
|
|
|
Homelab's stricter bar — **hashed==executed on the FULL executed closure (launcher + helper + broker)**
|
|
— is met. Verified at the source, not accepted on the review's assertion:
|
|
|
|
**B5 conjunction (the load-bearing repair) — HELD, all three legs:**
|
|
- **(a) materialized from pinned git-object bytes, NOT the mutable worktree.** `materialize_closure`
|
|
fetches each member via `git_object_bytes` (`git show {commit}:{path}`), then
|
|
`sha256(data) == pin` **fail-closed** (`RuntimeError` on mismatch) before use.
|
|
- **(b) no writable window hash→consume.** `pinned/` is `mkdir(mode=0o700)`; each file is written with
|
|
`os.open(O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0o600)` — `O_EXCL` refuses a pre-planted file. No `chmod`,
|
|
no `os.rename/replace`, no `symlink`, and nothing re-opens a pinned file for write (grep = 0). The
|
|
pinned bytes are immutable within the fixture threat model between hash and exec.
|
|
- **(c) re-hash == pin IMMEDIATELY before each exec, no interleaved yield.** Launcher: re-hash then
|
|
`return PiRpc(command,…)` whose `__init__` **first statement** is `subprocess.Popen(command,…)` —
|
|
zero IO/yield/reopen between. Broker + helper: both re-hashed then `subprocess.Popen` on the next
|
|
line. Adjacency-alone-without-materialization (the v6 defect) is **absent** — all three exec from
|
|
`pinned/`.
|
|
|
|
**B6 — helper pinned AND bound to the SAME single copy.** The broker receives
|
|
`--generation-module {closure.generation}` (the pinned helper); the launcher runs from `pinned/` so its
|
|
`import lease_generation` resolves to the sibling pinned copy via `sys.path[0]`. `closure_import_guard`
|
|
AST-parses every member and raises on any non-stdlib import other than the allowed `lease_generation`
|
|
— proving the dependency closure is complete and no unpinned module can enter at runtime.
|
|
|
|
**Closure = exactly 3 files, materialized inside the fixture root** (`root / "pinned"`). No path escapes
|
|
the fixture temp root; no live/default broker; `.state` remains fixture-bound. **R1 owner tripwire NOT
|
|
tripped** — this deepened isolation of an already-authorized touch, it did not widen the touched surface.
|
|
|
|
**Invariants (all INTACT):** BAR1 `GATED_WI_HEAD == f4008307` and `merge-base --is-ancestor 66b1e0a0
|
|
f4008307` = YES (file-backed `.state` revocation fidelity present); BAR2 `.state` =
|
|
`socket_path.parent / generation-{sid}.state`, `state_file_in_fixture_root` + `generation_source ==
|
|
"state-file"` checks present; BAR3 `lease_anchor_registered` / live-path / fixture-socket isolation
|
|
intact. `-O`-safe (0 bare `assert`); ABSENT-sweep (`yolo`/`execRuntime`/`p3_bank`/`promote_p2`/`retry`)
|
|
= 0; single broker (1 def + 1 call site); `--runs choices=(3,)`; allow-list env (0 `os.environ.copy`);
|
|
the only `shutil.copy2` is the legitimate `.pi/agent` credential copy (settings/auth/fd), **not** a
|
|
launcher/helper/broker copy — the v6 copy-to-fixture concern is gone.
|
|
|
|
## Independence
|
|
|
|
- **Substantive principal-independence** of review-v7 is satisfied by an orchestrator-dispatched,
|
|
builder-distinct Opus SECREV (`ms-secrev-828`, byte-only, non-builder) — that IS the substance of
|
|
Gate-16.
|
|
- The shared `ms-lead-reviewer` git signer on both the harness (`ms-rev-826` build) and the review
|
|
commit is **evidentiary, not substantive**. It is resolved by (1) this Mos co-attestation under a
|
|
**distinct** identity (`mos-orchestrator`), and (2) a homelab third-principal verify under its own
|
|
distinct identity — three distinct-identity principals of record. Tracked fleet-infra tooling-gap
|
|
(durable fix = per-lane distinct signers), **not a blocker**.
|
|
|
|
## Scope of this record — byte-clear, NOT fire-authorization
|
|
|
|
Producing probe evidence **executes** the Gate0 mechanism; a byte-clear is not a fire-authorization.
|
|
This co-attestation clears the **bytes / scope / mechanism / hygiene on the v7 full-closure bar**. FIRE
|
|
remains gated on: **homelab third-principal re-verify** (under its own distinct identity) + **Mos
|
|
transparency-to-Jason** + **Mos explicit FIRE GO**. Until then: nothing banked, WI-3 #830 held at
|
|
`f4008307` (unmoved), C-hatch armed (if the materialized-closure rig still no-fire / wrong-value /
|
|
assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason).
|
|
|
|
**Mos verdict: v7 full-closure byte-scope + mechanism + hygiene PASS. Co-attestation of record —
|
|
committed.**
|
|
|
|
---
|
|
|
|
## ⚠️ SUPERSEDED — homelab v7 third-principal FAIL @f609a449 raised a stricter bar (evidence-integrity note)
|
|
|
|
This co-attestation was **byte-clear on the v7 full-closure bar ONLY** and self-limited above to
|
|
*"byte-clear NOT fire-authorization; FIRE remains gated on homelab third-principal re-verify."*
|
|
Homelab (the required third principal) subsequently returned **FAIL @f609a449** (static verify, no
|
|
code run), and Mos **UPHELD** it after independently confirming both findings in source — so the v7
|
|
byte-clear this document records is **SUPERSEDED** and does **NOT** authorize FIRE.
|
|
|
|
Two residual isolation/binding holes WITHIN the materialized closure (both independently reproduced
|
|
by Mos in the harness source; accepted as gate-**strengthening**, not softening):
|
|
1. **Broker child env not isolated.** `launch_verified_broker` (`:551`) calls `Popen` with **no
|
|
`env=`** (only `PiRpc.__init__` `:50` passes an allow-listed `env`) → the broker child inherits
|
|
ambient `os.environ` (PYTHONPATH/PYTHONHOME/PYTHONPYCACHEPREFIX). `closure_import_guard` is a
|
|
static AST check and cannot bind the child's runtime stdlib resolution.
|
|
2. **Executed bytecode-cache outside the pin.** No `PYTHONDONTWRITEBYTECODE`/`-I`/`-B`/`__pycache__`
|
|
handling anywhere. `exec_module` on the pinned helper writes derived `.pyc` the pin never covers;
|
|
only the `.py` is re-hashed → executed bytecode ≠ pinned-source-hash.
|
|
|
|
Both break "hashed==executed on the FULL executed closure" on **fidelity** grounds even in a
|
|
non-adversarial fixture. Mos **authorized the bounded repair** (broker `Popen` with strict
|
|
allow-listed `env=` + `-I` + `PYTHON*` stripped; bytecode-cache suppressed via
|
|
`PYTHONDONTWRITEBYTECODE=1`/`-B` + reject stray `__pycache__`/`.pyc` fail-closed before each
|
|
consumer; launcher sibling-import binding to the pinned helper preserved). This **rides the existing
|
|
(ii)-full-closure authorization + R1 + Mos adjudication** — it deepens isolation/binding of an
|
|
already-authorized touch, stays inside the fixture temp root, no fresh Jason owner-window. It is
|
|
**NOT a Case-C escalation** (no probe fired, no evidence produced — a static pre-fire catch, exactly
|
|
what the review gate is for). Added review bars **B7** (broker child env-isolated) and **B8**
|
|
(executed bytecode pinned-or-suppressed) on top of B5+B6+all priors.
|
|
|
|
**Live target = v8** (env-isolated + bytecode-pinned harness, forthcoming). `f609a449` /
|
|
`2bba933f` / this co-attestation (`e08ad03`) are **SUPERSEDED**. A fresh Mos co-attestation will be
|
|
committed on v8 byte-verify PASS. WI-3 #830 remains HELD at `f4008307`; nothing banked; C-hatch
|
|
armed; NO FIRE.
|