stack/docs/compaction-refresh/reviews/GATE0-PROBE3-V8-ENVBYTECODE-S3-REVIEW-v8.md

⚠ SUPERSEDED by v9: the reviewed harness a92ad090 is superseded by the narrow fix 1c34e3cb (my v8 B6(c) FAIL — -I on the launcher — was remediated by -I→-s + PYTHONNOUSERSITE=1; re-review v9 = PASS). This v8 FAIL record pertains to the superseded commit.

Gate0 Probe-3 (D4) Broker Env-Isolation + Bytecode Binding — §3-Conformance Review v8

Verdict: ❌ FAIL (B7 and B8 land correctly, but the same change breaks B6(c): the launcher is run with -I, which strips the script directory from sys.path on Python 3.11+, so its bare import lease_generation cannot resolve the pinned helper — empirically confirmed).

Pin (GUARD 1 — reviewed object)

• Reviewed object = a92ad090ae3828c643f961c7628d809b8521185f (harness commit, branch feat/827-gate0-probe).
• Reviewed file: docs/compaction-refresh/probes/p3_d4_focused_run.py — sha256 (pushed provider bytes, -o FILE, FULL-40 ref, verified before trust): 915ebeb5aeab108cb60c5f629c1db520623ab4914eed427ca34ee66f9aa08390 (32614 bytes, no not-found sentinel).
• Closure pins (unchanged from v7): launcher e950e422… @f4008307 · helper 061625402f08488eac47acd23272904e71fd1a71fd15b3bdab158632c801be4c @f4008307 · broker 4db4fef1… @23c0caca.

Independence (GUARD 2 — principal-independence attestation)

Distinct Opus SECREV session, orchestrator-dispatched — the ms-secrev-828 reviewer lane, dispatched by mosaic-100 — byte review only, ran nothing (the harness/broker were not executed); did not build this harness (builder = ms-rev-826); is not Mos. This verdict is my own. (The -I semantics check below runs a throwaway two-line script to observe the interpreter's sys.path behavior — it does not run the harness, broker, or any part of the reviewed closure.)

🔴 BLOCKING FINDING — B6(c) broken: -I on the launcher strips the pinned-helper import path

File:line — p3_d4_focused_run.py:512 (the "-I" added to launch_verified_pi's launcher command).

The pinned launcher launch-runtime.py @f4008307 imports its helper with a bare top-level import: from lease_generation import initialize_runtime_generation (launcher line 15) — no sys.path manipulation. Under v7 this bound because python3 pinned/launch-runtime.py put the script's directory (pinned/) at sys.path[0], so the sibling lease_generation resolved to pinned/lease_generation.py.

v8 now runs the launcher as python3 -I -B pinned/launch-runtime.py … (:512-513). -I implies -P (Python 3.11+), which does NOT prepend the script's directory to sys.path. Empirically confirmed on this host (Python 3.11.2), using a throwaway script (not the harness):

python3 -I -B main.py  → sys.path[0] = '/usr/lib/python311.zip'
                          import sibling → ModuleNotFoundError: No module named '…'
python3    -B main.py  → sys.path[0] = '<script dir>'  → sibling import: OK

Therefore, at FIRE on Python 3.11+, the launcher's line-15 from lease_generation import … raises ModuleNotFoundError at module load — the pinned helper does not resolve (neither pinned nor worktree; the import simply fails). B6(c) — "launcher sibling-import to pinned/ via sys.path[0] STILL BINDS" — does not hold. The build report's assertion "-I keeps script dir" is false on 3.11+, and could not have been observed under the correct "never run" boundary.

Note: the env allow-list carries no PYTHONPATH (correct for B7), and -I ignores PYTHON* env regardless, so there is no alternate resolution path — the launcher import is unrecoverable under -I.

Fix: remove -I from the launcher command only (keep -B + the env= allow-list — the launcher's env-isolation is already provided by the constructed allow-list, which contains no PYTHONPATH/PYTHONHOME/ PYTHONPYCACHEPREFIX, and it needs pinned/ at sys.path[0] for the sibling import). Keep -I on the broker command (it loads the helper by explicit --generation-module path via importlib, so it never needs the script dir on sys.path). Alternatively, inject the pinned dir explicitly (e.g. PYTHONPATH=pinned/ — but that reintroduces a PYTHON* passthrough B7 forbids, so dropping -I on the launcher is the clean fix).

What DID land correctly (for the author's fast turnaround)

• B7 — broker child env-isolated: correct. launch_verified_broker now takes environment and passes env=environment (the constructed allow-list, not os.environ) to Popen (:566-568); the broker command includes -I (:551); the allow-list contains no PYTHONPATH/PYTHONHOME/PYTHONPYCACHEPREFIX passthrough. The broker child cannot inherit ambient env or resolve stdlib imports to ambient code. ✅
• B8 — bytecode pinned-or-suppressed: correct. PYTHONDONTWRITEBYTECODE=1 is in the allow-list env (:728) and -B is on both child commands (:512-513 launcher, :551-552 broker); reject_pinned_bytecode fails closed (RuntimeError) on any pre-existing pinned/__pycache__ or *.pyc (:498-501) and is called before each consumer (:534 launcher, :561 broker). No unpinned .pyc can be executed. ✅
• B5 conjunction / B6 single-helper / closure-import-guard / BAR1 / BAR2 (.state fidelity untouched) / BAR3 (live-path, fail-closed precondition, fixture-socket isolation, lease_anchor_registered + hex-256) / single p3 broker / -O-safe / allow-list env / --runs==(3,) / ABSENT sweep: all intact/unperturbed (the delta touches only the env/-I/-B/bytecode-reject surfaces). These are not the failing item.

Verdict

FAIL @ a92ad090. B7 (broker env isolation) and B8 (bytecode pinned-or-suppressed) are correctly implemented, but the -I added to the launcher command breaks B6(c): the launcher's bare from lease_generation import at f4008307:launch-runtime.py:15 cannot resolve the pinned helper because -I/-P strips sys.path[0] on Python 3.11+ (empirically confirmed, 3.11.2 → ModuleNotFoundError). PASS requires all of B7+B8+B5+B6+BAR1/2/3; B6(c) does not hold. Not softened → returns to author (ms-rev-826). The fix is narrow: drop -I from the launcher command (retain -B + allow-list env), keep -I on the broker.

Findings: B6(c) — p3_d4_focused_run.py:512 (-I on the launcher command; breaks the pinned-helper sibling import under Python 3.11+).

Scope reminder (not a finding)

Producing this evidence executes the Gate0 mechanism (§3/§5). This review clears bytes only; FIRE remains separately gated on Mos's post-clear GO — moot until this FAIL is remediated.

---

Reviewer: distinct Opus SECREV session (ms-secrev-828 lane, dispatched by mosaic-100), Gate-16 author≠reviewer, byte review only; ran nothing (harness/broker not executed). Reviewed object (pin): a92ad090ae3828c643f961c7628d809b8521185f · harness sha256 915ebeb5aeab108cb60c5f629c1db520623ab4914eed427ca34ee66f9aa08390.