stack/docs/compaction-refresh/reviews/GATE0-PROBE3-V10-NOSITE-S3-REVIEW-v10.md

Gate0 Probe-3 (D4) No-Site Startup Closure — §3-Conformance Review v10

Verdict: ✅ PASS

Pin (GUARD 1 — reviewed object)

• Reviewed object = ce5ba762051354338889959bfce2b0381f4a4e2a (harness commit, branch feat/827-gate0-probe).
• Reviewed file: docs/compaction-refresh/probes/p3_d4_focused_run.py — sha256 (pushed provider bytes, -o FILE, FULL-40 ref, verified before trust): 7e14ead89a7b2a297fcc17e7653291b3bcace1d2002a8f90a989db74f6985b6f (32753 bytes, no not-found sentinel).
• Closure pins (unchanged): launcher e950e422… @f4008307 · helper 061625402f08488eac47acd23272904e71fd1a71fd15b3bdab158632c801be4c @f4008307 · broker 4db4fef1… @23c0caca.

Independence (GUARD 2 — principal-independence attestation)

Distinct Opus SECREV session, orchestrator-dispatched — the ms-secrev-828 reviewer lane, dispatched by mosaic-100 — byte review only, ran nothing (harness/broker not executed); did not build this harness (builder = ms-rev-826); is not Mos; distinct principal from both. This re-verifies from scratch on the v10 SHA after homelab's 4th-round FAIL @1c34e3cb (no -S → site startup-closure hole) superseded my v9 PASS + Mos's co-attest. The -S/-s/-I behavior checks below use a throwaway script to observe interpreter startup — not the harness.

★ B9 — No-site startup closure (the homelab 4th-round FAIL)

The delta vs 1c34e3cb is exactly two -S insertions, byte-confirmed by diff (nothing else; +28 B fully accounted by the two "-S",\n lines):

• (i) Launcher command (launch_verified_pi, :512-516): sys.executable, "-s", "-S", "-B", str(launcher), … — carries -s + -S + -B, and no -I.
• (ii) Broker command (launch_verified_broker, :551-554): sys.executable, "-I", "-S", "-B", str(broker_path), … — carries -I + -S + -B.
• (iii) site not imported at child startup — empirically confirmed (Python 3.11.2, throwaway script): python3 -s -S -B main.py → sys.flags.no_site == 1, 'site' in sys.modules == False; python3 -I -S -B main.py → no_site == 1. So system-site .pth executable lines and sitecustomize/usercustomize cannot run unpinned startup code before the pinned launcher/broker. (Contrast without -S: python3 -s -B → no_site == 0, site imported — the exact v9 hole this closes.)
• (iv) No harness reliance on any site-injected path/hook (env is the constructed allow-list; children execute pinned bytes).
• (v) -S does not touch sys.path[0] (unlike -I/-P) — empirically confirmed: python3 -s -S -B main.py keeps sys.path[0] = the script's directory, so the launcher's bare from lease_generation import initialize_runtime_generation (f4008307:launch-runtime.py:15) still binds pinned/lease_generation.py with -S present. The broker's explicit --generation-module import (via importlib) binds the pinned helper regardless of sys.path/site, so -I -S is correct there.
• (vi) Delta = exact 2-line -S only vs 1c34e3cb (git-diff/byte-compared, not accepted on assertion).

All prior bars — byte-stable (delta was only the two -S lines)

• B6(c): launcher still carries no -I; sibling import binds pinned/ (confirmed above with -S present). ✅
• B7: broker Popen env=environment (allow-list, not os.environ; no PYTHONPATH/PYTHONHOME/ PYTHONPYCACHEPREFIX) + -I. ✅
• B8: reject_pinned_bytecode fail-closed before each consumer; PYTHONDONTWRITEBYTECODE=1 + PYTHONNOUSERSITE=1 in env; -B on both children. ✅
• B5: 3-leg conjunction — materialize each of launcher/helper/broker from git-object bytes with sha256==pin fail-closed; pinned/ 0o700 in fixture root, files O_EXCL 0o600 (no writable window); re-hash ==pin immediately before each Popen; launcher + broker consume the same single pinned helper. ✅
• B6: closure_import_guard AST present; single pinned helper; broker --generation-module = closure.generation. ✅
• Fidelity: extension bumps generation-{sid}.state via MOSAIC_LEASE_GENERATION_FILE (not in-mem); broker read_runtime_generation; assert_d4 generation_source=="state-file" / state_file_in_fixture_root / new→MUTATOR_UNVERIFIED / prior→STALE_GENERATION; .state fixture-root-bound. ✅
• Traceability: GATED_WI_HEAD == f4008307 + merge-base --is-ancestor 66b1e0a0 f4008307. ✅
• lease_anchor_registered + hex-256 INTACT; LIVE-PATH (pinned gated launcher); single p3 broker; promotion=fixture-only; --runs choices=(3,); -O-safe (0 bare assert); copy2 = creds-only; allow-list env (0 os.environ.copy). ✅

ABSENT sweep

P5/P6/P2-bank/retry-launder/mosaic-yolo/execRuntime = 0; source-invalid = 0; no live/real-broker path; no .state outside fixture root; no exec-at-import (__main__-guarded); no adjacency-only-exec-from-worktree; the only change is the authorized -S no-site isolation-deepening (no mechanism change, no scope-widen); -O-safe.

Verdict

PASS @ ce5ba762. B9 (no-site startup closure) is closed — both children carry -S, site is not imported at startup (so system-site .pth/sitecustomize cannot execute unpinned code before the pinned launcher/broker), -S leaves sys.path[0] intact so the launcher sibling import and the broker explicit-path import both still bind the pinned helper, and the delta vs 1c34e3cb is exactly the two -S insertions. All prior bars (B5/B6/B6c/B7/B8/ fidelity/traceability/lease_anchor/live-path/single-broker/promotion/--runs/-O-safe) are byte-stable. Zero out-of-scope surface. Findings: none.

Scope reminder (not a finding)

Producing this evidence executes the Gate0 mechanism (§3/§5). This review clears bytes only; FIRE remains separately gated on Mos's explicit post-clear GO, his byte-scope-verify co-attestation, and homelab's third-principal verify — not authorized by this review.

---

Reviewer: distinct Opus SECREV session (ms-secrev-828 lane, dispatched by mosaic-100), Gate-16 author≠reviewer, byte review only; ran nothing. Reviewed object (pin): ce5ba762051354338889959bfce2b0381f4a4e2a · harness sha256 7e14ead89a7b2a297fcc17e7653291b3bcace1d2002a8f90a989db74f6985b6f.