# Independent review — Remozio plan, revision 24 (round 18)

Scope: full plan, all 18 sections, including post-revision-5 additions (audit journal/epochs, timing/expiry, presence routing, push, LAN/relay, code identity, Sparkle updates, protocol evolution). Plan-only review; no testing or source inspection claimed. I also reviewed the round-17 disposition and find its two K3 fixes correctly integrated (§12 writer lock/head-mismatch handling; epoch-creation trust generation as descriptive metadata).

## Boundaries assessed

**Command binding (§6, §8):** Capture-before-approval, canonical digest recomputed by both verifiers, verified-requester identity from OS queries rather than caller labels, stdin source classification with explicit disclosure of uncaptured caller-controlled input, distinct exit statuses, and no-atomic-guarantee honesty (descriptor execution and the path/recheck race are explicitly gated with a no-silent-relocation rule). Consistent with §1's full-command display requirement.

**Biometric/key separation (§1, §6, §7):** The narrow decision key's purposes (one-time UI decisions, cancellation, routing, update scheduling) are enumerated and explicitly barred from commands, 1Password, credentials, enrollment, and reusable rules; both verifiers derive key class from retained semantics, not message assertions. The confirmed Little Snitch allow-once exception is not widened. "True one-time effect" validation, including second-attempt inheritance, is scheduled fixture work, not an assumed result.

**UI race handling (§6, §9, §13):** One-time permit consumed before any dialog mutation; scope selection + re-read + click as one bounded attempt; failure mid-mutation → unknown, no retry, refresh labeled with possibly-modified default; permit death/timeout → unknown with actor quiesce; expiry vs. disappearance vs. observed target timeout kept distinct. Internally consistent with the §17 restart matrix.

**Replay/downgrade resistance (§12, §16, §17, §18):** Fresh random journal epoch per root start with no sequence reuse; gateway control bound to lifecycle epoch + monotone revision with Mac-signed receipts required for counter reconciliation (a higher number alone is correctly rejected); floors persist independently of replaceable binaries; activation boundary is external to the candidate binary; negotiation transcripts are authenticated with domain separation, and security floors cannot be lowered by negotiation. The rollback/witness problem is honestly scoped as a feasibility gate with an explicit failure/consultation path and offline-operation preservation — per the review rules, not a defect.

**Privileged update path (§17):** Protected-placement invariant, no unprivileged-writable root code paths, quiescence-checked activation, floor commit as one durable transaction, no rollback below committed floor, and UX-preserving drain semantics (long commands defer activation rather than being killed). The "Update installing" bounded frontend resubmission correctly creates fresh capture and never replays decisions or pre-consumes stdin.

**Relay resistance (§15, §16):** Opaque push payloads, end-to-end payload encryption independent of Access/HTTPS termination, token-possession proof before mapping activation, transport credentials unable to mutate mappings, gateway never an enrollment authority, revoked-phone rejection at the Mac independent of gateway/Access cleanup.

**Cross-section contradiction check:** §14 handoff preserves immutable selection (§7) and first-decision-consumes (§6); §12 audit exclusions are consistent with §8's signed requester row (metadata classes are closed; raw values stay memory-only); §5 multi-phone delivery reconciles with §14 routing (routing gates delivery, ledger serializes consumption); §6 in-memory pending payloads match §17's no-cross-restart-handoff rule. No earlier invariant was found weakened by later additions.

## Tentative UX choices (explicitly deferred, not defects)

Per the review rules these are recorded as pending user decisions, not findings: the automatic-routing idle interval (§14, 30s draft), audit retention duration/budget (§12), the migration ceremony cost/flow (§3), and the ~60s 1Password estimate pending per-version validation (§13). None is silently resolved in the plan.

## Remaining implementation-verification limits

A no-findings conclusion is about planning coherence only. The plan's security claims still depend on: the §3 key-custody/pre-login spike, §7 single-biometric credential release spike, §8 atomic-execution and sudoers gates, §9 1Password/Little Snitch fixture validation, §14 local-command-approval path, §16 restored-trust witness gate, §17 protected-placement/Sparkle-version validation, and the Flux license remaining unresolved (§4 — reference-only reuse until then). Failure of any gate follows the documented consultation path; that is planned work, not convergence debt.

## Conclusion

NO SUBSTANTIVE FINDINGS. Revision 24 is internally consistent across the new and old sections, preserves the confirmed UX contract (biometric-free once/cancel decisions, biometrics for all reusable rules, full command display, remote-first operation without recurring steps), keeps all three adapters in scope, and routes every unproven platform assumption through a defined feasibility gate with an explicit failure path rather than asserting it.