# Independent review — Remozio plan, revision 27

Scope assessed: full plan, including post-revision-5 additions (audit journal/epochs, request age/expiry, presence routing, push, LAN/relay + Cloudflare, gateway control plane, component identity/Sparkle, protocol evolution, mixed devices and component versions), plus the round-20 disposition changes (pre-login witness availability, transient-fault recovery). Plan-only review; no testing, browsing, or source inspection was performed or is claimed.

## Areas specifically exercised

- **Cross-invariant consistency**: consumption-before-dispatch (§6, §12) vs. memory-only pending payloads and restart cancellation (§6, §17 matrix) vs. recapture rules after unexpected root restart (§17) — consistent; recapture is restricted to never-consumed identities with fresh challenge and preserved age.
- **Epoch/witness interplay (§12, §16)**: fresh random epoch per start, checkpoint anchored at epoch creation and trust/floor/replay changes, transient witness faults in a retryable admission-closed state with automatic backoff (round-20 fix), distinguished from genuine continuity mismatch requiring administrator recovery. No contradiction found; "a timeout alone is not rollback evidence" resolves the prior failure mode without weakening rollback detection.
- **Downgrade/replay coverage**: decisions bind digest + challenge (§6); routing and update-scheduling controls bind operation ID, revision, expiry under the narrow decision key with no target-action authority (§6, §14, §17); gateway controls bind lifecycle epoch + monotonic revision with authenticated-head reconciliation and revocation tombstones (§16); negotiation transcript authenticated and floors persisted independently of replaceable binaries (§17, §18); request re-encoding to weaker schemas forbidden (§18). No gap found.
- **Scope classification**: one-time vs. reusable effect classification from retained semantics and validated per-app/version behavior, enforced independently by root and adapter, with unknown compatibility contracts barred from inheriting one-time classification (§1, §6, §9). The Little Snitch allow-once exception remains narrowly confined; it is not widened to commands or 1Password.
- **Privileged update path**: protected-placement invariant, external activation boundary, floor commit only after quiescence and replacement checks, update-installing no-admission responses with bounded caller wait and fresh resubmission (§3, §17). The acknowledged tension (Sparkle vs. root-owned placement, possible renewed administrator authorization) is an explicitly defined feasibility gate with a consultation path, not a defect.
- **UX preservation**: biometric-free cancel/deny-once/allow-once retained; no lock-screen surface (matches the clarification); no forced warnings or truncation; 5-minute provisional expiry; streaming stdin preserved; update/routing controls add no biometric prompts and grant no action authority; routing changes cannot strand requests silently (§1, §7, §13–15, §17).

## Tentative UX choices (already recorded as pending decisions, not defects)

These remain open per the plan's own tracking and are flagged only for visibility: the migration-ceremony cost and its remote flow (§3), the single-biometric credential-release outcome (§7), the sudoers-policy choice (§8), the atomic-execution options if descriptor-based execution fails (§8), StrongBox-vs-TEE and biometric-invalidation policy (§4, §5, §7), the local command approval surface (§14), the idle interval, and the retention duration/budget. None may be silently resolved; all have defined evidence-and-consultation paths.

## Remaining implementation verification limits

Convergence here means no unresolved *planning* defects. It does not establish: Secure Enclave pre-login custody + code-identity restriction feasibility; a witness mechanism meeting the combined availability/anti-rollback requirements; 1Password/Little Snitch AX fixture behavior and true one-time semantics; descriptor-based execution; background Access authentication; privileged installation/anti-rollback enforcement on the macOS 14+ floor; push delivery under Doze/force-stop. Each is a scheduled gate with a failure/consultation path.

## Conclusion

**NO SUBSTANTIVE FINDINGS**

The revision-27 plan is internally consistent across its earlier invariants and the newer audit, routing, transport, update, and protocol-evolution requirements. The round-20 disposition (pre-login witness availability, automatic transient-fault recovery) is correctly integrated in §12 and §16 without contradicting rollback detection or the remote-UX contract. All flagged uncertainties are defined feasibility gates or recorded pending user decisions rather than unexamined assumptions.