# Round 8 GLM scoped review — sections 1–4, revision 14

**Scope:** Product contract; Scope and threat model; Components; Borrowing from Flux. Prior disposition (round 7, Opus findings) reviewed; those corrections concern update/activation behavior located in sections outside this pass and are not contradicted by the text reviewed here.

**Checks performed:**

- **Binding UX contract.** The biometrics table matches every binding constraint: single biometric for protected actions; cancel/deny-once/allow-once exempt; every reusable rule (Forever default, session/timed rules, create/change/remove) requires biometrics; "Do not silently select Once to avoid authentication" prevents auth-avoidance drift; no physical proximity or re-pairing is introduced (section 2 explicitly forbids proximity requirements after enrollment).
- **Internal consistency, sections 2 vs 3.** Relay limits (delay/drop/metadata only), root-signed protocol objects, one-time dispatch permits, consumption ledger, and E2E payload encryption coherently back the section 2 claims of tamper/replay/stale-dialog protection. The acknowledged non-atomicity of Accessibility observations is an honest documented residual, not a contradiction of stale-dialog protection (which is against replaying approvals onto new dialogs).
- **Key custody.** Transport/authority/adapter key separation is maintained; the pre-login fallback is correctly scoped to transport-only keys and explicitly excluded for credential-receiving and authority keys; "administrator-controlled" inherits the strict root-owned, non-user-writable definition established earlier in section 3; both failure paths end in a blocker plus user consultation rather than silent GUI-login dependence or key exposure.
- **Process boundaries.** Audit-token/code-signing validation per privileged XPC request, hardened runtime without exceptions, untrusted-same-user invocation of the command frontend, and enrolled-account-only policy close the confused-deputy and same-user injection paths within the stated assumptions.
- **Flux borrowing.** No-license status correctly forces design-only reference with independent implementation; Linux-specific PAM/socket behavior excluded; hardware attestation honestly not promised in v1, with software-keystore/biometric-fallback/recovery changes routed to user decision.

No defect found that has a concrete failure mode and a minimal correction without UX harm.

NO SUBSTANTIVE FINDINGS