# Round 9 review — GLM identity pass, sections 1–4 (revision 15)

**Scope reviewed:** Sections 1 (Product contract), 2 (Scope and threat model), 3 (Components), 4 (Borrowing from Flux), checked against the round-8 disposition and binding UX constraints.

**Checks performed:**

- **Biometric matrix vs. binding UX (§1):** Allow-once/deny-once/cancel require no biometrics; every reusable rule (session, timed, Forever, create/change/remove) requires one biometric; command/1Password/credential release require one. No double-biometric, downgrade-to-Once, or rule-without-biometric path exists in the text. Consistent.
- **Threat model vs. component boundaries (§2/§3):** The malicious unprivileged requesting process is addressed at every boundary it touches: live code-identity validation per privileged XPC request, caller UID capture, root-owned placements that resist same-user replacement (including the "older signed authority" rollback case from Opus 2, present as required), command frontend signature explicitly not treated as consent, and adapter provenance attestation without claiming atomicity of Accessibility observations. Consistent.
- **Disposition corrections:** Opus 2's activation/launch anti-rollback language is present in §3. Opus 1 (floors) and Opus 3 (auto-recapture) live in out-of-scope sections; nothing in §1–4 contradicts them, and §1's "one explicit decision authorizes one captured action" is compatible with recapture-as-new-request.
- **Key custody (§3):** Transport/authority/credential-receiving key separation is coherent; the dedicated-account fallback is correctly limited to transport-only keys; the blocker-and-consult path honors the UX consultation rules and does not force GUI login, physical access, or re-pairing.
- **UX regression scan:** No added confirmations, shortened windows, forced re-enrollment, or restricted commands were introduced by the revision-15 corrections within these sections.
- **Flux reuse (§4):** No-license status correctly yields design-reference-only reuse with independent implementation; no Linux-specific assumptions imported.

No substantive actionable defects found in the reviewed sections.

NO SUBSTANTIVE FINDINGS