# Independent plan review — revision 15

## Scope assessed

I reviewed the complete plan, with focus on the post-revision-5 additions and their interaction with earlier invariants:

- **Audit (§12) vs. data minimization (§6)**: exclusions for journal, cache, exports, and diagnostics are consistent; consumption+audit commit in one transaction; unknown outcomes can't be rewritten as success; revoked-phone offline cache limitation is explicitly documented rather than papered over.
- **Expiry/timing (§13) vs. capture and UI revalidation (§6, §9)**: two-clock model is coherent; monotonic-with-sleep expiry on the Mac, labeled estimates on the phone, revalidation before dispatch even during an open biometric prompt, and no authority revival from refresh or elapsed estimates. The three disappearance cases (observed timeout / unknown disappearance / post-dispatch) are correctly kept distinct.
- **Presence routing (§14) vs. consent model (§1, §6)**: routing affects delivery only; manual overrides grant no authority; local-kept requests expire without leaking stale approvals; handoff preserves age/deadline/identity; the local-command approval surface is a defined feasibility gate with an explicit interim caller-visible behavior, not an unplanned gap.
- **Push/relay (§15, §16) vs. trust boundary (§2, §3)**: opaque wake identifiers, fetch-after-wake with pinned identities, no plaintext to gateway/relay, revocation enforced at the Mac before Access revocation completes, token-as-metadata only, dedupe by request identity. Downgrade resistance in §18 (authenticated transcript, no retry to older format after signature failure, floors immune to negotiation) closes the relay downgrade path.
- **Updates/identity (§17) vs. root-authority invariants (§3, §6)**: the round-8 corrections are properly integrated — floors are proposed until quiescence + checks, then committed in one durable transaction; anti-rollback is enforced at an activation/placement boundary independent of the candidate binary, with the authority's self-check explicitly demoted to defense-in-depth; backup restoration cannot lower floors/ledger; the restart matrix composes with §6 crash rules, and automatic recapture is correctly restricted to never-consumed requests with fresh challenge and fresh consent (no consent reuse).
- **Protocol evolution (§18) vs. multi-phone consumption (§5, §6)**: one immutable request + one ledger; per-phone contract filtering; no re-encoding to weaker schemas; envelope and request contracts verified separately with domain separation. The v1/v1+v2 selection rule (largest eligible set, ties to highest version) is consistent with the acceptance cases.
- **Key separation (§6, §7)**: decision key purposes remain narrow; update-scheduling (§17) is a separate purpose that cannot supply artifacts, alter floors, or authorize target actions, and its worst-case misuse (initiating a drain) is visible and reversible — acceptable under the trusted-unlocked-phone assumption already adopted for allow-once.
- **UX preservation**: no new biometrics, confirmations, shortened windows, command restrictions, or forced re-pairing were found introduced; deferred preferences (idle interval, retention duration, 1Password lifetime estimate) are explicitly user decisions, so per the review instructions they are not findings.

## Remaining tentative UX choices (explicitly deferred, not defects)

Automatic idle interval (§14, 30s draft), audit retention duration/budget (§12), sudoers compatibility policy selection (§8), biometric-invalidation key policy (§5/§7), and the executable-race guarantee options (§8) all have defined evidence + consultation paths.

## Implementation verification limits

This review cannot validate the feasibility gates themselves: protected placement/anti-rollback enforcement on macOS 14+, single-biometric credential release, secure-field targeting, Little Snitch one-time effect semantics, pre-login key custody, background Access auth, and real-device delivery latency. Convergence here means planning coherence, not platform proof — consistent with §11's own definition.

## Conclusion

**NO SUBSTANTIVE FINDINGS**

The post-revision-5 additions are internally consistent with the earlier security invariants; downgrade, replay, rollback, and cross-component race paths appear closed at the planning level; the confirmed biometric exceptions remain narrowly scoped to Little Snitch one-time effects with dual verification; relay/gateway compromise is bounded to delay/metadata; and all three adapters remain in scope with unambiguous failure/consultation paths where feasibility is unproven.