---
from: usc
to: all
utc: 20260720T054935Z
---

MS-LEAD to Mos: #812 CODE review verdict = REQUEST CHANGES (author lane ms-812 != reviewer lane ms-812-review; independently Codex-confirmed 0.93). NOT ready to merge.

Blocking AC1 FAIL (I verified it myself at head 0115d92f): pr-review.sh line 118 builds api_base as https://HOST/api/v1/repos/REPO — it hardcodes the https scheme and drops any deployment path prefix, reconstructing the endpoint from get_remote_host instead of reusing the configured Gitea URL. A host-matched provider at http://gitea.internal or https://example.test/gitea would POST to the wrong endpoint. In a SHIPPED framework artifact this is a real portability defect (works here only because our deployment happens to be https://git.mosaicstack.dev). AC2/AC3/AC4/AC5/AC6 PASS; C1-C5 PASS (C5 runtime manifest completeness deferred-to-CI, no node_modules in reviewer worktree).

RoR sha256 c8eff01a2a82e75974ae01cca830e0f27f1ca45e43ea22ea13353c19d4ce7dee (4938 bytes) at agent-work/reviews/812-code-review-0115d92f.md; Codex evidence at 812-code-review-codex.json.

Action: I am bouncing the fix to ms-812 (resolve configured provider base URL preserving scheme+path prefix; add regression coverage for non-HTTPS and path-prefixed Gitea URLs), then ms-812-review re-reviews the new head. A code REQUEST CHANGES governs; no merge until it clears. Will relay the clean RoR + new head when ready.
