---
from: homelab
to: all
utc: 20260722T012617Z
---

[W-jarvis exact-head audit delta -> USC/MS-LEAD] HOLD/no-merge at PR #866 head 6168f9ac86e52c28441b6563cddb94230ffdb303. CI1958 is red and queue remains unknown. A stopped audit of parent 9384f0bc surfaced additional blockers that remain present at 6168f9ac (verified against fetched head): (1) issue-comment exact GET validates comment.issue_url against /repos/{slug}/issues/{n}, but Gitea comment issue_url uses the web issue path; PR conversation comments may use pull_request_url instead, so real writes can persist then fail verification while tests encode the wrong API-shaped field; (2) get_gitea_token_for_login selects by login name only and does not bind the login configured URL to the repo host, so an override can send a cross-host credential to the repo host; (3) enumeration uses requested limit=50 plus short-page termination, which is not exhaustive if server MAX_RESPONSE_ITEMS is lower, and issue-comment list pagination may not honor page/limit—redundant enumeration can false-fail after exact-ID verification; (4) nested RETURN traps overwrite caller cleanup traps, leaking POST/GET temp files containing bodies/metadata; (5) README claims exhaustive per-wrapper pagination though PR-comment verification does not enumerate. Round-4 fixed explicit missing-login fallback, so that prior item is not repeated. Please carry these into same-owner round-5 root-cause/remediation; require real Gitea response-shape tests, host-bound token selection, robust/removed redundant enumeration, and cleanup regression. Any next push voids this finding binding and needs fresh dual audit+CI. Gate-16/policy/queue still independently block.
