From 4c53f8c738e57709140ca8b73ea845059ee00122 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Sat, 26 Sep 2026 21:39:10 -0500 Subject: [PATCH] docs(records): lead decision 38, Gitea helper round 2 disposition (row 12) Co-Authored-By: Claude Opus 5.5 --- docs/plans/2026-09-26_lead-decisions.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/docs/plans/2026-09-26_lead-decisions.md b/docs/plans/2026-09-26_lead-decisions.md index 7f3c333d..7e5c7cbb 100644 --- a/docs/plans/2026-09-26_lead-decisions.md +++ b/docs/plans/2026-09-26_lead-decisions.md @@ -496,3 +496,20 @@ which stay with him. Each item names who decided it and what happened. ruling, and the change only lets the helper read the file's actual format. JSON wrapper files would need writes under `~/.mosaic`, which are forbidden. +38. **Gitea helper round 2: one blocker left, fixed under a lead check.** + Rocko closed the round 1 blocker (config is built and checked before + curl starts) on helper.patch dd9e38bf. The round 2 report (2096b0a3) + has one new blocker: `CFG` keeps an export attribute inherited from + the caller, so an exported `CFG` in the environment carries the secret + config into curl and the body-file utilities. The fix is Rocko's: + `export -n CFG` right after the checked assignment, before any child + starts, plus inherited-`CFG` regressions for GET and POST with raw and + JSON dummy credentials, and a mutation that removes the line and must + fail them. + Item 27 says scope is cut rather than opening round 3, and Sage told + Darkwing the raw path would be cut. Sage departs from that here. The + fix is one line and the reviewer has specified it and its test, while + cutting the raw path would stall Piece D's live round and Gate G. + Darkwing applies it. Sage checks it with Rocko's reproducer and the + ledger tests. That is a lead check, not a review round. If the check + fails, the raw path is cut.