From c948452cf768d22b5e9d72eeee303a1f631ef8b6 Mon Sep 17 00:00:00 2001 From: code-be-02 Date: Mon, 24 Aug 2026 21:00:42 -0500 Subject: [PATCH] fix(git-tools): sanitize WP5b for the public-package gates (review identity scrub + tool index) verify-sanitized denylist: an operator-identity token in a ci-queue-wait comment (spec finding references genericized - the framework-PR firewall applies to shipped files). check-tools-index: repo-decl.sh shipped means documented in the resident index in the SAME commit, and executable. Full sanitization CI step replayed green locally (verify-sanitized, resident budget x2, enumeration guard, tools index x2). --- packages/mosaic/framework/defaults/TOOLS.md | 1 + packages/mosaic/framework/tools/git/ci-queue-wait.sh | 2 +- packages/mosaic/framework/tools/git/repo-decl.sh | 0 3 files changed, 2 insertions(+), 1 deletion(-) mode change 100644 => 100755 packages/mosaic/framework/tools/git/repo-decl.sh diff --git a/packages/mosaic/framework/defaults/TOOLS.md b/packages/mosaic/framework/defaults/TOOLS.md index 6b0bf178..5ee67c84 100644 --- a/packages/mosaic/framework/defaults/TOOLS.md +++ b/packages/mosaic/framework/defaults/TOOLS.md @@ -23,6 +23,7 @@ absent. Do not use raw `tmux send-keys` for fleet messaging. ```bash tools/git/pr-create.sh ... tools/git/issue-create.sh ... tools/git/pr-merge.sh ... tools/git/ci-queue-wait.sh --purpose push|merge # REQUIRED before any push/merge +tools/git/repo-decl.sh # shared .mosaic/repo.json consumption lib (sourced) ``` **GITEA_LOGIN gotcha** — the wrappers default to login `mosaicstack`; on a USC repo that fails with diff --git a/packages/mosaic/framework/tools/git/ci-queue-wait.sh b/packages/mosaic/framework/tools/git/ci-queue-wait.sh index f26b13ba..07f3b87b 100755 --- a/packages/mosaic/framework/tools/git/ci-queue-wait.sh +++ b/packages/mosaic/framework/tools/git/ci-queue-wait.sh @@ -503,7 +503,7 @@ if [[ -z "$BRANCH" ]]; then fi fi -# T51 WP5b (spec 4.1, C4/jarvis F8): the declaration adds ROUTE CONTEXT only. +# T51 WP5b (spec 4.1, review ruling C4/F8): the declaration adds ROUTE CONTEXT only. # Branch-selection semantics are UNCHANGED — the guard keeps inspecting the # exact head above. No declaration dependency gates the wait (4.3/DR2 R9: # blocking here adds a blocker with no safety gain); absence is silent. diff --git a/packages/mosaic/framework/tools/git/repo-decl.sh b/packages/mosaic/framework/tools/git/repo-decl.sh old mode 100644 new mode 100755