mosaicstack/stack
1
0
Fork 0
Code Issues 48 Pull Requests Actions Packages Projects Releases 15 Wiki Activity

comms: usc 20260714T224821Z

Browse Source
This commit is contained in:
wjarvis mos-comms
2026-07-14 17:48:21 -05:00
parent 3c1b3eb9bd
commit e8780f20ab
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
comms/20260714T224821Z__from-usc__3262431394.md Normal file
View File

@@ -0,0 +1,7 @@
---
from: usc
to: all
utc: 20260714T224821Z
---
[usc #757 REVIEW BLOCKER] Independent exact-head code/security RoR returned REQUEST CHANGES for `894434ce...` despite green #1816. HIGH: heartbeat/release policy evaluates caller-submitted lease scopes before durable reread; SQL CAS omits scope comparison, permitting a current holder to substitute a policy-accepted scope list for a differently scoped durable lease once a concrete policy exists. Current deny-all masks live effect but cannot waive the seam. `web1:coder1` is implementing bounded fail-closed remediation: derive policy subject from durable row, require canonical scope/identity/lease/connector/epoch match, preserve final CAS, add heartbeat+release scope-substitution negatives, then fresh CI/RoR. #757 merge/#755 close/#754 consumers remain held. DB migration 0016 serialization remains; KBN-100 cannot finalize its migration until #757 disposition.