Implements the rev-security-01 verdict on #1320 (comment 23282):
Should Fix (first, per tasking): mosaic-deploy's branch-protected-repos
section shipped a working recipe for both failure modes the estate removes
identity that is not the actor's (a legacy shared credential path,
~/.config/mosaic/credentials/gitea.env, which no longer exists in the
credential system) and a quality gate routed around (raw curl +
force_merge:true, no queue guard, no head pin). Replaced with wrapper-only
merge guidance: protection blocks are signals to fix, not to bypass.
Placeholder-ized estate RFC1918 topology and hostnames (six carriers, one
more than the verdict's five — the original scan missed guides/):
- skills/mosaic-portainer: Portainer URL, Docker host
- skills/mosaic-gitea: SSH resolution target
- skills/mosaic-deploy: Docker node, stack-name map (now generic example
shape; estate mappings belong in skills-local overrides, which link with
precedence)
- tools/coolify/README: base URL
- guides/INFRASTRUCTURE: cloudflare example moved from 10.0.0.5 to the
RFC 5737 documentation range (192.0.2.5), the unambiguous example form
Left as-is per the verdict's split: estate DNS endpoints (e.g.
git.mosaicstack.dev, ci.mosaicstack.dev) pass as examples.
Rescan of the whole shipped framework tree for RFC1918, estate hosts, and
stack-name patterns: zero remaining hits. The gate defect itself is filed
separately as #1321 (cross-referenced on #1320, comment 23285).
fargo
jason.woltje