mosaicstack/stack
6
0
Fork 1
Code Issues 298 Pull Requests 18 Actions Packages Projects Releases 15 Wiki Activity

skills: mosaic-gitea SKILL.md still teaches legacy shared-credential read + raw force-merge bypass (residual of the #1320 Should Fix class) #1323

New Issue
Closed
opened 2026-08-19 20:57:20 +00:00 by rev-security-01 · 0 comments
rev-security-01 commented 2026-08-19 20:57:20 +00:00
Member
Copy Link
Copy Source

Found during the rev-security-01 review of PR #1322: the Should Fix remediated in mosaic-deploy (legacy shared credential + raw curl force-merge bypass) has a sibling instance in packages/mosaic/framework/skills/mosaic-gitea/SKILL.md that the #1320 verdict's file list missed. Pre-existing on 840c2b0; not introduced or touched by #1322.

Two locations (line numbers at c8f4634):

  1. Setup section (~lines 14-17): heading For force-merge (branch protection bypass): followed by reading a token from the legacy shared path ~/.config/mosaic/credentials/gitea.env into an env var. That path no longer exists in the credential system (per the #1322 PR body), and the seat-identity model has no shared-account fallback.
  2. (~lines 91-96): a complete **Force-merge bypassing branch protection:** recipe — raw curl POST to the merge API with {"Do":"squash","force_merge":true}, no queue guard, no head pin.

This is shipped framework content (npm publish includes the framework tree), teaching both failure modes the estate removes: acting under an identity that is not the actor's, and routing around a quality gate.

Remediation shape: same as the mosaic-deploy fix in #1322 — drop the bypass recipe and the legacy credential read; teach wrapper-only merge through pr-merge.sh with branch-protection blocks framed as signals to fix, exceptional cases routed to the operator or coordinating seat, still through the wrapper. The Setup section's legitimate content (credentials loader + pr-merge) already shows the right pattern two lines below the bad one.

Classification: Should Fix, security class, follow-up (non-blocking). Filed by rev-security-01.

Found during the rev-security-01 review of PR #1322: the Should Fix remediated in mosaic-deploy (legacy shared credential + raw curl force-merge bypass) has a sibling instance in `packages/mosaic/framework/skills/mosaic-gitea/SKILL.md` that the #1320 verdict's file list missed. Pre-existing on 840c2b0; not introduced or touched by #1322. Two locations (line numbers at c8f4634): 1. Setup section (~lines 14-17): heading `For force-merge (branch protection bypass):` followed by reading a token from the legacy shared path `~/.config/mosaic/credentials/gitea.env` into an env var. That path no longer exists in the credential system (per the #1322 PR body), and the seat-identity model has no shared-account fallback. 2. (~lines 91-96): a complete `**Force-merge bypassing branch protection:**` recipe — raw curl POST to the merge API with `{"Do":"squash","force_merge":true}`, no queue guard, no head pin. This is shipped framework content (npm publish includes the framework tree), teaching both failure modes the estate removes: acting under an identity that is not the actor's, and routing around a quality gate. Remediation shape: same as the mosaic-deploy fix in #1322 — drop the bypass recipe and the legacy credential read; teach wrapper-only merge through `pr-merge.sh` with branch-protection blocks framed as signals to fix, exceptional cases routed to the operator or coordinating seat, still through the wrapper. The Setup section's legitimate content (credentials loader + pr-merge) already shows the right pattern two lines below the bad one. Classification: Should Fix, security class, follow-up (non-blocking). Filed by rev-security-01.
fargo closed this issue 2026-08-19 22:51:37 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
fargo fred happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 sanity scooby (Scooby) scrappy shaggy tiny velma vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1323