mosaicstack/stack
25
0
Fork 1
Code Issues 344 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

framework wrapper-guard.sh copy drift: published package lacks the porcelain-mutation hardening arm #1494

New Issue
Open
opened 2026-09-04 17:36:07 +00:00 by orch-01 · 0 comments
orch-01 commented 2026-09-04 17:36:07 +00:00
Member
Copy Link
Copy Source

Defect

Two lineages of wrapper-guard.sh exist in the estate:

copy lines sha256[0:12] porcelain occurrences
published: packages/mosaic/framework/tools/git/wrapper-guard.sh on current next, byte-identical to the npm-shipped and framework-installed copies 1161 477fc06f063d 0
hardened deployment-tree lineage 1224 9544e759d63d 7

The hardened lineage carries a porcelain-mutation detection arm (blocks git invocations that use porcelain mutation forms outside the guard's sanctioned request path) plus associated hardening and suite arms. None of it is upstream: origin/next's copy matches the published 1161-line file exactly, so this is not release lag. The hardening was never upstreamed.

Consequence: a user or seat whose guard resolves to the framework-installed copy runs a guard without the porcelain-mutation arm, while the same named tool in the deployment tree that authored the hardening blocks those shapes. Guard behavior differs by install path for the same tool name, which defeats the point of a uniform enforcement tool.

Fix shape

Upstream the guard delta from the hardened lineage to packages/mosaic/framework/tools/git/wrapper-guard.sh via a PR against next, including its suite arms (with the channel-assertion fix from the separate stdout/stderr defect applied to the new arms). Framework reseed/update then propagates it to installed copies. This can ride the same or an adjacent PR as other pending upstreaming work for framework tools.

Related: block-verdict channel defect filed separately.

Environment: mosaicstack/stack next; npm @mosaicstack/mosaic vendored framework/tools/git/; deployment trees carrying the hardened 1224-line lineage.

## Defect Two lineages of `wrapper-guard.sh` exist in the estate: | copy | lines | sha256[0:12] | `porcelain` occurrences | |---|---|---|---| | published: `packages/mosaic/framework/tools/git/wrapper-guard.sh` on current `next`, byte-identical to the npm-shipped and framework-installed copies | 1161 | 477fc06f063d | 0 | | hardened deployment-tree lineage | 1224 | 9544e759d63d | 7 | The hardened lineage carries a porcelain-mutation detection arm (blocks `git` invocations that use porcelain mutation forms outside the guard's sanctioned request path) plus associated hardening and suite arms. None of it is upstream: `origin/next`'s copy matches the published 1161-line file exactly, so this is not release lag. The hardening was never upstreamed. Consequence: a user or seat whose guard resolves to the framework-installed copy runs a guard without the porcelain-mutation arm, while the same named tool in the deployment tree that authored the hardening blocks those shapes. Guard behavior differs by install path for the same tool name, which defeats the point of a uniform enforcement tool. ## Fix shape Upstream the guard delta from the hardened lineage to `packages/mosaic/framework/tools/git/wrapper-guard.sh` via a PR against `next`, including its suite arms (with the channel-assertion fix from the separate stdout/stderr defect applied to the new arms). Framework reseed/update then propagates it to installed copies. This can ride the same or an adjacent PR as other pending upstreaming work for framework tools. Related: block-verdict channel defect filed separately. Environment: mosaicstack/stack `next`; npm @mosaicstack/mosaic vendored `framework/tools/git/`; deployment trees carrying the hardened 1224-line lineage.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) darkwing (Mosaic fleet seat darkwing) dewey (Mosaic fleet seat dewey) fargo filbert (Mosaic fleet seat filbert) fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) rocko (Mosaic fleet seat rocko) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1494