Issues - stack - Mosaic Gitea

mosaicstack/stack

Labels Milestones New Issue

CI queue guard: the FIXED wrapper has never reached the hosts that run it (installed artifact is the pre-fix blob)

opened 2026-08-05 21:53:35 +00:00 by Ghost

SECURITY: repairing the credentials.json schema drift will RE-ARM the shared-credential fallback (#1043 ∘ fallback = machine-performed borrowed login)

opened 2026-08-05 19:19:51 +00:00 by Ghost

fix(ci): make upgrade rollback signal control deterministic bug

opened 2026-08-05 19:13:16 +00:00 by Ghost

The #1044 class is not gitea-specific: 22 shared-credential call sites across 5 services have no per-identity path

opened 2026-08-05 18:24:09 +00:00 by Ghost

SECURITY: load_credentials is not re-entrant — a second service load silently returns the FIRST service's credentials with exit 0 (defeats estate separation)

opened 2026-08-05 16:35:01 +00:00 by Ghost

mosaic-brain: codify per-estate agent working memory (~/.mosaic) into the installer

opened 2026-08-05 15:48:42 +00:00 by Ghost

test(installer): add red-first P0-P9 state-machine fixture

opened 2026-08-05 15:20:01 +00:00 by Ghost

SECURITY: one tea logins table interleaves both estates — a wrapper pointed at the wrong host succeeds AS THE OTHER ESTATE (host-string matching is the only boundary)

opened 2026-08-05 14:45:51 +00:00 by Ghost

wake-component: reconcile has no settling window (systematic false positives) + class escalation promotes routine sources to actionable on a lost race

opened 2026-08-05 02:18:25 +00:00 by Ghost

No pr-edit wrapper: PR body/title edits force a raw PATCH or an identity compromise (pr-metadata is GET-only; issue-edit resolves login by first host match)

opened 2026-08-04 23:32:44 +00:00 by Ghost

codex review wrappers crash on binary/non-UTF-8 diffs (invalid utf-8 byte) — blocks the independent-review gate on any PR with binary artifacts

opened 2026-08-04 21:49:44 +00:00 by Ghost

EPIC: 'mosaic cred' — one governed CLI/broker for agent credential lifecycle + access (identity validation via token→certificate; fail-closed, audited)

opened 2026-08-04 18:30:13 +00:00 by Ghost

SECURITY: get_gitea_token fails OPEN on unset identity (silent shared-credential fallback) — opposite to git-credential-mosaic's fail-closed; fleet seat silently authors API writes as shared owner

opened 2026-08-04 03:11:47 +00:00 by Ghost

Supply-chain integrity: sign + checksum official CLI tools; detect out-of-band modification

opened 2026-08-03 22:49:19 +00:00 by jason.woltje

Phase B2: graduate next's 10 in-flight commits to main (post main→next sync)

opened 2026-08-03 00:11:02 +00:00 by Ghost

RM-60: external trust boundary for isolated per-commit replay

opened 2026-08-01 03:05:45 +00:00 by Ghost

RM-02: Gate registry and negative-control CI verifier

opened 2026-08-01 01:14:54 +00:00 by Ghost

wake: observed_hash names a preimage it does not have — verifier cannot learn in-band what to reconstruct

opened 2026-07-31 14:03:25 +00:00 by Ghost

issue-comment.sh: wrong-cwd invocation silently targets the cwd repo; bare HTTP 500 names no endpoint while Gitea 500-masks nonexistent-issue comment POSTs bug

opened 2026-07-31 13:36:39 +00:00 by Ghost

CI test membership is two hand-enumerated allowlists that re-arm their own gap: 17 of 39 framework/tools test-*.sh suites are invisible to CI, including both push guards bug

opened 2026-07-31 12:43:06 +00:00 by Ghost

... 8 9 10 11 12 ...