stack

mosaic-brain: codify per-estate agent working memory (~/.mosaic) into the installer

opened 2026-08-05 15:48:42 +00:00 by Ghost

test(installer): add red-first P0-P9 state-machine fixture

opened 2026-08-05 15:20:01 +00:00 by Ghost

SECURITY: one tea logins table interleaves both estates — a wrapper pointed at the wrong host succeeds AS THE OTHER ESTATE (host-string matching is the only boundary)

#1049

opened 2026-08-05 14:45:51 +00:00 by Ghost

wake-component: reconcile has no settling window (systematic false positives) + class escalation promotes routine sources to actionable on a lost race

#1048

opened 2026-08-05 02:18:25 +00:00 by Ghost

No pr-edit wrapper: PR body/title edits force a raw PATCH or an identity compromise (pr-metadata is GET-only; issue-edit resolves login by first host match)

#1047

opened 2026-08-04 23:32:44 +00:00 by Ghost

1

codex review wrappers crash on binary/non-UTF-8 diffs (invalid utf-8 byte) — blocks the independent-review gate on any PR with binary artifacts

#1046

opened 2026-08-04 21:49:44 +00:00 by Ghost

EPIC: 'mosaic cred' — one governed CLI/broker for agent credential lifecycle + access (identity validation via token→certificate; fail-closed, audited)

#1045

opened 2026-08-04 18:30:13 +00:00 by Ghost

6

SECURITY: get_gitea_token fails OPEN on unset identity (silent shared-credential fallback) — opposite to git-credential-mosaic's fail-closed; fleet seat silently authors API writes as shared owner

#1044

opened 2026-08-04 03:11:47 +00:00 by Ghost

4

Supply-chain integrity: sign + checksum official CLI tools; detect out-of-band modification

#1042

opened 2026-08-03 22:49:19 +00:00 by jason.woltje

Phase B2: graduate next's 10 in-flight commits to main (post main→next sync)

#1037

opened 2026-08-03 00:11:02 +00:00 by Ghost

RM-60: external trust boundary for isolated per-commit replay

#1031

opened 2026-08-01 03:05:45 +00:00 by Ghost

RM-02: Gate registry and negative-control CI verifier

#1029

opened 2026-08-01 01:14:54 +00:00 by Ghost

wake: observed_hash names a preimage it does not have — verifier cannot learn in-band what to reconstruct

#1021

opened 2026-07-31 14:03:25 +00:00 by Ghost

issue-comment.sh: wrong-cwd invocation silently targets the cwd repo; bare HTTP 500 names no endpoint while Gitea 500-masks nonexistent-issue comment POSTs bug

#1020

opened 2026-07-31 13:36:39 +00:00 by Ghost

4

CI test membership is two hand-enumerated allowlists that re-arm their own gap: 17 of 39 framework/tools test-*.sh suites are invisible to CI, including both push guards bug

#1017

opened 2026-07-31 12:43:06 +00:00 by Ghost

8

pr-metadata.sh: anonymous fallback lacks the ^2 check, so a successful 200 is reported as 'unknown API error' at rc=1

#1015

opened 2026-07-31 12:34:45 +00:00 by Ghost

gitea wrappers: read-back origin pin fails closed AFTER the write when ROOT_URL scheme != configured URL — a landed comment/review is reported as a failure bug

#1014

opened 2026-07-31 12:17:26 +00:00 by Ghost

6

Gate-14/Gate-16: 10 git wrappers put the API token in curl argv at 16 sites — the mitigation ships in detect-platform.sh and is unused; peer seats share the uid and can read it from /proc bug

#1013

opened 2026-07-31 11:35:35 +00:00 by Ghost

7

Shared credential loader ignores MOSAIC_GIT_IDENTITY/GITEA_LOGIN — raw-API reads silently use the shared key, and the docs recommend that path bug

#1012

opened 2026-07-31 11:30:17 +00:00 by Ghost

4

fix(git): issue-create.sh — API fallback declares a false label/milestone incapability (D1); tea path drops unresolvable labels silently (D2) bug

#1011

opened 2026-07-31 11:08:54 +00:00 by Ghost

1