Issues - stack - Mosaic Gitea

mosaicstack/stack

Labels Milestones New Issue

installer: gateway version TOCTOU — verify-after compares against the re-resolved value, not the authoritative pin

opened 2026-08-06 03:34:57 +00:00 by Ghost

greenfield fixture: 4 payload-acquisition paths are unpinned (base image, apt set, npx package, skills clone)

opened 2026-08-06 03:28:56 +00:00 by Ghost

greenfield-install workflow: digest equality test runs BEFORE the expected-RED comparator — digest drift silently suppresses every downstream acceptance check

opened 2026-08-06 03:06:09 +00:00 by Ghost

#1017 follow-up: the enumeration guard's population covers 49 of 56 suite-shaped files

opened 2026-08-06 00:30:53 +00:00 by Ghost

Defer hostile-same-UID credential store TOCTOU to a non-bypassable primitive

opened 2026-08-05 22:49:43 +00:00 by Ghost

CI queue guard: the FIXED wrapper has never reached the hosts that run it (installed artifact is the pre-fix blob)

opened 2026-08-05 21:53:35 +00:00 by Ghost

SECURITY: repairing the credentials.json schema drift will RE-ARM the shared-credential fallback (#1043 ∘ fallback = machine-performed borrowed login)

opened 2026-08-05 19:19:51 +00:00 by Ghost

fix(ci): make upgrade rollback signal control deterministic bug

opened 2026-08-05 19:13:16 +00:00 by Ghost

The #1044 class is not gitea-specific: 22 shared-credential call sites across 5 services have no per-identity path

opened 2026-08-05 18:24:09 +00:00 by Ghost

SECURITY: load_credentials is not re-entrant — a second service load silently returns the FIRST service's credentials with exit 0 (defeats estate separation)

opened 2026-08-05 16:35:01 +00:00 by Ghost

mosaic-brain: codify per-estate agent working memory (~/.mosaic) into the installer

opened 2026-08-05 15:48:42 +00:00 by Ghost

test(installer): add red-first P0-P9 state-machine fixture

opened 2026-08-05 15:20:01 +00:00 by Ghost

SECURITY: one tea logins table interleaves both estates — a wrapper pointed at the wrong host succeeds AS THE OTHER ESTATE (host-string matching is the only boundary)

opened 2026-08-05 14:45:51 +00:00 by Ghost

wake-component: reconcile has no settling window (systematic false positives) + class escalation promotes routine sources to actionable on a lost race

opened 2026-08-05 02:18:25 +00:00 by Ghost

No pr-edit wrapper: PR body/title edits force a raw PATCH or an identity compromise (pr-metadata is GET-only; issue-edit resolves login by first host match)

opened 2026-08-04 23:32:44 +00:00 by Ghost

codex review wrappers crash on binary/non-UTF-8 diffs (invalid utf-8 byte) — blocks the independent-review gate on any PR with binary artifacts

opened 2026-08-04 21:49:44 +00:00 by Ghost

EPIC: 'mosaic cred' — one governed CLI/broker for agent credential lifecycle + access (identity validation via token→certificate; fail-closed, audited)

opened 2026-08-04 18:30:13 +00:00 by Ghost

SECURITY: get_gitea_token fails OPEN on unset identity (silent shared-credential fallback) — opposite to git-credential-mosaic's fail-closed; fleet seat silently authors API writes as shared owner

opened 2026-08-04 03:11:47 +00:00 by Ghost

Supply-chain integrity: sign + checksum official CLI tools; detect out-of-band modification

opened 2026-08-03 22:49:19 +00:00 by jason.woltje

Phase B2: graduate next's 10 in-flight commits to main (post main→next sync)

opened 2026-08-03 00:11:02 +00:00 by Ghost

... 9 10 11 12 13 ...