stack

RM-60: external trust boundary for isolated per-commit replay

#1031

opened 2026-08-01 03:05:45 +00:00 by Ghost

RM-02: Gate registry and negative-control CI verifier

#1029

opened 2026-08-01 01:14:54 +00:00 by Ghost

wake: observed_hash names a preimage it does not have — verifier cannot learn in-band what to reconstruct

#1021

opened 2026-07-31 14:03:25 +00:00 by Ghost

issue-comment.sh: wrong-cwd invocation silently targets the cwd repo; bare HTTP 500 names no endpoint while Gitea 500-masks nonexistent-issue comment POSTs bug

#1020

opened 2026-07-31 13:36:39 +00:00 by Ghost

4

CI test membership is two hand-enumerated allowlists that re-arm their own gap: 17 of 39 framework/tools test-*.sh suites are invisible to CI, including both push guards bug

#1017

opened 2026-07-31 12:43:06 +00:00 by Ghost

8

pr-metadata.sh: anonymous fallback lacks the ^2 check, so a successful 200 is reported as 'unknown API error' at rc=1

#1015

opened 2026-07-31 12:34:45 +00:00 by Ghost

gitea wrappers: read-back origin pin fails closed AFTER the write when ROOT_URL scheme != configured URL — a landed comment/review is reported as a failure bug

#1014

opened 2026-07-31 12:17:26 +00:00 by Ghost

6

Gate-14/Gate-16: 10 git wrappers put the API token in curl argv at 16 sites — the mitigation ships in detect-platform.sh and is unused; peer seats share the uid and can read it from /proc bug

#1013

opened 2026-07-31 11:35:35 +00:00 by Ghost

7

Shared credential loader ignores MOSAIC_GIT_IDENTITY/GITEA_LOGIN — raw-API reads silently use the shared key, and the docs recommend that path bug

#1012

opened 2026-07-31 11:30:17 +00:00 by Ghost

4

fix(git): issue-create.sh — API fallback declares a false label/milestone incapability (D1); tea path drops unresolvable labels silently (D2) bug

#1011

opened 2026-07-31 11:08:54 +00:00 by Ghost

1

fix(git): reason-discard + #865 misattribution family — issue-comment.sh still carries the exact defect #1004 removed bug

#1010

opened 2026-07-31 11:00:35 +00:00 by Ghost

2

Gate-14: no fleet-wide credential log-screen; the one seat-local screen was blind to encoding AND to header shape bug

#1009

opened 2026-07-31 10:41:24 +00:00 by Ghost

1

pipeline-status.sh silently swallows a positional pipeline number and answers with LATEST at exit 0 — a false green on a gate instrument bug

#1008

opened 2026-07-31 10:39:52 +00:00 by Ghost

1

get_gitea_token: per-slot identity path bypasses MOSAIC_CREDENTIALS_FILE and has no sandbox hook — test harnesses silently use production credentials bug

#1007

opened 2026-07-31 10:38:57 +00:00 by Ghost

6

pipeline-status.sh silently swallows a stray positional and answers about the LATEST pipeline at exit 0 bug

#1005

opened 2026-07-31 10:31:26 +00:00 by Ghost

wake: BASH_LINENO pin hardcodes [3 4] measured on one bash minor — a disagreeing bash aborts all ten suites (10/10 measured)

#1003

opened 2026-07-31 10:02:37 +00:00 by Ghost

AUDIT: wrapper exit codes are not derived from outcomes — 4 wrappers, 3 seats, both polarities, one night bug

#1002

opened 2026-07-31 09:56:56 +00:00 by Ghost

2

CI: type=service step records state=failure from pod absence at teardown (exit_code 0) on otherwise-green pipelines

#1000

opened 2026-07-31 09:41:55 +00:00 by Ghost

wake: fd-inheritance class stays OPEN after #993 — SOURCE_CMD and beacon.sh:262 are unbounded inheritors, fd set unenumerated bug

#999

opened 2026-07-31 09:31:12 +00:00 by Ghost

2

pr-review.sh posts issue comments, never review objects — gate 16 unrecordable for every wrapper-reviewed PR bug

#998

opened 2026-07-31 09:29:15 +00:00 by Ghost

2