stack

LATENT: same-named gitea_get_commit_status_json with swapped tail params puts a token in a URL path if ever co-sourced

#997

opened 2026-07-31 09:28:16 +00:00 by Ghost

issue-comment.sh reports success for a comment it never posts (tea needs a TTY; exit status unchecked) bug

#996

opened 2026-07-31 09:24:09 +00:00 by Ghost

4

ci-queue-wait.sh exits 0 when it could not measure CI state — the mandatory gate fails open

#995

opened 2026-07-31 09:20:12 +00:00 by Ghost

5

gate 16 is unverifiable from the record when a seat must write through a shared account

#994

opened 2026-07-31 09:13:39 +00:00 by Ghost

3

detector lock fd 9 is not close-on-exec: every child inherits it, and the unbounded ones (source adapter, untimed beacon sink) can hold the single-instance lock forever

#992

opened 2026-07-31 08:51:51 +00:00 by Ghost

1

No wrapper for Woodpecker pipeline approval — fork PRs always arrive blocked, the raw call records a human as approver, and pipeline-status renders blocked as pending

#990

opened 2026-07-31 08:29:49 +00:00 by Ghost

agent-send.sh: #809's primary identity source (MOSAIC_AGENT_NAME) is absent in every agent pane on sb-it-1-dt, so all sends silently run the #808 fallback path

#989

opened 2026-07-31 08:11:49 +00:00 by Ghost

1

git wrappers: issue-create.sh / issue-comment.sh / pr-review.sh have no -F/--body-file, so every long body is routed through shell interpolation that silently rewrites it

#988

opened 2026-07-31 08:06:43 +00:00 by Ghost

git wrappers: pr-view.sh cannot witness a PR's review verdicts, and 'tea pr review-comments' returns exit 0 with an empty table on a PR that has them

#987

opened 2026-07-31 08:06:17 +00:00 by Ghost

No mechanism sets the git AUTHOR field to the acting agent — MOSAIC_GIT_IDENTITY is credential-selection only, so agent commits land under a real person's name

#986

opened 2026-07-31 07:49:58 +00:00 by Ghost

CI gate to reject NEW grep-idiom assertions IN SHELL SUITES (bound: grep syntax only — cannot witness the same class in other languages)

#982

opened 2026-07-31 06:23:13 +00:00 by Ghost

3

credentials.sh: load_credentials returns rc=0 without reading the file when env vars are pre-set (cross-instance gitea credential bleed)

#981

opened 2026-07-31 06:15:49 +00:00 by Ghost

issue-create.sh: API fallback silently creates the issue as a DIFFERENT identity than GITEA_LOGIN names

#980

opened 2026-07-31 04:12:43 +00:00 by Ghost

4

No wrapper edits a PR body (issue-edit.sh has no PR equivalent) — blocks a seat from correcting its own declared contract

#979

opened 2026-07-31 03:10:23 +00:00 by Ghost

ci-queue-wait.sh cannot block: heredoc steals stdin, every state classifies as unknown -> exit 0

#978

opened 2026-07-31 02:48:12 +00:00 by Ghost

1

False-success is a CLASS: issue-close.sh has #976's exact shape, and its checked path is the fallback not the default

#977

opened 2026-07-31 02:31:48 +00:00 by Ghost

1

issue-comment.sh reports success for a comment that was never created (no readback)

#976

opened 2026-07-31 02:14:32 +00:00 by Ghost

1

wake/digest.sh: _quarantine_entry silently DESTROYS the dead-letter ledger when it cannot read it (rc=0, no signal) — the sole evidence base for quarantine-audit

#972

opened 2026-07-30 22:11:38 +00:00 by Ghost

wake: store.sh usage() has no test needle — the #952 surface that regressed silently is the one nothing asserts

#971

opened 2026-07-30 21:58:36 +00:00 by Ghost

wake: store.sh quarantine-audit prints its CLEAN SWEEP when the dead-letter ledger cannot be parsed (jq failure swallowed by || true)

#970

opened 2026-07-30 21:58:30 +00:00 by Ghost