stack

mosaic-sync-skills: unguarded ownership prefix collapses to / and can rm -f foreign symlinks bug

opened 2026-08-06 21:47:40 +00:00 by Ghost

load_credentials gitea-mosaicstack cannot succeed: loader expects a flat token key, config is per-seat bug

opened 2026-08-06 20:33:41 +00:00 by Ghost

pr-metadata.sh: the unauthenticated fallback never checks for success — a correct HTTP 200 is reported as 'unknown API error' and exits 1 bug

#1079

opened 2026-08-06 07:23:32 +00:00 by Ghost

SECURITY: credentials on curl argv across the framework tools — authentik/portainer/cloudflare/coolify/glpi are 100% exposed (identity, containers, DNS, and asset/ticket/user records) and were NEVER in scope of #1013's git-only remediation

#1078

opened 2026-08-06 05:50:58 +00:00 by Ghost

12

worktrees on another seat's repository silently inherit its git [user] identity — 72 worktrees on web1 commit as coder-mos1, and useConfigOnly makes it certain

#1077

opened 2026-08-06 05:27:27 +00:00 by Ghost

4

shell test suites assume GNU coreutils but CI executes them under Alpine/BusyBox — three distinct failures in one delivery cycle

#1076

opened 2026-08-06 05:09:32 +00:00 by Ghost

7

L0 Gate 8 has no hook: three agents bypassed a failed mandated wrapper in one night — a checkable rule enforced by prose only

#1075

opened 2026-08-06 04:44:59 +00:00 by Ghost

C1 greenfield fixture is NONDETERMINISTIC on the #869 probe path — identical inputs yield comparator rc=1 or rc=0, and it flakes toward PASS

#1074

opened 2026-08-06 04:36:10 +00:00 by Ghost

No CI/CD path deploys the framework to hosts — the root cause of the 46-file host skew (install.sh exists; nothing runs it)

#1072

opened 2026-08-06 04:22:40 +00:00 by Ghost

6

HOST FRAMEWORK SKEW: the installed ~/.config/mosaic tooling is not main (11 of 40 sampled files differ), and no drift detection exists

#1071

opened 2026-08-06 04:13:59 +00:00 by Ghost

5

installer: gateway version TOCTOU — verify-after compares against the re-resolved value, not the authoritative pin

#1070

opened 2026-08-06 03:34:57 +00:00 by Ghost

greenfield fixture: 4 payload-acquisition paths are unpinned (base image, apt set, npx package, skills clone)

#1069

opened 2026-08-06 03:28:56 +00:00 by Ghost

greenfield-install workflow: digest equality test runs BEFORE the expected-RED comparator — digest drift silently suppresses every downstream acceptance check

#1068

opened 2026-08-06 03:06:09 +00:00 by Ghost

#1017 follow-up: the enumeration guard's population covers 49 of 56 suite-shaped files

#1067

opened 2026-08-06 00:30:53 +00:00 by Ghost

Defer hostile-same-UID credential store TOCTOU to a non-bypassable primitive

#1065

opened 2026-08-05 22:49:43 +00:00 by Ghost

CI queue guard: the FIXED wrapper has never reached the hosts that run it (installed artifact is the pre-fix blob)

#1063

opened 2026-08-05 21:53:35 +00:00 by Ghost

SECURITY: repairing the credentials.json schema drift will RE-ARM the shared-credential fallback (#1043 ∘ fallback = machine-performed borrowed login)

#1057

opened 2026-08-05 19:19:51 +00:00 by Ghost

1

fix(ci): make upgrade rollback signal control deterministic bug

#1056

opened 2026-08-05 19:13:16 +00:00 by Ghost

The #1044 class is not gitea-specific: 22 shared-credential call sites across 5 services have no per-identity path

#1055

opened 2026-08-05 18:24:09 +00:00 by Ghost

SECURITY: load_credentials is not re-entrant — a second service load silently returns the FIRST service's credentials with exit 0 (defeats estate separation)

#1052

opened 2026-08-05 16:35:01 +00:00 by Ghost