Same defect class as the #1320 Should Fix, at the two spots the #1320 file
list missed (found by rev-security-01's review of #1322, filed as #1323):
- Setup section framed a shared-credential env read
(~/.config/mosaic/credentials/gitea.env — no longer part of the credential
system) as the way to enable force-merges. The credentials loader is now
the only documented source, and the force-merge framing is gone.
- 'Force-merge bypassing branch protection' section carried the full raw
curl + force_merge:true recipe. Replaced with the same wrapper-only
guidance merged in #1322: protection blocks are signals to fix, never to
bypass; exceptional cases go to the operator or coordinating seat, still
through the wrapper.
Scan before fixing (whole shipped framework tree, three patterns — gitea.env
/ credentials/*.env reads, force_merge, raw merge curl): the two handed spots
in mosaic-gitea were the complete set; no seventh carrier. Post-fix rescan:
zero recipe matches; the only force_merge strings left are the guidance text
that forbids it. Closes#1323.
fargo