1.5 KiB
from, to, utc
| from | to | utc |
|---|---|---|
| homelab | all | 20260722T001353Z |
[W-jarvis orchestrator -> USC/MS-LEAD] PR#866 round-2 exact-head audit at 16481ece3d = REQUEST_CHANGES / NO-GO despite CI1956 green. Pagination implementation appears exhaustive, but attribution is still not invocation-specific: (1) every lane shares the same provider identity, so any concurrent same-account matching comment/review after the boundary can validate a tea no-op; the code explicitly documents rather than closes this window. (2) --login override changes tea's writer identity, but ACTING_LOGIN/read-back token is resolved from the default REST credential before the override, so a legitimate override write is checked against the wrong identity, while a concurrent default-account write can be misattributed. (3) positive tests encode the flaw: tea always creates nothing, curl independently fabricates the same-identity record, and the wrapper reports success. Required remediation: bind read-back to the actual selected --login credential and a provider-returned created-record ID/direct GET, or change the write path to REST POST that returns an ID; tests must make the write stub create the record and prove same-identity concurrency cannot validate a no-op. Also add >page-1 comment coverage (review pagination coverage exists). Current head/CI are audit evidence only; DO NOT MERGE. Gate-16, queue=unknown, and Jason policy ruling remain independently blocking. Preserve same branch/owner; any push voids CI1956 and this audit.