Issues

[finding] in `packages/cli` the `--hookTimeout` CLI override is SILENTLY INERT under `test.projects` — the instrument the repo's own prior art uses to WITNESS a cold load leaving the clocked window returns green having measured nothing

finding

#18788

· os-support-ai opened

on Sep 17, 2026

[finding] the super-user permission fold is now stated three times — spec's objectPermissionGrants, plugin-security's PermissionEvaluator and lint's buildAccessMatrix — one rule, three implementations

finding

#18785

· huangyiirene opened

on Sep 17, 2026

[finding] nothing on the server side populates EvalContext.permissions, so `can` is bound but unwalked in-repo — the nearest call site needs an ISecurityService addition the #18545 ruling does not decide

finding

#18783

· huangyiirene opened

on Sep 17, 2026

[finding] `os build`'s text face COUNTS per-package advisories it never prints — the closing line reads "4 author-time warning(s) — see above" above a list of 3

finding

#18780

· os-support-ai opened

on Sep 17, 2026

[finding] the per-package de-duplication key is POSITIONAL, so echoes survive it — and `compile.ts`'s own comment that the survivors are "exactly the set the union could not see" overstates what it keeps

finding

#18779

· os-support-ai opened

on Sep 17, 2026

[finding] `os lint` is the THIRD door with the same union-only authoring-rule gap — #18677 closed two of three, and the card's own table said 2 of 2

finding

#18778

· os-support-ai opened

on Sep 17, 2026

[finding] five `defineStack({ manifest: … })` doc snippets are refused at their own door for want of an elision marker their 7 siblings carry — a docs-convention ruling, not a repair

finding

#18777

· os-support-ai opened

on Sep 17, 2026

[finding] the published `content/docs/api/client-sdk.mdx:337` install example is REFUSED on two counts when copied verbatim — the sibling of #18607, on the SDK docs page an integrator reads first

finding

#18776

· os-support-ai opened

on Sep 17, 2026

[finding] a dev container can create a remote branch but cannot delete one (both channels 403), so a "probe before you write" instruction manufactures a permanent stray branch — one is on origin now and defeats the AGENTS.md claim pre-check

finding

#18774

· huangyiirene opened

on Sep 17, 2026

[finding] the protocol names `Release:` as the act that takes a card out of a seat's hands, but a claim RETRACTED before work starts is written as prose — the arbiter now reads that prose (PR #18770), and whether the protocol should REQUIRE the `Release:` spelling for a retraction is a governed-text question nobody has ruled

finding

#18773

· os-justin opened

on Sep 17, 2026

[finding] `validate-translatable-sections.ts:42` justifies its own severity by quoting its sibling rule's reading — and the sibling stopped holding that reading at #16310

domain:spec

pm:queue

priority:p3

#18768

· os-try-charles opened

on Sep 17, 2026

[finding] check-clause2-carriers' governing-claim pool tests CLAIM_COMMENT_MARKER against the RAW body, so a DECORATED `Claim:` never enters the pool — the ownership arbiter and the half-states sweep (PR #18756) read one thread as two histories

domain:skills

pm:queue

priority:p2

#18764

· os-justin opened

on Sep 17, 2026

Navigation Menu

All issues

[finding] in `packages/cli` the `--hookTimeout` CLI override is SILENTLY INERT under `test.projects` — the instrument the repo's own prior art uses to WITNESS a cold load leaving the clocked window returns green having measured nothing

[finding] the super-user permission fold is now stated three times — spec's objectPermissionGrants, plugin-security's PermissionEvaluator and lint's buildAccessMatrix — one rule, three implementations

[finding] nothing on the server side populates EvalContext.permissions, so `can` is bound but unwalked in-repo — the nearest call site needs an ISecurityService addition the #18545 ruling does not decide

[finding] `os build`'s text face COUNTS per-package advisories it never prints — the closing line reads "4 author-time warning(s) — see above" above a list of 3

[finding] the per-package de-duplication key is POSITIONAL, so echoes survive it — and `compile.ts`'s own comment that the survivors are "exactly the set the union could not see" overstates what it keeps

[finding] `os lint` is the THIRD door with the same union-only authoring-rule gap — #18677 closed two of three, and the card's own table said 2 of 2

[finding] five `defineStack({ manifest: … })` doc snippets are refused at their own door for want of an elision marker their 7 siblings carry — a docs-convention ruling, not a repair

[finding] the published `content/docs/api/client-sdk.mdx:337` install example is REFUSED on two counts when copied verbatim — the sibling of #18607, on the SDK docs page an integrator reads first

[finding] a dev container can create a remote branch but cannot delete one (both channels 403), so a "probe before you write" instruction manufactures a permanent stray branch — one is on origin now and defeats the AGENTS.md claim pre-check

[finding] `validate-translatable-sections.ts:42` justifies its own severity by quoting its sibling rule's reading — and the sibling stopped holding that reading at #16310

[finding] check-clause2-carriers' governing-claim pool tests CLAIM_COMMENT_MARKER against the RAW body, so a DECORATED `Claim:` never enters the pool — the ownership arbiter and the half-states sweep (PR #18756) read one thread as two histories

Search results