2026-08-04 - 2026-09-04
Overview
2 Releases published by 1 user
Published
v26.15.0
Published
v26.14.0
71 Pull requests merged by 2 users
Merged
#906 fix(876): sweep session narrative out of hooks, workflows, scripts, tests and code comments; grow the detector to the process corpus
Merged
#905 fix(869,893): re-establish the 1.25.4-dated CI claims on 1.27.1, and settle the page_statuses asymmetry from source
Merged
#903 fix(891): a sourced path is code, so every hook resolves it from its own tree
Merged
#902 fix(855): two glob dialects cannot be canonicalised into one, so model one shape and refuse the rest
Merged
#899 fix(887): the image build builds the SPA and does not test it
Merged
#898 docs(release): record the v26.15.0 release notes
Merged
#897 fix(858,859): a rule the classifier cannot read is not a rule that matches nothing
Merged
#896 fix(870): an empty timeline page is not exhaustion — the walk reads to its cap
Merged
#892 fix(880): an absent recurrence array means unrestricted, an explicit [] is rejected
Merged
#890 fix(849): the verdict gate replaces every unknown state, and proves the clauses that claim to
Merged
#889 fix(845): the verdict writer checks that the gate will honour what it just posted
Merged
#888 docs(853): workflow_dispatch can't be ref-restricted at 1.27.1 — and restricting it would close nothing
Merged
#884 fix(836): never pass --depth to a checkout that may already be complete
Merged
#883 fix(820): derive where Complete<T> is APPLIED, not just what it means
Merged
#882 fix(812): classify the narrative sites by who-benefits; keep the detector's reach
Merged
#879 fix(823,824): a scheduling NULL collection reads as UNRESTRICTED and is guarded at both read sites; the Elastic indexer gets its own mutation proof
Merged
#875 fix(819): derive the SPA page-size guard population from the git index
Merged
#874 fix(809,822): isolate the suite from the production hook-fire log by construction
Merged
#873 fix(803,664): fence the HEAD alias on the PR timeline's pull_push count
Merged
#872 fix(786,789): workflows declare their own per-job metadata; guard populations derive from it
Merged
#871 docs(796): verification code is code under test — and the proof it was claiming an exemption from
Merged
#868 fix(763): page both /statuses/{sha} reads to a validated terminator
Merged
#867 docs(747): re-verify the Gitea 1.25.4-pinned CI claims on 1.27.1, and measure the merge-gate semantics that were source-attested
Merged
#866 probe(747c): DO NOT MERGE
Merged
#864 probe(747a): DO NOT MERGE
Merged
#863 probe(747): absent required status context — DO NOT MERGE
Merged
#862 docs(781,799): re-measure the tooling audit from a derived population, and adopt serena
Merged
#861 fix(787): derive the dropped-step guard's scope, and reconcile its snapshot against the server
Merged
#860 fix(748): declare permissions: on all six workflows, and prove the declaration binds
Merged
#857 fix(744,835): ci-image.yml publishes from main only; guard persist-credentials with no exemption
Merged
#850 fix(742): inherit an h10 verdict only from an allow-listed reviewer
Merged
#847 feat(735): bound the numeric FFmpeg profile fields with a 422, and expose readrate pacing
Merged
#846 fix(788): one declarative H10 verdict vocabulary, derived by both sides
Merged
#843 feat(732): On Now / Next gets a background box, and is on by default
Merged
#842 fix(746): drop the persisted checkout credential; unmask the base-ref fetches
Merged
#841 feat(734): field-level progressive disclosure — shared FieldHelp trigger + panel
Merged
#838 docs(755): ersatztv owns the fork code, media-management owns channel operations
Merged
#834 docs(708): record the live route-2 reproduction against PR #761
Merged
#833 fix(690,758): count the same query a paged handler pages
Merged
#831 fix(721,740): align Auto-Tune proposal rows on a grid; guard AddItemsDialog's async searches
Merged
#827 fix(807): SPA full-replace bodies are built as Complete<T>, with a derived guard over droppable request members
Merged
#826 fix(701): guard SongMetadata's nullable primitive collections at the read site
Merged
#825 fix(772,792): name the missing toolchain image; stop a refusal leaving a verdict comment
Merged
#818 fix(806): guard populations over FILES derive from the git index, not a filesystem walk
Merged
#817 docs: a cancelled job reads as failure where a monitor actually looks
Merged
#815 feat(790): execute every MUTATION grade instead of asserting it
Merged
#814 fix(780): reconcile the ruff gate with #784, merged in parallel
Merged
#813 feat(780): commit a ruff config and enforce it in CI
Merged
#811 feat(784): a doc records the end state — generalize the no-session-narrative rule
Merged
#810 test(785): mutation proofs for the three unproven ranked guards
Merged
#808 feat(779): test the deny path at the production config value, and derive full-replace field lists
Merged
#802 feat(778): name the check-and-use race, and verify the protection the merge gate rests on
Merged
#801 feat(794): witness a fix's test failing BEFORE the fix, and check the claim in CI
Merged
#800 docs(781): re-measure §5.3 from a derived population — the zeros split four ways
Merged
#795 feat(776): every hook reports that it fired, and the report is measured
Merged
#798 fix: the BOM guard was fail-open wherever xxd is not installed
Merged
#793 fix(777): repair both broken LSPs, and name the surface a subagent can actually reach
Merged
#762 chore(deps): update dependency scriban.signed to 7.2.6
Merged
#791 feat(774,775): one rule for guard populations, one for guard proofs — both enforced
Merged
#782 docs(773): root-cause the recurring defect shapes across the full closed-issue corpus
Merged
#770 fix(767): gate the release path on the delimiter ban with a prerequisite job
Merged
#769 docs(720): name all three Komodo stacks and the label-based resolution rule
Merged
#768 fix(756): extend the dropped-step guard to docker-build.yml's required jobs, where a drop is fail-OPEN
Merged
#764 fix(751): a stray expression delimiter in a COMMENT killed the verdict gate — plus the two nil-slice twins and a dead-code guard it hid
Merged
#760 fix(754,757): declare graphicsElementIds + padToNearestMinute, and pin every MCP tool to its OpenAPI contract
Merged
#749 fix(743): make review-verdict/h10 unskippable — disable direct push to main + admin force-merge; fix(719) tag-only push
Merged
#745 fix(697): scope CI's registry credential so head-resolved workflows cannot forge review-verdict/h10
Merged
#741 fix(685): AddItemsDialog resolves by search instead of windowing the whole media-library type
Merged
#739 docs(release): record the v26.14.0 release notes
Merged
#725 fix(674,688): cross-check decision frontmatter against PyYAML; split the ceiling calibration claim
Merged
#737 fix(726): let a lagging realtime input catch up so a sparse bitmap-subtitle stream can't pin it below realtime
6 Pull requests proposed by 2 users
Proposed
#761 chore(deps): update dependency meziantou.analyzer to 3.0.195
Proposed
#804 chore(deps): update dependency sqlitepclraw.bundle_e_sqlite3 to 3.0.5
Proposed
#805 chore(deps): update dependency system.commandline to 2.0.11
Proposed
#828 chore(deps): update dependency cliwrap to 3.10.5
Proposed
#829 chore(deps): update lucene.net to 4.8.0-beta00018
Proposed
#878 fix(830): a write failure reports to a surface that outlives the dialog that started it
79 Issues closed from 1 user
Closed
#876 docs.no-session-narrative reaches hooks and code comments, but nothing has ever swept them — 4 known sites
Closed
#893 page_statuses still terminates on its first empty page — is /statuses/{sha} subject to #870's post-pagination filtering?
Closed
#869 Finish the 1.25.4-dated CI claim sweep #747 deliberately did not complete
Closed
#891 ETV_HOOK_FIRE_LIB is SOURCED from an env-var path in 12 hooks — a decoy tree's code runs inside the gate
Closed
#855 Nothing couples ci-image.yml's push.paths to ci-image-pin's expected pathspec
Closed
#887 Every image build fails: completeAnnotations.guard.test.ts needs the git index, and the Dockerfile's exclude list is hand-maintained
Closed
#900 chore(release): cut and promote v26.15.0 on 736649b3b (main head could not build an image)
Closed
#858 pretooluse-merge-consent.sh resolves its verdict classifier from $CLAUDE_PROJECT_DIR — an env var as a security input
Closed
#859 Merge-gate branch-protection read: a malformed rule states a cause that did not happen, and the endpoint is now fetched twice
Closed
#870 The timeline walk's null terminator is defeatable: Gitea pages BEFORE it filters, so a page of inline-code comments reads as exhaustion
Closed
#880 Schedule-item recurrence fields: an omitted array means "never applies" on write but "unrestricted" on read
Closed
#849 review-verdict.yml post-write verification: three routes that leave an exemption success over a human failure
Closed
#845 post-review-verdict.sh does not check that its own account is on the gate's H10_REVIEWERS allow-list
Closed
#886 release.verdict-vocabulary-shared explains the sentinel with a set -u mechanism that measurement refutes
Closed
#853 workflow_dispatch still loads attacker YAML from an arbitrary ref — four workflows, no ref restriction
Closed
#836 :latest images ship InformationalVersion 0.0.0 — a --depth=2 fetch grafts the build job's full clone shallow
Closed
#820 Complete<T> proves its semantics but not its APPLICATION — nothing derives the set of SPA full-replace construction sites
Closed
#812 Remediate the 21 session-narrative sites #784's sweep found — 21 judgements, not a regex
Closed
#823 Scheduling collection-valued columns: is a runtime null reachable on DaysOfMonth / MonthsOfYear / DaysOfWeek?
Closed
#824 ElasticSearchIndex.UpdateSong has no regression test — an Elastic-only reintroduction of the #701 mutation stays CI-green
Closed
#819 The SPA page-size guard enumerates web/src with a Vite glob while claiming completeness
Closed
#809 The production-hook-fire-log isolation guard is per-test, but its claim is per-suite
Closed
#822 test_the_suite_does_not_write_to_the_PRODUCTION_log uses global mutable state as its oracle — any concurrent session reddens it
Closed
#664 pr-changed-files.sh head binding cannot see an A→B→A force-push across its paging round-trips
Closed
#803 Head-ABA: a force-push H1->H2->H1 during paging defeats pr-changed-files.sh, and three contracts still deny it
Closed
#789 Derive the CI toolchain population from workflow-owned metadata, not TOOLCHAIN_JOBS
Closed
#786 Extend the machine-checked guard inventory to inline workflow-job guards
Closed
#796 A verification harness is itself unproven code — five false greens, each created by the fix for the last
Closed
#763 Page both /statuses/{sha} reads in review-verdict.yml — limit clamps to 50, so the post-write race check can miss a raced verdict
Closed
#747 Re-verify the Gitea 1.25.4-pinned CI claims after the 1.27.1 upgrade
Closed
#781 Plugin/MCP config hygiene: retire what is enabled and never invoked, de-duplicate the gitea server
Closed
#799 serena is enabled and starts fine, but its tools never reach a session — establish why, then use or disable it
Closed
#787 The dropped-step guard's SCOPE is a dated comment, not a check, against branch protection
Closed
#748 Declare permissions: on the status-writing workflows so the Gitea Restricted token default can be enabled
Closed
#744 ci-image.yml's push trigger has no branches: filter — any branch push runs attacker YAML on a docker-capable runner
Closed
#835 Guard the persist-credentials convention — after #744, with no exemption list
Closed
#742 Tighten review-verdict.yml provenance from "non-null creator" to an allow-list of approved reviewers
Closed
#735 Validate FFmpeg profile numeric fields to sane ranges instead of silently transforming them, and expose readrate pacing as a bounded field
Closed
#788 One shared verdict vocabulary instead of two shell copies plus a parity test
Closed
#732 On Now / Next overlay: give it a boxed background for legibility, and enable it on all channels by default
Closed
#746 docker-build.yml checkouts should set persist-credentials: false — after the || true fetch masking is removed
Closed
#734 SPA: field-level progressive disclosure — short summary → hover popup → (future) deep-dive docs link
Closed
#755 Project boundary: ersatztv owns the fork code, media-management owns channel operations
Closed
#708 Reproduce #698 route 2 live: push code onto a renovate-authored PR branch and confirm the manifest allow-list refuses the exemption
Closed
#690 Rerun collections: paged list TotalCount ignores the search query, so the SPA renders empty pages
Closed
#758 GetPagedPlayouts: TotalCount ignores the query filter, so a filtered page reports the unfiltered total
Closed
#721 Auto-Tune proposal rows should be a grid — channel numbers do not line up, and the name renders twice
Closed
#740 AddItemsDialog.runSearch has no stale-response or is-mounted guard (pre-existing, surfaced during #685)
Closed
#807 The SPA's hand-built request objects can silently drop an OPTIONAL DTO field
Closed
#701 Search indexers mutate SongMetadata.Artists on a possibly-tracked entity (??= []) — same shape rejected in #691
Closed
#792 post-review-verdict.sh exits 0 when it deliberately writes NO status
Closed
#772 The pinned CI toolchain image can vanish from the registry and take ALL container CI down, with no signal but a pull error
Closed
#806 Guard populations over FILES should derive from the git index, not a filesystem walk
Closed
#790 An executable clause-level mutation harness for the shell and python guards
Closed
#780 Reconcile Python tooling: commit a ruff config and enforce it, or stop claiming we enforce it
Closed
#784 Generalize the no-session-narrative rule from the kickoff file to all docs — the reader never saw the earlier draft
Closed
#785 Mutation proofs for the 19 unproven guards, worst-consequence first
Closed
#779 Test the deny path with the production config value, and assert full-replace field lists
Closed
#778 Audit read-then-write against live remote state: pin a version or use compare-and-set
Closed
#794 A fix ships a test witnessed failing BEFORE the fix — mechanise it by reverting the code side and asserting red
Closed
#776 Make hooks report that they fired — PreToolUse/PostToolUse execution is currently unobservable
Closed
#797 pretooluse-bom-guard.sh is fail-open wherever xxd is not installed — including the CI runner
Closed
#777 csharp-lsp and typescript-lsp are broken; the "workflow agents must use csharp-lsp" guidance is stale
Closed
#774 Guard convention: derive the expected set from the authoritative source and assert equality — never filter, never sample
Closed
#775 Every guard ships with a proof it can go red: delete that guard alone, the suite must fail
Closed
#773 Root-cause the recurring defect shapes across closed issues, then build hooks/tooling that make them hard to repeat — plus an audit of the tooling we already have and don't use
Closed
#767 Make the delimiter ban fail-CLOSED on the release path — build's Smoke step is still droppable on a v* tag push
Closed
#720 docs(ci-cd): a Komodo stack named ersatztv now exists on jazz — and it is NOT prod
Closed
#756 Extend the dropped-step guard to docker-build.yml's required jobs, where a dropped step is fail-OPEN
Closed
#751 review-verdict.yml's classify/post step never executes — job goes green, review-verdict/h10 is never posted automatically
Closed
#754 MCP ersatztv_update_channel omits graphicsElementIds — cannot set the On Now/Next overlay, and silently strips it
Closed
#757 MCP tool catalog: query parameters are unguarded — list_playouts omits query, get_playout_items omits showFiller
Closed
#719 H11 pre-push guard blocks a tag-only push, on every release cut
Closed
#743 review-verdict/h10 is bypassable without forging it: direct pushes to main are server-side permitted
Closed
#697 ETV_STATUS_AUTH can write commit statuses, so any head-resolved workflow can still forge review-verdict/h10
Closed
#685 CollectionsScreen AddItemsDialog windows the whole media-library type on an empty query, with no truncation surfaced (§3b deviation)
Closed
#674 decisions_validate.py stays green on frontmatter PyYAML rejects — an apostrophe in a single-quoted scalar (hit twice in one session)
Closed
#688 decisions_validate ceiling calibration test is one line from red — any record ≥61 prose lines fails script-tests
Closed
#726 Embedded BITMAP subtitle (PGS/DVD) burn-in + -readrate halves transcode to 0.53x realtime — Live TV buffering
94 Issues created by 1 user
Opened
#726 Embedded BITMAP subtitle (PGS/DVD) burn-in + -readrate halves transcode to 0.53x realtime — Live TV buffering
Opened
#727 FFmpeg version health check warns on our own bundled FFmpeg — hardcoded 7.1.1 vs bundled 8.1.2
Opened
#728 Channels list: row checkbox renders a visible "Select <channel name>" label, duplicating the name column
Opened
#729 Channel edit → Branding: logo renders broken — detail endpoint returns a relative logo path, list endpoint returns absolute
Opened
#730 Settings → System: stale "managed in the legacy UI" copy pointing at a UI removed in #91b, and it renders as a dead link
Opened
#731 Dashboard "On air now": channel logo never rendered — ChannelLogo is called without src, always falling back to initials
Opened
#732 On Now / Next overlay: give it a boxed background for legibility, and enable it on all channels by default
Opened
#733 dvbsub/dvb_subtitle are missing from both IsImage lists, so DVB bitmap subtitles are routed down the text/libass path
Opened
#734 SPA: field-level progressive disclosure — short summary → hover popup → (future) deep-dive docs link
Opened
#735 Validate FFmpeg profile numeric fields to sane ranges instead of silently transforming them, and expose readrate pacing as a bounded field
Opened
#736 Advanced: editable FFmpeg arguments box — show the composed command, allow override, reset to default
Opened
#740 AddItemsDialog.runSearch has no stale-response or is-mounted guard (pre-existing, surfaced during #685)
Opened
#742 Tighten review-verdict.yml provenance from "non-null creator" to an allow-list of approved reviewers
Opened
#743 review-verdict/h10 is bypassable without forging it: direct pushes to main are server-side permitted
Opened
#744 ci-image.yml's push trigger has no branches: filter — any branch push runs attacker YAML on a docker-capable runner
Opened
#746 docker-build.yml checkouts should set persist-credentials: false — after the || true fetch masking is removed
Opened
#747 Re-verify the Gitea 1.25.4-pinned CI claims after the 1.27.1 upgrade
Opened
#748 Declare permissions: on the status-writing workflows so the Gitea Restricted token default can be enabled
Opened
#751 review-verdict.yml's classify/post step never executes — job goes green, review-verdict/h10 is never posted automatically
Opened
#754 MCP ersatztv_update_channel omits graphicsElementIds — cannot set the On Now/Next overlay, and silently strips it
Opened
#755 Project boundary: ersatztv owns the fork code, media-management owns channel operations
Opened
#756 Extend the dropped-step guard to docker-build.yml's required jobs, where a dropped step is fail-OPEN
Opened
#757 MCP tool catalog: query parameters are unguarded — list_playouts omits query, get_playout_items omits showFiller
Opened
#758 GetPagedPlayouts: TotalCount ignores the query filter, so a filtered page reports the unfiltered total
Opened
#759 MCP query-parameter guard ignores a $ref'd OpenAPI parameter instead of failing loudly
Opened
#763 Page both /statuses/{sha} reads in review-verdict.yml — limit clamps to 50, so the post-write race check can miss a raced verdict
Opened
#767 Make the delimiter ban fail-CLOSED on the release path — build's Smoke step is still droppable on a v* tag push
Opened
#772 The pinned CI toolchain image can vanish from the registry and take ALL container CI down, with no signal but a pull error
Opened
#773 Root-cause the recurring defect shapes across closed issues, then build hooks/tooling that make them hard to repeat — plus an audit of the tooling we already have and don't use
Opened
#774 Guard convention: derive the expected set from the authoritative source and assert equality — never filter, never sample
Opened
#775 Every guard ships with a proof it can go red: delete that guard alone, the suite must fail
Opened
#776 Make hooks report that they fired — PreToolUse/PostToolUse execution is currently unobservable
Opened
#777 csharp-lsp and typescript-lsp are broken; the "workflow agents must use csharp-lsp" guidance is stale
Opened
#778 Audit read-then-write against live remote state: pin a version or use compare-and-set
Opened
#779 Test the deny path with the production config value, and assert full-replace field lists
Opened
#780 Reconcile Python tooling: commit a ruff config and enforce it, or stop claiming we enforce it
Opened
#781 Plugin/MCP config hygiene: retire what is enabled and never invoked, de-duplicate the gitea server
Opened
#783 ersatztv skill states the stack names correctly but does not warn that two of the three fail silently
Opened
#784 Generalize the no-session-narrative rule from the kickoff file to all docs — the reader never saw the earlier draft
Opened
#785 Mutation proofs for the 19 unproven guards, worst-consequence first
Opened
#786 Extend the machine-checked guard inventory to inline workflow-job guards
Opened
#787 The dropped-step guard's SCOPE is a dated comment, not a check, against branch protection
Opened
#788 One shared verdict vocabulary instead of two shell copies plus a parity test
Opened
#789 Derive the CI toolchain population from workflow-owned metadata, not TOOLCHAIN_JOBS
Opened
#790 An executable clause-level mutation harness for the shell and python guards
Opened
#792 post-review-verdict.sh exits 0 when it deliberately writes NO status
Opened
#794 A fix ships a test witnessed failing BEFORE the fix — mechanise it by reverting the code side and asserting red
Opened
#796 A verification harness is itself unproven code — five false greens, each created by the fix for the last
Opened
#797 pretooluse-bom-guard.sh is fail-open wherever xxd is not installed — including the CI runner
Opened
#799 serena is enabled and starts fine, but its tools never reach a session — establish why, then use or disable it
Opened
#803 Head-ABA: a force-push H1->H2->H1 during paging defeats pr-changed-files.sh, and three contracts still deny it
Opened
#806 Guard populations over FILES should derive from the git index, not a filesystem walk
Opened
#807 The SPA's hand-built request objects can silently drop an OPTIONAL DTO field
Opened
#809 The production-hook-fire-log isolation guard is per-test, but its claim is per-suite
Opened
#812 Remediate the 21 session-narrative sites #784's sweep found — 21 judgements, not a regex
Opened
#816 Mutation harness: reset_sandbox does not restore .git control state
Opened
#819 The SPA page-size guard enumerates web/src with a Vite glob while claiming completeness
Opened
#820 Complete<T> proves its semantics but not its APPLICATION — nothing derives the set of SPA full-replace construction sites
Opened
#821 curl -u "$VAR" puts a credential in argv on shared hosts — five call sites, one class
Opened
#822 test_the_suite_does_not_write_to_the_PRODUCTION_log uses global mutable state as its oracle — any concurrent session reddens it
Opened
#823 Scheduling collection-valued columns: is a runtime null reachable on DaysOfMonth / MonthsOfYear / DaysOfWeek?
Opened
#824 ElasticSearchIndex.UpdateSong has no regression test — an Elastic-only reintroduction of the #701 mutation stays CI-green
Opened
#830 AddItemsDialog: a failed add is silently swallowed when the dialog is closed mid-request
Opened
#832 MediaCards paged handlers: 1-based paging + delete-or-keep (count drift fixed in #690/#758)
Opened
#835 Guard the persist-credentials convention — after #744, with no exemption list
Opened
#836 :latest images ship InformationalVersion 0.0.0 — a --depth=2 fetch grafts the build job's full clone shallow
Opened
#837 Scripted-playout _off: the documented "null -> all off" behaviour depends on an unrecorded formatter setting, and no test would catch it changing
Opened
#839 FieldHelp's panel placement is verified by hand, not by a test
Opened
#840 FieldHelp's portalled panel puts a docsHref link at the end of the tab order
Opened
#844 Per-channel default-adoption state, so "on by default" can stop re-adding an overlay the operator cleared
Opened
#845 post-review-verdict.sh does not check that its own account is on the gate's H10_REVIEWERS allow-list
Opened
#848 The QSV frame-pool 422 can name a control the editor is not rendering
Opened
#849 review-verdict.yml post-write verification: three routes that leave an exemption success over a human failure
Opened
#853 workflow_dispatch still loads attacker YAML from an arbitrary ref — four workflows, no ref restriction
Opened
#854 docker/ci/Dockerfile's FFMPEG-bump comment still says a push publishes — and cannot be fixed on its own
Opened
#855 Nothing couples ci-image.yml's push.paths to ci-image-pin's expected pathspec
Opened
#858 pretooluse-merge-consent.sh resolves its verdict classifier from $CLAUDE_PROJECT_DIR — an env var as a security input
Opened
#859 Merge-gate branch-protection read: a malformed rule states a cause that did not happen, and the endpoint is now fetched twice
Opened
#869 Finish the 1.25.4-dated CI claim sweep #747 deliberately did not complete
Opened
#870 The timeline walk's null terminator is defeatable: Gitea pages BEFORE it filters, so a page of inline-code comments reads as exhaustion
Opened
#876 docs.no-session-narrative reaches hooks and code comments, but nothing has ever swept them — 4 known sites
Opened
#877 Dismissible write failures, shape A2: the error state survives but its render site is gated by the same condition dismissal clears
Opened
#880 Schedule-item recurrence fields: an omitted array means "never applies" on write but "unrestricted" on read
Opened
#881 Mutation claims in PROSE are outside testing.mutation-claims-are-executed — 4 false ones in #812, each caught by a separate review round
Opened
#885 Same-repo pull_request runs get REGISTRY_PASSWORD from head-supplied YAML — the route #853 found under the dispatch class
Opened
#886 release.verdict-vocabulary-shared explains the sentinel with a set -u mechanism that measurement refutes
Opened
#887 Every image build fails: completeAnnotations.guard.test.ts needs the git index, and the Dockerfile's exclude list is hand-maintained
Opened
#891 ETV_HOOK_FIRE_LIB is SOURCED from an env-var path in 12 hooks — a decoy tree's code runs inside the gate
Opened
#893 page_statuses still terminates on its first empty page — is /statuses/{sha} subject to #870's post-pagination filtering?
Opened
#894 SPA lets a user build an empty recurrence set the server now rejects (#880 residual)
Opened
#895 "all N tests stayed green" claims in test comments go stale the moment anyone adds a test — 4 found, no detector
Opened
#900 chore(release): cut and promote v26.15.0 on 736649b3b (main head could not build an image)
Opened
#901 Convention: for a predicate over shell or config TEXT, pin the artifact whole — "match a shape" is the exception that must argue for itself
Opened
#904 test_docs_only_detector_clone_depth.py flakes ~8% in the CI container (measured, pre-existing on main)
3 Unresolved Conversations
Open
#22
Dependency Dashboard
Open
#627
Re-arm the MySQL data-migration fixture in CI — the dedupe DML has no automated coverage on MySQL
Open
#663
A review-verdict/h10 success is repo-global, so a second PR with the same head inherits it