Issue 344: gaps 12 and 13 closed by mesh-catalog #153 and mesh-controller #177

2026-10-09 13:49:54 +02:00
parent d7c97d02fa
commit 57cfdb5cf9
1 changed files with 5 additions and 3 deletions
@@ -89,14 +89,16 @@ note. Each gap says what is open, why it matters, and what would close it.
   account answered as the operator. An agent could therefore post comments, pull requests and approving reviews
   as the operator. The operator's own forge account is also a site administrator, so acting as it is acting as
   an administrator.
-   *Closes with:* the tool sending only a known list of query keys and never `sudo` (being fixed in
-   mesh-catalog #153); later, a non-administrator account for the tools (gap 7).
+   *Closed* on 2026-10-09 by mesh-catalog #153: the tools send only a known list of query keys, never `sudo`, and
+   every caller-supplied path segment is checked, so `..` cannot reach another endpoint. A non-administrator account
+   for the tools (gap 7) remains.

 13. **The forge applies only the first protection rule that matches a branch.** A rule named for the branch comes
   before a glob rule. A weak rule named for a branch next to a strong glob would leave the branch weakly protected,
   while a reader that asks "does any rule protect it" sees it as protected. No repository has such a pair today
   (every rule is named `main`), and the tools refuse to create one.
-   *Closes with:* every reader judging the first matching rule, as the forge does.
+   *Closed* on 2026-10-09 by mesh-controller #177: the build-source check judges the first matching rule, as the
+   forge does.

 ## Why it is an issue