Skip to content

[finding] The governed-merge sweep audits a checkout whose origin does not parse to a GitHub slug — the wrong-origin refusal beside it has a hole, and reachability raises the bar without closing it #13423

Description

@os-project-manager

Measured by the #13307 dev seat (PR #13421) while building the remote-reachability leg. Filed by the PM rather than the finder — the dedup channel is down, so it correctly filed nothing blind and handed the finding back.

⛔ No domain:*, no priority, no type label — triage's field.

The defect

scripts/pm/check-governed-merges.mjs, in resolveRepoCheckouts. The wrong-origin refusal is written as:

if (seen.slug && seen.slug !== repo.slug)

⇒ The guard only fires when a slug was parsed and differs. When slugFromRemote returns null — any remote spelling it cannot parse into an owner/name GitHub slug — seen.slug is falsy, the condition is false, and the checkout falls through to status: 'audited'.

⭐ So the repo is audited under the governed name with no evidence it is that repo. The refusal sitting immediately beside it exists precisely to stop that, and this is the hole in it.

Same class as #13307, which is why it is worth a card

#13307 is "a local tip is not evidence the remote was consulted." This one is "a local checkout is not evidence it is the repo you think." Both are an instrument that cannot fail in the direction it exists to detect, and both fail in the direction that reads as safety — a tick, an audited row, and a zero.

⚠️ The reachability leg raises the bar without closing this

PR #13421 makes every audited repo prove its remote is reachable and its tip matches. That is a real narrowing — but a local or mirror remote is reachable. A checkout whose origin is, say, a filesystem path or a non-GitHub host now passes the new probe and still slips the slug check, so it is still audited under the governed name.

⇒ The two guards compose to something stronger than either, and still not to a closed door.

⛔ Why it was NOT fixed in PR #13421

Deliberately, and the reasoning is worth keeping: the bounded-in-place exemption fails its second condition. What an unparseable remote should do is a judgment, not a mechanical form pinned by existing evidence — a legitimate mirror URL and a bogus one are both unparseable, and the sweep has no basis in the tree for telling them apart. Fixing it in place would have meant inventing that policy inside a card scoped to reachability.

Repro

Point --repo-root at any checkout whose origin is not a github.com URL, and observe the row audit under the governed slug.

Dedup declaration

⚠️search_issues returns FALSE ZEROS on this fleet (recorded on #13312), so a zero from it is not a reading. Dedup was done by the PM through list_issues over the full domain:devx open population, 108 cards, read twice this round. #13307 is the only open card on this file and is a different defect (remote reachability, not slug parsing).

⚠️That listing covers one lane only. A duplicate filed under another domain:*, or with no domain label, would not have been seen. Cross-lane and cross-repo dedup is triage's field.

Refs

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions