Development record

2026-08-01 — itd-105 / spc-21, MERGE-GATE fix (concurrent session A): a fresh merge-gate security reviewer found a real gap in that same allowlist test, not in the shipped script. `TestBootstrapFetchOriginsAreConstants` subtracted any name the script "assigns to itself" before checking it against the allowlist, so a SELF-referential seam (`mirror="${mirror:-}"`, then `[ -n "$mirror" ] && repo_url="$mirror"`) read as script-local and the test passed green while a curl shim recorded a fetch to an attacker-named host. Reproduced by planting exactly that shape against the committed script before fixing. The allowlist now taints any name whose own assignment line references itself, on every line where it is assigned, so neither the self-reference nor any later use of the name reads as safe — verified this catches the planted bypass and still passes on the real script. One more merge-gate MINOR landed in the same pass: `mkdir -p "$tmp"` (the temp-download directory) succeeds on a directory that reappears, symlinked, in the window since the preceding `rm -rf`; plain `mkdir` (no `-p`) turns that same-name race into a refusal instead of a curl write through a planted symlink. Both merge-gate reviews (fresh, independent, full-PR-diff) had already returned MERGE before these were found — landed anyway per the merge gate's "fix everything raised" step rather than waiting for a fifth review round, since both are narrow, each has a watched-fail-then-pass test, and neither changes the shipped script's externally observable behaviour except the second (a same-name TOCTOU race becoming a loud refusal, strictly safer).