lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(buglog): log P0 defects from the 2026-10-10 review (bug-1936..bug-1952)

Browse source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-10-10 08:15:28 +00:00
parent 94472ee3e7
commit 2fed7a6e5f
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
18 changed files with 1258 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

395
.wolf/buglog.json
View file

@ -17812,6 +17812,401 @@
"record": ".wolf/bugs/bug-1935.md",
"gitea_issue": 360,
"gitea_synced_status": "fixed"
},
{
"id": "bug-1936",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "wrong-result",
"timestamp": "2026-10-10T08:14:36Z",
"last_seen": "2026-10-10T08:14:36Z",
"occurrences": 1,
"error_message": "apiserver drops cwd, env, run/resource limits, file transfers and I/O paths of REST job submissions\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n`modelJobToSubmit()` (`src/frontend/apiserver/backend/convert.go:323-375`) builds the controller's `job_startinfo_t` with only cmdline, execuser, launch_type and pre/post-exec; it never sets `exdata`, `exechome` or `execcwd`:\n```go\nsi := (*C.job_startinfo_t)(C.calloc(1, C.sizeof_job_startinfo_t))\nsi.cmdline = C.CString(job.Command)\n... // no si.exdata / si.exechome / si.execcwd\n```\nSo `--cwd`, `--env`, `--file` transfers, interactive mode, every `*_limit` flag (incl. `-W` run limit), `-i/-o/-e`, asked hosts and begin/end time are kept only in the apiserver's memory and never reach the controller or the worker.\n\n**Expected:** Every submit option the apiserver accepts reaches the worker in the job's start info (exdata, exec home, cwd), or is rejected as unsupported.\n**Impact:** Silent wrong result: jobs run without the limits, environment, working directory and I/O paths the user asked for (e.g. a `-W` run limit is never enforced).\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/frontend/apiserver/backend/convert.go, src/frontend/apiserver/controllers/jobs.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"submit",
"exdata",
"limits"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1936.md"
},
{
"id": "bug-1937",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "worker",
"severity": "wrong-result",
"timestamp": "2026-10-10T08:14:38Z",
"last_seen": "2026-10-10T08:14:38Z",
"occurrences": 1,
"error_message": "apiserver writes job file transfers under 'transfer_files' but the worker parses 'transfer_file'\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe apiserver serialises transfers as `extendDataMap[\"transfer_files\"]` (`src/frontend/apiserver/controllers/jobs.go:1923`) while the worker looks for:\n```c\nelse if (strcmp(key, \"transfer_file\") == 0) { /* xcecd_exdata.c:115 */\n```\n\n**Expected:** Both sides use one key, so transfers in exdata are parsed.\n**Impact:** Wrong result once exdata reaches the worker: file transfers are silently ignored.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/frontend/apiserver/controllers/jobs.go, src/worker/src/xcecd_exdata.c",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"worker",
"exdata",
"file-transfer"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1937.md"
},
{
"id": "bug-1938",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "scheduler",
"severity": "wrong-result",
"timestamp": "2026-10-10T08:14:41Z",
"last_seen": "2026-10-10T08:14:41Z",
"occurrences": 1,
"error_message": "xce_scheduler dispatches jobs from closed or inactive queues (queue readiness gate is a stub)\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe admin queue controls set and clear the closed/inactive flags (`src/controller/queue.c:131-152`), but the scheduler's gates always pass:\n```c\n/* FIXME this is just stub, we need to add more */\nint sched_job_is_ready(xce_sched_job_t* j) { return 1; }\n/* FIXME this is just stub, we need to add more */\nint sched_queue_is_ready(xce_sched_queue_t* q) { return 1; } /* core.c:646-649 */\n```\n\n**Expected:** Jobs of an inactive queue are not dispatched (they stay pending with a reason); a closed queue accepts no new submissions.\n**Impact:** Admin queue control silently ignored: inactivating a queue does not stop dispatch.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/scheduler/src/core.c, src/scheduler/src/plugins/builtin_fcfs.c",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"scheduler",
"queue",
"admin-control"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1938.md"
},
{
"id": "bug-1939",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "scheduler",
"severity": "wrong-result",
"timestamp": "2026-10-10T08:14:43Z",
"last_seen": "2026-10-10T08:14:43Z",
"occurrences": 1,
"error_message": "xce_scheduler dispatches jobs to hosts closed by an admin\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nHost close sets `XCE_WORKER_CLOSED|XCE_WORKER_CLOSED_BY_ADMIN` (`src/controller/worker.c:1015-1024`), but no scheduler code checks either bit (only unavailable/reconciling hosts are skipped: `core_session.c:136`, `resource.c:704,887`); the parallel allocator's bad-host check is empty (`plugins/parjob_allocator.c:40-48`).\n\n**Expected:** A closed host gets no new jobs; running jobs are unaffected.\n**Impact:** Admin host control silently ignored: closing a host for maintenance does not stop new jobs landing on it.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/scheduler/src/resource.c, src/scheduler/src/core_session.c, src/scheduler/src/plugins/parjob_allocator.c",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"scheduler",
"host",
"admin-control"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1939.md"
},
{
"id": "bug-1940",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "wrong-result",
"timestamp": "2026-10-10T08:14:46Z",
"last_seen": "2026-10-10T08:14:46Z",
"occurrences": 1,
"error_message": "job control ignores the requested signal and the force-kill flag (apiserver to controller)\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe control handler passes a JSON event string as content (`controllers/jobs.go:2260-2277`); `signalNumber()` looks it up as a signal name, fails and falls back to TERM/TSTP/CONT; `backend/clib.go:697-705` always sends `sig.force = 0` and `ckpt.kill = 0`, dropping ForceKill and the checkpoint kill/method options (`:746-762`).\n\n**Expected:** A kill with a user-chosen signal sends that signal; force kill and checkpoint options reach the controller.\n**Impact:** Wrong result: users cannot send a specific signal or force-kill a job.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/frontend/apiserver/controllers/jobs.go, src/frontend/apiserver/backend/clib.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"job-control",
"signal"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1940.md"
},
{
"id": "bug-1941",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "controller",
"severity": "wrong-result",
"timestamp": "2026-10-10T08:14:48Z",
"last_seen": "2026-10-10T08:14:48Z",
"occurrences": 1,
"error_message": "xce_controller refuses kill/stop/resume of running jobs on hosts whose status is not exactly OK\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n```c\n/* FIXME: better method to check host status */\nif (w->ep && w->host.status == 0) { /* src/controller/job.c:2145-2156 */\n```\nAny other status bit (CLOSED_BY_ADMIN, BUSY, UNAVAIL...) makes the control request fail.\n\n**Expected:** Jobs on a closed (or otherwise flagged but connected) host can be killed, stopped and resumed; a host that is not connected gives a clear error.\n**Impact:** Users and admins cannot kill jobs on a host closed for maintenance.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/controller/job.c",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"controller",
"job-control",
"host-status"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1941.md"
},
{
"id": "bug-1942",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "controller",
"severity": "wrong-result",
"timestamp": "2026-10-10T08:14:51Z",
"last_seen": "2026-10-10T08:14:51Z",
"occurrences": 1,
"error_message": "xce_controller sends job control of a multi-host job only to its first host\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nJob control is routed to `allocs[0]->host` only (`src/controller/job.c:2126-2131`).\n\n**Expected:** Signals reach every host of the job (or the job's launcher is documented to fan them out and does so).\n**Impact:** Suspending or killing a multi-host job can leave its tasks on other hosts running.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/controller/job.c",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"controller",
"job-control",
"parallel"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1942.md"
},
{
"id": "bug-1943",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "scheduler",
"severity": "wrong-result",
"timestamp": "2026-10-10T08:14:54Z",
"last_seen": "2026-10-10T08:14:54Z",
"occurrences": 1,
"error_message": "xce_scheduler --sim does not load user and host groups, so group-scoped limits differ from live\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nOn a config push the live scheduler loads user and host groups (`groupmgr_load_configs`, `src/scheduler/src/scheduler.c:1144-1145`); the core's config event used by the simulator applies only resources, resource values and queues (`core_events.c:846-850`).\n\n**Expected:** Live and simulated scheduling apply the same groups (scheduler-driver-equivalence.md).\n**Impact:** Replays of clusters with group-scoped limits make different decisions than the live scheduler.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/scheduler/src/core_events.c, src/scheduler/src/scheduler.c",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"scheduler",
"sim",
"equivalence",
"limit"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1943.md"
},
{
"id": "bug-1944",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "scheduler",
"severity": "wrong-result",
"timestamp": "2026-10-10T08:14:56Z",
"last_seen": "2026-10-10T08:14:56Z",
"occurrences": 1,
"error_message": "xce_scheduler gives a job moved to another queue the queue's priority, so it jumps ahead\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nNew jobs get priority 0 (`schedobj.c:214`, `core_events.c:353`), but on a queue change the job's priority becomes the queue's priority (`core_events.c:1360`, `schedobj.c:684`); the picker sorts by job priority within a queue (`plugins/builtin_fcfs.c:213`).\n\n**Expected:** Moving a job does not change its job priority.\n**Impact:** Wrong ordering: moved jobs overtake jobs submitted earlier to the target queue.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/scheduler/src/core_events.c, src/scheduler/src/schedobj.c",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"scheduler",
"queue",
"priority"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1944.md"
},
{
"id": "bug-1945",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "security",
"timestamp": "2026-10-10T08:14:59Z",
"last_seen": "2026-10-10T08:14:59Z",
"occurrences": 1,
"error_message": "apiserver signs and accepts JWTs with the shipped default secret when XCE_JWT_SECRET is unset\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n`config/app.yaml:17` ships the secret `xce-api-key`; `utils/config.go:315-320` uses `XCE_JWT_SECRET` when set and otherwise keeps the default without any warning.\n\n**Expected:** The apiserver never runs with a publicly known signing secret.\n**Impact:** Security: anyone can forge tokens for any user on a deployment that did not set the environment variable.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/frontend/apiserver/config/app.yaml, src/frontend/apiserver/utils/config.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"security",
"jwt"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1945.md"
},
{
"id": "bug-1946",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "security",
"timestamp": "2026-10-10T08:15:01Z",
"last_seen": "2026-10-10T08:15:01Z",
"occurrences": 1,
"error_message": "apiserver logout does not revoke the token: it stays valid until expiry\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nLogout deletes a token file (`controllers/auth.go:69-95`) that token validation never reads (`middleware/validatehandler.go:101-116`).\n\n**Expected:** After logout the token is rejected.\n**Impact:** Security: a leaked token keeps working for up to 24 h after logout.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/frontend/apiserver/controllers/auth.go, src/frontend/apiserver/middleware/validatehandler.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"security",
"jwt"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1946.md"
},
{
"id": "bug-1947",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "security",
"timestamp": "2026-10-10T08:15:04Z",
"last_seen": "2026-10-10T08:15:04Z",
"occurrences": 1,
"error_message": "apiserver config-file auth compares plaintext passwords with != and ships admin/admin defaults\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n`backend/auth/config_file.go:60` compares the stored plaintext password with `!=`; `config/auth.yaml:12-21` ships `admin/admin` and `user1/user1`.\n\n**Expected:** Stored passwords are hashed and compared in constant time; no default credentials are shipped active.\n**Impact:** Security: password disclosure from the config file, timing side channel, and known default credentials.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/frontend/apiserver/backend/auth/config_file.go, src/frontend/apiserver/config/auth.yaml",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"security",
"auth"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1947.md"
},
{
"id": "bug-1948",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "security",
"timestamp": "2026-10-10T08:15:06Z",
"last_seen": "2026-10-10T08:15:06Z",
"occurrences": 1,
"error_message": "apiserver trusts X-Forwarded-For from any client, so IP whitelist and JWT IP binding can be spoofed\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe router uses `gin.Default()` (`router/routers.go:19`) and never calls `SetTrustedProxies`, so `ClientIP()` honours `X-Forwarded-For` from any peer.\n\n**Expected:** Forwarded headers are only honoured from configured trusted proxies.\n**Impact:** Security: a client can claim any IP and bypass the IP whitelist and the IP bound into its JWT.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/frontend/apiserver/router/routers.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"security",
"whitelist"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1948.md"
},
{
"id": "bug-1949",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "security",
"timestamp": "2026-10-10T08:15:09Z",
"last_seen": "2026-10-10T08:15:09Z",
"occurrences": 1,
"error_message": "apiserver RequirePermission and IP whitelist write an error but do not abort the request\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nOn a bad token `RequirePermission` returns an error response without `Abort()` (`controllers/rbac_check.go:119-122`); the IP whitelist does the same for an invalid client IP (`middleware/whitelist.go:130-132`); `ReturnError` never aborts (`controllers/response.go:30-37`).\n\n**Expected:** A failed middleware check stops the request before the handler runs.\n**Impact:** Security: the handler may still run after an authorization failure.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/frontend/apiserver/controllers/rbac_check.go, src/frontend/apiserver/middleware/whitelist.go, src/frontend/apiserver/controllers/response.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"security",
"middleware"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1949.md"
},
{
"id": "bug-1950",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "security",
"timestamp": "2026-10-10T08:15:11Z",
"last_seen": "2026-10-10T08:15:11Z",
"occurrences": 1,
"error_message": "apiserver JWT validation does not pin the signing algorithm\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe middleware's parse callback returns the key without checking `token.Method` (`middleware/validatehandler.go:102-104`), unlike the other parse path (`controllers/auth.go:186`).\n\n**Expected:** Only the configured HMAC algorithm is accepted.\n**Impact:** Security hardening: algorithm-confusion class of attacks is not ruled out.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/frontend/apiserver/middleware/validatehandler.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"security",
"jwt"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1950.md"
},
{
"id": "bug-1951",
"status": "open",
"status_updated": "2026-10-10",
"status_note": "newly logged",
"component": "apiserver",
"severity": "crash",
"timestamp": "2026-10-10T08:15:14Z",
"last_seen": "2026-10-10T08:15:14Z",
"occurrences": 1,
"error_message": "apiserver crashes on an auth.yaml without a config_file block (nil pointer)\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n`backend/auth/config_file.go:39` reads `cfg.ConfigFile.Users` without checking `cfg.ConfigFile` for nil.\n\n**Expected:** A missing block is a clear configuration error, not a panic.\n**Impact:** Crash at startup or login with a minimal auth.yaml.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/frontend/apiserver/backend/auth/config_file.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"auth",
"config",
"crash"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1951.md"
},
{
"id": "bug-1952",
"status": "investigating",
"status_updated": "2026-10-10",
"status_note": "suspected from source reading; confirm with a test before fixing",
"component": "apiserver",
"severity": "security",
"timestamp": "2026-10-10T08:15:16Z",
"last_seen": "2026-10-10T08:15:16Z",
"occurrences": 1,
"error_message": "apiserver user role changes check a narrower rbac:control grant only against the target user\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nSuspected (needs verification): in add/delete roles for a user, a non-`all` `rbac:control` grant is only checked against \"is the target me?\" (`controllers/users.go:404-412,455-462`), so such a grant could let a user give itself `cluster_admin`. Built-in roles grant `rbac:control` only with domain `all` (`config/rbac.yaml:100-102`), so this is latent.\n\n**Expected:** A user can never grant itself a role with more rights than it already holds.\n**Impact:** Security (latent): privilege escalation through a custom role.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
"file": "src/frontend/apiserver/controllers/users.go",
"root_cause": "TODO: required for fixed/partial",
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
"tags": [
"apiserver",
"security",
"rbac"
],
"related_bugs": [],
"fix_commits": [],
"record": ".wolf/bugs/bug-1952.md"
}
]
}