save wolf status

.wolf/buglog.json

@@ -14883,5 +14883,41 @@
     ],
     "occurrences": 1,
     "last_seen": "2026-08-07T09:10:00Z"
+  },
+  {
+    "id": "bug-1508",
+    "timestamp": "2026-08-08T00:00:00Z",
+    "error_message": "No user report / no test failure -- discovered incidentally during doc-cleanup fact-check audit of src/docs/job_peek.md against current code.",
+    "file": "src/worker/src/xcecd_worker.c (handle_fetchfile, jobs-peek fetchfile feature)",
+    "root_cause": "job_peek.md's design called for worker-side security validation on the fetchfile RPC (jobid ownership check, out/err-file path match against the job's actual output paths, path-traversal rejection) before Plan B (CGO/FetchFile) shipped. The validation was never implemented -- handle_fetchfile() opens whatever path it is given with no ownership or path-traversal check.",
+    "fix": "NOT FIXED -- out of scope for the doc-cleanup task that found it. Flagged to user as a follow-up; needs its own security-reviewer pass on handle_fetchfile() (job ownership check + path-traversal rejection, matching the validation job_peek.md originally specified).",
+    "tags": [
+      "security",
+      "path-traversal",
+      "fetchfile",
+      "worker",
+      "jobs-peek",
+      "needs-fix"
+    ],
+    "related_bugs": [],
+    "occurrences": 1,
+    "last_seen": "2026-08-08T00:00:00Z"
+  },
+  {
+    "id": "bug-1509",
+    "timestamp": "2026-08-10T07:34:55.093767+00:00",
+    "error_message": "extralib flake dependency pulls external repo for trivial linked-list code used only by autoscaler scaler.h",
+    "file": "src/flake.nix,src/nixSupport/xce.nix,src/autoscaler/scaler/include/scaler.h",
+    "root_cause": "basiclib/list.h (xcelist_t + list_insert_entry_back) is the only consumer; can be vendored locally in ~30 lines.",
+    "fix": "Port xcelist_t/xcelist_entry_t/list_insert_entry_back to local basic_list.h in autoscaler, remove extralib from flake.nix inputs and xce.nix nativeBuildInputs. ~40 min effort.",
+    "tags": [
+      "tech-debt",
+      "build",
+      "nix",
+      "low-risk"
+    ],
+    "related_bugs": [],
+    "occurrences": 1,
+    "last_seen": "2026-08-10"
   }
 ]