Issues

gate-7 Pattern 2 assumes OpenRegister enforces per-object authz — for most of the fleet it is default-OPEN (compounds #365)

#372

· rubenvdlinde opened

on Aug 11, 2026

gate-33/axe steps run with if:always() and report an INFRA failure as an accessibility one — 'axe-runner crashed: Executable doesn't exist' when the real cause was a composer TLS error 4 steps earlier

#369

· rubenvdlinde opened

on Aug 11, 2026

gate-25: the PHPUnit coverage match is unscoped and skip-blind — measured false coverage on 3 endpoints with zero tests

#367

· rubenvdlinde opened

on Aug 11, 2026

gate-7 accepts a 401 authentication check as an authorisation guard — 4 real IDORs read as PASS (fleet-wide false negative)

#365

· rubenvdlinde opened

on Aug 11, 2026

gate-25: the auth lookback is a fixed 20 lines, so it reads the previous method's attribute — and prose

#363

· rubenvdlinde opened

on Aug 11, 2026

gate-26's signal is inverted: it credits PROSE and refuses NAVIGATION — 11 of 21 openregister findings are false, 6 of 16 passes are comment-only

#362

· rubenvdlinde opened

on Aug 11, 2026

gate-26 visual-coverage is satisfied by a bare component name in a COMMENT — reproduced 10 → 9 → 10, plus fleet measurement

#358

· rubenvdlinde opened

on Aug 11, 2026

gate-19: an @e2e anchor that is unparseable or dangling is silently ignored — 22 real, running tests scored as zero coverage

#357

· rubenvdlinde opened

on Aug 11, 2026

gate-19: one requirement-level @e2e exclude silently exempts every sibling scenario — 471 of openbuild's 509 exclusions share a reason (42 reasons, one covers 32)

#356

· rubenvdlinde opened

on Aug 11, 2026

gate-19: duplicate scenario titles collapse to one slug — one test credits several scenarios, and dangling anchors are never reported

#354

· rubenvdlinde opened

on Aug 11, 2026

Coverage ratchet is unclosable when the merge base predates the app's PHPUnit setup (dev→main PRs)

#352

· rubenvdlinde opened

on Aug 11, 2026

axe-run.cjs: any hash route after the first dies with 'returned HTTP 0' — enable-axe covers exactly one route per SPA

#351

· rubenvdlinde opened

on Aug 11, 2026

Navigation Menu

Uh oh!

All issues

gate-7 Pattern 2 assumes OpenRegister enforces per-object authz — for most of the fleet it is default-OPEN (compounds #365)

gate-33/axe steps run with if:always() and report an INFRA failure as an accessibility one — 'axe-runner crashed: Executable doesn't exist' when the real cause was a composer TLS error 4 steps earlier

gate-25: the PHPUnit coverage match is unscoped and skip-blind — measured false coverage on 3 endpoints with zero tests

gate-7 accepts a 401 authentication check as an authorisation guard — 4 real IDORs read as PASS (fleet-wide false negative)

gate-25: the auth lookback is a fixed 20 lines, so it reads the previous method's attribute — and prose

gate-26's signal is inverted: it credits PROSE and refuses NAVIGATION — 11 of 21 openregister findings are false, 6 of 16 passes are comment-only

gate-26 visual-coverage is satisfied by a bare component name in a COMMENT — reproduced 10 → 9 → 10, plus fleet measurement

gate-19: an @e2e anchor that is unparseable or dangling is silently ignored — 22 real, running tests scored as zero coverage

gate-19: one requirement-level @e2e exclude silently exempts every sibling scenario — 471 of openbuild's 509 exclusions share a reason (42 reasons, one covers 32)

gate-19: duplicate scenario titles collapse to one slug — one test credits several scenarios, and dangling anchors are never reported

Coverage ratchet is unclosable when the merge base predates the app's PHPUnit setup (dev→main PRs)

axe-run.cjs: any hash route after the first dies with 'returned HTTP 0' — enable-axe covers exactly one route per SPA

Uh oh!

Search results