{"repo":"NousResearch/hermes-agent","public_id":"125841","display_label":"Plugin catalog admission gate path/commit confinement fix","summary":"These items address a security or correctness gap where the plugin-catalog CI gate could validate files outside the intended pinned commit or be bypassed via renames, subdirectory traversal, or tag pins. The work focuses on confining the admission gate strictly to the pinned clone.","subsystem":null,"counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":130712,"merged_at":"2026-10-01T17:46:46+00:00"},"resolution":{"state":"resolved","by":"pr-130712"},"freshness":{"state":"verified","last_verified_at":"2026-10-01T17:46:46+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":125841,"pr_number":130712,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-10-01T17:46:46+00:00"}],"members":[{"kind":"issue","number":125841,"title":"[Bug]: plugin-catalog pinned-source gate can validate files outside the pinned commit","url":null,"state":"closed"},{"kind":"pr","number":125842,"title":"fix(ci): confine plugin-catalog admission gate to the pinned clone","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#130712","number":130712}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":130712,"title":"Plugin catalog CI can no longer be bypassed by renames, subdir traversal or tag pins (salvage #125842)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":[".github/workflows/plugin-catalog-ci.yml","plugin-catalog/README.md","scripts/validate_plugin_catalog.py","tests/ci/test_plugin_catalog_ci_confinement.py","tests/scripts/test_validate_plugin_catalog.py","website/docs/user-guide/features/plugin-catalog.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}