From the full-repo Codex audit:
- The publisher read discovery fields one per line, so a report title
with newlines shifted every later field and published a manifest
without source.publish_date, which every client rejects (blocking all
syncs). Read them NUL-separated, and refuse to write a manifest missing
a field clients require.
- The snapshot builder copied the SQLite file with cp; committed data
still in the -wal file of an open database would be missing. Checkpoint
first (a no-op for the publisher's closed database, so the bytes and
hash are unchanged) and refuse to copy when that cannot complete.
- install.sh took the tag from a greedy match, which on a compact
single-line releases response picks the last tag, not the newest (it
installed v0.2.3 over v0.2.4 in the new test). Split fields first.
- scripts/audit-msn-fundamentals.sh read the symbol map from a path that
no longer exists and silently checked no stocks.
- release.yml granted contents: write to every job; only publish gets it
now. Actions in the release and snapshot workflows are pinned to commit
SHAs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh
