Source: 2026-09-11 self-audit of v0.19.5 (commit f6f8484), finding D-M28 in the reconciled review; raw finding sem 4.3.
Severity: medium · Disposition: fix before porting · Evidence: observed fact
Location
mcp-server/server.ts:704-708.
Defect
codecarto_publish uses cwd as a containment root before it is validated as absolute/existing the way the other tools validate it.
Proposed fix
Validate cwd wherever it becomes a containment root.
The reimplementation spec carries this as a normative rule with a named acceptance scenario.
Source: 2026-09-11 self-audit of v0.19.5 (commit
f6f8484), finding D-M28 in the reconciled review; raw finding sem 4.3.Severity: medium · Disposition: fix before porting · Evidence: observed fact
Location
mcp-server/server.ts:704-708.Defect
codecarto_publishusescwdas a containment root before it is validated as absolute/existing the way the other tools validate it.Proposed fix
Validate
cwdwherever it becomes a containment root.The reimplementation spec carries this as a normative rule with a named acceptance scenario.