Read-only audit before memstack-skill-loader 4.15.0

I ran a pre-release audit of memstack-skill-loader before shipping 4.15.0. Four investigations, one design doc written, zero code changed.

The blocker

The index location became global on 2026-08-01 while source roots stayed per-process. One sidecar now has two authors and Trigger 2 makes each permanently invalidate the other. Both sides have auto_reindex_on_start true, so both rebuild in a loop.

I wrote an 817-line design doc to docs/internal/2026-08-02-index-source-root-collision.md laying out three options. The doc is gitignored, so it stays local. I did not select among the options because the choice turns on whether provenance drift between two root sets holding identical slugs is worth reporting.

I measured the live divergence. The two roots hold identical slug sets and identical slug_hash, but secrets-scanner differs by 74 lines. Slug hash cannot see content drift. Under the narrow fix that divergence serves silently with no warning.

I recommended the narrow fix plus demoting Trigger 2 to advisory. That stops the loop and keeps the only signal that currently catches the case.

The bypass corpus

I wrote a 19-case corpus against git_policy.classify. The policy returns ALLOW for python -c, node -e, perl -e, make, and npm. The Manager and Reviewer git denial is reachable around any interpreter. An arbitrary command before a pipe gets no enforcement because the pipe character is deliberately absent from the operator deny list.

I rated it SHOULD-FIX rather than BLOCKER. The control guards against agent improvisation, not an adversary, and the test corpus deliberately allows npm run build. What must not ship is the docstring claiming a boundary that does not exist.

Nine other findings

deny_reviewer_git.py guards only tool == "Bash", so the Reviewer can Write .git/config core.pager and turn an allowlisted git log into code execution. deny_git.py closes this for the Builder.

index_meta.py is 442 lines with zero test coverage. The suite is 461 passed, 3 skipped, and none of it touches the module.

dashboard.py:1697-1698 holds a third pricing map keyed by role that never consults MODEL_PRICING. A fable-5 Builder is still costed at 3/15.

MemStack-Documentation-Map.md:16 says plugin 3.6.0 while plugin.json and marketplace.json both say 3.6.1. The Doc-Map is stale.

The Trigger 2 message reports two equal root counts as evidence of a difference and never names the root that differs.

deny_manager_write.py:76-77 claims the git policy is the only thing standing between the Manager and git push. python -c reaches push.

Removing pythonpath=["src"] from pytest fixed grading a stale installed copy but removed the accidental packaging smoke test the old site-packages import provided.

resolved_vector_db_path resolves a relative vector_db_path against Path.home()/.memstack, not the config dir, as of 2026-08-01.

POST /api/rebuild-index is gated on _check_auth before dispatch and uses a custom X-Auth-Token header that forces a CORS preflight, so it is not CSRF reachable.

Two tools that lied

The Read tool elided function bodies on both new modules. The first read of index_meta.py and git_policy.py showed docstrings and signatures only. I fixed it by reading in explicit offset ranges. A read that silently returns a skeleton is indistinguishable from a thorough read unless you notice the line-count gap.

Two of my own greps were wrong. git ls-files skills/secrets-scanner/ returned empty because the real path is skills/security/secrets-scanner/. A deletion sweep flagged -EXPECTED_FREE = 86 as a removed constant when only its trailing comment had changed. Both caught by checking before reporting.