Issues

• test: TestWebMgmtRebindsOnAddressReplacement14582 racy - asserts async listener close synchronously

  bug
  psaab/xpf#14824 · Filter by author psaab opened on Oct 17, 2026

• build: master test cfg broken - persistent_inbound_lookup arity E0061 (policy_revalidation.rs:461, tests_det_flip_14625)

  bug
  psaab/xpf#14818 · Filter by author psaab opened on Oct 17, 2026

• [build] origin/master does not compile: policy_revalidation persistent_inbound_lookup arity

  psaab/xpf#14802 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D20-05] Event-Mode LocalLogWriter Omits #6585 Control/Newline Sanitization (SanitizeForDisplay) and #…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14732 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D20-04] Dual-Stack DDNS Manager.currentAuthorityLocked Collapses Per-Family Authority Fingerprints to…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14731 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D20-02] HA DHCP Lease Pre-Seed (PreSeedMemfileMerged4/6 and PreSeedMemfileMerged4/6WithAuthority) Pre…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14730 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D20-01] DHCPv4 Client leaseFromACKv4 Omits Protected-Prefix Overlap Validation and Checks ClasslessRo…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14728 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D19-05] canonicalizeHTTPTarget and probeHTTP Return Unwrapped Errors Instead of ErrProbeSetup (Causin…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14727 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D19-04] recordRepublishResultLocked Clears republishFailClosed While Leaving s.active Forced All-Fals…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14726 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D19-03] SessionMatchesWithIndex Fails to Match Multi-Term Applications and Application Sets (clear/sh…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14725 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D19-02] runAction and HandleEvent Leak onLatched Edge Latches on Cooldown-Stale Drops, Transient Comm…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14724 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D19-01] joinFeedURL Silently Falls Back to baseURL on Malformed rawPath, Strips Network-Path (//) and…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14723 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D18-05] Unsynchronized SaveRescueConfig Races DeleteRescueConfig, Resurrecting Deleted Cleartext rescue.conf

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14722 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D18-04] Runner.rollback Omits Post-Start HelperHealthy Gate; Resumed StateRollingBack Returns nil and Rejoins Election

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14721 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D18-03] Cutover Pre-STOP Stamp and Pre-FLIP Guard Confusion Delete the Committed Rollback Target on Verify/Start Failure

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14720 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D18-01] DB.writeConfirmCover Cleared on Return Causes Tombstone/Retry/Recovery Rewrites to Strip Confirm Encryption

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14719 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D17-05] Unconfined Root-Privileged Filesystem Read Pre-Authorization and Verbatim File Line Exfiltrat…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14718 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D17-04] Local CLI annotate Authorization-to-Execution Parser Desynchronization Bypasses deny-configur…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14717 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D17-03] Un-Lexed edit Path Storage in dispatchConfig and AuthorizeConfigMutation Desynchronizes Autho…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14716 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D17-02] show configuration and Config-Mode show Display-Pipe Substring Matching Ignores Trailing Stan…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14715 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D17-01] Recursive Multi-Pipe Dispatch Overwrites c.pendingPipeSuffix, Bypassing deny-commands and all…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14714 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D16-05] Non-GET Safe HTTP Methods (HEAD) Bypass Command-Regex Route Resolution in authorizeRESTComman…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14712 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D16-04] Dual-Header Authorization + X-API-Key Throttle Identity Mismatch Enables X-API-Key Per-Accoun…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14711 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D16-02] RBAC deny-configuration Regex Bypass via Non-ASCII/Vertical-Tab Whitespace Tokenization Misma…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14710 · Filter by author psaab opened on Oct 17, 2026

• [gemini-hostile D15-04] d11LedgerPrincipalAllowed Grants GetD11AttestationLedger and SystemAction("userspace-attest:a…

  auditbugmodel:gemini-4-argon-highsource:deep-reviewvalidated-by:research
  psaab/xpf#14709 · Filter by author psaab opened on Oct 17, 2026