2026-10-18. The maintainer: "fossil will work as a cgi to itself for public testing", then "yeah, adversarial testing on a scratch repo would be good." The staged release at 9108fea704 was served by fossil server as its own CGI (/ext/ocx2-cgi), on a scratch repository made by fossil new, with scratch users of each kind (setup admin, owner, a user with a, a clone's user, a node, a reader). Nothing touched ollama.
Four attackers, each told to break one thing: authority (who may do what), privacy (what leaks), input (what a tool is given) and concurrency (writes racing each other and writers outside OCX). A fifth reproduced every claim on a fresh instance and merged them.
| Kept | Count |
|---|---|
| high | 4: a forum write stored but never indexed when its crosslink meets an outside writer; edit writing outside the checkout through a dangling symlink; text that is not UTF-8, or holds a NUL, crashing the CGI or answering a backtrace; one bad MCP argument ending the stdio server |
| medium | 4: GET forms putting collect's code in the URL and cutting long queries; a clone write reported failed although the next sync sends it; a clone losing the server's reason for a refusal; a trickling remote stalling a clone with no limit |
| low | 6: E2BIG on about 2000 artifacts; a clone passing the server's receipt answer unchecked; the turn held through Fossil's 15 s busy wait; a lock file beside a repository that does not exist; no -- marker; the test setup touching the account's ~/.fossil |
| dropped | 4, each found intended or not reproduced |
No authority defect was found: capabilities are Fossil's, and each tool asked by a user without its capability, by GET for a write, or from another site was refused.
The attachment adversary-record.tar, plain, holds the setup script, each attacker's report as it returned, and the triage with each reproduction, its smallest fix and the spec that would show it. The scratch passwords and collect codes that two reports quoted are removed; the repositories, password files and cookie jars are not included.