Two-model consensus finds the bug. The receipt is the patch that landed.

Security policy can be bypassed by placing sensitive files in subdirectories (anchored patterns only match repo root)

Watcher always uses testnet chain config regardless of CONFIG.chainId

ALLOWED_ORIGIN defaults to '*' but Access-Control-Allow-Credentials is always 'true'

README claims testsPassed=13/13 but API hardcodes testsPassed=8/8

FloatVault.withdraw ignores strategy’s actualOut and attempts to transfer requested amount regardless of received funds

AgentFloatHook._beforeSwap uses regular approve (not forceApprove) on USDT-style tokens

Hardcoded AGBETS→V2 routing contradicts skill's own guidance and risks future breakage

cmd_claimable is documented as performing an on-chain read but actually does nothing

Insecure install method using curl | sh without integrity verification

isTransientError always returns true — non-transient errors are retried, burning attempts and LLM budget

Unhandled missing OPTIN_HMAC_SECRET causes 500 instead of a friendly error

Benchmark backfill logs can misreport flipped row count

`backfill-benchmark-flag.ts` script detection of direct execution is fragile under compiled / symlinked runs

Cron Authorization compare on truncated/unicode headers can throw on non-Latin Buffer length mismatch

Use of Array.prototype.toSorted may break on Node 18 environments (SSR route + script)

Inefficient Octokit instantiation per PR poll

Authorization timing check leaks length oracle; comment claims otherwise

Missing authentication/authorization on secret-management endpoints

Token reassembly from `claude setup-token` can splice in non-token text and write garbage to CLAUDE_CODE_OAUTH_TOKEN

Synchronous child_process calls block the Node event loop on every request

Sharp-move dedup window violates idempotency under same-minute reruns

Undefined FORK_DEFAULT_BRANCH used to fetch aeon.yml from the fork

Exit taxonomy is missing V4_READINESS_REMOTE_API_ERROR status code listed in edge cases

v4-readiness manifest references files not included in the skill’s read set, causing missed Review detections

action query param does not distinguish enable vs missing — disable-link replay flips on

Trusted-sources logic documented in SKILL.md is not implemented in scan.sh

Security scanner uses PCRE tokens (\s, \b) with grep -E, causing widespread false negatives

Branch field in skills.lock is ignored when fetching latest commits, causing false results on non-default branches

last_checked is updated for UNREACHABLE entries, contradicting “last verified” intent and masking stale checks

State file rollback uses non-existent .bak and can cause data loss on write failure

deploy-watcher Vercel API call uses projectId but interpolates project slug

Daily spend circuit breaker compares strings as numbers; awk treats missing/non-numeric values as 0 → cap bypass

postprocess-admanage-create: ad sets with only campaignId (no parentCampaignConfigName) are not written to state

jq --argjson resp $resp will crash the result-writer if curl/server returns non-JSON, dropping the error record

ADMANAGE_API_KEY missing is documented as 'Hard-fails' but script actually exits 0

Slack bot-message filter is inverted: BOT_ID = "null" string check rejects real users

Telegram getUpdates acknowledges all updates (including other chats), risking message loss outside target chat

Jekyll site url points to a different repo than the project

Status page intro contradicts heartbeat's documented behavior on forks

Install one-liner `./aeon` is not a documented entry point for aeon-bench

Unauthenticated endpoint can trigger GitHub Actions via gh CLI

Detailed server error messages leaked to clients

Missing authentication/authorization on secrets API exposes GitHub secret management to any caller

Synchronous child_process calls block the Node event loop on every request

Duplicated section number '4' in heartbeat skill

Mode-switch trigger described inconsistently between docs and goals

Duplicated per-skill `model` overrides drift from the default and from each other

Middleware test shares a single response across all `it` blocks, defeating per-test isolation

Comment in middleware.ts misstates CSP policy ('No unsafe-inline') while code includes it

Health endpoint exposes operational details (env var presence, raw DB error messages) to unauthenticated callers