[finding] plugins/uberdev/skills/merge-pipeline/SKILL.md — 4 findings #799

PR_LABEL_LIST joins label names with a single space and pads the result, then membership is a glob over that string. GitHub label names may contain spaces, so a repo label literally named 'needs premerge-approved review' contributes the premerge instrument to the resolved set. The same defect exists in the duplicated copy inside the b.5 fence. Testing membership on the array with jq -e index() rather than on a space-joined string removes the class.

(b) reads 'contains a trailer matching ^Reviewed-by: uberdev/review-pr@([a-f0-9]{40})$ ... else gate_fail with trust_trail_trailer_missing'. A premerge trailer matches neither the instrument segment nor the dollar anchor, and the reconciliation saying a premerge trailer satisfies (b) on the same terms arrives three sentences later. This file is executed by a model reading prose, so a controller applying (b) as written refuses every premerge trail before (b.5) ever runs. Quoting TRUST_TRAILER_REGEX in (b) instead of the review-pr instantiation closes it.

The snippet is duplicated verbatim in sub-condition (a) and inside merge-base-identity-fence-v1, with the prose 'Keep this snippet byte-identical to (a)'s' as the only link. They are byte-identical today, but only the fence copy is extracted and executed by tests/trust-trail-base-identity.test.sh; (a)'s copy is never executed and no test compares the two. This is the one-contract-N-uncompared-copies class the repo already tracks under ＃370 and ＃371 - an edit to (a) that widens or narrows the label set drifts silently while every grep stays green. Note this copy was introduced by the attempt-1 repair itself.

The snippet appears at both (a) and inside merge-base-identity-fence-v1, linked only by the sentence telling the editor to keep them byte-identical. Nothing executes or compares the two. Adding a member to TRUST_LABEL_ENUM in one copy only yields either a vacuous admission at (a) or a blanket refusal of that instrument at (b.5) - the same silent-failure class the comment block directly above it documents. They are byte-identical today, so this is a drift risk rather than a live defect.