Found by lane/macos-legs during the 2026-07-31 platform run and confirmed by the adversarial verifier with an independent syscall probe, not taken on the lane's word.
Media intake refuses every $TMPDIR path on macOS. On macOS $TMPDIR is a per-user path under /var/folders/..., which is where the platform puts temporary files — so this is not an exotic corner, it is the default location any macOS caller would hand us.
Severity HIGH: it is a real product defect on a supported platform, not a harness artifact, and it was unfixed when the lane landed. It is recorded here so it is not lost in the lane's evidence.
Two related arms in the same lane were found VACUOUS and should be repaired alongside this, because they currently cannot detect the bug they exist for: the macOS symlink arm and the over-cap arm are both refused by the component walk before reaching their intended gate. They pass for the wrong reason.
When fixing, prove both directions: a legitimate $TMPDIR media path must be admitted, and a genuinely hostile path (traversal, symlink escape) must still be refused. Widening the walk until everything is admitted would trade a false refusal for a security hole.
Found by
lane/macos-legsduring the 2026-07-31 platform run and confirmed by the adversarial verifier with an independent syscall probe, not taken on the lane's word.Media intake refuses every
$TMPDIRpath on macOS. On macOS$TMPDIRis a per-user path under/var/folders/..., which is where the platform puts temporary files — so this is not an exotic corner, it is the default location any macOS caller would hand us.Severity HIGH: it is a real product defect on a supported platform, not a harness artifact, and it was unfixed when the lane landed. It is recorded here so it is not lost in the lane's evidence.
Two related arms in the same lane were found VACUOUS and should be repaired alongside this, because they currently cannot detect the bug they exist for: the macOS symlink arm and the over-cap arm are both refused by the component walk before reaching their intended gate. They pass for the wrong reason.
When fixing, prove both directions: a legitimate
$TMPDIRmedia path must be admitted, and a genuinely hostile path (traversal, symlink escape) must still be refused. Widening the walk until everything is admitted would trade a false refusal for a security hole.