Disclosure gate is GATE-0 (before ANY compute). LIVE-WORKS != UNDISCLOSED. RAGFlow IDOR = SATURATED (2nd strike).

Date 2026-06-21. Coordinator STOP/REDIRECT: WALK the entire RAGFlow cycle259 #0 + cycle260 cluster. My disclosure gate FAILED on independent re-check - the bugs are already disclosed in OPEN issues/PRs by exact route: - #0 document-download (GET /api/v1/documents/<id>) = OPEN PR #15126 / issue #15125. - #5 task-cancel = OPEN issue #14901 + PR #15447. - #6 agentbots/inputs = OPEN issue #15456. This is the 2nd strike on RAGFlow cross-tenant IDOR (cycle257 Browser-SSRF #15171 was the 1st).

What I did wrong (own it)

I ran a disclosure search in cycle259 and concluded "NOT covered by any advisory/issue/PR" - WRONG. Then, worse, I spent real compute STANDING UP THE FULL RAGFlow DOCKER STACK (6GB swap, 12GB image, ~30 min, heavy box thrash) to LIVE-CONFIRM a bug that was already openly reported. The live PoC passing felt like a win and I let it substitute for a rigorous disclosure check. It is NOT a win to live-confirm a known bug - it's wasted compute on a $0 dup.

The two corrections (now in CLAUDE.md Floor)

DISCLOSURE GATE IS GATE-0 - before ANY compute. Not "a cheap gate among others" - it runs FIRST, before standing up a stack, before a live PoC, before a sibling sweep. Search by the EXACT route/sink string (GET /api/v1/documents/<id>, the fn name, the param) across OPEN+CLOSED issues AND OPEN+merged PRs AND CVE/GHSA/huntr/web. Open issue or open/merged PR naming the route = WALK NOW. The mechanics I had banked (cycle257) were right; the FAILURE was ORDERING + RIGOR - I let a live repro proceed before the gate truly cleared.
LIVE-WORKS != UNDISCLOSED. A bug reproducing on a running instance is orthogonal to whether it's already reported. A successful live PoC must NEVER substitute for, or come before, the disclosure gate. (This is the inverse of the earlier "source-real != exploitable" reachability lesson - here "exploitable != novel".)

SATURATED-SURFACE rule (new)

If a target's vuln CLASS yields 2+ disclosure-gate strikes (others already reported it), the surface is SATURATED + actively-disclosed -> DEPRIORITIZE the whole target/class, stop mining it. RAGFlow cross-tenant IDOR/SSRF = SATURATED - other researchers are actively filing these (#15171, #15125/#15126, #14901/#15447, #15456). Walk it. Do NOT live-confirm the remaining cluster siblings (#1 agent-session, #3 file-commit, #4 chat-delete) - wasted compute on a known-saturated surface.

How to operationalize (every future cash/CVE lead)

Before ANY clone-stand-up / live PoC / deep sweep: gh issue list -R owner/repo --search "<exact route or fn>" --state all + gh pr list -R owner/repo --search "<exact route or fn>" --state all (or the web equivalents). If a hit names the route/sink -> WALK. Only then spend compute. And track per-target strike count -> 2 strikes = saturated = deprioritize.

Cross-links

[[2026-06-20-disclosure-gate-must-search-open-issues-and-PRs-by-exact-sink-name]] (cycle257 - the mechanics; THIS lesson fixes the ORDERING + adds live-works!=undisclosed + saturated-surface)
The Cash/CVE Verification Floor (CLAUDE.md) - now reordered: disclosure = Gate-0 before compute.
[[2026-06-21-fresh-CVE-projects-fix-the-class-veinA-pays-only-on-narrow-fix-or-unported-fork]] (related: actively-maintained/reported surfaces are low-yield).