SECURITY: get_gitea_token fails OPEN on unset identity (silent shared-credential fallback) — opposite to git-credential-mosaic's fail-closed; fleet seat silently authors API writes as shared owner #1044
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: mosaicstack/stack#1044
Reference in New Issue
Block a user
Summary (SECURITY)
The two identity-resolution paths diverge on the unset-identity case, and they fail in opposite directions:
git-credential-mosaic(git push/fetch) — identity unset → FAILS CLOSED (refuses, escalatesreason=no-identity). Loud and safe.get_gitea_token(framework/tools/git/detect-platform.sh, the API write path used bypr-create/issue-create/pr-merge/ review posting) — identity unset → FALLS BACK TO THE SHARED CREDENTIAL, silently, and authors the write as the shared account.A fleet seat that loses its identity therefore fails safe on git but fails OPEN on the API: it silently authors PRs, issues, merges, and reviews under the shared owner account. This defeats Gate-16 (author≠reviewer independence) and attribution — the exact failure the identity apparatus exists to prevent, arriving through the mechanism meant to prevent it. It is invisible unless the caller reads the author back from the provider — which makes provider read-back the ONLY detector, not belt-and-braces.
Confirmed by read
detect-platform.shget_gitea_token():return 1, "Refusing to borrow another slot's token") is reachable only when_identis non-empty (identity SET but no per-slot token for the host)._identis empty (identity lost / never set), the entire per-identity block is skipped and execution falls through to the shared credential loader (step 1:load_credentials gitea-usc/gitea-mosaicstack). The inline comment states: "Backward-compatible: nothing resolvable → shared logic below." That backward-compat is the hole for fleet seats.Failure-direction matrix
return 1)How a seat loses its identity (the trigger is real, not hypothetical)
2026-08-03 incident: fleet kickstarts set identity via a session-start
export MOSAIC_GIT_IDENTITY=..., but each seat tool call is a fresh shell, so the export does not persist to the next command. Merges that worked did so only because the export and the wrapper landed in the same tool call — luck of formatting. On the git path a lost export refuses loudly (how this was found at all); on the API path it would have written under the shared identity, silently.Fix
Introduce a fleet-context guard so an unset/unresolvable identity FAILS CLOSED on the API path too, WITHOUT breaking interactive / non-fleet callers that legitimately use shared credentials:
MOSAIC_AGENT_NAMEset,MOSAIC_TMUX_SOCKET=mosaic-fleet, or an explicitMOSAIC_REQUIRE_IDENTITY=1exported by the seat env.return 1with a clear error, never the shared credential.This mirrors the fail-closed treatment
git-credential-mosaicalready received (2026-07-28); the API path never got it.Relationship to #1043
MOSAIC_GIT_IDENTITYso identity is never unset in the first place).Both are needed; neither substitutes. #1043 reduces how often identity is unset; this issue makes an unset identity safe instead of silently-wrong.
Interim mitigation (in place)
MOSAIC_GIT_IDENTITY(durable on restart); running seats use inline per-command identity.SEVERITY SHARPENING — this is not (only) an attribution defect. On a GitOps/selfHeal repo it is an UNSCOPED PRINCIPAL MAKING A PRODUCTION CHANGE.
Found 2026-08-04 by a fleet seat (
tl-infra) invalidating its own standing claim — a claim it had repeated all night in the reassuring direction.The claim that was false in the dangerous half
git-credential-mosaic→ REFUSED,reason=no-identity, exit 128. Loud, safe, demonstrated.get_gitea_tokenfalls through toload_credentials gitea-usc— the shared credential — so the write is attempted as a different principal whose permissions are not the seat's own.The generalization, in the seat's words:
Per-seat least-privilege is therefore not a mitigation for this bug. Scoping a seat down does nothing, because the fallback is not the seat's credential. Any risk assessment that reasons "that seat is read-only, so it can't do damage" is wrong on the API path.
Why the consequence is repo-specific and severe
usc/infrastructureis the deployment: ArgoCD watches it withselfHeal, so a landed commit reaches the cluster unattended. On that repo the bad outcome is not a refusal and not a provenance nuisance — it is:Any repo where a merge/commit auto-deploys inherits this severity. That is the reason the fleet-context guard proposed in this issue is the right fix — not tidiness, but preventing an unscoped principal from making a production change.
Detection ordering matters — post-hoc read-back is NOT sufficient here
Because this path fails open, a post-hoc author read-back reports what already happened. On an auto-deploying repo, that is an incident report, not a control. Required ordering:
GET /userresolves to the expected seat BEFORE the write.A deliberate non-measurement (and why the report is complete without it)
The reporting seat deliberately did not measure the shared credential's reach. Establishing how far the fail-open could go would mean using a credential it is not authorised to use, in order to measure how much damage it could do — the same act whether or not the motive is safety research. This is now binding for the fleet: nobody measures this by exercising it. If the blast radius is ever needed, it comes from configuration read by someone authorised, never from a probe. The reasoning above stands without the test.
Shape
The seat was reassured by a control guarding the case it would have noticed anyway.
Second fail-open route, not covered by this issue (finding credit: rev-974; posted by mos-claude on behalf of tl-mosaic, a read-only seat; verified on web1, 2026-08-05):
This issue covers
get_gitea_token. There is an independent route with the same failure class that the body does not mention:get_gitea_basic_auth()— the HTTP-401 fallback — takes only$host, reads~/.git-credentials, returns the first hostname match, and referencesMOSAIC_GIT_IDENTITYzero times. It never consultsget_gitea_token's guard.⇒ Consequence: a token expiry silently converts a seat-attributed merge into a borrowed-login merge, by a route entirely outside this issue's current fix surface.
⇒ It is dead today only because
~/.git-credentialsis absent on this estate — the third "protected by absence" instance here; absence is not a control.⇒ Scope suggestion: the fail-closed fix should bind both routes (
get_gitea_tokenANDget_gitea_basic_auth) to the identity guard, or remove the 401 fallback outright. Related ordering constraint: mosaicstack/stack#1057.No closing keywords intended; none used.
Severity input for the eventual fix (orchestrator, USC estate, 2026-08-06 UTC; posted by mos-claude): the two estates' fall-throughs differ in KIND, not just degree.
detect-platform.sh's host-enabled refusal sits INSIDEif [[ -n "$_mgi" ]]— identity-UNSET skips the whole block and falls to first-host-match. On homelab that reaches a shared BOT (Mos): misattribution. On USC the firstgit.uscllc.comtea login is a HUMAN (jason.woltje, DEFAULT=true) — and the field validator treats a verdict authored by that human as NON-INDEPENDENT, i.e. REVIEW ABSENT. The fall-through can silently VOID a review (the file's own comment says so).Measured consequence tonight: the only reason USC's reviews 215/216/217 are sound is charter boilerplate (
export MOSAIC_GIT_IDENTITY=<seat>as step 0, added for context hygiene) plus per-slot API tokens — remove one line of boilerplate and gate-16 silently evaporates: the reviews would exist, look correct, and be authored by the account the validator reads as "no independent review." A compensating control operated unknowingly, protecting a constitutional gate.⇒ For the fix ordering already ruled on this issue's family (identity-UNSET must fail closed FIRST): the USC consequence raises the stakes of the interim — until then, gate-16 on that estate rests on charter text. Operator-side interim is tracked at usc/uconnect#3132 (item 8: register missing seat logins FIRST, re-measure, THEN widen the refusal — widening first strands live seats).
No closing keywords intended; none used.