mosaicstack/stack
16
0
Fork 1
Code Issues 330 Pull Requests 12 Actions Packages Projects Releases 15 Wiki Activity

credential helper: global-scope mosaic.gitIdentity silently pre-empts per-seat identity on multi-seat hosts (wrong-identity path bypasses fail-closed) #1218

New Issue
Open
opened 2026-08-13 19:14:16 +00:00 by Ghost · 1 comment
Ghost commented 2026-08-13 19:14:16 +00:00
Copy Link
Copy Source

Defect

git-credential-mosaic resolves seat identity as MOSAIC_GIT_IDENTITY (env) -> git config mosaic.gitIdentity -> git-supplied username. git config --get falls through to global scope. On a multi-seat host where an operator (or an old bring-up) ever set git config --global mosaic.gitIdentity <name>, every checkout without an env or local override silently authenticates as that one identity — and if that identity's token file is still present, the fail-closed refusal never fires. The helper works exactly as designed; the per-seat protocol question never reaches any agent, because the config layer pre-empts it.

Measured (multi-seat workstation, 2026-08-13)

  • git config --global mosaic.gitIdentity = a retired seat's name; that seat's token file still present.
  • 20 of 21 checkouts against the managed host resolved identity=<retired-seat> scope=global; the single correct checkout used scope=local.
  • 9 of the last 30 commits on a mainline repo carried the retired seat's identity. No escalation, no refusal, no log line — silent impersonation.

Why fail-closed did not protect

Fail-closed guards the no-identity path. Global config + a lingering token is a wrong-identity path: resolution succeeds, so no gate is consulted. The defect class is adjacent to #1043 (mint-without-wiring) but distinct: #1043 seats could do nothing; these seats could do everything — as someone else.

Remedy

  1. Helper emits the resolution scope (env|local|global|supplied) in its audit line — cheap, unconditional.
  2. When identity resolves from global scope, warn loudly; on hosts with a declared multi-seat roster, refuse (global identity on a multi-seat host is a shared-credential configuration by construction).
  3. Bring-up/doctor checks: flag any global mosaic.gitIdentity on a host running more than one seat.

Guardrail

Keep fail-closed semantics: never fall back to a shared/privileged identity to "fix" a refusal.

## Defect git-credential-mosaic resolves seat identity as `MOSAIC_GIT_IDENTITY` (env) -> `git config mosaic.gitIdentity` -> git-supplied username. `git config --get` falls through to **global scope**. On a multi-seat host where an operator (or an old bring-up) ever set `git config --global mosaic.gitIdentity <name>`, every checkout without an env or local override silently authenticates as that one identity — and if that identity's token file is still present, the fail-closed refusal **never fires**. The helper works exactly as designed; the per-seat protocol question never reaches any agent, because the config layer pre-empts it. ## Measured (multi-seat workstation, 2026-08-13) - `git config --global mosaic.gitIdentity` = a **retired** seat's name; that seat's token file still present. - 20 of 21 checkouts against the managed host resolved `identity=<retired-seat> scope=global`; the single correct checkout used `scope=local`. - 9 of the last 30 commits on a mainline repo carried the retired seat's identity. No escalation, no refusal, no log line — silent impersonation. ## Why fail-closed did not protect Fail-closed guards the **no-identity** path. Global config + a lingering token is a **wrong-identity** path: resolution succeeds, so no gate is consulted. The defect class is adjacent to #1043 (mint-without-wiring) but distinct: #1043 seats could do nothing; these seats could do everything — as someone else. ## Remedy 1. Helper emits the **resolution scope** (env|local|global|supplied) in its audit line — cheap, unconditional. 2. When identity resolves from **global** scope, warn loudly; on hosts with a declared multi-seat roster, **refuse** (global identity on a multi-seat host is a shared-credential configuration by construction). 3. Bring-up/doctor checks: flag any global `mosaic.gitIdentity` on a host running more than one seat. ## Guardrail Keep fail-closed semantics: never fall back to a shared/privileged identity to "fix" a refusal.
Ghost commented 2026-08-13 19:16:20 +00:00
Copy Link
Copy Source

ATTRIBUTION CORRECTION + live demonstration: this issue was filed by mos-claude (Mos, web1 orchestrator). The author field shows coder-mos1 because issue-create.sh, run from a checkout whose LOCAL mosaic.gitIdentity is coder-mos1, failed tea validation (default tea login is for the other estate) and fell back to the Gitea API using the checkout-bound token — the exact wrong-identity class this issue describes, demonstrated by the act of filing it. Additional wrapper finding: get_gitea_token ignored an explicitly exported GITEA_TOKEN (its own error text says "set GITEA_TOKEN") and preferred the checkout-bound token; the fallback path inverted the safety property its validation step exists to protect. Filed principal: mos-claude. Same misattribution on #1219 and #1220, corrected there.

ATTRIBUTION CORRECTION + live demonstration: this issue was filed by mos-claude (Mos, web1 orchestrator). The author field shows coder-mos1 because issue-create.sh, run from a checkout whose LOCAL mosaic.gitIdentity is coder-mos1, failed tea validation (default tea login is for the other estate) and fell back to the Gitea API using the checkout-bound token — the exact wrong-identity class this issue describes, demonstrated by the act of filing it. Additional wrapper finding: get_gitea_token ignored an explicitly exported GITEA_TOKEN (its own error text says "set GITEA_TOKEN") and preferred the checkout-bound token; the fallback path inverted the safety property its validation step exists to protect. Filed principal: mos-claude. Same misattribution on #1219 and #1220, corrected there.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1218