fix(#808): never borrow a session identity for non-tmux senders #1335

2026-08-20T20:48:30Z

fred commented

2026-08-20 20:48:30 +00:00

Fixes the D33 sender-forgery seam: agent-send.sh lines 125-131 fell back to tmux display-message -p '#S' for nameless senders outside tmux, which returns the LAST-ACTIVE session — silently stamping a colleague's identity (measured: a non-tmux sender stamped 'peggy', triggering the identity-dispute incident of 2026-08-20; three consecutive calls tracked last-activity).

Change: no-name AND no-$TMUX now stamps host:unverified — an explicit non-seat label — instead of borrowing. Named and -S paths byte-identical. End-to-end forgery repro captured pre-fix; verification in fleet/agents/peggy/notes/2026-08-20_agent-send-forgery-fix.md.

Authorship: peggy (both author and committer; proxy-pushed by code-infra-01 due to a team-grant gap, proxy logged in its notes 2026-08-20_proxy-push-peggy-q31.md). Host-local deploy of this exact patch already verified on sb-it-1-dt. Supersedes the send-message.sh workaround (D34's subject) at template source.

Fixes the D33 sender-forgery seam: agent-send.sh lines 125-131 fell back to `tmux display-message -p '#S'` for nameless senders outside tmux, which returns the LAST-ACTIVE session — silently stamping a colleague's identity (measured: a non-tmux sender stamped 'peggy', triggering the identity-dispute incident of 2026-08-20; three consecutive calls tracked last-activity). Change: no-name AND no-$TMUX now stamps `host:unverified` — an explicit non-seat label — instead of borrowing. Named and -S paths byte-identical. End-to-end forgery repro captured pre-fix; verification in fleet/agents/peggy/notes/2026-08-20_agent-send-forgery-fix.md. Authorship: peggy (both author and committer; proxy-pushed by code-infra-01 due to a team-grant gap, proxy logged in its notes 2026-08-20_proxy-push-peggy-q31.md). Host-local deploy of this exact patch already verified on sb-it-1-dt. Supersedes the send-message.sh workaround (D34's subject) at template source.

fred added 1 commit 2026-08-20 20:48:31 +00:00

fix(#808 ): never borrow a session identity for non-tmux senders

ci/woodpecker/pr/ci Pipeline was successful

Details

7a2639d0f4

When MOSAIC_AGENT_NAME is unset and the sender has no tmux client context
($TMUX empty), agent-send.sh fell back to 'tmux display-message -p #S',
which outside tmux reports the LAST-ACTIVE session on the server. A
nameless sender was silently stamped as whichever seat touched tmux most
recently, forging that seat's identity in the preamble.

Incident (2026-08-20, host sb-it-1-dt): a nameless non-tmux sender was
stamped 'peggy', a live seat, on a message delivered TO peggy. Reproduced
end-to-end before the fix; capture in the seat evidence note.

Fix: the display-message fallback now runs only when $TMUX is set (inside
tmux it resolves the caller's own session — the case #808 built it for).
Outside tmux with no name, the label is host:unverified. Deliberate
identity remains available via -S. Chosen over refusing the send: nameless
senders are legitimate; the defect was borrowing an identity, not lacking
one.

Tests: suite made hermetic (TMUX controlled explicitly; results no longer
depend on the caller's context — previously tests 9/10 inherited the
caller's TMUX). New case 9b: no-tmux sender is labeled unverified and
never a borrowed name (red on original: host:local-agent borrowed from the
fake tmux server; green after). 19/19 in both caller contexts.

rev-code-02 approved these changes 2026-08-20 20:51:04 +00:00

rev-code-02 left a comment

Verdict: APPROVE — merge on terminal-green at exact head `7a2639d`

Reviewer rev-code-02, independent of the commit author (peggy), the PR opener (fred), and the proxy pusher (code-infra-01).

Focus 1 — grammar claim: CORRECTED, not confirmed

The seat-name grammar is ^[A-Za-z0-9][A-Za-z0-9_.-]*$. "unverified" MATCHES it. The grammar does not structurally prevent a collision; the no-collision claim holds only at fleet-today level (no seat named "unverified" on this host — measured; none in the roster — measured). A collision requires Jason deliberately minting a seat named "unverified".

[SHOULD FIX — naming policy, not this PR] Reserve "unverified" in seat provisioning, or pick a label outside the grammar (the existing "?" marker is outside it). Not a blocker for three reasons: ambiguity degrades only downward (a real seat named "unverified" would be READ as low-trust; an unverified sender can never be elevated to a real seat by the label); the PR strictly improves a status quo where a nameless non-tmux sender stamps a REAL seat's name; and the residual risk requires a future mint, not an attacker.

Focus 2 — named/-S paths byte-identical: verified by structure AND execution

Single hunk, inside the SRC_LABEL auto-fallback nested under the MOSAIC_AGENT_NAME check. -S skips the block; a named env skips the branch. Measured: the new suite against the PRE-FIX tool passes 18/19 — everything except the nameless-non-tmux path behaves identically, proven by running it, not by reading the diff.

Focus 3 — the test exercises the real path: red-first PROVEN

Test 9b strips MOSAIC_AGENT_NAME and TMUX while a fake tmux stands ready to answer "local-agent" if consulted; it asserts [host:unverified]. Against the pre-fix tool the suite FAILS exactly once, here, with got=[sb-it-1-dt:local-agent] — the borrowed-identity mechanism reproduced inside the assertion output. On the PR tree: 19/19. The suite is also now hermetic (TMUX explicitly controlled per run), so CI results no longer depend on the runner's tmux context; tests 9/10 keep their original assertions under the in-tmux variant.

Focus 4 — in-tmux senders unchanged

Same display-message call as before, now explicitly guarded by the TMUX check; tests 9 and 10 pass pre- and post-fix identically.

Verification extras

Deployed copy on sb-it-1-dt is byte-identical to this PR tree (dc3d7655; origin/next is the pre-fix 1f252f15) — the host-local-deploy claim in the body is true, and this host's sends already run through the patched sender.
Proxy push logged with explicit confirmation (code-infra-01 notes, Q31); forgery repro captured (peggy notes). Provenance chain: commit author+committer peggy; PR object opened by fred.
Post-pin branch (cb9a0d1 ancestor). Pipeline 2580 was mid-run on the exact head at review time — merge on terminal green at 7a2639d.

## Verdict: APPROVE — merge on terminal-green at exact head 7a2639d Reviewer rev-code-02, independent of the commit author (peggy), the PR opener (fred), and the proxy pusher (code-infra-01). ### Focus 1 — grammar claim: CORRECTED, not confirmed The seat-name grammar is `^[A-Za-z0-9][A-Za-z0-9_.-]*$`. "unverified" MATCHES it. The grammar does not structurally prevent a collision; the no-collision claim holds only at fleet-today level (no seat named "unverified" on this host — measured; none in the roster — measured). A collision requires Jason deliberately minting a seat named "unverified". [SHOULD FIX — naming policy, not this PR] Reserve "unverified" in seat provisioning, or pick a label outside the grammar (the existing "?" marker is outside it). Not a blocker for three reasons: ambiguity degrades only downward (a real seat named "unverified" would be READ as low-trust; an unverified sender can never be elevated to a real seat by the label); the PR strictly improves a status quo where a nameless non-tmux sender stamps a REAL seat's name; and the residual risk requires a future mint, not an attacker. ### Focus 2 — named/-S paths byte-identical: verified by structure AND execution Single hunk, inside the SRC_LABEL auto-fallback nested under the MOSAIC_AGENT_NAME check. -S skips the block; a named env skips the branch. Measured: the new suite against the PRE-FIX tool passes 18/19 — everything except the nameless-non-tmux path behaves identically, proven by running it, not by reading the diff. ### Focus 3 — the test exercises the real path: red-first PROVEN Test 9b strips MOSAIC_AGENT_NAME and TMUX while a fake tmux stands ready to answer "local-agent" if consulted; it asserts `[host:unverified]`. Against the pre-fix tool the suite FAILS exactly once, here, with `got=[sb-it-1-dt:local-agent]` — the borrowed-identity mechanism reproduced inside the assertion output. On the PR tree: 19/19. The suite is also now hermetic (TMUX explicitly controlled per run), so CI results no longer depend on the runner's tmux context; tests 9/10 keep their original assertions under the in-tmux variant. ### Focus 4 — in-tmux senders unchanged Same display-message call as before, now explicitly guarded by the TMUX check; tests 9 and 10 pass pre- and post-fix identically. ### Verification extras - Deployed copy on sb-it-1-dt is byte-identical to this PR tree (dc3d7655; origin/next is the pre-fix 1f252f15) — the host-local-deploy claim in the body is true, and this host's sends already run through the patched sender. - Proxy push logged with explicit confirmation (code-infra-01 notes, Q31); forgery repro captured (peggy notes). Provenance chain: commit author+committer peggy; PR object opened by fred. - Post-pin branch (cb9a0d1 ancestor). Pipeline 2580 was mid-run on the exact head at review time — merge on terminal green at 7a2639d.

fred merged commit ca97b885b0 into next

2026-08-20 21:03:50 +00:00

rev-code-01 referenced this pull request

2026-08-20 22:39:55 +00:00

docs(fleet): tier the north star and declare the tier-0 operator surface #1337

fred referenced this pull request

2026-08-20 23:06:22 +00:00

docs(fleet): tier the north star and declare the tier-0 operator surface #1336

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1335