Repository navigation
0.5.241: room membership is signed by the person, not the engine or node key - #827
Merged
Merged
Conversation
With the contact ladder green on 0.5.240, every creator POST /v1/chat answered 500 chat.community_create_failed: `membership_founding_member_unsigned` (CIRISPersist#955). The chat routes signed the pair room's founding record, the acceptance of a proposal and the joiner's intent with st.node_signer, the ENGINE key. On a split home (an agent embedding the node) that is the AGENT key: its own self, no owner-binding, so persist's admission_identity_for_writer could not lift it to the founder. contacts_chat::membership_authority picks the held NODE key's signer (owned, so persist resolves it to the person) and falls back to the engine key on a standalone node, whose engine IS the node. MLS and KeyPackage signing is unchanged. tests/split_home_pair_room.rs builds the split home and shows the agent key refused with the production rule and the node key founding the room. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QriZxPx5aJvHXCGaTZmvKF
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
emooreatx
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Five-platform run 40542816916, on 0.5.240. The whole contact ladder went green, then every creator
POST /v1/chatreturned 500chat.community_create_failed:The chat routes signed the pair room's membership rows with
st.node_signer, the engine key. On a split home, where an agent embeds the node (every production agent since 0.5.189), that is the agent key. An agent is its own self with no owner-binding, so persist could not count its signature as the founder's.What
Membership is the person's act. Per Eric: invites come from people, not nodes, and in production the user's signing key is always available.
contacts_chat::membership_pensigns with the owner's own pen (owner_signer_capsule::acquire, the same way chat messages and widening are already signed). It covers:open_pair_room);accept_pair_proposal);pair_intents::advance).The background pair-room driver uses the owner pen it already holds. A delegated session is refused with
chat.delegation_denied. MLS state, KeyPackages and message signing are unchanged.(An earlier commit on this branch signed with the node key. That passes persist's check but is wrong in principle, so it was replaced.)
Tests
tests/split_home_pair_room.rsbuilds the split home: the engine on the agent key, an owner → node binding, and the agent anchored byself_at_login.All green locally:
-D warnings--strict🤖 Generated with Claude Code
https://claude.ai/code/session_01QriZxPx5aJvHXCGaTZmvKF