id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently

id(attestation): `sign_genesis` / `sign_claim` never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently

Summary

pkgs/id/src/attestation.rs enforces its authority rules in the viewer: compute_state (attestation.rs:258) counts a genesis only when each of the agreement's two players has signed the identical agreement, and counts a claim only when its author is one of those players ("Claims answering a different agreement, from non-players, or with an outcome other than … are ignored", attestation.rs:254-255). The signing entry points enforce only one viewer invariant — sign_genesis (attestation.rs:171) refuses a duplicate-seat agreement, mirroring the viewer's malformed-agreement rule from #2863. Neither signer checks the other authority rule:

sign_genesis never checks that the signing key is one of agreement.players. A third party can sign the agreement and produce a well-formed attestation.genesis event that no viewer will ever count toward the genesis pair.
sign_claim (attestation.rs:208) never checks that the signing key is one of the players of the agreement the claim answers (it cannot check from the claim alone — see acceptance criteria for the shape this implies).

So a caller holding the wrong key — the realistic failure: a harness or wallet layer selects the wrong identity, or an operator signs with a witness/service key — gets a successful signature, a chain event, and an event id to hand out, and the object simply never exists for any viewer. That is the same failure shape closed for currency in #6422 ("creation reports success, consumption silently ignores") and for artifacts in #5623: a signed object should be refused at creation when the module's own consumption rules make it unreachable, so the mistake surfaces where the caller can fix it.

Evidence (verified this run, origin/main `a2b4345e80`)

Code: sign_genesis (attestation.rs:171-205) checks only first == second (duplicate seat) before serializing and calling chain::sign; sign_claim (attestation.rs:208-232) performs no check at all. compute_state's genesis rule (agreement.players.iter().all(|player| genesis.iter().any(|(author, signed)| author == player && …))) and per-player claim collection (author == player) make non-player objects unreachable by construction.
Probe (laptop, worktree of origin/main at a2b4345e80, ~/git/fleet/probe-attestation-wt, integration test pkgs/id/tests/probe_attestation_sign.rs, cargo test -p id --test probe_attestation_sign -- --nocapture, 1 passed): sign_genesis by a third key naming neither seat → Ok (event produced); sign_claim by the same third key → Ok; compute_state over both players' genuine genesis events plus only the stranger's claim → Proposed (the stranger's claim is ignored, exactly as documented). Controls in the same probe: both players' sign calls succeed, and the existing duplicate-seat refusal errors as documented.

Why it matters

The attestation PoC's own module doc states the principle: "Reconstruction is admission, not deserialization: derive conclusions from signature-verified authors and compare claims with the selected agreement. Reject, ignore, or dispute inconsistent input according to the API's rules; never silently repair it or let an input's own claims establish authority." The viewer side honors that; the signer side is the remaining half. This module is explicitly the shape later production attestation APIs would be built on (#2039 design, epic #2056 review gate), so the sign-side contract should be settled while it is still a PoC surface. The duplicate-seat refusal in sign_genesis already establishes the house shape: viewer invariants that make an object meaningless are refused at sign time with a typed SignError.

Acceptance criteria

sign_genesis refuses to sign when the signing key's player_id is not one of agreement.players, surfacing a typed SignError variant (e.g. NotAPlayer); no event is produced.
sign_claim gains a way to refuse a non-player signer — e.g. it takes the GenesisAgreement (or its player set) alongside the claim, or a sibling checked entry point is added and the unchecked one is crate-private/test-only, mirroring the sign_unchecked pattern in artifact.rs. The chosen shape is the fixer's call; the requirement is that the public signing path cannot silently produce a claim no viewer will count.
Tests: a non-player genesis signing and a non-player claim signing both error; both players' genuine genesis + claim flow still computes Agreed (the existing attestation_poc.rs demonstration passes unchanged).
compute_state behavior is unchanged: non-player objects from other/legacy signers are still ignored, never counted.
Out of scope: the witness slot (present and unused by design in this PoC) and objection handling (id: investigate: match audit — netcode log format, replay validation, and cheating signals #2038/id: design: match attestation + audit v1 #2039).

Notes

Related: id(attestation): compute_state never checks the two players are distinct — players=[A,A] attests Agreed from one key's single genesis + single claim #2863 (duplicate-seat: the sign-time refusal precedent in this same function), id(attestation): compute_state never validates the claim outcome's domain — claims naming a third party (or any string) as winner compute Agreed #2868 (claim outcome domain, viewer side), id(currency): sign_authorisation never calls validate — a signed authorisation naming another issuer or with rate_den = 0 is dead on arrival, and signing succeeds silently #6422 (the currency sign-side validation gap — same failure shape, different module and rule; complementary, not a duplicate), id(artifact): validate known-kind bodies in generic signing helpers #5623 (artifact sign-side precedent), Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898 (the reconstruction-is-admission design epic this module's doc cites).
Found by Lane B (new-issue-creator-code-b), weighting away from Lane A's recent fleet-config/queue filings and Lane B's own recent dead-test and currency filings.

CODE-1924

🤖 Agent note · filed

Agent: new-issue-creator job (new-issue-creator-code-b)
Session / ID: cron new-issue-creator-code-b run 2026-11-05 20:50 CST (2026-11-06T02:50Z)
Found via: filed this run
Task: Filed issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424 — sign_genesis (pkgs/id/src/attestation.rs:171) and sign_claim (:208) never check the signer is one of the agreement's players, so a non-player's signed genesis/claim signs successfully yet compute_state (:258) can never count it; verified with a laptop probe on origin/main a2b4345 (non-player sign_genesis Ok, sign_claim Ok, stranger-only claim set computes Proposed; player controls Ok, duplicate-seat refusal intact).
Expectation: effort s — refuse non-player signers at sign time with a typed SignError (sign_claim needs the agreement/player set, shape is the fixer's call per the issue's acceptance criteria); compute_state unchanged. Enqueued as a triage packet on repo-health-code-pilot.
Links: issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424; related issue id(attestation): compute_state never checks the two players are distinct — players=[A,A] attests Agreed from one key's single genesis + single claim #2863 (duplicate-seat sign-time precedent), issue id(currency): sign_authorisation never calls validate — a signed authorisation naming another issuer or with rate_den = 0 is dead on arrival, and signing succeeds silently #6422 (currency sign-side sibling), issue id(artifact): validate known-kind bodies in generic signing helpers #5623 (artifact sign-side precedent)

🤖 Agent note · triage verdict — CONFIRMED, with the API-shape decision made

Agent: repo queue worker, lane code-b (repo-worker-code)
Session / ID: cron repo-queue-worker-shift-b run 2026-11-05; task 10869
Found via: claimed task 10869 this shift; execution-lane assignment returned direct, so this lane triaged it.
Task: task 10869 for issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424 (triage). Fresh check: issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424 is OPEN, no hard-stop labels (held / user/owned / do-not-merge / do-not-auto-edit).

Verdict: CONFIRMED at laptop main 1dae17e457.

Fresh source verification (pkgs/id/src/attestation.rs):

sign_genesis checks only the duplicate-seat invariant (first == second → SignError::DuplicateSeat); it never compares player_id(key) against agreement.players.
sign_claim checks nothing at all — and structurally cannot: its parameters are (key, seq_num, backlink, claim, after). A ResultClaim carries only the agreement hash, not the player set, so signer membership is undecidable at this call site without an API change.
compute_state counts genesis only from the two players and ignores claims whose author is not a seated player — so a non-player's signed genesis/claim is dead on arrival, exactly as filed. The creator's laptop probe (non-player sign_genesis Ok, non-player sign_claim Ok, stranger-only claim computes Proposed) is consistent with this source read.

API-shape decision (the triage call the packet asked for):

Add a typed SignError::NotAPlayer variant, returned when player_id(key) is not one of agreement.players.
sign_genesis: refuse with NotAPlayer after the existing duplicate-seat check; no event produced.
sign_claim: change the signature to also take agreement: &GenesisAgreement (mirroring sign_genesis), refuse with NotAPlayer when the signer is not a player, and refuse when claim.agreement != agreement.agreement_hash() (a claim answering a different agreement is equally dead on arrival in compute_state; with the agreement in hand this check is free). A checked sibling that leaves the current unchecked public sign_claim in place is rejected: the silent path would remain public.
Cost is low and bounded: the only in-repo callers of sign_claim are the PoC tests (pkgs/id/tests/attestation_poc.rs, the two calls at ~:87/:95), and the module is explicitly a proof of concept with no production API built on it. compute_state behavior is unchanged — non-player objects from peers are still ignored.

Follow-up: small_fix task enqueued from this triage (task id in the completion note below / queue dedupe key repo-health:v1:fix:developing-today/code:issue:6424) covering the refusal implementations, both new refusal tests, the attestation_poc demonstration still computing Agreed, and cargo test -p id attestation coverage.

Expectation: the follow-up fix task implements the shape above; issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424 stays open until that fix lands.
Links: task 10869 · issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424

fix(id): refuse non-player signers in sign_genesis/sign_claim (#6424)

🤖 Agent note · PR opened, parked for CI

Agent: repo-worker-code (OpenChamber scheduled lane, lane bf419306), task 10870
Task: Implemented sign-time refusal (NotAPlayer / AgreementMismatch, crate-private sign_claim_unchecked) in PR fix(id): refuse non-player signers in sign_genesis/sign_claim (#6424) #6559. 20 attestation tests pass locally. PR also fixes two str/String comparisons in world_net.rs that stopped the id lib compiling on main 9c06d0c.
Next: parked 20 min; resume reads CI fresh and merges if green.

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-d
Session / ID: task 10870
Found via: queue claim
Task: Handing task 10870 for issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424 to the opencode execution lane — checkpointed handed_off; the laptop opencode-claimant launches the bound session.
Expectation: claimant launches the bound opencode session for task 10870; parked 1200s pending launch
Links: issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424

🤖 Agent note · handed off

Agent: repo queue worker, lane code-k (repo-worker-code)
Session / ID: cron repo-queue-worker-shift-k run 2026-11-06 11:13 CST; task 10870
Found via: queue claim · task 10870
Task: task 10870 for issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424 (small_fix). Fresh check: issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424 is OPEN, no hard-stop labels (held / user/owned / do-not-merge / do-not-auto-edit); PR fix(id): refuse non-player signers in sign_genesis/sign_claim (#6424) #6559 is OPEN. Execution-lane assignment returned opencode — handed off to the opencode claimant, which launches the bound opencode session; this lane does not work it directly.
Expectation: claimant session drives task 10870 to a terminal state. Attempts 4/4 AT CAP — claimant must bind this cycle or a cap raise is needed; prior progress records PR fix(id): refuse non-player signers in sign_genesis/sign_claim (#6424) #6559, branch queue/10870-6424-attestation-signer-player, tests 20 pass.
Links: task 10870 · issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424 · PR fix(id): refuse non-player signers in sign_genesis/sign_claim (#6424) #6559

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-z
Session / ID: task 10870
Found via: queue claim
Task: task 10870 (small_fix, issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424 — refuse non-player signers in sign_genesis/sign_claim) claimed by lane code-z and handed off — execution lane assigned opencode by fleet queue lane per worker instruction §1b; this lane does not work it directly. Issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424 verified OPEN with no held, user/owned, do-not-merge, or do-not-auto-edit labels (fresh gh check 2026-11-06T17:57Z). ⚠️ Attempts are at 4/4 — AT CAP: if the claimant does not bind during this park, task 10870 cannot be re-claimed without a max_attempts raise.
Expectation: opencode-claimant launches the bound opencode session and drives task 10870 to a terminal state; task parked 1200s for that launch.
Links: issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-a
Session / ID: task 10870
Found via: queue claim
Task: handing task 10870 for issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424 to the opencode claimant (assigned_lane=opencode); claimant launches the bound opencode session
Expectation: claimant picks up task 10870; attempts 4/4; if not launched before park expiry, task 10870 returns to the queue
Links: issue id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424

Navigation Menu

Repository navigation

id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424

id(attestation): `sign_genesis` / `sign_claim` never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently

Summary

Evidence (verified this run, origin/main `a2b4345e80`)

Why it matters

Acceptance criteria

Notes

65 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently #6424

Description

id(attestation): sign_genesis / sign_claim never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently

Summary

Evidence (verified this run, origin/main a2b4345e80)

Why it matters

Acceptance criteria

Notes

Activity

developing-today commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

65 remaining items

dezren39 commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

id(attestation): `sign_genesis` / `sign_claim` never check the signer is a player — a non-player's signed genesis or claim is dead on arrival, and signing succeeds silently

Evidence (verified this run, origin/main `a2b4345e80`)