Fix R1: invalidate view codes on revoke/rekey/suspend #5

leora · 2026-10-06T06:10:54+08:00

leora commented

2026-10-06 06:10:54 +08:00

Summary

Independent review finding R1 (High): revoke/rekey left outstanding view codes redeemable, and ignored agent revocation.

Changes

marks unused codes spent
Called from (covers revoke, timed suspend, and rekey)
also refuses when the agent is revoked/unknown (defense in depth)
DESIGN.md updated; regression tests for revoke/suspend/rekey + redeem

Test plan

(134 passed)

## Summary Independent review finding **R1 (High)**: revoke/rekey left outstanding view codes redeemable, and ignored agent revocation. ## Changes - marks unused codes spent - Called from (covers revoke, timed suspend, and rekey) - also refuses when the agent is revoked/unknown (defense in depth) - DESIGN.md updated; regression tests for revoke/suspend/rekey + redeem ## Test plan - [x] (134 passed)

leora added 1 commit 2026-10-06 06:10:54 +08:00

Fix R1: invalidate view codes on revoke/rekey/suspend 4a7b7d6fd7

Outstanding view codes survived revoke and rekey, so a pre-issued code
could mint a fresh human_via_agent session after compromise revoke or
key rotation. Invalidate unused codes when sessions are revoked (covers
revoke, suspend, and rekey), and refuse redeem when the agent is
currently revoked. Regression tests cover all three paths.

leora merged commit d4af46cc1b into sigil-initial

2026-10-06 06:10:55 +08:00

leora referenced this issue from a commit

2026-10-06 06:10:56 +08:00

Merge pull request 'Fix R1: invalidate view codes on revoke/rekey/suspend' (#5) from leora/fix-r1-invalidate-view-codes into sigil-initial

leora referenced this pull request

2026-10-06 06:16:20 +08:00

Sigil: agent identity for the new internet #1

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bigpickle/sigil#5