identity drift: prod bot MXID (@voicebridge_as) vs docs/test-profile (@nether-voicebridge_bot) — first real beta user stranded #96

New issue

Open

opened 2026-07-12 03:25:43 +00:00 by robocub · 1 comment

robocub commented

2026-07-12 03:25:43 +00:00

Collaborator

Incident 2026-07-12 (first real self-serve attempt!): @dau:tinier.town DM-invited @nether-voicebridge_bot:nether.im per the docs. Prod's [server.nether] sets bot_user_id = @voicebridge_as:nether.im, so no prod client syncs as the documented user — the invite sat pending. A staging e2e run (whose test profile DOES use the _bot MXID, masquerading via the nvbtest as_token — same exclusive namespace) then consumed the invites at startup, federated-joined both of dau's DMs, and greeted from a throwaway drill process. Net effect: user stranded at an address nobody serves, plus staging can eat prod-adjacent invites.

Shipped immediately: docs corrected to @voicebridge_as:nether.im (repo 86fbd34, wiki 4efbd55).

Remaining decisions:

Converge the identities. Either prod migrates to the conventional @<stem>_bot user (invasive: every bridged-room membership, mgmt crypto store, tenants — probably not worth it), or the convention/docs/example configs treat the sender_localpart user as the canonical bot and the _bot derivation note gets revisited. Pick one and make validate() or docs generation keep them honest.
Stop the harness masquerading prod-visible identities. The e2e test profile's bot_user_id is inside the appservice's exclusive namespace, so drill runs can consume real pending invites for that MXID. Options: move the harness bot to a clearly-test localpart (still in namespace, e.g. @nether-voicebridge_e2etest:nether.im), or accept + document the hazard (mgmt scenarios only when no pending prod invites — unenforceable for strangers).
Leftovers: @nether-voicebridge_bot is now a member of two tinier.town DM rooms (one E2EE) with a greeting posted from a dead drill device; needs a polite exit (message + leave via as_token).
Detection gap: an invite to ANY namespace user that nothing serves is silent. Cheap guard: nvb-watch could sync-poll the documented DM MXID for pending invites and alert.

**Incident 2026-07-12 (first real self-serve attempt!):** `@dau:tinier.town` DM-invited `@nether-voicebridge_bot:nether.im` per the docs. Prod's `[server.nether]` sets `bot_user_id = @voicebridge_as:nether.im`, so no prod client syncs as the documented user — the invite sat pending. A staging e2e run (whose `test` profile DOES use the `_bot` MXID, masquerading via the nvbtest as_token — same exclusive namespace) then consumed the invites at startup, federated-joined both of dau's DMs, and greeted from a throwaway drill process. Net effect: user stranded at an address nobody serves, plus staging can eat prod-adjacent invites. **Shipped immediately:** docs corrected to `@voicebridge_as:nether.im` (repo `86fbd34`, wiki `4efbd55`). **Remaining decisions:** 1. **Converge the identities.** Either prod migrates to the conventional `@<stem>_bot` user (invasive: every bridged-room membership, mgmt crypto store, tenants — probably not worth it), or the convention/docs/example configs treat the sender_localpart user as the canonical bot and the `_bot` derivation note gets revisited. Pick one and make `validate()` or docs generation keep them honest. 2. **Stop the harness masquerading prod-visible identities.** The e2e `test` profile's `bot_user_id` is inside the appservice's exclusive namespace, so drill runs can consume real pending invites for that MXID. Options: move the harness bot to a clearly-test localpart (still in namespace, e.g. `@nether-voicebridge_e2etest:nether.im`), or accept + document the hazard (mgmt scenarios only when no pending prod invites — unenforceable for strangers). 3. **Leftovers:** `@nether-voicebridge_bot` is now a member of two tinier.town DM rooms (one E2EE) with a greeting posted from a dead drill device; needs a polite exit (message + leave via as_token). 4. **Detection gap:** an invite to ANY namespace user that nothing serves is silent. Cheap guard: nvb-watch could sync-poll the documented DM MXID for pending invites and alert.

robocub referenced this issue from a commit

2026-07-12 03:39:32 +00:00

docs(e2e): harness sender_localpart must differ from prod's (#96)

robocub commented

2026-07-12 03:43:47 +00:00

Author

Collaborator

Progress 2026-07-12:

Docs fixed to @voicebridge_as:nether.im (repo 86fbd34, wiki 4efbd55, live).
User notified: redirect + apology posted into both of dau's DM rooms as the old bot.
Harness repointed (item 2): staging e2e.toml sender_localpart → nether-voicebridge_e2e (mgmt bot = @nether-voicebridge_e2e_bot, registered + joined Auto Test 01/02; per-scenario bridge stores wiped once — identity change invalidates persisted sessions); mgmt_self_serve_link LIVE PASS 76.5s on the new identity. e2e.example.toml documents the distinct-stem convention (5935c1e).
Remaining: operator deactivates @nether-voicebridge_bot:nether.im via the Tuwunel admin room (deactivation auto-leaves its ~77 rooms — all e2e detritus + dau's two DMs; prod rooms are @voicebridge_as's and unaffected). Then item 1 (identity-convergence decision) can be closed as "prod stays voicebridge_as, conventional name retired", and item 4 (pending-invite watch) remains optional hardening.

Progress 2026-07-12: - **Docs fixed** to `@voicebridge_as:nether.im` (repo `86fbd34`, wiki `4efbd55`, live). - **User notified**: redirect + apology posted into both of dau's DM rooms as the old bot. - **Harness repointed** (item 2): staging `e2e.toml` `sender_localpart` → `nether-voicebridge_e2e` (mgmt bot = `@nether-voicebridge_e2e_bot`, registered + joined Auto Test 01/02; per-scenario bridge stores wiped once — identity change invalidates persisted sessions); `mgmt_self_serve_link` LIVE PASS 76.5s on the new identity. `e2e.example.toml` documents the distinct-stem convention (`5935c1e`). - **Remaining**: operator deactivates `@nether-voicebridge_bot:nether.im` via the Tuwunel admin room (deactivation auto-leaves its ~77 rooms — all e2e detritus + dau's two DMs; prod rooms are `@voicebridge_as`'s and unaffected). Then item 1 (identity-convergence decision) can be closed as "prod stays voicebridge_as, conventional name retired", and item 4 (pending-invite watch) remains optional hardening.

robocub referenced this issue

2026-07-12 04:04:07 +00:00

mgmt: restart-window invite double-processing can auto-DECLINE a legitimate DM invite (#89a cooldown misfire) #97

robocub referenced this issue

2026-07-12 04:17:47 +00:00

e2e: DM/invite lifecycle coverage — E2EE DMs, restart races, cooldown semantics (gaps exposed by #96/#97) #99

robocub referenced this issue

2026-07-12 04:53:45 +00:00

e2e: #99 implementation — E2EE DM actor + invite-lifecycle scenarios (parallel-instance handoff) #100

robocub referenced this issue from a commit

2026-07-12 06:25:56 +00:00

fix(ci): e2e nightly still masqueraded the deactivated pre-#96 bot identity