#96 - identity drift: prod bot MXID (@voicebridge_as) vs docs/test-profile (@nether-voicebridge_bot) — first real beta user stranded - dark/nether-voicebridge

robocub commented

2026-07-12 03:25:43 +00:00

Collaborator

Incident 2026-07-12 (first real self-serve attempt!): @dau:tinier.town DM-invited @nether-voicebridge_bot:nether.im per the docs. Prod's [server.nether] sets bot_user_id = @voicebridge_as:nether.im, so no prod client syncs as the documented user — the invite sat pending. A staging e2e run (whose test profile DOES use the _bot MXID, masquerading via the nvbtest as_token — same exclusive namespace) then consumed the invites at startup, federated-joined both of dau's DMs, and greeted from a throwaway drill process. Net effect: user stranded at an address nobody serves, plus staging can eat prod-adjacent invites.

Shipped immediately: docs corrected to @voicebridge_as:nether.im (repo 86fbd34, wiki 4efbd55).

Remaining decisions:

Converge the identities. Either prod migrates to the conventional @<stem>_bot user (invasive: every bridged-room membership, mgmt crypto store, tenants — probably not worth it), or the convention/docs/example configs treat the sender_localpart user as the canonical bot and the _bot derivation note gets revisited. Pick one and make validate() or docs generation keep them honest.
Stop the harness masquerading prod-visible identities. The e2e test profile's bot_user_id is inside the appservice's exclusive namespace, so drill runs can consume real pending invites for that MXID. Options: move the harness bot to a clearly-test localpart (still in namespace, e.g. @nether-voicebridge_e2etest:nether.im), or accept + document the hazard (mgmt scenarios only when no pending prod invites — unenforceable for strangers).
Leftovers: @nether-voicebridge_bot is now a member of two tinier.town DM rooms (one E2EE) with a greeting posted from a dead drill device; needs a polite exit (message + leave via as_token).
Detection gap: an invite to ANY namespace user that nothing serves is silent. Cheap guard: nvb-watch could sync-poll the documented DM MXID for pending invites and alert.

**Incident 2026-07-12 (first real self-serve attempt!):** `@dau:tinier.town` DM-invited `@nether-voicebridge_bot:nether.im` per the docs. Prod's `[server.nether]` sets `bot_user_id = @voicebridge_as:nether.im`, so no prod client syncs as the documented user — the invite sat pending. A staging e2e run (whose `test` profile DOES use the `_bot` MXID, masquerading via the nvbtest as_token — same exclusive namespace) then consumed the invites at startup, federated-joined both of dau's DMs, and greeted from a throwaway drill process. Net effect: user stranded at an address nobody serves, plus staging can eat prod-adjacent invites. **Shipped immediately:** docs corrected to `@voicebridge_as:nether.im` (repo `86fbd34`, wiki `4efbd55`). **Remaining decisions:** 1. **Converge the identities.** Either prod migrates to the conventional `@<stem>_bot` user (invasive: every bridged-room membership, mgmt crypto store, tenants — probably not worth it), or the convention/docs/example configs treat the sender_localpart user as the canonical bot and the `_bot` derivation note gets revisited. Pick one and make `validate()` or docs generation keep them honest. 2. **Stop the harness masquerading prod-visible identities.** The e2e `test` profile's `bot_user_id` is inside the appservice's exclusive namespace, so drill runs can consume real pending invites for that MXID. Options: move the harness bot to a clearly-test localpart (still in namespace, e.g. `@nether-voicebridge_e2etest:nether.im`), or accept + document the hazard (mgmt scenarios only when no pending prod invites — unenforceable for strangers). 3. **Leftovers:** `@nether-voicebridge_bot` is now a member of two tinier.town DM rooms (one E2EE) with a greeting posted from a dead drill device; needs a polite exit (message + leave via as_token). 4. **Detection gap:** an invite to ANY namespace user that nothing serves is silent. Cheap guard: nvb-watch could sync-poll the documented DM MXID for pending invites and alert.

robocub referenced this issue from a commit

2026-07-12 03:39:32 +00:00

docs(e2e): harness sender_localpart must differ from prod's (#96)

robocub commented

2026-07-12 03:43:47 +00:00

Author

Collaborator

Progress 2026-07-12:

Docs fixed to @voicebridge_as:nether.im (repo 86fbd34, wiki 4efbd55, live).
User notified: redirect + apology posted into both of dau's DM rooms as the old bot.
Harness repointed (item 2): staging e2e.toml sender_localpart → nether-voicebridge_e2e (mgmt bot = @nether-voicebridge_e2e_bot, registered + joined Auto Test 01/02; per-scenario bridge stores wiped once — identity change invalidates persisted sessions); mgmt_self_serve_link LIVE PASS 76.5s on the new identity. e2e.example.toml documents the distinct-stem convention (5935c1e).
Remaining: operator deactivates @nether-voicebridge_bot:nether.im via the Tuwunel admin room (deactivation auto-leaves its ~77 rooms — all e2e detritus + dau's two DMs; prod rooms are @voicebridge_as's and unaffected). Then item 1 (identity-convergence decision) can be closed as "prod stays voicebridge_as, conventional name retired", and item 4 (pending-invite watch) remains optional hardening.

Progress 2026-07-12: - **Docs fixed** to `@voicebridge_as:nether.im` (repo `86fbd34`, wiki `4efbd55`, live). - **User notified**: redirect + apology posted into both of dau's DM rooms as the old bot. - **Harness repointed** (item 2): staging `e2e.toml` `sender_localpart` → `nether-voicebridge_e2e` (mgmt bot = `@nether-voicebridge_e2e_bot`, registered + joined Auto Test 01/02; per-scenario bridge stores wiped once — identity change invalidates persisted sessions); `mgmt_self_serve_link` LIVE PASS 76.5s on the new identity. `e2e.example.toml` documents the distinct-stem convention (`5935c1e`). - **Remaining**: operator deactivates `@nether-voicebridge_bot:nether.im` via the Tuwunel admin room (deactivation auto-leaves its ~77 rooms — all e2e detritus + dau's two DMs; prod rooms are `@voicebridge_as`'s and unaffected). Then item 1 (identity-convergence decision) can be closed as "prod stays voicebridge_as, conventional name retired", and item 4 (pending-invite watch) remains optional hardening.

robocub referenced this issue

2026-07-12 04:04:07 +00:00

mgmt: restart-window invite double-processing can auto-DECLINE a legitimate DM invite (#89a cooldown misfire) #97

robocub referenced this issue

2026-07-12 04:17:47 +00:00

e2e: DM/invite lifecycle coverage — E2EE DMs, restart races, cooldown semantics (gaps exposed by #96/#97) #99

robocub referenced this issue

2026-07-12 04:53:45 +00:00

e2e: #99 implementation — E2EE DM actor + invite-lifecycle scenarios (parallel-instance handoff) #100

robocub referenced this issue from a commit

2026-07-12 06:25:56 +00:00

fix(ci): e2e nightly still masqueraded the deactivated pre-#96 bot identity

robocub referenced this issue from a commit

2026-07-12 06:37:29 +00:00

fix(ci): e2e nightly still masqueraded the deactivated pre-#96 bot identity

robocub referenced this issue

2026-07-12 14:07:55 +00:00

infra: nether.autos incus container — federated-fixture setup runbook (new-session handoff for #106/#108) #109

robocub referenced this issue from a commit

2026-08-20 02:28:51 +00:00

ops(nvb-watch): dormant-MXID invite canary — alert when someone invites the address nobody serves (#96)

robocub commented

2026-08-20 02:29:40 +00:00

Author

Collaborator

Status sweep 2026-08-20, item by item:

Identity convergence — recommendation: keep @voicebridge_as canonical. Migrating prod to @nether-voicebridge_bot would touch every bridged-room membership, the mgmt crypto store, and tenants for zero user-visible benefit; the docs already point at @voicebridge_as (fixed 07-12). The _bot-derivation note in the registration YAML should be softened when #41 reworks the docs.
Harness masquerade — already resolved: the e2e profile runs @nether-voicebridge_e2e_bot.
Leftovers — checked server-side as the MXID: the two tinier.town DM memberships are gone (no :tinier.town rooms, no pending invites — nothing to exit politely anymore). What remains is 9 stale memberships from the pre-rename harness era (6 old nvbtest_* drill DMs + the 3 Auto Test rooms). A batch-leave to make the address fully dormant is prepared but awaits an operator go (touches homeserver state).
Detection gap — shipped on branch ops/96-dormant-mxid-watch: nvb-watch section 3a syncs as @nether-voicebridge_bot each tick and posts a state-latched 📬 alert for any pending invite (re-invite re-alerts). Offline harness covers alert/latch/re-alert; 27/27 green. Deploy to /opt/nvb-ops after merge.

Once the branch merges + deploys and the batch-leave runs, this can close.

Status sweep 2026-08-20, item by item: 1. **Identity convergence — recommendation: keep `@voicebridge_as` canonical.** Migrating prod to `@nether-voicebridge_bot` would touch every bridged-room membership, the mgmt crypto store, and tenants for zero user-visible benefit; the docs already point at `@voicebridge_as` (fixed 07-12). The `_bot`-derivation note in the registration YAML should be softened when #41 reworks the docs. 2. **Harness masquerade** — already resolved: the e2e profile runs `@nether-voicebridge_e2e_bot`. 3. **Leftovers** — checked server-side as the MXID: the two tinier.town DM memberships are **gone** (no `:tinier.town` rooms, no pending invites — nothing to exit politely anymore). What remains is 9 stale memberships from the pre-rename harness era (6 old `nvbtest_*` drill DMs + the 3 Auto Test rooms). A batch-leave to make the address fully dormant is prepared but awaits an operator go (touches homeserver state). 4. **Detection gap — shipped** on branch `ops/96-dormant-mxid-watch`: nvb-watch section 3a syncs as `@nether-voicebridge_bot` each tick and posts a state-latched 📬 alert for any pending invite (re-invite re-alerts). Offline harness covers alert/latch/re-alert; 27/27 green. Deploy to `/opt/nvb-ops` after merge. Once the branch merges + deploys and the batch-leave runs, this can close.

robocub referenced this issue from a commit

2026-08-20 02:42:46 +00:00

Merge ops/96-dormant-mxid-watch: nvb-watch dormant-MXID invite canary (#96)

robocub commented

2026-08-20 02:43:28 +00:00

Author

Collaborator

nvb-watch canary merged (58df4b7) and deployed to /opt/nvb-ops (backup .bak-96); first tick ran clean and initialized the state file. Remaining before close: the batch-leave making @nether-voicebridge_bot fully dormant (9 stale test-era memberships) — awaiting an operator go.

nvb-watch canary merged (58df4b7) and deployed to /opt/nvb-ops (backup .bak-96); first tick ran clean and initialized the state file. Remaining before close: the batch-leave making @nether-voicebridge_bot fully dormant (9 stale test-era memberships) — awaiting an operator go.

robocub commented

2026-08-20 23:01:14 +00:00

Author

Collaborator

Batch-leave executed with operator go (2026-08-20): all 9 stale test-era memberships left (9× 200), joined_rooms now empty — @nether-voicebridge_bot is fully dormant. Final state of the four items:

Identity convergence: @voicebridge_as stays canonical (docs corrected 07-12; migration not worth it).
Harness masquerade: moved to @nether-voicebridge_e2e_bot long since.
Leftovers: tinier.town DMs were already gone; the 9 harness-era rooms are now left too. The account has zero memberships.
Detection: the nvb-watch dormant-MXID canary is deployed and ticking — any future invite to this address posts a 📬 alert, and with the account fully dormant, ANY activity on it is definitionally a stranded user.

Closing.

Batch-leave executed with operator go (2026-08-20): all 9 stale test-era memberships left (9× 200), `joined_rooms` now **empty** — `@nether-voicebridge_bot` is fully dormant. Final state of the four items: 1. Identity convergence: `@voicebridge_as` stays canonical (docs corrected 07-12; migration not worth it). 2. Harness masquerade: moved to `@nether-voicebridge_e2e_bot` long since. 3. Leftovers: tinier.town DMs were already gone; the 9 harness-era rooms are now left too. The account has zero memberships. 4. Detection: the nvb-watch dormant-MXID canary is deployed and ticking — any future invite to this address posts a 📬 alert, and with the account fully dormant, ANY activity on it is definitionally a stranded user. Closing.

robocub closed this issue

2026-08-20 23:01:14 +00:00

Rows
Columns

identity drift: prod bot MXID (@voicebridge_as) vs docs/test-profile (@nether-voicebridge_bot) — first real beta user stranded #96