open/repo-mailbox
1
0
Fork 0
Code Issues Releases 5 Activity

fix(dispatch): background report signs with --from; coord-send refuses a worktree-derived sender

Browse source 
In a linked worktree basename(git toplevel) is the worktree's name, so the
background child's report was signed `from: dispatch-bg-form` (measured by
the PM on 741ada8) - a mailbox no session holds.

- skills/dispatch: the starter reports by full path with
  `coord-send.sh --from <repo> --to <sender>`; board-selftest §19b gains the
  check (red on 741ada8) plus a known-negative control that runs the same
  predicate against the old "via coord-send" wording.
- coord-send.sh: a DERIVED sender inside a linked worktree exits 2, naming
  --from and the repo the worktree belongs to. Chose refusal over a warning
  because stderr is where a session least looks and the mail would already be
  delivered, and over a silent redirect for the reason the retired
  ktg-plugin-marketplace address is rejected rather than redirected.
  Linked-ness is git's own test (git-dir != git-common-dir), not ".git is a
  file", because a submodule has that too. coord-selftest section 39: 9
  checks, 3 red before the fix; controls for submodule, main checkout,
  explicit --from and a worktree named like its repo.
- Six other scripts derive identity the same way; named as a bounded gap in
  CLAUDE.md, not changed (not ordered).

Suites under /bin/bash 3.2: coord 266, board 497, route 73, orders 116,
guard 54 = 1006 (was 995). npm test 12/12.

Order 20260923T082933Z-466405184-from-.claude.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-23 11:20:39 +02:00
commit 7b09114cd6
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
7 changed files with 136 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
scripts/board-selftest.sh
View file

@ -1966,6 +1966,22 @@ printf '%s\n' "$dsk_bg" | grep -q 'coord-order-done\.sh --repo [^ ]* '
check "background starter closes with --repo (a worktree's name is not the repo's)" $?
if printf '%s\n' "$dsk_bg" | grep -qE '^[[:space:]]*coord-order-(claim|done) '; then rc=1; else rc=0; fi
check "background section has no bare coord-order-claim/-done command line" "$rc"
# ...and the REPORT is signed with --from, by full path. coord-send derives its
# sender from the same toplevel basename, so in the worktree the report was
# signed `from: dispatch-bg-form` (measured by the PM on 741ada8, order
# 20260923T082933Z-466405184). The predicate reads the starter BLOCK only and
# is a function, so the known-negative control runs the same code: every
# mention of coord-send in the starter must be the full-path call with --from.
dsk_starter="$(printf '%s\n' "$dsk_bg" | awk '/^```text/{f=1; next} f && /^```/{exit} f')"
dsk_unsigned_report() {
n_all="$(printf '%s\n' "$1" | grep -o 'coord-send' | wc -l | tr -d ' ')"
n_ok="$(printf '%s\n' "$1" | grep -oE 'bash [^ ]*/scripts/coord-send\.sh --from [^ ]+ ' | wc -l | tr -d ' ')"
[ "$n_all" -eq 0 ] || [ "$n_ok" -ne "$n_all" ]
}
[ -n "$dsk_starter" ] && ! dsk_unsigned_report "$dsk_starter"
check "background starter reports by FULL path to coord-send.sh with --from (a worktree's name is not the repo's)" $?
dsk_unsigned_report 'ORDRE x ... (4) Lukk ... Rapport som coord til .claude via coord-send.'
check "control: the report predicate catches a starter that says 'via coord-send' without --from" $?
# The description is what makes a skill trigger; a form it does not mention is
# a form nobody reaches through the front door.
dsk_fm="$(awk 'NR==1 && /^---$/{f=1; next} f && /^---$/{exit} f' "$DSKILL")"