open/repo-mailbox
1
0
Fork 0
Code Issues Releases 2 Activity

feat(coord-send): reject the retired ktg-plugin-marketplace address

Browse source 
Operator decision 2026-08-15: ktg-plugin-marketplace is a polyrepo
directory, not a git repo, so no session can ever hold that coord
identity naturally. catalog's H4 reply confirmed adoption was declined
and drained the 6 stray messages as a one-time settlement, not an
ongoing subscription. --to now fails loud with a pointer to catalog
instead of silently redirecting mail somewhere the sender doesn't
believe it landed - the same misdelivery defect this closes a second
time (2 messages sat undelivered 2 days on this exact misaddressing).
Only --to is retired; --from is untouched since the defect was mail
arriving there, not mail claiming to originate there.

coord-selftest.sh: 206/206 (+6, section 33).
This commit is contained in:
Kjell Tore Guttormsen 2026-08-15 20:37:11 +02:00
commit bd24b8f0e7
2 changed files with 47 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

31
scripts/coord-selftest.sh
View file

@ -983,6 +983,37 @@ check "origin-age portability: under a GNU-date PATH (shimmed from measured beha
/bin/rm -rf "$PADIR" "$SHIMDIR" 2>/dev/null
# 33. Retired coord address: ktg-plugin-marketplace is a polyrepo DIRECTORY,
# not a git repo (git rev-parse fails there), so no session can ever hold
# that identity naturally - catalog owns migration and adoption instead (H4
# order, catalog reply archived 2026-08-15T16:27:51Z). coord-send REJECTS the
# address rather than silently redirecting it to catalog: a redirect delivers
# post somewhere the sender does not believe it landed, which is the SAME
# defect class as the misdelivery this closes (2 messages sat 2 days
# undelivered on this exact misaddressing before H4 counted them). Rejection
# fails loud at the sender, at the moment the mistake is made.
rto="$("$SEND" --to ktg-plugin-marketplace --from x --subject s --message m </dev/null 2>&1)"; rc=$?
[ "$rc" -eq 2 ]; check "retired: coord-send refuses --to ktg-plugin-marketplace" $?
printf '%s' "$rto" | grep -q "catalog"; check "retired: the refusal points the sender at catalog" $?
[ ! -e "$CLAUDE_COORD_DIR/ktg-plugin-marketplace/inbox" ] || [ -z "$(ls -A "$CLAUDE_COORD_DIR/ktg-plugin-marketplace/inbox" 2>/dev/null)" ]
check "retired: nothing was actually delivered to the retired address" $?
# Scope decision: only --to is retired, not --from. A message SENT under that
# name (--from override, or historical mail already in the mailbox) is not
# the defect this order closes - the defect was mail ARRIVING there, not mail
# claiming to originate there. Pinned so a later session does not "fix" this
# into a from-check by symmetry.
fro="$("$SEND" --to somerepo --from ktg-plugin-marketplace --subject s --message m </dev/null 2>&1)"; rc=$?
[ "$rc" -eq 0 ]; check "retired: --from ktg-plugin-marketplace is NOT blocked (only --to is retired)" $?
# The unified TO resolution means --reply-to inherits the same guard:
# replying to a message that claims to be FROM the retired address would
# resend --to that address, and must fail the same way.
rfn="$(basename "$(ls "$CLAUDE_COORD_DIR"/somerepo/inbox/*-from-ktg-plugin-marketplace.md 2>/dev/null | head -1)")"
rre="$("$SEND" --from somerepo --reply-to "$rfn" --message "reply" 2>&1)"; rc=$?
[ "$rc" -eq 2 ]; check "retired: replying to a message FROM the retired address also refuses" $?
printf '%s' "$rre" | grep -q "catalog"; check "retired: the reply-path refusal also points at catalog" $?
echo "----"
echo "PASS=$PASS FAIL=$FAIL"
[ "$FAIL" -eq 0 ]