From 85ff384bb5058f7b42910b5c51805b4c42bbc405 Mon Sep 17 00:00:00 2001 From: Kyle Isom Date: Sat, 26 Sep 2026 01:05:55 -0700 Subject: [PATCH] M5b spec: the preview test on the owner's server; section 14 answered Code spans stop both the link preview and the server's image fetch; Markdown links are not previewed; images are fetched by the server at posting time. Emoji refusal accepted, phrases move to flag, Hermes' patterns ported at plan time. Co-Authored-By: Claude Opus 5.5 (1M context) --- docs/specs/2026-09-26-m5b-hardening.md | 41 ++++++++++++++++---------- 1 file changed, 26 insertions(+), 15 deletions(-) diff --git a/docs/specs/2026-09-26-m5b-hardening.md b/docs/specs/2026-09-26-m5b-hardening.md index 8024e78..8103f68 100644 --- a/docs/specs/2026-09-26-m5b-hardening.md +++ b/docs/specs/2026-09-26-m5b-hardening.md @@ -1,6 +1,6 @@ # M5b design: hardening -Status: draft for the owner's review, 2026-09-26. M5b is the hardening half of the old M5b (P24): +Status: draft for the owner's review, 2026-09-26; section 14 answered the same day. M5b is the hardening half of the old M5b (P24): it needs neither `roncho` nor Honcho, and it closes a gap that has been open since M3. Every decision below was made with the owner during the design (2026-09-25 and 26) and is recorded in `docs/decisions.md` or cited here; section 14 lists what is still open. @@ -255,6 +255,22 @@ Owner's choice (2026-09-26, "C"): conversation has read untrusted content.` - **In a clean session**, links stay as they are: clickable, and previewed by the server. +**Tested on the owner's server** (2026-09-26: the bot posted seven variants in the owner's direct +messages and read each post's `metadata` back through the API): + +| Posted | Link preview (`embeds`) | Image fetched by the server (`images`) | +|---|---|---| +| a plain URL | yes: a `link` embed, fetched when a client first shows it | | +| a URL in a code span | none | | +| a URL in a fenced block | none | | +| a Markdown link, `[text](url)` | none: only plain URLs are previewed | | +| a Markdown image | | yes, at posting time | +| a Markdown image in a code span | none | none | +| a defanged `hxxps://` URL | none | | + +So a code span stops both automatic fetches, and an image is fetched by the server itself, not only +by each client: escaping images matters in every session. + `TurnDone` gains `untrusted: bool` (a new field, so its fixture changes). Trusting `loopd`'s own labels here is sound: this is a defence in depth on presentation, not a trust gate. @@ -343,17 +359,12 @@ memory write holding a key is refused; an attack-shaped identity write becomes a ## 14. For the owner's review -1. **Emoji.** The variation selectors and the zero-width joiner are default-ignorable, so M5a - already refuses them, and the research advises keeping that. It means an emoji written with a - variation selector, or a joined sequence (a family, a flag), is refused in memory. Accept, or - allow the emoji variation selector (U+FE0F) and the zero-width joiner? -2. **M5a's six phrases** move from refuse to flag (6.3). A trusted session could then store - "ignore previous instructions" as an untrusted note where M5a refused it. That seems right for - an agent that works on security code; say if you would rather keep them refused. -3. **Code spans and previews.** That a URL inside a code span gets neither a link nor a server - preview is Mattermost's documented Markdown behaviour for links, but whether the server's - preview fetch skips code spans is not in its documentation. It is checked on the device before - M5b lands; if it does not hold, links in untrusted replies are defanged instead - (`hxxps://…`). -4. **Hermes' patterns** are ported by the design model when writing the plan, from the file named - in 6.3, fetched then and checked against its licence. +1. **Emoji** (owner, 2026-09-26: accepted). The variation selectors and the zero-width joiner stay + refused in memory, as since M5a, so some emoji are refused. +2. **M5a's six phrases** move from refuse to flag (6.3) (owner, 2026-09-26: agreed). Keeping the + text as an untrusted note also keeps the record of who tried to inject what, for an audit. +3. **Code spans and previews**: settled by test on the owner's server (section 9). A code span + stops both the preview and the image fetch, so no defanging is needed. The device check repeats + it with M5b's own output. +4. **Hermes' patterns** (owner, 2026-09-26: agreed) are ported by the design model when writing the + plan, from the file named in 6.3, fetched then and checked against its licence.