kyle/boxmaker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

M5b spec: the preview test on the owner's server; section 14 answered

Browse Source 
Code spans stop both the link preview and the server's image fetch;
Markdown links are not previewed; images are fetched by the server at
posting time. Emoji refusal accepted, phrases move to flag, Hermes'
patterns ported at plan time.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kyle
2026-09-26 01:05:55 -07:00
co-authored by Claude Opus 5.5
parent aea594a1ad
commit 85ff384bb5
1 changed files with 26 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/specs/2026-09-26-m5b-hardening.md
+26 -15
View File
@@ -1,6 +1,6 @@
# M5b design: hardening
Status: draft for the owner's review, 2026-09-26. M5b is the hardening half of the old M5b (P24):
Status: draft for the owner's review, 2026-09-26; section 14 answered the same day. M5b is the hardening half of the old M5b (P24):
it needs neither `roncho` nor Honcho, and it closes a gap that has been open since M3. Every
decision below was made with the owner during the design (2026-09-25 and 26) and is recorded in
`docs/decisions.md` or cited here; section 14 lists what is still open.
@@ -255,6 +255,22 @@ Owner's choice (2026-09-26, "C"):
conversation has read untrusted content.`
- **In a clean session**, links stay as they are: clickable, and previewed by the server.
**Tested on the owner's server** (2026-09-26: the bot posted seven variants in the owner's direct
messages and read each post's `metadata` back through the API):
| Posted | Link preview (`embeds`) | Image fetched by the server (`images`) |
|---|---|---|
| a plain URL | yes: a `link` embed, fetched when a client first shows it | |
| a URL in a code span | none | |
| a URL in a fenced block | none | |
| a Markdown link, `[text](url)` | none: only plain URLs are previewed | |
| a Markdown image | | yes, at posting time |
| a Markdown image in a code span | none | none |
| a defanged `hxxps://` URL | none | |
So a code span stops both automatic fetches, and an image is fetched by the server itself, not only
by each client: escaping images matters in every session.
`TurnDone` gains `untrusted: bool` (a new field, so its fixture changes). Trusting `loopd`'s own
labels here is sound: this is a defence in depth on presentation, not a trust gate.
@@ -343,17 +359,12 @@ memory write holding a key is refused; an attack-shaped identity write becomes a
## 14. For the owner's review
1. **Emoji.** The variation selectors and the zero-width joiner are default-ignorable, so M5a
already refuses them, and the research advises keeping that. It means an emoji written with a
variation selector, or a joined sequence (a family, a flag), is refused in memory. Accept, or
allow the emoji variation selector (U+FE0F) and the zero-width joiner?
2. **M5a's six phrases** move from refuse to flag (6.3). A trusted session could then store
"ignore previous instructions" as an untrusted note where M5a refused it. That seems right for
an agent that works on security code; say if you would rather keep them refused.
3. **Code spans and previews.** That a URL inside a code span gets neither a link nor a server
preview is Mattermost's documented Markdown behaviour for links, but whether the server's
preview fetch skips code spans is not in its documentation. It is checked on the device before
M5b lands; if it does not hold, links in untrusted replies are defanged instead
(`hxxps://…`).
4. **Hermes' patterns** are ported by the design model when writing the plan, from the file named
in 6.3, fetched then and checked against its licence.
1. **Emoji** (owner, 2026-09-26: accepted). The variation selectors and the zero-width joiner stay
refused in memory, as since M5a, so some emoji are refused.
2. **M5a's six phrases** move from refuse to flag (6.3) (owner, 2026-09-26: agreed). Keeping the
text as an untrusted note also keeps the record of who tried to inject what, for an audit.
3. **Code spans and previews**: settled by test on the owner's server (section 9). A code span
stops both the preview and the image fetch, so no defanging is needed. The device check repeats
it with M5b's own output.
4. **Hermes' patterns** (owner, 2026-09-26: agreed) are ported by the design model when writing the
plan, from the file named in 6.3, fetched then and checked against its licence.