zara-comms: verify observed sends match intended message payload #60

New issue

Closed

opened 2026-09-08 02:02:53 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:02:53 +00:00

Owner

Problem

CommsDomain.send() currently treats a provider accepted: true plus any retrievable message from the same provider as verified for a new send. For replies it only additionally compares conversation/reply IDs. A provider can therefore acknowledge one payload but return evidence for a different account, recipient set, or body and Zara will claim success.

Required behavior

A send may be verified only when the observed provider message matches the intended:

provider
account ID
recipients
body
reply target
conversation ID when the draft pins one

Provider acknowledgement alone is never success. Deterministic regressions must cover mismatched account/recipients/body, and the full registry/install/Nix gate must stay green.

No Zara Core changes.

## Problem `CommsDomain.send()` currently treats a provider `accepted: true` plus any retrievable message from the same provider as verified for a new send. For replies it only additionally compares conversation/reply IDs. A provider can therefore acknowledge one payload but return evidence for a different account, recipient set, or body and Zara will claim success. ## Required behavior A send may be `verified` only when the observed provider message matches the intended: - provider - account ID - recipients - body - reply target - conversation ID when the draft pins one Provider acknowledgement alone is never success. Deterministic regressions must cover mismatched account/recipients/body, and the full registry/install/Nix gate must stay green. No Zara Core changes.

nsaspy closed this issue

2026-09-08 02:02:53 +00:00

nsaspy referenced this issue

2026-09-08 02:20:14 +00:00

Add root-confined structured zara-files service #503