Evidence record / eve
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the signals and issues that cite it, below.
2026-09-21-eve-cross-principal-authority-queued-messages-from-different-users-ran-under-the-last-sender
Cross-principal authority: queued messages from different users ran under the last sender’s auth. In a shared channel (Slack thread, group chat), queued input from several people was coalesced into one turn and executed with the last sender’s user-scoped connections. That is a privilege-mixing bug, and it sits exactly on the queue path the parent told operators to enable.
Channel: tagged-release. Half: defect. Date: 2026-08-21 to 2026-09-15.
Operator consequence: Anyone who set turnPolicy: "queue" on a
multi-user channel after the parent’s 0.39.3 advice was exposed until 0.52.5.
Upgrade to >= 0.56.0 for all three fixes. Re-audit user-scoped connection
actions taken from shared threads between 0.39.3 and 0.52.5.
Receipt
Finding metadata
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
Finding ID: 2026-09-21-eve-cross-principal-authority-queued-messages-from-different-users-ran-under-the-last-sender
Accepted signals
Profile citations
- Eve / claim / queue-auth
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact