mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
a029d69d5e
Each Sessions row is bound to the device identity that registered it. The binding ran in shadow; it now refuses every foreign-identity outcome: register-session answers 403 with session_owner_mismatch before anything is written, agent telemetry 403 in the error envelope (SessionOwnerMismatch), the hosted diagnostics upload URL 403. The error channel stays 200 and only skips its write into the named session. An evaluation defect fails open. The agent already rotates its session id on the 403 at registration; it now does the same for the coded 409 (session id claimed by another tenant) instead of retrying six times and exiting, and fails without retry on any other coded 409 (BackendRefusalException, never an auth failure). A snapshot restored after a rotation adopts the current session id. A guard test pins the four call sites and fails when a site observes the binding without acting on the refusal. Privacy page: session binding under how data is protected. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>