Between 2026-10-01 and 2026-10-06 several holes in accounts and the sync door were closed, and the ground was laid for agent accounts (RFC 0021). Each is listed with the landing that closed it. Whether any sync-door hole was ever used is being checked against past pushes in ticket #256.
The sync door
- Write cards before the login card (!783). A fossil login card signs only the bytes after it. The gate credited the whole request to that login, so anyone holding one signed request could put artifacts in front of it and replay it under that account. Write cards before the login are now refused.
- Writes without a push card (!821). Both write gates ran only when a request carried a push card, so a request of pull plus file cards could store artifacts in a repository that requires a credential. Any write card now counts as a push.
Accounts
- Site administrators stop at the repository door (!797). A site admin held every letter on every repository, private ones included. Site admin is now forge-wide administration only; on a repository an admin has the role they were given, and a private repository they were not added to answers 404.
- Admins send reset links and never see or set a password (!815). An admin could set any account's password and sign in as that person.
- Old invite links cannot take over a claimed account (!806). A link's kind was not tied to the account's state, so an invite from before the account was claimed could set a new password for up to a week. An invite now works only on an account with no password, a reset only on one with a password, and every credential check compares in constant time.
- Deleted accounts stay deleted (!816). Deleting an account removed only its grants, so re-inviting the same name inherited its repositories. Deletion now removes everything the name holds and refuses while it still owns repositories.
Tokens, the ground for agents
RFC 0021 (!804) makes an agent its own account, owned by a person and never holding more than they do. Two rungs are built:
- Tokens (!807): named, scoped (sync, api, web), expiring credentials, limited to listed repositories and a ceiling of letters, resolved the same way at every door.
- Run tokens (!809): each CI job gets a token scoped to its run and its declared permissions.
Agent accounts themselves, their pages and the cutover of today's shared agent account are open as ticket #331 through ticket #340.