Skip to content

feat: detect and repair lagging recovery escrows - #11200

Open
huggingbot wants to merge 5 commits into
feat/mfa-recovery-locksfrom
feat/mfa-recovery-reconciliation
Open

huggingbot wants to merge 5 commits into
feat/mfa-recovery-locksfrom
feat/mfa-recovery-reconciliation

Conversation

@huggingbot

@huggingbot huggingbot commented Oct 29, 2026 •

Copy link
Copy Markdown
Member

Explanation

  • Before a mutation, read every escrow's version with an AAL1 approval. Differing versions fail with replica_lagging.
  • Add repairReplicas(identifier). It copies the highest record to escrows one version behind, as a mutation addressed only to them (register, updateIdentifiers or updateRecoverySecret).
  • Clear a pending mutation when every remaining escrow rejects it, even if others have receipts: the mutation is obsolete or was already repaired.
  • Allow abort while writing once the approval has expired, there are no receipts, and every target escrow is still at expectedVersion.
  • Compare only the secret on reads; a repaired replica holds the same secret under a different mutation ID.

References

Co-authored-by: Cursor <cursoragent@cursor.com>
@huggingbot
huggingbot requested review from a team as code owners October 29, 2026 12:58
Co-authored-by: Cursor <cursoragent@cursor.com>
huggingbot and others added 3 commits November 2, 2026 19:55
Fold repairReplicas into resume(identifier): with no pending mutation, it copies the highest escrow record to escrows one version behind. Drop abort while writing: local approval expiry does not prove a delayed write cannot land, since the device clock may run ahead of the escrow's.

Co-authored-by: Cursor <cursoragent@cursor.com>
- Require every escrow and one version for getIdentifiers (replica_lagging)
- Probe escrows moved off expectedVersion without identifier proofs, even
  with receipts, so resumed writes never fork and clear without the
  original identifier or SIWE wallet
- Clear with mutation_superseded, unsent, when a renewed approval no
  longer covers the payload and every remaining escrow moved
- Reject updates whose identifier is not enrolled on every escrow
  (identifier_not_enrolled)
- Let resume(identifier) authorize a pending update with another
  enrolled identifier
- Reuse the pre-write escrow reads to find new SIWE identifiers

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant