feat(mcp): one-time recovery key on init + the leak test the audit demanded - #58
Merged
Merged
Conversation
…dit demanded
AIFINP-220 §3 sets the rule — the private key must never reach chat or logs —
and asks for an automated test that proves it. This adds both the missing
recovery prompt and that test, and they are not in tension once the CHANNEL is
the thing you look at.
The recovery print is on the TERMINAL, on a fresh plaintext init, once. That is
the one-time backup every wallet CLI shows, on a channel the human running init
controls. It is the opposite of the leak the audit forbids, which is a secret
written into a CHAT transcript an LLM provider retains or a log a shipper keeps.
Same string, opposite exposure — so the distinction the tests enforce is where
it appears, not whether.
- fresh plaintext init prints RECOVERY KEY once, with the secret and a
"do not paste into chat" warning
- a second init does NOT reprint it — shown once means once
- an ENCRYPTED init prints no recovery line at all: recovery there is the
keystore plus the passphrase, and reprinting the plaintext secret would undo
the encryption the user just chose
- the ephemeral / no-init start (the autonomous path — an agent launched with
no wallet) never prints a secret, only addresses. The agent can announce its
addresses without the key ever reaching the transcript.
The autonomous requirement — the agent gets its instructions itself and does not
overpay — is already met elsewhere and unchanged here: the MCP tools are
self-documenting (payable_fetch tells the agent to use it and not WebFetch), the
402 carries how_to_pay, describeQuote states what a payment buys, and
orderIdHash/nonce stop a double-pay. This commit closes the one gap those left:
a human-run init had no off-machine backup line, and nothing tested that the
secret stays off chat.
mcp suite: 82 passing. Version rc.4 -> rc.5.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AIFINP-220 §3: the private key must never reach chat or logs, and there should be an automated test proving it. This adds the missing recovery prompt and that test — and they only look contradictory until you look at the channel.
The recovery print is on the terminal, not in chat
Fresh plaintext init prints
RECOVERY KEYonce, with a "do not paste into chat" warning. That is the one-time backup every wallet CLI shows, on a channel the human runninginitcontrols. The leak the audit forbids is the same string in a chat transcript an LLM provider retains. Same secret, opposite exposure — so the tests enforce where it appears, not whether.The autonomous requirement was already met
The agent getting its own instructions and not overpaying is unchanged and covered: MCP tools are self-documenting (
payable_fetchtells the agent to use it, not WebFetch), the 402 carrieshow_to_pay,describeQuotestates what a payment buys, and orderIdHash/nonce stop a double-pay. This closes the one gap left: a human-runinithad no off-machine backup line, and nothing tested that the secret stays off chat.mcp suite 82 passing. Version rc.4 → rc.5.