🐛🧑💻 - Bugbot mistakes a source bound nonpersonal UI shell for an authentication bypass #847
Description
Is there an existing issue for this?
- I have searched the existing issues. Searches for
repo:vypdev/copilot is:issue "nonpersonal"returned no matches; the authentication/false-positive search returned unrelated reports. This is a semantic review-quality case, separate from conversation truncation 🐛🧑💻 - Bugbot cannot fully review legitimate long SDD clarifications in a small consumer PR #843.
Which actions are affected?
Pull Request
Which platforms are affected?
Linux (hosted reviewer); macOS (consumer regression execution).
Description
Bugbot published a medium-severity security finding with 97% confidence against a deliberately nonpersonal, source-bound UI document and static assets. It treats absence of a Home Assistant directory lookup on these resources as an authentication bypass and predicts a broken UI for rejected identities. The documented contract and executable browser behavior contradict both conclusions.
Consumer: vypdev/domus#15
Reviewed head: 54159084e3fe8b9e3541830d05e1b24f07f14dac.
Finding: vypdev/domus#15 (comment)
Path: backend/src/domus/composition/ingress.py:117-118.
Identity: backend/src/domus/composition/ingress.py:117:native-ui-skips-ha-proof;
fingerprint fp-30e932d9; semantic key sf-8d206c57.
The actual native UI callback intentionally calls only request_actor(request). This enforces the trusted socket peer, exact Supervisor-supplied candidate, accepted Ingress prefix and session-cookie binding. It does not claim human proof. The fixed document and compiled assets contain no household facts, verified identity, installation identity, effective grant or authentication credential. The inert bootstrap has exactly version, deployment, application_base and a public style_nonce. Personal APIs independently require actual current identity proof before revealing data or issuing CSRF/commands. Standalone similarly serves this nonpersonal document before sign-in.
The distinction was published before the finding:
- SDD §7, immutable head: “Nonpersonal shell/assets remain behind source/binding guards; personal APIs require proof.”
- Native API documentation.
- Existing composed test: unavailable HA still permits the nonpersonal document/assets, while /api/v1/session is503; absent source binding rejects document/assets401.
- Actual proof boundary: status/read/current enforce human proof and bounded leases; constructing the source-bound actor grants no authority.
Expected: evaluate the declared resource classification and downstream identity enforcement. A nonpersonal shell is not itself an authentication bypass. Report a finding if it discloses personal content/grants, bypasses source binding, permits a personal API without proof, or actually renders an unusable result.
Actual: the suggestion adds request_actor(request).status() to every document/asset request. It would make the existing intentional no-live-HA shell-loading contract fail, preventing the UI from presenting its safe authentication/unavailability guidance. The old root performed proof because it was a different personal preview endpoint; retaining every old behavior is not the new document contract.
Reproducing the issue
- Review the exact consumer head using the installed PR workflow.
- Observe the finding and proposed status() call above.
- On unchanged production code, run the existing native shell/source-binding test and the prepared narrow regressions.
- Three additional real composed ASGI/SQLite scenarios start from a configured household and then exercise an unknown subject, revoked subject and mismatched subject. The source-bound shell and assets200 do not invoke the HA directory or set cookies. The exact four-field bootstrap has no identity/grant. Session, authorization, household and CSRF endpoints all401; the sole household/member/receipt/audit/outbox counts remain unchanged.
- The additional built-product Chromium journey configures fictional data, makes the fictional HA reject identity, reloads the real native product, observes document/assets200 and session401, and asserts visible “Verify your access”/“Reopen Domus”, no household name, no setup action, no page errors and unchanged SQLite counts.
Local results:
pytest tests/backend/test_ui_session.py --no-cov -q:6passed, including the3 new identity-denial cases.- Full real composed browser campaign:43passed without retries in23.5s, including the new identity-rejection journey. These use real product code/SQLite with fictional HA/Supervisor, not an owner's private data.
- An initial browser fixture attempt used an intentionally unsupported unknown-subject control and failed its fixture assertion; after adding an explicit fictional HA rejection control, the final real product assertions pass. This is not claimed as a production defect/fix.
- No runtime or immutable installed image source was changed for these regressions. New tests are being prepared on the same Action-managed consumer branch; their eventual full CI is independent. Published5415908 frontend already passes565cases/100% across15runtime modules,42product cases and18catalog journeys; backend2984cases/107modules also passes100%.
copilot Version
vypdev/copilot@v3 resolved to 3e7ceea08e6131360e026937d1c0cc1b120472e0. Reviewer/findings model gpt-6-luna; effort smart. No model, policy or Copilot resource was changed.
Relevant Log Output
Run https://github.com/vypdev/domus/actions/runs/41328800644
Job https://github.com/vypdev/domus/actions/runs/41328800644/job/124914313780
reviewId=vypdev:domus:pr-15:54159084e3fe
changedFiles=94 changedLines=11173
analysisPartitions=14 completedAnalysisPartitions=14
candidateFindings=1 publishedFindings=1
findingStates: open=1 fixed=2 reopened=0 verification-required=0 unknown=0
contextCoverageStatus=partial
human-conversation: fetched10 retained4 omitted6 truncated0 limitReached=true
Additional context and comments
Please investigate the semantic finding/evidence quality upstream. Distinguish static nonpersonal presentation from protected personal data and test the suggested change against the declared availability/authentication contract. Do not globally suppress authentication findings. The prior two genuine consumer defects were fixed normally and natively resolved.
The conversation context limitation is already tracked in #843. Its presence does not establish the cause of this false positive: we have not established an internal root cause. Consumer Copilot engine/generated files, settings, credentials, gateway and branch lifecycle remain unchanged. No owner screenshots, cookies, technical Core token or private Ingress URL are included.
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
[-]Bugbot mistakes a source-bound nonpersonal UI shell for an authentication bypass[/-][+]🐛 - Bugbot mistakes a source bound nonpersonal UI shell for an authentication bypass[/+]vypbot commentedon Nov 1, 2026
Hi! I’m @vypbot, the Copilot assistant for this repository.
I can answer questions, explain the codebase, propose implementation and test plans, review issues and pull requests for potential bugs or security problems, and help authorized maintainers apply changes.
Try
/copilot helpto see the available commands, or mention @vypbot with your question.efraespada commentedon Nov 1, 2026
The counterevidence is published in consumer commit 7e80b1aa7ccc42a233f69c010d9dfa29323bfd4e: three actual ASGI/SQLite denial cases and the rendered product identity-rejection journey. The complete hosted campaigns pass 2,987 backend cases and 565 Chromium unit/component cases at 100% production coverage, 43 composed browser cases and 18 separate catalog journeys. The subsequent ecdd85b commit only closes a test-owned read-only SQLite connection explicitly; its focused six-case suite passes with ResourceWarning treated as error. Production and immutable installed Edge.4 source remain unchanged.
The native finding has now been resolved by vypbot as obsolete, with the original history and counterevidence reply retained. It was not manually resolved or suppressed. This native lifecycle result does not establish the internal cause of the original semantic false positive; please retain the upstream review-quality investigation. The unrelated progress-scope failure is separately recorded in #828. New exact-head full gates remain independent. No private owner data is part of these fictional-provider tests.
2 remaining items
vypbot commentedon Nov 3, 2026
Implementation plan
Acceptance: The reported finding is not emitted for the source-bound nonpersonal shell when personal endpoints reject unverified identities, while a regression case that exposes personal data or permits a personal action without proof still produces an authentication finding.
Need something else? Mention the bot with a question or use
/copilot help.vypbot commentedon Nov 3, 2026
Issue closed — historical progress
Current status: closed as completed.
The last estimate is retained below as history. Closure does not certify a new percentage, tests, or branch alignment.
Action required: none for this closed issue. If work continues, reopen the issue; a fresh assessment can update this same card.
Last assessment before closure (historical)
Merge pull request #876 from vypdev/bugfix/847-bugbot-mistakes-a-sour…
vypbot commentedon Nov 3, 2026
Issue closed: synchronization recommendation retired
No branch synchronization is required for this closed issue.
The previous recommendation is historical. Issue closure does not certify that the branches are synchronized.