Assert the live Matrix tests run as a testing identity #13

2026-09-07T20:16:18Z

dev-agent commented

2026-09-07 20:16:18 +00:00

You asked me to make sure testing runs as nisse-dev-testing rather than nisse-dev. It already does — audit below — so this PR makes that enforced rather than a fact I checked once.

Audit result (all already correct):

	Identity	Notes
Matrix	`@nisse-dev-testing:dongar.net`	`@nisse-dev` does not exist yet (404)
LiteLLM	key alias `nisse-dev-unittests`	scoped to llama3.2 + claude-haiku-4-5, $1 cap
Gitea	none yet	`tea` uses `dev-agent`, which is my PR workflow, not the agent

I also owe a correction: I previously told you we had put the production Matrix token into CI secrets. That was wrong — it was the testing account's token all along.

What this adds, checked at the start of the live Matrix test:

NISSE_MATRIX_USER_ID must equal the token's actual owner. This matters more than it appears: MatrixTransport filters its own messages by comparing sender to that value, so a mismatch would make the bot treat its own posts as operator input — a feedback loop, and a self-approval path if the allowlist were ever loosened. (Your allowlist is @dongar alone, so that second risk is closed today.)
The account must be a testing identity, so a misconfigured live run cannot act as the production agent once nisse-dev exists.

Unrelated heads-up: the LiteLLM test key is at $0.41 of its $1.00 cap. When it runs out, the live tests will start failing with 400s rather than skipping.

🤖 Generated with Claude Code

You asked me to make sure testing runs as `nisse-dev-testing` rather than `nisse-dev`. It already does — audit below — so this PR makes that enforced rather than a fact I checked once. **Audit result (all already correct):** | | Identity | Notes | |---|---|---| | Matrix | `@nisse-dev-testing:dongar.net` | `@nisse-dev` does not exist yet (404) | | LiteLLM | key alias `nisse-dev-unittests` | scoped to llama3.2 + claude-haiku-4-5, $1 cap | | Gitea | none yet | `tea` uses `dev-agent`, which is my PR workflow, not the agent | I also owe a correction: I previously told you we had put the *production* Matrix token into CI secrets. That was wrong — it was the testing account's token all along. **What this adds**, checked at the start of the live Matrix test: 1. `NISSE_MATRIX_USER_ID` must equal the token's actual owner. This matters more than it appears: `MatrixTransport` filters its own messages by comparing sender to that value, so a mismatch would make the bot treat its own posts as operator input — a feedback loop, and a self-approval path if the allowlist were ever loosened. (Your allowlist is `@dongar` alone, so that second risk is closed today.) 2. The account must be a testing identity, so a misconfigured live run cannot act as the production agent once `nisse-dev` exists. **Unrelated heads-up:** the LiteLLM test key is at **$0.41 of its $1.00 cap**. When it runs out, the live tests will start failing with 400s rather than skipping. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dev-agent added 1 commit 2026-09-07 20:16:19 +00:00

Assert the live Matrix tests run as a testing identity

CI / checks (push) Successful in 14s

Details

CI / checks (pull_request) Successful in 12s

Details

e04d786840

Two invariants only a live homeserver can check, now enforced rather
than verified by hand:

- The configured NISSE_MATRIX_USER_ID must be the token's real owner.
  MatrixTransport filters its own messages by comparing sender to that
  value, so a mismatch would make the bot read its own posts as
  operator input.
- The account must be a testing identity, so a stray live run can
  never act as the production agent.

Both hold today; this keeps them holding when the production
nisse-dev account is created.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dongar approved these changes

2026-09-07 20:33:35 +00:00

dev-agent merged commit ad45e33517 into main

2026-09-07 20:35:10 +00:00

dev-agent deleted branch matrix-identity-guard

2026-09-07 20:35:10 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dev/nisse#13