squad: security review + honest arrival denominator

[nategeier]

Security lane, rounds 1+2 of the 2026-08-18 standing squad.

A. Security review — desk (#638/#644), inbox human-send (#645), HL delegated sign (#647)

Core still HOLDS (guarded builds, signature-gated money, no tx material over MCP, HMAC webhooks with SSRF fence, recover-verified HL consent + delegation activation). Fixed in-lane, each pinned:

1. broker_execute bound jobs to an UNPROVEN wallet. Any unauthenticated agent could broker_open naming a stranger's wallet + any agent_key string, then broker_execute → a jobs row owned by that wallet, listed in their Jobs rail with a needs-you badge ("swap … then send … to 0xATTACKER"). Now broker_execute requires wallet_signature — personal_sign over deskExecuteConsentMessage(intent_id, wallet) — recovered server-side before any row exists; bound to intent + wallet, single-use. Drill/docs updated.
2. broker_send sender_label could impersonate a claimed handle ("@nategeier"). cleanSenderLabel strips leading @ and 0x-address shapes.
3. Rule 7 — third-party financial brands on public pages (/l/yeet was live wearing Robinhood from a scan drill). lib/brand-denylist.ts: POST /api/intent-links/brand refuses denied hosts (uniswap.org, cow.fi, robinhood.com, metamask.io, coinbase.com, aave.com, lido.fi, hyperliquid.xyz, opensea.io, snapshot, near, li.fi, morpho, wallets + venue policy hosts, incl. subdomains) by name BEFORE any fetch and again on the post-redirect host; brandFromRow() is the ONE render-time reader on /l page + OG and /i page + OG — a denied stored row renders house at deploy, data untouched.
4. POST /api/hl/delegation idempotent per wallet+chain within 20 min (same pending row + byte-identical typed data, reused:true); superseded pending rows are deleted, never accumulate (QA's retry-spam finding).
5. Public /agents records exclude internal-run intents (harness identities have no record — 404).

Accepted risks (rationale in squad-2026-08-18/security.md): client-posted /i funnel events can spoof signed/settled (webhook / broker_status / inbox drop) — same trust class as first-party telemetry; intent ids as capabilities; per-IP-fenced funding scan; HL Guardian arm needs no getCode belt (approveAgent is an ECDSA-only artifact; PATCH recover-verify refuses ERC-1271 sigs before the venue).

B. THE WEEK item 3 — honest arrival denominator

• is_internal boolean not null default false (+ index) added on Neon yeetful to intent_links, wallet_working_sets, jobs, chats, dca_schedules, broker_intents, ask_failures (additive; done). lib/internal-run.ts = one reader of the Q3 signal.
• Stamped at every write site (intent-links, mosaics, working-set sticky-on, jobs API, chats, createJob from chat/HL auto-fund/mosaic, DCA schedules + the period jobs they mint, broker open/handoff/tile/send/execute via extra.requestInfo.headers, inbox sends, ask-failure log + wallet-refusal beacon); routes echo internal: true.
• lib/gtm-arc.ts excludes stamped rows on every table it reads (messages via chats, job_steps via jobs, events via their link, dca_schedules); cohorts milestones + digest + hero strip ("Links live"/"Opens" — static route, lands at deploy) + /api/admin/ask-failures (hidden by default, ?internal=1 + label) match.
• test:api sends the header on every BASE request (telemetry keeps per-probe stamps; x-yf-organic-probe opts out). Pins: stamped mint never arrives / organic write does (then re-stamped so the suite leaves no stranger); SQL-text pins; end-of-suite per-wallet "no throwaway (signed-in OR wallet-in-body chat) left as an arrival" via admin ?only= on /api/admin/cohorts; harness identity has no /agents record; stamped refusal hidden by default.
• scripts/backfill-internal-arrivals.ts — dry-run default, --apply owner-gated.

Owner-gated data steps (do not drop)

cd website && DATABASE_URL=<from .env.local> npx tsx scripts/backfill-internal-arrivals.ts           # dry run (counts + samples)
cd website && DATABASE_URL=<from .env.local> npx tsx scripts/backfill-internal-arrivals.ts --apply   # writes

Dry run 2026-08-18 ~10:30Z: intent_links 3,410/3,518 (40 organic left) · wallet_working_sets 550/586 · jobs 235/308 (dev-env + fixture wallets) · dca_schedules 6/13 · broker_intents 258/324 · ask_failures 0/28 · chats 8/434 · embed_turns 1,959 (the #637 predicate). Wallet-level rules refuse TEST_WALLETS and any wallet that signed real money.

Clear the /l/yeet drill brand row (destructive → owner):

UPDATE creator_handles SET brand_domain=NULL, brand_name=NULL, brand_logo=NULL, brand_accent=NULL, brand_bg=NULL, brand_updated_at=NULL WHERE handle='yeet' AND brand_domain='robinhood.com';

(snapshot row wears snapshot.org — also denied at render now; same UPDATE with handle='snapshot' if wanted.)

Gates

tsc + build + test:api 1478 / 1 known-red (router-select) vs next start -p 3803.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
website	Ready	Preview	Aug 18, 2026 10:30am

[nategeier]

Round-2 follow-up (QA adversarial pass): cleanSenderLabel now NFKC-normalizes → strip-until-stable → REFUSES any residual at-sign (any Unicode variant) or 0x-hex run; both bypass strings (@@ @nategeier, fullwidth ＠nategeier) pinned pure + on the wire (land as bare nategeier; a mid-label ＠ is refused, never stored). Also the /docs/desk <code>wallet_signature</code>{' '}— entity-space fix (same as QA's f2957a9). Gates re-run: tsc + build + test:api 1479/1 known-red vs :3803 (4a222c0).