Bifrost

Heimdall

Image store: room directory must share the Persona directory's group; never create the Persona directory

The room directory's gid must equal the Persona directory's, else store-failed (a setgid
directory in the wrong group would still give files the wrong group). A missing Persona
directory is refused rather than created; only the room directory is made. The stat is
injectable so the group case is testable where the sandbox cannot chown.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fd0a43e0e4

2026-11-08 09:29:59 +00:00

Heimdall

Image store: never chmod a room directory; refuse when setgid is not inherited

A chmod by bifrost, which is not in the Persona's group, clears the setgid bit, so files
would take bifrost's group and the Persona's reader could not open them. Directories and
files are now created with exact modes (fixed umask around mkdir and open), the room
directory must have inherited setgid from the installer's Persona directory or the image
is refused (store-failed), and the Persona directory is never chmodded. Adds behavioural
redirect-refused and fetch-timeout tests.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

129b517f46

2026-11-08 09:27:40 +00:00

Heimdall

Test: the streamed cap fails by assertion, not by timeout

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

a85942e858

2026-11-08 09:21:46 +00:00

Heimdall

Test: a failed image write leaves no temp file

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

e23f7da2d5

2026-11-08 09:19:32 +00:00

Heimdall

Matrix mouth: fetch and store chat images (cut A), ChatDelivery v3

m.image events in delivered messages are fetched as the receiving Persona,
classified by magic bytes, bounded by size and header pixel count, and stored
under IMAGE_STORE_ROOT/<persona>/<room hash>/<bytes hash>[.ext] (0640, dirs
2750). The delivery tuple gains index 11, nil or [path, mime, size, sha256];
the pending kind becomes gamecult.persona.chat_pending.v2 with Huginn's v3
golden bytes. Refusals keep the typed text line plus a fixed-word reason.
The mouth test homeserver is answered in-process so the suite runs under a
capped address space.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

02275ee17b

2026-11-08 09:18:55 +00:00

Matrix mouth: fetch and store chat images (cut A), ChatDelivery v3 #12

2026-11-08