Client approval quorum differs from documented consensus model #70
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Info
Severity: LOW
Attack vector: network-only
Impact
Allows a smaller set of online user agents than the documentation implies to approve new SDK clients.
Description
The current approval flow requires unanimous approval from currently connected user agents, not the broader quorum model described in the architecture. In a multi-user-agent deployment where only one agent is online, that single agent can approve a new SDK client.
Example flow
Mitigation
Align the implementation with the documented quorum semantics and define how offline user agents affect approval decisions.
The finding is valid but requires a product decision before it can be fixed. The current implementation collects approvals only from currently connected operators — it has no awareness of how many operators are registered in the database. This means a single connected operator can approve a new SDK client even if four others are registered but offline.
The fix itself is straightforward (query operator_client for total registered count, then enforce a threshold before spawning ClientApprovalController), but the threshold policy needs to be decided first: all registered must be online, a simple majority, or a configurable minimum. Each option has different availability trade-offs.