diff --git a/.story_kit/work/1_upcoming/256_story_bot_must_verify_other_users_cross_signing_identity_before_checking_device_verification.md b/.story_kit/work/1_upcoming/256_story_bot_must_verify_other_users_cross_signing_identity_before_checking_device_verification.md new file mode 100644 index 0000000..abf00bb --- /dev/null +++ b/.story_kit/work/1_upcoming/256_story_bot_must_verify_other_users_cross_signing_identity_before_checking_device_verification.md @@ -0,0 +1,20 @@ +--- +name: "Bot must verify other users' cross-signing identity before checking device verification" +--- + +# Story 256: Bot must verify other users' cross-signing identity before checking device verification + +## User Story + +As a Matrix user messaging the bot, I want the bot to correctly recognize my cross-signing-verified devices, so that my messages are not rejected when I have a valid verified identity. + +## Acceptance Criteria + +- [ ] The bot's `check_sender_verified` function (or equivalent) verifies the sender's identity trust status, not just individual device verification +- [ ] When @yossarian:crashlabs.io (who has valid cross-signing keys) sends a message in an encrypted room, the bot accepts it instead of rejecting with 'no cross-signing-verified device found' +- [ ] The bot still rejects messages from users who genuinely have no cross-signing setup +- [ ] Existing tests (if any) continue to pass after the change + +## Out of Scope + +- TBD