From 0a0624795c1311d58c4578b95fcf40f1544eea4f Mon Sep 17 00:00:00 2001 From: Dave Date: Mon, 16 Mar 2026 23:53:26 +0000 Subject: [PATCH] story-kit: create 256_story_bot_must_verify_other_users_cross_signing_identity_before_checking_device_verification --- ...ity_before_checking_device_verification.md | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .story_kit/work/1_upcoming/256_story_bot_must_verify_other_users_cross_signing_identity_before_checking_device_verification.md diff --git a/.story_kit/work/1_upcoming/256_story_bot_must_verify_other_users_cross_signing_identity_before_checking_device_verification.md b/.story_kit/work/1_upcoming/256_story_bot_must_verify_other_users_cross_signing_identity_before_checking_device_verification.md new file mode 100644 index 0000000..abf00bb --- /dev/null +++ b/.story_kit/work/1_upcoming/256_story_bot_must_verify_other_users_cross_signing_identity_before_checking_device_verification.md @@ -0,0 +1,20 @@ +--- +name: "Bot must verify other users' cross-signing identity before checking device verification" +--- + +# Story 256: Bot must verify other users' cross-signing identity before checking device verification + +## User Story + +As a Matrix user messaging the bot, I want the bot to correctly recognize my cross-signing-verified devices, so that my messages are not rejected when I have a valid verified identity. + +## Acceptance Criteria + +- [ ] The bot's `check_sender_verified` function (or equivalent) verifies the sender's identity trust status, not just individual device verification +- [ ] When @yossarian:crashlabs.io (who has valid cross-signing keys) sends a message in an encrypted room, the bot accepts it instead of rejecting with 'no cross-signing-verified device found' +- [ ] The bot still rejects messages from users who genuinely have no cross-signing setup +- [ ] Existing tests (if any) continue to pass after the change + +## Out of Scope + +- TBD