[Birfy]

set-main checked only body.id, so a signed-in member could take another owner's Main Bot's place: { id: <my Bot>, replace: <their Main Bot> } promoted their own Bot into the deployment-wide state.mainBotIds and demoted the other owner's Main Bot, whose Bot then lost the Main-only tools. This is option 1 of #613: owner-scoped replace, the smallest change that closes the demote path exactly.

What changed

• core/src/host/authz.js — set-main keeps the body.id check and now also requires the actor to own body.replace when it names a different Bot. Taking another owner's Main Bot's place is bot/forbidden before the roster runs.
• core/src/host/roster.js — setMain refuses a replace whose Bot has a different ownerId and leaves state.mainBotIds unchanged, so the invariant holds for every caller of the roster, not only the HTTP endpoint.
• core/test/authz.test.js, core/test/roster.test.js — one test per half.
• docs/subsystems/core-host.md (the core/src/host/ owner), changelog.d/613-main-bot-owner.security.md, and the regenerated patches/ds-bot/ (node scripts/ds-bot-patches.mjs generate + check).

Deliberately not in this PR: a per-owner state.mainBotIds (option 2) and blocked-shared for set-main with more than one member (option 3). Both are the team-mode decision #613 leaves open; today's shape — one deployment-wide list, where a member may still promote a Bot they own — is unchanged.

撤掉修复后变红

Reverted the two source hunks only (tests kept, authz.js back to if (ep === 'set-main') return requireBot(body?.id) and setMain back to its old replace branch):

cd core && DSH_HARNESS=<dsh checkout> node --import ./test/harness-resolve.mjs --test test/authz.test.js test/roster.test.js
# tests 48 / pass 46 / fail 2
not ok - #613: a member cannot take another owner’s Main Bot’s place
not ok - #613: a Main Bot’s place is only taken by a Bot of the same owner

Exactly the two new tests fail; the other 46 in those files pass.

修复后变绿

Same command with the fix in place:

cd core && DSH_HARNESS=<dsh checkout> node --import ./test/harness-resolve.mjs --test test/authz.test.js test/roster.test.js
# tests 48 / pass 48 / fail 0

The authz test covers: a member's swap of another owner's Main Bot is bot/forbidden; demoting that Main Bot by naming it as the target is refused; a swap inside one owner's team is allowed; the caller's own Bot may still be promoted plainly. The roster test covers the cross-owner replace being refused with state.mainBotIds unchanged on disk, and a same-owner swap still working.

跑了什么

• node .github/scripts/changelog.mjs check → 23 fragments well formed.
• node core/scripts/check-arch-docs.mjs → OK (6 changed file(s)) against a local origin/main at 81c708d.
• node scripts/ds-bot-patches.mjs generate then check → core/ equals ds-bot/ + patches/ds-bot/.
• The targeted suites above, red then green.

没跑什么

• The full npm run verify: this box has no npm ci/npm run harness install for core/ (oxlint comes with it), so lint and the whole core suite run on CI here. CI's tests-ok covers lint, arch-docs, the client check, the patch check and the full core + plugin suites.
• The plugin suites, the smoke test and the pack/typecheck of the package job: not run locally; unchanged code paths, and CI runs them.
• No manual call to set-main in a live deployment; the two-owner behaviour is asserted at the authz and roster layers.

风险

Permissions surface. The change only narrows: it adds an owner check on replace and an owner invariant in setMain. No new configuration, no secret path, no change to rt.isMain or to the tool gates it drives. risk:T* is set by the controller.

Fixes #613

[Birfy]

Verdict: PASS at d974ee6

Tip SHA: d974ee63af7c6805789b464fd9d37e91d1f464f7
CI at tip: 8/8 success (tests-ok, package, plugins social/tree/timeline, ubuntu-latest Node 24,
           reviewed tip, risk tier)
Tier (from the diff): T3 — core/src/host/authz.js is a T3 path in .github/agent/risk-rules.json

Ran at this tip, not inferred from CI:

$ cd core && TZ=UTC DSH_HARNESS=… node --import ./test/harness-resolve.mjs --test test/authz.test.js test/roster.test.js
# tests 48 / pass 48 / fail 0

Gate ③, both directions — authz.js and roster.js restored to the base commit 81c708d0, tests kept:

not ok 20 - #613: a member cannot take another owner's Main Bot's place
not ok 48 - #613: a Main Bot's place is only taken by a Bot of the same owner
# tests 48 / pass 46 / fail 2

Exactly the two new tests go red, and only they.

What I checked beyond the tests:

• set-main now runs requireBot(body.replace) when replace names a different Bot, so a member can no longer promote their own Bot into the deployment-wide Main list on the strength of owning body.id alone. The body.id check stays, so the endpoint still needs the caller to own the target.
• roster.js throws unless replace and id share an ownerId, which keeps the invariant for any caller that bypasses the endpoint — the state layer refuses even if authz is ever refactored away.
• A replace that is not a string, or names a Bot that does not exist, does not reach the swap: the first is skipped by the typeof guard and then handled (and refused) by roster.js, the second fails requireBot. Both fail closed; neither grants.

One note, not a blocker: the branch is based on 81c708d0, two merges behind main (3995d9b9). mergeable_state is clean and the queue rebuilds the tip, so this is informational.

Entering the merge queue now.

[Birfy]

Post-merge record: 3b2ab414 (squash, via the merge queue). Reviewed tip d974ee63 was unchanged between the verdict and the queue. #613 is closed by this merge.