Reserve/namespace bot names vs player signatures #49

New issue

Closed

opened 2026-06-11 14:06:28 +00:00 by sickday · 0 comments

sickday commented

2026-06-11 14:06:28 +00:00

Owner

Problem

signature = Protocol.Name.to_long(downcase(name)) is the world-wide identity for both bots and players. A human registering a name matching a bot shares a signature. DB rows do not collide (bots → bot_profiles by name; players → profiles/skills by signature), but the new SessionGuard treats them as one identity — a human cannot log in while a same-named bot is online (and vice-versa). Availability quirk, not corruption, but worth closing.

Fix options

Reserve a bot-name namespace/prefix, a registered-bot-names denylist at player registration, or a dedicated identity space for bots.

Acceptance

A player and a bot can never resolve to the same signature.

Part of the Security & Data-Integrity Hardening epic.

## Problem `signature = Protocol.Name.to_long(downcase(name))` is the world-wide identity for both bots and players. A human registering a name matching a bot shares a signature. DB rows do not collide (bots → `bot_profiles` by name; players → `profiles`/`skills` by signature), but the new `SessionGuard` treats them as one identity — a human cannot log in while a same-named bot is online (and vice-versa). Availability quirk, not corruption, but worth closing. ## Fix options - Reserve a bot-name namespace/prefix, a registered-bot-names denylist at player registration, or a dedicated identity space for bots. ## Acceptance - A player and a bot can never resolve to the same signature. Part of the Security & Data-Integrity Hardening epic.

sickday referenced this issue

2026-06-11 14:06:43 +00:00

Epic: Security & Data-Integrity Hardening #50

sickday added the

epic:security-hardening

optimization

priority:low

server

labels

2026-06-11 14:07:42 +00:00

sickday added this to the v1 milestone

2026-06-11 14:11:16 +00:00