amadan
multi-account: account manifest is not write-once — a host-role principal can claim a vacant account with no key Idea open
Migrated from github.com/carlosframework/platform issue #313, opened 2026-08-27. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".
Still outstanding: The account manifest is not write-once, so a host-role principal can claim a vacant account.
---
Surfaced by the open-source redaction audit (2026-08-27); the design spec (multi-account-design, §"accepted risks") states it plainly and it is still true on main.
The gap. The account manifest object is an ordinary, overwritable key; the bucket has no Object Lock; the host role holds unconditional \s3:PutObject\ on the deployment bucket. So any process with the host role (every box, and by #232 every exec-backed app on a box) can write a manifest naming itself owner of a vacant account and wait for the next console start or \console member\ call. No signing key is needed.
Fix shape. Any of: conditional PUT (\If-None-Match: *\) on manifest create + refuse overwrite from the host role; sign manifests with the release key and have the console verify before trusting an owner; or move manifest writes behind the console API entirely and drop \PutObject\ on \accounts/*\ from the host policy.
Related: #232 (shared uid widens who holds the host role in practice).