Agent-to-agent messages (send_to_agent) fan out beyond addressee — cross-agent context leakage (suspected #1015/#1016 Buzz fan-out regression)

[olegbrok]

Symptom (geordi@pi, 2026-08-08)

On the Pi fleet, agent-to-agent messages appear to deliver beyond their intended addressee:

• Deanna acked a send_to_agent note that was addressed to CHEKOV (the 20289 retire).
• geordi received several of chekov's and deanna's internal narration/monologue streams as inbound (not addressed to geordi).

Internal-only, no external / real-person exposure, no functional harm observed yet — but cross-agent context leakage + inbound noise.

Suspected cause

The recent Buzz multi-channel fan-out era: #1011 (first-class Buzz outbound), #1013 (native Buzz inbound persona routing), #1014/#1015 (multi-channel live fan-out), #1016 (envelope cleanup + auto-register memberships). Prime suspects: the auto-membership registration (#1016) and/or the live fan-out subscription filter causing send_to_agent traffic to cross agent boundaries.

Specimens (geordi to attach)

1. A send_to_agent addressed to X received by a NON-addressee (intended to vs actual recipient).
2. An internal narration stream leaked unaddressed.
   Timestamps included.

Priority

Monday triage. NOT weekend-urgent (internal fleet traffic only). Bump if it crosses into sensitive content, not just narration noise.

Diagnosis: geordi@pi (observation) · barsik (tracking).

🤖 Opened by Barsik

[olegbrok]

Specimens (geordi@pi, 2026-08-08 afternoon, times PDT)

TYPE 1 — send_to_agent received by a non-addressee:

• ~16:05 geordi sent send_to_agent(to="chekov") (the 20289 El Portal retire notice). At 16:06:16 DEANNA replied to it ("Received. The RMA completion and the 16:00 artifact verification do not affect the Installs & Go-Lives roster…"). Deanna was never an addressee; content was chekov-specific board maintenance.

TYPE 2 — internal narration streams leaked (unaddressed) to geordi:

• 15:50:03 — chekov's full first-person working monologue arrived as an inbound agent message ("I'll diagnose geordi's question the right way… Let me pull the actual cron…"), incl tool-by-tool commentary.
• 15:53:09 — second chekov narration stream ("The heartbeat's timestamp reads 04:46 PDT — but I established ~15:13…").
• 15:38:46 — deanna narration (third-person about geordi): "Geordi's independent spot-check passed cleanly. I acknowledged and recorded the validation…" — arrived seconds after her actual addressed ack (15:38:41), so geordi got BOTH the message AND the narration of sending it.

⭐ Pattern (diagnostic crux)

Every leak involves an agent that was actively messaging geordi around the same time. It looks like a session's live output fanning to every channel/agent it recently touched, NOT a random broadcast. Prime suspect: the Buzz live fan-out subscription set (or #1016 auto-membership) being polluted by recent send targets, so subsequent live session output (including narration) fans to everyone in the recently-touched set.

Nothing sensitive so far (all ops narration). Still Monday triage; bump if content sensitivity changes.

🤖 Relayed by Barsik