fix: reject mismatched skill_id between payload and bus context (OVOS-INTENT-4 §3.2)

handle_register_template, handle_register_entity, handle_deregister_intent,
handle_deregister_entity and handle_deregister_skill trusted message.data's
skill_id unconditionally, letting any producer claim ownership of another
skill's intents/entities by forging the payload field. message.context is
attached by the bus client itself and cannot be forged by a message
producer, so it is the authoritative attribution per OVOS-INTENT-4 §3.2.

Add module-level _skill_id_from_context(message, handler), mirroring
ovos_adapt/opm.py:73, and use it in all five handlers: when context carries
a skill_id that disagrees with the payload, reject the call (return None,
LOG.warning naming both values and the topic) instead of acting on either
side. When context carries no skill_id (legacy, pre-spec producers),
today's payload-trusting behaviour is unchanged. The legacy
handle_detach_intent, which the bus-client twins from
ovos.intent.deregister while carrying the original context, gets the same
prefix check against its already-namespaced intent_name.

Fail-before: both new regression tests (mismatched register.template
indexing nothing, ovos.skill.deregister with data.skill_id=victim /
context.skill_id=attacker leaving victim's intents matchable) failed
against the unfixed source and pass after. Full suite: 90 passed, 2 skipped
(pre-existing), 0 failed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: JarbasAl

padacioso/opm.py

@@ -280,10 +280,27 @@ def __detach_intent(self, intent_name, lang=None):
     def handle_detach_intent(self, message):
         """Messagebus handler for detaching padacioso intent.
 
+        The bus-client twins ``ovos.intent.deregister`` into this legacy
+        topic carrying the producer's original context, so the same
+        OVOS-INTENT-4 §3.2 identity check applies: ``intent_name`` is
+        already namespaced ``<skill_id>:<name>``, so its prefix is compared
+        against ``context["skill_id"]`` and a mismatch is rejected.
+
         Args:
             message (Message): message triggering action
         """
-        self.__detach_intent(message.data.get('intent_name'))
+        intent_name = message.data.get('intent_name')
+        context_skill_id = message.context.get("skill_id") if message.context else None
+        if context_skill_id is not None and intent_name:
+            prefix_skill_id = intent_name.split(':', 1)[0]
+            if prefix_skill_id != context_skill_id:
+                LOG.warning(f"[handle_detach_intent] rejecting mismatched "
+                            f"skill_id on {message.msg_type}: "
+                            f"intent_name={intent_name!r} "
+                            f"(skill_id={prefix_skill_id!r}) != "
+                            f"message.context['skill_id']={context_skill_id!r}")
+                return
+        self.__detach_intent(intent_name)
 
     def __detach_entity(self, name, lang):
         """ Remove an entity.
@@ -450,7 +467,7 @@ def handle_register_template(self, message: Message):
         """
         topic = SpecMessage.INTENT_REGISTER_TEMPLATE.value
         data = message.data
-        skill_id = data.get("skill_id")
+        skill_id = _skill_id_from_context(message, "handle_register_template")
         intent_name = data.get("intent_name")
         samples = data.get("samples")
         if not samples:  # §6.3 malformed
@@ -494,7 +511,7 @@ def handle_register_entity(self, message: Message):
         """OVOS-INTENT-4 §7 — register an entity value-set hint."""
         topic = SpecMessage.ENTITY_REGISTER.value
         data = message.data
-        skill_id = data.get("skill_id")
+        skill_id = _skill_id_from_context(message, "handle_register_entity")
         entity_name = data.get("entity_name")
         samples = data.get("samples")
         if not samples:  # §7.2 malformed
@@ -535,7 +552,7 @@ def _intent_langs(self, message: Message) -> List[str]:
 
     def handle_deregister_intent(self, message: Message):
         """OVOS-INTENT-4 §8.2 — remove one intent (all langs if lang omitted)."""
-        skill_id = message.data.get("skill_id")
+        skill_id = _skill_id_from_context(message, "handle_deregister_intent")
         intent_name = message.data.get("intent_name")
         name = self._internal_name(skill_id, intent_name)
         self.__detach_intent(name)
@@ -544,7 +561,7 @@ def handle_deregister_intent(self, message: Message):
 
     def handle_deregister_entity(self, message: Message):
         """OVOS-INTENT-4 §8.3 — remove one entity (all langs if lang omitted)."""
-        skill_id = message.data.get("skill_id")
+        skill_id = _skill_id_from_context(message, "handle_deregister_entity")
         entity_name = message.data.get("entity_name")
         name = self._internal_name(skill_id, entity_name)
         for lang in self._intent_langs(message):
@@ -554,7 +571,7 @@ def handle_deregister_entity(self, message: Message):
 
     def handle_deregister_skill(self, message: Message):
         """OVOS-INTENT-4 §8.4 — remove everything owned by a skill_id."""
-        skill_id = message.data.get("skill_id")
+        skill_id = _skill_id_from_context(message, "handle_deregister_skill")
         if not skill_id:
             return
         prefix = skill_id + ":"
@@ -731,6 +748,38 @@ def shutdown(self):
         self.bus.remove(SpecMessage.INTENT_DISABLE.value, self.handle_disable_intent)
 
 
+def _skill_id_from_context(message: Message, handler: str) -> Optional[str]:
+    """OVOS-INTENT-4 §3.2 identity check for the registration/deregistration
+    handlers.
+
+    ``message.context["skill_id"]`` is the authoritative attribution of the
+    producing component. A payload ``skill_id`` that disagrees with it is a
+    forged or misrouted claim, so the registration is REJECTED (``None`` is
+    returned, and neither value is used) rather than trusting either side.
+    Producers that never set ``context["skill_id"]`` (legacy, pre-spec) keep
+    today's behaviour: the payload value is trusted as before.
+
+    Args:
+        message: the incoming bus message
+        handler: name of the calling handler, for the warning message
+
+    Returns:
+        The resolved skill id, or ``None`` if the payload and context
+        disagree.
+    """
+    context_skill_id = message.context.get("skill_id") if message.context else None
+    payload_skill_id = message.data.get("skill_id")
+    if context_skill_id is None:
+        return payload_skill_id
+    if payload_skill_id and payload_skill_id != context_skill_id:
+        LOG.warning(f"[{handler}] rejecting mismatched skill_id on "
+                    f"{message.msg_type}: message.data['skill_id']="
+                    f"{payload_skill_id!r} != "
+                    f"message.context['skill_id']={context_skill_id!r}")
+        return None
+    return context_skill_id
+
+
 def _dealias_intent_name(name: Optional[str]) -> Optional[str]:
     """Fold the legacy ``<skill_id>:<file>.intent`` id onto the OVOS-INTENT-4
     canonical ``<skill_id>:<file>`` id.

test/test_pipeline.py

@@ -217,6 +217,40 @@ def test_legacy_still_works(self):
         intent = svc.calc_intent("hello there", "en-US")
         self.assertEqual(intent.name, "greet.skill:hello")
 
+    def test_mismatched_register_template_indexes_nothing(self):
+        # OVOS-INTENT-4 §3.2 — a payload claiming a different skill_id than
+        # the bus context is a forged/misrouted attribution and is rejected
+        svc = self.get_service()
+        msg = Message(self.SpecMessage.INTENT_REGISTER_TEMPLATE.value, {
+            "skill_id": "victim.skill",
+            "intent_name": "play_music",
+            "lang": "en-US",
+            "samples": ["play {query}"],
+        }, {"skill_id": "attacker.skill"})
+        svc.handle_register_template(msg)
+        self.assertNotIn("victim.skill:play_music",
+                         svc.containers["en-US"].intent_samples)
+        self.assertNotIn("attacker.skill:play_music",
+                         svc.containers["en-US"].intent_samples)
+
+    def test_mismatched_deregister_skill_leaves_victim_intents(self):
+        # OVOS-INTENT-4 §3.2 — ovos.skill.deregister with data.skill_id=victim
+        # but context.skill_id=attacker must not remove victim's intents
+        svc = self.get_service()
+        svc.handle_register_template(Message(
+            self.SpecMessage.INTENT_REGISTER_TEMPLATE.value, {
+                "skill_id": "victim.skill", "intent_name": "play_music",
+                "lang": "en-US", "samples": ["play {query}"],
+            }))
+        svc.handle_deregister_skill(Message(
+            self.SpecMessage.SKILL_DEREGISTER.value,
+            {"skill_id": "victim.skill"},
+            {"skill_id": "attacker.skill"}))
+        self.assertIn("victim.skill:play_music",
+                      svc.containers["en-US"].intent_samples)
+        intent = svc.calc_intent("play jazz", "en-US")
+        self.assertEqual(intent.name, "victim.skill:play_music")
+
 
 class ContextGatingTest(unittest.TestCase):
     """OVOS-CONTEXT-1 §6/§6.1 requires_context / excludes_context gating."""