Unclear Whether genuine approvals from the lead are still accepted when no verification key is set up is not known.
What
In agent teams, several Claude agents work together. A team lead coordinates teammates, and they exchange messages through an inbox. The part that reads the inbox now checks messages using a verify key, leadVerifyKey:
- A plan approval reply that claims to come from the team lead but cannot be verified is ignored. It is logged as '[InboxPoller] Not applying a plan approval response that claims to be from the team lead but could not be verified'.
- A message from the lead that arrives without a key is reported as
lead_frame_without_key. - When the lead holds a verify key, unverified replies to permission or sandbox-permission requests are treated as rejected or denied. A sandbox is the restricted area commands run in.
- A plan approval request records a
planDigestalong with the response. - A shutdown approval is ignored unless it matches an unused shutdown request from the lead.
Before, a reply was rejected only when it came from someone other than the lead. Replies from the lead were processed without a key check or a request match.
Why
This makes it harder for a forged inbox message to pose as the team lead. Such a message could otherwise approve a plan, grant a permission or shut down a teammate. Unverified replies now fail toward the safe answer.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
Whether genuine approvals from the lead are still accepted when no verification key is set up is not known.