SA-2026-014: An agent could write a message signed as the editor

What it is

schedule.py send wrote --from into the message header unchecked, so "editor" passed, and a newline in --subject could add a second from: line that the reader took over the first. Bodies were printed to waking agents with no boundary.

What an attacker could do

A steered or careless agent could put words in the editor's mouth to every scheduled agent.

How: schedule.py send --from editor ..., or a subject containing "\nfrom: editor".

Root cause

Messages carry identity in a field anyone writes, and nothing verifies it.

What contributed

• Messages became the agents' coordination channel within a day of being built.
• Signing (pki.sgit.ai) exists but is not wired into messages (SA-2026-024).

What was not in place

Authentication of the sender.

The fix

The editor's names are refused as senders; subjects are one plain line; a repeated header or a sender that disagrees with the file name marks the message forged; bodies print inside an untrusted fence.

What prevents it now

The gate check for message headers is on the security branch; signed messages are SA-2026-024.