fix: sha256:01c18d272ae3e8990e699520637d8eb45ee8fca1bca9aed809e1d867f3c7f22f · gabriel/muse

fix: verify-commit/verify-tag --check-key-status always "unknown" (musehub#223)

Root cause was deeper than the missing hub endpoint: both commands imported a nonexistent muse.core.repo.read_hub_url, silently caught by the surrounding try/except, so hub_url was always None regardless of whether a hub was configured -- the real GET /api/keys/{key_id}/status endpoint (now implemented server-side, companion musehub commit) was never even reached. Fixed to import the real muse.cli.config.get_hub_url.

Secondary finding from the same investigation: `signer` was always empty for human-authored commits (result["signer"] = commit.agent_id, and humans have no agent_id by design). Fixed to fall back to commit.author when agent_id is empty -- both fields are already on the local commit record, no hub lookup needed.

TDD: added tests/test_cmd_verify_commit.py:: test_reports_active_status_from_configured_hub and tests/test_cmd_verify_tag.py:: test_verify_tag_check_key_status_reports_active_from_configured_hub, configuring a real hub URL and mocking the HTTP response to confirm the full chain (config -> hub_url resolution -> network call -> status surfaced in CLI JSON output) actually works end-to-end -- not just that _fetch_key_status's own unit tests mock the boundary correctly in isolation. Also added test_human_commit_signer_falls_back_to_author and test_agent_commit_signer_prefers_agent_id_over_author. Confirmed genuine RED via muse-dev shelf save/pop isolation on all 4 fixes (2 per file).

Regression: 98 passed in test_cmd_verify_commit.py + test_cmd_verify_tag.py; 106 passed across test_cmd_config.py, test_hub_api_ssl_and_public_access.py, test_cmd_verify_shallow.py.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

symbols added

symbols modified

files changed

1259

files in snapshot

dead code introduced

Semantic Changes 12 symbols

~ muse/cli/commands/verify_commit.py .py 2 symbols modified

~ _verify_one

~ run

~ muse/cli/commands/verify_tag.py .py 1 symbol modified

~ run

~ tests/test_cmd_verify_commit.py .py 3 symbols added, 3 symbols modified

+ test_reports_active_status_from_configured_hub method method test_reports_active_status_from_configured_hub L879–904

+ test_agent_commit_signer_prefers_agent_id_over_author method method test_agent_commit_signer_prefers_agent_id_over_author L303–314

+ test_human_commit_signer_falls_back_to_author method method test_human_commit_signer_falls_back_to_author L289–301

~ TestCheckKeyStatus

~ TestVerifyOne

~ _commit_files

~ tests/test_cmd_verify_tag.py .py 2 symbols added, 1 symbol modified

+ MagicMock import import MagicMock L22–22

+ test_verify_tag_check_key_status_reports_active_from_configured_hub function function test_verify_tag_check_key_status_reports_active_from_configured_hub L439–462

~ patch

Files Changed

1259 in snapshot

~ muse/cli/commands/verify_commit.py .py

~ muse/cli/commands/verify_tag.py .py

~ tests/test_cmd_verify_commit.py .py

~ tests/test_cmd_verify_tag.py .py

← Older Oldest on fix/223-verify-commit-key-status

All commits

Newer → Latest on fix/223-verify-commit-key-status

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:01c18d272ae3e8990e699520637d8eb45ee8fca1bca9aed809e1d867f3c7f22f --body "your comment"