gabriel / muse public
feat BREAKING task/high4-key-rotation #1 / 1
AI Agent gabriel · 162 days ago · Apr 17, 2026 · Diff

feat: muse auth rotate — HD key rotation to next index (HIGH-4)

New subcommand: muse auth rotate --hub <url> [--passphrase P] [--json]

Reads the current identity's hd_path to find the active rotation index (the 6th path component: m/purpose'/domain'/entity'/id'/role'/N'). Derives a new Ed25519 identity key at index N+1, overwrites the PEM, and updates identity.toml. The operator then re-registers the new fingerprint with 'muse auth register'.

Supporting changes: muse/core/keypair.py — generate_hd_keypair gains rotation_index param (default 0, fully backward compatible) muse/cli/commands/auth.py — _parse_rotation_index() helper, run_rotate(), rotate subparser registered in register()

Tests (tests/test_auth_rotate.py — 10 tests): I1-I4 basic rotation: different fingerprint, index increments, deterministic II1-3 --json fields, --passphrase and MUSE_BIP39_PASSPHRASE flow through III1-3 guard rails: no identity → fails; PEM is valid Ed25519; toml updated

sha256:16d36a7fd82056419e2f4ffa62fcc0ebcf4fde11429f7a9d69a48a27ef014a45 sha
sha256:421d52c5f90eae755ac6ffa6250f2f0975125c4347065e7daf79e974d8d55b04 parent
+33 ~2 symbols
sha256:d6083425940cea7ee03196d18c02488783a246cd35a7254482d4292468e3a8e9 snapshot
+33
symbols added
~2
symbols modified
0
dead code introduced
Semantic Changes 35 symbols
~ tests/test_auth_rotate.py .py 31 symbols added
+ TestRotateBasic class class TestRotateBasic L106–170
+ test_I1_rotate_produces_different_fingerprint method method test_I1_rotate_produces_different_fingerprint L107–121
+ test_I2_rotate_increments_index method method test_I2_rotate_increments_index L123–139
+ test_I3_two_rotations_increment_twice method method test_I3_two_rotations_increment_twice L141–149
+ test_I4_rotation_is_deterministic method method test_I4_rotation_is_deterministic L151–170
+ TestRotateFlags class class TestRotateFlags L178–222
+ test_II1_json_output_has_expected_fields method method test_II1_json_output_has_expected_fields L179–189
+ test_II2_passphrase_flag_changes_result method method test_II2_passphrase_flag_changes_result L191–206
+ test_II3_env_var_passphrase_works method method test_II3_env_var_passphrase_works L208–222
+ TestRotateGuards class class TestRotateGuards L230–269
+ test_III1_rotate_without_prior_keygen_fails method method test_III1_rotate_without_prior_keygen_fails L231–236
+ test_III2_new_pem_is_valid_ed25519 method method test_III2_new_pem_is_valid_ed25519 L238–249
+ test_III3_identity_toml_reflects_new_index method method test_III3_identity_toml_reflects_new_index L251–269
+ _HUB variable variable _HUB L44–44
+ _MNEMONIC variable variable _MNEMONIC L45–48
+ _fp function function _fp L86–87
+ _hd_path function function _hd_path L90–91
+ _keygen function function _keygen L74–75
+ _rotate function function _rotate L78–83
+ _rotation_index function function _rotation_index L94–98
+ fixed_mnemonic function function fixed_mnemonic L68–71
+ CliRunner import import CliRunner L38–38
+ annotations import import annotations L30–30
+ id_module import import id_module L40–40
+ json import import json L32–32
+ kp_module import import kp_module L39–39
+ load_pem_private_key import import load_pem_private_key L36–36
+ pathlib import import pathlib L33–33
+ pytest import import pytest L35–35
+ isolated function function isolated L57–64
+ runner variable variable runner L42–42
~ muse/cli/commands/auth.py .py 2 symbols added, 1 symbol modified
+ _parse_rotation_index function function _parse_rotation_index L1022–1033
+ run_rotate function function run_rotate L1036–1131
~ register
~ muse/core/keypair.py .py 1 symbol modified
~ generate_hd_keypair
← Older Oldest on task/high4-key-rotation
All commits
Newer → Latest on task/high4-key-rotation

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:16d36a7fd82056419e2f4ffa62fcc0ebcf4fde11429f7a9d69a48a27ef014a45 --body "your comment"