gabriel / muse public
feat patch auth dev
AI Agent gabriel · 148 days ago · Apr 25, 2026 · Diff

feat(auth): Phase 8 — migrate run_recover and run_rotate off PEM files

- run_recover: replace generate_hd_keypair with derive_hd_public_info; store mnemonic in OS keychain; guard on identity entry (not PEM file) for --force; remove key_path from entry, JSON, and _RecoverJson TypedDict - run_rotate: read mnemonic from keychain (kc_load) instead of _read_mnemonic_securely; replace generate_hd_keypair with derive_hd_public_info; remove key_path from entry, JSON, _RotateJson - test_cmd_auth_phase8.py: new TDD test file; 12 tests REC-1..REC-7 and ROT-1..ROT-4 all green - test_auth_rotate.py: add keychain patching to isolated fixture; remove stdin from _rotate(); replace test_III2_new_pem_is_valid_ed25519 with test_III2_rotate_writes_no_pem; all 10 green - test_hd_keygen_unified.py: replace test_recover_writes_pem with test_recover_writes_no_pem; delete test_recover_pem_mode_600; add keychain patching to _do_recover - docs: mark Phase 8 complete; update all stale status fields

sha256:2ce0743fe5cd25849790e34608228477f418536be07f4b129d85f9c2cdf5895c sha
sha256:794449e7457b82dc5e2c97854618810e77aa6d13267acffe12cb9f85daeb2a17 parent
+36 ~22 −6 symbols
sha256:bb463eec3d05d0ef0083326a955d92d940738ffde410834401f9e6ee65587860 snapshot
+36
symbols added
~22
symbols modified
−6
symbols removed
0
dead code introduced
Semantic Changes 64 symbols
~ tests/test_cmd_auth_phase8.py .py 31 symbols added
+ TestRecoverNoPem class class TestRecoverNoPem L98–170
+ test_REC_1_no_pem_written method method test_REC_1_no_pem_written L99–103
+ test_REC_2_hd_path_in_toml_no_key_path method method test_REC_2_hd_path_in_toml_no_key_path L105–112
+ test_REC_3_fingerprint_matches_mnemonic method method test_REC_3_fingerprint_matches_mnemonic L114–125
+ test_REC_4_mnemonic_stored_in_keychain method method test_REC_4_mnemonic_stored_in_keychain L127–135
+ test_REC_5_no_force_rejects_existing_entry method method test_REC_5_no_force_rejects_existing_entry L137–141
+ test_REC_5b_force_overwrites_existing method method test_REC_5b_force_overwrites_existing L143–147
+ test_REC_6_json_has_no_key_path method method test_REC_6_json_has_no_key_path L149–154
+ test_REC_7_agent_recover_no_pem method method test_REC_7_agent_recover_no_pem L156–170
+ TestRotateNoPem class class TestRotateNoPem L178–212
+ test_ROT_1_no_pem_written method method test_ROT_1_no_pem_written L179–184
+ test_ROT_2_no_key_path_in_toml method method test_ROT_2_no_key_path_in_toml L186–194
+ test_ROT_3_reads_mnemonic_from_keychain method method test_ROT_3_reads_mnemonic_from_keychain L196–204
+ test_ROT_4_json_has_no_key_path method method test_ROT_4_json_has_no_key_path L206–212
+ _HOSTNAME variable variable _HOSTNAME L33–33
+ _HUB variable variable _HUB L32–32
+ _MNEMONIC variable variable _MNEMONIC L34–37
+ _keygen function function _keygen L64–65
+ _pem_files function function _pem_files L83–85
+ _recover function function _recover L68–73
+ _rotate function function _rotate L76–80
+ _toml function function _toml L88–90
+ CliRunner import import CliRunner L26–26
+ annotations import import annotations L19–19
+ id_module import import id_module L28–28
+ json import import json L21–21
+ kp_module import import kp_module L27–27
+ pathlib import import pathlib L22–22
+ pytest import import pytest L24–24
+ isolated function function isolated L46–61
+ runner variable variable runner L30–30
~ docs/key-material-security-audit.md .md 3 symbols added, 2 symbols removed, 12 symbols modified
− Files to Delete (blocked on runrecover / runrotate migration) section Files to Delete (blocked on runrecover / runrotate migration) L259–270
− table@L261 section table@L261 L261–270
+ Files to Delete (deferred cleanup) section Files to Delete (deferred cleanup) L269–280
+ table@L271 section table@L271 L271–280
+ Phase 8 — Migrate run_recover and run_rotate off PEM files ✅ COMPLETE section Phase 8 — Migrate run_recover and run_rotate off PEM files ✅ COMPLETE L235–247
~ Key Material Security Audit — Muse + MuseHub
~ Current State — What Exists Today
~ py
~ py
~ Identified Issues (Ranked by Severity)
~ HIGH
~ table@L104
~ Implementation Plan
~ Phase 2 — Derive and Sign in Memory (C1, C2, H1) ✅ COMPLETE
~ py CLI Commands (H2, H4) ✅ COMPLETE
~ Phase 7 — MuseHub Server Audit ✅ COMPLETE
~ Test Checklist
~ muse/cli/commands/auth.py .py 4 symbols modified
~ _RecoverJson
~ _RotateJson
~ run_recover
~ run_rotate
~ tests/test_auth_rotate.py .py 1 symbol added, 2 symbols removed, 3 symbols modified
− test_III2_new_pem_is_valid_ed25519 method method test_III2_new_pem_is_valid_ed25519 L251–262
− load_pem_private_key import import load_pem_private_key L41–41
+ test_III2_rotate_writes_no_pem method method test_III2_rotate_writes_no_pem L255–263
~ TestRotateGuards
~ _rotate
~ isolated
~ tests/test_hd_keygen_unified.py .py 1 symbol added, 2 symbols removed, 3 symbols modified
− test_recover_pem_mode_600 method method test_recover_pem_mode_600 L499–506
− test_recover_writes_pem method method test_recover_writes_pem L458–464
+ test_recover_writes_no_pem method method test_recover_writes_no_pem L459–466
~ TestRunRecover
~ _do_recover
~ test_recover_produces_same_fingerprint_as_keygen
← Older Oldest on dev
All commits
Newer → Latest on dev

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:2ce0743fe5cd25849790e34608228477f418536be07f4b129d85f9c2cdf5895c --body "your comment"