gabriel / muse public
fix patch task/222-fix-hub-scoping-registration #1 / 1
AI Agent gabriel · 3 days ago · Sep 18, 2026 · Diff

fix: hub-scoping migration never actually signed or registered with the hub (musehub#221 follow-up)

Found while planning the real rollout of `muse migrate hub-scoping`: the shared `_make_hub_register_fn` shim used by both `migrate hub-scoping` and `migrate domain-integers` called `_post_challenge`/`_post_verify` with the wrong argument shapes entirely (positional args instead of the payload dicts those functions actually take) and never signed the challenge nonce at all. The resulting TypeError was swallowed by a broad `except Exception`, so a live run would silently report `hub_registered: false` for every entry -- meaning identity.toml would claim a new hub-scoped key while the hub server still only recognized the old one, breaking auth against that hub on the very next request. This was never caught because the test suite only ever exercised `run_migration` with a `MagicMock` hub_register_fn -- the shim itself was untested.

- `_make_hub_register_fn` now takes `seed` and mirrors the real challenge/sign/verify flow from `muse auth register` (auth.py:1656-1703): derives the private key at the *new* hub-scoped path, builds the correct payload dicts, actually signs the nonce with `sign_bytes`, and submits a real signature. Both call sites (`_run_domain_integers`, `_run_hub_scoping`) updated to pass `seed` through. - Added `--hub <url>` to `migrate hub-scoping` so a live run can target one hub at a time instead of migrating every pre-hub-scoping entry (including production) in a single all-or-nothing invocation. - 12 new tests: challenge/verify payload shape, real signature verification against the newly derived public key, fail-closed on a missing challenge_token, fail-closed (not raise) on hub HTTP errors, and CLI-level `--hub` filtering (valid + unknown hub). All new tests mock the HTTP layer only -- no real keychain or network access, per MUSE_KEYCHAIN_BACKEND=disabled discipline.

Verified via `--dry-run` against the real identity.toml: confirms all three real hub entries (localhost, staging, production) still need this migration, with zero writes.

Tests: 48/48 in test_migrate_hub_scoping.py, 116/116 across the full migrate/auth-register targeted set.

sha256:46ec1508d0a0173522de9d4928d536003fbee08f203c47130c60ebb2ee217344 sha
sha256:094f61276606fe7ac4e458d1842e6b68154988569385904d223c30cc0bb7b030 parent
+12 ~4 symbols
sha256:3d34b69a593b99a61447e7710c9bafa3f99558d8924a970f27fff37541702e42 snapshot
+12
symbols added
~4
symbols modified
0
dead code introduced
Semantic Changes 16 symbols
~ muse/cli/commands/migrate_cmd.py .py 4 symbols modified
~ _make_hub_register_fn
~ _run_domain_integers
~ _run_hub_scoping
~ register
~ tests/test_migrate_hub_scoping.py .py 12 symbols added
+ TestCliHubFilter class class TestCliHubFilter L726–790
+ test_hub_filter_restricts_to_named_hub method method test_hub_filter_restricts_to_named_hub L727–761
+ test_hub_filter_unknown_hub_errors method method test_hub_filter_unknown_hub_errors L763–790
+ TestCliLiveRunRegistersForReal class class TestCliLiveRunRegistersForReal L798–855
+ test_live_run_calls_real_challenge_and_verify_with_correct_payloads method method test_live_run_calls_real_challenge_and_verify_with_correct_payloads L799–855
+ TestMakeHubRegisterFn class class TestMakeHubRegisterFn L566–718
+ _derive method method _derive L567–573
+ test_hub_http_failure_returns_false_not_raise method method test_hub_http_failure_returns_false_not_raise L703–718
+ test_missing_challenge_token_fails_closed method method test_missing_challenge_token_fails_closed L679–701
+ test_sends_correct_challenge_payload method method test_sends_correct_challenge_payload L575–607
+ test_signature_verifies_against_new_key method method test_signature_verifies_against_new_key L609–648
+ test_verify_payload_public_key_matches_new_fingerprint method method test_verify_payload_public_key_matches_new_fingerprint L650–677
← Older Oldest on task/222-fix-hub-scoping-registration
All commits
Newer → Latest on task/222-fix-hub-scoping-registration

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:46ec1508d0a0173522de9d4928d536003fbee08f203c47130c60ebb2ee217344 --body "your comment"