gabriel / muse public
feat BREAKING auth task/secure-key-material #1 / 1
gabriel · 158 days ago · Apr 16, 2026 · Diff

feat(auth): remove key_source field + delete migrate command

- key_source was ambiguous (derivation method vs storage location) and redundant — JBOK is deleted, all keys are HD; hd_path is the natural discriminator - Remove key_source from IdentityEntry TypedDict, _dump_identity, _load_all, and all auth command JSON outputs - Delete run_migrate and its parser registration (JBOK→HD migration is permanently dead — the guard always rejected) - Fix test_auth_show_migrate.py: delete all migrate/JBOK tests, update show tests to use hd_path as discriminator and in-memory keychain fixtures - Fix test_cmd_auth_keygen_hd.py: replace mnemonic-in-TOML test with keychain-based round-trip test - Fix test_hd_keygen_unified.py: assert key_source absent from TOML - Fix test_agent_signing.py: replace generate_keypair with generate_hd_keypair - Fix test_cmd_agent.py / test_agent_json_schema.py: keychain isolation

sha256:4a32229feea71de40b954a0cf1dfa50bf7c39abe97a94774e529bead7315c84d sha
+11 ~59 −50 symbols
sha256:0641d7721d33af69917d7db96e208ed672449dc1e4bb17b64877ed9c9e722e11 snapshot
+11
symbols added
~59
symbols modified
−50
symbols removed
0
dead code introduced
Semantic Changes 120 symbols
~ muse/cli/commands/auth.py .py 1 symbol added, 2 symbols removed, 7 symbols modified
_MigrateJson class class _MigrateJson L166–176
run_migrate function function run_migrate L1514–1686
+ _read_mnemonic_securely function function _read_mnemonic_securely L105–150
~ muse/cli/config.py .py 1 symbol modified
~ pyproject.toml .toml 2 symbols modified
~ tests/test_agent_signing.py .py 3 symbols added, 13 symbols removed, 11 symbols modified
TestCommitSigningWithAgentKey class class TestCommitSigningWithAgentKey L418–521
_write_commit_env method method _write_commit_env L421–449
test_agent_signature_verifies_with_embedded_public_key method method test_agent_signature_verifies_with_embedded_public_key L490–521
test_signing_key_fingerprint_matches_public_key method method test_signing_key_fingerprint_matches_public_key L469–488
test_signing_produces_valid_ed25519_signature method method test_signing_produces_valid_ed25519_signature L451–467
TestGetSigningIdentityEnvVar class class TestGetSigningIdentityEnvVar L345–410
_make_pem method method _make_pem L346–348
test_invalid_muse_agent_key_falls_through method method test_invalid_muse_agent_key_falls_through L391–400
test_muse_agent_key_default_handle_is_agent method method test_muse_agent_key_default_handle_is_agent L378–389
test_muse_agent_key_takes_priority method method test_muse_agent_key_takes_priority L350–363
test_muse_agent_key_uses_agent_id_as_fallback_handle method method test_muse_agent_key_uses_agent_id_as_fallback_handle L365–376
test_no_env_var_and_no_identity_returns_none method method test_no_env_var_and_no_identity_returns_none L402–410
generate_keypair import import generate_keypair L35–35
+ _SEED_A variable variable _SEED_A L40–40
+ _SEED_B variable variable _SEED_B L41–41
+ generate_hd_keypair import import generate_hd_keypair L32–32
~ tests/test_auth_show_migrate.py .py 4 symbols added, 26 symbols removed, 17 symbols modified
test_migrate_invalid_strength_exits_1 method method test_migrate_invalid_strength_exits_1 L580–597
test_migrate_stores_12_word_mnemonic method method test_migrate_stores_12_word_mnemonic L553–578
test_run_migrate_docstring method method test_run_migrate_docstring L775–777
TestMigrateCLI class class TestMigrateCLI L282–423
_mk_fake_pem method method _mk_fake_pem L285–289
test_migrate_no_identity_exits_1 method method test_migrate_no_identity_exits_1 L348–364
test_migrate_rejects_already_hd method method test_migrate_rejects_already_hd L329–346
test_migrate_requires_force method method test_migrate_requires_force L310–327
test_migrate_requires_to_hd_flag method method test_migrate_requires_to_hd_flag L291–308
test_migrate_success_json method method test_migrate_success_json L366–394
test_migrate_writes_hd_to_toml method method test_migrate_writes_hd_to_toml L396–423
test_migrate_latency method method test_migrate_latency L648–672
test_migrate_already_hd_guard method method test_migrate_already_hd_guard L739–760
test_migrate_no_force_exits_safely method method test_migrate_no_force_exits_safely L716–737
test_show_jbok_json method method test_show_jbok_json L232–247
test_jbok_entry_json method method test_jbok_entry_json L116–137
test_jbok_stderr_human_readable method method test_jbok_stderr_human_readable L208–221
TestShowMigrateE2E class class TestShowMigrateE2E L431–492
test_migrate_preserves_handle method method test_migrate_preserves_handle L469–492
test_migrate_then_show_roundtrip method method test_migrate_then_show_roundtrip L434–467
TestStress class class TestStress L500–542
test_distinct_mnemonics method method test_distinct_mnemonics L503–542
_write_jbok_identity function function _write_jbok_identity L75–87
_write_toml_section function function _write_toml_section L67–72
patch import import patch L26–26
tomllib import import tomllib L25–25
+ test_show_bare_json method method test_show_bare_json L221–237
+ test_bare_entry_json method method test_bare_entry_json L110–130
+ test_bare_entry_stderr_human_readable method method test_bare_entry_stderr_human_readable L198–210
+ _write_bare_identity function function _write_bare_identity L61–73
~ tests/test_cmd_auth_keygen_hd.py .py 2 symbols added, 6 symbols removed, 5 symbols modified
test_jbok_entry_no_hd_fields method method test_jbok_entry_no_hd_fields L208–218
test_key_source_serialised method method test_key_source_serialised L160–167
test_mnemonic_serialised method method test_mnemonic_serialised L169–178
test_key_source_field_accepted method method test_key_source_field_accepted L123–132
test_json_output_has_key_source method method test_json_output_has_key_source L397–403
test_mnemonic_stored_in_identity_toml_round_trips method method test_mnemonic_stored_in_identity_toml_round_trips L655–689
+ test_entry_no_spurious_fields method method test_entry_no_spurious_fields L175–185
+ test_keygen_hd_key_derives_correctly method method test_keygen_hd_key_derives_correctly L614–657
~ tests/test_hd_keygen_unified.py .py 1 symbol added, 3 symbols removed, 6 symbols modified
test_identity_toml_has_mnemonic method method test_identity_toml_has_mnemonic L210–220
test_identity_toml_key_source_hd method method test_identity_toml_key_source_hd L222–229
test_json_has_key_source_hd method method test_json_has_key_source_hd L187–193
+ test_identity_toml_has_no_key_source method method test_identity_toml_has_no_key_source L202–209
← Older Oldest on task/secure-key-material
All commits
Newer → Latest on task/secure-key-material

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:4a32229feea71de40b954a0cf1dfa50bf7c39abe97a94774e529bead7315c84d --body "your comment"