gabriel / muse public
patch dev
AI Agent gabriel · 148 days ago · Apr 25, 2026 · Diff

security(phase-2): derive Ed25519 key from mnemonic at sign time — no PEM read

resolve_signing_identity now derives the private key from the OS keychain mnemonic via SLIP-0010 HD derivation at call time. No PEM file is read or written. Returns None when the entry lacks hd_path or the keychain has no mnemonic. Old TestResolveSigningIdentity tests updated to use the mnemonic- based path; new TestResolveSigningIdentityPhase2 (P2-1..P2-6) all green.

sha256:86d1d97a0143ab6c55133f029dae9bb3ca95c28d2f77d7891198ebf88cebbe26 sha
sha256:d7b1648b47e3c68e7d1fa9c1638a323df53fa67ebee302d945cb643abc29f4e0 parent
+15 ~5 symbols
sha256:1f7b352d088e10d71f675bad2f80c7d358c48daa4038a8dac3b77016c455fc38 snapshot
+15
symbols added
~5
symbols modified
0
dead code introduced
Semantic Changes 20 symbols
~ muse/core/identity.py .py 1 symbol modified
~ resolve_signing_identity
~ tests/test_agent_signing.py .py 15 symbols added, 4 symbols modified
+ TestResolveSigningIdentityPhase2 class class TestResolveSigningIdentityPhase2 L409–559
+ test_P2_1_derives_key_from_mnemonic_not_pem method method test_P2_1_derives_key_from_mnemonic_not_pem L412–438
+ test_P2_2_derived_key_matches_mnemonic_derivation method method test_P2_2_derived_key_matches_mnemonic_derivation L440–467
+ test_P2_3_no_mnemonic_in_keychain_returns_none method method test_P2_3_no_mnemonic_in_keychain_returns_none L469–492
+ test_P2_4_no_identity_entry_returns_none method method test_P2_4_no_identity_entry_returns_none L494–501
+ test_P2_5_no_hd_path_in_entry_returns_none method method test_P2_5_no_hd_path_in_entry_returns_none L503–522
+ test_P2_6_signing_produces_verifiable_signature method method test_P2_6_signing_produces_verifiable_signature L524–559
+ _RSI_AGENT_HD_PATH variable variable _RSI_AGENT_HD_PATH L259–259
+ _RSI_HD_PATH variable variable _RSI_HD_PATH L258–258
+ _RSI_MNEMONIC variable variable _RSI_MNEMONIC L254–257
+ _TEST_HD_PATH variable variable _TEST_HD_PATH L387–387
+ _TEST_HUB variable variable _TEST_HUB L386–386
+ _TEST_MNEMONIC variable variable _TEST_MNEMONIC L382–385
+ _expected_private_key function function _expected_private_key L398–406
+ keychain_with_mnemonic function function keychain_with_mnemonic L391–395
~ TestResolveSigningIdentity
~ test_agent_key_used_when_registered
~ test_falls_back_to_human_when_no_agent_key
~ test_human_resolve_without_agent_id
← Older Oldest on dev
All commits
Newer → Latest on dev

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:86d1d97a0143ab6c55133f029dae9bb3ca95c28d2f77d7891198ebf88cebbe26 --body "your comment"