gabriel / muse public
refactor BREAKING task/fingerprint-prefix #2 / 2
AI Agent gabriel · 155 days ago · Apr 22, 2026 · Diff

refactor: canonical public_key_fingerprint with sha256: prefix in _types

Single source of truth for public key fingerprinting. Deleted duplicate implementations from provenance.py and agent.py (_fingerprint). All call sites now route through muse.core._types.public_key_fingerprint, which returns sha256:<64-hex> (length 71) consistent with every other content-addressed value in the system.

signer_key_id in CommitRecord wire format remains bare 16-char hex — that is a separate migration concern.

Tests: 16 new TDD tests in test_public_key_fingerprint.py, all updated existing test files updated to expect the prefixed format.

sha256:9604b7385087f53fc12d4d6398966152e90652122df931800fee579d854493b0 sha
sha256:9ef9e1c3cd263b29c5ad21f2be44526fca5a1c290c874f858de038573bb43861 parent
+35 ~53 −10 symbols
sha256:f4db4fd9de9f6cf1a817bad47a27f5e67974485492168605fb180a5f0c6e1266 snapshot
+35
symbols added
~53
symbols modified
−10
symbols removed
0
dead code introduced
Semantic Changes 98 symbols
~ tests/test_public_key_fingerprint.py .py 23 symbols added
+ TestFingerprintInIdentityEntry class class TestFingerprintInIdentityEntry L118–158
+ test_fingerprint_field_in_identity_entry_is_prefixed method method test_fingerprint_field_in_identity_entry_is_prefixed L132–158
+ test_generate_hd_keypair_returns_prefixed_fingerprint method method test_generate_hd_keypair_returns_prefixed_fingerprint L121–130
+ TestNoBareFingerprintsAnywhere class class TestNoBareFingerprintsAnywhere L96–115
+ test_agent_fingerprint_function_is_gone method method test_agent_fingerprint_function_is_gone L99–107
+ test_provenance_fingerprint_function_is_gone method method test_provenance_fingerprint_function_is_gone L109–115
+ TestPublicKeyFingerprintCanonical class class TestPublicKeyFingerprintCanonical L14–63
+ test_correct_sha256_of_input method method test_correct_sha256_of_input L34–38
+ test_deterministic method method test_deterministic L46–49
+ test_different_inputs_produce_different_fingerprints method method test_different_inputs_produce_different_fingerprints L51–53
+ test_empty_bytes method method test_empty_bytes L55–58
+ test_hex_portion_is_64_chars method method test_hex_portion_is_64_chars L22–26
+ test_hex_portion_is_lowercase_hex method method test_hex_portion_is_lowercase_hex L28–32
+ test_known_zero_key method method test_known_zero_key L40–44
+ test_returns_sha256_prefixed_string method method test_returns_sha256_prefixed_string L17–20
+ test_total_length_is_71 method method test_total_length_is_71 L60–63
+ TestPublicKeyFingerprintKeypairModule class class TestPublicKeyFingerprintKeypairModule L66–93
+ test_consistent_with_types_module method method test_consistent_with_types_module L85–93
+ test_hex_portion_is_64_chars method method test_hex_portion_is_64_chars L77–83
+ test_returns_sha256_prefixed_string method method test_returns_sha256_prefixed_string L69–75
+ annotations import import annotations L7–7
+ hashlib import import hashlib L9–9
+ pytest import import pytest L11–11
~ muse/cli/commands/agent.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− _fingerprint function function _fingerprint L192–194
+ _canonical_fingerprint import import _canonical_fingerprint L96–96
~ run_keygen
~ muse/cli/commands/sign.py .py 1 symbol added, 1 symbol modified
+ _canonical_fingerprint import import _canonical_fingerprint L89–89
~ _public_key_info
~ muse/core/_types.py .py 1 symbol added
+ public_key_fingerprint function function public_key_fingerprint L121–139
~ muse/core/keypair.py .py 1 symbol added, 1 symbol modified
+ _canonical_fingerprint import import _canonical_fingerprint L49–49
~ public_key_fingerprint
~ muse/core/provenance.py .py 1 symbol removed, 1 symbol modified
− public_key_fingerprint function function public_key_fingerprint L271–282
~ sign_commit_record
~ tests/test_agent_supercharge.py .py 3 symbols added, 3 symbols removed, 14 symbols modified
− test_hex_length_is_64 method method test_hex_length_is_64 L405–407
− test_matches_hashlib_directly method method test_matches_hashlib_directly L429–432
− test_returns_hex_string method method test_returns_hex_string L399–403
+ test_matches_canonical_formula method method test_matches_canonical_formula L428–431
+ test_returns_prefixed_string method method test_returns_prefixed_string L399–402
+ test_total_length_is_71 method method test_total_length_is_71 L404–406
~ TestPerformance
~ test_fingerprint_1000_under_500ms
~ TestSecurity
~ test_null_bytes_in_fingerprint_input
~ test_sql_injection_in_slot_name
~ TestStress
~ test_fingerprint_1000_calls_no_crash
~ test_fingerprint_thread_safety
~ TestUnitFingerprint
~ test_deterministic
~ test_different_inputs_differ
~ test_empty_bytes
~ test_known_input
~ test_single_byte_inputs
~ tests/test_cmd_agent.py .py 2 symbols added, 2 symbols removed, 6 symbols modified
− test_length_is_64 method method test_length_is_64 L195–198
− test_returns_hex_string method method test_returns_hex_string L184–188
+ test_returns_prefixed_string method method test_returns_prefixed_string L184–187
+ test_total_length_is_71 method method test_total_length_is_71 L195–198
~ TestDataIntegrity
~ test_fingerprint_matches_sha256_of_public_key
~ TestFingerprint
~ test_sha256_of_input
~ TestRunKeygen
~ test_keygen_produces_valid_output
~ tests/test_provenance.py .py 1 symbol added, 2 symbols removed, 10 symbols modified
− test_fingerprint_is_16_hex_chars method method test_fingerprint_is_16_hex_chars L146–151
− public_key_fingerprint import import public_key_fingerprint L10–10
+ test_fingerprint_is_prefixed_and_71_chars method method test_fingerprint_is_prefixed_and_71_chars L145–150
~ TestPublicKeyHelpers
~ test_different_keys_different_fingerprints
~ test_fingerprint_is_deterministic
~ AgentIdentity
~ encode_public_key
~ make_agent_identity
~ provenance_payload
~ sign_commit_ed25519
~ sign_commit_record
~ verify_commit_ed25519
~ tests/test_security_agent_impersonation.py .py 2 symbols added, 1 symbol removed, 19 symbols modified
− public_key_fingerprint import import public_key_fingerprint L39–39
+ _signer_key_id function function _signer_key_id L53–55
+ _hashlib import import _hashlib L50–50
~ TestSigningRoundTrip
~ test_key_fingerprint_is_16_hex_chars
~ TestVerifySignatures
~ test_forged_signature_detected
~ test_mixed_signed_unsigned_commits
~ test_multiple_commits_signed_all_valid
~ test_valid_signature_passes
~ TestVerifySignaturesV7
~ test_v7_agent_id_mutation_detected_by_verify
~ test_v7_any_provenance_field_mutation_detected
~ test_v7_author_mutation_detected_by_verify
~ test_v7_forged_signature_detected
~ test_v7_mixed_chain_verifies
~ test_v7_valid_signature_passes
~ encode_public_key
~ provenance_payload
~ sign_commit_ed25519
~ sign_commit_record
~ verify_commit_ed25519
← Older Oldest on task/fingerprint-prefix
All commits Newer docs: update fingerprint examples to sha256: prefix sha256:2df337adcba922beb52384f3eff0ca4f24e06044df5b32f5eab8319fb4f3601a

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:9604b7385087f53fc12d4d6398966152e90652122df931800fee579d854493b0 --body "your comment"