gabriel / muse public
feat BREAKING migrate task/migrate-signing #1 / 2
AI Agent gabriel · 146 days ago · Apr 26, 2026 · Diff

feat(migrate): sign unsigned commits during migration

- Add signing_identity parameter to migrate() and _make_canonical_dict() - When provided, unsigned commits are signed with the given Ed25519 identity - signer_public_key baked into compute_commit_id so the ID is stable - Already-signed commits are never re-signed - MigrateResult gains commits_signed and unsigned_commits_skipped fields - CLI JSON output includes both new fields - 18 TDD tests in TestMigrateSignsUnsignedCommits all green

sha256:d5f79d21e6927f2763ca88b1d82fb4745702895174908ee8ca4fddde5656d5f3 sha
sha256:4843cdc97dbb2bf25e7e5167f957a409bdf414e824d0b09b32b521aded47e367 parent
+24 ~5 symbols
sha256:e40a418975a77dc4eaa3e718445725f0fb3cc37dbfaea85226495bd39259b7d9 snapshot
+24
symbols added
~5
symbols modified
0
dead code introduced
Semantic Changes 29 symbols
~ muse/cli/commands/migrate.py .py 1 symbol modified
~ run
~ muse/core/migrate.py .py 1 symbol added, 3 symbols modified
+ TYPE_CHECKING import import TYPE_CHECKING L34–34
~ MigrateResult
~ _make_canonical_dict
~ migrate
~ tests/test_code_migrate.py .py 23 symbols added, 1 symbol modified
+ TestMigrateSignsUnsignedCommits class class TestMigrateSignsUnsignedCommits L1522–1755
+ test_already_signed_commit_not_re_signed method method test_already_signed_commit_not_re_signed L1618–1642
+ test_branch_ref_updated_to_signed_commit_id method method test_branch_ref_updated_to_signed_commit_id L1684–1692
+ test_commit_id_after_signing_differs_from_unsigned_id method method test_commit_id_after_signing_differs_from_unsigned_id L1674–1682
+ test_dry_run_reports_commits_that_would_be_signed method method test_dry_run_reports_commits_that_would_be_signed L1706–1711
+ test_dry_run_with_signing_identity_writes_nothing method method test_dry_run_with_signing_identity_writes_nothing L1696–1704
+ test_json_output_includes_commits_signed method method test_json_output_includes_commits_signed L1722–1733
+ test_migrate_result_has_commits_signed_field method method test_migrate_result_has_commits_signed_field L1715–1718
+ test_migrated_commit_has_ed25519_signature method method test_migrated_commit_has_ed25519_signature L1555–1567
+ test_migrated_commit_has_signer_public_key method method test_migrated_commit_has_signer_public_key L1569–1578
+ test_no_signing_identity_commits_signed_is_zero method method test_no_signing_identity_commits_signed_is_zero L1547–1551
+ test_only_unsigned_commits_get_signed_in_mixed_dag method method test_only_unsigned_commits_get_signed_in_mixed_dag L1646–1670
+ test_signature_verifies_against_signer_public_key method method test_signature_verifies_against_signer_public_key L1591–1614
+ test_signer_public_key_matches_signing_key method method test_signer_public_key_matches_signing_key L1580–1587
+ test_two_unsigned_commits_increments_twice method method test_two_unsigned_commits_increments_twice L1534–1545
+ test_unsigned_commit_increments_commits_signed method method test_unsigned_commit_increments_commits_signed L1527–1532
+ test_unsigned_commits_without_identity_not_fatal method method test_unsigned_commits_without_identity_not_fatal L1737–1742
+ test_unsigned_commits_without_identity_reported_in_result method method test_unsigned_commits_without_identity_reported_in_result L1744–1748
+ test_zero_unsigned_skipped_when_all_signed method method test_zero_unsigned_skipped_when_all_signed L1750–1755
+ _make_ed25519_key function function _make_ed25519_key L1486–1489
+ _make_signing_identity function function _make_signing_identity L1499–1502
+ _pubkey_str function function _pubkey_str L1492–1496
+ _write_unsigned_commit function function _write_unsigned_commit L1505–1512
~ _read_raw_commit
Older feat: add progressive re-signing to muse code migrate sha256:bb9e7203e470365c85ba1d82ab3f45b5a8d0bc330018a117a82ea305959fc385 All commits
Newer → Latest on task/migrate-signing

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:d5f79d21e6927f2763ca88b1d82fb4745702895174908ee8ca4fddde5656d5f3 --body "your comment"