gabriel / musehub public
feat patch task/identity-repo-phase2 #1 / 1
AI Agent gabriel · 143 days ago · May 1, 2026 · Diff

feat: Phase 2 — key rotation commits to identity repo

- Add _commit_key_rotation_to_identity_repo() in musehub_auth.py: reads the current HEAD IdentityRecord, replaces pubkey with the newly rotated key, and commits the updated record to the identity repo's main branch. No-op when identity repo doesn't exist yet (migration-period safety).

- Wire into add_key_for_identity() immediately after the key DB row is committed, so every rotation produces a tamper-evident audit entry in the identity repo's commit history.

- Add tests/test_identity_repo_phase2.py: 7 TDD regression tests covering: second commit appears after rotation, third commit after second rotation, commit message contains handle, updated pubkey in HEAD record, original commit immutability, handle/type preserved, second rotation reflects latest pubkey. All 7 GREEN.

Closes #19 Phase 2

sha256:23bb5b9df34f65b3af3d477353e744877eda75e294268d06b7f497779b748d70 sha
sha256:fc7dd68fc1f263774922ef1016d57e4b6fd828cbdaab4e32fd8729c3b60eecc5 parent
+30 ~1 symbols
sha256:658a4b9700b32f1bc558ba81a52435f9e610e2cf1493c53a7b641463df75c109 snapshot
+30
symbols added
~1
symbol modified
0
dead code introduced
Semantic Changes 31 symbols
~ tests/test_identity_repo_phase2.py .py 29 symbols added
+ TestRotationCreatesCommit class class TestRotationCreatesCommit L144–192
+ test_rotation_adds_second_commit_to_identity_repo method async_method test_rotation_adds_second_commit_to_identity_repo L145–158
+ test_rotation_commit_message_identifies_handle method async_method test_rotation_commit_message_identifies_handle L178–192
+ test_second_rotation_adds_third_commit method async_method test_second_rotation_adds_third_commit L160–176
+ TestRotationUpdatesPubkey class class TestRotationUpdatesPubkey L200–271
+ test_initial_record_pubkey_unchanged_in_history method async_method test_initial_record_pubkey_unchanged_in_history L219–235
+ test_rotation_preserves_handle_and_type method async_method test_rotation_preserves_handle_and_type L237–250
+ test_rotation_updates_pubkey_in_identity_record method async_method test_rotation_updates_pubkey_in_identity_record L201–217
+ test_second_rotation_reflects_latest_pubkey method async_method test_second_rotation_reflects_latest_pubkey L252–271
+ _get_identity_commits function async_function _get_identity_commits L90–106
+ _keypair function function _keypair L35–38
+ _read_identity_record_from_commit function async_function _read_identity_record_from_commit L109–136
+ _register function async_function _register L46–66
+ _rotate function async_function _rotate L69–87
+ _sign_nonce function function _sign_nonce L41–43
+ AsyncSession import import AsyncSession L21–21
+ Ed25519PrivateKey import import Ed25519PrivateKey L18–18
+ add_key_for_identity import import add_key_for_identity L25–25
+ annotations import import annotations L13–13
+ b64url_encode import import b64url_encode L23–23
+ create_challenge import import create_challenge L25–25
+ db import import db L24–24
+ encode_pubkey import import encode_pubkey L19–19
+ encode_sig import import encode_sig L19–19
+ json import import json L15–15
+ key_fingerprint import import key_fingerprint L23–23
+ pytest import import pytest L17–17
+ select import import select L20–20
+ verify_and_authenticate import import verify_and_authenticate L25–25
~ musehub/services/musehub_auth.py .py 1 symbol added, 1 symbol modified
+ _commit_key_rotation_to_identity_repo function async_function _commit_key_rotation_to_identity_repo L142–219
~ add_key_for_identity
← Older Oldest on task/identity-repo-phase2
All commits
Newer → Latest on task/identity-repo-phase2

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:23bb5b9df34f65b3af3d477353e744877eda75e294268d06b7f497779b748d70 --body "your comment"