gabriel / musehub public
feat BREAKING attestations task/attestations-phase1 #1 / 1
AI Agent gabriel · 124 days ago · May 7, 2026 · Diff

feat(attestations): Phase 1 — claim-type registry, scope, expiry, 52 tests GREEN

- DB-backed claim type registry (musehub_attestation_claim_types) with 17 seed types across identity / trust / collab / code / music / skill categories - Attestation scope: identity | repo | commit; scope_ref binds to handle/repo@sha256:... - Canonical ATTEST message appends scope_ref for non-identity scope (domain-separated from MSign and MPay prefixes to prevent cross-protocol replay) - issue_attestation: validates claim type + scope + sig before persisting; idempotent via ON CONFLICT DO NOTHING with IntegrityError fallback for concurrent callers - get_attestations_for_commit / get_attestations_for_repo: new query surfaces - verify_stored_attestation: key-rotation-safe using stored attester_public_key - add_claim_type / deprecate_claim_type: runtime registry extension - Migration 0043: idempotent DDL + seed, widens subject to VARCHAR(128), adds scope/scope_ref/repo_id/commit_id/expires_at columns + indexes - API: GET /api/profiles/attestation-types (before /{handle} to avoid param capture), POST/DELETE/GET attestation routes with scope-aware subject validation - Test conftest: re-seeds claim types table after each TRUNCATE; session_factory fixture for concurrent stress tests - 52 TDD tests covering 7 tiers: unit, integration, E2E, stress, data integrity, performance, security

sha256:9254c5d6da0544ee3ffd22f7e89095fa6ec0015846be3620f27314b92121de4d sha
sha256:d9c51d610099345c4e85c8bad76ae0914fdf933c193dab22695b5a4f533030e2 parent
+42 ~38 −2 symbols
sha256:2fb2f85d1ed1e48c8ec7585d474b146418b9390990b03f9a8998a677779d9573 snapshot
+42
symbols added
~38
symbols modified
−2
symbols removed
0
dead code introduced
Semantic Changes 82 symbols
~ alembic/versions/0043_attestation_claim_types_and_scope.py .py 12 symbols added
+ _SEED_TYPES variable variable _SEED_TYPES L18–36
+ branch_labels variable variable branch_labels L14–14
+ depends_on variable variable depends_on L15–15
+ down_revision variable variable down_revision L13–13
+ downgrade function function downgrade L131–156
+ ARRAY import import ARRAY L10–10
+ JSONB import import JSONB L10–10
+ annotations import import annotations L6–6
+ op import import op L9–9
+ sa import import sa L8–8
+ revision variable variable revision L12–12
+ upgrade function function upgrade L39–128
~ musehub/api/routes/api/profiles.py .py 2 symbols added, 9 symbols modified
+ ClaimTypeListResponse import import ClaimTypeListResponse L17–17
+ list_attestation_types function async_function list_attestation_types L37–46
~ AttestationListResponse
~ AttestationRequest
~ AttestationResponse
~ MPayClaimRequest
~ MPayClaimResponse
~ MPayLedgerResponse
~ ProfileManifest
~ issue_attestation
~ revoke_attestation
~ musehub/db/musehub_models.py .py 1 symbol added, 1 symbol modified
+ MusehubAttestationClaimType class class MusehubAttestationClaimType L1646–1672
~ MusehubAttestation
~ musehub/models/musehub.py .py 3 symbols added, 4 symbols modified
+ _validate_scope_fields method method _validate_scope_fields L2707–2713
+ ClaimTypeListResponse class class ClaimTypeListResponse L2753–2757
+ ClaimTypeRecord class class ClaimTypeRecord L2742–2750
~ AttestationBadge
~ AttestationListResponse
~ AttestationRequest
~ AttestationResponse
~ musehub/services/musehub_attestations.py .py 22 symbols added, 2 symbols removed, 11 symbols modified
− Encoding import import Encoding L19–19
− PublicFormat import import PublicFormat L19–19
+ _CLAIM_TYPES variable variable _CLAIM_TYPES L48–69
+ _DEPRECATED_TYPES variable variable _DEPRECATED_TYPES L73–73
+ _VALID_SCOPES variable variable _VALID_SCOPES L75–75
+ _extract_claim_type function function _extract_claim_type L232–238
+ _row_to_response function function _row_to_response L241–256
+ add_claim_type function async_function add_claim_type L644–683
+ build_canonical_message function function build_canonical_message L170–189
+ deprecate_claim_type function async_function deprecate_claim_type L686–702
+ get_attestations_for_commit function async_function get_attestations_for_commit L482–507
+ get_attestations_for_repo function async_function get_attestations_for_repo L514–536
+ get_claim_type function function get_claim_type L82–92
+ get_claim_type_from_db function async_function get_claim_type_from_db L601–614
+ Any import import Any L25–25
+ ClaimTypeListResponse import import ClaimTypeListResponse L33–33
+ ClaimTypeRecord import import ClaimTypeRecord L33–33
+ annotations import import annotations L20–20
+ list_claim_types function function list_claim_types L95–103
+ list_claim_types_from_db function async_function list_claim_types_from_db L617–641
+ parse_scope_ref function function parse_scope_ref L131–163
+ validate_claim_for_issue function function validate_claim_for_issue L106–114
+ validate_scope_for_claim function function validate_scope_for_claim L117–128
+ verify_stored_attestation function async_function verify_stored_attestation L543–577
~ _canonical_message
~ attestation_to_badge
~ get_attestations_by_attester
~ get_attestations_for_subject
~ AttestationBadge
~ AttestationListResponse
~ AttestationRequest
~ AttestationResponse
~ issue_attestation
~ revoke_attestation
~ verify_attestation_signature
~ tests/conftest.py .py 1 symbol added, 2 symbols modified
+ session_factory function async_function session_factory L317–319
~ _db_schema
~ db_session
~ tests/test_attestations_phase1.py .py 1 symbol added, 11 symbols modified
+ real_keypair function function real_keypair L542–544
~ TestAttestationAPIRoundTrip
~ test_e2e_claim_types_endpoint
~ test_e2e_commit_scope_not_in_profile_list
~ test_e2e_create_and_list_identity_scope
~ test_e2e_revoke_removes_from_listing
~ test_e2e_unknown_type_returns_400
~ _req
~ _sign
~ test_p2_commit_query_under_20ms
~ test_s1_concurrent_identical_issue_is_idempotent
~ test_s2_many_distinct_attestations
← Older Oldest on task/attestations-phase1
All commits
Newer → Latest on task/attestations-phase1

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:9254c5d6da0544ee3ffd22f7e89095fa6ec0015846be3620f27314b92121de4d --body "your comment"