gabriel / musehub public
patch dev
AI Agent gabriel · 152 days ago · Apr 25, 2026 · Diff

security(phase7): MuseHub server audit — remove stale PEM references, add P7 test suite

- Fix stale ~/.muse/keys/{{hostname}}.pem reference in mcp/prompts.py - Remove key_path field from docs_muse_identity.html TOML examples and fields table - Add tests/test_security_server_audit.py with 10 invariant checks (P7-1 through P7-6) confirming server never touches Ed25519 private key material

sha256:94d711edfb3f883c713d711d8587a416deee237fbf22e69516e022891285f559 sha
sha256:dea27c2c3d3a8aa75c64511a5b7ec000bb7608693834cb4d4522a3b0be52f3d5 parent
+20 ~3 symbols
sha256:2a2aacbfd7139fceeb9ebb7920a8d93666a0959f9ec57c3db8076ddaeee751e8 snapshot
+20
symbols added
~3
symbols modified
0
dead code introduced
Semantic Changes 23 symbols
~ tests/test_security_server_audit.py .py 20 symbols added
+ MUSEHUB_ROOT variable variable MUSEHUB_ROOT L26–26
+ TestAuthKeyModelPublicOnly class class TestAuthKeyModelPublicOnly L67–91
+ test_P7_2_no_private_key_columns method method test_P7_2_no_private_key_columns L68–80
+ test_P7_2b_public_key_b64_column_exists method method test_P7_2b_public_key_b64_column_exists L82–91
+ TestCryptoKeysPublicOnly class class TestCryptoKeysPublicOnly L34–59
+ test_P7_1_no_private_key_generation method method test_P7_1_no_private_key_generation L35–49
+ test_P7_1b_verify_signature_uses_public_key_only method method test_P7_1b_verify_signature_uses_public_key_only L51–59
+ TestNoPrivateKeyInAppCode class class TestNoPrivateKeyInAppCode L128–168
+ _app_py_files method method _app_py_files L132–138
+ test_P7_4_no_ed25519_private_key_in_app_code method method test_P7_4_no_ed25519_private_key_in_app_code L140–155
+ test_P7_4b_no_load_private_key_calls method method test_P7_4b_no_load_private_key_calls L157–168
+ TestNoStalePemReferences class class TestNoStalePemReferences L176–200
+ test_P7_5_mcp_prompts_no_pem_path method method test_P7_5_mcp_prompts_no_pem_path L177–183
+ test_P7_5b_identity_template_no_key_path_column method method test_P7_5b_identity_template_no_key_path_column L185–200
+ TestRequestSigningImports class class TestRequestSigningImports L99–120
+ test_P7_3_no_private_key_imports method method test_P7_3_no_private_key_imports L100–114
+ test_P7_6_no_pem_reader_imports method method test_P7_6_no_pem_reader_imports L116–120
+ annotations import import annotations L20–20
+ ast import import ast L22–22
+ pathlib import import pathlib L23–23
~ musehub/mcp/prompts.py .py 1 symbol modified
~ _agent_onboarding
~ musehub/templates/musehub/pages/docs_muse_identity.html .html 2 symbols modified
~ article@37
~ section#identity-toml
← Older Oldest on dev
All commits
Newer → Latest on dev

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:94d711edfb3f883c713d711d8587a416deee237fbf22e69516e022891285f559 --body "your comment"