feat: muse auth rotate — HD key rotation to next index (HIGH-4)
New subcommand: muse auth rotate --hub <url> [--passphrase P] [--json]
Reads the current identity's hd_path to find the active rotation index (the 6th path component: m/purpose'/domain'/entity'/id'/role'/N'). Derives a new Ed25519 identity key at index N+1, overwrites the PEM, and updates identity.toml. The operator then re-registers the new fingerprint with 'muse auth register'.
Supporting changes: muse/core/keypair.py — generate_hd_keypair gains rotation_index param (default 0, fully backward compatible) muse/cli/commands/auth.py — _parse_rotation_index() helper, run_rotate(), rotate subparser registered in register()
Tests (tests/test_auth_rotate.py — 10 tests): I1-I4 basic rotation: different fingerprint, index increments, deterministic II1-3 --json fields, --passphrase and MUSE_BIP39_PASSPHRASE flow through III1-3 guard rails: no identity → fails; PEM is valid Ed25519; toml updated
0 comments
muse hub commit comment sha256:16d36a7fd82056419e2f4ffa62fcc0ebcf4fde11429f7a9d69a48a27ef014a45 --body "your comment"
No comments yet. Be the first to start the discussion.