security: mnemonic_to_seed returns bytearray; zero seeds at all call sites
- mnemonic_to_seed() return type bytes -> bytearray so callers can wipe the 64-byte root seed from heap after use (previously immutable, never zeroable) - All auth.py call sites zero operator_seed, agent_sub_seed, and seed immediately after last use (generate_hd_keypair / derive_agent_sub_seed) - Add tests/test_seed_zeroing.py (5 tests: return type, mutability, determinism, length, passphrase variant) — RED before this commit - Add tests/test_agent_sub_seed_zeroing.py (5 tests: return type, mutability, intermediates zeroed, determinism, length) — validates prior commit too
sha256:1b7335af1da84059c62c6657ca0925e250ead304ce925c7b7ad469ad5501ecd4
sha
sha256:8f1d86346b2e89393e5d570a22bbc05e16ae92051fbe6b498059aa3e404c6d1b
snapshot
0 comments
To add a comment, use the Muse CLI:
muse hub commit comment sha256:1b7335af1da84059c62c6657ca0925e250ead304ce925c7b7ad469ad5501ecd4 --body "your comment"
No comments yet. Be the first to start the discussion.