fix: sha256:2c28ee2f8955ec67b41a9f8606a52d873631c2ded2a7082b06de44fe37bbb45b · gabriel/muse

fix: muse commit --sign now works for human identities, not just agents (musehub#96, #97)

Discovered while recording Build with Muse episode 04, 'Identity, Without Passwords' -- muse commit -m '...' --sign as a human with a registered identity (muse auth whoami: type=human, key_set=true) silently produced an unsigned commit. No warning, no error -- muse verify-commit reported valid=false.

Root cause (musehub#96): the signing-resolution block in muse/cli/commands/commit.py was gated on 'sign and resolved_agent_id'. A human commit has no --agent-id/MUSE_AGENT_ID, so resolved_agent_id is '' (falsy) and the entire block -- including the call to get_signing_identity() -- was skipped. get_signing_identity() already supports human-key resolution when agent_id is None/falsy (it falls back to the human entry in ~/.muse/identity.toml), and sign_commit_record() accepts an empty-string agent_id fine (it's metadata-only, not part of key resolution). The gate at the call site was the only thing preventing human signing from working.

Fix: changed the gate to 'if sign:' and pass agent_id=resolved_agent_id or None so empty string and None are treated identically.

Second bug (musehub#97), same code path: the warning branch was unreachable for human commits before this fix (the outer gate skipped it entirely), so a human commit with --sign and NO identity configured would also silently succeed unsigned. Now that the gate lets human commits reach the warning branch, split the message on whether resolved_agent_id is set so a human commit gets human-appropriate phrasing ('No signing identity found -- commit will be unsigned') instead of the agent-phrased 'No signing identity found for agent ''.'

Also updated --sign's --help text, which claimed signing 'requires --agent-id or MUSE_AGENT_ID' -- no longer true.

Verified end-to-end against the fixed muse-dev CLI in a disposable scratch repo (not canonical): muse commit -m ... --sign with no --agent-id now produces a commit with a non-empty signer_public_key, and muse verify-commit reports valid=true.

Added TestSignFlagWorksForHumanIdentity to test_commit_sign_config.py: - test_sign_without_agent_id_produces_signed_commit (musehub#96 regression) - test_sign_without_agent_id_and_no_identity_warns_human_phrasing (musehub#97 regression) - test_sign_with_agent_id_and_no_identity_still_warns_agent_phrasing (no-regression guard)

Confirmed all three fail without the fix (reverted locally, reran, restored) and pass with it. Full tests/test_commit_sign_config.py (17/17) and tests/test_cmd_commit.py (97/97) pass.

Closes musehub staging#96, musehub staging#97.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

+13

symbols added

symbols modified

files changed

1198

files in snapshot

dead code introduced

Semantic Changes 15 symbols

~ docs/issues/issue-1-sign-agent-only.md .md 5 symbols added

+ muse commit --sign is agent-only, silently no-ops for human commits section muse commit --sign is agent-only, silently no-ops for human commits L1–69

+ Acceptance criteria section Acceptance criteria L62–69

+ Background section Background L3–30

+ Fix section Fix L56–61

+ Root cause section Root cause L31–55

~ docs/issues/issue-2-sign-silent-failure.md .md 4 symbols added

+ muse commit --sign fails silently when no identity is resolvable for a human commit section muse commit --sign fails silently when no identity is resolvable for a human commit L1–63

+ Acceptance criteria section Acceptance criteria L57–63

+ Background section Background L3–36

+ Fix section Fix L37–56

~ muse/cli/commands/commit.py .py 2 symbols modified

~ register

~ run

~ tests/test_commit_sign_config.py .py 4 symbols added

+ TestSignFlagWorksForHumanIdentity class class TestSignFlagWorksForHumanIdentity L213–260

+ test_sign_with_agent_id_and_no_identity_still_warns_agent_phrasing method method test_sign_with_agent_id_and_no_identity_still_warns_agent_phrasing L248–260

+ test_sign_without_agent_id_and_no_identity_warns_human_phrasing method method test_sign_without_agent_id_and_no_identity_warns_human_phrasing L232–246

+ test_sign_without_agent_id_produces_signed_commit method method test_sign_without_agent_id_produces_signed_commit L218–230

Files Changed

+2 ~2

1198 in snapshot

+ docs/issues/issue-1-sign-agent-only.md .md

+ docs/issues/issue-2-sign-silent-failure.md .md

~ muse/cli/commands/commit.py .py

~ tests/test_commit_sign_config.py .py

← Older Oldest on task/musehub-96-97-sign-human-identity

All commits

Newer → Latest on task/musehub-96-97-sign-human-identity

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:2c28ee2f8955ec67b41a9f8606a52d873631c2ded2a7082b06de44fe37bbb45b --body "your comment"