feat: Phase 2 — key rotation commits to identity repo
- Add _commit_key_rotation_to_identity_repo() in musehub_auth.py: reads the current HEAD IdentityRecord, replaces pubkey with the newly rotated key, and commits the updated record to the identity repo's main branch. No-op when identity repo doesn't exist yet (migration-period safety).
- Wire into add_key_for_identity() immediately after the key DB row is committed, so every rotation produces a tamper-evident audit entry in the identity repo's commit history.
- Add tests/test_identity_repo_phase2.py: 7 TDD regression tests covering: second commit appears after rotation, third commit after second rotation, commit message contains handle, updated pubkey in HEAD record, original commit immutability, handle/type preserved, second rotation reflects latest pubkey. All 7 GREEN.
Closes #19 Phase 2
0 comments
muse hub commit comment sha256:23bb5b9df34f65b3af3d477353e744877eda75e294268d06b7f497779b748d70 --body "your comment"
No comments yet. Be the first to start the discussion.