feat(cli): single-command agent provisioning ergonomics and passphrase harmonization - #409
Conversation
Auths Commit Verification
Result: ❌ 0/12 commits verified How to fixCommit 1. Install auths macOS: 2. One-time setup (creates your identity and configures Git) auths init3. Sign this branch and push auths sign origin/main..HEAD
git push --force-with-leaseFor CI to verify the signer, commit an identity bundle: auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
Auths Commit Verification
Result: ❌ 0/13 commits verified How to fixCommit 1. Install auths macOS: 2. One-time setup (creates your identity and configures Git) auths init3. Sign this branch and push auths sign origin/main..HEAD
git push --force-with-leaseFor CI to verify the signer, commit an identity bundle: auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
Auths Commit Verification
Result: ❌ 0/14 commits verified How to fixCommit 1. Install auths macOS: 2. One-time setup (creates your identity and configures Git) auths init3. Sign this branch and push auths sign origin/main..HEAD
git push --force-with-leaseFor CI to verify the signer, commit an identity bundle: auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
Auths Commit Verification
Result: ❌ 0/15 commits verified How to fixCommit 1. Install auths macOS: 2. One-time setup (creates your identity and configures Git) auths init3. Sign this branch and push auths sign origin/main..HEAD
git push --force-with-leaseFor CI to verify the signer, commit an identity bundle: auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
Auths Commit Verification
Result: ❌ 0/16 commits verified How to fixCommit 1. Install auths macOS: 2. One-time setup (creates your identity and configures Git) auths init3. Sign this branch and push auths sign origin/main..HEAD
git push --force-with-leaseFor CI to verify the signer, commit an identity bundle: auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
Auths Commit Verification
Result: ❌ 0/17 commits verified How to fixCommit 1. Install auths macOS: 2. One-time setup (creates your identity and configures Git) auths init3. Sign this branch and push auths sign origin/main..HEAD
git push --force-with-leaseFor CI to verify the signer, commit an identity bundle: auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
b79d84d to
3c0640b
Compare
Auths Commit Verification
Result: ❌ 0/18 commits verified How to fixCommit 1. Install auths macOS: 2. One-time setup (creates your identity and configures Git) auths init3. Sign this branch and push auths sign origin/main..HEAD
git push --force-with-leaseFor CI to verify the signer, commit an identity bundle: auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
3c0640b to
3c201e9
Compare
Auths Commit Verification
Result: ❌ 0/18 commits verified How to fixCommit 1. Install auths macOS: 2. One-time setup (creates your identity and configures Git) auths init3. Sign this branch and push auths sign origin/main..HEAD
git push --force-with-leaseFor CI to verify the signer, commit an identity bundle: auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
3c201e9 to
bac6a8d
Compare
Auths Commit Verification
Result: ❌ 0/18 commits verified How to fixCommit 1. Install auths macOS: 2. One-time setup (creates your identity and configures Git) auths init3. Sign this branch and push auths sign origin/main..HEAD
git push --force-with-leaseFor CI to verify the signer, commit an identity bundle: auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
bac6a8d to
3348fae
Compare
Auths Commit Verification
Result: ❌ 0/18 commits verified How to fixCommit 1. Install auths macOS: 2. One-time setup (creates your identity and configures Git) auths init3. Sign this branch and push auths sign origin/main..HEAD
git push --force-with-leaseFor CI to verify the signer, commit an identity bundle: auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
…ergonomics Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y Auths-Anchor-Seq: 70 Auths-Scope: sign_commit
…agent provision Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y Auths-Anchor-Seq: 70 Auths-Scope: sign_commit
Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y Auths-Anchor-Seq: 70 Auths-Scope: sign_commit
… completion Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y Auths-Anchor-Seq: 70 Auths-Scope: sign_commit
…g sign_with_key and extract_public_key_bytes Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y Auths-Anchor-Seq: 70 Auths-Scope: sign_commit
…orage through sign_with_key Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y Auths-Anchor-Seq: 70 Auths-Scope: sign_commit
…nd add e2e agent provisioning tests Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y Auths-Anchor-Seq: 70 Auths-Scope: sign_commit
…phrase prompts on SE hardware keys Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y Auths-Anchor-Seq: 70 Auths-Scope: sign_commit
…provisioning.py Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y Auths-Anchor-Seq: 70 Auths-Scope: sign_commit
….se handles in store_key Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
…less agent signing Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
…y, sign_raw in Arc and Box KeyStorage impls Auths-Scope: sign_commit Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
…warding Auths-Scope: sign_commit Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths-Scope: sign_commit Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
…th and clean .auths/roots Auths-Scope: sign_commit Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths-Scope: sign_commit Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths Commit Verification
Result: ❌ 0/1 commits verified How to fixCommit |
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
…uths into dev-agenticSigningErgonomics Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths Commit Verification
Result: ❌ 9/27 commits verified (1 skipped) How to fixCommit auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths Commit Verification
Result: ❌ 9/29 commits verified (1 skipped) How to fixCommit auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths Commit Verification
Result: ❌ 9/30 commits verified (1 skipped) How to fixCommit auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths Commit Verification
Result: ❌ 9/32 commits verified (1 skipped) How to fixCommit |
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths Commit Verification
Result: ❌ 9/33 commits verified (1 skipped) How to fixCommit |
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths Commit Verification
Result: ❌ 9/34 commits verified (1 skipped) How to fixCommit |
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths Commit Verification
Result: ❌ 9/35 commits verified (1 skipped) How to fixCommit |
…elp block Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths Commit Verification
Result: ❌ 9/36 commits verified (1 skipped) How to fixCommit |
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths Commit Verification
Result: ❌ 9/37 commits verified (1 skipped) How to fixCommit |
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6 Auths-Anchor-Seq: 1
Auths Commit Verification
Result: ❌ 9/38 commits verified (1 skipped) How to fixCommit |
Summary
Closes #382
Implements single-command agent provisioning ergonomics and resolves device key signing passphrase harmonization bugs across key storage backends.
Key Changes
auths agent provision):--label,--key,--profile,--out,--passphrase-file,--repo.env.sh), and helper wrapper (bin/auths-agent).AgentProvisionPassphraseProvider):main) decryption prompts to CLI/environment providers while supplying agent passphrase for agent key operations.is_hardware_key,rebind_identity,export_public_key, andsign_rawforwarding forArc<dyn KeyStorage>andBox<dyn KeyStorage>implementations to prevent fallback tois_hardware_backend()on wrapped software keys.SecureEnclaveKeyStorage::store_keypurges stale.sehandle files when writing.swkeysoftware keys to prevent handle collisions.tests/e2e/test_agent_provisioning.py.test_arc_and_box_forward_is_hardware_keyinauths-core.