ai/byre
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 15 Wiki Activity

Fix inconsistencies found by consistency audit of 395f76e

Browse Source
This commit is contained in:
Ian Gulliver
2026-10-23 11:48:42 -07:00
parent 836d3019ac
commit f1d3f9be61
17 changed files with 376 additions and 362 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/operations.md
+1 -1
View File
@@ -104,7 +104,7 @@ Coordination of merges, discards, reviews, ready-for-merge prompts, workflow sta
## Signing merges
byre never signs with a key on the machine it runs on: every git command it runs there, except `git config`, gets `-c commit.gpgsign=false`, so its end-of-turn, snapshot and merge-in commits stay unsigned whatever the server's config says. A signing program left to run under the launchd service can wait forever on a prompt nobody sees (`ac-sign` waiting on AppleConnect did), and the turn would never end. Those commits never reach the default branch anyway; the squash replaces them. When a project checkout's `commit.gpgsign` is true (`git -C <checkout> config --type=bool --get commit.gpgsign` prints it), the squash commit of a merge is signed on the merging user's most recently active Mac, so a key that never leaves that Mac's Secure Enclave and needs a fingerprint works. The Mac runs its own git signing config, as git does: `gpg.format` (`openpgp` or `x509`; `ssh` is not supported), the program when it isn't `gpg`/`gpgsm`, and `user.signingkey` when the program can't find the key from the user's byre git identity (not the Mac's `user.email`). The program must print `[GNUPG:] SIG_CREATED ` on its status fd, as git requires. A Touch ID prompt left unanswered for 2 minutes fails the merge. The notes commit is not signed.
byre never signs with a key on the Mac it runs on: every git command it runs there, except `git config`, gets `-c commit.gpgsign=false`, so its end-of-turn, snapshot and merge-in commits stay unsigned whatever the server's config says. A signing program left to run under the launchd service can wait forever on a prompt nobody sees (`ac-sign` waiting on AppleConnect did), and the turn would never end. Those commits never reach the default branch anyway; the squash replaces them. When a project checkout's `commit.gpgsign` is true (`git -C <checkout> config --type=bool --get commit.gpgsign` prints it), the squash commit of a merge is signed on the merging user's most recently active Mac, so a key that never leaves that Mac's Secure Enclave and needs a fingerprint works. The Mac runs its own git signing config, as git does: `gpg.format` (`openpgp` or `x509`; `ssh` is not supported), the program when it isn't `gpg`/`gpgsm`, and `user.signingkey` when the program can't find the key from the user's byre git identity (not the Mac's `user.email`). The program must print `[GNUPG:] SIG_CREATED ` on its status fd, as git requires. A Touch ID prompt left unanswered for 2 minutes fails the merge. The notes commit is not signed.
`byre signing <checkout>` turns it on for a project; agents learn it from the `signing` knowledge-base article. It sets `commit.gpgsign` true in the checkout; a global `commit.gpgsign` true on the server does the same for every project. Agents' own `git commit` in a task worktree reads that config and runs the signing program on the server. No restart is needed; `git -C <checkout> cat-file commit HEAD` shows the `gpgsig` header.