mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-10-23 03:47:00 +09:00
558f194506
* fix(witness): support pinned signing keys and label legacy signatures The default witness seed is derived from the public git commit, so anyone can re-sign a modified manifest; verify.mjs still called the result cryptographically valid. Add RUFLO_WITNESS_SEED for external-key signing and RUFLO_WITNESS_PUBLIC_KEY for pinned verification (fail closed on external-key manifests without a pin), tag legacy manifests as self-attested, and stop describing the default as authorship proof. * fix(witness): make --public-key win over the env pin The env-var precedence audit requires a CLI flag for RUFLO_WITNESS_PUBLIC_KEY. Add --public-key, document that it takes precedence, and cover both precedence directions in the auth test. * fix(ci): exclude witness-auth test from vitest ratchet (uses node:test) plugins/ruflo-core/scripts/witness/__tests__/witness-auth.test.mjs imports from node:test, not vitest, matching the same miscategorization pattern as pod-tick.test.mjs and probe-mod-guards.test.mjs. vitest's glob picks it up but can't parse node:test's API, so the ratchet reports "No test suite found" even though `node --test` passes all 3 cases cleanly. Co-Authored-By: RuFlo <ruv@ruv.net> --------- Co-authored-by: r <r@x> Co-authored-by: RuFlo <ruv@ruv.net>
1.3 KiB
1.3 KiB
name, description, argument-hint
| name | description | argument-hint |
|---|---|---|
| witness | Manage and verify a tamper-evident fix manifest with temporal history (ADR-103) | init|regen|verify|history|regressions [--manifest <path>] [--history <path>] |
$ARGUMENTS
Run the appropriate witness sub-command. Defaults assume verification.md.json and verification-history.jsonl at the project root.
# Bootstrap (one-time per project)
node plugins/ruflo-core/scripts/witness/init.mjs
# Regen + append history (each release)
node plugins/ruflo-core/scripts/witness/regen.mjs \
--manifest verification.md.json \
--history verification-history.jsonl \
--fixes witness-fixes.json
# Verify against live tree
node plugins/ruflo-core/scripts/witness/verify.mjs --manifest verification.md.json
# Verify without dependencies or generated dist/ artifacts
node plugins/ruflo-core/scripts/witness/verify.mjs \
--manifest verification.md.json --source-only
# Temporal queries
node plugins/ruflo-core/scripts/witness/history.mjs --history verification-history.jsonl summary
node plugins/ruflo-core/scripts/witness/history.mjs --history verification-history.jsonl regressions
node plugins/ruflo-core/scripts/witness/history.mjs --history verification-history.jsonl timeline --id <fix-id>
See plugins/ruflo-core/skills/witness/SKILL.md for the full workflow + anti-patterns.