matrixscroll 0.2.0__tar.gz → 0.2.2__tar.gz

{matrixscroll-0.2.0 → matrixscroll-0.2.2}/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to the Matrix Scroll Python SDK are documented here. The
 format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.2] - 2026-06-20
+
+Policy flags for CI and release gates.
+
+### Added
+- **CLI policy flags** — `matrixscroll verify` and `matrixscroll envelope-verify` accept
+  `--require-mode` and `--trusted-keys` (JSON policy file), wired to
+  `verify_manifest_with_policy()`.
+
+## [0.2.1] - 2026-06-20
+
+Windows and cross-platform commit envelope fix.
+
+### Fixed
+- **`parse_commit()` on Windows** — read author/committer timezone from `git cat-file commit`
+  instead of reconstructing dates with `%z` (unsupported in `git show` format on Windows).
+
 ## [0.2.0] - 2026-06-20
 
 Agent provenance release: Git commit envelopes, SDK module split, CI scaffolding.

{matrixscroll-0.2.0 → matrixscroll-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: matrixscroll
-Version: 0.2.0
+Version: 0.2.2
 Summary: Open protocol for signing AI-assisted code provenance with Ed25519; shipping software root of trust with SSX360 hardware support in progress.
 Project-URL: Homepage, https://matrixscroll.com
 Project-URL: Documentation, https://matrixscroll.com/docs
@@ -37,15 +37,14 @@ Description-Content-Type: text/markdown
 
 # Matrix Scroll
 
-**Open protocol for signed AI-assisted code provenance.**
+**Signed provenance for agent-assisted Git commits — verify offline, one command.**
 
-Every AI-generated change in your IDE can be cryptographically signed by an
-Ed25519 identity and verified offline with a public key and one command. The
-v0.2.x reference implementation ships a well-tested software root of trust
-with Git commit-envelope hooks; SSX360/NXP SE050 hardware signing is the
-compatible reference-device path in progress.
+Matrix Scroll is a cryptographic evidence layer: when an AI agent (Cursor, Claude Code, Copilot, etc.) produces a commit, a signed **commit envelope** records actor, tool, and optional scope. Verify locally or in CI without trusting the IDE. The v0.2.x reference SDK ships an emulated Ed25519 root of trust with Git hooks; SSX360/NXP SE050 hardware signing is the compatible reference-device path in progress.
+
+Matrix Scroll is **not** an IAM system, agent sandbox, or prompt-injection filter — it complements those controls with tamper-evident signatures.
 
 - 📜 **Spec:** [`SPEC.md`](SPEC.md) — wire format, canonical encoding, schemas.
+- 📄 **Whitepaper:** [`docs/WHITEPAPER.md`](docs/WHITEPAPER.md) — why Git commits, implementation guide.
 - 🛡 **Agentic AI controls:** [`docs/AGENTIC_AI_SECURITY.md`](docs/AGENTIC_AI_SECURITY.md)
   maps Matrix Scroll to the joint *Careful Adoption of Agentic AI Services* guidance.
 - 🔐 **Algorithm:** Ed25519 (RFC 8032). Private keys are never exposed by the SDK API.
@@ -100,7 +99,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and run
 - uses: SSX360/matrixscroll-verify-action@v1
   with:
     manifest: examples/agentic_ai_evidence_manifest.signed.json
-    matrixscroll-version: "0.2.0"
+    matrixscroll-version: "0.2.2"
 ```
 
 ## CLI

{matrixscroll-0.2.0 → matrixscroll-0.2.2}/README.md

@@ -1,14 +1,13 @@
 # Matrix Scroll
 
-**Open protocol for signed AI-assisted code provenance.**
+**Signed provenance for agent-assisted Git commits — verify offline, one command.**
 
-Every AI-generated change in your IDE can be cryptographically signed by an
-Ed25519 identity and verified offline with a public key and one command. The
-v0.2.x reference implementation ships a well-tested software root of trust
-with Git commit-envelope hooks; SSX360/NXP SE050 hardware signing is the
-compatible reference-device path in progress.
+Matrix Scroll is a cryptographic evidence layer: when an AI agent (Cursor, Claude Code, Copilot, etc.) produces a commit, a signed **commit envelope** records actor, tool, and optional scope. Verify locally or in CI without trusting the IDE. The v0.2.x reference SDK ships an emulated Ed25519 root of trust with Git hooks; SSX360/NXP SE050 hardware signing is the compatible reference-device path in progress.
+
+Matrix Scroll is **not** an IAM system, agent sandbox, or prompt-injection filter — it complements those controls with tamper-evident signatures.
 
 - 📜 **Spec:** [`SPEC.md`](SPEC.md) — wire format, canonical encoding, schemas.
+- 📄 **Whitepaper:** [`docs/WHITEPAPER.md`](docs/WHITEPAPER.md) — why Git commits, implementation guide.
 - 🛡 **Agentic AI controls:** [`docs/AGENTIC_AI_SECURITY.md`](docs/AGENTIC_AI_SECURITY.md)
   maps Matrix Scroll to the joint *Careful Adoption of Agentic AI Services* guidance.
 - 🔐 **Algorithm:** Ed25519 (RFC 8032). Private keys are never exposed by the SDK API.
@@ -63,7 +62,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and run
 - uses: SSX360/matrixscroll-verify-action@v1
   with:
     manifest: examples/agentic_ai_evidence_manifest.signed.json
-    matrixscroll-version: "0.2.0"
+    matrixscroll-version: "0.2.2"
 ```
 
 ## CLI

{matrixscroll-0.2.0 → matrixscroll-0.2.2}/docs/AGENTIC_AI_SECURITY.md

@@ -36,9 +36,9 @@ The machine-readable control matrix lives at
 | AAI-04 | Human accountability | Owner, approver, reviewer, break-glass contact, and kill-switch fields are signed. |
 | AAI-05 | Threat modeling | Threats are mapped to strict verification and tamper vectors. |
 | AAI-06 | Secure defaults / validation | Wrong schema, algorithm, device id, malformed key, NaN, and unsigned manifests fail closed. |
-| AAI-07 | Monitoring and auditability | Signed manifests are portable audit records verifiable offline. |
+| AAI-07 | Monitoring and auditability | Signed manifests and **commit envelopes** (`.git/matrixscroll/envelopes/<sha>.json`) are portable audit records verifiable offline. |
 | AAI-08 | Incident response / kill switch | CI/CLI verification exits non-zero; manifests include escalation and shutdown metadata. |
-| AAI-09 | Supply-chain management | Minimal deps, Dependabot, CI build verification, and conformance vectors. |
+| AAI-09 | Supply-chain management | Git post-commit hooks + CI verify-action; minimal deps; Dependabot; conformance vectors. |
 | AAI-10 | Strong authentication / non-repudiation | Ed25519 identity; the planned SSX360 hardware mode keeps private keys out of agent runtimes. |
 | AAI-11 | Governance and change control | CODEOWNERS + CI protect spec/core/vectors/security files. |
 | AAI-12 | Deception / prompt-injection resilience | Trust is verified after agent action; model text cannot forge signatures. |
@@ -63,14 +63,12 @@ Matrix Scroll adds a stronger evidence layer on top:
 ## Recommended deployment pattern
 
 1. Define the agent task as a low-risk, bounded pilot.
-2. Create an evidence manifest like
+2. Install Git hooks (`matrixscroll hook-install`) and set `MATRIXSCROLL_ACTOR_TYPE=agent`.
+3. Create an evidence manifest like
    [`examples/agentic_ai_evidence_manifest.json`](../examples/agentic_ai_evidence_manifest.json).
-3. Have a human owner approve the resource/operation/timeframe scope.
-4. Sign the manifest with `matrixscroll sign`.
-5. Require `matrixscroll verify` in CI before the agent can act or before its
-   output can be accepted.
-6. Retain the signed manifest with logs, SBOM, model/provider metadata, and
-   incident-response records.
+4. Have a human owner approve the resource/operation/timeframe scope.
+5. Sign the manifest with `matrixscroll sign`; require `matrixscroll envelope-verify` on each agent commit in CI.
+6. Retain signed envelopes and manifests with logs, SBOM, and incident-response records.
 
 ## Residual risks outside SDK scope
 

matrixscroll-0.2.2/docs/WHITEPAPER.md

@@ -0,0 +1,144 @@
+# Agent Attestation for Git Commits
+
+**Signed provenance for agent-assisted code changes — verify offline, one command.**
+
+## Executive summary
+
+Agentic coding tools can commit and push code without a durable record of *who* acted (human, agent, or CI) or *which tool* produced the change. Review fatigue and credential theft make software-only gates insufficient. Matrix Scroll adds a cryptographic **commit envelope** — Ed25519-signed metadata bound to each Git commit — that anyone can verify offline or in CI.
+
+This document distills the public product story. The full enterprise architecture lives in internal strategy materials; this whitepaper is scoped to developers, DevSecOps, and auditors adopting the open protocol today.
+
+## Scope and audience
+
+**Audience:** Software engineers using AI-assisted IDEs, platform teams wiring CI gates, security auditors.
+
+**Covers:** Why Git commits are the Day-1 beachhead, protocol overview, install path, honest roadmap.
+
+**Does not cover:** IAM replacement, prompt-injection mitigation, financial transaction gating, or hardware manufacturing details.
+
+**Prerequisites:** Git, Python 3.10+, basic CI familiarity.
+
+## What Matrix Scroll is — and is not
+
+Matrix Scroll is **not** an agent runtime, sandbox, IAM system, or prompt filter. It is a **cryptographic evidence layer**: it signs what an agent (or human) attested at commit time and lets verifiers check that record without trusting the IDE or Matrix Scroll servers.
+
+## Why Git commits first
+
+| Vector | Risk | Why Matrix Scroll fits |
+|--------|------|------------------------|
+| **Git commits** | Rogue agent code, LLM filibustering in review, stolen tokens | Standardized hooks; high-consequence; maps to supply-chain guidance |
+| Financial APIs | Fragmented rails, liability | Defer — integration cost too high for Day 1 |
+| Database writes | Latency, engine sprawl | Defer — per-query hardware signing impractical |
+
+Supply-chain incidents involving agent-assisted merges illustrate the gap: audit logs show *that* a commit landed, not *which actor class and tool* produced it with verifiable scope.
+
+## Regulatory context (verified links)
+
+Five Eyes agencies published joint guidance on careful adoption of agentic AI services:
+
+- [CISA — Careful Adoption of Agentic AI Services](https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services)
+- [ACSC — Careful adoption of agentic AI services](https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services)
+- [Canadian Centre for Cyber Security](https://www.cyber.gc.ca/en/news-events/joint-guidance-careful-adoption-agentic-artificial-intelligence-services)
+- [NCSC-UK — Thinking carefully before adopting agentic AI](https://www.ncsc.gov.uk/blogs/thinking-carefully-before-adopting-agentic-ai)
+
+Matrix Scroll maps these controls in [`docs/AGENTIC_AI_SECURITY.md`](AGENTIC_AI_SECURITY.md), including commit-envelope audit trails for monitoring (AAI-07) and supply-chain evidence (AAI-09).
+
+## Protocol overview
+
+Three layers:
+
+1. **Identity** (`matrixscroll.identity.v1`) — Ed25519 key pair; device id `MS-XXXX-XXXX`
+2. **Commit envelope** (`matrixscroll.commit_envelope.v1`) — commit object fields + provenance (`actor_type`, `tool`, optional scope manifest)
+3. **Verification** — canonical JSON bytes, signature excluded; offline check with embedded public key
+
+Full wire format: [`SPEC.md`](../SPEC.md). Schema: [`schemas/commit-envelope.v1.json`](../schemas/commit-envelope.v1.json).
+
+```
+  agent / IDE / CI
+        │
+        ▼
+  git commit  ──►  post-commit hook signs envelope
+        │
+        ▼
+  .git/matrixscroll/envelopes/<sha>.json
+        │
+        ▼
+  matrixscroll envelope-verify <sha>   (local or CI)
+```
+
+## Step-by-step implementation
+
+### 1. Install
+
+```bash
+pip install "matrixscroll>=0.2.1"
+matrixscroll hook-install
+matrixscroll hook-status
+```
+
+### 2. Agent provenance
+
+```bash
+export MATRIXSCROLL_ACTOR_TYPE=agent
+export MATRIXSCROLL_TOOL=cursor
+git commit -m "feat: agent-assisted change"
+matrixscroll envelope-verify "$(git rev-parse HEAD)"
+```
+
+Hooks default to **warn mode**; set `"enforce": true` in `.git/matrixscroll/config.json` to block commits when signing fails. See [`docs/quickstart-git.md`](quickstart-git.md).
+
+**Windows:** commit-envelope signing requires matrixscroll **0.2.1+** (cat-file parsing fix).
+
+### 3. CI gate
+
+```yaml
+- uses: SSX360/matrixscroll-verify-action@v1
+  with:
+    manifest: path/to/signed-manifest.json
+    matrixscroll-version: "0.2.2"
+    require-mode: emulated
+    trusted-keys: trusted-keys.json
+```
+
+Policy flags (`--require-mode`, `--trusted-keys`) ship in **0.2.2+**.
+
+### 4. Optional scope manifest
+
+Bind agent operations to a signed evidence manifest:
+
+```bash
+export MATRIXSCROLL_AGENT_SCOPE=examples/agentic_ai_evidence_manifest.signed.json
+```
+
+## Trust levels (honest roadmap)
+
+| Level | Provider | Status |
+|-------|----------|--------|
+| **L1 Emulated** | Software key (`~/.matrixscroll/`) | Shipping |
+| **L2 Hardware** | SSX360 / NXP SE050 secure element | In progress |
+| **L3 Attested** | L2 + remote attestation | Roadmap |
+
+YubiKey bridge (PKCS#11 / PIV) documented in [`docs/yubikey-bridge.md`](yubikey-bridge.md).
+
+## Common pitfalls
+
+- **Expecting IAM replacement** — Matrix Scroll proves evidence; you still need least privilege and sandboxing.
+- **Pre-commit expected_id** — v0.2.x signs **post-commit** with the actual SHA; do not bind envelopes before the commit exists.
+- **Skipping enforce mode in production** — warn mode is for adoption; CI should fail closed on verify exit `2`.
+
+## Conclusion and next steps
+
+1. Install hooks in a pilot repo with `MATRIXSCROLL_ACTOR_TYPE=agent`.
+2. Add verify-action to CI on protected branches.
+3. Read the control mapping in [`docs/AGENTIC_AI_SECURITY.md`](AGENTIC_AI_SECURITY.md).
+4. Follow protocol changes via [`CHANGELOG.md`](../CHANGELOG.md) and GitHub releases.
+
+Questions: [GitHub Discussions](https://github.com/SSX360/matrixscroll/discussions) or security@matrixscroll.com for vulnerabilities.
+
+## References
+
+- Matrix Scroll spec: [`SPEC.md`](../SPEC.md)
+- Agentic AI mapping: [`docs/AGENTIC_AI_SECURITY.md`](AGENTIC_AI_SECURITY.md)
+- Git design spec: [`docs/superpowers/specs/2026-06-19-matrixscroll-git-design.md`](superpowers/specs/2026-06-19-matrixscroll-git-design.md)
+- CISA agentic AI guidance (link above)
+- Conformance vectors: [`vectors/`](../vectors/)

{matrixscroll-0.2.0 → matrixscroll-0.2.2}/docs/quickstart-git.md

@@ -33,6 +33,17 @@ Enable enforce mode in `.git/matrixscroll/config.json`:
 }
 ```
 
+## Windows
+
+Commit-envelope signing requires **matrixscroll 0.2.1+** (fixes Git `cat-file` parsing on Windows). After upgrading:
+
+```powershell
+pip install -U "matrixscroll>=0.2.1"
+matrixscroll hook-install
+```
+
+Use `python -m matrixscroll.cli` if the `matrixscroll` script is not on your PATH.
+
 ## Agent provenance
 
 Set environment variables before committing:

{matrixscroll-0.2.0 → matrixscroll-0.2.2}/matrixscroll/__init__.py

@@ -38,7 +38,7 @@ from ._core import (
     verify_manifest,
 )
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"
 
 __all__ = [
     "ALGORITHM",

{matrixscroll-0.2.0 → matrixscroll-0.2.2}/matrixscroll/cli.py

@@ -18,6 +18,7 @@ import sys
 from pathlib import Path
 
 from ._core import sign_manifest, status, verify_manifest
+from .policy import VerifyPolicy, verify_manifest_with_policy
 
 try:
     from . import git as _git
@@ -30,6 +31,24 @@ def _cmd_status(_args: argparse.Namespace) -> int:
     return 0
 
 
+def _load_policy(args: argparse.Namespace) -> VerifyPolicy | None:
+    policy = VerifyPolicy(require_mode=args.require_mode or None)
+    if args.trusted_keys:
+        file_policy = VerifyPolicy.from_json_file(args.trusted_keys)
+        policy.trusted_public_keys = file_policy.trusted_public_keys
+        if file_policy.require_mode and not policy.require_mode:
+            policy.require_mode = file_policy.require_mode
+        if file_policy.allowed_schemas:
+            policy.allowed_schemas = file_policy.allowed_schemas
+    if (
+        policy.require_mode is None
+        and policy.trusted_public_keys is None
+        and policy.allowed_schemas is None
+    ):
+        return None
+    return policy
+
+
 def _cmd_verify(args: argparse.Namespace) -> int:
     path = Path(args.manifest)
     try:
@@ -37,15 +56,25 @@ def _cmd_verify(args: argparse.Namespace) -> int:
     except (OSError, ValueError) as exc:
         print(json.dumps({"ok": False, "error": f"cannot read manifest: {exc}"}))
         return 2
-    ok = verify_manifest(manifest)
+    policy = _load_policy(args)
+    if policy is not None:
+        ok, reason = verify_manifest_with_policy(manifest, policy)
+        if not ok:
+            print(json.dumps({"ok": False, "error": reason or "policy verification failed"}))
+            return 2
+    else:
+        ok = verify_manifest(manifest)
+        if not ok:
+            print(json.dumps({"ok": False, "error": "cryptographic verification failed"}))
+            return 2
     block = manifest.get("signature") or {}
     print(json.dumps({
-        "ok": ok,
+        "ok": True,
         "device_id": block.get("device_id"),
         "mode": block.get("mode"),
         "signed_at": block.get("signed_at"),
     }, sort_keys=True))
-    return 0 if ok else 2
+    return 0
 
 
 def _cmd_hook_install(_args: argparse.Namespace) -> int:
@@ -97,15 +126,25 @@ def _cmd_envelope_verify(args: argparse.Namespace) -> int:
             print(json.dumps({"ok": False, "error": f"no envelope for {target}"}))
             return 2
         envelope = json.loads(env_path.read_text(encoding="utf-8-sig"))
-    ok = verify_manifest(envelope)
+    policy = _load_policy(args)
+    if policy is not None:
+        ok, reason = verify_manifest_with_policy(envelope, policy)
+        if not ok:
+            print(json.dumps({"ok": False, "error": reason or "policy verification failed"}))
+            return 2
+    else:
+        ok = verify_manifest(envelope)
+        if not ok:
+            print(json.dumps({"ok": False, "error": "cryptographic verification failed"}))
+            return 2
     block = envelope.get("signature") or {}
     print(json.dumps({
-        "ok": ok,
+        "ok": True,
         "device_id": block.get("device_id"),
         "mode": block.get("mode"),
         "signed_at": block.get("signed_at"),
     }, sort_keys=True))
-    return 0 if ok else 2
+    return 0
 
 
 def _cmd_sign(args: argparse.Namespace) -> int:
@@ -120,6 +159,21 @@ def _cmd_sign(args: argparse.Namespace) -> int:
     return 0
 
 
+def _add_policy_args(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument(
+        "--require-mode",
+        metavar="MODE",
+        default="",
+        help="Require signature mode (e.g. emulated, hardware)",
+    )
+    parser.add_argument(
+        "--trusted-keys",
+        metavar="PATH",
+        default="",
+        help="JSON file with trusted_public_keys and optional policy fields",
+    )
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
         prog="matrixscroll",
@@ -131,6 +185,7 @@ def build_parser() -> argparse.ArgumentParser:
 
     verify_p = sub.add_parser("verify", help="Verify a signed manifest JSON file")
     verify_p.add_argument("manifest", help="Path to a signed manifest produced by sign_manifest")
+    _add_policy_args(verify_p)
 
     sign_p = sub.add_parser("sign", help="Sign a manifest JSON file with the active provider")
     sign_p.add_argument("manifest", help="Path to a manifest JSON file to sign")
@@ -148,6 +203,7 @@ def build_parser() -> argparse.ArgumentParser:
 
     env_verify = sub.add_parser("envelope-verify", help="Verify a commit envelope by path or commit sha")
     env_verify.add_argument("target", help="Envelope file path or 40-char commit sha")
+    _add_policy_args(env_verify)
     env_verify.set_defaults(command="envelope-verify")
 
     return parser

{matrixscroll-0.2.0 → matrixscroll-0.2.2}/matrixscroll/git.py

@@ -19,7 +19,7 @@ HOOK_MARKER = "# matrixscroll-git hook\n"
 DEFAULT_CONFIG = {"enforce": False, "actor_type": "human", "tool": "git-cli"}
 
 
-def _run_git(*args: str, cwd: Path | None = None) -> str:
+def _run_git(*args: str, cwd: Path | None = None, strip: bool = True) -> str:
     result = subprocess.run(
         ["git", *args],
         capture_output=True,
@@ -29,7 +29,9 @@ def _run_git(*args: str, cwd: Path | None = None) -> str:
     )
     if result.returncode != 0:
         raise RuntimeError(result.stderr.strip() or result.stdout.strip())
-    return result.stdout.strip()
+    if strip:
+        return result.stdout.strip()
+    return result.stdout
 
 
 def repo_root() -> Path:
@@ -102,28 +104,49 @@ def compute_commit_id(
     message: str,
 ) -> str:
     """Compute Git commit object SHA-1 without creating the commit."""
-    lines = [f"tree {tree}"]
-    for parent in parents:
-        lines.append(f"parent {parent}")
-    lines.append(f"author {author['name']} <{author['email']}> {author['date']}")
-    lines.append(f"committer {committer['name']} <{committer['email']}> {committer['date']}")
-    lines.append("")
-    lines.append(message.rstrip("\n"))
-    body = "\n".join(lines).encode("utf-8")
-    header = f"commit {len(body)}\0".encode("ascii") + body
-    return hashlib.sha1(header, usedforsecurity=False).hexdigest()
+    parts = [
+        f"tree {tree}",
+        *[f"parent {parent}" for parent in parents],
+        f"author {author['name']} <{author['email']}> {author['date']}",
+        f"committer {committer['name']} <{committer['email']}> {committer['date']}",
+    ]
+    body = ("\n".join(parts) + "\n\n").encode("utf-8") + message.encode("utf-8")
+    wrapped = f"commit {len(body)}\0".encode("ascii") + body
+    return hashlib.sha1(wrapped, usedforsecurity=False).hexdigest()
+
+
+def _parse_identity_line(line: str) -> dict[str, str]:
+    """Parse ``author Name <email> timestamp tz`` from a commit object line."""
+    _, rest = line.split(" ", 1)
+    name_email, timestamp, tz = rest.rsplit(" ", 2)
+    if name_email.endswith(">") and " <" in name_email:
+        name, email = name_email.rsplit(" <", 1)
+        email = email[:-1]
+    else:
+        name, email = name_email, ""
+    return {"name": name, "email": email, "date": f"{timestamp} {tz}"}
 
 
 def parse_commit(sha: str, root: Path | None = None) -> dict[str, Any]:
     root = root or repo_root()
-    fmt = "%H%x00%T%x00%P%x00%an%x00%ae%x00%at%x00%cn%x00%ce%x00%ct%x00%B"
-    parts = _run_git("show", "-s", f"--format={fmt}", sha, cwd=root).split("\0")
-    if len(parts) < 10:
-        raise RuntimeError(f"unexpected git show output for {sha}")
-    commit_sha, tree, parents_raw, an, ae, at, cn, ce, ct, body = parts[:10]
-    parents = [p for p in parents_raw.split() if p]
-    author = {"name": an, "email": ae, "date": _git_date(int(at))}
-    committer = {"name": cn, "email": ce, "date": _git_date(int(ct))}
+    commit_sha = _run_git("rev-parse", sha, cwd=root)
+    raw = _run_git("cat-file", "commit", commit_sha, cwd=root, strip=False)
+    tree = ""
+    parents: list[str] = []
+    author: dict[str, str] | None = None
+    committer: dict[str, str] | None = None
+    for line in raw.splitlines():
+        if line.startswith("tree "):
+            tree = line.split(" ", 1)[1]
+        elif line.startswith("parent "):
+            parents.append(line.split(" ", 1)[1])
+        elif line.startswith("author "):
+            author = _parse_identity_line(line)
+        elif line.startswith("committer "):
+            committer = _parse_identity_line(line)
+    if not tree or author is None or committer is None or "\n\n" not in raw:
+        raise RuntimeError(f"unexpected commit object for {sha}")
+    body = raw.split("\n\n", 1)[1]
     actual_id = compute_commit_id(
         tree=tree,
         parents=parents,
@@ -178,7 +201,7 @@ def build_commit_envelope(
             if msg_file.is_file():
                 msg = msg_file.read_text(encoding="utf-8")
             else:
-                msg = _run_git("log", "-1", "--pretty=%B", cwd=root) if parents else ""
+                msg = _run_git("log", "-1", "--pretty=%B", cwd=root, strip=False) if parents else ""
         msg = msg or ""
         commit_block = {
             "expected_id": compute_commit_id(

{matrixscroll-0.2.0 → matrixscroll-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "matrixscroll"
-version = "0.2.0"
+version = "0.2.2"
 description = "Open protocol for signing AI-assisted code provenance with Ed25519; shipping software root of trust with SSX360 hardware support in progress."
 readme = "README.md"
 requires-python = ">=3.10"

{matrixscroll-0.2.0 → matrixscroll-0.2.2}/tests/test_cli.py

@@ -99,6 +99,40 @@ class VerifyCommandTests(_RunMixin, unittest.TestCase):
             self.assertEqual(rc, 0)
             self.assertTrue(json.loads(out)["ok"])
 
+    def test_verify_require_mode_passes_for_matching_mode(self):
+        with tempfile.TemporaryDirectory() as tmp, _isolated_env(Path(tmp)):
+            path = self._signed_path(Path(tmp), {"release": "policy-ok"})
+            rc, out = self._run(["verify", str(path), "--require-mode", "emulated"])
+            self.assertEqual(rc, 0)
+            self.assertTrue(json.loads(out)["ok"])
+
+    def test_verify_require_mode_fails_for_mismatch(self):
+        with tempfile.TemporaryDirectory() as tmp, _isolated_env(Path(tmp)):
+            path = self._signed_path(Path(tmp), {"release": "policy-fail"})
+            rc, out = self._run(["verify", str(path), "--require-mode", "hardware"])
+            self.assertEqual(rc, 2)
+            self.assertIn("required mode hardware", json.loads(out)["error"])
+
+    def test_verify_trusted_keys_passes_for_signer_key(self):
+        with tempfile.TemporaryDirectory() as tmp, _isolated_env(Path(tmp)):
+            path = self._signed_path(Path(tmp), {"release": "trusted-ok"})
+            signed = json.loads(path.read_text(encoding="utf-8"))
+            pub = signed["signature"]["public_key"]
+            keys_path = Path(tmp) / "trusted-keys.json"
+            keys_path.write_text(json.dumps({"trusted_public_keys": [pub]}), encoding="utf-8")
+            rc, out = self._run(["verify", str(path), "--trusted-keys", str(keys_path)])
+            self.assertEqual(rc, 0)
+            self.assertTrue(json.loads(out)["ok"])
+
+    def test_verify_trusted_keys_fails_for_unknown_key(self):
+        with tempfile.TemporaryDirectory() as tmp, _isolated_env(Path(tmp)):
+            path = self._signed_path(Path(tmp), {"release": "trusted-fail"})
+            keys_path = Path(tmp) / "trusted-keys.json"
+            keys_path.write_text(json.dumps({"trusted_public_keys": ["wrong-key"]}), encoding="utf-8")
+            rc, out = self._run(["verify", str(path), "--trusted-keys", str(keys_path)])
+            self.assertEqual(rc, 2)
+            self.assertIn("trusted set", json.loads(out)["error"])
+
 
 class SignCommandTests(_RunMixin, unittest.TestCase):
     def test_sign_then_verify_roundtrip(self):

{matrixscroll-0.2.0 → matrixscroll-0.2.2}/tests/test_git_envelope.py

@@ -47,6 +47,24 @@ def test_sign_and_verify_commit_envelope():
     assert verify_manifest(signed)
 
 
+def test_parse_commit_matches_git(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
+    import subprocess
+
+    from matrixscroll.git import parse_commit
+
+    subprocess.run(["git", "init"], cwd=tmp_path, check=True, capture_output=True)
+    subprocess.run(["git", "config", "user.email", "dev@example.com"], cwd=tmp_path, check=True)
+    subprocess.run(["git", "config", "user.name", "Dev"], cwd=tmp_path, check=True)
+    sample = tmp_path / "hello.txt"
+    sample.write_text("hello\n", encoding="utf-8")
+    subprocess.run(["git", "add", "hello.txt"], cwd=tmp_path, check=True)
+    subprocess.run(["git", "commit", "-m", "init"], cwd=tmp_path, check=True)
+    sha = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=tmp_path, text=True).strip()
+    parsed = parse_commit(sha, tmp_path)
+    assert parsed["actual_id"] == sha
+    assert parsed["message"].startswith("init")
+
+
 def test_build_commit_envelope_in_repo(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
     import subprocess