skcomms 0.2.7__tar.gz → 0.2.9__tar.gz

skcomms-0.2.9/.github/workflows/secret-scan.yml

@@ -0,0 +1,61 @@
+name: secret-scan
+
+# Secret-scan gate: keeps the repo's clean secrets hygiene true over time.
+#
+# Runs gitleaks (the fleet default, via its official GitHub Action) on every
+# push and every pull request. The build FAILS if gitleaks finds anything not
+# covered by the baseline allowlist in .gitleaks.toml at the repo root.
+#
+# The allowlist documents known non-secret placeholder tokens; see that file
+# for how to add an entry when a real placeholder trips the scanner. If the
+# scanner flags a REAL secret, rotate it and purge it from history, do NOT
+# add it to the allowlist.
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Full history so a push scans every new commit, not just the tip.
+          fetch-depth: 0
+      # Run the gitleaks BINARY, not gitleaks-action.
+      #
+      # The action requires a paid license for ORGANIZATION-owned repos, and
+      # this repo is owned by the smilinTux org, so every run died with
+      # "missing gitleaks license" BEFORE scanning anything. That is worse than
+      # having no gate: the check sat red on main for months, so it read as
+      # known-broken and got ignored, while the repo had no secret scanning at
+      # all. It also hid a real (benign) finding, see .gitleaks.toml.
+      #
+      # gitleaks itself is MIT-licensed and free. Only the ACTION wrapper is
+      # licensed, so invoking the binary directly restores real scanning at no
+      # cost and with no org secret to provision. Pinned to an exact version so
+      # a new upstream rule cannot turn CI red without a deliberate bump.
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: 8.28.0
+        run: |
+          set -euo pipefail
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+      - name: Run gitleaks
+        # --redact so a genuine finding never echoes the secret into public CI
+        # logs. --exit-code 1 makes a finding fail the build.
+        run: |
+          gitleaks detect \
+            --source . \
+            --config .gitleaks.toml \
+            --redact \
+            --no-banner \
+            --exit-code 1

{skcomms-0.2.7 → skcomms-0.2.9}/.gitleaks.toml

@@ -33,3 +33,15 @@ docs/superpowers/specs/2026-06-13-ble-mesh-proximity-transport-design.md:178.
 """
 paths = ['''docs/superpowers/specs/2026-06-13-ble-mesh-proximity-transport-design\.md''']
 regexes = ['''Ed25519-signed''']
+
+# Fake PGP key blocks in the identity-trust backup test. The private-key rule
+# matches the "-----BEGIN PGP PRIVATE KEY BLOCK-----" armor header, but the body
+# is the literal string "fake-private" (and "fake-public"): a fixture that
+# exercises the backup/restore path without any real key material. Confirmed
+# non-secret on 2026-08-14 by reading tests/test_identity_trust_backup.py:42-43.
+#
+# This is the finding that had been sitting undetected: the CI gate has never
+# actually scanned anything (see secret-scan.yml), so nothing ever reported it.
+[[allowlists]]
+description = "Fake PGP armor fixtures in tests/test_identity_trust_backup.py"
+paths = ['''tests/test_identity_trust_backup\.py''']

{skcomms-0.2.7/src/skcomms.egg-info → skcomms-0.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: skcomms
-Version: 0.2.7
+Version: 0.2.9
 Summary: Sovereign communications for AI agents — multi-channel transport + FQID realm addressing
 Author-email: smilinTux <chefboyrdave2.1@gmail.com>
 License: GPL-3.0-or-later

{skcomms-0.2.7 → skcomms-0.2.9}/src/skcomms/pairing_mirror.py

@@ -55,15 +55,36 @@ def _base() -> Optional[str]:
 def mirror_pairing(fqid: str, pubkey: str) -> None:
     """Record an accepted peer as a TOFU enrollment in capauth.pairing.
 
+    Idempotent per (subject, key): re-mirroring an already-enrolled key is a
+    no-op. Without that guard every accept minted ANOTHER approved DeviceRecord,
+    and because each accept presents a freshly generated key, TOFU pinned
+    nothing: the subject simply accumulated approved devices. Observed on
+    ``opus@chef.skworld``, 22 records in one afternoon, every one a distinct
+    fingerprint, in pairs because both :func:`skcomms.pairing.accept_pairing`
+    and the public-pairing path mirror the same accept.
+
+    Enrollments are NOT deduped by content upstream (``enroll_device`` +
+    ``approve`` always create), so the check belongs here at the call site.
+
     Best-effort: gated on the kernel flag, and any capauth error is logged at
     debug and swallowed so it can never break :func:`accept_pairing`.
     """
     if not kernel_enabled() or not fqid or not pubkey:
         return
     try:
-        from capauth.pairing import approve, enroll_device
+        from capauth.pairing import approve, enroll_device, list_devices
 
         base = _base()
+
+        # Trust on FIRST use: if this subject already has a live device for this
+        # key, keep the existing record rather than minting a second one. A
+        # revoked record is deliberately not resurrected here; re-enrolling a
+        # revoked key must be an explicit operator action, not a side effect of
+        # a peer re-accept.
+        if _already_enrolled(fqid, pubkey, base):
+            logger.debug("pairing mirror: %s already enrolled for this key, skipping", fqid)
+            return
+
         enr = enroll_device(
             pubkey,
             list(_DEFAULT_SCOPES),
@@ -76,6 +97,30 @@ def mirror_pairing(fqid: str, pubkey: str) -> None:
         logger.debug("capauth pairing mirror failed", exc_info=True)
 
 
+def _already_enrolled(fqid: str, pubkey: str, base) -> bool:
+    """Whether *fqid* already has a live capauth device carrying *pubkey*.
+
+    Compares the armored public key stored on the DeviceRecord. A record with
+    no stored key never matches, so it enrolls rather than silently treating an
+    unknown key as already trusted. Any lookup failure also returns False: a
+    duplicate record is far better than dropping a real pairing.
+    """
+    from capauth.pairing import list_devices
+
+    try:
+        existing = list_devices(fqid, base_dir=base, include_revoked=False)
+    except Exception:
+        logger.debug("pairing mirror: device lookup failed, enrolling anyway", exc_info=True)
+        return False
+
+    presented = (pubkey or "").strip()
+    for dev in existing:
+        stored = (getattr(dev, "pubkey", None) or "").strip()
+        if stored and stored == presented:
+            return True
+    return False
+
+
 def mirror_revocation(fqid: str) -> None:
     """Revoke every non-revoked capauth device whose subject is this peer's fqid.
 

{skcomms-0.2.7 → skcomms-0.2.9/src/skcomms.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: skcomms
-Version: 0.2.7
+Version: 0.2.9
 Summary: Sovereign communications for AI agents — multi-channel transport + FQID realm addressing
 Author-email: smilinTux <chefboyrdave2.1@gmail.com>
 License: GPL-3.0-or-later

{skcomms-0.2.7 → skcomms-0.2.9}/tests/conftest.py

@@ -25,8 +25,19 @@ def _isolate_skcomms_home(tmp_path, monkeypatch):
     isolation, tests that build servers with defaults would write replay
     state into the operator's live home. Tests that need a specific home
     still win: their own ``monkeypatch.setenv`` runs after this fixture.
+
+    The pairing kernel base is isolated for the same reason, and it is the
+    sharper case: ``mirror_pairing`` enrolls + approves into the capauth
+    pairing store, which is the store ``capauth.authz.decide()`` reads to
+    authorize. Four test files exercise pairing without setting the base
+    themselves (test_pairing, test_pairing_cli, test_public_pairing,
+    test_key_exchange_transport_scoping), so a plain ``pytest tests/`` was
+    minting real approved DeviceRecords into the operator's live security
+    store. Measured: running test_public_pairing.py alone added 2 records,
+    and 58 accumulated records for ``opus@chef.skworld`` trace to this.
     """
     monkeypatch.setenv("SKCOMMS_HOME", str(tmp_path / "skcomms-home"))
+    monkeypatch.setenv("SKCOMMS_PAIRING_KERNEL_BASE", str(tmp_path / "capauth-pairing"))
     # Nonce caches are node-local (outside the synced home) by default; keep
     # tests off the operator's real ~/.local/state/skcomms as well.
     monkeypatch.setenv("SKCOMMS_NONCE_CACHE_DIR", str(tmp_path / "skcomms-local-state"))

{skcomms-0.2.7 → skcomms-0.2.9}/tests/test_pairing_mirror.py

@@ -308,3 +308,54 @@ def test_public_pairing_kernel_disabled_writes_nothing(tmp_path, monkeypatch):
     )
     assert res["paired"]["fqid"] == "opus@chef.skworld"
     assert list_devices(subject="opus@chef.skworld", base_dir=str(tmp_path / "capauth")) == []
+
+
+# ── idempotency (trust on FIRST use, not on every use) ───────────────────
+
+
+# Deliberately NOT shaped like real base64 key material. mirror_pairing only
+# needs two distinct opaque strings (it stores them and fingerprints them), and
+# a realistic-looking prefix made the secret scanner flag these as a leaked
+# key. Suppressing that with an allowlist entry would blunt a gate that only
+# started working on 2026-08-14 (see the secret-scan workflow), so the fixture
+# avoids tripping it in the first place.
+_KEY_A = "not-a-real-key-fixture-alpha"
+_KEY_B = "not-a-real-key-fixture-bravo"
+
+
+def test_re_mirroring_the_same_key_does_not_mint_a_second_device(tmp_path, monkeypatch):
+    """Repeated accepts of one peer+key must converge on ONE device record.
+
+    Regression pin for the observed drift: opus@chef.skworld accumulated 22
+    approved TOFU records in a single afternoon because every accept called
+    enroll_device + approve unconditionally.
+    """
+    monkeypatch.setenv("SKCOMMS_PAIRING_KERNEL_BASE", str(tmp_path))
+    from capauth.pairing.kernel import list_devices
+
+    from skcomms.pairing_mirror import mirror_pairing
+
+    for _ in range(5):
+        mirror_pairing("peer@example.skworld", _KEY_A)
+
+    devices = list_devices("peer@example.skworld", base_dir=tmp_path, include_revoked=True)
+    assert len(devices) == 1
+
+
+def test_a_genuinely_new_key_still_enrolls(tmp_path, monkeypatch):
+    """The guard must not block a real second device for the same subject."""
+    monkeypatch.setenv("SKCOMMS_PAIRING_KERNEL_BASE", str(tmp_path))
+    from capauth.pairing.kernel import list_devices
+
+    from skcomms.pairing_mirror import mirror_pairing
+
+    mirror_pairing("peer@example.skworld", _KEY_A)
+    mirror_pairing("peer@example.skworld", _KEY_B)
+
+    devices = list_devices("peer@example.skworld", base_dir=tmp_path, include_revoked=True)
+    assert len(devices) == 2
+
+    # And re-presenting the first key still does not add a third.
+    mirror_pairing("peer@example.skworld", _KEY_A)
+    devices = list_devices("peer@example.skworld", base_dir=tmp_path, include_revoked=True)
+    assert len(devices) == 2

skcomms-0.2.7/.github/workflows/secret-scan.yml

@@ -1,48 +0,0 @@
-name: secret-scan
-
-# Secret-scan gate: keeps the repo's clean secrets hygiene true over time.
-#
-# Runs gitleaks (the fleet default, via its official GitHub Action) on every
-# push and every pull request. The build FAILS if gitleaks finds anything not
-# covered by the baseline allowlist in .gitleaks.toml at the repo root.
-#
-# The allowlist documents known non-secret placeholder tokens; see that file
-# for how to add an entry when a real placeholder trips the scanner. If the
-# scanner flags a REAL secret, rotate it and purge it from history, do NOT
-# add it to the allowlist.
-
-on:
-  push:
-    branches: ["main"]
-  pull_request:
-    branches: ["main"]
-
-permissions:
-  contents: read
-
-jobs:
-  gitleaks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          # Full history so a push scans every new commit, not just the tip.
-          fetch-depth: 0
-      - name: Run gitleaks
-        uses: gitleaks/gitleaks-action@v2
-        env:
-          # Use the baseline/allowlist committed at the repo root.
-          GITLEAKS_CONFIG: ${{ github.workspace }}/.gitleaks.toml
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # gitleaks-action requires a license for ORGANIZATION-owned repos.
-          # The note here used to say this repo ran on an individual account;
-          # it does not, it is owned by the smilinTux org, which is why every
-          # run fails with "missing gitleaks license" before scanning anything.
-          # Licensing keys on org-vs-personal, not public-vs-private, so being
-          # a public repo does not exempt it.
-          #
-          # Free key for open source at https://gitleaks.io; add it as an
-          # organization secret named GITLEAKS_LICENSE so every smilinTux repo
-          # can use the same one. Until it exists this reference is harmless:
-          # an unset secret expands to empty, exactly as today.
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}