Sign pushes by default and remove the lock feature gate - #6139
Draft
samuv wants to merge 2 commits into
Draft
Conversation
The final RFC THV-0080 piece: thv skill push signs the pushed artifact with the provided cosign key (attaching the signature manifest next to it, so installs can verify), and pushing unsigned requires an explicit --no-sign — a failed signing fails the push rather than silently publishing unsigned. With signing on publish and verification on consume both in place, the TOOLHIVE_SKILLS_LOCK_ENABLED gate comes out: the lock file, sync, upgrade, dependency materialization, and signature verification are now standard behavior for project-scoped skills. The architecture document's trust-model section graduates from the drift-detection honesty note to the verified model — TOFU semantics, the explicit allow_unsigned / allow_signer_change escape hatches, the provisional git marker, and what deliberately remains trusted on faith. Closes #5899. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
github-actions
Bot
added
size/M
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## skills-sig/13b-provenance-display #6139 +/- ##
=====================================================================
+ Coverage 72.46% 72.49% +0.03%
=====================================================================
Files 739 739
Lines 76319 76389 +70
=====================================================================
+ Hits 55306 55381 +75
- Misses 17074 17080 +6
+ Partials 3939 3928 -11 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Signed-by-default pushes turned every E2E push into a 400: the suite has no signing infrastructure, so its pushes carry the explicit no_sign decision — matching the allow_unsigned exceptions its project-scoped installs already record. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
github-actions
Bot
added
size/M
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Stack 2 of RFC THV-0080 — final PR (stack #6128, on top of #6137). Closes #5899 when it lands.
Summary
The last piece: signing on publish, and the feature gate comes out.
thv skill pushsigns by default:--keysigns the pushed artifact with a cosign private key (the signature manifest is attached at the.sigtag, so project-scoped installs verify it; the flow the signer/verifier PRs round-trip in tests). Pushing unsigned requires an explicit--no-sign, and a failed signing fails the push — an artifact is never silently published unsigned. Threaded through CLI, client, and API.TOOLHIVE_SKILLS_LOCK_ENABLEDis removed: with verification on consume (installs, sync, upgrade) and signing on publish both in place, the lock file graduates from experimental. The gate, its env var, the "(experimental)" command markers, and every gated test-server setup are gone; the lock file,toolhive.requiresmaterialization,sync,upgrade, and signature verification are now standard behavior for project-scoped skills. This is THE user-facing change of the stack.docs/arch/12-skills-system.md): the "drift detection over a repository-editable file" honesty note graduates to the verified model — TOFU semantics with the identity displayed,--allow-unsigned/--allow-signer-changeescape hatches, theprovisional:git marker, and an explicit list of what deliberately remains trusted on faith (unsigned exceptions, the lock file as reviewable policy, the first-use anchor).Type of change
Test plan
task test, full suite with -race)task lint-fix, 0 issues)task docsregenerated.Does this introduce a user-facing change?
Yes. The skills lock file feature is no longer gated: project-scoped installs write
toolhive.lock.yaml, verify signatures (unsigned installs need--allow-unsigned), andthv skill sync/upgradework withoutTOOLHIVE_SKILLS_LOCK_ENABLED.thv skill pushnow requires--keyor an explicit--no-sign.Special notes for reviewers
cosign verify --keyaccepts our attached signature) is covered by the signer package's unit tests plus toolhive-core's key-signed retrieval tests; a manual cosign-CLI check against a real registry is worth doing once before release.provisional:), keyless/OIDC signing, catalog-supplied expected identity, and movingpkg/skills/signerto toolhive-core.Generated with Claude Code