agent release show: return the per-commit signature-verification state - #35
Merged
Merged
Conversation
…ation state it promised The command's own help text (and the served orientation doc) describe sourceCodeEntryDetails as "per-commit attribution + signature state", but the hard-coded GraphQL selection only asked for the attribution fields -- so the payload never carried the signature verdict, and an agent could not distinguish "backend verified the signature" from "key never matched but nothing surfaced it" (attribution resolves off trailers and is independent of signature verification). Select SourceCodeEntry.signature (state, format, signedByOwnerType, signedByOwnerUuid, verifiedAt, keyFingerprint) -- served by every backend that supports agent release show at all, so no compatibility fence is needed. Verified live: a signed agent-session release now returns signature.state=VERIFIED with the matched key fingerprint alongside attributionState=RESOLVED. ReARM-Agentic-Session: cli-sig-state-1785636783 ReARM-Agent: 62df357e-a3a4-4df5-82d4-049e629d1c6b Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
rearm agent release showdocumentssourceCodeEntryDetailsas "per-commit attribution + signature state" (its own--helpand the served orientation doc §5), but the hard-coded GraphQL selection only requested the attribution fields — the signature verdict never appeared in the payload. Practical consequence: an agent could not distinguish "backend verified the signature" from "verifier couldn't match the key but nothing surfaced it", since attribution resolves off commit trailers independently of signature verification.Fix: select
SourceCodeEntry.signature { state format signedByOwnerType signedByOwnerUuid verifiedAt keyFingerprint }— the server-side field (latestsignature_verificationsverdict, same row the UI reads) has existed since before the agentic release-show query itself, so every backend that can answer this command already serves it; no compatibility fence needed, and no backend or doc changes — the existing docs simply become truthful.Output change: each SCE gains a nullable
signatureobject (null when no SIGNATURE artifact was ever attached, e.g. plain unsigned CI commits).Verified live against a deployed instance: a signed agent-session release now returns
🤖 Generated with Claude Code