fix(devops): unsigned-commit fallback for config integrity log - #69
Merged
Merged
Conversation
When the 1Password ssh-agent is locked (unattended Mac), commit signing fails and the integrity log stays uncommitted -- making every subsequent `hermes config verify` exit 2 (log tampering false positive). Fall back to --no-gpg-sign for seal/restore log commits, tagged '[unsigned: signer unavailable]' in the message. restore() now reuses git_commit() instead of its own silent add+commit block. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
🔎 Lint report:
|
github-actions Bot
pushed a commit
that referenced
this pull request
Jul 2, 2026
… mark arc complete (#76) Session close-out audit found the Outcome section only mentioned PR #67. PR #69 explicitly self-describes as "follow-up to #67" (unsigned-commit git fallback) and PR #68 (AGENTS.md docs) is also a direct follow-up; neither was recorded. Also clarifies that #71/#72 (cron ticker heartbeat/stall fix) are an unrelated arc shipped the same day, not part of this project. Claude-Session: https://claude.ai/code/session_01PQKCc5mDedYAiCNyXnTezh Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When the 1Password ssh-agent is locked (unattended Mac), commit signing fails and the integrity log stays uncommitted — making every subsequent
hermes config verifyexit 2 (log-tampering false positive, would page Slack every 30 min).git_commit()now retries with--no-gpg-signwhen the signed commit fails; unsigned commits are tagged[unsigned: signer unavailable]in the message for auditability.restore()reusesgit_commit()instead of its own silent add+commit block (which swallowed the same failure).Found while wiring the Config Integrity Watchdog cron (
fbe11786e4d1) tohermes config verify— first cron-context seal wrote the log but could not commit it (Pro's 1Password locked), leaving verify stuck at exit 2. Deployed copies on the Pro/Air are already patched; this makes the repo source match.Refs: DAN-1880, follow-up to #67.
Test plan
hermes config verifyexits 0hermes config restoreno-op path exits 0🤖 Generated with Claude Code