From feaf59a4e5bd773d79b24b48d37f7693f35768fb Mon Sep 17 00:00:00 2001 From: MongLong0214 Date: Fri, 14 Aug 2026 13:26:44 +0900 Subject: [PATCH] =?UTF-8?q?spec:=20=EC=84=9C=EB=AA=85=20=EB=AA=A8=EB=93=9C?= =?UTF-8?q?=EC=97=90=20signer=20allowlist=20=EC=9A=94=EA=B5=AC=EB=A5=BC=20?= =?UTF-8?q?=EC=A0=95=EB=B3=B8=EC=97=90=20=EB=B0=98=EC=98=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #642(#597)가 requireSignedDirective 모드에 trustedSigner allowlist를 추가했다. README 4개·docs/cli.md·docs/capture.md·ADR-0005는 새 계약을 담고 있는데 SPEC §7만 옛 계약(Git G 상태만 요구)에 머물러 있었다. 정본이 구현보다 약한 게이트를 서술하면, 스펙만 보고 만든 구현은 CommitLore가 claim으로 등급하는 레코드를 directive로 등급한다. #631이 다루는 경로별 등급 불일치와 같은 종류이며, 여기서는 스펙과 구현 사이에서 벌어진다. 문구는 ADR-0005의 이미 승인된 서술을 옮긴 것이고 새 결정을 담지 않는다. Limit: SPEC §7은 구현이 실제로 강제하는 것보다 약한 조건을 서술할 수 없다 Ruled-out: README·docs만 고치고 SPEC은 두기 | 정본이 규범이라 독립 구현자는 SPEC을 읽지 README를 읽지 않는다 Record-Id: r-signspec645 Blast: module Undo: easy Certainty: firm X-Claude-Session: https://claude.ai/code/session_01Go54NtZpaoNMRtmYtPLX6R --- spec/SPEC.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/SPEC.md b/spec/SPEC.md index dddc863a..c20e260a 100644 --- a/spec/SPEC.md +++ b/spec/SPEC.md @@ -233,9 +233,9 @@ Records are graded on two axes, and the grade decides how `Warn:` is delivered: `Warn:` renders as an **instruction** only when provenance is `authored`, the record is active, and the commit's author string matches a string this repository configured for directives. Otherwise it renders as a **claim** — surfaced as information, never as a directive. In the default mode this is an unauthenticated, forgeable string match: the commit author chooses the string, so anyone able to write a commit can choose a configured one. A record from a contributor whose chosen string does not match renders as a claim; the match itself does not prove who wrote it. -`commitlore.requireSignedDirective=true` adds an opt-in authenticated boundary: an otherwise eligible directive additionally needs Git's `G` signature status, meaning Git verified it against the verifier's own trust store. Every other status — untrusted, bad, absent, expired, revoked or unable to check — is unverified and renders as a claim. A verified signature establishes neither the signer's authority to direct this repository nor the truth or safety of the record's content. +`commitlore.requireSignedDirective=true` adds an opt-in authenticated boundary: an otherwise eligible directive additionally needs Git's `G` signature status — meaning Git verified it against the verifier's own trust store — **and** the exact signing-key fingerprint Git reports as `%GF` must appear in the repository-local `commitlore.trustedSigner` allowlist. Every other signature status — untrusted, bad, absent, expired, revoked or unable to check — is unverified and renders as a claim, as does any fingerprint the allowlist does not list. An absent, empty, or unreadable allowlist authorizes nobody, so every record renders as a claim; it never means every valid signer is authorized. A verified signature establishes that a key this verifier accepts signed the commit; the allowlist is what supplies authority for this repository, and neither establishes the truth or safety of the record's content. -This is a minimum, not a solution: the default makes a repository's policy auditable rather than silently assumed, while signature mode uses Git's existing verifier trust store without inventing key distribution. +This is a minimum, not a solution: the default makes a repository's policy auditable rather than silently assumed, while signature mode uses Git's existing verifier trust store and a repository-local allowlist without inventing key distribution. ---