fix(agent): per-request signing authorization (#354)

[bordumb]

Addresses #354 (partial — lands the enforceable mechanism + tested policy; the platform approval prompt that flips enforcement to on is the remaining follow-up).

Problem

The signing agent (the SSH-agent used for git commit signing) held unlocked keys and would sign for any same-user process that reached its socket during the unlock window — no per-request authorization, no biometric. The existing peer-UID check gates other users, not another process you run.

What this PR does (TDD)

• RED → GREEN: agent_refuses_to_sign_when_authorizer_denies failed against current code (the agent signs for anyone); now passes via a new gate.
• SignAuthorizer hook consulted in AgentSession::sign before every signature — deny ⇒ refuse.
• PerCallerAuthorizer (the chosen policy): approves a peer once per connecting process and pins it, so the legitimate caller isn't re-prompted per signature while a different process triggers a fresh approval. Tested (per_caller_pins_approved_and_reprompts_a_different_process). Keyed by (uid, pid); macOS has no peer pid → falls back to time-bucketed re-auth.
• Wired live on the socket path: PeerAuthorizedAgent reads the peer (uid, pid) and injects the authorizer per session. Authorizer types re-exported as public API for host injection.

Impact (why it's a policy, not a hard prompt)

• CI: unaffected — release/artifact signing uses auths sign (direct keychain decrypt), never the agent.
• Autonomous / MCP: keep an explicit non-interactive policy (their authority is the delegation/scope, not a human touch).
• Developer: per-caller approval (not per-signature), so a 30-commit rebase from one git process = one approval, not 30.

Honest limitation

The shipped default is permissive (AllowAllSigning) — signing behavior is unchanged. Real enforcement requires the platform approval prompt (macOS LocalAuthentication / Touch ID, or a Linux prompt) injected as the PerCallerAuthorizer approval Fn at the CLI boundary. That platform piece is deliberately a follow-up rather than faked.

Tests

All 14 agent tests green (2 new + 12 existing); auths-core compiles clean. Full guard (clippy --workspace, fmt-all) not yet run — left to CI.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
auths	Ready	Preview, Comment	Jun 24, 2026 7:32pm

[github-actions]

Auths Commit Verification

Commit	Status	Details
a050a6c3	❌ Failed	No signature found

Result: ❌ 0/1 commits verified

---

How to fix

Commit a050a6c3 has no Auths signature (no Auths-Id/Auths-Device trailer).

1. Install auths

macOS: brew install auths
Linux: Download from releases

2. One-time setup (creates your identity and configures Git)

auths init

3. Sign this branch and push

auths sign origin/main..HEAD
git push --force-with-lease

For CI to verify the signer, commit an identity bundle:

auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000

Quickstart →

[github-actions]

Auths Commit Verification

Commit	Status	Details
e5dcb1e7	❌ Failed	No signature found
a050a6c3	❌ Failed	No signature found

Result: ❌ 0/2 commits verified

---

How to fix

Commit e5dcb1e7 has no Auths signature (no Auths-Id/Auths-Device trailer).

1. Install auths

macOS: brew install auths
Linux: Download from releases

2. One-time setup (creates your identity and configures Git)

auths init

3. Sign this branch and push

auths sign origin/main..HEAD
git push --force-with-lease

For CI to verify the signer, commit an identity bundle:

auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000

Quickstart →

[bordumb]

Update (e5dcb1e7): enforcement is now wired, not just the mechanism.

• The SignAuthorizer is dependency-injected through the agent serve path (start_agent_listener_with_handle) instead of a hardcoded permissive default.
• The CLI selects the policy by context: an interactive (TTY) foreground agent gates each new connecting process behind a terminal approval prompt and pins it (PerCallerAuthorizer); a daemonized / headless agent stays permissive (no human to approve).
• CI is unaffected — it signs via the direct keychain path (auths sign), never the agent.

Verified: full chain (cli → sdk → core) compiles clean; 7/7 agent tests pass including the socket integration test now routed through the injected authorizer.

Remaining for full enforcement on the common (daemonized) deployment: the macOS Touch ID / Linux GUI approval backend. The infra exists to build it on (build.rs links LocalAuthentication; the Swift bridge already drives LAContext for Secure-Enclave signing) — it's a thin approve backend swapped in for the daemon case. Note: that dialog can't be verified from a headless CI environment; it needs on-device confirmation.