Repository navigation
refactor: unify sandboxed agent commit signing - #37
Merged
Merged
Conversation
Use Ed25519 for Claude commit signing regardless of the machine's work settings. Make the launcher and sandbox profile available in personal environments as well. Remove RSA signing access and redundant multi-key loading while keeping authentication and manual GPG signing unchanged.
Share one SSH-signing Git configuration across Claude, Codex, and OpenCode instead of maintaining identical per-agent files. Select the shared configuration in the common launcher and grant each sandbox access to it. Keep manual sessions on their existing GPG setup.
Describe agent signing configuration, host setup, sandbox access, and local versus host verification for maintainers. Align the chezmoi data contract and profile-maintenance guidance with the shared configuration and launcher responsibilities.
Default to the personal email on every machine and select the work email for SolarEdge GitLab and Azure DevOps remotes. This removes the machine-wide work default and the dotfiles path exception. Allow sandboxed agents to read the work identity configuration and document the URL matching rules without changing signing methods.
MrPointer
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 Summary
Sandboxed agents used separate signing configuration, and Claude was unavailable on personal machines.
This consolidates agent Git configuration and signs through the host
ssh-agentwith the machine’s Ed25519 key.Git identity now defaults to personal and selects SolarEdge work identity from remote URLs rather than clone paths.
Key Decisions
🔐 Agent signing boundary
Claude, OpenCode, and Codex use the host Ed25519 signing key through
ssh-agent. Agents receive public key metadata and the agent socket, but never private-key access. Manual Git remains GPG-signed.⚙️ Shared configuration ownership
The shared nono launcher selects
~/.config/git/agent.gitconfigfor every agent. This replaces agent-specific Git configuration and centralizes key preloading, with registration and verification guidance documented for the shared setup.👤 Remote-based work identity
Personal email is the default identity. On work-configured machines, SolarEdge work email applies to
gitlab.solaredge.com, Azure SSHssh.dev.azure.com, and Azure HTTP(S)dev.azure.comremotes. Identity therefore does not depend on where a repository is cloned.🖥️ Claude availability
Generic Claude is available on personal and work machines. Its previous work-dependent configuration excluded personal environments.
🔄 Before & After