[bordumb]

The problem

Only the signer could verify anything. Established by running the product, not reading it:

$ git clone <repo> && auths verify HEAD
Verification failed: KEL not found for did:keri:EKjF-HM6…          exit 1
$ auths verify HEAD --remote origin
Verification failed: Root … is not a pinned trusted root.          exit 1
$ auths verify HEAD --identity-bundle bundle.json
Error: a bundle is evidence for a pinned root, never the source of the pin.  exit 2

That third error is correct — a bundle that bootstrapped its own trust would be circular. The design was right. Two small bugs and one missing default meant nothing could reach a second person.

Placing .auths/roots by hand made every path return exit 0. The engine was never the problem.

Root cause

init/mod.rs wrote <repo>/.auths/roots and never staged it. That file's mere existence then made the hook's [ ! -e ] guard at commit_hooks.rs:50 false forever, so the hook never staged it either. The two mechanisms were written to cooperate (see the comment at init/mod.rs:426) and instead cancelled out. The pin stayed untracked, never reached a cloner, and every third-party path dead-ended on it.

Separately, auths registry push had zero callers outside its own command — logged in docs/plans/blockers/fixes.md as "4D: nothing pushes the registry" — so the KEL never reached the remote either. And a plain git clone fetches only refs/heads/* and refs/tags/*, so even once mirrored, auths verify never looked.

The four commits

Commit	What
47e4a8dc	New RepoIndex port + roots::pin_root_in_repo workflow: pin and stage. Hook keys off tracked-ness, not existence, and stops claiming the pin is "committed with this commit" (it lands in N+1 — git snapshots the index before prepare-commit-msg). Hook → v2.
8d57d020	Managed pre-push hook mirrors refs/auths/registry to the code remote. Non-fatal, opt-out via auths.autopush=false, and chains to the repo's own pre-push — core.hooksPath replaces .git/hooks, so a non-chaining hook would silently disable husky/pre-commit/prek machine-wide.
dc12ee66	auths verify defaults its KEL transport to the repo's own origin. Free in the common case (KelResolverChain is local-first; nothing is fetched when the KEL is local) and fires exactly where verification would otherwise fail.
6a8d8f14	The tests that would have caught this.

Result — the acceptance criterion

On a machine with no ~/.auths, having never met the signer:

$ git clone <repo> && cd <repo>
$ auths verify HEAD
Commit 200a9c0… verified: signed by did:keri:EO0bMMH4XfQdwD1WYbssMjDi2016rcVVc98G0dQrVDBM
exit 0

No flags. No identity. No setup.

On the tests

Every existing verification test runs as the signer with a populated ~/.auths — which is exactly why a total failure of the core promise shipped with a green suite. The new tests play the second person, and the fixture uses plain git commit / git push (never auths sign / auths registry push), since a fixture reaching for the manual verbs would prove nothing about the default path.

Mutation-checked: restoring the old write-but-never-stage behaviour fails 3 of the 4.

Verification

• cargo test -p auths-cli --test integration → 67 passed, 0 failed
• cargo test -p auths-sdk --lib → 176 passed, 0 failed
• cargo clippy -p auths-sdk -p auths-cli --all-targets → clean
• cargo fmt --all → applied

Honesty note

Committing .auths/roots makes the pin travel; it does not make first-clone trust sound. A cloner trusting the repo's own pin is doing TOFU-on-the-root, which roots.rs:6-8 correctly warns is unbounded. What this buys is continuity — the same root signed throughout, rotations chained, later substitution detectable. That is what the flight-recorder use case needs, and it should be documented that way rather than sold as authenticity. Flagged for a second opinion.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
auths	Ready	Preview, Comment	Jul 17, 2026 9:38am

[github-actions]

Auths Commit Verification

Commit	Status	Details
6a8d8f14	❌ Failed	Commit carries no Auths-Id/Auths-Device trailer. The prepare-commit-msg hook installed by auths init adds these on every commit — if this repo sets its own core.hooksPath (e.g. husky), the hook is bypassed; run auths doctor to check. Backfill existing commits with auths sign <ref> (rewrites the commit).
dc12ee66	❌ Failed	Commit carries no Auths-Id/Auths-Device trailer. The prepare-commit-msg hook installed by auths init adds these on every commit — if this repo sets its own core.hooksPath (e.g. husky), the hook is bypassed; run auths doctor to check. Backfill existing commits with auths sign <ref> (rewrites the commit).
8d57d020	❌ Failed	Commit carries no Auths-Id/Auths-Device trailer. The prepare-commit-msg hook installed by auths init adds these on every commit — if this repo sets its own core.hooksPath (e.g. husky), the hook is bypassed; run auths doctor to check. Backfill existing commits with auths sign <ref> (rewrites the commit).
47e4a8dc	❌ Failed	Commit carries no Auths-Id/Auths-Device trailer. The prepare-commit-msg hook installed by auths init adds these on every commit — if this repo sets its own core.hooksPath (e.g. husky), the hook is bypassed; run auths doctor to check. Backfill existing commits with auths sign <ref> (rewrites the commit).

Result: ❌ 0/4 commits verified

---

How to fix

Commit 6a8d8f14 has no Auths signature (no Auths-Id/Auths-Device trailer).

1. Install auths

macOS: brew install auths
Linux: Download from releases

2. One-time setup (creates your identity and configures Git)

auths init

3. Sign this branch and push

auths sign origin/main..HEAD
git push --force-with-lease

For CI to verify the signer, commit an identity bundle:

auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000

Quickstart →