chore: untrack local integration config from legis#5
Merged
Conversation
…ardline.yaml) These are machine-local integration config — MCP server paths and loopback service URLs (loomweave/filigree/wardline) — that leaked into the published package repo via PR #4. They are developer-environment artifacts, not package content, so stop tracking them and add them to .gitignore (they remain on disk for local use). Lacuna keeps its own copies tracked as the reference demo bed; this only affects legis. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
tachyon-beep
added a commit
that referenced
this pull request
Jun 7, 2026
filigree/client.py and identity/loomweave_client.py signed their requests with byte-for-byte copies of the same X-Weft-Component scheme (_json_body_bytes / _path_and_query / sign_*_request / *_hmac_key_from_env). The wire format lived in two modules; a change to canonicalization or the X-Weft-* headers would have to touch both or the channels silently diverge. Extract src/legis/weft_signing.py as the single definition (weft_body_bytes, weft_path_and_query, sign_weft_request(component, ...), weft_hmac_key_from_env(env_var)). Both clients delegate; module-level _json_body_bytes/_path_and_query aliases keep internal transport and existing call sites stable. The serializer deliberately stays off canonical.canonical_json — its ensure_ascii=False would change the signed bytes (the cross-tool HMAC contract with Wardline). Behavior-preserving: existing per-channel golden vectors unchanged and green; adds tests/test_weft_signing.py with a cross-channel anti-drift test (signatures identical modulo the component prefix) and an ascii-escaping guard. Full suite 684 passed, mypy + ruff clean. rc4 review finding #5 (legis-3012f98aaa). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stops tracking three machine-local integration-config files that leaked into the package repo via PR #4, and adds them to
.gitignore. They remain on disk for local use (git rm --cached, not deleted)..mcp.json— local MCP server command pathsloomweave.yaml/wardline.yaml— loopback service URLs (loomweave/filigree/wardline)These are developer-environment artifacts, not package content. Lacuna keeps its own copies tracked as the reference demo bed; this only affects legis.
No code or test changes.
🤖 Generated with Claude Code