Sign checkpoints at push time

[pjbgf]

https://entire.io/gh/entireio/cli/trails/537

Summary

Defer GPG/SSH signing of checkpoint commits from creation time to push time. During an agent session, checkpoint commits accumulate
unsigned on the local entire/checkpoints/v1 ref — no GPG agent calls per step. At pre-push, every local-only commit is cherry-picked
onto the remote tip with strict signing, with a visible per-commit progress line and an interactive retry/skip/abort prompt on failure.

Why

• Performance: active sessions create many checkpoint commits; the per-step SignCommitBestEffort round-trip to the GPG/SSH agent
  dominated commit latency.
• Visibility: signing was silent — users couldn't tell when the agent was being invoked or which commit it was signing.
• Correctness: local-only checkpoints don't need signatures; only what leaves the machine.

What changes

• CreateCommit and the orphan metadata-branch init no longer sign.
• createCherryPickCommit is split into buildCherryPickCommit + persistCherryPickCommit so a new push-time loop can sign each
  cherry-picked clone between build and persist.
• New strict SignCommit(ctx, commit) error alongside the existing SignCommitBestEffort (now a logging wrapper). ErrSigningDisabled
  sentinel.
• PrePush fetches the remote tip into the appropriate ref (temp ref for URL targets), runs the sign-loop over local-only commits,
  advances the local ref to the new signed tip, then pushes. On any abort the local ref stays untouched.
• Cross-clone safety: empty-tree orphans are filtered out, and tree construction uses diff-based application (mirroring cherryPickOnto)
  so per-clone files accumulate onto the remote tip rather than overwriting it.

UX

[entire] Fetching latest from remote...
[entire] Signing commits:
10/10: Finalize transcript for Checkpoint: 17d941007e3b
[entire] Pushing entire/checkpoints/v1 to checkpoint remote... done

• TTY: a static header and a single status line that rewrites in place — no scrollback noise.
• Non-TTY (CI): one line per commit, preserved for the audit trail.
• Signing failure: Retry, skip, or abort? [r/s/a]:. Non-TTY defaults to skip (with a logging.Warn).
• Setting: sign_checkpoint_commits (default true) gates the whole loop.

---

Note

High Risk
Changes when and how metadata refs are rewritten before push (cherry-pick, ref advance, cross-clone filtering); signing failures can block push or leave unsigned commits on the chain.

Overview
Checkpoint commit signing moves from per-step creation to pre-push, so local entire/checkpoints/v1 history stays unsigned during sessions and only commits that will leave the machine are signed.

CreateCommit and orphan metadata ref init no longer call the signer. Signing is centralized in a new strict SignCommit (returns ErrSigningDisabled and propagates signer errors); SignCommitBestEffort is a thin logging wrapper. Cherry-pick helpers split into buildCherryPickCommit / persistCherryPickCommit so push can sign between build and store.

PrePush runs signLocalCommitsForPush before each checkpoint ref push: fetch remote tip, collect local-only commits (collectCommitsSince now supports exclude == ZeroHash), optionally drop empty-tree orphan dupes on cross-clone pushes, then signAndPersistCommits (diff-based cherry-pick + per-commit signing, TTY progress, retry/skip/abort on failure). Abort leaves the local ref unchanged; signing off via sign_checkpoint_commits skips the loop. Metadata reconcile still uses best-effort signing on its cherry-pick path.

Tests cover unsigned CreateCommit, strict SignCommit, and end-to-end pre-push signing behavior.

^{Reviewed by Cursor Bugbot for commit b2d3e84. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b2d3e84. Configure here.}

[Copilot]

Pull request overview

This PR moves checkpoint commit signing from checkpoint creation time to pre-push time, so agent sessions can create many local commits without incurring per-step GPG/SSH signer latency. At push time, local-only commits are replayed onto the remote tip and (attempted to be) signed with user-visible progress and interactive failure handling.

Changes:

• Introduces a new push-time signing/replay flow (signLocalCommitsForPush + signAndPersistCommits) with progress output and retry/skip/abort handling.
• Splits cherry-pick commit creation into “build” vs “persist” steps to allow signing between them.
• Adds strict checkpoint.SignCommit (with ErrSigningDisabled) and updates SignCommitBestEffort to wrap it; removes eager signing from commit creation/orphan init, and adds targeted tests.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
cmd/entire/cli/testutil/testutil.go	Adds bare-repo + remote setup helpers for push-related tests.
cmd/entire/cli/strategy/push_signing.go	New push-time signing/replay implementation (fetch remote tip, cherry-pick via diffs, per-commit signing, progress + prompts).
cmd/entire/cli/strategy/push_signing_test.go	New unit/E2E-style tests covering push-time signing behavior and UI formatting.
cmd/entire/cli/strategy/push_common.go	Extends commit collection logic to support “exclude == ZeroHash” ranges.
cmd/entire/cli/strategy/metadata_reconcile.go	Splits cherry-pick commit construction vs persistence; keeps best-effort signing for reconcile path.
cmd/entire/cli/strategy/manual_commit_push.go	Hooks push-time signing into PrePush before pushing each checkpoint/metadata ref.
cmd/entire/cli/strategy/common.go	Removes eager signing from orphan metadata ref initialization.
cmd/entire/cli/checkpoint/objectsigner_strict_test.go	Adds tests for strict SignCommit semantics (disabled, propagate errors, success).
cmd/entire/cli/checkpoint/objectsigner_errors.go	Adds ErrSigningDisabled + ShouldSkipPushSigning helper.
cmd/entire/cli/checkpoint/committed.go	Removes eager signing from CreateCommit; adds strict SignCommit and reimplements SignCommitBestEffort as a wrapper.
cmd/entire/cli/checkpoint/committed_no_eager_sign_test.go	Ensures CreateCommit never calls the signer even when signing is enabled/configured.