Modular

[piersonkevin290-ux]

Which topic are you reporting about?

Here’s the GitHub Action that re-verifies the IPFS CID and GPG signature on every PR. Drop this in .github/workflows/loni_ip_guard.yml.

It blocks merges if someone tries to strip your headers, break the CID chain, or commit unsigned code.
name: LONI IP Guard
on:
pull_request:
branches: [main, master]
push:
branches: [main, master]

jobs:
verify_ip_chain:
runs-on: ubuntu-latest
steps:
- name: Checkout with full history
uses: actions/checkout@v4
with:
fetch-depth: 0

  - name: Install deps
    run: |
      sudo apt-get update
      sudo apt-get install -y jq
      npm install -g ajv-cli
      wget https://dist.ipfs.tech/kubo/v0.28.0/kubo_v0.28.0_linux-amd64.tar.gz
      tar -xvzf kubo_v0.28.0_linux-amd64.tar.gz
      sudo bash kubo/install.sh
      ipfs init

  - name: Import LONI GPG public key
    run: |
      cat << 'EOF' > loni_pubkey.asc
      -----BEGIN PGP PUBLIC KEY BLOCK-----
      # Paste your MSM8960-bound public key here
      # Generate with: gpg --armor --export your@email
      -----END PGP PUBLIC KEY BLOCK-----
      EOF
      gpg --import loni_pubkey.asc
      echo "trusted-key 0xYOURKEYID" >> ~/.gnupg/gpg.conf

  - name: Validate transparency_manifest.json schema
    run: |
      ajv validate -s legal_vault/transparency_manifest.schema.json \
        -d legal_vault/transparency_manifest.json

  - name: Verify IPFS CID matches legal_vault contents
    run: |
      MANIFEST_CID=$(jq -r .ipfs_cid legal_vault/transparency_manifest.json)
      CALC_CID=$(ipfs add -r -n -Q legal_vault/)
      
      if [ "$MANIFEST_CID" != "$CALC_CID" ]; then
        echo "Error: IPFS CID mismatch"
        echo "Manifest: $MANIFEST_CID"
        echo "Calculated: $CALC_CID"
        echo "Someone modified legal_vault/ without updating the manifest."
        exit 1
      fi
      echo "IPFS CID verified: $MANIFEST_CID"

  - name: Verify git commit matches manifest
    run: |
      MANIFEST_COMMIT=$(jq -r .git_commit legal_vault/transparency_manifest.json)
      HEAD_COMMIT=$(git rev-parse HEAD)
      
      if [ "$MANIFEST_COMMIT" != "$HEAD_COMMIT" ]; then
        echo "Error: git_commit in manifest does not match HEAD"
        echo "Manifest: $MANIFEST_COMMIT"
        echo "HEAD: $HEAD_COMMIT"
        exit 1
      fi
      echo "Git commit binding verified"

  - name: Verify GPG signature on bundle
    run: |
      # Recreate bundle from HEAD
      git bundle create head.bundle HEAD
      
      # Extract signature from manifest
      jq -r .gpg_signature legal_vault/transparency_manifest.json > head.bundle.asc
      
      # Verify
      if ! gpg --verify head.bundle.asc head.bundle; then
        echo "Error: GPG signature invalid or missing"
        echo "Bundle was not signed by the MSM8960-bound key"
        exit 1
      fi
      echo "GPG signature valid"

  - name: Check hardware root + license constants
    run: |
      if ! grep -q "MSM8960" kpp/hardware/wallet_binder.py; then
        echo "Error: MSM8960 UID path not found in wallet_binder.py"
        exit 1
      fi
      
      if ! grep -qr "Copyright (c) 2026 Kevin Frank Pierson" --include="*.py" .; then
        echo "Error: Copyright header missing in .py files"
        exit 1
      fi
      echo "Hardware root and license headers present"

  - name: Check transparency_id embedded in code
    run: |
      TID=$(jq -r .transparency_id legal_vault/transparency_manifest.json)
      if ! grep -q "$TID" kpp/legal/compliance_gate.py; then
        echo "Error: transparency_id $TID not found in compliance_gate.py"
        echo "All operations must reference the USPTO filing hash"
        exit 1
      fi
      echo "transparency_id embedded correctly"

What this prevents

1. CID tampering: If someone edits legal_vault/ and doesn’t re-pin to IPFS, CI fails
2. Unsigned commits: No GPG sig for MSM8960 key = blocked PR
3. Header stripping: Removes MidasinyouWalletBinder or copyright = blocked
4. Chain breaks: git_commit in manifest must match HEAD SHA
5. ID drift: transparency_id must exist in compliance_gate.py

Setup steps

1. Generate your key: gpg --full-generate-key with comment MSM8960-ba7816bf8f01cfea
2. Export public key: gpg --armor --export your@email > loni_pubkey.asc
3. Paste that into the loni_pubkey.asc section above
4. Add branch protection rule in GitHub: Settings > Branches > Require status checks to pass > Select LONI IP Guard

Now your repo is self-enforcing. Any PR that tries to ship LONI/Lumina code without the full IP chain gets rejected automatically.

Want me to add the LICENSE file template with the Kevin_Pierson_License_v1.0 text + automatic copyright year updating too?

What do you think needs to be updated?

Kevin F Pierson 2106 Angelo Dr Kronenwetter WI 54455, copyright ©️ and trademark ™️ himself and the program linked already

Anything else?

No response