# Adapter: Git-native

Use the CLI from a local protocol checkout and a project directory you control.
Git is optional for formal validity. Draft-first participation needs no key;
this guide is the terminal formalization path.

## Setup

From the protocol checkout:

```bash
cargo build --manifest-path reference/legible-core/Cargo.toml --bin legible
export LEGIBLE_BIN="$PWD/reference/legible-core/target/debug/legible"
```

Use a compatible existing plain Ed25519 key or create one yourself at a non-existing
path, with a chosen passphrase. Never put the private key in the project or chat.
Do not substitute `ed25519-sk`. A confirmation prompt controls use of the key,
not proof that the exact core was reviewed.

## Prepare and sign

Follow [first-appoint.md](../../docs/first-appoint.md) §2–4. A declaration uses
`legible/protocol/v2/appoint`, NRC 0.2 and its exact digest. A problem alone is
valid; evidence and solution are optional. Use a qualified commit reference
(`git:sha1:<40-hex>`), not `myrepo/HEAD`, when referring to Git evidence.

```bash
"$LEGIBLE_BIN" build --type appoint --in appoint.json --repo /absolute/path/to/project
"$LEGIBLE_BIN" inspect --record /absolute/path/to/project/.legible/appoints/<ID>.appoint
```

Review and confirm that core. Use the isolated temporary-message signing recipe
in first-appoint §4, then seal, validate and verify. `sign.sh` also validates the
core, independently recomputes the supplied ID, checks the envelope, displays the
exact declaration and asks for `SIGN` before invoking OpenSSH. Run it yourself in
a trusted terminal; a typed prompt is not cryptographic proof of human review.

For a Nod, use [first-nod.md](../../docs/first-nod.md): the recognizer signs with
their own key. No automatic Nod is emitted by using this adapter.

## Save or share

A signed private record can remain private. Before using Git, inspect existing
status and ignore rules. Add ignore rules for `.ch/` and `.legible/ch/` to the
existing `.gitignore`, preserving its other entries. An ignore rule does not
remove already tracked files.

Do not stage all of `.legible/`. Select exact authorized files and inspect
their core and destinations. The Python publish helper requires an explicit
allowlist of public verified signed records and makes a local commit without push.
Changing signed visibility requires a new record. A push, file transfer or cloud
sync is an independently authorized sharing operation.

Timestamping is separately optional. The helper records `input: utf8-id` and a
content-addressed proof reference but does not validate a token merely by adopting
or listing it. The offline experimental verifier checks binding and signature
against caller-supplied trust material; see first-appoint §5–6 and spec §13.