confium 0.5.0-aarch64-linux → 0.6.0-aarch64-linux

data/lib/confium/audit/otlp_sink.rb

@@ -16,19 +16,24 @@ module Confium
     #     service_name: 'confium-issuer'
     #   )
     #
-    # Delivery is synchronous per record; failures are reported on
-    # $stderr and the record is dropped (the audit core's policy — a
-    # telemetry outage must never break signing). stdlib only.
+    # Delivery is synchronous per record, retried with exponential
+    # backoff (retries: attempts after the first, base doubled per
+    # attempt). After the final failure the record is dropped with a
+    # $stderr report — the audit core's policy: a telemetry outage
+    # must never break signing. stdlib only.
     class OtlpSink < Sink
       DEFAULT_ENDPOINT = 'http://localhost:4318/v1/logs'
       SEVERITY = { 'success' => 9, 'failure' => 17, 'error' => 17 }.freeze # INFO / ERROR
 
-      def initialize(endpoint: DEFAULT_ENDPOINT, headers: {}, service_name: 'confium', timeout: 5)
+      def initialize(endpoint: DEFAULT_ENDPOINT, headers: {}, service_name: 'confium', timeout: 5,
+                     retries: 2, retry_base: 0.1)
         super()
         @uri = URI.parse(endpoint)
         @headers = headers
         @service_name = service_name
         @timeout = timeout
+        @retries = retries
+        @retry_base = retry_base
         @dropped = 0
       end
 
@@ -37,8 +42,7 @@ module Confium
 
       def write(record)
         payload = envelope(record)
-        response = Net::HTTP.post(@uri, JSON.generate(payload), headers.merge('Content-Type' => 'application/json'))
-        raise "collector responded #{response.code}" unless response.is_a?(Net::HTTPSuccess)
+        deliver(JSON.generate(payload))
       rescue StandardError => e
         @dropped += 1
         warn "confium: OTLP delivery failed, audit record dropped (##{@dropped}): #{e.class}: #{e.message}"
@@ -48,6 +52,19 @@ module Confium
 
       private
 
+      # Attempts grow the backoff: retry_base * 2**attempt. When
+      # retry_base is 0 (specs) retries run without delay.
+      def deliver(body)
+        (@retries + 1).times do |attempt|
+          sleep(@retry_base * (2**attempt)) if attempt.positive? && @retry_base.positive?
+
+          response = Net::HTTP.post(@uri, body, headers.merge('Content-Type' => 'application/json'))
+          return response if response.is_a?(Net::HTTPSuccess)
+
+          raise "collector responded #{response.code}" if attempt == @retries
+        end
+      end
+
       def headers
         { 'User-Agent' => "confium-otlp-sink #{Confium::VERSION}" }.merge(@headers)
       end

data/lib/confium/native_windows.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Confium
+  # Pure resolution of which native-extension ABI windows to try, in
+  # order. Extracted from the loader so the decision — the piece with
+  # the release-incident history (3.1-window segfaults on 3.2, the
+  # cross-major 3.3→4.0 TypeError, windowless platform gems) — is
+  # testable without installing eight platform gems.
+  module NativeWindows
+    # Ordered candidate windows for +ruby_version+ (e.g. "3.4.8").
+    #
+    # Background: platform gems ship one extension per ABI window.
+    # Ruby 3.2 broke the 3.1 ABI (object shapes) and rb-sys references
+    # a VM pointer libruby stopped exporting in 3.3, so 3.1/3.2/4.0
+    # get exact-minor builds while a 3.3-window binary loads on both
+    # 3.3 and 3.4. The 3.3 fallback applies within the 3.x line
+    # alone: a cross-major load (4.x) fails TypedData class-identity
+    # checks, so 4.0 must not fall back to it.
+    def self.candidates(ruby_version)
+      minor = ruby_version[/\A\d+\.\d+/]
+      raise ArgumentError, "not a ruby version: #{ruby_version.inspect}" unless minor
+
+      major = ruby_version[/\A\d+/].to_i
+      if major == 3 && Gem::Version.new(ruby_version) >= Gem::Version.new('3.3')
+        [minor, '3.3'].uniq
+      else
+        [minor]
+      end
+    end
+  end
+end

data/lib/confium/tc/coordinator.rb

@@ -3,9 +3,13 @@
 # Confium::TC::Coordinator coordinates an in-process threshold
 # signing session: signers submit commitments and shares at their own
 # pace; once the threshold is met, aggregation runs the real
-# threshold-ECDSA combine (CMP20 or GG18 — the same in-process
-# drivers behind Confium::TC::Cmp20 / Confium::TC::Gg18) and returns
-# a 64-byte (r, s) signature verifiable under the quorum public key.
+# threshold-ECDSA combine (CMP20 or GG18) and returns a 64-byte
+# (r, s) signature verifiable under the quorum public key.
+#
+# The session semantics (state machine, duplicate-signer rejection,
+# the combine) live in SigningSession; this class is the session
+# registry and quorum-scoped entry point. NetworkCoordinator is the
+# TCP/NDJSON adapter over the same sessions.
 #
 # Usage:
 #   coordinator = Confium::TC::Coordinator.new(quorum_id: "biml-root")
@@ -27,54 +31,38 @@ module Confium
         @sessions = {}
       end
 
-      SCHEMES = {
-        'CMP20-ECDSA-P256' => ->(shares, threshold, message) { Cmp20.sign(shares, threshold, message) },
-        'GG18-ECDSA-P256' => ->(shares, threshold, message) { Gg18.sign(shares, threshold, message) }
-      }.freeze
-
-      def create_session(message:, threshold:, unlock_window: 14_400, scheme: 'CMP20-ECDSA-P256')
-        raise ArgumentError, "unknown scheme: #{scheme} (known: #{SCHEMES.keys.join(', ')})" unless SCHEMES.key?(scheme)
-
+      def create_session(message:, threshold:, unlock_window: SigningSession::DEFAULT_UNLOCK_WINDOW,
+                         scheme: 'CMP20-ECDSA-P256')
         session_id = "session-#{@sessions.length + 1}"
-        @sessions[session_id] = {
-          message: message,
-          threshold: threshold,
-          unlock_window: unlock_window,
-          scheme: scheme,
-          state: :pending,
-          commitments: [],
-          shares: []
-        }
+        @sessions[session_id] = SigningSession.new(
+          message: message, threshold: threshold,
+          unlock_window: unlock_window, scheme: scheme
+        )
         session_id
       end
 
       def session_state(session_id)
-        @sessions.dig(session_id, :state)
+        fetch(session_id).state
       end
 
       def submit_commitment(session_id, signer_id, commitment_bytes)
-        session = @sessions[session_id] or raise "Unknown session: #{session_id}"
-        session[:commitments] << { signer_id: signer_id, bytes: commitment_bytes }
-        return unless session[:commitments].length >= session[:threshold]
-
-        session[:state] = :commitments_collected
+        fetch(session_id).add_commitment(signer_id, commitment_bytes)
       end
 
       def submit_share(session_id, signer_id, share_bytes)
-        session = @sessions[session_id] or raise "Unknown session: #{session_id}"
-        session[:shares] << { signer_id: signer_id, bytes: share_bytes }
+        fetch(session_id).add_share(signer_id, share_bytes)
       end
 
       def aggregate(session_id)
-        session = @sessions[session_id] or raise "Unknown session: #{session_id}"
-        raise ThresholdError, 'Threshold not met' if session[:shares].length < session[:threshold]
+        fetch(session_id).aggregate
+      end
 
-        session[:state] = :completed
-        SCHEMES.fetch(session[:scheme]).call(
-          session[:shares].map { |s| s[:bytes] },
-          session[:threshold],
-          session[:message]
-        )
+      private
+
+      def fetch(session_id)
+        @sessions.fetch(session_id) do
+          raise NotFoundError.new("Unknown session: #{session_id}", kind: :session, identifier: session_id)
+        end
       end
     end
   end

data/lib/confium/tc/signing_session.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+module Confium
+  module TC
+    # One threshold-signing session: the state machine and the combine
+    # behind every coordinator surface. Coordinator (in-process) and
+    # NetworkCoordinator (TCP/NDJSON) are adapters over this class —
+    # they own registries and framing; the session owns the semantics:
+    #
+    #   pending → commitments_collected (T distinct commitments)
+    #          → completed (aggregate runs the scheme combine)
+    #
+    # Aggregate may be called again after completion — the combine
+    # randomizes its nonce, so each call yields a fresh (verifiable)
+    # signature over the same shares, which is what a network client
+    # retrying after a dropped response needs.
+    #
+    # Signer identity is load-bearing: one signer submitting two
+    # shares must never count twice toward the threshold, so
+    # commitments and shares are keyed by signer_id and duplicates
+    # raise.
+    class SigningSession
+      DEFAULT_UNLOCK_WINDOW = 14_400
+
+      SCHEMES = {
+        'CMP20-ECDSA-P256' => ->(shares, threshold, message) { Cmp20.sign(shares, threshold, message) },
+        'GG18-ECDSA-P256' => ->(shares, threshold, message) { Gg18.sign(shares, threshold, message) }
+      }.freeze
+
+      attr_reader :message, :threshold, :unlock_window, :scheme, :state
+
+      def initialize(message:, threshold:, unlock_window: DEFAULT_UNLOCK_WINDOW, scheme: 'CMP20-ECDSA-P256')
+        raise ArgumentError, "unknown scheme: #{scheme} (known: #{SCHEMES.keys.join(', ')})" unless SCHEMES.key?(scheme)
+
+        @message = message
+        @threshold = threshold
+        @unlock_window = unlock_window
+        @scheme = scheme
+        @state = :pending
+        # @type ivar @commitments: Hash[String, String]
+        @commitments = {}
+        # @type ivar @shares: Hash[String, String]
+        @shares = {}
+      end
+
+      def add_commitment(signer_id, commitment_bytes)
+        record(@commitments, signer_id, commitment_bytes)
+        @state = :commitments_collected if @commitments.length >= @threshold
+        self
+      end
+
+      def add_share(signer_id, share_bytes)
+        record(@shares, signer_id, share_bytes)
+        self
+      end
+
+      def commitment_count
+        @commitments.length
+      end
+
+      def share_count
+        @shares.length
+      end
+
+      def threshold_met?
+        @shares.length >= @threshold
+      end
+
+      def aggregate
+        unless threshold_met?
+          raise ThresholdError.new('Threshold not met', have_count: @shares.length, need_count: @threshold)
+        end
+
+        signature = SCHEMES.fetch(@scheme).call(@shares.values, @threshold, @message)
+        @state = :completed
+        signature
+      end
+
+      private
+
+      def record(store, signer_id, bytes)
+        if store.key?(signer_id)
+          raise ValidationError.new(
+            "duplicate submission from signer #{signer_id}",
+            param: :signer_id, expected: 'one submission per signer', actual: signer_id
+          )
+        end
+
+        store[signer_id] = bytes
+      end
+    end
+  end
+end

data/lib/confium/tc.rb

@@ -11,12 +11,10 @@
 # for the full interface specification.
 module Confium
   module TC
-    # The native extension defines Confium::TC; this namespace file is
-    # eager-required from confium.rb, so autoloads registered here do
-    # fire. Coordinator and ShareFile are pure Ruby and load with the
-    # namespace; Session wraps the engine via FFI and needs the
-    # external libconfium dylib, so it stays lazy.
-    autoload :Session, 'confium/tc/session'
+    # The native extension defines Confium::TC; this namespace file
+    # is eager-required from confium.rb, so autoloads never fire —
+    # the pure-Ruby companions load with the namespace directly.
+    require_relative 'tc/signing_session'
     require_relative 'tc/coordinator'
     require_relative 'tc/network_coordinator'
     require_relative 'tc/share_file'

data/lib/confium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confium
-  VERSION = '0.5.0'
+  VERSION = '0.6.0'
 end

data/lib/confium.rb

@@ -10,25 +10,14 @@
 # are loaded lazily via autoload — see lib/confium/<name>.rb.
 
 require_relative 'confium/version'
+require_relative 'confium/native_windows'
 
 begin
-  # Pre-built platform gems ship one extension per C-ABI window
-  # (Ruby 3.2 broke the 3.1 ABI — object shapes — and rb-sys
-  # references the VM pointer libruby stopped exporting in 3.3, so
-  # 3.1 and 3.2 get exact-minor builds while 3.3 covers 3.3+).
-  # Source builds install the extension flat, without a version
-  # directory.
-  minor = RUBY_VERSION[/\A\d+\.\d+/]
+  # Pre-built platform gems ship one extension per ABI window (the
+  # window rules live in Confium::NativeWindows). Source builds
+  # install the extension flat, without a version directory.
   dlext = RbConfig::CONFIG['DLEXT'] || 'so'
-  major = RUBY_VERSION[/\A\d+/].to_i
-  # 3.3-window binaries load on 3.3/3.4 only; a cross-major load
-  # (4.x) fails TypedData class checks, so the fallback applies
-  # within the 3.x line alone.
-  candidates = major == 3 && Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.3') ? [minor, '3.3'].uniq : [minor]
-  # Windows gems carry an exact-minor window per Ruby (a PE import
-  # names the version-specific ruby DLL); other platforms share the
-  # 3.3 window for 3.3+. Prefer the exact minor when present.
-  windowed = candidates.filter_map do |w|
+  windowed = Confium::NativeWindows.candidates(RUBY_VERSION).filter_map do |w|
     path = File.expand_path("confium_native/#{w}/confium_native.#{dlext}", __dir__ || '.')
     w if File.exist?(path)
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: confium
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: aarch64-linux
 authors:
 - Ribose Open
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-24 00:00:00.000000000 Z
+date: 2026-08-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -100,10 +100,7 @@ files:
 - lib/confium.rb
 - lib/confium/audit.rb
 - lib/confium/audit/otlp_sink.rb
-- lib/confium/cfm.rb
 - lib/confium/composite.rb
-- lib/confium/crypto.rb
-- lib/confium/digest.rb
 - lib/confium/errors.rb
 - lib/confium/errors/coerce.rb
 - lib/confium/errors/crypto_error.rb
@@ -115,8 +112,7 @@ files:
 - lib/confium/errors/unresolved_signer_error.rb
 - lib/confium/errors/validation_error.rb
 - lib/confium/errors/verification_error.rb
-- lib/confium/ffi.rb
-- lib/confium/lib.rb
+- lib/confium/native_windows.rb
 - lib/confium/openpgp.rb
 - lib/confium/pki.rb
 - lib/confium/pki/certificate_builder.rb
@@ -128,9 +124,8 @@ files:
 - lib/confium/tc.rb
 - lib/confium/tc/coordinator.rb
 - lib/confium/tc/network_coordinator.rb
-- lib/confium/tc/session.rb
-- lib/confium/tc/session_stub.rb
 - lib/confium/tc/share_file.rb
+- lib/confium/tc/signing_session.rb
 - lib/confium/transparency.rb
 - lib/confium/transparency/ots.rb
 - lib/confium/version.rb

data/lib/confium/cfm.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require 'ffi'
-
-module Confium
-  class CFM
-    attr_reader :ptr
-
-    def initialize
-      pptr = ::FFI::MemoryPointer.new(:pointer)
-      Confium.call_ffi(:cfm_create, pptr)
-      @ptr = ::FFI::AutoPointer.new(pptr.read_pointer, self.class.method(:destroy))
-    end
-
-    def self.destroy(ptr)
-      Confium::Lib.cfm_destroy(ptr)
-    end
-
-    def load_plugin(name, path)
-      Confium.call_ffi(:cfm_plugin_load, @ptr, name, path, nil, nil)
-    end
-  end
-end

data/lib/confium/crypto.rb

@@ -1,51 +0,0 @@
-# frozen_string_literal: true
-
-# {Confium::Crypto} is the registry namespace for Confium's cryptographic
-# interfaces.
-#
-# Mirroring the Rust plugin-interface registry (TODO #02), each Ruby
-# interface module (Digest, and future Cipher, AEAD, KDF, RNG, Signature,
-# KEM, ...) registers itself here on load rather than being enumerated in
-# a central case statement. This keeps the registry open for extension
-# (OCP) and makes the set of available interfaces a single source of
-# truth.
-#
-# Example:
-#
-#   module Confium
-#     module Digest
-#       Confium::Crypto.register(:hash, self)
-#     end
-#   end
-#
-#   Confium::Crypto.lookup(:hash)  # => Confium::Digest
-module Confium
-  module Crypto
-    # @type ivar @interfaces: Hash[Symbol, untyped]
-    @interfaces = {}
-
-    class << self
-      # Register an interface +klass+ under the symbolic +name+. Adding a
-      # new interface is a one-line registration; no central switch needs
-      # editing.
-      def register(name, klass)
-        @interfaces[name] = klass
-        klass
-      end
-
-      # Resolve a registered interface by +name+. Raises ArgumentError if
-      # nothing has been registered under that name.
-      def lookup(name)
-        @interfaces.fetch(name) do
-          raise ArgumentError, "unknown interface #{name.inspect}"
-        end
-      end
-
-      # Enumerate the names of every registered interface. Primarily for
-      # introspection and tooling.
-      def interfaces
-        @interfaces.keys.dup
-      end
-    end
-  end
-end

data/lib/confium/digest.rb

@@ -1,62 +0,0 @@
-# frozen_string_literal: true
-
-require 'ffi'
-require 'digest'
-
-module Confium
-  class Digest < ::Digest::Class
-    attr_reader :name, :ptr
-
-    def initialize(cfm, name)
-      @name = name
-      pptr = ::FFI::MemoryPointer.new(:pointer)
-      Confium.call_ffi(:cfm_hash_create, cfm.ptr, pptr, name, nil, nil, nil)
-      ptr = pptr.read_pointer
-      raise if ptr.null?
-
-      @ptr = ::FFI::AutoPointer.new(ptr, self.class.method(:destroy))
-    end
-
-    def initialize_copy(source)
-      @name = source.name
-      pptr = ::FFI::MemoryPointer.new(:pointer)
-      Confium.call_ffi(:cfm_hash_clone, source.ptr, pptr)
-      ptr = pptr.read_pointer
-      @ptr = ::FFI::AutoPointer.new(ptr, self.class.method(:destroy))
-    end
-
-    def self.destroy(ptr)
-      Confium::Lib.cfm_hash_destroy(ptr)
-    end
-
-    def block_length
-      plength = ::FFI::MemoryPointer.new(:uint32)
-      Confium.call_ffi(:cfm_hash_block_size, @ptr, plength)
-      plength.read(:uint32)
-    end
-
-    def digest_length
-      plength = ::FFI::MemoryPointer.new(:uint32)
-      Confium.call_ffi(:cfm_hash_output_size, @ptr, plength)
-      plength.read(:uint32)
-    end
-
-    def update(data)
-      Confium.call_ffi(:cfm_hash_update, @ptr, data, data.bytesize)
-      self
-    end
-
-    def reset
-      Confium.call_ffi(:cfm_hash_reset, @ptr)
-      self
-    end
-
-    def finish
-      buf = ::FFI::MemoryPointer.new(:uint8, digest_length)
-      Confium.call_ffi(:cfm_hash_finalize, @ptr, buf, buf.size)
-      buf.read_bytes(buf.size)
-    end
-
-    alias << update
-  end
-end

data/lib/confium/ffi.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require 'ffi'
-
-# {Confium::FFI} is the namespace for everything that touches the native
-# Confium shared library through Ruby-FFI.
-#
-# This file registers autoload entries for the planned FFI helper modules
-# (Library, Error, Options). They are listed in the TODO #14 architecture
-# (see `TODO.finalize/14-ruby-bindings-architecture.md`) and will be added
-# as the bindings grow; until then the autoloads are inert — they only
-# trigger a load when the corresponding constant is first referenced.
-#
-# Note: the legacy FFI library wrapper still lives at `Confium::Lib`
-# (file `confium/lib.rb`) and is autoloaded from `confium.rb`. It will be
-# migrated into `Confium::FFI::Library` in a follow-up.
-module Confium
-  module FFI
-    autoload :Library, 'confium/ffi/library'
-    autoload :Error,   'confium/ffi/error'
-    autoload :Options, 'confium/ffi/options'
-  end
-end

data/lib/confium/lib.rb

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-require 'ffi'
-
-module Confium
-  module Lib
-    extend ::FFI::Library
-
-    FFI_LAYOUT = {
-      cfm_create: [%i[pointer], :uint32],
-      cfm_destroy: [%i[pointer], :uint32],
-      cfm_plugin_load: [%i[pointer string string pointer pointer], :uint32],
-      cfm_hash_create: [%i[pointer pointer pointer pointer pointer pointer], :uint32],
-      cfm_hash_output_size: [%i[pointer pointer], :uint32],
-      cfm_hash_block_size: [%i[pointer pointer], :uint32],
-      cfm_hash_update: [%i[pointer pointer uint32], :uint32],
-      cfm_hash_reset: [%i[pointer], :uint32],
-      cfm_hash_clone: [%i[pointer pointer], :uint32],
-      cfm_hash_finalize: [%i[pointer pointer uint32], :uint32],
-      cfm_hash_destroy: [%i[pointer], :void]
-    }.freeze
-
-    ffi_lib([ENV.fetch('CONFIUM_LIB', nil), 'confium', 'libconfium'].compact)
-
-    FFI_LAYOUT.each do |func, ary|
-      class_eval do
-        attach_function(func, ary.first, ary.last)
-      end
-    rescue ::FFI::NotFoundError
-      # that's okay
-    end
-  end
-end

data/lib/confium/tc/session.rb

@@ -1,51 +0,0 @@
-# frozen_string_literal: true
-
-require 'confium/lib'
-
-# Confium::TC::Session wraps a threshold cryptography session.
-#
-# A session represents one signing or decryption operation involving
-# T-of-N parties. The session goes through states: pending →
-# commitments_collected → shares_collected → completed.
-#
-# Usage:
-#   session = Confium::TC::Session.new(scheme: "FROST-ed25519",
-#                                      threshold: 3,
-#                                      num_parties: 5,
-#                                      party_index: 0)
-#   session.set_local_share(share_bytes)
-#   session.round(incoming_messages) # returns outgoing messages
-#   result = session.result if session.complete?
-module Confium
-  module TC
-    class Session
-      attr_reader :scheme, :threshold, :num_parties, :party_index, :state
-
-      def initialize(scheme:, threshold:, num_parties:, party_index:)
-        @scheme = scheme
-        @threshold = threshold
-        @num_parties = num_parties
-        @party_index = party_index
-        @state = :pending
-        @local_share = nil
-        @result = nil
-      end
-
-      def set_local_share(share_bytes)
-        raise ArgumentError, 'share must be a String' unless share_bytes.is_a?(String)
-
-        @local_share = share_bytes
-      end
-
-      def complete?
-        @state == :completed
-      end
-
-      def result
-        raise 'Session not complete' unless complete?
-
-        @result
-      end
-    end
-  end
-end