confium 0.6.3-aarch64-linux → 0.7.1-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7c4d93f65610ac51b8971063f71aacca6db68894fd069518d2f44d04305ea18
-  data.tar.gz: 4e48317b7168323cf3bb4f10e5ecd5346b4fe47417a8aa75460842e4053db9ab
+  metadata.gz: 7cab2b2ace3e324582536762cd815c779eb2e2d4beb2aa8b9d14a96b217e6df6
+  data.tar.gz: de2dfb7bf71bfe5b54744f3e14a0ffaa12d63f5a32c6baa39ff3de1fce9c801c
 SHA512:
-  metadata.gz: 2fdf87bc54d8521635ad2ab5b08aa23b7236ea396b5422f49a1fc0b5bb32d4b272029142b297848824ab31ad16af4b64ab1f2fcfcffae12743ac2daafdbbbe15
-  data.tar.gz: 5342fd696b0768166d62a2325259ce6f29e089eb36b075fa7b96f774827d0ab5c9f2b50770cb4c0e016d43870d915e6fee8600b978f18f38ed713ad288a97b59
+  metadata.gz: 252ee6c69983a91d316b3d45c7a8f5cb3632494b6962bcce98202378c1860f168ae09f66fa6d36d1c516f6c683a21ea919d44422a7261df04a6478b198f065d2
+  data.tar.gz: ff7af357dc2d7f35f568ebd42fd0dca670312ef68953bf91f4c74108e9c6f7336ccf91a9dc9c802e4cb7f18208569ea6b9cffde9866a448ee8ecff2c1d153d62

data/CHANGELOG.md

@@ -1,5 +1,72 @@
 # Changelog
 
+## [0.7.1] — UNRELEASED (code on main; release on the owner's tag)
+
+### Added
+
+- `Confium::Transparency::OTS` is now the real OpenTimestamps
+  wire-protocol binding (confium-transparency 0.9): `OTS::Client#stamp`
+  POSTs the 32-byte digest to the calendar pool and returns a `Proof`
+  carrying the parsed partial proof; `#upgrade` polls for a confirmed
+  one; `Proof#verify` replays the op tree and classifies attestations
+  (pending URIs, Bitcoin/Litecoin heights, `anchored`). Module-level
+  `OTS.stamp`/`verify`/`upgrade` over the default calendar pool.
+  Network failures raise (`IOError`/`ParseError`) — the stub-era
+  silent nil is gone.
+- The calendar round trip releases the GVL (direct
+  `rb_thread_call_without_gvl` trampoline — magnus 0.8 does not wrap
+  it), so a slow calendar never freezes the VM.
+
+### Fixed
+
+- The workspace's OTS file magic was missing its final two salt bytes
+  (29 vs 31; shifted every parse offset for real .ots files) — caught
+  by this binding's cross-checked specs, fixed in confium-transparency
+  v0.9.1.
+
+## [0.7.0] — 2026-09-07
+
+### Added
+
+- `Confium::Transport::SignerClient` / `CoordinatorServer` —
+  coordinator sessions over any registry transport the extension
+  links, addressed by URL: `tcp://host:port` for local/trusted
+  networks, `noise://host:port` for Noise_XX
+  (`Noise_XX_25519_ChaChaPoly_BLAKE2s`) encrypted sessions.
+  `noise://` URLs take `key=<hex>` (local static private key;
+  ephemeral and trust-on-first-use when omitted) and `pinned=<hex>`
+  (SHA-256 fingerprint of the expected peer static key — the
+  handshake aborts on mismatch). The handshake carries a 10-second
+  deadline so a non-Noise peer fails fast instead of hanging.
+  `SignerClient` exposes `#register`, `#create_session`,
+  `#submit_commitment`, `#submit_share` (returns the aggregated
+  signature once the threshold is met, else nil);
+  `CoordinatorServer.new(url)` serves any linked scheme for tests
+  and single-process deployments.
+
+### Changed
+
+- **BREAKING**: `Confium::Net` is `Confium::Transport`. Defining
+  `Confium::Net` shadowed Ruby stdlib `Net` for every constant
+  lookup under the `Confium` namespace — `Confium::Audit::OtlpSink`'s
+  `Net::HTTP` resolved to `Confium::Net::HTTP` and raised
+  `NameError`. No prior release shipped the `Net` names.
+
+## [0.6.3] — 2026-08-26
+
+### Added
+
+- `Confium::TC::Session` — per-party threshold protocol sessions
+  over confium-tc-core 0.4: each signer process runs its own
+  session (`"FROST-ed25519-dkg"` for distributed key generation,
+  `"FROST-ed25519"` for signing with the DKG share and message) and
+  exchanges only `round_step` messages — the share never leaves the
+  process. `#round_step(incoming)` returns
+  `{ "outgoing" => [...], "complete" => bool }`; the completed DKG
+  session's `#result` is the party's share blob, the signing
+  session's `#result` an RFC 8032 Ed25519 signature verifiable under
+  the group public key.
+
 ## [0.6.2] — 2026-08-26
 
 ### Added

data/Cargo.lock

@@ -135,6 +135,15 @@ dependencies = [
  "wyz",
 ]
 
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -207,6 +216,30 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "chacha20poly1305"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+ "zeroize",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@@ -229,6 +262,7 @@ checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common 0.1.7",
  "inout",
+ "zeroize",
 ]
 
 [[package]]
@@ -301,7 +335,7 @@ checksum = "e8c96d4d5997726cf0eb794410e3e8bbce839cfba9c4a32e26ede0c076b02e64"
 dependencies = [
  "chrono",
  "confium-api",
- "confium-net",
+ "confium-net 0.3.0",
  "confium-store 0.3.0",
  "confium-tc-core 0.3.0",
  "data-encoding",
@@ -321,6 +355,26 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "confium-coordinator"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f49eae3301b6f1f2f36b2eb66d0fdd863bcecb1dc18b51ec51e5f8d1bb9dc3"
+dependencies = [
+ "chrono",
+ "confium-net 0.8.5",
+ "getrandom 0.4.3",
+ "hex",
+ "hmac 0.13.0",
+ "p256 0.14.0",
+ "rand_core 0.6.4",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "thiserror 2.0.20",
+ "tracing",
+]
+
 [[package]]
 name = "confium-core"
 version = "0.2.0"
@@ -413,6 +467,44 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "confium-net"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bd7098e54033a09b1f6a4ebd0c0f54d6c44da8f46cfdff7ae156895f1083fc6"
+dependencies = [
+ "inventory",
+ "snafu 0.9.2",
+ "url",
+]
+
+[[package]]
+name = "confium-net-noise"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "213e90ce6daa40d1ec92d8e524276744a07f027c453bd32815f80c29ba947237"
+dependencies = [
+ "confium-net 0.8.5",
+ "inventory",
+ "sha2 0.11.0",
+ "snafu 0.9.2",
+ "snow",
+ "url",
+ "x25519-dalek",
+]
+
+[[package]]
+name = "confium-net-tcp"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b80e3d692ed5328a72e754a0f73d81f6c8fde3714d05fc0be1953f657e05f76"
+dependencies = [
+ "confium-net 0.8.5",
+ "inventory",
+ "snafu 0.9.2",
+ "url",
+]
+
 [[package]]
 name = "confium-observability"
 version = "0.3.0"
@@ -493,8 +585,8 @@ checksum = "3dd7d4965aef12324cb76d397294c317b83b774de029f1d37b387cf54ba9593c"
 dependencies = [
  "chrono",
  "confium-api",
- "confium-coordinator",
- "confium-net",
+ "confium-coordinator 0.3.0",
+ "confium-net 0.3.0",
  "confium-store 0.3.0",
  "confium-tc-keys",
  "data-encoding",
@@ -566,7 +658,7 @@ checksum = "add3e15337ce81944f78c9ce844d870a081cbe91506a85b9a5c4e4c0da983771"
 dependencies = [
  "chrono",
  "confium-api",
- "confium-net",
+ "confium-net 0.3.0",
  "confium-store 0.3.0",
  "data-encoding",
  "hex",
@@ -683,17 +775,18 @@ dependencies = [
 
 [[package]]
 name = "confium-transparency"
-version = "0.4.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "874cdab3dded22c22980d3a5b1f802301739368a32e9196bc645600329c07dcf"
+checksum = "b4ec484381b582f508f774babbc1bf1b4a98c6aadd43cde806952c6e416b62ca"
 dependencies = [
  "chrono",
- "data-encoding",
+ "hex",
  "serde",
  "serde_json",
- "sha2 0.10.9",
- "snafu 0.8.9",
- "thiserror 1.0.69",
+ "sha2 0.11.0",
+ "subtle",
+ "thiserror 2.0.20",
+ "ureq",
 ]
 
 [[package]]
@@ -703,10 +796,13 @@ dependencies = [
  "chrono",
  "confium-attributes",
  "confium-composite",
+ "confium-coordinator 0.8.5",
  "confium-core",
  "confium-crypto-vss",
  "confium-crypto-zk",
  "confium-deployment",
+ "confium-net-noise",
+ "confium-net-tcp",
  "confium-observability",
  "confium-pki",
  "confium-privacy",
@@ -1215,6 +1311,18 @@ dependencies = [
  "wasi",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.4.3"
@@ -1223,7 +1331,7 @@ checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
  "libc",
- "r-efi",
+ "r-efi 6.0.0",
  "rand_core 0.10.1",
 ]
 
@@ -1785,6 +1893,17 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash",
+]
+
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -1879,6 +1998,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "r-efi"
 version = "6.0.0"
@@ -2348,6 +2473,23 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "snow"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "599b506ccc4aff8cf7844bc42cf783009a434c1e26c964432560fb6d6ad02d82"
+dependencies = [
+ "aes-gcm",
+ "blake2",
+ "chacha20poly1305",
+ "curve25519-dalek",
+ "getrandom 0.3.4",
+ "ring",
+ "rustc_version",
+ "sha2 0.10.9",
+ "subtle",
+]
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -2666,6 +2808,15 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.126"
@@ -2870,6 +3021,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
 [[package]]
 name = "wnaf"
 version = "0.14.0"
@@ -2896,6 +3053,18 @@ dependencies = [
  "tap",
 ]
 
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core 0.6.4",
+ "serde",
+ "zeroize",
+]
+
 [[package]]
 name = "x509-cert"
 version = "0.3.0"

data/README.adoc

@@ -18,7 +18,7 @@ Add to your Gemfile:
 
 [source,ruby]
 ----
-gem "confium", "~> 0.3"
+gem "confium", "~> 0.7"
 ----
 
 Or install directly:
@@ -78,18 +78,38 @@ kp = Confium::TC::FrostP256.generate_keypair
 shares = Confium::TC::FrostP256.split_secret(kp["private_key"], 3, 5)
 recovered = Confium::TC::FrostP256.recover_secret(shares.first(3).map { |s| { "x" => s.x, "y" => s.y_bytes } })
 recovered == kp["private_key"]  # => true
+
+# Distributed key generation + 2-of-3 FROST-ed25519 signing (each party
+# holds its own Confium::TC::Session and only exchanges round messages)
+parties = %w[alice bob carol]
+sessions = parties.each_with_index.map do |id, i|
+  Confium::TC::Session.new("FROST-ed25519-dkg", parties: parties, threshold: 2, this_party_idx: i)
+end
+# run rounds: session.round_step(messages_in) -> {"outgoing" => [...], "complete" => bool}
+# broadcast "outgoing" payloads between sessions until every session is complete
+dkg_share = sessions.first.result  # this party's share (embeds the group public key)
+
+signers = sessions.first(2).map.with_index do |s, i|
+  Confium::TC::Session.new("FROST-ed25519",
+                           parties: parties.first(2), threshold: 2, this_party_idx: i,
+                           local_share: dkg_share, message: "authentic message")
+end
+# run rounds as above; the completed session's #result is an RFC 8032
+# Ed25519 signature verifiable under the group public key
 ----
 
-== API surface (v0.3)
+== API surface (v0.7)
 
 === `Confium::Transparency`
 - `MerkleTree.new` / `#append(artifact_hash)` / `#root` / `#length` / `#empty?` / `#inclusion_proof(seq)`
 - `InclusionProof#sequence` / `#steps` / `#verify(root)`
+- `Ots.stamp(hash)` / `Ots.verify(proof)` / `Ots.upgrade(proof)` — real OpenTimestamps anchoring over the wire protocol (calendar HTTP, servers tried in order; the network round trip releases the GVL). `Ots::Client.new(servers)` for a custom pool; `Ots::Proof#verify` replays the op tree and classifies attestations. Network failures raise — there is no silent nil
 
 === `Confium::Composite` — PQ migration
 - `.generate_ed25519_keypair` → `{ private_key:, public_key: }`
 - `.sign_ed25519(private_key, message)` → component Hash
-- `Signature.new(components)` / `#verify(message)` / `#component_count` / `#algorithms`
+- `Signature.new(components)` / `#verify(message)` / `#component_count` / `#algorithms` / `#to_json`
+- `.from_json(json)` / `.components_to_json(components)` / `.canonical_json(json, data)`
 - `VerificationResult#all_verified?` / `#per_component`
 
 === `Confium::Attributes` — threshold policy DSL
@@ -99,11 +119,14 @@ recovered == kp["private_key"]  # => true
 - DSL: `min_count("attr", n)`, `min_distinct("attr", n)`, `any("attr")`, `all("attr")`, `none("attr")`, `and(...)`, `or(...)`, `not(p)`
 
 === `Confium::PKI`
-- `Certificate.from_der(bytes)` / `.from_pem(str)` / `#to_der` / `#to_pem` / `#fingerprint_sha256` / `#serial_hex` / `#not_before` / `#not_after` / `#valid_at?(iso8601)` / `#public_key_bytes`
+- `Certificate.from_der(bytes)` / `.from_pem(str)` / `#to_der` / `#to_pem` / `#fingerprint_sha256` / `#serial_hex` / `#not_before` / `#not_after` / `#valid_at?(iso8601)` / `#public_key_bytes`; DER parse failures carry a byte `offset` in the error details
+- `CertificateBuilder` / `CMS::SignedDataBuilder` — build certificates and signed data in Ruby
+- `PathValidator.validate(leaf, intermediates, root, now_iso8601 = nil)` → `PathValidationResult` (chain validation leaf → root at a point in time)
 - `CSR.from_der` / `.from_pem` / `#to_der` / `#to_pem`
 - `CMS::SignedData.from_json` / `#to_json` / `#signer_count` / `#content_type` / `#content` / `#certificate_count` / `#certificate_at(i)`
 - `CMS::Content#bytes` / `#length`
 - `XMLDSig.canonicalize(xml)` / `.canonicalize_exclusive(xml)` (Canonical XML RFC 3076 + Exclusive C14N)
+- `Cnml` — institutional certificate workflow helpers
 
 === `Confium::Identity` — actor roles
 - `.actor_types` → `["manufacturer", "testing_lab", "issuing_authority_officer", "biml_director", "quorum_coordinator", "verifier"]`
@@ -123,6 +146,51 @@ recovered == kp["private_key"]  # => true
 - `.partial_decrypt(party_index, share_bytes, ciphertext)` → `{ party_index:, bytes: }`
 - `.aggregate_partials(partials, threshold, ciphertext)` → shared_secret bytes
 
+=== `Confium::TC::Cmp20` / `Confium::TC::Gg18` — threshold ECDSA protocols
+- `.keygen(threshold, parties)` → `{ public_key, shares }`
+- `.sign(shares, public_key, message)` → DER ECDSA signature
+
+=== `Confium::TC::Session` — per-party threshold sessions (real FROST)
+- `Session.new(scheme, parties:, threshold:, this_party_idx:, local_share: nil, message: nil)` — `"FROST-ed25519-dkg"` for distributed key generation, `"FROST-ed25519"` for signing (pass the DKG share and the message)
+- `#scheme_name` / `#threshold` / `#party_count` / `#this_party_idx` / `#round` / `#complete?`
+- `#round_step(messages)` → `{ "outgoing" => [{from, to, round, payload}...], "complete" => bool }` — feed each round's incoming messages, broadcast the outgoing ones
+- `#result` — after DKG: share blob (group public key + party share); after signing: RFC 8032 Ed25519 signature
+
+=== `Confium::TC::Coordinator` — quorum signing orchestration
+- `Coordinator.new(quorum_id:)` / `#create_session(message:, threshold:, scheme: "CMP20-ECDSA-P256")` / `#submit_commitment` / `#submit_share` / `#aggregate` / `#session_state`
+- `SigningSession#add_commitment` / `#add_share` / `#threshold_met?` / `#aggregate` — the seam every transport adapts to
+- `NetworkCoordinator` — TCP/NDJSON server (`#start` / `#stop` / `#running?`); `SignerClient` — remote submit + aggregate with typed `RemoteError`
+- `ShareFile` — encrypted share-file persistence
+
+=== `Confium::Store::Keystore` — key handles and remote signing
+- `Keystore.new(backend, **options)` / `.backends`
+- `#sign(key_id, algorithm, message)` → signature bytes (sign-with-handle contract; cloud KMS backends `aws-kms` / `gcp-kms` / `azure-keyvault` via cargo features)
+
+=== `Confium::Audit` — structured audit trail
+- `Audit.sink =` / `Audit.sink` / `Audit.enabled?` / `Audit.record(...)`
+- `Sink` (base) / `MemorySink` / `StderrSink` / `FileSink`
+- `OtlpSink.new(endpoint:, headers:, service_name:, ...)` — OTLP/HTTP export with retry and `#dropped` counter
+
+=== `Confium::OpenPGP`
+- `.armor(data, type)` / `.dearmor(data)` — RFC 9580 §6 ASCII armor with CRC-24 (pure Ruby)
+- `.verify_detached(message, signature, keys)` / `.verify(...)` — real signature verification when the extension is built with the `pgp` feature; `PGP_AVAILABLE` reports it
+
+=== `Confium::Transport` — coordinator clients over any transport
+- `SignerClient.new(url)` — connect over any registry transport: `tcp://host:port` (local/trusted) or `noise://host:port?key=<hex>&pinned=<hex>` (Noise_XX encrypted, stable identity + peer pinning)
+- `#register(signer_id, quorum_id)` / `#create_session(quorum_id, scheme, message, threshold, num_parties)` → session id
+- `#submit_commitment(session_id, signer_id, bytes)` / `#submit_share(session_id, signer_id, bytes)`
+- `CoordinatorServer.new(url)` — serve coordinator sessions over any linked scheme (test/in-process use)
+
+=== `Confium::ERS` — evidence records
+- `EvidenceRecord.build_initial(...)` / `#renew(...)` / `#renewal_count` (RFC 4998 / RFC 6283 archival)
+
+=== `Confium::Policy` / `Confium::SecureBytes`
+- `Policy.jurisdiction = :eu` — jurisdictional algorithm policy (EU/US profiles; SM2/SM3/SM4 for CN planned)
+- `SecureBytes.wrap(raw)` — zeroize-on-clear wrapper for private keys, shares, and secrets (`#bytes` non-destructive read, `#clear`)
+
+=== Errors
+- Typed error hierarchy (`ParseError`, `ThresholdError`, `VerificationError`, `PolicyViolationError`, ...) — native failures surface positional `details` hashes (including DER byte offsets for parse errors)
+
 == Development
 
 After checking out the repo:

data/confium.gemspec

@@ -40,6 +40,8 @@ Gem::Specification.new do |spec|
   ]
   spec.files.reject! { |f| File.directory?(f) }
   spec.files.reject! { |f| f =~ /\.(dll|so|dylib|lib|bundle)\Z/ }
+  # Windows socket diagnostic crate — development-only, never shipped.
+  spec.files.reject! { |f| f.start_with?('ext/socket-smoke/') }
   spec.require_paths = ['lib']
 
   spec.required_ruby_version = '>= 3.1.0'

data/lib/confium/transparency/ots.rb

@@ -1,14 +1,13 @@
 # frozen_string_literal: true
 
-# Confium::Transparency::OTS — OpenTimestamps client interface.
+# Confium::Transparency::OTS — OpenTimestamps calendar client.
 #
-# Wraps confium-transparency::ots::Client for anchoring Merkle tree
-# roots in the Bitcoin blockchain via OTS calendar servers.
-#
-# This is a pure-Ruby stub that defines the interface. The actual
-# OTS stamping requires network access to calendar servers and
-# will be wired through the Rust extension in a future PR
-# (TODO.completion/011-ots-ers-exposure.md).
+# Real wire-protocol implementation over the native extension
+# (confium-transparency 0.8.5+): stamps POST the 32-byte digest to a
+# calendar server and parse the returned partial proof; verification
+# replays the op tree from the digest and classifies attestations.
+# Network failures raise (Confium::Transparency::OTS is backed by a
+# real HTTP client) — there is no silent nil.
 
 module Confium
   module Transparency
@@ -20,44 +19,48 @@ module Confium
         https://a.pool.eternitywall.com
       ].freeze
 
-      # An OTS receipt proving that a hash was anchored in Bitcoin
-      # at a specific block height.
-      class Receipt
-        attr_reader :bytes, :block_height
+      class << self
+        # Stamp a 32-byte digest via the default calendar pool.
+        # Returns a Proof (pending attestation — Bitcoin confirmation
+        # arrives later; poll with #upgrade).
+        #
+        # @param hash [String] 32-byte SHA-256 digest to anchor
+        # @return [Confium::Transparency::OTS::Proof]
+        # @raise [IOError, ArgumentError]
+        def stamp(hash)
+          default_client.stamp(hash)
+        end
 
-        def initialize(bytes:, block_height: nil)
-          @bytes = bytes
-          @block_height = block_height
+        # Verify a proof: replay its op tree from the digest and
+        # classify the attestations.
+        #
+        # @param proof [Proof, String] the proof (or raw .ots bytes —
+        #   pass the digest alongside for the String form)
+        # @param digest [String, nil] required when proof is bytes
+        # @return [Hash] { pending: [uri], bitcoin: [height],
+        #   litecoin: [height], anchored: bool }
+        def verify(proof, digest = nil)
+          proof = Proof.new(digest, proof) if digest && proof.is_a?(String)
+          proof.verify
         end
 
-        def to_bytes
-          @bytes
+        # Upgrade a pending proof (fetch a more complete one).
+        #
+        # @return [Proof]
+        def upgrade(proof)
+          default_client.upgrade(proof)
         end
-      end
 
-      # Stamp a 32-byte hash via OTS calendar servers.
-      # Returns a Receipt (stub: returns nil — requires network).
-      #
-      # @param hash [String] 32-byte SHA-256 hash to anchor
-      # @return [Receipt, nil]
-      def self.stamp(_hash)
-        # Real implementation: calls the Rust OTS client which
-        # submits the hash to calendar servers and returns a
-        # merged proof. Requires network access.
-        nil
-      end
+        private
 
-      # Verify an OTS receipt against a hash.
-      # Returns true if the receipt proves the hash was anchored.
-      #
-      # @param receipt [Receipt, String] the OTS proof
-      # @param hash [String] the 32-byte hash
-      # @return [Boolean]
-      def self.verify(_receipt, _hash)
-        # Real implementation: calls the Rust OTS verifier which
-        # walks the Bitcoin blockchain proof.
-        false
+        def default_client
+          @default_client ||= Client.new(DEFAULT_CALENDARS)
+        end
       end
+
+      # The native Client is defined by the extension
+      # (Confium::Transparency::OTS::Client) with #stamp / #upgrade;
+      # the Proof class carries #digest / #to_bytes / #verify.
     end
   end
 end

data/lib/confium/transparency.rb

@@ -5,8 +5,8 @@
 # The Transparency module itself is defined by the native Rust
 # extension via magnus at require time. This file registers
 # pure-Ruby autoloads for the Transparency submodules.
-module Confium
-  module Transparency
-    autoload :OTS, 'confium/transparency/ots'
-  end
-end
+# `require`, not `autoload`: the native extension defines the OTS
+# constant at load time, which would shadow the autoload entry and
+# keep this file from ever running — the Ruby-level convenience
+# methods would silently vanish.
+require 'confium/transparency/ots'

data/lib/confium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confium
-  VERSION = '0.6.3'
+  VERSION = '0.7.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: confium
 version: !ruby/object:Gem::Version
-  version: 0.6.3
+  version: 0.7.1
 platform: aarch64-linux
 authors:
 - Ribose Open
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-26 00:00:00.000000000 Z
+date: 2026-09-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake