confium 0.6.3 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0739c3bc2fd3d3d347fd283d19bb70b9bd1611cd262c4d6229b80828d67b441c'
-  data.tar.gz: ae757155d9a5312662d44ac21d740c68228b2e8ad011c178e168969b2563d068
+  metadata.gz: 604e0df1709827705bdca8fabd5ac2c5bdb70eb1e32b550e7ad7bfca143d7dcc
+  data.tar.gz: b1d4eea58189c4e1acf7613c27efc23ea7a76ea6afb9a32b911f27d56dc45a7c
 SHA512:
-  metadata.gz: d17228e2f724d28a2481bd6c115cdec90f8955b346c7f72a22b0217d78f5365bbcb61930d08662562c1f9e4ec8b05eeb8dc73c63b30f902dbe27ede051fa9408
-  data.tar.gz: 7780ff8ceff7791de1bca7e5dc7e15215db6886eec4cd6d01dbc75b0fa8d04c7d0350234bd33f8d5dfd94587b532c088246c59a28e7edd99ad3fb077ed7d8d34
+  metadata.gz: e07456a3f0a1c4499290372d238fd15e173e578deabb01de7bea5c5b6c014495eab86b962c71f33fb3f21c9d2f9124dd982373c5e7df404c011955180d136b1f
+  data.tar.gz: 2ee41a6707200f709086c9ae63d73554f2aa8836abf06c732a1ac904fded30baece97813b50a8229c2a351ea3cf0430d2265d3f93b06aa49daa4f8447c67e037

data/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## [0.7.0] — 2026-09-07
+
+### Added
+
+- `Confium::Transport::SignerClient` / `CoordinatorServer` —
+  coordinator sessions over any registry transport the extension
+  links, addressed by URL: `tcp://host:port` for local/trusted
+  networks, `noise://host:port` for Noise_XX
+  (`Noise_XX_25519_ChaChaPoly_BLAKE2s`) encrypted sessions.
+  `noise://` URLs take `key=<hex>` (local static private key;
+  ephemeral and trust-on-first-use when omitted) and `pinned=<hex>`
+  (SHA-256 fingerprint of the expected peer static key — the
+  handshake aborts on mismatch). The handshake carries a 10-second
+  deadline so a non-Noise peer fails fast instead of hanging.
+  `SignerClient` exposes `#register`, `#create_session`,
+  `#submit_commitment`, `#submit_share` (returns the aggregated
+  signature once the threshold is met, else nil);
+  `CoordinatorServer.new(url)` serves any linked scheme for tests
+  and single-process deployments.
+
+### Changed
+
+- **BREAKING**: `Confium::Net` is `Confium::Transport`. Defining
+  `Confium::Net` shadowed Ruby stdlib `Net` for every constant
+  lookup under the `Confium` namespace — `Confium::Audit::OtlpSink`'s
+  `Net::HTTP` resolved to `Confium::Net::HTTP` and raised
+  `NameError`. No prior release shipped the `Net` names.
+
+## [0.6.3] — 2026-08-26
+
+### Added
+
+- `Confium::TC::Session` — per-party threshold protocol sessions
+  over confium-tc-core 0.4: each signer process runs its own
+  session (`"FROST-ed25519-dkg"` for distributed key generation,
+  `"FROST-ed25519"` for signing with the DKG share and message) and
+  exchanges only `round_step` messages — the share never leaves the
+  process. `#round_step(incoming)` returns
+  `{ "outgoing" => [...], "complete" => bool }`; the completed DKG
+  session's `#result` is the party's share blob, the signing
+  session's `#result` an RFC 8032 Ed25519 signature verifiable under
+  the group public key.
+
 ## [0.6.2] — 2026-08-26
 
 ### Added

data/Cargo.lock

@@ -135,6 +135,15 @@ dependencies = [
  "wyz",
 ]
 
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -207,6 +216,30 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "chacha20poly1305"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+ "zeroize",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@@ -229,6 +262,7 @@ checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common 0.1.7",
  "inout",
+ "zeroize",
 ]
 
 [[package]]
@@ -301,7 +335,7 @@ checksum = "e8c96d4d5997726cf0eb794410e3e8bbce839cfba9c4a32e26ede0c076b02e64"
 dependencies = [
  "chrono",
  "confium-api",
- "confium-net",
+ "confium-net 0.3.0",
  "confium-store 0.3.0",
  "confium-tc-core 0.3.0",
  "data-encoding",
@@ -321,6 +355,26 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "confium-coordinator"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f49eae3301b6f1f2f36b2eb66d0fdd863bcecb1dc18b51ec51e5f8d1bb9dc3"
+dependencies = [
+ "chrono",
+ "confium-net 0.8.5",
+ "getrandom 0.4.3",
+ "hex",
+ "hmac 0.13.0",
+ "p256 0.14.0",
+ "rand_core 0.6.4",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "thiserror 2.0.20",
+ "tracing",
+]
+
 [[package]]
 name = "confium-core"
 version = "0.2.0"
@@ -413,6 +467,44 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "confium-net"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bd7098e54033a09b1f6a4ebd0c0f54d6c44da8f46cfdff7ae156895f1083fc6"
+dependencies = [
+ "inventory",
+ "snafu 0.9.2",
+ "url",
+]
+
+[[package]]
+name = "confium-net-noise"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "213e90ce6daa40d1ec92d8e524276744a07f027c453bd32815f80c29ba947237"
+dependencies = [
+ "confium-net 0.8.5",
+ "inventory",
+ "sha2 0.11.0",
+ "snafu 0.9.2",
+ "snow",
+ "url",
+ "x25519-dalek",
+]
+
+[[package]]
+name = "confium-net-tcp"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b80e3d692ed5328a72e754a0f73d81f6c8fde3714d05fc0be1953f657e05f76"
+dependencies = [
+ "confium-net 0.8.5",
+ "inventory",
+ "snafu 0.9.2",
+ "url",
+]
+
 [[package]]
 name = "confium-observability"
 version = "0.3.0"
@@ -493,8 +585,8 @@ checksum = "3dd7d4965aef12324cb76d397294c317b83b774de029f1d37b387cf54ba9593c"
 dependencies = [
  "chrono",
  "confium-api",
- "confium-coordinator",
- "confium-net",
+ "confium-coordinator 0.3.0",
+ "confium-net 0.3.0",
  "confium-store 0.3.0",
  "confium-tc-keys",
  "data-encoding",
@@ -566,7 +658,7 @@ checksum = "add3e15337ce81944f78c9ce844d870a081cbe91506a85b9a5c4e4c0da983771"
 dependencies = [
  "chrono",
  "confium-api",
- "confium-net",
+ "confium-net 0.3.0",
  "confium-store 0.3.0",
  "data-encoding",
  "hex",
@@ -703,10 +795,13 @@ dependencies = [
  "chrono",
  "confium-attributes",
  "confium-composite",
+ "confium-coordinator 0.8.5",
  "confium-core",
  "confium-crypto-vss",
  "confium-crypto-zk",
  "confium-deployment",
+ "confium-net-noise",
+ "confium-net-tcp",
  "confium-observability",
  "confium-pki",
  "confium-privacy",
@@ -1215,6 +1310,18 @@ dependencies = [
  "wasi",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.4.3"
@@ -1223,7 +1330,7 @@ checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
  "libc",
- "r-efi",
+ "r-efi 6.0.0",
  "rand_core 0.10.1",
 ]
 
@@ -1785,6 +1892,17 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash",
+]
+
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -1879,6 +1997,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "r-efi"
 version = "6.0.0"
@@ -2348,6 +2472,23 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "snow"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "599b506ccc4aff8cf7844bc42cf783009a434c1e26c964432560fb6d6ad02d82"
+dependencies = [
+ "aes-gcm",
+ "blake2",
+ "chacha20poly1305",
+ "curve25519-dalek",
+ "getrandom 0.3.4",
+ "ring",
+ "rustc_version",
+ "sha2 0.10.9",
+ "subtle",
+]
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -2666,6 +2807,15 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.126"
@@ -2870,6 +3020,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
 [[package]]
 name = "wnaf"
 version = "0.14.0"
@@ -2896,6 +3052,18 @@ dependencies = [
  "tap",
 ]
 
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core 0.6.4",
+ "serde",
+ "zeroize",
+]
+
 [[package]]
 name = "x509-cert"
 version = "0.3.0"

data/README.adoc

@@ -18,7 +18,7 @@ Add to your Gemfile:
 
 [source,ruby]
 ----
-gem "confium", "~> 0.3"
+gem "confium", "~> 0.7"
 ----
 
 Or install directly:
@@ -78,18 +78,38 @@ kp = Confium::TC::FrostP256.generate_keypair
 shares = Confium::TC::FrostP256.split_secret(kp["private_key"], 3, 5)
 recovered = Confium::TC::FrostP256.recover_secret(shares.first(3).map { |s| { "x" => s.x, "y" => s.y_bytes } })
 recovered == kp["private_key"]  # => true
+
+# Distributed key generation + 2-of-3 FROST-ed25519 signing (each party
+# holds its own Confium::TC::Session and only exchanges round messages)
+parties = %w[alice bob carol]
+sessions = parties.each_with_index.map do |id, i|
+  Confium::TC::Session.new("FROST-ed25519-dkg", parties: parties, threshold: 2, this_party_idx: i)
+end
+# run rounds: session.round_step(messages_in) -> {"outgoing" => [...], "complete" => bool}
+# broadcast "outgoing" payloads between sessions until every session is complete
+dkg_share = sessions.first.result  # this party's share (embeds the group public key)
+
+signers = sessions.first(2).map.with_index do |s, i|
+  Confium::TC::Session.new("FROST-ed25519",
+                           parties: parties.first(2), threshold: 2, this_party_idx: i,
+                           local_share: dkg_share, message: "authentic message")
+end
+# run rounds as above; the completed session's #result is an RFC 8032
+# Ed25519 signature verifiable under the group public key
 ----
 
-== API surface (v0.3)
+== API surface (v0.7)
 
 === `Confium::Transparency`
 - `MerkleTree.new` / `#append(artifact_hash)` / `#root` / `#length` / `#empty?` / `#inclusion_proof(seq)`
 - `InclusionProof#sequence` / `#steps` / `#verify(root)`
+- `Ots.stamp(hash)` / `Ots.verify(receipt, hash)` — OpenTimestamps anchoring interface (pure-Ruby stub; calendar-server wiring lands with the Rust client)
 
 === `Confium::Composite` — PQ migration
 - `.generate_ed25519_keypair` → `{ private_key:, public_key: }`
 - `.sign_ed25519(private_key, message)` → component Hash
-- `Signature.new(components)` / `#verify(message)` / `#component_count` / `#algorithms`
+- `Signature.new(components)` / `#verify(message)` / `#component_count` / `#algorithms` / `#to_json`
+- `.from_json(json)` / `.components_to_json(components)` / `.canonical_json(json, data)`
 - `VerificationResult#all_verified?` / `#per_component`
 
 === `Confium::Attributes` — threshold policy DSL
@@ -99,11 +119,14 @@ recovered == kp["private_key"]  # => true
 - DSL: `min_count("attr", n)`, `min_distinct("attr", n)`, `any("attr")`, `all("attr")`, `none("attr")`, `and(...)`, `or(...)`, `not(p)`
 
 === `Confium::PKI`
-- `Certificate.from_der(bytes)` / `.from_pem(str)` / `#to_der` / `#to_pem` / `#fingerprint_sha256` / `#serial_hex` / `#not_before` / `#not_after` / `#valid_at?(iso8601)` / `#public_key_bytes`
+- `Certificate.from_der(bytes)` / `.from_pem(str)` / `#to_der` / `#to_pem` / `#fingerprint_sha256` / `#serial_hex` / `#not_before` / `#not_after` / `#valid_at?(iso8601)` / `#public_key_bytes`; DER parse failures carry a byte `offset` in the error details
+- `CertificateBuilder` / `CMS::SignedDataBuilder` — build certificates and signed data in Ruby
+- `PathValidator.validate(leaf, intermediates, root, now_iso8601 = nil)` → `PathValidationResult` (chain validation leaf → root at a point in time)
 - `CSR.from_der` / `.from_pem` / `#to_der` / `#to_pem`
 - `CMS::SignedData.from_json` / `#to_json` / `#signer_count` / `#content_type` / `#content` / `#certificate_count` / `#certificate_at(i)`
 - `CMS::Content#bytes` / `#length`
 - `XMLDSig.canonicalize(xml)` / `.canonicalize_exclusive(xml)` (Canonical XML RFC 3076 + Exclusive C14N)
+- `Cnml` — institutional certificate workflow helpers
 
 === `Confium::Identity` — actor roles
 - `.actor_types` → `["manufacturer", "testing_lab", "issuing_authority_officer", "biml_director", "quorum_coordinator", "verifier"]`
@@ -123,6 +146,51 @@ recovered == kp["private_key"]  # => true
 - `.partial_decrypt(party_index, share_bytes, ciphertext)` → `{ party_index:, bytes: }`
 - `.aggregate_partials(partials, threshold, ciphertext)` → shared_secret bytes
 
+=== `Confium::TC::Cmp20` / `Confium::TC::Gg18` — threshold ECDSA protocols
+- `.keygen(threshold, parties)` → `{ public_key, shares }`
+- `.sign(shares, public_key, message)` → DER ECDSA signature
+
+=== `Confium::TC::Session` — per-party threshold sessions (real FROST)
+- `Session.new(scheme, parties:, threshold:, this_party_idx:, local_share: nil, message: nil)` — `"FROST-ed25519-dkg"` for distributed key generation, `"FROST-ed25519"` for signing (pass the DKG share and the message)
+- `#scheme_name` / `#threshold` / `#party_count` / `#this_party_idx` / `#round` / `#complete?`
+- `#round_step(messages)` → `{ "outgoing" => [{from, to, round, payload}...], "complete" => bool }` — feed each round's incoming messages, broadcast the outgoing ones
+- `#result` — after DKG: share blob (group public key + party share); after signing: RFC 8032 Ed25519 signature
+
+=== `Confium::TC::Coordinator` — quorum signing orchestration
+- `Coordinator.new(quorum_id:)` / `#create_session(message:, threshold:, scheme: "CMP20-ECDSA-P256")` / `#submit_commitment` / `#submit_share` / `#aggregate` / `#session_state`
+- `SigningSession#add_commitment` / `#add_share` / `#threshold_met?` / `#aggregate` — the seam every transport adapts to
+- `NetworkCoordinator` — TCP/NDJSON server (`#start` / `#stop` / `#running?`); `SignerClient` — remote submit + aggregate with typed `RemoteError`
+- `ShareFile` — encrypted share-file persistence
+
+=== `Confium::Store::Keystore` — key handles and remote signing
+- `Keystore.new(backend, **options)` / `.backends`
+- `#sign(key_id, algorithm, message)` → signature bytes (sign-with-handle contract; cloud KMS backends `aws-kms` / `gcp-kms` / `azure-keyvault` via cargo features)
+
+=== `Confium::Audit` — structured audit trail
+- `Audit.sink =` / `Audit.sink` / `Audit.enabled?` / `Audit.record(...)`
+- `Sink` (base) / `MemorySink` / `StderrSink` / `FileSink`
+- `OtlpSink.new(endpoint:, headers:, service_name:, ...)` — OTLP/HTTP export with retry and `#dropped` counter
+
+=== `Confium::OpenPGP`
+- `.armor(data, type)` / `.dearmor(data)` — RFC 9580 §6 ASCII armor with CRC-24 (pure Ruby)
+- `.verify_detached(message, signature, keys)` / `.verify(...)` — real signature verification when the extension is built with the `pgp` feature; `PGP_AVAILABLE` reports it
+
+=== `Confium::Transport` — coordinator clients over any transport
+- `SignerClient.new(url)` — connect over any registry transport: `tcp://host:port` (local/trusted) or `noise://host:port?key=<hex>&pinned=<hex>` (Noise_XX encrypted, stable identity + peer pinning)
+- `#register(signer_id, quorum_id)` / `#create_session(quorum_id, scheme, message, threshold, num_parties)` → session id
+- `#submit_commitment(session_id, signer_id, bytes)` / `#submit_share(session_id, signer_id, bytes)`
+- `CoordinatorServer.new(url)` — serve coordinator sessions over any linked scheme (test/in-process use)
+
+=== `Confium::ERS` — evidence records
+- `EvidenceRecord.build_initial(...)` / `#renew(...)` / `#renewal_count` (RFC 4998 / RFC 6283 archival)
+
+=== `Confium::Policy` / `Confium::SecureBytes`
+- `Policy.jurisdiction = :eu` — jurisdictional algorithm policy (EU/US profiles; SM2/SM3/SM4 for CN planned)
+- `SecureBytes.wrap(raw)` — zeroize-on-clear wrapper for private keys, shares, and secrets (`#bytes` non-destructive read, `#clear`)
+
+=== Errors
+- Typed error hierarchy (`ParseError`, `ThresholdError`, `VerificationError`, `PolicyViolationError`, ...) — native failures surface positional `details` hashes (including DER byte offsets for parse errors)
+
 == Development
 
 After checking out the repo:

data/confium.gemspec

@@ -40,6 +40,8 @@ Gem::Specification.new do |spec|
   ]
   spec.files.reject! { |f| File.directory?(f) }
   spec.files.reject! { |f| f =~ /\.(dll|so|dylib|lib|bundle)\Z/ }
+  # Windows socket diagnostic crate — development-only, never shipped.
+  spec.files.reject! { |f| f.start_with?('ext/socket-smoke/') }
   spec.require_paths = ['lib']
 
   spec.required_ruby_version = '>= 3.1.0'

data/ext/confium_native/Cargo.toml

@@ -25,6 +25,9 @@ build = "build.rs"
 pgp = ["rnp"]
 
 [dependencies]
+confium-coordinator = "0.8"
+confium-net-noise = "0.8"
+confium-net-tcp = "0.8"
 # rb-sys for Ruby C API access.
 rb-sys = { version = "0.9.124", features = ["global-allocator"] }
 

data/ext/confium_native/src/lib.rs

@@ -14,10 +14,14 @@ mod path;
 mod pki;
 mod store;
 mod tc;
+mod net;
 mod tc_session;
 mod transparency;
 mod util;
 
+#[cfg(windows)]
+mod winsock;
+
 use magnus::{function, Error, Module, Ruby};
 
 const VERSION: &str = env!("CARGO_PKG_VERSION");
@@ -30,6 +34,19 @@ fn native_loaded() -> bool {
     true
 }
 
+/// `Confium::Native.winsock_probe(tag)` — run the winsock diagnostic
+/// sequence at an arbitrary point (Windows only; no-op elsewhere).
+/// Timeline bisect for the listener bind failure: call it at ext
+/// load, suite start, and just before a ceremony to see exactly when
+/// each std net operation degrades.
+fn winsock_probe_fn(tag: String) -> Result<(), Error> {
+    #[cfg(windows)]
+    winsock::probe_on_demand(&tag);
+    #[cfg(not(windows))]
+    let _ = tag;
+    Ok(())
+}
+
 fn core_version() -> &'static str {
     // Set by build.rs at compile time from Cargo.lock. Always matches the
     // confium-core crate version the extension was built against.
@@ -38,11 +55,15 @@ fn core_version() -> &'static str {
 
 #[magnus::init]
 fn init(ruby: &Ruby) -> Result<(), Error> {
+    #[cfg(windows)]
+    winsock::probe();
+
     let confium = ruby.define_module("Confium")?;
     let native = confium.define_module("Native")?;
     native.define_module_function("version", function!(native_version, 0))?;
     native.define_module_function("loaded?", function!(native_loaded, 0))?;
     confium.define_module_function("core_version", function!(core_version, 0))?;
+    native.define_module_function("winsock_probe", function!(winsock_probe_fn, 1))?;
 
     transparency::init(ruby, confium)?;
     openpgp_verify::init(ruby, confium)?;
@@ -56,6 +77,7 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     deployment::init(ruby, confium)?;
     tc::init(ruby, confium)?;
     tc_session::init(ruby, confium)?;
+    net::init(ruby, confium)?;
     audit::init(ruby, confium)?;
     ers::init(ruby, confium)?;
     Ok(())

data/ext/confium_native/src/net.rs

@@ -0,0 +1,125 @@
+//! Confium::Transport — transport-level coordinator clients.
+//!
+//! Binds the registry-transport coordinator surface: a signer dials
+//! the coordinator over any URL scheme the native library links
+//! (tcp:// for local/trusted, noise:// for encrypted sessions with
+//! key=/pinned= parameters), and a CoordinatorServer serves any
+//! linked scheme. This is the transport half of multi-host signing;
+//! the protocol half is Confium::TC::Session.
+
+use magnus::{prelude::*, DataTypeFunctions, Error, Ruby, TypedData};
+
+// Force the noise transport crate (and its `register_transport!`
+// static) into the cdylib so the noise:// scheme resolves — the
+// binding itself never names a symbol from it.
+extern crate confium_net_noise as _noise_link;
+extern crate confium_net_tcp as _tcp_link;
+
+use confium_coordinator::coordinator::client::SignerClient as RustSignerClient;
+use confium_coordinator::coordinator::net_server::CoordinatorServer as RustCoordinatorServer;
+
+fn io_error(e: std::io::Error, operation: &str) -> Error {
+    magnus::Error::new(
+        magnus::exception::io_error(),
+        format!("{operation}: {e}"),
+    )
+}
+
+/// Confium::Transport::SignerClient — a coordinator connection over a
+/// registry transport URL.
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Transport::SignerClient", size)]
+pub struct SignerClient {
+    inner: std::cell::RefCell<RustSignerClient>,
+}
+
+impl SignerClient {
+    fn initialize(ruby: &Ruby, url: String) -> Result<Self, Error> {
+        let _ = ruby;
+        let inner = RustSignerClient::connect_url(&url).map_err(|e| io_error(e, "SignerClient.new"))?;
+        Ok(Self { inner: std::cell::RefCell::new(inner) })
+    }
+
+    fn register(&self, signer_id: String, quorum_id: String) -> Result<(), Error> {
+        self.inner
+            .borrow_mut()
+            .register(&signer_id, &quorum_id)
+            .map_err(|e| io_error(e, "register"))
+    }
+
+    fn create_session(
+        &self,
+        quorum_id: String,
+        scheme: String,
+        message: String,
+        threshold: u32,
+        num_parties: u32,
+    ) -> Result<String, Error> {
+        self.inner
+            .borrow_mut()
+            .create_session(&quorum_id, &scheme, message.as_bytes(), threshold, num_parties)
+            .map_err(|e| io_error(e, "create_session"))
+    }
+
+    fn submit_commitment(&self, args: &[magnus::Value]) -> Result<(), Error> {
+        let scanned = magnus::scan_args::scan_args::<(String, String, Vec<u8>), (), (), (), (), ()>(args)
+            .map_err(|e| magnus::Error::new(magnus::exception::arg_error(), e.to_string()))?;
+        let (session_id, signer_id, commitment) = scanned.required;
+        self.inner
+            .borrow_mut()
+            .submit_commitment(&session_id, &signer_id, &commitment)
+            .map_err(|e| io_error(e, "submit_commitment"))
+    }
+
+    fn submit_share(&self, args: &[magnus::Value]) -> Result<Option<Vec<u8>>, Error> {
+        let scanned = magnus::scan_args::scan_args::<(String, String, Vec<u8>), (), (), (), (), ()>(args)
+            .map_err(|e| magnus::Error::new(magnus::exception::arg_error(), e.to_string()))?;
+        let (session_id, signer_id, share) = scanned.required;
+        self.inner
+            .borrow_mut()
+            .submit_share(&session_id, &signer_id, &share)
+            .map_err(|e| io_error(e, "submit_share"))
+    }
+}
+
+/// Confium::Transport::CoordinatorServer — serves coordinator sessions over
+/// any linked transport scheme. Held in a Ruby object; the server
+/// thread runs until the process exits.
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Transport::CoordinatorServer", size)]
+pub struct CoordinatorServer {
+    _bound: String,
+}
+
+impl CoordinatorServer {
+    fn initialize(ruby: &Ruby, url: String) -> Result<Self, Error> {
+        let _ = ruby;
+        let server = RustCoordinatorServer::new(&url);
+        let bound = server
+            .start_url(&url)
+            .map_err(|e| io_error(e, "CoordinatorServer.new"))?;
+        Ok(Self { _bound: bound })
+    }
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let net = parent.define_module("Transport")?;
+
+    let client = net.define_class("SignerClient", ruby.class_object())?;
+    client.define_singleton_method("new", magnus::function!(SignerClient::initialize, 1))?;
+    client.define_method("register", magnus::method!(SignerClient::register, 2))?;
+    client.define_method(
+        "create_session",
+        magnus::method!(SignerClient::create_session, 5),
+    )?;
+    client.define_method(
+        "submit_commitment",
+        magnus::method!(SignerClient::submit_commitment, -1),
+    )?;
+    client.define_method("submit_share", magnus::method!(SignerClient::submit_share, -1))?;
+
+    let server = net.define_class("CoordinatorServer", ruby.class_object())?;
+    server.define_singleton_method("new", magnus::function!(CoordinatorServer::initialize, 1))?;
+
+    Ok(())
+}