confium 0.6.3 → 0.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0739c3bc2fd3d3d347fd283d19bb70b9bd1611cd262c4d6229b80828d67b441c'
-  data.tar.gz: ae757155d9a5312662d44ac21d740c68228b2e8ad011c178e168969b2563d068
+  metadata.gz: 80f1cc9387a28284e32d2c8b92fbdb5555f675f05e2ec8e6c38cd213a65e215f
+  data.tar.gz: d9ccaaf8e4297e8a731be6e19be9a5ee6566d3aa24d8398598f48fd6b2cf50fa
 SHA512:
-  metadata.gz: d17228e2f724d28a2481bd6c115cdec90f8955b346c7f72a22b0217d78f5365bbcb61930d08662562c1f9e4ec8b05eeb8dc73c63b30f902dbe27ede051fa9408
-  data.tar.gz: 7780ff8ceff7791de1bca7e5dc7e15215db6886eec4cd6d01dbc75b0fa8d04c7d0350234bd33f8d5dfd94587b532c088246c59a28e7edd99ad3fb077ed7d8d34
+  metadata.gz: b0fe995dbf54fcbc0b8fe57d815eedcba6abb10f8c4b26cd1713b62042798390861eb6faaf96168dcfcc8baa03dd54dd1d5c89d0f826f3d68f1a2bfb60416096
+  data.tar.gz: 4dde75f2b6d9c9143c546facb59bd249a1d87b6451d18a6036c1deec428773a553e2aedb8f9047465c4d0933e9f502d9d63341b74dac34ddfab3b31abafbd572

data/CHANGELOG.md

@@ -1,5 +1,72 @@
 # Changelog
 
+## [0.7.1] — UNRELEASED (code on main; release on the owner's tag)
+
+### Added
+
+- `Confium::Transparency::OTS` is now the real OpenTimestamps
+  wire-protocol binding (confium-transparency 0.9): `OTS::Client#stamp`
+  POSTs the 32-byte digest to the calendar pool and returns a `Proof`
+  carrying the parsed partial proof; `#upgrade` polls for a confirmed
+  one; `Proof#verify` replays the op tree and classifies attestations
+  (pending URIs, Bitcoin/Litecoin heights, `anchored`). Module-level
+  `OTS.stamp`/`verify`/`upgrade` over the default calendar pool.
+  Network failures raise (`IOError`/`ParseError`) — the stub-era
+  silent nil is gone.
+- The calendar round trip releases the GVL (direct
+  `rb_thread_call_without_gvl` trampoline — magnus 0.8 does not wrap
+  it), so a slow calendar never freezes the VM.
+
+### Fixed
+
+- The workspace's OTS file magic was missing its final two salt bytes
+  (29 vs 31; shifted every parse offset for real .ots files) — caught
+  by this binding's cross-checked specs, fixed in confium-transparency
+  v0.9.1.
+
+## [0.7.0] — 2026-09-07
+
+### Added
+
+- `Confium::Transport::SignerClient` / `CoordinatorServer` —
+  coordinator sessions over any registry transport the extension
+  links, addressed by URL: `tcp://host:port` for local/trusted
+  networks, `noise://host:port` for Noise_XX
+  (`Noise_XX_25519_ChaChaPoly_BLAKE2s`) encrypted sessions.
+  `noise://` URLs take `key=<hex>` (local static private key;
+  ephemeral and trust-on-first-use when omitted) and `pinned=<hex>`
+  (SHA-256 fingerprint of the expected peer static key — the
+  handshake aborts on mismatch). The handshake carries a 10-second
+  deadline so a non-Noise peer fails fast instead of hanging.
+  `SignerClient` exposes `#register`, `#create_session`,
+  `#submit_commitment`, `#submit_share` (returns the aggregated
+  signature once the threshold is met, else nil);
+  `CoordinatorServer.new(url)` serves any linked scheme for tests
+  and single-process deployments.
+
+### Changed
+
+- **BREAKING**: `Confium::Net` is `Confium::Transport`. Defining
+  `Confium::Net` shadowed Ruby stdlib `Net` for every constant
+  lookup under the `Confium` namespace — `Confium::Audit::OtlpSink`'s
+  `Net::HTTP` resolved to `Confium::Net::HTTP` and raised
+  `NameError`. No prior release shipped the `Net` names.
+
+## [0.6.3] — 2026-08-26
+
+### Added
+
+- `Confium::TC::Session` — per-party threshold protocol sessions
+  over confium-tc-core 0.4: each signer process runs its own
+  session (`"FROST-ed25519-dkg"` for distributed key generation,
+  `"FROST-ed25519"` for signing with the DKG share and message) and
+  exchanges only `round_step` messages — the share never leaves the
+  process. `#round_step(incoming)` returns
+  `{ "outgoing" => [...], "complete" => bool }`; the completed DKG
+  session's `#result` is the party's share blob, the signing
+  session's `#result` an RFC 8032 Ed25519 signature verifiable under
+  the group public key.
+
 ## [0.6.2] — 2026-08-26
 
 ### Added

data/Cargo.lock

@@ -135,6 +135,15 @@ dependencies = [
  "wyz",
 ]
 
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -207,6 +216,30 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "chacha20poly1305"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+ "zeroize",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@@ -229,6 +262,7 @@ checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common 0.1.7",
  "inout",
+ "zeroize",
 ]
 
 [[package]]
@@ -301,7 +335,7 @@ checksum = "e8c96d4d5997726cf0eb794410e3e8bbce839cfba9c4a32e26ede0c076b02e64"
 dependencies = [
  "chrono",
  "confium-api",
- "confium-net",
+ "confium-net 0.3.0",
  "confium-store 0.3.0",
  "confium-tc-core 0.3.0",
  "data-encoding",
@@ -321,6 +355,26 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "confium-coordinator"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f49eae3301b6f1f2f36b2eb66d0fdd863bcecb1dc18b51ec51e5f8d1bb9dc3"
+dependencies = [
+ "chrono",
+ "confium-net 0.8.5",
+ "getrandom 0.4.3",
+ "hex",
+ "hmac 0.13.0",
+ "p256 0.14.0",
+ "rand_core 0.6.4",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "thiserror 2.0.20",
+ "tracing",
+]
+
 [[package]]
 name = "confium-core"
 version = "0.2.0"
@@ -413,6 +467,44 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "confium-net"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bd7098e54033a09b1f6a4ebd0c0f54d6c44da8f46cfdff7ae156895f1083fc6"
+dependencies = [
+ "inventory",
+ "snafu 0.9.2",
+ "url",
+]
+
+[[package]]
+name = "confium-net-noise"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "213e90ce6daa40d1ec92d8e524276744a07f027c453bd32815f80c29ba947237"
+dependencies = [
+ "confium-net 0.8.5",
+ "inventory",
+ "sha2 0.11.0",
+ "snafu 0.9.2",
+ "snow",
+ "url",
+ "x25519-dalek",
+]
+
+[[package]]
+name = "confium-net-tcp"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b80e3d692ed5328a72e754a0f73d81f6c8fde3714d05fc0be1953f657e05f76"
+dependencies = [
+ "confium-net 0.8.5",
+ "inventory",
+ "snafu 0.9.2",
+ "url",
+]
+
 [[package]]
 name = "confium-observability"
 version = "0.3.0"
@@ -493,8 +585,8 @@ checksum = "3dd7d4965aef12324cb76d397294c317b83b774de029f1d37b387cf54ba9593c"
 dependencies = [
  "chrono",
  "confium-api",
- "confium-coordinator",
- "confium-net",
+ "confium-coordinator 0.3.0",
+ "confium-net 0.3.0",
  "confium-store 0.3.0",
  "confium-tc-keys",
  "data-encoding",
@@ -566,7 +658,7 @@ checksum = "add3e15337ce81944f78c9ce844d870a081cbe91506a85b9a5c4e4c0da983771"
 dependencies = [
  "chrono",
  "confium-api",
- "confium-net",
+ "confium-net 0.3.0",
  "confium-store 0.3.0",
  "data-encoding",
  "hex",
@@ -683,17 +775,18 @@ dependencies = [
 
 [[package]]
 name = "confium-transparency"
-version = "0.4.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "874cdab3dded22c22980d3a5b1f802301739368a32e9196bc645600329c07dcf"
+checksum = "b4ec484381b582f508f774babbc1bf1b4a98c6aadd43cde806952c6e416b62ca"
 dependencies = [
  "chrono",
- "data-encoding",
+ "hex",
  "serde",
  "serde_json",
- "sha2 0.10.9",
- "snafu 0.8.9",
- "thiserror 1.0.69",
+ "sha2 0.11.0",
+ "subtle",
+ "thiserror 2.0.20",
+ "ureq",
 ]
 
 [[package]]
@@ -703,10 +796,13 @@ dependencies = [
  "chrono",
  "confium-attributes",
  "confium-composite",
+ "confium-coordinator 0.8.5",
  "confium-core",
  "confium-crypto-vss",
  "confium-crypto-zk",
  "confium-deployment",
+ "confium-net-noise",
+ "confium-net-tcp",
  "confium-observability",
  "confium-pki",
  "confium-privacy",
@@ -1215,6 +1311,18 @@ dependencies = [
  "wasi",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.4.3"
@@ -1223,7 +1331,7 @@ checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
  "libc",
- "r-efi",
+ "r-efi 6.0.0",
  "rand_core 0.10.1",
 ]
 
@@ -1785,6 +1893,17 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash",
+]
+
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -1879,6 +1998,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "r-efi"
 version = "6.0.0"
@@ -2348,6 +2473,23 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "snow"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "599b506ccc4aff8cf7844bc42cf783009a434c1e26c964432560fb6d6ad02d82"
+dependencies = [
+ "aes-gcm",
+ "blake2",
+ "chacha20poly1305",
+ "curve25519-dalek",
+ "getrandom 0.3.4",
+ "ring",
+ "rustc_version",
+ "sha2 0.10.9",
+ "subtle",
+]
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -2666,6 +2808,15 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.126"
@@ -2870,6 +3021,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
 [[package]]
 name = "wnaf"
 version = "0.14.0"
@@ -2896,6 +3053,18 @@ dependencies = [
  "tap",
 ]
 
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core 0.6.4",
+ "serde",
+ "zeroize",
+]
+
 [[package]]
 name = "x509-cert"
 version = "0.3.0"

data/README.adoc

@@ -18,7 +18,7 @@ Add to your Gemfile:
 
 [source,ruby]
 ----
-gem "confium", "~> 0.3"
+gem "confium", "~> 0.7"
 ----
 
 Or install directly:
@@ -78,18 +78,38 @@ kp = Confium::TC::FrostP256.generate_keypair
 shares = Confium::TC::FrostP256.split_secret(kp["private_key"], 3, 5)
 recovered = Confium::TC::FrostP256.recover_secret(shares.first(3).map { |s| { "x" => s.x, "y" => s.y_bytes } })
 recovered == kp["private_key"]  # => true
+
+# Distributed key generation + 2-of-3 FROST-ed25519 signing (each party
+# holds its own Confium::TC::Session and only exchanges round messages)
+parties = %w[alice bob carol]
+sessions = parties.each_with_index.map do |id, i|
+  Confium::TC::Session.new("FROST-ed25519-dkg", parties: parties, threshold: 2, this_party_idx: i)
+end
+# run rounds: session.round_step(messages_in) -> {"outgoing" => [...], "complete" => bool}
+# broadcast "outgoing" payloads between sessions until every session is complete
+dkg_share = sessions.first.result  # this party's share (embeds the group public key)
+
+signers = sessions.first(2).map.with_index do |s, i|
+  Confium::TC::Session.new("FROST-ed25519",
+                           parties: parties.first(2), threshold: 2, this_party_idx: i,
+                           local_share: dkg_share, message: "authentic message")
+end
+# run rounds as above; the completed session's #result is an RFC 8032
+# Ed25519 signature verifiable under the group public key
 ----
 
-== API surface (v0.3)
+== API surface (v0.7)
 
 === `Confium::Transparency`
 - `MerkleTree.new` / `#append(artifact_hash)` / `#root` / `#length` / `#empty?` / `#inclusion_proof(seq)`
 - `InclusionProof#sequence` / `#steps` / `#verify(root)`
+- `Ots.stamp(hash)` / `Ots.verify(proof)` / `Ots.upgrade(proof)` — real OpenTimestamps anchoring over the wire protocol (calendar HTTP, servers tried in order; the network round trip releases the GVL). `Ots::Client.new(servers)` for a custom pool; `Ots::Proof#verify` replays the op tree and classifies attestations. Network failures raise — there is no silent nil
 
 === `Confium::Composite` — PQ migration
 - `.generate_ed25519_keypair` → `{ private_key:, public_key: }`
 - `.sign_ed25519(private_key, message)` → component Hash
-- `Signature.new(components)` / `#verify(message)` / `#component_count` / `#algorithms`
+- `Signature.new(components)` / `#verify(message)` / `#component_count` / `#algorithms` / `#to_json`
+- `.from_json(json)` / `.components_to_json(components)` / `.canonical_json(json, data)`
 - `VerificationResult#all_verified?` / `#per_component`
 
 === `Confium::Attributes` — threshold policy DSL
@@ -99,11 +119,14 @@ recovered == kp["private_key"]  # => true
 - DSL: `min_count("attr", n)`, `min_distinct("attr", n)`, `any("attr")`, `all("attr")`, `none("attr")`, `and(...)`, `or(...)`, `not(p)`
 
 === `Confium::PKI`
-- `Certificate.from_der(bytes)` / `.from_pem(str)` / `#to_der` / `#to_pem` / `#fingerprint_sha256` / `#serial_hex` / `#not_before` / `#not_after` / `#valid_at?(iso8601)` / `#public_key_bytes`
+- `Certificate.from_der(bytes)` / `.from_pem(str)` / `#to_der` / `#to_pem` / `#fingerprint_sha256` / `#serial_hex` / `#not_before` / `#not_after` / `#valid_at?(iso8601)` / `#public_key_bytes`; DER parse failures carry a byte `offset` in the error details
+- `CertificateBuilder` / `CMS::SignedDataBuilder` — build certificates and signed data in Ruby
+- `PathValidator.validate(leaf, intermediates, root, now_iso8601 = nil)` → `PathValidationResult` (chain validation leaf → root at a point in time)
 - `CSR.from_der` / `.from_pem` / `#to_der` / `#to_pem`
 - `CMS::SignedData.from_json` / `#to_json` / `#signer_count` / `#content_type` / `#content` / `#certificate_count` / `#certificate_at(i)`
 - `CMS::Content#bytes` / `#length`
 - `XMLDSig.canonicalize(xml)` / `.canonicalize_exclusive(xml)` (Canonical XML RFC 3076 + Exclusive C14N)
+- `Cnml` — institutional certificate workflow helpers
 
 === `Confium::Identity` — actor roles
 - `.actor_types` → `["manufacturer", "testing_lab", "issuing_authority_officer", "biml_director", "quorum_coordinator", "verifier"]`
@@ -123,6 +146,51 @@ recovered == kp["private_key"]  # => true
 - `.partial_decrypt(party_index, share_bytes, ciphertext)` → `{ party_index:, bytes: }`
 - `.aggregate_partials(partials, threshold, ciphertext)` → shared_secret bytes
 
+=== `Confium::TC::Cmp20` / `Confium::TC::Gg18` — threshold ECDSA protocols
+- `.keygen(threshold, parties)` → `{ public_key, shares }`
+- `.sign(shares, public_key, message)` → DER ECDSA signature
+
+=== `Confium::TC::Session` — per-party threshold sessions (real FROST)
+- `Session.new(scheme, parties:, threshold:, this_party_idx:, local_share: nil, message: nil)` — `"FROST-ed25519-dkg"` for distributed key generation, `"FROST-ed25519"` for signing (pass the DKG share and the message)
+- `#scheme_name` / `#threshold` / `#party_count` / `#this_party_idx` / `#round` / `#complete?`
+- `#round_step(messages)` → `{ "outgoing" => [{from, to, round, payload}...], "complete" => bool }` — feed each round's incoming messages, broadcast the outgoing ones
+- `#result` — after DKG: share blob (group public key + party share); after signing: RFC 8032 Ed25519 signature
+
+=== `Confium::TC::Coordinator` — quorum signing orchestration
+- `Coordinator.new(quorum_id:)` / `#create_session(message:, threshold:, scheme: "CMP20-ECDSA-P256")` / `#submit_commitment` / `#submit_share` / `#aggregate` / `#session_state`
+- `SigningSession#add_commitment` / `#add_share` / `#threshold_met?` / `#aggregate` — the seam every transport adapts to
+- `NetworkCoordinator` — TCP/NDJSON server (`#start` / `#stop` / `#running?`); `SignerClient` — remote submit + aggregate with typed `RemoteError`
+- `ShareFile` — encrypted share-file persistence
+
+=== `Confium::Store::Keystore` — key handles and remote signing
+- `Keystore.new(backend, **options)` / `.backends`
+- `#sign(key_id, algorithm, message)` → signature bytes (sign-with-handle contract; cloud KMS backends `aws-kms` / `gcp-kms` / `azure-keyvault` via cargo features)
+
+=== `Confium::Audit` — structured audit trail
+- `Audit.sink =` / `Audit.sink` / `Audit.enabled?` / `Audit.record(...)`
+- `Sink` (base) / `MemorySink` / `StderrSink` / `FileSink`
+- `OtlpSink.new(endpoint:, headers:, service_name:, ...)` — OTLP/HTTP export with retry and `#dropped` counter
+
+=== `Confium::OpenPGP`
+- `.armor(data, type)` / `.dearmor(data)` — RFC 9580 §6 ASCII armor with CRC-24 (pure Ruby)
+- `.verify_detached(message, signature, keys)` / `.verify(...)` — real signature verification when the extension is built with the `pgp` feature; `PGP_AVAILABLE` reports it
+
+=== `Confium::Transport` — coordinator clients over any transport
+- `SignerClient.new(url)` — connect over any registry transport: `tcp://host:port` (local/trusted) or `noise://host:port?key=<hex>&pinned=<hex>` (Noise_XX encrypted, stable identity + peer pinning)
+- `#register(signer_id, quorum_id)` / `#create_session(quorum_id, scheme, message, threshold, num_parties)` → session id
+- `#submit_commitment(session_id, signer_id, bytes)` / `#submit_share(session_id, signer_id, bytes)`
+- `CoordinatorServer.new(url)` — serve coordinator sessions over any linked scheme (test/in-process use)
+
+=== `Confium::ERS` — evidence records
+- `EvidenceRecord.build_initial(...)` / `#renew(...)` / `#renewal_count` (RFC 4998 / RFC 6283 archival)
+
+=== `Confium::Policy` / `Confium::SecureBytes`
+- `Policy.jurisdiction = :eu` — jurisdictional algorithm policy (EU/US profiles; SM2/SM3/SM4 for CN planned)
+- `SecureBytes.wrap(raw)` — zeroize-on-clear wrapper for private keys, shares, and secrets (`#bytes` non-destructive read, `#clear`)
+
+=== Errors
+- Typed error hierarchy (`ParseError`, `ThresholdError`, `VerificationError`, `PolicyViolationError`, ...) — native failures surface positional `details` hashes (including DER byte offsets for parse errors)
+
 == Development
 
 After checking out the repo:

data/confium.gemspec

@@ -40,6 +40,8 @@ Gem::Specification.new do |spec|
   ]
   spec.files.reject! { |f| File.directory?(f) }
   spec.files.reject! { |f| f =~ /\.(dll|so|dylib|lib|bundle)\Z/ }
+  # Windows socket diagnostic crate — development-only, never shipped.
+  spec.files.reject! { |f| f.start_with?('ext/socket-smoke/') }
   spec.require_paths = ['lib']
 
   spec.required_ruby_version = '>= 3.1.0'

data/ext/confium_native/Cargo.toml

@@ -25,6 +25,9 @@ build = "build.rs"
 pgp = ["rnp"]
 
 [dependencies]
+confium-coordinator = "0.8"
+confium-net-noise = "0.8"
+confium-net-tcp = "0.8"
 # rb-sys for Ruby C API access.
 rb-sys = { version = "0.9.124", features = ["global-allocator"] }
 
@@ -33,7 +36,7 @@ magnus = { version = "0.8", features = ["bytes"] }
 
 # Confium crates — all from crates.io so gem install works without workspace checkout.
 confium-core = "0.2"
-confium-transparency = "0.4"
+confium-transparency = { version = "0.9", features = ["calendar"] }
 confium-composite = "0.3.1"
 confium-attributes = "0.3.1"
 confium-pki = "0.5.6"

data/ext/confium_native/src/gvl.rs

@@ -0,0 +1,56 @@
+//! GVL release for long blocking calls.
+//!
+//! magnus 0.8 does not wrap `rb_thread_call_without_gvl`, so the OTS
+//! calendar round trip (up to 30s) would hold the GVL and freeze the
+//! entire Ruby VM — including any Ruby thread serving as the peer.
+//! This is the standard MRI mechanism: release the GVL for the
+//! duration of a blocking FFI call, reacquire before touching Ruby
+//! objects again. The closure must not touch the Ruby API.
+
+use std::ffi::c_void;
+
+unsafe extern "C" {
+    fn rb_thread_call_without_gvl(
+        func: extern "C" fn(*mut c_void) -> *mut c_void,
+        data1: *mut c_void,
+        ubf: Option<extern "C" fn(*mut c_void) -> *mut c_void>,
+        data2: *mut c_void,
+    ) -> *mut c_void;
+}
+
+struct CallBox<F: FnOnce() -> T, T> {
+    func: Option<F>,
+    out: Option<T>,
+}
+
+extern "C" fn trampoline<F: FnOnce() -> T, T>(data: *mut c_void) -> *mut c_void {
+    // SAFETY: data points at the CallBox constructed by without_gvl,
+    // live for the duration of the call, on this same thread.
+    let box_ = unsafe { &mut *(data as *mut CallBox<F, T>) };
+    let func = box_.func.take().expect("trampoline runs once");
+    box_.out = Some(func());
+    std::ptr::null_mut()
+}
+
+/// Run `func` with the GVL released. Reacquires before returning.
+///
+/// # Safety (caller obligations)
+///
+/// `func` must not call the Ruby C API (no Ruby objects) and must be
+/// callable from this thread while the GVL is released.
+pub unsafe fn without_gvl<F: FnOnce() -> T, T>(func: F) -> T {
+    let mut call = CallBox {
+        func: Some(func),
+        out: None,
+    };
+    // SAFETY: the trampoline and box are used per the contract above.
+    unsafe {
+        rb_thread_call_without_gvl(
+            trampoline::<F, T>,
+            &mut call as *mut CallBox<F, T> as *mut c_void,
+            None,
+            std::ptr::null_mut(),
+        );
+    }
+    call.out.take().expect("trampoline stored the result")
+}

data/ext/confium_native/src/lib.rs

@@ -9,15 +9,21 @@ mod attributes;
 mod composite;
 mod deployment;
 mod ers;
+mod gvl;
 mod openpgp_verify;
 mod path;
 mod pki;
 mod store;
 mod tc;
+mod net;
+mod ots;
 mod tc_session;
 mod transparency;
 mod util;
 
+#[cfg(windows)]
+mod winsock;
+
 use magnus::{function, Error, Module, Ruby};
 
 const VERSION: &str = env!("CARGO_PKG_VERSION");
@@ -30,6 +36,19 @@ fn native_loaded() -> bool {
     true
 }
 
+/// `Confium::Native.winsock_probe(tag)` — run the winsock diagnostic
+/// sequence at an arbitrary point (Windows only; no-op elsewhere).
+/// Timeline bisect for the listener bind failure: call it at ext
+/// load, suite start, and just before a ceremony to see exactly when
+/// each std net operation degrades.
+fn winsock_probe_fn(tag: String) -> Result<(), Error> {
+    #[cfg(windows)]
+    winsock::probe_on_demand(&tag);
+    #[cfg(not(windows))]
+    let _ = tag;
+    Ok(())
+}
+
 fn core_version() -> &'static str {
     // Set by build.rs at compile time from Cargo.lock. Always matches the
     // confium-core crate version the extension was built against.
@@ -38,13 +57,19 @@ fn core_version() -> &'static str {
 
 #[magnus::init]
 fn init(ruby: &Ruby) -> Result<(), Error> {
+    #[cfg(windows)]
+    winsock::probe();
+
     let confium = ruby.define_module("Confium")?;
     let native = confium.define_module("Native")?;
     native.define_module_function("version", function!(native_version, 0))?;
     native.define_module_function("loaded?", function!(native_loaded, 0))?;
     confium.define_module_function("core_version", function!(core_version, 0))?;
+    native.define_module_function("winsock_probe", function!(winsock_probe_fn, 1))?;
 
     transparency::init(ruby, confium)?;
+    let transparency = confium.define_module("Transparency")?;
+    ots::init(ruby, transparency)?;
     openpgp_verify::init(ruby, confium)?;
     #[cfg(feature = "pgp")]
     openpgp_verify::init_pgp(ruby, &confium)?;
@@ -56,6 +81,7 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     deployment::init(ruby, confium)?;
     tc::init(ruby, confium)?;
     tc_session::init(ruby, confium)?;
+    net::init(ruby, confium)?;
     audit::init(ruby, confium)?;
     ers::init(ruby, confium)?;
     Ok(())