confium 0.7.0-aarch64-linux → 0.7.1-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f18dce29f81e247abe9da09030555f31f0b768c35177d7f4adc86cb177314f7
-  data.tar.gz: 9d326b380b6ea3a7240d665afb5fd61176d5ddc6ecd5a1180693bbf1937f06c3
+  metadata.gz: 7cab2b2ace3e324582536762cd815c779eb2e2d4beb2aa8b9d14a96b217e6df6
+  data.tar.gz: de2dfb7bf71bfe5b54744f3e14a0ffaa12d63f5a32c6baa39ff3de1fce9c801c
 SHA512:
-  metadata.gz: e24855a974b75a1cc505bb24c2ee1d918d82c8730591dd394b905a98bc0a958b7e7219c0a339ffc4992c197a668b8930e1e896305dbdd8c630c8cd65ff41b76a
-  data.tar.gz: 56ebf0c41f6ca0b8e477e8bd090a9033f164f96637f34314023bd1bd4d80bf8cfa51c5182ad420e520feb07098d57df95fcba5bb82209d1c0b4d6f8ae7ec296d
+  metadata.gz: 252ee6c69983a91d316b3d45c7a8f5cb3632494b6962bcce98202378c1860f168ae09f66fa6d36d1c516f6c683a21ea919d44422a7261df04a6478b198f065d2
+  data.tar.gz: ff7af357dc2d7f35f568ebd42fd0dca670312ef68953bf91f4c74108e9c6f7336ccf91a9dc9c802e4cb7f18208569ea6b9cffde9866a448ee8ecff2c1d153d62

data/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [0.7.1] — UNRELEASED (code on main; release on the owner's tag)
+
+### Added
+
+- `Confium::Transparency::OTS` is now the real OpenTimestamps
+  wire-protocol binding (confium-transparency 0.9): `OTS::Client#stamp`
+  POSTs the 32-byte digest to the calendar pool and returns a `Proof`
+  carrying the parsed partial proof; `#upgrade` polls for a confirmed
+  one; `Proof#verify` replays the op tree and classifies attestations
+  (pending URIs, Bitcoin/Litecoin heights, `anchored`). Module-level
+  `OTS.stamp`/`verify`/`upgrade` over the default calendar pool.
+  Network failures raise (`IOError`/`ParseError`) — the stub-era
+  silent nil is gone.
+- The calendar round trip releases the GVL (direct
+  `rb_thread_call_without_gvl` trampoline — magnus 0.8 does not wrap
+  it), so a slow calendar never freezes the VM.
+
+### Fixed
+
+- The workspace's OTS file magic was missing its final two salt bytes
+  (29 vs 31; shifted every parse offset for real .ots files) — caught
+  by this binding's cross-checked specs, fixed in confium-transparency
+  v0.9.1.
+
 ## [0.7.0] — 2026-09-07
 
 ### Added

data/Cargo.lock

@@ -775,17 +775,18 @@ dependencies = [
 
 [[package]]
 name = "confium-transparency"
-version = "0.4.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "874cdab3dded22c22980d3a5b1f802301739368a32e9196bc645600329c07dcf"
+checksum = "b4ec484381b582f508f774babbc1bf1b4a98c6aadd43cde806952c6e416b62ca"
 dependencies = [
  "chrono",
- "data-encoding",
+ "hex",
  "serde",
  "serde_json",
- "sha2 0.10.9",
- "snafu 0.8.9",
- "thiserror 1.0.69",
+ "sha2 0.11.0",
+ "subtle",
+ "thiserror 2.0.20",
+ "ureq",
 ]
 
 [[package]]

data/README.adoc

@@ -103,7 +103,7 @@ end
 === `Confium::Transparency`
 - `MerkleTree.new` / `#append(artifact_hash)` / `#root` / `#length` / `#empty?` / `#inclusion_proof(seq)`
 - `InclusionProof#sequence` / `#steps` / `#verify(root)`
-- `Ots.stamp(hash)` / `Ots.verify(receipt, hash)` — OpenTimestamps anchoring interface (pure-Ruby stub; calendar-server wiring lands with the Rust client)
+- `Ots.stamp(hash)` / `Ots.verify(proof)` / `Ots.upgrade(proof)` — real OpenTimestamps anchoring over the wire protocol (calendar HTTP, servers tried in order; the network round trip releases the GVL). `Ots::Client.new(servers)` for a custom pool; `Ots::Proof#verify` replays the op tree and classifies attestations. Network failures raise — there is no silent nil
 
 === `Confium::Composite` — PQ migration
 - `.generate_ed25519_keypair` → `{ private_key:, public_key: }`

data/lib/confium/transparency/ots.rb

@@ -1,14 +1,13 @@
 # frozen_string_literal: true
 
-# Confium::Transparency::OTS — OpenTimestamps client interface.
+# Confium::Transparency::OTS — OpenTimestamps calendar client.
 #
-# Wraps confium-transparency::ots::Client for anchoring Merkle tree
-# roots in the Bitcoin blockchain via OTS calendar servers.
-#
-# This is a pure-Ruby stub that defines the interface. The actual
-# OTS stamping requires network access to calendar servers and
-# will be wired through the Rust extension in a future PR
-# (TODO.completion/011-ots-ers-exposure.md).
+# Real wire-protocol implementation over the native extension
+# (confium-transparency 0.8.5+): stamps POST the 32-byte digest to a
+# calendar server and parse the returned partial proof; verification
+# replays the op tree from the digest and classifies attestations.
+# Network failures raise (Confium::Transparency::OTS is backed by a
+# real HTTP client) — there is no silent nil.
 
 module Confium
   module Transparency
@@ -20,44 +19,48 @@ module Confium
         https://a.pool.eternitywall.com
       ].freeze
 
-      # An OTS receipt proving that a hash was anchored in Bitcoin
-      # at a specific block height.
-      class Receipt
-        attr_reader :bytes, :block_height
+      class << self
+        # Stamp a 32-byte digest via the default calendar pool.
+        # Returns a Proof (pending attestation — Bitcoin confirmation
+        # arrives later; poll with #upgrade).
+        #
+        # @param hash [String] 32-byte SHA-256 digest to anchor
+        # @return [Confium::Transparency::OTS::Proof]
+        # @raise [IOError, ArgumentError]
+        def stamp(hash)
+          default_client.stamp(hash)
+        end
 
-        def initialize(bytes:, block_height: nil)
-          @bytes = bytes
-          @block_height = block_height
+        # Verify a proof: replay its op tree from the digest and
+        # classify the attestations.
+        #
+        # @param proof [Proof, String] the proof (or raw .ots bytes —
+        #   pass the digest alongside for the String form)
+        # @param digest [String, nil] required when proof is bytes
+        # @return [Hash] { pending: [uri], bitcoin: [height],
+        #   litecoin: [height], anchored: bool }
+        def verify(proof, digest = nil)
+          proof = Proof.new(digest, proof) if digest && proof.is_a?(String)
+          proof.verify
         end
 
-        def to_bytes
-          @bytes
+        # Upgrade a pending proof (fetch a more complete one).
+        #
+        # @return [Proof]
+        def upgrade(proof)
+          default_client.upgrade(proof)
         end
-      end
 
-      # Stamp a 32-byte hash via OTS calendar servers.
-      # Returns a Receipt (stub: returns nil — requires network).
-      #
-      # @param hash [String] 32-byte SHA-256 hash to anchor
-      # @return [Receipt, nil]
-      def self.stamp(_hash)
-        # Real implementation: calls the Rust OTS client which
-        # submits the hash to calendar servers and returns a
-        # merged proof. Requires network access.
-        nil
-      end
+        private
 
-      # Verify an OTS receipt against a hash.
-      # Returns true if the receipt proves the hash was anchored.
-      #
-      # @param receipt [Receipt, String] the OTS proof
-      # @param hash [String] the 32-byte hash
-      # @return [Boolean]
-      def self.verify(_receipt, _hash)
-        # Real implementation: calls the Rust OTS verifier which
-        # walks the Bitcoin blockchain proof.
-        false
+        def default_client
+          @default_client ||= Client.new(DEFAULT_CALENDARS)
+        end
       end
+
+      # The native Client is defined by the extension
+      # (Confium::Transparency::OTS::Client) with #stamp / #upgrade;
+      # the Proof class carries #digest / #to_bytes / #verify.
     end
   end
 end

data/lib/confium/transparency.rb

@@ -5,8 +5,8 @@
 # The Transparency module itself is defined by the native Rust
 # extension via magnus at require time. This file registers
 # pure-Ruby autoloads for the Transparency submodules.
-module Confium
-  module Transparency
-    autoload :OTS, 'confium/transparency/ots'
-  end
-end
+# `require`, not `autoload`: the native extension defines the OTS
+# constant at load time, which would shadow the autoload entry and
+# keep this file from ever running — the Ruby-level convenience
+# methods would silently vanish.
+require 'confium/transparency/ots'

data/lib/confium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confium
-  VERSION = '0.7.0'
+  VERSION = '0.7.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: confium
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.7.1
 platform: aarch64-linux
 authors:
 - Ribose Open
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-07 00:00:00.000000000 Z
+date: 2026-09-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake