kairos-chain 3.0.0 → 3.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b831eba22baf94d43c7592c5ff2dbf12ca928dcea034b713837bf5253e691f99
-  data.tar.gz: 65c6cd548075ccfccf85d3330548fe51280d39f7c767f6de96c8d64fa5afd799
+  metadata.gz: 754ac017b9725fc33b9efa2b60bbcb8e8e73cbcfdd239b5c5f9f0fc5ede94cbc
+  data.tar.gz: 4f93f73953d9dd89728bbd66256d69dabf5aa66242b3ec15b4ce782bdcfa29f0
 SHA512:
-  metadata.gz: df294d0d060010e7d589e972ab12164c9cc1451bfd069693d5296bafb9512e95c985d83f4cb849a9d5064f76f0c89b57fbad2245d517f4cc759ce00ebae0f446
-  data.tar.gz: 81a7d541ebf5afc58b938f2b6d2b22c0f38c3c32d69705c2b6cd4074425292a0defa98a4adc74834659bef418a78539b2f7f2a90d48eb26df1f6961c1e41c978
+  metadata.gz: 1d3f3b1f2ec4b18ae428e3287e9225e5282abdefb811129d972c99c14107a5026e128b2cbd102c65e3b5e662dc7c7fbb9e3d72498cb43c50167d7bf7835ae93f
+  data.tar.gz: 73a4c69bb24acfcf147f8f1b505f1601c6c2264a5121d49ce83df3a84551e5e8aea707abc8e0fb4ba7b6569dd1fcaa8c79df52e3b9f52f32f35d4f9b9c4c10e5

data/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.1.1] - 2026-03-23
+
+### Fixed
+
+- **HTTPS support for all MMP HTTP calls**: `Net::HTTP.new` does not enable SSL by default. All MMP PlaceClient and meeting_* tools failed with "Connection reset by peer" when connecting to TLS-enabled Meeting Place servers. Added `http.use_ssl = (uri.scheme == 'https')` to all HTTP calls.
+- **Caddy DNS resolvers**: Ubuntu 24.04 uses systemd-resolved (127.0.0.53) which is inaccessible from Docker containers. Added external DNS resolvers (8.8.8.8, 1.1.1.1) to Caddy container.
+
+### Changed
+
+- **Domain**: `meeting.kairoschain.io` → `meeting.genomicschain.io`
+
+---
+
+## [3.1.0] - 2026-03-22
+
+### Added
+
+- **Docker Production Deployment**: Complete Docker setup for Meeting Place server on EC2
+  - `docker-compose.prod.yml` with Caddy TLS reverse proxy (`meeting.kairoschain.io`)
+  - Network isolation: `frontend` (Caddy + app) / `backend` (app + PG)
+  - Security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
+  - EC2 setup script (Amazon Linux 2023, Docker Compose via dnf)
+  - Service Grant DB migrations in entrypoint
+  - Volume upgrade: automatic SkillSet backfill from template on existing volumes
+- **Configurable Grant Creation Cooldown** (`grant_creation_cooldown`): Config option in `service_grant.yml` (default: 300s, set to 0 to disable). Future: trust-based cooldown where `cooldown = base * (1.0 - trust_score)`
+
+### Fixed
+
+- **AccessGate owner bypass**: Admin/owner tokens (from `--init-admin`) were blocked by Service Grant with "pubkey_hash missing from auth context". Owner role now bypasses Service Grant checks — admin tokens are system management, not service consumers
+- **GrantManager record_with_retry kwargs**: `record_grant_event` passed bare kwargs to `record_with_retry(event, attempt:)`, leaving the positional `event` parameter empty → `ArgumentError`. Fixed with explicit `{}` braces. Caused 500 errors on Place API endpoints
+- **meeting_connect session_token**: `connect_relay` saved the MMP introduce handshake token (`/meeting/v1/introduce`) instead of the Place register token (`/place/v1/register`). The MMP token lacks `pubkey_hash` in the session store, causing all Place API write operations (deposit, acquire) to fail with 403 "Cannot resolve identity"
+
+### Review
+
+- Docker deployment: 2 rounds × 3 LLMs (Claude Agent Team, Cursor Composer-2, Cursor GPT-5.4), converged at Round 2
+- Service Grant bugfixes: 1 round × 3 LLMs, 3/3 APPROVE
+
+---
+
 ## [3.0.0] - 2026-03-21
 
 ### Added
@@ -476,6 +515,8 @@ This project follows [Semantic Versioning](https://semver.org/).
 - Skill promotion with Persona Assembly
 - Tool guide and metadata system
 
+[3.1.1]: https://github.com/masaomi/KairosChain_2026/compare/v3.1.0...v3.1.1
+[3.1.0]: https://github.com/masaomi/KairosChain_2026/compare/v3.0.0...v3.1.0
 [3.0.0]: https://github.com/masaomi/KairosChain_2026/compare/v2.10.1...v3.0.0
 [2.10.1]: https://github.com/masaomi/KairosChain_2026/compare/v2.10.0...v2.10.1
 [2.10.0]: https://github.com/masaomi/KairosChain_2026/compare/v2.9.0...v2.10.0

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.0.0"
+  VERSION = "3.1.1"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/mmp/lib/mmp/place_client.rb

@@ -127,6 +127,7 @@ module MMP
       uri = URI.parse("#{@place_url}#{path}")
       uri.query = URI.encode_www_form(params) unless params.empty?
       http = Net::HTTP.new(uri.host, uri.port); http.open_timeout = @timeout; http.read_timeout = @timeout
+      http.use_ssl = (uri.scheme == 'https')
       req = Net::HTTP::Get.new(uri)
       req['Authorization'] = "Bearer #{@bearer_token}" if @bearer_token
       response = http.request(req)
@@ -139,6 +140,7 @@ module MMP
     def post(path, body)
       uri = URI.parse("#{@place_url}#{path}")
       http = Net::HTTP.new(uri.host, uri.port); http.open_timeout = @timeout; http.read_timeout = @timeout
+      http.use_ssl = (uri.scheme == 'https')
       req = Net::HTTP::Post.new(uri.path)
       req['Content-Type'] = 'application/json'
       req['Authorization'] = "Bearer #{@bearer_token}" if @bearer_token

data/templates/skillsets/mmp/tools/meeting_acquire_skill.rb

@@ -215,7 +215,7 @@ module KairosMcp
             path = "/place/v1/skill_content/#{URI.encode_www_form_component(skill_id)}"
             path += "?owner=#{URI.encode_www_form_component(owner_agent_id)}" if owner_agent_id
             uri = URI.parse("#{url}#{path}")
-            http = Net::HTTP.new(uri.host, uri.port)
+            http = Net::HTTP.new(uri.host, uri.port); http.use_ssl = (uri.scheme == 'https')
             http.open_timeout = 5; http.read_timeout = 10
             req = Net::HTTP::Get.new(uri)
             req['Authorization'] = "Bearer #{bearer_token}" if bearer_token
@@ -254,7 +254,7 @@ module KairosMcp
 
           def get_skill_direct(endpoint, skill_id, bearer_token: nil)
             uri = URI.parse("#{endpoint}/meeting/v1/skill_content")
-            http = Net::HTTP.new(uri.host, uri.port)
+            http = Net::HTTP.new(uri.host, uri.port); http.use_ssl = (uri.scheme == 'https')
             http.open_timeout = 5; http.read_timeout = 10
             req = Net::HTTP::Post.new(uri.path)
             req['Content-Type'] = 'application/json'

data/templates/skillsets/mmp/tools/meeting_browse.rb

@@ -99,7 +99,7 @@ module KairosMcp
           def browse_place(url, token, params)
             query = URI.encode_www_form(params)
             uri = URI.parse("#{url}/place/v1/board/browse?#{query}")
-            http = Net::HTTP.new(uri.host, uri.port)
+            http = Net::HTTP.new(uri.host, uri.port); http.use_ssl = (uri.scheme == 'https')
             http.open_timeout = 5; http.read_timeout = 10
             req = Net::HTTP::Get.new(uri)
             req['Authorization'] = "Bearer #{token}" if token

data/templates/skillsets/mmp/tools/meeting_connect.rb

@@ -155,7 +155,8 @@ module KairosMcp
             result = {
               status: 'connected', mode: 'relay', url: url, relay_mode: true,
               identity_verified: verified,
-              session_token: meeting_session_token,
+              session_token: session_token,
+              meeting_session_token: meeting_session_token,
               meeting_place: { url: url, name: place_info['name'] || place_info[:name] || 'Meeting Place' },
               self_agent_id: agent_id,
               your_skills: skill_counts,
@@ -249,6 +250,7 @@ module KairosMcp
           def http_post(url, body)
             uri = URI.parse(url)
             http = Net::HTTP.new(uri.host, uri.port)
+            http.use_ssl = (uri.scheme == 'https')
             req = Net::HTTP::Post.new(uri.path)
             req['Content-Type'] = 'application/json'
             req.body = JSON.generate(body)

data/templates/skillsets/mmp/tools/meeting_deposit.rb

@@ -173,7 +173,7 @@ module KairosMcp
 
           def deposit_to_place(url, token, skill)
             uri = URI.parse("#{url}/place/v1/deposit")
-            http = Net::HTTP.new(uri.host, uri.port)
+            http = Net::HTTP.new(uri.host, uri.port); http.use_ssl = (uri.scheme == 'https')
             http.open_timeout = 5; http.read_timeout = 15
             req = Net::HTTP::Post.new(uri.path)
             req['Content-Type'] = 'application/json'

data/templates/skillsets/mmp/tools/meeting_federate.rb

@@ -170,7 +170,7 @@ module KairosMcp
 
             query = URI.encode_www_form(params)
             uri = URI.parse("#{url}/place/v1/board/browse?#{query}")
-            http = Net::HTTP.new(uri.host, uri.port)
+            http = Net::HTTP.new(uri.host, uri.port); http.use_ssl = (uri.scheme == 'https')
             http.open_timeout = 5; http.read_timeout = 10
             req = Net::HTTP::Get.new(uri)
             req['Authorization'] = "Bearer #{token}"
@@ -198,7 +198,7 @@ module KairosMcp
             path = "/place/v1/skill_content/#{URI.encode_www_form_component(skill_id)}"
             path += "?owner=#{URI.encode_www_form_component(owner_agent_id)}" if owner_agent_id
             uri = URI.parse("#{url}#{path}")
-            http = Net::HTTP.new(uri.host, uri.port)
+            http = Net::HTTP.new(uri.host, uri.port); http.use_ssl = (uri.scheme == 'https')
             http.open_timeout = 5; http.read_timeout = 10
             req = Net::HTTP::Get.new(uri)
             req['Authorization'] = "Bearer #{token}"
@@ -224,7 +224,7 @@ module KairosMcp
           # Returns nil on failure (caller should fallback to URL).
           def resolve_place_id(url)
             uri = URI.parse("#{url}/place/v1/info")
-            http = Net::HTTP.new(uri.host, uri.port)
+            http = Net::HTTP.new(uri.host, uri.port); http.use_ssl = (uri.scheme == 'https')
             http.open_timeout = 3; http.read_timeout = 5
             req = Net::HTTP::Get.new(uri)
             response = http.request(req)
@@ -262,7 +262,7 @@ module KairosMcp
           # POST skill to target Place with provenance
           def deposit_to_target(url, token, skill)
             uri = URI.parse("#{url}/place/v1/deposit")
-            http = Net::HTTP.new(uri.host, uri.port)
+            http = Net::HTTP.new(uri.host, uri.port); http.use_ssl = (uri.scheme == 'https')
             http.open_timeout = 5; http.read_timeout = 15
             req = Net::HTTP::Post.new(uri.path)
             req['Content-Type'] = 'application/json'

data/templates/skillsets/mmp/tools/meeting_get_skill_details.rb

@@ -118,7 +118,7 @@ module KairosMcp
 
           def get_details_direct(endpoint, skill_id, bearer_token: nil)
             uri = URI.parse("#{endpoint}/meeting/v1/skill_details?skill_id=#{URI.encode_www_form_component(skill_id)}")
-            http = Net::HTTP.new(uri.host, uri.port)
+            http = Net::HTTP.new(uri.host, uri.port); http.use_ssl = (uri.scheme == 'https')
             http.open_timeout = 3; http.read_timeout = 5
             req = Net::HTTP::Get.new(uri)
             req['Authorization'] = "Bearer #{bearer_token}" if bearer_token

data/templates/skillsets/service_grant/lib/service_grant/access_checker.rb

@@ -43,7 +43,7 @@ module ServiceGrant
       if @grant_manager.in_cooldown?(grant) && write_action?(service, action)
         raise AccessDeniedError.new(:cooldown, service: service, action: action,
           message: "New grant in cooldown period. Read-only actions only.",
-          cooldown_remaining: GrantManager::GRANT_CREATION_COOLDOWN -
+          cooldown_remaining: @grant_manager.cooldown -
                               (Time.now - grant[:first_seen_at]).to_i)
       end
 

data/templates/skillsets/service_grant/lib/service_grant/access_gate.rb

@@ -22,6 +22,7 @@ module ServiceGrant
       return unless user_ctx  # STDIO mode -- permissive
 
       return if user_ctx[:local_dev]  # local dev mode -- permissive
+      return if user_ctx[:role] == 'owner'  # admin/owner bypasses service grant checks
 
       pubkey_hash = user_ctx[:pubkey_hash]
 

data/templates/skillsets/service_grant/lib/service_grant/grant_manager.rb

@@ -4,12 +4,15 @@ require 'time'
 
 module ServiceGrant
   class GrantManager
-    GRANT_CREATION_COOLDOWN = 300  # 5 minutes
+    DEFAULT_GRANT_CREATION_COOLDOWN = 300  # 5 minutes
     MAX_GRANTS_PER_IP_PER_HOUR = 5
 
-    def initialize(pg_pool:, plan_registry:)
+    attr_reader :plan_registry, :cooldown
+
+    def initialize(pg_pool:, plan_registry:, cooldown: nil)
       @pg = pg_pool
       @plans = plan_registry
+      @cooldown = cooldown || DEFAULT_GRANT_CREATION_COOLDOWN
       @ip_tracker = IpRateTracker.new(
         max: MAX_GRANTS_PER_IP_PER_HOUR, window: 3600, pg_pool: pg_pool
       )
@@ -133,8 +136,9 @@ module ServiceGrant
     end
 
     def in_cooldown?(grant)
+      return false if @cooldown <= 0
       return false unless grant[:first_seen_at]
-      (Time.now - grant[:first_seen_at]) < GRANT_CREATION_COOLDOWN
+      (Time.now - grant[:first_seen_at]) < @cooldown
     end
 
     def grants_with_unknown_plans(plan_registry)
@@ -177,11 +181,11 @@ module ServiceGrant
     MAX_RECORDING_RETRIES = 3
 
     def record_grant_event(pubkey_hash, service, action, details = {})
-      record_with_retry(
+      record_with_retry({
         type: 'service_grant_event', layer: 'L1',
         pubkey_hash: pubkey_hash, service: service,
         action: action, details: details, timestamp: Time.now.iso8601
-      )
+      })
     end
 
     # Record with retry (non-blocking, up to MAX_RECORDING_RETRIES attempts).

data/templates/skillsets/service_grant/lib/service_grant.rb

@@ -47,7 +47,9 @@ module ServiceGrant
 
       # 3. IP resolution + domain objects
       @ip_resolver = ClientIpResolver.new(config['ip_resolution'] || {})
-      @grant_manager = GrantManager.new(pg_pool: @pg_pool, plan_registry: @plan_registry)
+      cooldown = config['grant_creation_cooldown']&.to_i
+      @grant_manager = GrantManager.new(pg_pool: @pg_pool, plan_registry: @plan_registry,
+                                         cooldown: cooldown)
       @usage_tracker = UsageTracker.new(pg_pool: @pg_pool, plan_registry: @plan_registry,
                                          cycle_manager: @cycle_manager)
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kairos-chain
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.1.1
 platform: ruby
 authors:
 - Masaomi Hatakeyama
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-21 00:00:00.000000000 Z
+date: 2026-03-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -389,7 +389,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.26
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: KairosChain - Self-referential MCP server for auditable skill self-management