kairos-chain 3.52.1 → 3.53.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e6bc15d467e1fbef211be82d39ec89bfdc760d7bdd67286635967c95c2acd2ce
-  data.tar.gz: b761078e7adc2798988a2fb0154bbbf998b37eed14d9979e87e7656194f03b76
+  metadata.gz: 31e74313d89bf76d795f74dd21f641fd702a1c186cec186f7425b8af53d2e012
+  data.tar.gz: 0f325ce8ac8876685f7aa266fabf539e228e8fe5b57cfbfc5b6a395d82a8290c
 SHA512:
-  metadata.gz: 604f315facca09bdb89e8abe403cf2873abe6a201cf9771181f04a813c323685da0749237e0f3f547379f9ce1dc7a8976b3e12f657c4718604ef694368f15f27
-  data.tar.gz: 67b55d37e2ba35259b1df7e42c96222cf637a9b295eac63b877b715f060310ff19841c2152de9fad1a92345a8f40738803b47a68b020e74ad9405c923a17de6b
+  metadata.gz: 98f7d0763ee115a0380028deedc06a12a022fad0bfec85b89529527b15763cea236ef16a7ec3304ee3f0b6aa8f381f04f71f0cbd1c4ff425c9f76b77598ed2af
+  data.tar.gz: 7ca21d4ec532094e1b0fd0048ba4d8e1acd5bf0f3e4d35473d36ad751ca6f37b93e9ecb447e681be5a2ecf86694cefb7a7bd8ebce8068c43a0d64b70a797ff5d

data/CHANGELOG.md

@@ -4,6 +4,40 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.53.0] - 2026-07-24
+
+### SkillSet Web Catalog — anonymous public presentation surface for SkillSet deposits
+
+Adds an anonymous, read-only web catalog for Meeting Place SkillSet deposits
+(including certified distillates), closing the presentation gap with the
+existing skill catalog: SkillSet deposits were previously reachable only
+through the authenticated agent API and had no browser-visible surface.
+
+Design `skillset_web_catalog` v0.3.1 FROZEN (design review 3 rounds, R3 6/6
+APPROVE unanimous; implementation review 3 rounds, R3 8/8 APPROVE unanimous).
+
+- **PlaceRouter public-route mechanism (WC-1/WC-2)**: extensions declare
+  unauthenticated `/place/web/` routes via `#public_route_prefixes` (the
+  capability travels with the extension, so every registration path wires it);
+  read-only by construction, dispatched through `#public_call` with no peer
+  identity; declarations are recorded and introspectable; the window
+  contributes method restriction, per-client rate limiting, and transport
+  security headers (CSP `default-src 'none'`, `X-Frame-Options: DENY`,
+  `nosniff`).
+- **skillset_exchange catalog (WC-3/WC-4/WC-5)**: anonymous `/place/web/skillsets`
+  listing + per-deposit detail views. Certificate summary is projected onto the
+  CD-2 checkability vocabulary at the deposit crossing (never on the anonymous
+  path); provenance is rendered as a co-equal field with three truthful states
+  and no ranking/badge/filter keyed on certificate presence (CD-3); depositor
+  text is structurally separated and HTML-escaped; per-deposit-instance
+  addresses sever withdrawn/replaced listings; `no-store` caching.
+- **docker/Caddyfile**: `header_up X-Real-IP {remote_host}` on the meeting-place
+  reverse-proxy blocks so the per-client rate limit keys on the real client and
+  cannot be spoofed or collapsed to the shared proxy IP.
+
+New test suite `test_skillset_web_catalog.rb` (68 assertions). Exchange
+interfaces, storage, and the hestia skill catalog are consumed unchanged.
+
 ## [3.51.3] - 2026-07-23
 
 ### Multi-LLM Review — knowledge template sync (v3.6.1)

data/lib/kairos_mcp/http_server.rb

@@ -374,10 +374,22 @@ module KairosMcp
           require_path = File.join(ss.path, ext_def['require'])
           require require_path
           ext_class = Object.const_get(ext_def['class'])
-          router.register_extension(
-            ext_class.new(router),
-            route_action_map: ext_def['route_actions'] || {}
-          )
+          # public_routes (skillset web catalog design WC-2): pass only when the
+          # installed hestia PlaceRouter supports it, so a newer gem composes
+          # with an older hestia SkillSet (and vice versa) without breaking.
+          supports_public = router.method(:register_extension).parameters.any? { |_type, name| name == :public_routes }
+          if supports_public
+            router.register_extension(
+              ext_class.new(router),
+              route_action_map: ext_def['route_actions'] || {},
+              public_routes: ext_def['public_routes'] || []
+            )
+          else
+            router.register_extension(
+              ext_class.new(router),
+              route_action_map: ext_def['route_actions'] || {}
+            )
+          end
         rescue StandardError => e
           $stderr.puts "[HttpServer] Failed to load extension '#{ext_def['class']}' " \
                        "from SkillSet '#{ss.name}': #{e.message}"

data/lib/kairos_mcp/skillset_manager.rb

@@ -457,6 +457,17 @@ module KairosMcp
 
         if !File.exist?(dst)
           changed << rel
+        elsif rel.start_with?('config/')
+          # An existing config/ file is operator-owned state (activation
+          # flags, adopted profiles): a difference from the template is
+          # user customization, not a pending upgrade — never listed and
+          # therefore never overwritten by upgrade_apply. Parity with
+          # install(force:)'s config preservation and the docker
+          # entrypoint's config-preserving sync. (Production incident
+          # 2026-07-24: upgrade --apply silently reset the confidentiality
+          # guard's enabled: true to the template's false.) Absent config
+          # files still install above (new shipped config).
+          next
         elsif Digest::SHA256.file(src).hexdigest != Digest::SHA256.file(dst).hexdigest
           changed << rel
         end

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.52.1"
+  VERSION = "3.53.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/hestia/lib/hestia/place_router.rb

@@ -79,21 +79,113 @@ module Hestia
       @self_id = nil
       @extensions = []
       @extension_action_map = {}
+      # WC-2 (skillset web catalog design): public (unauthenticated) routes
+      # declared by extensions. The router learns only that an extension has
+      # public routes under a prefix, never what they mean. Declarations are
+      # recorded acts (introspectable via #status).
+      @public_routes = {}
+      @public_route_declarations = []
+      @public_rate_limiter = nil
     end
 
+    # Public web namespace an extension may declare routes under. Constraining
+    # the namespace keeps the public surface within the window's established
+    # anonymous-access discipline.
+    PUBLIC_ROUTE_NAMESPACE = '/place/web/'
+
     # Register a PlaceRouter extension for additional endpoint handling.
     # Extensions receive authenticated requests and return Rack responses or nil.
     # Idempotent: skips if an extension of the same class is already registered.
     #
+    # Public routes (WC-1/WC-2): an extension may additionally declare
+    # unauthenticated, read-only route prefixes under /place/web/. The router
+    # enforces the window discipline (GET/HEAD only, IP rate limiting) and
+    # dispatches via #public_call(env) — a separate entry point that carries no
+    # authenticated capability, so the anonymous invocation path is read-only
+    # at the capability level, not merely by method filtering. The declaration
+    # is a recorded act, kept in the router's declaration registry.
+    #
+    # Public routes are sourced from the extension itself when it responds to
+    # #public_route_prefixes (the capability travels with the extension, WC-2),
+    # so every registration path — startup, lazy tool-triggered, STDIO —
+    # wires them identically without each call site having to remember. An
+    # explicit +public_routes+ argument, when given, is unioned in (used by
+    # tests and the config-driven path).
+    #
+    # Idempotent-with-upgrade: a second registration of the same class is
+    # skipped, but if the already-registered instance carries no public routes
+    # and this call supplies them, they are attached to the existing instance —
+    # so a lazy path that registered first (without routes) does not
+    # permanently disable the catalog.
+    #
     # @param extension [Object] Extension instance responding to #call(env, peer_id:)
     # @param route_action_map [Hash] Maps route segments to action names for access control
-    def register_extension(extension, route_action_map: {})
-      return if @extensions.any? { |e| e.class == extension.class }
+    # @param public_routes [Array<String>] Extra path prefixes under /place/web/ served unauthenticated
+    def register_extension(extension, route_action_map: {}, public_routes: [])
+      declared = public_routes.dup
+      if extension.respond_to?(:public_route_prefixes)
+        declared |= Array(extension.public_route_prefixes)
+      end
+
+      existing = @extensions.find { |e| e.class == extension.class }
+      if existing
+        # Upgrade an earlier lazy registration: attach only the prefixes the
+        # existing instance does not already own, under the same public_call
+        # validation a fresh registration gets.
+        missing = declared.reject { |prefix| route_owned_by?(existing, prefix) }
+        unless missing.empty?
+          validate_public_call!(existing, missing)
+          attach_public_routes(existing, missing)
+        end
+        return
+      end
+
+      validate_public_call!(extension, declared) unless declared.empty?
 
       @extensions << extension
       @extension_action_map.merge!(route_action_map)
+      attach_public_routes(extension, declared) unless declared.empty?
     end
 
+    # Recorded public-route declarations (WC-2: declaration as a recorded,
+    # checkable act). Deep read-only copy (strings included) so callers cannot
+    # mutate the registry.
+    def public_route_declarations
+      @public_route_declarations.map { |d| { **d, prefixes: d[:prefixes].map(&:dup) } }
+    end
+
+    # Attach validated public route prefixes to an extension and record the
+    # declaration. Shared by fresh registration and lazy-upgrade paths.
+    def attach_public_routes(extension, prefixes)
+      prefixes.each do |prefix|
+        unless prefix.is_a?(String) && prefix.start_with?(PUBLIC_ROUTE_NAMESPACE) &&
+               prefix.chomp('/').length > PUBLIC_ROUTE_NAMESPACE.length
+          raise ArgumentError,
+                "public route prefix must be under #{PUBLIC_ROUTE_NAMESPACE} with a non-empty segment: #{prefix.inspect}"
+        end
+        @public_routes[prefix.chomp('/')] = extension
+      end
+      @public_route_declarations << {
+        extension_class: extension.class.name,
+        prefixes: prefixes.map { |p| p.dup.freeze },
+        declared_at: Time.now.utc.iso8601
+      }
+    end
+    private :attach_public_routes
+
+    def validate_public_call!(extension, prefixes)
+      return if prefixes.empty?
+      return if extension.respond_to?(:public_call)
+
+      raise ArgumentError, "#{extension.class} declares public routes but does not respond to #public_call"
+    end
+    private :validate_public_call!
+
+    def route_owned_by?(extension, prefix)
+      @public_routes[prefix.chomp('/')].equal?(extension)
+    end
+    private :route_owned_by?
+
     # Start the Meeting Place: initialize components and self-register.
     #
     # @param identity [MMP::Identity] This instance's identity
@@ -246,6 +338,14 @@ module Hestia
       request_method = env['REQUEST_METHOD']
       path = env['PATH_INFO']
 
+      # Extension-declared public routes (WC-1/WC-2): checked before the
+      # WebRouter because their prefixes are more specific than the shared
+      # /place/web/ namespace. The window contributes method restriction and
+      # rate limiting here; content-side escaping is owned by the extension.
+      if (public_ext = match_public_route(path))
+        return handle_public_extension_route(env, public_ext, request_method)
+      end
+
       # Public, unauthenticated, read-only web surface (ANC-7 verification view,
       # skill catalog, JSON API). Delegated before the auth flow — same position
       # as the other unauthenticated endpoints below. The WebRouter enforces
@@ -363,12 +463,95 @@ module Hestia
         uptime_seconds: @started_at ? (Time.now.utc - @started_at).to_i : 0,
         deposits: @skill_board.deposit_stats,
         last_heartbeat_check: heartbeat_result,
-        federation_cleanup: cleanup_result
+        federation_cleanup: cleanup_result,
+        public_route_declarations: public_route_declarations
       }
     end
 
     private
 
+    # --- Extension public routes (window discipline) ---
+
+    # Match a request path against declared public route prefixes.
+    # Longest-prefix wins, so a more specific prefix is never shadowed by a
+    # broader one regardless of declaration order.
+    def match_public_route(path)
+      return nil if @public_routes.empty?
+
+      normalized = path.chomp('/')
+      best = nil
+      @public_routes.each do |prefix, ext|
+        next unless normalized == prefix || path.start_with?("#{prefix}/")
+        best = [prefix, ext] if best.nil? || prefix.length > best[0].length
+      end
+      best&.last
+    end
+
+    # Transport security headers the anonymous window contributes to every
+    # extension-served public response (WC-1: the window owns transport
+    # discipline). Mirrors the WebRouter's public HTML posture. The extension
+    # keeps content-specific headers (its own Content-Type, Cache-Control).
+    PUBLIC_SECURITY_HEADERS = {
+      'X-Content-Type-Options' => 'nosniff',
+      'X-Frame-Options' => 'DENY',
+      'Content-Security-Policy' => "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'"
+    }.freeze
+
+    # Serve an extension-declared public route under the window discipline:
+    # read-only methods only, IP rate limiting shared across all extension
+    # public routes, and dispatch through #public_call — which receives no
+    # peer identity and no session capability (invocation-level read-only).
+    def handle_public_extension_route(env, extension, request_method)
+      unless %w[GET HEAD].include?(request_method)
+        return decorate_public([405, { 'Content-Type' => 'text/plain', 'Allow' => 'GET, HEAD' }, ['Method Not Allowed']], request_method)
+      end
+
+      # Resolve the client IP through the same trusted-proxy-aware resolver the
+      # authenticated path uses, so the anonymous rate limit is per real client
+      # and cannot be bypassed by a forged X-Real-IP / X-Forwarded-For header.
+      ip = resolve_public_ip(env)
+      unless public_extension_rate_limiter.allow?(ip)
+        return decorate_public([429, { 'Content-Type' => 'text/plain' }, ['Rate limit exceeded. Try again later.']], request_method)
+      end
+
+      result = extension.public_call(env)
+      result ||= [404, { 'Content-Type' => 'text/html' }, ['Not Found']]
+      decorate_public(result, request_method)
+    rescue StandardError => e
+      $stderr.puts "[PlaceRouter] Public extension route error: #{e.class}: #{e.message}"
+      decorate_public([500, { 'Content-Type' => 'text/plain' }, ['Internal Server Error']], request_method)
+    end
+
+    # Client IP for anonymous rate limiting. Uses ServiceGrant's trusted-proxy
+    # resolver when present (as the authenticated path does); otherwise falls
+    # back to REMOTE_ADDR — never a raw client-suppliable header, so the limit
+    # cannot be evaded by spoofing X-Real-IP.
+    def resolve_public_ip(env)
+      if defined?(ServiceGrant) && ServiceGrant.respond_to?(:ip_resolver) && ServiceGrant.ip_resolver
+        ServiceGrant.ip_resolver.resolve(env) || env['REMOTE_ADDR'] || 'unknown'
+      else
+        env['REMOTE_ADDR'] || 'unknown'
+      end
+    end
+
+    # Add the window's transport security headers and strip the body for HEAD.
+    def decorate_public(response, request_method)
+      status, headers, body = response
+      # Window security headers win over anything the extension set — the
+      # window owns transport discipline (WC-1); the extension keeps its
+      # content headers (Content-Type, Cache-Control) which are not in the set.
+      merged = headers.merge(PUBLIC_SECURITY_HEADERS)
+      body = [] if request_method == 'HEAD'
+      [status, merged, body]
+    end
+
+    def public_extension_rate_limiter
+      @public_rate_limiter ||= begin
+        require_relative 'public_rate_limiter'
+        PublicRateLimiter.new
+      end
+    end
+
     # --- Handlers ---
 
     # GET /place/v1/info — Public, no auth

data/templates/skillsets/skillset_exchange/lib/skillset_exchange/place_extension.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require 'cgi'
+require 'digest'
+require 'securerandom'
 require 'fileutils'
 require 'json'
 require 'uri'
@@ -9,6 +12,7 @@ require 'rubygems/package'
 require 'stringio'
 require 'time'
 require 'yaml'
+require 'tmpdir'
 
 module SkillsetExchange
   # PlaceExtension adds SkillSet deposit/browse/content/withdraw endpoints
@@ -26,6 +30,50 @@ module SkillsetExchange
       ['POST', '/place/v1/skillset_withdraw'] => :handle_skillset_withdraw,
     }.freeze
 
+    # Anonymous, read-only web catalog (skillset web catalog design WC-1..WC-5).
+    # The router sources these prefixes from #public_route_prefixes at every
+    # registration path (the capability travels with the extension, WC-2); the
+    # router contributes method restriction, rate limiting, and transport
+    # security headers, while this extension owns rendering, context-correct
+    # escaping, and the disclosure bound.
+    PUBLIC_PREFIX = '/place/web/skillsets'
+
+    # CD-2 checkability vocabulary. The anonymous summary projects the
+    # certificate's statuses onto exactly these claim keys, and only when the
+    # value is one of the CD-2 status words — so a malformed or quality-shaped
+    # certificate cannot inject non-vocabulary content into the machinery-owned
+    # provenance register (WC-3/WC-4). Everything else is dropped.
+    CD2_STATUS_VALUES = %w[checkable anchor-pending trusted].freeze
+    CD2_STATUS_KEYS = %w[
+      identity.binding identity.continuity identity.uniqueness
+      derivation recording reissuance_citation_observance
+      drawn_from revocation_status
+    ].freeze
+    MAX_SUMMARY_IDENTITY_LEN = 128
+    MAX_SUMMARY_CHANNEL_LEN = 128
+
+    # Public route prefixes this extension serves unauthenticated (WC-2). Read
+    # by PlaceRouter#register_extension at every registration path.
+    def self.public_route_prefixes
+      [PUBLIC_PREFIX]
+    end
+
+    def public_route_prefixes
+      self.class.public_route_prefixes
+    end
+
+    # In-package provenance certificate file (chain_distillation CD-7/BL-S2-6).
+    CERTIFICATE_FILENAME = 'certificate.json'
+
+    HTML_HEADERS = {
+      'Content-Type' => 'text/html; charset=utf-8',
+      # WC-5 cache-lifecycle bound: no cache this design controls may serve a
+      # listing beyond the deposit it describes. BL-WC-4 default: no-store,
+      # which also instructs caches the design does not control.
+      'Cache-Control' => 'no-store',
+      'X-Content-Type-Options' => 'nosniff'
+    }.freeze
+
     # Executable extensions to check in tar headers (same as Skillset::EXECUTABLE_EXTENSIONS)
     EXECUTABLE_EXTENSIONS = %w[.rb .py .sh .pl .js .ts .lua .exe .so .dylib .dll .class .jar .wasm].freeze
 
@@ -42,10 +90,23 @@ module SkillsetExchange
       @session_store = router.session_store
       @registry = router.registry
       @deposited_skillsets = {}  # { "name:depositor_id" => metadata_hash }
+      # Guards @deposited_skillsets across authenticated writer threads
+      # (deposit/withdraw) and anonymous reader threads (catalog/detail render).
+      @state_mutex = Mutex.new
       @config = load_config
       @storage_dir = resolve_storage_dir
       FileUtils.mkdir_p(@storage_dir) if @storage_dir
       load_state
+      # BL-WC-5 launch backfill: pre-existing deposits get their certificate
+      # state and listing address here, at construction — never on the
+      # anonymous request path. Scoped rescue so only backfill failures are
+      # non-fatal; storage/config init failures still propagate to the
+      # registration error handler.
+      begin
+        backfill_listing_state!
+      rescue StandardError => e
+        $stderr.puts "[SkillsetExchange] Listing-state backfill failed (non-fatal): #{e.message}"
+      end
     end
 
     # Rack-compatible dispatch. Returns Rack response or nil (not handled).
@@ -58,6 +119,22 @@ module SkillsetExchange
       send(handler, env, peer_id)
     end
 
+    # Anonymous public dispatch (WC-1): invoked by the PlaceRouter for declared
+    # public routes. Receives no peer identity and no session capability — the
+    # anonymous invocation path is read-only at the capability level. Returns a
+    # Rack response or nil (router 404s).
+    def public_call(env)
+      return nil unless %w[GET HEAD].include?(env['REQUEST_METHOD'])
+
+      path = env['PATH_INFO']
+      case path
+      when PUBLIC_PREFIX, "#{PUBLIC_PREFIX}/"
+        render_public_catalog(env)
+      when %r{\A#{Regexp.escape(PUBLIC_PREFIX)}/([a-f0-9]{16})/?\z}
+        render_public_detail(Regexp.last_match(1))
+      end
+    end
+
     private
 
     # -----------------------------------------------------------------------
@@ -141,6 +218,7 @@ module SkillsetExchange
       # Extract to temp dir, create Skillset, compare content_hash
       hash_verified = false
       canonical_metadata = {}
+      certificate_state = nil
       begin
         Dir.mktmpdir('kairos_ss_deposit') do |tmpdir|
           extract_tar_gz(archive_data, tmpdir)
@@ -155,6 +233,10 @@ module SkillsetExchange
               provides: temp_ss.provides,
               file_count: temp_ss.file_list.size
             }
+            # BL-WC-5 (deposit-time extraction point): the certificate summary
+            # is derived here, at the deposit crossing, from the verified
+            # archive — never on the anonymous request path.
+            certificate_state = extract_certificate_state(extracted_dir)
             if actual_hash == content_hash
               hash_verified = true
             else
@@ -256,12 +338,23 @@ module SkillsetExchange
         provides: canonical_metadata[:provides] || provides,
         archive_size_bytes: archive_data.bytesize,
         file_count: file_list.size,
-        deposited_at: Time.now.utc.iso8601
+        # Microsecond precision: the listing address derives from this value,
+        # and WC-5's identity severance must hold even for same-second
+        # replacements.
+        deposited_at: Time.now.utc.iso8601(6),
+        certificate: certificate_state
       }
+      # WC-5 listing identity: a per-deposit-instance address. A fresh random
+      # nonce per deposit makes severance unconditional — even two replacements
+      # of the same (name, depositor) within the same microsecond get distinct
+      # addresses, so a new deposit never wears a predecessor's address.
+      metadata[:deposit_nonce] = SecureRandom.hex(16)
+      metadata[:listing_address] = listing_address_for(metadata)
       File.write(File.join(deposit_dir, 'metadata.json'), JSON.pretty_generate(metadata))
 
-      # Replace existing deposit from same agent with same name
-      @deposited_skillsets[deposit_key] = metadata
+      # Replace existing deposit from same agent with same name.
+      # Guarded so an anonymous reader's snapshot never sees a torn write.
+      @state_mutex.synchronize { @deposited_skillsets[deposit_key] = metadata }
       save_state
 
       # 11. Record chain event
@@ -489,8 +582,8 @@ module SkillsetExchange
         })
       end
 
-      # 4. Remove from in-memory state
-      @deposited_skillsets.delete(deposit_key)
+      # 4. Remove from in-memory state (guarded against anonymous readers)
+      @state_mutex.synchronize { @deposited_skillsets.delete(deposit_key) }
 
       # 5. Delete disk files (use trusted metadata values, not raw request input)
       deposit_dir = File.join(@storage_dir, "#{meta[:name]}_#{sanitize_id(meta[:depositor_id])}")
@@ -629,6 +722,284 @@ module SkillsetExchange
       end
     end
 
+    # -----------------------------------------------------------------------
+    # Certificate summary (skillset web catalog design WC-3/WC-4, BL-WC-2/5)
+    # -----------------------------------------------------------------------
+
+    # Derive the deposit-judgment certificate state from a verified extracted
+    # package directory. Three truthful states (WC-4):
+    #   { present: false }                       — no certificate in the package
+    #   { present: true, summary: {...} }        — certificate, summary derived
+    #   { present: true, summary: nil }          — certificate, summary unavailable
+    # The summary is a CD-5-bounded projection of the certificate's own claims:
+    # identity, checkability statuses (CD-2 vocabulary), and the revocation
+    # channel. Never payload-derived content, never openings/salts, never
+    # diagnostics.
+    def extract_certificate_state(extracted_dir)
+      cert_path = File.join(extracted_dir, CERTIFICATE_FILENAME)
+      return { present: false } unless File.exist?(cert_path)
+
+      cert = JSON.parse(File.read(cert_path))
+      core = cert['claim_core']
+      return { present: true, summary: nil } unless core.is_a?(Hash)
+
+      identity = core['certificate_identity']
+      unless identity.is_a?(String) && !identity.empty? && identity.length <= MAX_SUMMARY_IDENTITY_LEN
+        return { present: true, summary: nil }
+      end
+
+      channel = core.dig('recording', 'revocation_channel')
+      channel = nil unless channel.is_a?(String) && channel.length <= MAX_SUMMARY_CHANNEL_LEN
+
+      {
+        present: true,
+        summary: {
+          certificate_identity: identity,
+          statuses: project_cd2_statuses(core['statuses']),
+          revocation_channel: channel
+        }
+      }
+    rescue StandardError
+      # Extraction failure yields absence of a summary, never diagnostics.
+      { present: true, summary: nil }
+    end
+
+    # WC-3/WC-4: project depositor-supplied statuses onto the CD-2 vocabulary.
+    # Only known claim keys with recognized CD-2 status values survive; any
+    # other key, non-scalar value, or non-vocabulary word is dropped. This
+    # makes "the summary is CD-2 checkability statuses" structural rather than
+    # a trust in the depositor's certificate shape, and bounds the rendered
+    # table to at most CD2_STATUS_KEYS entries.
+    def project_cd2_statuses(raw)
+      return {} unless raw.is_a?(Hash)
+
+      projected = {}
+      CD2_STATUS_KEYS.each do |key|
+        value = raw[key]
+        projected[key] = value if value.is_a?(String) && CD2_STATUS_VALUES.include?(value)
+      end
+      projected
+    end
+
+    # WC-5 listing identity: per-deposit-instance, transport-safe address.
+    # The deposit_nonce (assigned at deposit time) guarantees uniqueness; the
+    # other components keep the address stable across a backfill re-derivation.
+    def listing_address_for(meta)
+      basis = "#{meta[:name]}|#{meta[:depositor_id]}|#{meta[:deposited_at]}|#{meta[:deposit_nonce]}"
+      Digest::SHA256.hexdigest(basis)[0, 16]
+    end
+
+    # Launch-time backfill (BL-WC-5): give pre-existing deposits their
+    # certificate state and listing address. Runs at extension construction —
+    # off the anonymous request path — and persists once. This is a writer
+    # under the guard-enrollment discipline at this instance's boundary.
+    def backfill_listing_state!
+      changed = false
+      @deposited_skillsets.each_value do |meta|
+        unless meta[:listing_address]
+          # Legacy deposits predate the nonce; assign one now so the address is
+          # per-deposit-unique, then persist it (deterministic thereafter).
+          meta[:deposit_nonce] ||= SecureRandom.hex(16)
+          meta[:listing_address] = listing_address_for(meta)
+          changed = true
+        end
+        next if meta.key?(:certificate)
+
+        meta[:certificate] = backfill_certificate_state(meta)
+        changed = true
+      end
+      save_state if changed
+    end
+
+    def backfill_certificate_state(meta)
+      deposit_dir = File.join(@storage_dir, "#{meta[:name]}_#{sanitize_id(meta[:depositor_id])}")
+      archive_path = File.join(deposit_dir, 'archive.tar.gz')
+      # Presence unknown when the archive cannot be inspected: rendered as the
+      # neutral unavailability marker, never as "no provenance claim".
+      return { present: nil } unless File.exist?(archive_path)
+
+      state = nil
+      Dir.mktmpdir('kairos_ss_backfill') do |tmpdir|
+        extract_tar_gz(File.binread(archive_path), tmpdir)
+        extracted_dir = File.join(tmpdir, meta[:name].to_s)
+        state = if File.directory?(extracted_dir)
+                  extract_certificate_state(extracted_dir)
+                else
+                  { present: nil }
+                end
+      end
+      state
+    rescue StandardError
+      { present: nil }
+    end
+
+    # -----------------------------------------------------------------------
+    # Anonymous web catalog rendering (WC-1/WC-3/WC-4/WC-5)
+    # -----------------------------------------------------------------------
+
+    def render_public_catalog(env)
+      params = parse_query(env)
+      search = params['search'].to_s
+      limit = [[(params['limit'] || '50').to_i, 1].max, 100].min
+
+      results = @state_mutex.synchronize { @deposited_skillsets.values.dup }
+
+      # WC-4: search matches depositor-authored metadata only — never
+      # certificate-derived fields, which are excluded from any matching.
+      unless search.empty?
+        q = search.downcase
+        results = results.select do |meta|
+          meta[:name].to_s.downcase.include?(q) ||
+            meta[:description].to_s.downcase.include?(q) ||
+            (meta[:tags] || []).any? { |t| t.to_s.downcase.include?(q) } ||
+            (meta[:provides] || []).any? { |p| p.to_s.downcase.include?(q) }
+        end
+      end
+
+      total = results.size
+      # DEE: unordered random sample, identical for certified and uncertified.
+      sampled = results.size > limit ? results.sample(limit) : results.shuffle
+
+      cards = sampled.map { |meta| listing_card_html(meta) }.join("\n")
+      body = <<~HTML
+        #{public_page_header('SkillSet Catalog')}
+        <p>#{total} SkillSet deposit#{total == 1 ? '' : 's'} on this Place. Unordered random sample — no ranking, no recommendation.</p>
+        <form method="get" action="#{h(PUBLIC_PREFIX)}">
+          <input type="text" name="search" value="#{h(search)}" placeholder="Search name, description, tags" />
+          <button type="submit">Search</button>
+        </form>
+        #{total.zero? ? '<p>No SkillSet deposits are currently listed.</p>' : cards}
+        #{public_page_footer}
+      HTML
+      html_response(200, body)
+    end
+
+    def render_public_detail(address)
+      meta = @state_mutex.synchronize { @deposited_skillsets.values.find { |m| m[:listing_address] == address } }
+      unless meta
+        return html_response(404, <<~HTML)
+          #{public_page_header('Listing not found')}
+          <p>No listing exists at this address. Listings are per-deposit: a withdrawn or replaced deposit's address ceases to resolve.</p>
+          #{public_page_footer}
+        HTML
+      end
+
+      body = <<~HTML
+        #{public_page_header(meta[:name].to_s)}
+        #{listing_card_html(meta, detail: true)}
+        <h2>Acquisition</h2>
+        <p>This catalog is read-only. Acquisition happens exclusively on the authenticated agent path:
+        connect a KairosChain instance to this Place and use the <code>skillset_acquire</code> tool
+        (name: <code>#{h(meta[:name])}</code>, depositor: <code>#{h(meta[:depositor_id])}</code>).
+        The Place verified format safety, a tar header scan, and depositor identity — review content before use.</p>
+        #{public_page_footer}
+      HTML
+      html_response(200, body)
+    end
+
+    # One listing, uniform structure (WC-4): every listing carries the same
+    # provenance register, populated exclusively from certificate-derived
+    # state; depositor-authored text stays in its own register.
+    def listing_card_html(meta, detail: false)
+      addr = h(meta[:listing_address].to_s)
+      title = detail ? h(meta[:name].to_s) : %(<a href="#{h(PUBLIC_PREFIX)}/#{addr}">#{h(meta[:name].to_s)}</a>)
+      tags = (meta[:tags] || []).map { |t| h(t.to_s) }.join(', ')
+      provides = (meta[:provides] || []).map { |p| h(p.to_s) }.join(', ')
+      <<~HTML
+        <article class="listing">
+          <h3>#{title} <small>v#{h(meta[:version].to_s)}</small></h3>
+          <p class="depositor-text">#{h(meta[:description].to_s)}</p>
+          <dl>
+            <dt>Depositor</dt><dd>#{h(meta[:depositor_id].to_s)}</dd>
+            <dt>Deposited at</dt><dd>#{h(meta[:deposited_at].to_s)}</dd>
+            #{tags.empty? ? '' : "<dt>Tags</dt><dd>#{tags}</dd>"}
+            #{provides.empty? ? '' : "<dt>Provides</dt><dd>#{provides}</dd>"}
+            <dt>Content hash</dt><dd><code>#{h(meta[:content_hash].to_s)}</code></dd>
+            <dt>Files</dt><dd>#{h(meta[:file_count].to_s)} (#{h(meta[:archive_size_bytes].to_s)} bytes)</dd>
+          </dl>
+          #{provenance_field_html(meta, detail: detail)}
+        </article>
+      HTML
+    end
+
+    # The provenance register (WC-4 three truthful states, WC-5 honesty).
+    def provenance_field_html(meta, detail: false)
+      cert = meta[:certificate]
+      state_html =
+        if cert.nil? || cert[:present].nil?
+          '<p>Provenance state unavailable.</p>'
+        elsif cert[:present] && cert[:summary]
+          summary_html(cert[:summary], detail: detail)
+        elsif cert[:present]
+          '<p>Provenance claim present — summary unavailable.</p>'
+        else
+          '<p>No provenance claim.</p>'
+        end
+      <<~HTML
+        <section class="provenance" aria-label="Provenance (certificate-derived)">
+          <h4>Provenance</h4>
+          #{state_html}
+        </section>
+      HTML
+    end
+
+    def summary_html(summary, detail: false)
+      identity = h(summary[:certificate_identity].to_s)
+      unless detail
+        return "<p>Provenance certificate <code>#{identity}</code> (deposit-time claims; see detail view).</p>"
+      end
+
+      statuses = summary[:statuses] || {}
+      rows = statuses.map do |claim, status|
+        "<tr><td>#{h(claim.to_s)}</td><td>#{h(status.to_s)}</td></tr>"
+      end.join
+      channel = summary[:revocation_channel]
+      <<~HTML
+        <p>Provenance certificate <code>#{identity}</code>.</p>
+        #{rows.empty? ? '' : "<table><thead><tr><th>Claim</th><th>Checkability</th></tr></thead><tbody>#{rows}</tbody></table>"}
+        #{channel ? "<p>Revocation channel: <code>#{h(channel.to_s)}</code></p>" : ''}
+        <p class="limits">Everything in this summary, including checkability status, reflects deposit-judgment
+        state and is silent about everything after. Revocation checking is carrier-side and out of this
+        catalog's scope. Provenance describes origin, not quality.</p>
+      HTML
+    end
+
+    def public_page_header(title)
+      <<~HTML
+        <!DOCTYPE html>
+        <html lang="en"><head><meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>#{h(title)} — Meeting Place</title>
+        <style>
+          body { font-family: system-ui, sans-serif; max-width: 46rem; margin: 2rem auto; padding: 0 1rem; }
+          article.listing { border: 1px solid #ccc; border-radius: 6px; padding: 0.8rem 1rem; margin: 1rem 0; }
+          section.provenance { border-top: 1px dashed #999; margin-top: 0.6rem; padding-top: 0.4rem; }
+          section.provenance h4 { margin: 0 0 0.3rem; font-size: 0.85rem; text-transform: uppercase; letter-spacing: 0.05em; }
+          p.limits { font-size: 0.85rem; color: #555; }
+          dl { display: grid; grid-template-columns: max-content 1fr; gap: 0.1rem 0.8rem; }
+          dt { font-weight: 600; } dd { margin: 0; overflow-wrap: anywhere; }
+          table { border-collapse: collapse; } td, th { border: 1px solid #ccc; padding: 0.2rem 0.5rem; }
+        </style></head><body>
+        <h1>#{h(title)}</h1>
+      HTML
+    end
+
+    def public_page_footer
+      <<~HTML
+        <hr><p class="limits">Anonymous read-only view of SkillSet deposits. Listings are shown without
+        ranking (DEE). Certificate presence is an origin claim, not a quality signal.</p>
+        </body></html>
+      HTML
+    end
+
+    def html_response(status, body)
+      [status, HTML_HEADERS.dup, [body]]
+    end
+
+    def h(value)
+      CGI.escapeHTML(value.to_s)
+    end
+
     # -----------------------------------------------------------------------
     # Configuration
     # -----------------------------------------------------------------------
@@ -693,8 +1064,13 @@ module SkillsetExchange
 
     def save_state
       FileUtils.mkdir_p(File.dirname(state_path))
+      # Snapshot the hash under the lock, then serialize the snapshot outside
+      # it, so a concurrent writer's guarded mutation cannot land mid-iteration
+      # of JSON serialization (avoids "modified during iteration" and torn
+      # on-disk state under multi-thread deposit/withdraw).
+      snapshot = @state_mutex.synchronize { @deposited_skillsets.dup }
       data = {
-        deposited_skillsets: @deposited_skillsets,
+        deposited_skillsets: snapshot,
         updated_at: Time.now.utc.iso8601
       }
       temp = "#{state_path}.tmp"

data/templates/skillsets/skillset_exchange/skillset.json

@@ -26,7 +26,8 @@
         "skillset_browse": "browse",
         "skillset_content": "browse",
         "skillset_withdraw": "deposit_skill"
-      }
+      },
+      "public_routes": ["/place/web/skillsets"]
     }
   ],
   "plugin": {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kairos-chain
 version: !ruby/object:Gem::Version
-  version: 3.52.1
+  version: 3.53.0
 platform: ruby
 authors:
 - Masaomi Hatakeyama