kairos-chain 3.0.0 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b831eba22baf94d43c7592c5ff2dbf12ca928dcea034b713837bf5253e691f99
-  data.tar.gz: 65c6cd548075ccfccf85d3330548fe51280d39f7c767f6de96c8d64fa5afd799
+  metadata.gz: e54f4f7441bfe3317429a9e4108553e38b0cfa385eddb31073c992b031b7b1d3
+  data.tar.gz: 02f49343b4d7093e1a21e7d1744c1baee811e2e4b0d41de9ace45f3fe7d85b6d
 SHA512:
-  metadata.gz: df294d0d060010e7d589e972ab12164c9cc1451bfd069693d5296bafb9512e95c985d83f4cb849a9d5064f76f0c89b57fbad2245d517f4cc759ce00ebae0f446
-  data.tar.gz: 81a7d541ebf5afc58b938f2b6d2b22c0f38c3c32d69705c2b6cd4074425292a0defa98a4adc74834659bef418a78539b2f7f2a90d48eb26df1f6961c1e41c978
+  metadata.gz: fc5d36893a14b35805e16660194e3e41baa3d7ca81cee43673c7bff099121eb6ac06f1a291636a95c4ae324fc7f8e0cfebf8fd30a0f7bbf4df89ecbe5c63ce58
+  data.tar.gz: d732c15570847c314b2a6c55689007f5bb9fbc1318ff1bd075016da999e8bcf45812834dd9e17a3df42cd53ee8c7fa645cd2b55577785eff1ebfe74b172a74b2

data/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.1.0] - 2026-03-22
+
+### Added
+
+- **Docker Production Deployment**: Complete Docker setup for Meeting Place server on EC2
+  - `docker-compose.prod.yml` with Caddy TLS reverse proxy (`meeting.kairoschain.io`)
+  - Network isolation: `frontend` (Caddy + app) / `backend` (app + PG)
+  - Security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
+  - EC2 setup script (Amazon Linux 2023, Docker Compose via dnf)
+  - Service Grant DB migrations in entrypoint
+  - Volume upgrade: automatic SkillSet backfill from template on existing volumes
+- **Configurable Grant Creation Cooldown** (`grant_creation_cooldown`): Config option in `service_grant.yml` (default: 300s, set to 0 to disable). Future: trust-based cooldown where `cooldown = base * (1.0 - trust_score)`
+
+### Fixed
+
+- **AccessGate owner bypass**: Admin/owner tokens (from `--init-admin`) were blocked by Service Grant with "pubkey_hash missing from auth context". Owner role now bypasses Service Grant checks — admin tokens are system management, not service consumers
+- **GrantManager record_with_retry kwargs**: `record_grant_event` passed bare kwargs to `record_with_retry(event, attempt:)`, leaving the positional `event` parameter empty → `ArgumentError`. Fixed with explicit `{}` braces. Caused 500 errors on Place API endpoints
+- **meeting_connect session_token**: `connect_relay` saved the MMP introduce handshake token (`/meeting/v1/introduce`) instead of the Place register token (`/place/v1/register`). The MMP token lacks `pubkey_hash` in the session store, causing all Place API write operations (deposit, acquire) to fail with 403 "Cannot resolve identity"
+
+### Review
+
+- Docker deployment: 2 rounds × 3 LLMs (Claude Agent Team, Cursor Composer-2, Cursor GPT-5.4), converged at Round 2
+- Service Grant bugfixes: 1 round × 3 LLMs, 3/3 APPROVE
+
+---
+
 ## [3.0.0] - 2026-03-21
 
 ### Added
@@ -476,6 +502,7 @@ This project follows [Semantic Versioning](https://semver.org/).
 - Skill promotion with Persona Assembly
 - Tool guide and metadata system
 
+[3.1.0]: https://github.com/masaomi/KairosChain_2026/compare/v3.0.0...v3.1.0
 [3.0.0]: https://github.com/masaomi/KairosChain_2026/compare/v2.10.1...v3.0.0
 [2.10.1]: https://github.com/masaomi/KairosChain_2026/compare/v2.10.0...v2.10.1
 [2.10.0]: https://github.com/masaomi/KairosChain_2026/compare/v2.9.0...v2.10.0

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.0.0"
+  VERSION = "3.1.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/mmp/tools/meeting_connect.rb

@@ -155,7 +155,8 @@ module KairosMcp
             result = {
               status: 'connected', mode: 'relay', url: url, relay_mode: true,
               identity_verified: verified,
-              session_token: meeting_session_token,
+              session_token: session_token,
+              meeting_session_token: meeting_session_token,
               meeting_place: { url: url, name: place_info['name'] || place_info[:name] || 'Meeting Place' },
               self_agent_id: agent_id,
               your_skills: skill_counts,

data/templates/skillsets/service_grant/lib/service_grant/access_checker.rb

@@ -43,7 +43,7 @@ module ServiceGrant
       if @grant_manager.in_cooldown?(grant) && write_action?(service, action)
         raise AccessDeniedError.new(:cooldown, service: service, action: action,
           message: "New grant in cooldown period. Read-only actions only.",
-          cooldown_remaining: GrantManager::GRANT_CREATION_COOLDOWN -
+          cooldown_remaining: @grant_manager.cooldown -
                               (Time.now - grant[:first_seen_at]).to_i)
       end
 

data/templates/skillsets/service_grant/lib/service_grant/access_gate.rb

@@ -22,6 +22,7 @@ module ServiceGrant
       return unless user_ctx  # STDIO mode -- permissive
 
       return if user_ctx[:local_dev]  # local dev mode -- permissive
+      return if user_ctx[:role] == 'owner'  # admin/owner bypasses service grant checks
 
       pubkey_hash = user_ctx[:pubkey_hash]
 

data/templates/skillsets/service_grant/lib/service_grant/grant_manager.rb

@@ -4,12 +4,15 @@ require 'time'
 
 module ServiceGrant
   class GrantManager
-    GRANT_CREATION_COOLDOWN = 300  # 5 minutes
+    DEFAULT_GRANT_CREATION_COOLDOWN = 300  # 5 minutes
     MAX_GRANTS_PER_IP_PER_HOUR = 5
 
-    def initialize(pg_pool:, plan_registry:)
+    attr_reader :plan_registry, :cooldown
+
+    def initialize(pg_pool:, plan_registry:, cooldown: nil)
       @pg = pg_pool
       @plans = plan_registry
+      @cooldown = cooldown || DEFAULT_GRANT_CREATION_COOLDOWN
       @ip_tracker = IpRateTracker.new(
         max: MAX_GRANTS_PER_IP_PER_HOUR, window: 3600, pg_pool: pg_pool
       )
@@ -133,8 +136,9 @@ module ServiceGrant
     end
 
     def in_cooldown?(grant)
+      return false if @cooldown <= 0
       return false unless grant[:first_seen_at]
-      (Time.now - grant[:first_seen_at]) < GRANT_CREATION_COOLDOWN
+      (Time.now - grant[:first_seen_at]) < @cooldown
     end
 
     def grants_with_unknown_plans(plan_registry)
@@ -177,11 +181,11 @@ module ServiceGrant
     MAX_RECORDING_RETRIES = 3
 
     def record_grant_event(pubkey_hash, service, action, details = {})
-      record_with_retry(
+      record_with_retry({
         type: 'service_grant_event', layer: 'L1',
         pubkey_hash: pubkey_hash, service: service,
         action: action, details: details, timestamp: Time.now.iso8601
-      )
+      })
     end
 
     # Record with retry (non-blocking, up to MAX_RECORDING_RETRIES attempts).

data/templates/skillsets/service_grant/lib/service_grant.rb

@@ -47,7 +47,9 @@ module ServiceGrant
 
       # 3. IP resolution + domain objects
       @ip_resolver = ClientIpResolver.new(config['ip_resolution'] || {})
-      @grant_manager = GrantManager.new(pg_pool: @pg_pool, plan_registry: @plan_registry)
+      cooldown = config['grant_creation_cooldown']&.to_i
+      @grant_manager = GrantManager.new(pg_pool: @pg_pool, plan_registry: @plan_registry,
+                                         cooldown: cooldown)
       @usage_tracker = UsageTracker.new(pg_pool: @pg_pool, plan_registry: @plan_registry,
                                          cycle_manager: @cycle_manager)
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kairos-chain
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.1.0
 platform: ruby
 authors:
 - Masaomi Hatakeyama
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-21 00:00:00.000000000 Z
+date: 2026-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -389,7 +389,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.26
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: KairosChain - Self-referential MCP server for auditable skill self-management