xytara 3.9.4 → 3.9.5

package/RELEASE_NOTES.md

@@ -1,6 +1,7 @@
-`xytara` 3.9.4 keeps the signed bytes of every anchored attestation fetchable, across restarts and deploys.
+`xytara` 3.9.5 lets a provider be named by an ENS name it owns, checked against the name's own records on Ethereum (x402 `payee-name`, wg-identity#36).
 
-- **Attestation archive** — `POST /v1/attestations/archive { attestation }` stores an attestation durably and `GET /v1/attestations/:id` returns it byte-identical. Anyone may submit one, because only naxytra's own records are accepted: the signature must verify against the runtime's published keys (for its own attestations) or the MCP executor's published keys (for the executor's), and the attestation must carry an external anchoring binding (`ctp/1`). A delegation-log checkpoint is restored into the checkpoint store only if its head is a real head of this runtime's log, and a restored older checkpoint never replaces the current one.
-- **MCP executor** — every attestation it issues with an external binding is archived on the runtime as it is issued. `GET /attestations/<id>` serves from memory, and falls back to the archive when the in-memory copy is gone (re-verified against the executor's own keys; the response says `source: "archive"`). `/health` reports archive counters.
-- **Verifiers** — the delegation-log verifier covers the archive (own signed and anchored records only; idempotent; tampered, forged, foreign-issuer and fake-head records refused; executor keys); the executor verifier archives a bound attestation through a real runtime, wipes its in-memory copy, and gets it back byte-identical.
+- **Provider ENS names** — registration accepts an optional `ens_name` (lowercase ASCII `.eth` names). The runtime checks it against Ethereum mainnet at registration and daily: the name's `org.x402.origins` record must list the provider's endpoint origin, its address record for the payout network (or a CAIP-10 entry in `org.x402.payto`) must list the payout address, and the name must be unexpired on chain time (ENSv2 and unmigrated ENSv1 names). Verdicts and reason codes follow the payee-name spec; a failed chain read is always `inconclusive`, never `false`. Records served off-chain (CCIP-Read) are not followed yet and read as inconclusive.
+- **Receipts** — while the verdict is `payee-bound` for the record's current endpoint origin and payout address, signed delivery receipts carry `delivery.provider_name` (name, reason, `checked_at`, `expires_at`) next to `provider_id`.
+- **Registry** — the name is owner-protected and not routing-material (setting or changing it never re-pends an active provider); a stored verdict is dropped when the name, endpoint origin or payout address changes. The public record shows the verdict but never the payout address. `POST /v1/provider-network/providers/<id>/name-check` re-runs the check (owner, at most once a minute, or the operator).
+- **Verifiers** — the verdict logic, the RPC reader against a mock JSON-RPC, the registry rules, and an x402-paid call whose signed receipt names a bound provider.
 - Client package (thin): unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xytara",
-  "version": "3.9.4",
+  "version": "3.9.5",
   "description": "Client for the hosted naxytra runtime: discover a capability, pay per call with x402 (gasless USDC on Base) or credits, get the deliverable and a signed delivery receipt you can verify offline. The runtime is a hosted service; this package is the client.",
   "main": "client.js",
   "exports": {