ciris-server 0.1.2__tar.gz → 0.2.1__tar.gz

ciris_server-0.2.1/.cargo/config.toml

@@ -0,0 +1,14 @@
+# Android cross-link targets (NDK API 24). The 16 KiB max-page-size arg is the
+# Android-15+ compatibility flag the substrate crates use. Mirrors
+# CIRISVerify/.cargo/config.toml so the android wheel lane links cleanly.
+[target.armv7-linux-androideabi]
+linker = "armv7a-linux-androideabi24-clang"
+rustflags = ["-C", "link-arg=-Wl,-z,max-page-size=16384"]
+
+[target.aarch64-linux-android]
+linker = "aarch64-linux-android24-clang"
+rustflags = ["-C", "link-arg=-Wl,-z,max-page-size=16384"]
+
+[target.x86_64-linux-android]
+linker = "x86_64-linux-android24-clang"
+rustflags = ["-C", "link-arg=-Wl,-z,max-page-size=16384"]

ciris_server-0.2.1/.github/workflows/bench.yml

@@ -0,0 +1,67 @@
+name: bench
+
+# Run the criterion benches, turn them into an INTERPRETED page (video
+# throughput / replication speed / post-quantum overhead — what the numbers
+# mean, not just ns), and publish to GitHub Pages. Mirrors the substrate
+# sisters' publish-only bench discipline (not a pass/fail gate — shared runners
+# are too noisy), but with an interpretation layer on top (scripts/bench_report.py).
+#
+# Published at: https://cirisai.github.io/CIRISServer/
+# One-time: Settings → Pages → Source = "GitHub Actions" (the configure-pages
+# step below sets enablement: true to do this automatically on first run).
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "benches/**"
+      - "scripts/bench_report.py"
+      - ".github/workflows/bench.yml"
+      - "Cargo.toml"
+  workflow_dispatch:
+  schedule:
+    - cron: "0 7 * * 1" # Mondays 07:00 UTC
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Never cancel an in-flight Pages deploy; let bench runs serialize.
+concurrency:
+  group: bench-pages
+  cancel-in-progress: false
+
+jobs:
+  bench-and-publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deploy.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install build deps
+        run: sudo apt-get update && sudo apt-get install -y libtss2-dev libsqlite3-dev
+      - uses: Swatinem/rust-cache@v2
+        continue-on-error: true
+        with:
+          cache-bin: false
+          key: bench
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Run benches (criterion)
+        run: cargo bench --bench pqc_av_streaming --bench replication_ingest
+      - name: Generate interpreted page
+        run: |
+          BENCH_DATE="$(date -u +%Y-%m-%d)" \
+            python3 scripts/bench_report.py --out bench-site --commit "$GITHUB_SHA"
+      - uses: actions/configure-pages@v5
+        with:
+          enablement: true
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: bench-site
+      - id: deploy
+        uses: actions/deploy-pages@v4

{ciris_server-0.1.2 → ciris_server-0.2.1}/.github/workflows/ci.yml

@@ -33,13 +33,23 @@ jobs:
           components: clippy
       - name: Install build deps (Linux)
         if: runner.os == 'Linux'
+        # libtss2-dev: the Linux-only keyring/tpm backend (cfg(target_os=linux)).
+        # libsqlite3-dev: persist's sqlite. macOS/Windows pull NEITHER tss-esapi
+        # nor openssl (postgres+tpm are Linux-only per Cargo.toml [target.linux]).
         run: sudo apt-get update && sudo apt-get install -y libtss2-dev libsqlite3-dev
       - uses: Swatinem/rust-cache@v2
         continue-on-error: true
         with:
           cache-bin: false
-      - run: cargo clippy --all-targets --all-features -- -D warnings
-      - run: cargo test --all-features
+      # Default features build everywhere (sqlite + the binary path); postgres +
+      # tpm are Linux-only (per-target). NOT --all-features: that drags
+      # `extension-module` (libpython-no-link) into the test binary.
+      - run: cargo clippy --all-targets -- -D warnings
+      - run: cargo test
+      # The PyO3 wheel surface (Linux only; libpython linked, no extension-module).
+      - name: clippy (python surface, Linux)
+        if: runner.os == 'Linux'
+        run: cargo clippy --all-targets --features python -- -D warnings
 
   # Win7-SP1 → Win11 build check (CIRISVerify#67 pattern, mirrored by every
   # upstream substrate crate). Rust 1.78 raised the windows-msvc std floor to
@@ -65,6 +75,16 @@ jobs:
       - name: Build (x86_64-win7-windows-msvc, build-std)
         shell: bash
         run: |
+          # LNK1181 workaround (persist's recipe): build-std relinks std, which
+          # needs the windows_x86_64_msvc import-lib dirs on LIB. openssl/tss2 are
+          # NOT pulled on this windows target (postgres+tpm are Linux-only), so no
+          # vcpkg/openssl-src build is needed here anymore.
+          cargo fetch
+          extra=""
+          while IFS= read -r d; do
+            extra="${extra};$(cygpath -w "$d")"
+          done < <(find "$HOME/.cargo/registry/src" -type d -path '*windows_x86_64_msvc-*/lib' 2>/dev/null | sort -u)
+          [ -n "$extra" ] && export LIB="${LIB:-}${extra}"
           cargo +nightly build --release \
             --target x86_64-win7-windows-msvc \
             -Z build-std=std,panic_abort \

{ciris_server-0.1.2 → ciris_server-0.2.1}/.github/workflows/publish-pypi.yml

@@ -108,6 +108,85 @@ jobs:
           path: dist/*.whl
           if-no-files-found: warn
 
+  # Android abi3 wheels (incl. arm32 armeabi-v7a) — the CIRISAgent KMP client's
+  # mobile targets. NDK cross-compile + libpython stub, the substrate recipe
+  # (CIRISVerify/Persist/Edge). continue-on-error while the cross lane iterates
+  # to green — it must not block the desktop/server publish.
+  android:
+    name: wheel android-${{ matrix.abi }}
+    runs-on: ubuntu-latest
+    # Green as of 0.2.1 (arm64-v8a + armeabi-v7a both package). A required gate now.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { abi: armeabi-v7a, target: armv7-linux-androideabi, clang: armv7a-linux-androideabi24, legacy: arm-linux-androideabi,  pw: 32 }
+          - { abi: arm64-v8a,   target: aarch64-linux-android,   clang: aarch64-linux-android24,    legacy: aarch64-linux-android, pw: 64 }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: nttld/setup-ndk@v1
+        id: ndk
+        with:
+          ndk-version: r26b
+          add-to-path: true
+      - name: PyO3 cross config + libpython stub
+        env:
+          ANDROID_NDK_HOME: ${{ steps.ndk.outputs.ndk-path }}
+        run: |
+          CFG="${RUNNER_TEMP}/pyo3-android.config"
+          {
+            echo "implementation=CPython"; echo "version=3.10"; echo "shared=false"
+            echo "abi3=true"; echo "lib_name=python3.10"; echo "lib_dir="
+            echo "executable="; echo "pointer_width=${{ matrix.pw }}"; echo "build_flags="
+            echo "suppress_build_script_link_lines=true"
+          } > "$CFG"
+          echo "PYO3_CONFIG_FILE=${CFG}" >> "$GITHUB_ENV"
+          STUB="${RUNNER_TEMP}/python-stub"; mkdir -p "$STUB"
+          TC="${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64"
+          echo 'void __pystub(void){}' | \
+            "${TC}/bin/${{ matrix.clang }}-clang" -shared -nostdlib \
+              -Wl,-soname,libpython3.10.so -o "${STUB}/libpython3.10.so" -x c -
+      - name: Build wheel (maturin, Android NDK)
+        env:
+          ANDROID_NDK_HOME: ${{ steps.ndk.outputs.ndk-path }}
+          ANDROID_API_LEVEL: "24" # maturin can't infer the API level for armv7 (it can for arm64)
+        run: |
+          # cc-rs guesses the wrong NDK clang name (arm-linux-androideabi-clang);
+          # point CC/CXX/AR + the cargo linker at the real r26b tools (what
+          # cargo-ndk would set). Var names use the underscore/SCREAMING target.
+          TC="${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64/bin"
+          CLANG="${TC}/${{ matrix.clang }}-clang"
+          TUS="$(echo '${{ matrix.target }}' | tr - _)"
+          TSC="$(echo "$TUS" | tr a-z A-Z)"
+          export "CC_${TUS}=${CLANG}"
+          export "CXX_${TUS}=${CLANG}++"
+          export "AR_${TUS}=${TC}/llvm-ar"
+          export "RANLIB_${TUS}=${TC}/llvm-ranlib"
+          export "CARGO_TARGET_${TSC}_LINKER=${CLANG}"
+          # openssl-src (pulled by persist on android) hardcodes the LEGACY NDK
+          # tool names that r26b dropped; shim them → the r26b llvm tools.
+          export ANDROID_NDK_ROOT="${ANDROID_NDK_HOME}"
+          ln -sf "${TC}/llvm-ar"     "${TC}/${{ matrix.legacy }}-ar"
+          ln -sf "${TC}/llvm-ranlib" "${TC}/${{ matrix.legacy }}-ranlib"
+          ln -sf "${CLANG}"          "${TC}/${{ matrix.legacy }}-clang"
+          ln -sf "${CLANG}++"        "${TC}/${{ matrix.legacy }}-clang++"
+          export PATH="${TC}:${PATH}"
+          export RUSTFLAGS="-L ${RUNNER_TEMP}/python-stub -C link-arg=-Wl,--no-as-needed -C link-arg=-lpython3.10"
+          python -m pip install --upgrade pip
+          pip install "maturin>=1.7,<2"
+          maturin build --release --out dist --target ${{ matrix.target }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-android-${{ matrix.abi }}
+          path: dist/*.whl
+          if-no-files-found: warn
+
   sdist:
     name: sdist
     runs-on: ubuntu-latest
@@ -145,7 +224,7 @@ jobs:
   # ── Publish to PyPI via Trusted Publishing (OIDC) ──────────────────────────
   publish:
     name: publish to PyPI
-    needs: [linux, macos, windows, sdist, conformance-gate]
+    needs: [linux, macos, windows, android, sdist, conformance-gate]
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/') || inputs.publish
     environment: pypi

{ciris_server-0.1.2 → ciris_server-0.2.1}/CHANGELOG.md

@@ -4,6 +4,55 @@ All notable changes to CIRISServer. Format follows [Keep a Changelog](https://ke
 this project uses [Semantic Versioning](https://semver.org/). The minor line tracks
 the fabric-node scope (0.1 lens · 0.5 +registry · 1.0 +node), paced by the CIRISAgent train.
 
+## [0.2.1] — 2026-06-15
+
+Android wheels (incl. arm32) now publish; legacy-trace importer.
+
+### Added
+- **`ciris-server import-traces <dump-dir>`** — imports the legacy CIRISLens
+  TimescaleDB dump into the persist corpus as CEG objects. Reconstructs flat
+  1.9.x lens rows → `CompleteTrace`/`BatchEnvelope` (reasoning columns →
+  components; original schema + signature in a provenance component); stamped
+  `2.7.legacy`; imported pre-verified; idempotent. A salvage pass repairs the
+  dump's systematic `\\"`→`\"` export mis-escaping and flags those rows
+  `_salvaged: true`. Validated on the prod dump: **all 12,165 traces →
+  20,959 trace-events, errored=0** (3,635 salvaged).
+- **Android wheels** (armeabi-v7a + arm64-v8a) now build & publish (NDK r26b
+  cross-compile: explicit `CC`/`AR`/linker for the toolchain, legacy-NDK
+  tool-name shims for openssl-src, `ANDROID_API_LEVEL`). Promoted from
+  continue-on-error to a required publish lane.
+
+## [0.2.0] — 2026-06-15
+
+All-platforms-green CI, **full hybrid post-quantum federation signatures**, and a
+published interpreted benchmark page.
+
+### Added
+- **Full hybrid PQC federation signature (Ed25519 + ML-DSA-65).** The node mints
+  (or **adopts**, on takeover) an `ml_dsa_65.seed` and signs every federation
+  envelope with both halves (edge `LocalSigner` classical + pqc). `/v1/identity`
+  now carries `ml_dsa_65_pubkey_b64` + `pqc_key_id`. Classical stays
+  hardware-sealed; the ML-DSA half is a software seed (no sealed-ML-DSA backend
+  exists — a TPM can't do ML-DSA).
+  - **One remaining classical path**, filed upstream: persist's storage-tier
+    scrub signature is Ed25519-only — `with_hardware_signer` is classical-only and
+    `with_signer_arcs` (hybrid) needs a plaintext key. **CIRISPersist#224** adds a
+    hybrid-hardware ctor to close it without un-sealing.
+- **Interpreted benchmark page** → `https://cirisai.github.io/CIRISServer/`
+  (`.github/workflows/bench.yml` + `scripts/bench_report.py`): video throughput
+  (fps ceiling, sustainable mesh participants @30 fps), post-quantum handshake
+  overhead, mesh fan-out, and **replication speed** (new `replication_ingest`
+  bench, ~13K traces/s/core).
+- Android arm32 (armeabi-v7a) + arm64 wheel lane (NDK cross-compile;
+  `continue-on-error` while it iterates to green).
+
+### Changed / Fixed
+- **All CI platforms green** (was red on macOS/Windows/Win7). Root cause was our
+  own feature wiring: a top-level `tpm` feature + unconditional `postgres`
+  dragged `tss-esapi`/`openssl` onto platforms that can't build them. Fixed with
+  per-target deps (`postgres` + `tpm` Linux-only; `android` keyring backend) and
+  dropping `--all-features`.
+
 ## [0.1.2] — 2026-06-15
 
 Substrate floor bump + the `/v1/identity` endpoint the migration runbook requires.

{ciris_server-0.1.2 → ciris_server-0.2.1}/Cargo.lock

@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
 [[package]]
 name = "aead"
 version = "0.5.2"
@@ -982,7 +988,7 @@ dependencies = [
 
 [[package]]
 name = "ciris-server"
-version = "0.1.2"
+version = "0.2.1"
 dependencies = [
  "anyhow",
  "axum",
@@ -996,7 +1002,9 @@ dependencies = [
  "ciris-verify-core",
  "criterion",
  "ed25519-dalek",
+ "flate2",
  "fs2",
+ "getrandom 0.3.4",
  "pyo3",
  "pyo3-async-runtimes",
  "serde_json",
@@ -1195,6 +1203,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "criterion"
 version = "0.5.1"
@@ -1206,6 +1223,7 @@ dependencies = [
  "ciborium",
  "clap",
  "criterion-plot",
+ "futures",
  "is-terminal",
  "itertools 0.10.5",
  "num-traits",
@@ -1218,6 +1236,7 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "tinytemplate",
+ "tokio",
  "walkdir",
 ]
 
@@ -1737,6 +1756,16 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
 
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
 [[package]]
 name = "float_eq"
 version = "1.0.1"
@@ -3044,6 +3073,16 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
 [[package]]
 name = "mio"
 version = "1.2.1"
@@ -5028,6 +5067,12 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "simd-adler32"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+
 [[package]]
 name = "siphasher"
 version = "1.0.3"

{ciris_server-0.1.2 → ciris_server-0.2.1}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ciris-server"
-version = "0.1.2"   # 0.1 = lens-only (agent ~2.9.7); 0.5 = +registry (~2.9.8); 1.0 = +node (~2.9.10). Patch forward (0.1.1) on breakage.
+version = "0.2.1"   # 0.1 = lens-only (agent ~2.9.7); 0.5 = +registry (~2.9.8); 1.0 = +node (~2.9.10). Patch forward (0.1.1) on breakage.
 edition = "2021"
 # MSRV floor is set by the substrate: ciris-verify v5.2.0 requires 1.86
 # (persist v6.0.1 is 1.83). Build with the higher of the two.
@@ -41,13 +41,13 @@ python = ["dep:pyo3", "dep:pyo3-async-runtimes", "ciris-lens-core/python"]
 # `extension-module` is what maturin builds the wheel with (tells PyO3 not to
 # link libpython). The bin must NOT enable it. See pyproject.toml [tool.maturin].
 extension-module = ["python", "pyo3/extension-module"]
-# Real TPM-2.0 / Secure-Enclave / StrongBox hardware backing for the node's RNS
-# transport identity. The CIRIS family already pulls `ciris-keyring/tpm`
-# transitively on Linux (so libtss2-dev is a Linux build dep regardless — CI must
-# install it); this is the explicit handle for CIRISServer's own intent and for
-# non-Linux targets. Runtime auto-detects hardware and degrades to encrypted
-# software when absent (`is_hardware_backed()` reports the posture).
-tpm = ["ciris-keyring/tpm"]
+# NOTE: hardware key custody (TPM/SE/StrongBox) is wired per-TARGET below, not as
+# a cargo feature — TPM (tss-esapi) is Linux-only, so a top-level `tpm` feature
+# made `--all-features` drag tss-esapi onto Windows/macOS (where it can't build).
+# The `[target.'cfg(target_os = "linux")']` table enables keyring/tpm + persist
+# postgres on Linux only; runtime auto-detects hardware and degrades to encrypted
+# software when absent (`is_hardware_backed()` reports the posture). This mirrors
+# the substrate crates' per-target keyring/postgres gating.
 
 # ----------------------------------------------------------------------------
 # Dependencies — CIRISServer AUTHORS NO PRIMITIVES. It composes the core
@@ -82,7 +82,10 @@ ciris-lens-core     = { path = "crates/ciris-lens-core" } # ABSORBED in-tree (wo
 
 # The substrate trio (also pulled transitively by the cores; pinned here so the
 # composition root owns the singleton construction).
-ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v7.0.0", features = ["postgres", "sqlite"] }
+# sqlite on all platforms; postgres is Linux-only (libpq/openssl don't link
+# cleanly on the macOS/Windows runners — same posture as persist's own CI). The
+# `[target.linux]` table below adds postgres.
+ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v7.0.0", features = ["sqlite"] }
 ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v3.6.0", features = ["transport-reticulum", "transport-http"] }
 # Founder-quorum verification + key-id fingerprint at the composition root
 # (threshold:: module path — NOT re-exported at the crate root).
@@ -106,9 +109,25 @@ fs2       = "0.4"   # available-disk check for realistic-minimum feature gating
 axum       = "0.8"
 base64     = "0.22"
 serde_json = "1"
+getrandom  = "0.3"   # mint the ML-DSA-65 federation seed on first boot (hybrid PQC)
+flate2     = "1"     # read the gz'd legacy-trace dump (import-traces subcommand)
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 
+# Linux-only hardware + Postgres: cargo UNIONS these onto the base deps above.
+# - persist `postgres` (libpq/openssl) — Linux deployment + the postgres
+#   conformance lane; macOS/Windows stay sqlite-only.
+# - keyring `tpm` (tss-esapi / TPM 2.0) — the real hardware backend; needs
+#   libtss2 (Linux build dep). Other targets keep the software keystore.
+[target.'cfg(target_os = "linux")'.dependencies]
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v7.0.0", features = ["postgres"] }
+ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v5.6.0", version = "5", features = ["tpm"] }
+
+# Android (arm64/arm32/x86_64): the keyring `android` backend (JNI → Android
+# Keystore/StrongBox); sqlite bundles, no postgres/tpm. Mirrors persist/edge.
+[target.'cfg(target_os = "android")'.dependencies]
+ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v5.6.0", version = "5", features = ["android"] }
+
 # Test-only — the two-node replication integration test (tests/replication.rs)
 # builds + signs CEG batches with the same primitives persist verifies against.
 # ed25519-dalek MUST match persist's locked 2.x (the SigningKey type crosses the
@@ -118,7 +137,7 @@ ed25519-dalek = "2"
 base64        = "0.22"
 chrono        = { version = "0.4", features = ["serde"] }
 serde_json    = "1"
-criterion     = "0.5"
+criterion     = { version = "0.5", features = ["async_tokio"] }
 # The PQC primitives the realtime-A/V E2E bench drives directly: hybrid KEX
 # (X25519 + ML-KEM-768) for the per-Link transit key, AES-256-GCM for the
 # two-layer chunk seal. Same pin/features edge composes (tag parity).
@@ -129,6 +148,11 @@ ciris-crypto  = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v5.6.0"
 name = "pqc_av_streaming"
 harness = false
 
+# Replication / corpus-ingest throughput (the CEG-RC5 receive spine).
+[[bench]]
+name = "replication_ingest"
+harness = false
+
 [profile.release]
 # panic strategy stays "unwind" (the Win7 build-std lane relies on this being
 # pinned here, not on the build-std crate list — see release.yml win7 lane).

{ciris_server-0.1.2 → ciris_server-0.2.1}/FSD/LENS_TO_SERVER_MIGRATION.md

@@ -72,8 +72,13 @@ pip install ciris-server        # the abi3 wheel (live on PyPI; self-contained,
 ```
 export CIRIS_HOME=/var/lib/ciris-server          # data + identity root
 mkdir -p "$CIRIS_HOME/identity"
-# Federation signing seed → adopted + TPM-sealed on first boot, byte-identical
+# Federation signing seed (Ed25519) → adopted + TPM-sealed on first boot, byte-identical
 cp /var/lib/cirislens/keyring/ed25519.seed "$CIRIS_HOME/identity/ed25519.seed"
+# PQC signing seed (ML-DSA-65) → adopted as the hybrid half, IF the deployment had one.
+# The federation signature is a FULL HYBRID (Ed25519 + ML-DSA-65); if no ml_dsa_65.seed
+# is carried over, the node MINTS a fresh PQC half on first boot — a NEW PQC pubkey, so
+# coordinate enrollment (the Ed25519 key_id is still continuous).
+cp /var/lib/cirislens/keyring/ml_dsa_65.seed "$CIRIS_HOME/identity/ml_dsa_65.seed"  # if present
 # RNS transport identity → adopted into the keystore byte-identically (dest hash preserved)
 export CIRIS_SERVER_RET_IDENTITY_PATH=/var/lib/cirislens/keyring/lens-edge.identity
 ```
@@ -81,6 +86,8 @@ On first boot the node:
 - **adopts** `ed25519.seed` (`SealedEd25519Signer::adopt`) → the **same** 32-byte
   Ed25519 pubkey ⇒ the **same `key_id`**, now TPM-sealed; the plaintext is archived
   to `ed25519.seed.migrated` (the sealed copy is load-bearing);
+- **adopts** `ml_dsa_65.seed` (if present) → the **same** ML-DSA-65 pubkey (the PQC
+  half of the hybrid signature); software-at-rest (no sealed-ML-DSA backend);
 - **adopts** the `.rid` into `BlobTransportKeystore` → the **same Reticulum
   destination hash**, now TPM-sealed; the original is archived to
   `*.migrated-<ts>`.

{ciris_server-0.1.2 → ciris_server-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ciris-server
-Version: 0.1.2
+Version: 0.2.1
 License-File: LICENSE
 Summary: The fabric node — the federation's headless cohabitation runtime (registry + lens [+ node] over one shared substrate), as the abi3 wheel CIRISAgent consumes. agent = fabric node + brain.
 Author-email: Eric Moore <eric@ciris.ai>