ciris-server 0.4.7__tar.gz → 0.4.8__tar.gz

{ciris_server-0.4.7 → ciris_server-0.4.8}/Cargo.lock

@@ -995,7 +995,7 @@ dependencies = [
 
 [[package]]
 name = "ciris-server"
-version = "0.4.7"
+version = "0.4.8"
 dependencies = [
  "anyhow",
  "async-trait",

{ciris_server-0.4.7 → ciris_server-0.4.8}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ciris-server"
-version = "0.4.7"   # 0.1 = lens-only (agent ~2.9.7); 0.3 = +auth subsystem / one-wheel; 0.4 = +federation peering/identity (capacity scoring, consent:replication, register_federation_key gate, root-bootstrap, NodeCode); 0.4.1 = self-attested first-run root claim (#887); 0.4.2 = one-time claim PIN; 0.4.3 = CC-compliant ownership (infra:* responsible-party owner-binding, no agency, serve-only-until-owned); 0.4.4 = substrate-native user-signed owner-binding — 1-phase /v1/setup/root + the local node's /v1/setup/claim-remote (client is a node; crypto only in the substrate); 0.5 = +registry (~2.9.8); 1.0 = +node (~2.9.10). Patch forward on breakage.
+version = "0.4.8"   # 0.1 = lens-only (agent ~2.9.7); 0.3 = +auth subsystem / one-wheel; 0.4 = +federation peering/identity (capacity scoring, consent:replication, register_federation_key gate, root-bootstrap, NodeCode); 0.4.1 = self-attested first-run root claim (#887); 0.4.2 = one-time claim PIN; 0.4.3 = CC-compliant ownership (infra:* responsible-party owner-binding, no agency, serve-only-until-owned); 0.4.4 = substrate-native user-signed owner-binding — 1-phase /v1/setup/root + the local node's /v1/setup/claim-remote (client is a node; crypto only in the substrate); 0.5 = +registry (~2.9.8); 1.0 = +node (~2.9.10). Patch forward on breakage.
 edition = "2021"
 # MSRV floor is set by the substrate: ciris-verify v5.2.0 requires 1.86
 # (persist v6.0.1 is 1.83). Build with the higher of the two.

{ciris_server-0.4.7 → ciris_server-0.4.8}/FSD/LENS_TO_SERVER_MIGRATION.md

@@ -18,6 +18,29 @@
 4. Verify (`/v1/identity` shows the same `key_id`; read endpoints 200; ingest lands).
 5. Tear down Grafana / TimescaleDB / the Python ingest API / the OAuth admin.
 
+> **v0.4.7 — bridge deploy + agent lens-drop-in (current).** Floor = persist v9.0.0 +
+> verify v6.0.0 + edge v4.6.0 (CEG 1.0-RC29). Two consumers:
+>
+> **Bridge deploy.** `pip install ciris-server==0.4.7` (manylinux abi3 wheel) **or** the
+> `ciris-server-x86_64-unknown-linux-gnu` release binary. **HTTP trace ingest is back**
+> (the §3.4 listen+1 relay): the emitter's legacy POST lands directly —
+> Caddy: `reverse_proxy /lens-api/api/v1/accord/events ciris-server:4243` (no path
+> rewrite). The node is a public Reticulum node at `0.0.0.0:4242` (warm-link target +
+> signed announce + `key_id→dest` discovery). **⚠ HYBRID HARD CUT:** persist v9.0.0
+> rejects classical-only Ed25519 traces (`verify_hybrid_required`) — the deployed
+> `CIRIS-AccordMetrics` emitter MUST run the **hybrid-signing agent build** (the in-tree
+> adapter seals hybrid via `LensClient`), or ingest 401s. Mobile inbound-relay +
+> LXMF propagation are edge work (CIRISEdge#168/#169), not in this release.
+>
+> **Agent lens replacement (drop-in).** `pip install ciris-server==0.4.7`, then swap
+> `from ciris_lens_core import …` → `from ciris_server import …`. The wheel re-exports
+> the **complete** lens surface — `LensClient`, `process_trace_batch`, `scrub_trace`,
+> `scrub_traces_batch`, `ner_is_configured`, `install_relay`, `install_node`,
+> `install_ret_relay`, `LensAudit`, `EgressFilter`, `PeerAcl`, `ScoringConfig`,
+> `UxConfig`, `LensNode`, `RetRelay`, `PROJECTION_VERSION` — over ONE shared substrate
+> (one `.so`, one PyO3 registry: `ciris_server.Engine is ciris_persist.Engine`). Drop the
+> `ciris-lens-core` dependency. This is the 2.9.7 fold.
+
 > **Procedure validated** (2026-06-15, on 0.1.x / persist-7 floor): two fresh
 > homes given the *same* planted `ed25519.seed` + `.rid` both booted to the
 > **identical** RNS destination hash — the federation seed is adopted + sealed

{ciris_server-0.4.7 → ciris_server-0.4.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ciris-server
-Version: 0.4.7
+Version: 0.4.8
 License-File: LICENSE
 Summary: The fabric node — the federation's headless cohabitation runtime (registry + lens [+ node] over one shared substrate), as the abi3 wheel CIRISAgent consumes. agent = fabric node + brain.
 Author-email: Eric Moore <eric@ciris.ai>

{ciris_server-0.4.7 → ciris_server-0.4.8}/crates/ciris-lens-core/src/capture/batch.rs

@@ -118,6 +118,23 @@ fn trace_to_wire_json(trace: &CompleteTrace) -> Value {
     // but build_batch_bytes refuses unsigned traces, so they're Some here.
     obj.insert("signature".into(), json!(trace.signature));
     obj.insert("signature_key_id".into(), json!(trace.signature_key_id));
+    // Hybrid (ML-DSA-65) half + producer PQC pubkey. Required for the
+    // trace-tier hard cut (CIRISPersist#225): persist's `VerifyMode::Full`
+    // runs `verify_trace_hybrid` under `HybridPolicy::Strict` and the
+    // producer's ML-DSA-65 pubkey rides the envelope (the directory is
+    // Ed25519-only). Emitted ONLY when set, matching persist's
+    // `skip_serializing_if = "Option::is_none"` on these fields — so an
+    // Ed25519-only seal stays byte-identical on the wire (and is rejected
+    // by the hard cut, as intended).
+    if let Some(sig) = &trace.signature_ml_dsa_65 {
+        obj.insert("signature_ml_dsa_65".into(), json!(sig));
+    }
+    if let Some(pk) = &trace.pubkey_ml_dsa_65 {
+        obj.insert("pubkey_ml_dsa_65".into(), json!(pk));
+    }
+    if let Some(id) = &trace.pqc_key_id {
+        obj.insert("pqc_key_id".into(), json!(id));
+    }
     Value::Object(obj)
 }
 
@@ -233,6 +250,9 @@ mod tests {
             ],
             signature: None,
             signature_key_id: None,
+            signature_ml_dsa_65: None,
+            pubkey_ml_dsa_65: None,
+            pqc_key_id: None,
             trace_level: Some("generic".into()),
             trace_schema_version: TRACE_SCHEMA_VERSION.into(),
             deployment_profile: Some(json!({
@@ -389,6 +409,9 @@ mod tests {
             ],
             signature: None,
             signature_key_id: None,
+            signature_ml_dsa_65: None,
+            pubkey_ml_dsa_65: None,
+            pqc_key_id: None,
             trace_level: Some("generic".into()),
             trace_schema_version: "3.0.0".into(),
             deployment_profile: Some(serde_json::json!({
@@ -492,4 +515,73 @@ mod tests {
              (the dispatch mismatch mints invalid signatures on non-ASCII — CIRISAgent#871 trap)"
         );
     }
+
+    // ── CIRISPersist#225: 3.0.0 / JCS HYBRID round-trip proof ───────────────
+
+    /// THE 3.0.0 hybrid wire proof (the trace-tier hard cut, CIRISPersist#225):
+    ///
+    /// A `"3.0.0"` trace that lens-core seals with the bound HYBRID signature
+    /// (Ed25519 + ML-DSA-65, via `LocalSigner::sign_hybrid` +
+    /// `seal::apply_hybrid_signature`) and wraps must round-trip through
+    /// persist's `BatchEnvelope::from_json` AND pass persist's
+    /// `verify_trace_hybrid` under `HybridPolicy::Strict` with the JCS
+    /// canonicalizer — the exact admission gate `VerifyMode::Full` runs.
+    ///
+    /// This is the regression guard for the `verify_hybrid_base64` break:
+    /// the seal frames every signature/pubkey field as STANDARD base64 (the
+    /// alphabet persist's hybrid gate decodes), and stamps the ML-DSA-65 half
+    /// + producer pubkey the Strict policy requires.
+    #[tokio::test]
+    async fn batch_300_hybrid_round_trips_through_persist_verify_trace_hybrid() {
+        use std::sync::Arc;
+
+        use base64::{engine::general_purpose::STANDARD as B64, Engine as _};
+        use ciris_persist::prelude::LocalSigner;
+        use ciris_persist::schema::{BatchEnvelope, BatchEvent};
+        use ciris_persist::verify::canonical::{canonicalizer_for, JcsCanonicalizer};
+        use ciris_persist::verify::ed25519::{canon_version_for_trace_schema, verify_trace_hybrid};
+        use ciris_persist::verify::{HybridPolicy, VerifyOutcome};
+        use ed25519_dalek::SigningKey;
+
+        // Hybrid LocalSigner: Ed25519 + ML-DSA-65 (deterministic seeds).
+        let sk = SigningKey::from_bytes(&[225u8; 32]);
+        let vk = sk.verifying_key();
+        let pqc = ciris_keyring::MlDsa65SoftwareSigner::from_seed_bytes(&[226u8; 32], "hyb-pqc")
+            .expect("ml-dsa seed");
+        let signer = LocalSigner::from_parts(
+            sk,
+            "hybrid-host-key".into(),
+            Some(Arc::new(pqc) as Arc<dyn ciris_keyring::PqcSigner>),
+            Some("hyb-pqc".into()),
+        );
+
+        // Seal: canonical bytes (JCS-dispatched for 3.0.0) → bound hybrid sign.
+        let mut trace = sealed_300_trace();
+        let canonical = seal::canonical_bytes(&trace).expect("canonicalize 3.0.0");
+        let hybrid = signer.sign_hybrid(&canonical).await.expect("hybrid sign");
+        seal::apply_hybrid_signature(
+            &mut trace,
+            &hybrid.classical.signature,
+            "hybrid-host-key",
+            &hybrid.pqc.signature,
+            &hybrid.pqc.public_key,
+            "hyb-pqc",
+        );
+
+        // Wrap → persist parse.
+        let bytes = build_batch_bytes(&[trace], &provenance_300()).expect("build hybrid batch");
+        let env = BatchEnvelope::from_json(&bytes)
+            .expect("persist must parse a lens-core-built 3.0.0 hybrid batch");
+        let BatchEvent::CompleteTrace { trace: ptrace, .. } = &env.events[0];
+
+        // The exact admission gate: V2Jcs canonicalizer + Strict hybrid policy.
+        let canon = canonicalizer_for(canon_version_for_trace_schema("3.0.0"));
+        let ed25519_pubkey_b64 = B64.encode(vk.to_bytes());
+        let outcome = verify_trace_hybrid(ptrace, canon, &ed25519_pubkey_b64, HybridPolicy::Strict)
+            .expect("persist verify_trace_hybrid must accept a 3.0.0 hybrid-sealed lens trace");
+        assert_eq!(outcome, VerifyOutcome::HybridVerified);
+
+        // Sanity: the canon we built equals JCS for 3.0.0 (dispatch live).
+        let _ = JcsCanonicalizer; // type-name lock; JCS is the 3.x canonicalizer.
+    }
 }

{ciris_server-0.4.7 → ciris_server-0.4.8}/crates/ciris-lens-core/src/capture/client.rs

@@ -74,7 +74,7 @@ use super::consent::{ConsentConfig, ConsentError, ConsentResolution};
 use super::correlation::CorrelationMetadata;
 use super::partial::CompleteTrace;
 use super::partial::{CaptureOutcome, InboundEvent, PartialTraceStore};
-use super::seal::{apply_signature, canonical_bytes, TraceSealError};
+use super::seal::{self, apply_signature, canonical_bytes, TraceSealError};
 
 use crate::config::UpstreamLens;
 
@@ -133,6 +133,14 @@ pub enum SealSignError {
     #[error("hardware sign: {0}")]
     HardwareSign(String),
 
+    /// `Engine::sign_hybrid` failed — no `LocalSigner` (the Engine was
+    /// built via `from_shared`), no PQC identity configured
+    /// (`PqcNotConfigured` — an Ed25519-only deployment cannot produce
+    /// the ML-DSA-65 half the trace-tier hard cut requires), or the
+    /// underlying signer errored.
+    #[error("hybrid sign: {0}")]
+    HybridSign(String),
+
     /// Wraps [`TraceSealError`] for the (rare) path where a
     /// `LocalSigner` is composed directly (e.g., in tests via
     /// `sign_trace`).
@@ -253,17 +261,59 @@ pub async fn sign_trace_via_hardware_signer(
     Ok(())
 }
 
+// ── hybrid_sign_trace_via_engine ─────────────────────────────────────
+
+/// Hybrid-sign (Ed25519 + ML-DSA-65) a sealed trace via the Engine's
+/// `LocalSigner`, the federation-admissible seal path.
+///
+/// Computes `seal::canonical_bytes` (the federation-wide canonical bytes
+/// authority) and hands them to [`Engine::sign_hybrid`], which produces
+/// the bound-hybrid signature — Ed25519 over `canonical`, ML-DSA-65 over
+/// `canonical ‖ ed25519_sig` — plus both public keys. The five resulting
+/// fields are stamped via [`seal::apply_hybrid_signature`] (all STANDARD
+/// base64). The trace then passes persist's `VerifyMode::Full`
+/// `verify_trace_hybrid` under `HybridPolicy::Strict` (CIRISPersist#225
+/// trace-tier hard cut).
+///
+/// `signature_key_id` uses the Engine signer's current alias (the
+/// Ed25519 key persist resolves from `accord_public_keys`); the
+/// ML-DSA-65 `pqc_key_id` uses the LocalSigner's `pqc_key_id`, falling
+/// back to the classical alias when the PQC key has no distinct id.
+async fn hybrid_sign_trace_via_engine(
+    engine: &Engine,
+    trace: &mut CompleteTrace,
+) -> Result<(), SealSignError> {
+    let bytes = canonical_bytes(trace).map_err(SealSignError::Canonicalize)?;
+    let hybrid = engine
+        .sign_hybrid(&bytes)
+        .await
+        .map_err(|e| SealSignError::HybridSign(e.to_string()))?;
+    // The Ed25519 key_id is the producer's federation alias persist
+    // resolves from `accord_public_keys`. `pqc_key_id` is verbatim
+    // metadata persist stores but the hybrid verify does not consult
+    // (the producer's ML-DSA-65 pubkey rides the envelope and is bound
+    // into the verify); the Engine exposes no separate PQC alias
+    // accessor, so we label it with the same federation alias.
+    let key_id = engine.signer().current_alias().to_owned();
+    seal::apply_hybrid_signature(
+        trace,
+        &hybrid.classical.signature,
+        &key_id,
+        &hybrid.pqc.signature,
+        &hybrid.pqc.public_key,
+        &key_id,
+    );
+    Ok(())
+}
+
 // ── seal_sign_wrap ───────────────────────────────────────────────────
 
-/// Stamp missing fields, sign via `HardwareSigner`, and wrap the
-/// signed trace into `BatchEnvelope` wire bytes ready for
+/// Stamp missing fields, hybrid-sign via the Engine's `LocalSigner`, and
+/// wrap the signed trace into `BatchEnvelope` wire bytes ready for
 /// `Engine::receive_and_persist` (and federation fan-out).
 ///
 /// Separated from the async `capture_event` path so it can be tested
-/// independently (see `tests::seal_sign_wrap_*` below). The test
-/// harness exercises this with a `LocalSigner`-backed
-/// `sign_trace_via_hardware_signer` mock that skips the real
-/// `HardwareSigner` I/O.
+/// independently (see `tests::seal_sign_wrap_*` below).
 ///
 /// Steps:
 ///
@@ -271,7 +321,7 @@ pub async fn sign_trace_via_hardware_signer(
 ///    one (2.7.9 required cohort block).
 /// 2. Stamp `trace_level` if absent (fallback from
 ///    [`BatchProvenance::trace_level`]).
-/// 3. Sign via [`sign_trace_via_hardware_signer`].
+/// 3. Hybrid-sign via [`hybrid_sign_trace_via_engine`].
 /// 4. Wrap into `BatchEnvelope` bytes via [`build_batch_bytes`].
 ///
 /// # Design note — deployment_profile stamp
@@ -283,7 +333,7 @@ pub async fn sign_trace_via_hardware_signer(
 /// whose `THOUGHT_START` event already carried a non-None
 /// `deployment_profile` (future multi-hop scenario) keeps its own.
 async fn seal_sign_wrap(
-    signer: &dyn HardwareSigner,
+    engine: &Engine,
     trace: &mut CompleteTrace,
     provenance: &BatchProvenance,
     deployment_profile: Option<&serde_json::Value>,
@@ -296,8 +346,8 @@ async fn seal_sign_wrap(
     if trace.trace_level.is_none() {
         trace.trace_level = Some(provenance.trace_level.clone());
     }
-    // 3. Sign.
-    sign_trace_via_hardware_signer(signer, trace).await?;
+    // 3. Hybrid-sign (Ed25519 + ML-DSA-65 — the trace-tier hard cut).
+    hybrid_sign_trace_via_engine(engine, trace).await?;
     // 4. Batch → bytes.
     let bytes = build_batch_bytes(std::slice::from_ref(trace), provenance)?;
     Ok(bytes)
@@ -632,9 +682,11 @@ impl CaptureClient {
             } => {
                 let trace_id = trace.trace_id.clone();
 
-                // Sign + wrap (async, lock released).
+                // Sign + wrap (async, lock released). Hybrid-signs via the
+                // Engine's LocalSigner so the trace carries both halves the
+                // CIRISPersist#225 trace-tier hard cut requires.
                 let bytes = seal_sign_wrap(
-                    self.engine.signer().as_ref(),
+                    self.engine.as_ref(),
                     &mut trace,
                     &provenance,
                     deployment_profile.as_ref(),
@@ -788,6 +840,9 @@ mod tests {
             ],
             signature: None,
             signature_key_id: None,
+            signature_ml_dsa_65: None,
+            pubkey_ml_dsa_65: None,
+            pqc_key_id: None,
             trace_level: Some("generic".into()),
             trace_schema_version: TRACE_SCHEMA_VERSION.into(),
             deployment_profile: Some(deployment_profile()),

{ciris_server-0.4.7 → ciris_server-0.4.8}/crates/ciris-lens-core/src/capture/correlation.rs

@@ -794,6 +794,9 @@ mod tests {
             }],
             signature: None,
             signature_key_id: None,
+            signature_ml_dsa_65: None,
+            pubkey_ml_dsa_65: None,
+            pqc_key_id: None,
             trace_level: Some("generic".into()),
             trace_schema_version: TRACE_SCHEMA_VERSION.into(),
             deployment_profile: Some(json!({

{ciris_server-0.4.7 → ciris_server-0.4.8}/crates/ciris-lens-core/src/capture/partial.rs

@@ -123,6 +123,20 @@ pub struct CompleteTrace {
     pub components: Vec<TraceComponent>,
     pub signature: Option<String>,
     pub signature_key_id: Option<String>,
+    /// ML-DSA-65 (FIPS 204) signature half of the hybrid trace seal,
+    /// STANDARD base64. Signed over the bound input `canonical ‖
+    /// ed25519_sig` (the bound-hybrid construction persist's
+    /// `verify_trace_hybrid` reconstructs). `None` until the hybrid seal
+    /// stamps it; the trace-tier hard cut (CIRISPersist#225) rejects a
+    /// classical-only trace at `VerifyMode::Full` admission.
+    pub signature_ml_dsa_65: Option<String>,
+    /// Producer's ML-DSA-65 public key, STANDARD base64 (1952 raw bytes).
+    /// Rides the trace envelope because the `accord_public_keys`
+    /// directory is Ed25519-only; bound into the hybrid verify. `None`
+    /// together with [`signature_ml_dsa_65`](Self::signature_ml_dsa_65).
+    pub pubkey_ml_dsa_65: Option<String>,
+    /// Identifier of the ML-DSA-65 signing key (stored verbatim).
+    pub pqc_key_id: Option<String>,
     pub trace_level: Option<String>,
     pub trace_schema_version: String,
     /// 6-field cohort-taxonomy block (2.7.9+). Required on the wire at
@@ -241,6 +255,9 @@ impl PartialTraceStore {
                 components: Vec::new(),
                 signature: None,
                 signature_key_id: None,
+                signature_ml_dsa_65: None,
+                pubkey_ml_dsa_65: None,
+                pqc_key_id: None,
                 trace_level: ev.trace_level.clone(),
                 trace_schema_version: TRACE_SCHEMA_VERSION.to_string(),
                 deployment_profile: None,

{ciris_server-0.4.7 → ciris_server-0.4.8}/crates/ciris-lens-core/src/capture/seal.rs

@@ -3,16 +3,22 @@
 //!
 //! # The signature-critical contract
 //!
-//! When `ACTION_RESULT` seals a trace, lens-core canonicalizes it,
-//! **Ed25519**-signs the canonical bytes (via the host `Engine`'s
-//! signing identity), and persists it. (Trace signing is Ed25519-only —
-//! the hybrid Ed25519+ML-DSA-65 pair is the detection-event /
-//! attestation surface, not traces.) The **canonical bytes must be
-//! byte-identical** to what every federation verifier recomputes, or
-//! the signature fails to verify. This module owns the canonical-
-//! envelope *structure*; the byte serialization is delegated to
-//! persist's **version-aware dispatch** — `canon_version_for_trace_schema`
-//! + `canonicalizer_for` (CIRISPersist#171 / v4.6.0 / v4.15.0 #871).
+//! When `ACTION_RESULT` seals a trace, lens-core canonicalizes it and
+//! **hybrid**-signs the canonical bytes (Ed25519 + ML-DSA-65, via the
+//! host `Engine::sign_hybrid`). persist's trace-tier hard cut
+//! (CIRISPersist#225: `VerifyMode::Full` → `verify_trace_hybrid` under
+//! `HybridPolicy::Strict`) REJECTS a classical-only trace at admission —
+//! the durable, replicated, kept-for-posterity corpus outlives Ed25519,
+//! so an HNDL forge-later adversary must not be able to mint backdated
+//! traces. (The Ed25519-only [`apply_signature`] / [`sign_trace`] /
+//! [`verify_trace_signature`] primitives remain for the classical verify
+//! path + back-compat tests, but a federation-admissible seal is hybrid.)
+//! The **canonical bytes must be byte-identical** to what every
+//! federation verifier recomputes, or the signature fails to verify. This
+//! module owns the canonical-envelope *structure*; the byte serialization
+//! is delegated to persist's **version-aware dispatch** —
+//! `canon_version_for_trace_schema` + `canonicalizer_for`
+//! (CIRISPersist#171 / v4.6.0 / v4.15.0 #871).
 //!
 //! # JCS / 3.0.0 era (CIRISLensCore#43.2)
 //!
@@ -58,12 +64,13 @@
 //! # This module
 //!
 //! The pure, signature-critical core: [`build_canonical_envelope`] /
-//! [`canonical_bytes`] (the signed bytes) + [`apply_signature`] /
-//! [`verify_trace_signature`] (Ed25519 stamp + the federation-verifier
-//! algorithm). No Engine, no I/O — fully unit-tested incl. a sign→verify
-//! round-trip. The thin async glue (`engine.local_sign(canonical_bytes)`
-//! → `apply_signature` → `receive_and_persist`) lands with the Engine
-//! integration (Cut 4).
+//! [`canonical_bytes`] (the signed bytes) + the stamps
+//! [`apply_signature`] (Ed25519-only) / [`apply_hybrid_signature`]
+//! (Ed25519 + ML-DSA-65) + [`verify_trace_signature`] (the Ed25519
+//! federation-verifier algorithm). No Engine, no I/O — fully unit-tested
+//! incl. sign→verify round-trips. The async glue that hybrid-signs via
+//! `Engine::sign_hybrid` and calls `receive_and_persist` lives in
+//! `capture::client` (`hybrid_sign_trace_via_engine` / `seal_sign_wrap`).
 
 use serde_json::{json, Map, Value};
 
@@ -200,31 +207,76 @@ pub fn canonical_bytes(trace: &CompleteTrace) -> Result<Vec<u8>, String> {
 
 // ── Signature application + verification ────────────────────────────
 //
-// Trace signing is **Ed25519-only** over the canonical bytes (NOT a
-// hybrid Ed25519+ML-DSA pair — that is the detection-event / attestation
-// surface). The signature is stored URL-safe-base64-no-pad, the
-// `signature_key_id` names the signing key. This mirrors CIRISAgent's
-// `Ed25519TraceSigner.sign_trace` (`unified_key.sign_base64(message)`) +
-// `verify_trace` (`Ed25519.verify(sig, message)`) exactly, so a trace
-// lens-core seals verifies under the agent's verify path and vice-versa.
-
-/// Encode an Ed25519 signature for the `CompleteTrace.signature` field:
-/// URL-safe base64, no padding — the form CIRISAgent's `verify_trace`
-/// decodes (it re-appends `==` before `urlsafe_b64decode`).
+// Trace signing is a **bound hybrid** (Ed25519 + ML-DSA-65) over the
+// canonical bytes. persist's trace-tier hard cut (CIRISPersist#225,
+// `VerifyMode::Full` → `verify_trace_hybrid` under `HybridPolicy::Strict`)
+// REJECTS a classical-only trace at admission — the durable, replicated,
+// kept-for-posterity corpus outlives Ed25519, so an HNDL forge-later
+// adversary must not be able to mint backdated traces. Both signature
+// halves + the producer's ML-DSA-65 pubkey ride the trace envelope.
+//
+// **Base64 framing (the CIRISPersist#225 trap this module fixes):**
+// every signature/pubkey field is **STANDARD** base64. persist's hybrid
+// gate (`verify::hybrid::verify_hybrid` → `decode_b64_fixed`) decodes
+// STANDARD ONLY; URL-safe-no-pad base64-rejects there with
+// `verify_hybrid_base64` BEFORE any crypto runs. The Ed25519-only path
+// (`verify_trace` → `decode_signature`) accepts any alphabet, so STANDARD
+// satisfies BOTH — URL-safe-no-pad satisfies only the Ed25519-only path.
+//
+// The bound-hybrid construction: Ed25519 signs `canonical`; ML-DSA-65
+// signs `canonical ‖ ed25519_sig` (prevents classical-half stripping).
+// This mirrors persist's own `LocalSigner::sign_hybrid` /
+// `verify_trace_hybrid` byte-for-byte (lens-core never rolls crypto).
+
+/// Encode a signature/pubkey for a `CompleteTrace` field: **STANDARD**
+/// base64 (with padding) — the alphabet persist's hybrid trace-tier gate
+/// (`verify::hybrid::verify_hybrid`, STANDARD-only) decodes. persist's
+/// Ed25519-only `verify_trace` accepts any alphabet, so STANDARD
+/// satisfies BOTH verify paths; URL-safe-no-pad does NOT (it
+/// base64-rejects at the hybrid gate → `verify_hybrid_base64`). Matches
+/// persist's producer-side `hybrid_sign_trace` reference exactly.
 pub fn encode_signature(sig_bytes: &[u8]) -> String {
     use base64::Engine as _;
-    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(sig_bytes)
+    base64::engine::general_purpose::STANDARD.encode(sig_bytes)
 }
 
-/// Stamp a computed signature onto a sealed trace. Pure — the caller
-/// (the Engine-coupled `sign_trace`, Cut 3b glue) obtains `sig_bytes`
-/// from `engine.local_sign(canonical_bytes(trace))` and the host's
-/// signing `key_id`.
+/// Stamp a computed **Ed25519** signature onto a sealed trace (classical
+/// half only). Pure. For a federation-admissible trace use
+/// [`apply_hybrid_signature`] — the classical-only stamp is rejected by
+/// persist's `VerifyMode::Full` hybrid hard cut (CIRISPersist#225).
+/// Retained for the Ed25519-only verify path + back-compat unit tests.
 pub fn apply_signature(trace: &mut CompleteTrace, sig_bytes: &[u8], key_id: &str) {
     trace.signature = Some(encode_signature(sig_bytes));
     trace.signature_key_id = Some(key_id.to_string());
 }
 
+/// Stamp a computed **hybrid** (Ed25519 + ML-DSA-65) signature onto a
+/// sealed trace — the federation-admissible seal. Stamps all five fields
+/// persist's `verify_trace_hybrid` reads: the Ed25519 `signature` (+
+/// `signature_key_id`), the `signature_ml_dsa_65` half, the producer's
+/// `pubkey_ml_dsa_65` (rides the envelope; the directory is Ed25519-only),
+/// and `pqc_key_id`. All raw byte inputs are STANDARD-base64 framed.
+///
+/// `ed25519_sig` is over `canonical`; `ml_dsa_65_sig` is over the bound
+/// input `canonical ‖ ed25519_sig`. The caller (the Engine-coupled
+/// hybrid signer glue) obtains both halves + the PQC pubkey from
+/// `Engine::sign_hybrid`, which builds exactly this bound shape.
+#[allow(clippy::too_many_arguments)]
+pub fn apply_hybrid_signature(
+    trace: &mut CompleteTrace,
+    ed25519_sig: &[u8],
+    key_id: &str,
+    ml_dsa_65_sig: &[u8],
+    pubkey_ml_dsa_65: &[u8],
+    pqc_key_id: &str,
+) {
+    trace.signature = Some(encode_signature(ed25519_sig));
+    trace.signature_key_id = Some(key_id.to_string());
+    trace.signature_ml_dsa_65 = Some(encode_signature(ml_dsa_65_sig));
+    trace.pubkey_ml_dsa_65 = Some(encode_signature(pubkey_ml_dsa_65));
+    trace.pqc_key_id = Some(pqc_key_id.to_string());
+}
+
 /// Verify a sealed trace's Ed25519 signature against `verifying_key`,
 /// recomputing the canonical bytes (sign/verify can never drift — both
 /// go through [`canonical_bytes`]). Returns `false` on any failure
@@ -242,7 +294,15 @@ pub fn verify_trace_signature(
     let Some(sig_b64) = &trace.signature else {
         return false;
     };
-    let Ok(sig_raw) = base64::engine::general_purpose::URL_SAFE_NO_PAD.decode(sig_b64) else {
+    // Decode any alphabet persist accepts (`verify::ed25519::decode_signature`):
+    // STANDARD (our seal stamp, hybrid-gate-compatible) then URL-safe
+    // (legacy / agent `urlsafe_b64encode`). Fail-closed if none decode.
+    use base64::engine::general_purpose::{STANDARD, URL_SAFE, URL_SAFE_NO_PAD};
+    let Ok(sig_raw) = STANDARD
+        .decode(sig_b64)
+        .or_else(|_| URL_SAFE_NO_PAD.decode(sig_b64))
+        .or_else(|_| URL_SAFE.decode(sig_b64))
+    else {
         return false;
     };
     let Ok(sig_arr) = <[u8; 64]>::try_from(sig_raw.as_slice()) else {
@@ -337,6 +397,9 @@ mod tests {
             ],
             signature: None,
             signature_key_id: None,
+            signature_ml_dsa_65: None,
+            pubkey_ml_dsa_65: None,
+            pqc_key_id: None,
             trace_level: Some("FULL_TRACES".into()),
             trace_schema_version: TRACE_SCHEMA_VERSION.into(),
             deployment_profile: None,
@@ -461,6 +524,9 @@ mod tests {
             }],
             signature: None,
             signature_key_id: None,
+            signature_ml_dsa_65: None,
+            pubkey_ml_dsa_65: None,
+            pqc_key_id: None,
             trace_level: Some("GENERIC".into()),
             trace_schema_version: "2.7.9".into(), // V1Python path — explicit
             deployment_profile: None,
@@ -482,14 +548,24 @@ mod tests {
     }
 
     #[test]
-    fn encode_signature_is_urlsafe_no_pad() {
-        // 64-byte Ed25519 sig → 86-char URL-safe base64, no '=' padding,
-        // no '+'/'/' (the form the agent's verify_trace decodes).
+    fn encode_signature_is_standard_base64() {
+        // 64-byte Ed25519 sig → 88-char STANDARD base64 (padded). STANDARD
+        // is the alphabet persist's hybrid trace-tier gate decodes
+        // (STANDARD-only); URL-safe-no-pad base64-rejects there. Decodes
+        // back to the original 64 bytes round-trip.
+        use base64::Engine as _;
         let sig = [0xFBu8; 64];
         let enc = encode_signature(&sig);
-        assert_eq!(enc.len(), 86);
-        assert!(!enc.contains('='));
-        assert!(!enc.contains('+') && !enc.contains('/'));
+        assert_eq!(
+            enc.len(),
+            88,
+            "STANDARD base64 of 64 bytes is 88 chars (padded)"
+        );
+        assert!(enc.ends_with("=="), "64 bytes → two '=' pad chars");
+        let back = base64::engine::general_purpose::STANDARD
+            .decode(&enc)
+            .expect("STANDARD decodes our stamp");
+        assert_eq!(back, sig);
     }
 
     #[test]
@@ -674,6 +750,9 @@ mod tests {
             components,
             signature: None,
             signature_key_id: None,
+            signature_ml_dsa_65: None,
+            pubkey_ml_dsa_65: None,
+            pqc_key_id: None,
             trace_level: spec.trace_level,
             trace_schema_version: spec.trace_schema_version,
             deployment_profile: spec.deployment_profile,
@@ -739,6 +818,9 @@ mod tests {
             }],
             signature: None,
             signature_key_id: None,
+            signature_ml_dsa_65: None,
+            pubkey_ml_dsa_65: None,
+            pqc_key_id: None,
             trace_level: Some("GENERIC".into()),
             trace_schema_version: "2.7.9".into(),
             deployment_profile: None,

{ciris_server-0.4.7 → ciris_server-0.4.8}/crates/ciris-lens-core/src/config/egress.rs

@@ -829,6 +829,9 @@ mod tests {
             ],
             signature: None,
             signature_key_id: None,
+            signature_ml_dsa_65: None,
+            pubkey_ml_dsa_65: None,
+            pqc_key_id: None,
             trace_level: Some("full_traces".into()),
             trace_schema_version: TRACE_SCHEMA_VERSION.into(),
             deployment_profile: Some(serde_json::json!({
@@ -934,6 +937,9 @@ mod tests {
             }],
             signature: None,
             signature_key_id: None,
+            signature_ml_dsa_65: None,
+            pubkey_ml_dsa_65: None,
+            pqc_key_id: None,
             trace_level: Some("generic".into()),
             trace_schema_version: TRACE_SCHEMA_VERSION.into(),
             deployment_profile: Some(serde_json::json!({

{ciris_server-0.4.7 → ciris_server-0.4.8}/crates/ciris-lens-core/src/ffi/pyo3.rs

@@ -603,9 +603,14 @@ impl PyLensClient {
     ///   (**cohabitation path**, CIRISLensCore#43.1 P0 fix). When provided,
     ///   sign+persist are driven via its Python methods — cross-wheel-safe.
     ///   Pass `None` (default) for the single-wheel / sovereign path.
-    /// - `trace_schema_version` — wire schema version string (default `"2.7.9"`).
+    /// - `trace_schema_version` — wire schema version string (default `"3.0.0"`).
+    ///   `"3.0.0"`+ (major ≥ 3) signs over **RFC 8785 JCS** (`V2Jcs`) — the
+    ///   post-#871 CEG-native canonical form the whole fabric is on; legacy
+    ///   `"2.x"` is Python-compat (`V1Python`). persist's ingest dispatches the
+    ///   verifier by this version (`canon_version_for_trace_schema`), so the
+    ///   batch is a JCS CEG object end-to-end.
     /// - `deployment_profile` — operator 6-field cohort dict; required on the
-    ///   wire at schema 2.7.9. Pass `None` only for non-production / dev.
+    ///   wire at schema 3.0.0. Pass `None` only for non-production / dev.
     /// - `consent_attesting_key_id` — key ID for CEG-based consent resolution.
     ///   `None` → config-only path (2.9.6 interim). Has no effect when
     ///   `engine=` is provided (follow-up: CIRISEdge#85).
@@ -628,7 +633,7 @@ impl PyLensClient {
         consent_timestamp,
         trace_level,
         engine = None,
-        trace_schema_version = "2.7.9".to_string(),
+        trace_schema_version = "3.0.0".to_string(),
         deployment_profile = None,
         consent_attesting_key_id = None,
         local_copy_dir = None,