ciris-server 0.5.231__tar.gz → 0.5.232__tar.gz

{ciris_server-0.5.231 → ciris_server-0.5.232}/.github/workflows/ci.yml

@@ -306,6 +306,21 @@ jobs:
         # 48 -> 49 (CIRISServer#632): the NODE key's own trust-root acceptance on a split install
         # (mesh_genesis::accept_trust_root_as_node_key) — edge's serve gate (leg B) reads the wire key.
         run: python3 tools/audit_cohort_scope_callers.py --max-federation 49
+      # ── The CSD/4 catalogue model (FSD/CSD4.md §7) ──────────────────────────
+      #
+      # The topology catalogue is LOCKED: twenty entries, a closed vocabulary of
+      # states, and the requirements each CSD tests at. `evaluate` fails on a
+      # broken promise, an unknown atom, an unrealizable entry or a requirement
+      # no entry reaches; the unit tests hold the planner (earliest checkpoint,
+      # cheapest cover) and that every relation is built or refused by name.
+      # No binary: the model computes each entry's states from its steps.
+      - name: CSD/4 catalogue model (evaluate + unit tests)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          python3 -m pip install --quiet pyyaml pytest
+          python3 -m harness.native evaluate
+          python3 -m pytest -q harness/native/test_model.py
       # The NOISE FLOOR proof (CIRISServer#14, CEG §19.7 / §19.3 N5) — provable
       # individual-unrecoverability for erasure compliance, run explicitly so the
       # MEASURED residual-fidelity numbers land in the CI log (Linux only — one

{ciris_server-0.5.231 → ciris_server-0.5.232}/.github/workflows/mesh-harness.yml

@@ -199,6 +199,10 @@ jobs:
       - name: Build the test-anchor wheel once
         run: |
           cargo build --release --features test-anchor,python
+          # The three-holder test anchor the bundle-v4 ceremony signs under
+          # (harness_genesis_v4, CIRISServer#801). Same features, so only the
+          # example links on top of the build above.
+          cargo build --release --features test-anchor,python --example test_ceremony_anchor
           python3 harness/mesh-repro/pack_wheel.py
           ls -la harness/mesh-repro/wheels/
 
@@ -223,7 +227,7 @@ jobs:
             # THREE ciris-server nodes, no python agent role — the cross-node chat
             # topology is standalone, not an overlay (CIRISServer#455).
             chat)
-              echo 'files=-f docker-compose.chat.yml' >> "$GITHUB_OUTPUT"
+              echo 'files=-f docker-compose.chat.yml -f docker-compose.chat.genesis-v4.yml' >> "$GITHUB_OUTPUT"
               echo 'services=canonical node-a node-b'  >> "$GITHUB_OUTPUT"
               echo 'profiles='                         >> "$GITHUB_OUTPUT" ;;
             # ONE person, TWO devices: the chat topology's node-a plus node-c,
@@ -231,7 +235,7 @@ jobs:
             # reach the logs and teardown steps too — a compose command without
             # it does not see node-c, and the teardown would leave it running.
             selffiles)
-              echo 'files=-f docker-compose.chat.yml' >> "$GITHUB_OUTPUT"
+              echo 'files=-f docker-compose.chat.yml -f docker-compose.chat.genesis-v4.yml' >> "$GITHUB_OUTPUT"
               echo 'services=canonical node-a node-c'  >> "$GITHUB_OUTPUT"
               echo 'profiles=scale'                    >> "$GITHUB_OUTPUT" ;;
             # Dispatch-only: the chat ladder plus a second device and a household.
@@ -243,8 +247,12 @@ jobs:
               echo 'files=-f docker-compose.yml -f docker-compose.traceflow.yml -f docker-compose.genesis.yml' >> "$GITHUB_OUTPUT"
               echo 'services=canonical agent' >> "$GITHUB_OUTPUT"
               echo 'profiles=' >> "$GITHUB_OUTPUT" ;;
+            traceflow_prod)
+              echo 'files=-f docker-compose.yml -f docker-compose.traceflow.yml -f docker-compose.genesis-v4.yml -f docker-compose.prod.yml' >> "$GITHUB_OUTPUT"
+              echo 'services=canonical agent' >> "$GITHUB_OUTPUT"
+              echo 'profiles=' >> "$GITHUB_OUTPUT" ;;
             *)
-              echo 'files=-f docker-compose.yml -f docker-compose.traceflow.yml' >> "$GITHUB_OUTPUT"
+              echo 'files=-f docker-compose.yml -f docker-compose.traceflow.yml -f docker-compose.genesis-v4.yml' >> "$GITHUB_OUTPUT"
               echo 'services=canonical agent' >> "$GITHUB_OUTPUT"
               echo 'profiles=' >> "$GITHUB_OUTPUT" ;;
           esac

{ciris_server-0.5.231 → ciris_server-0.5.232}/.github/workflows/release.yml

@@ -491,9 +491,20 @@ jobs:
           # literal under bash and would fail the step on a release that
           # legitimately has no wheels (the iOS lane red, everything else fine)
           # — turning a partial release into no release at all.
+          # THE CSD/4 CATALOGUE as release assets (FSD/CSD4.md): the
+          # requirements, the Constitution's vocabulary and its pin byte for
+          # byte, and the model's trace of T0–T19. CIRISClient's CSD/4 checker
+          # pins these per release, so it needs no server code and its copy
+          # cannot change under it. `trace` refuses a catalogue that does not
+          # evaluate clean, which fails the release rather than publishing it.
+          python3 -m pip install --quiet pyyaml
+          cp harness/native/topologies/catalog/requirements.yaml release/csd4-requirements.yaml
+          cp harness/native/topologies/catalog/topology_vocabulary.json release/csd4-topology_vocabulary.json
+          cp harness/native/topologies/catalog/topology_vocabulary.pin release/csd4-topology_vocabulary.pin
+          python3 -m harness.native trace > release/csd4-traces.json
           cd release
           # shellcheck disable=SC2012
-          sha256sum $(ls *.tar.gz *.whl 2>/dev/null) > SHA256SUMS
+          sha256sum $(ls *.tar.gz *.whl csd4-* 2>/dev/null) > SHA256SUMS
       - name: Install cosign
         uses: sigstore/cosign-installer@v3
       - name: Sign artifacts (Sigstore keyless)
@@ -501,7 +512,7 @@ jobs:
           cd release
           # Same guard as the hashing step: `*.whl` must not become a literal
           # argument when the iOS wheel lane produced nothing.
-          for f in $(ls *.tar.gz *.whl 2>/dev/null) SHA256SUMS; do
+          for f in $(ls *.tar.gz *.whl csd4-* 2>/dev/null) SHA256SUMS; do
             cosign sign-blob --yes --output-signature "$f.sig" --output-certificate "$f.pem" "$f"
           done
       - name: Create GitHub Release
@@ -514,6 +525,7 @@ jobs:
             release/*.whl
             release/*.whl.sig
             release/*.whl.pem
+            release/csd4-*
             release/SHA256SUMS
             release/SHA256SUMS.sig
             release/SHA256SUMS.pem

{ciris_server-0.5.231 → ciris_server-0.5.232}/Cargo.lock

@@ -581,7 +581,7 @@ dependencies = [
  "bitflags 2.13.1",
  "cexpr",
  "clang-sys",
- "itertools 0.10.5",
+ "itertools 0.12.1",
  "log",
  "prettyplease",
  "proc-macro2",
@@ -1031,8 +1031,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-crypto"
-version = "20.1.0"
-source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v20.1.0#f4ea1a2d12179f7d9eafe40f89a6c81b7306476a"
+version = "20.2.0"
+source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v20.2.0#3c16f9c65f23d71f40ab52fd7f330e4e13a5fd15"
 dependencies = [
  "chacha20poly1305 0.10.1",
  "ed25519-dalek",
@@ -1058,8 +1058,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-edge"
-version = "41.1.1"
-source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v41.1.1#a51f78e4e6c919153dab01905fdbb74924f616f2"
+version = "43.1.1"
+source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v43.1.1#d44e1c57935637ab60a60e38917390fa18e83449"
 dependencies = [
  "async-trait",
  "axum",
@@ -1116,8 +1116,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-keyring"
-version = "20.1.0"
-source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v20.1.0#f4ea1a2d12179f7d9eafe40f89a6c81b7306476a"
+version = "20.2.0"
+source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v20.2.0#3c16f9c65f23d71f40ab52fd7f330e4e13a5fd15"
 dependencies = [
  "aes-gcm 0.10.3",
  "async-trait",
@@ -1183,8 +1183,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-persist"
-version = "55.0.0"
-source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v55.0.0#ca6bdf6004577b4738cf3fd82d196c040f4cf7c3"
+version = "59.1.0"
+source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v59.1.0#32512f52766ce2261869a0df1ac6fade75c08662"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1231,7 +1231,7 @@ dependencies = [
 
 [[package]]
 name = "ciris-server"
-version = "0.5.231"
+version = "0.5.232"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1280,8 +1280,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-verify-core"
-version = "20.1.0"
-source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v20.1.0#f4ea1a2d12179f7d9eafe40f89a6c81b7306476a"
+version = "20.2.0"
+source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v20.2.0#3c16f9c65f23d71f40ab52fd7f330e4e13a5fd15"
 dependencies = [
  "android_system_properties",
  "async-trait",
@@ -1324,8 +1324,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-verify-ffi"
-version = "20.1.0"
-source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v20.1.0#f4ea1a2d12179f7d9eafe40f89a6c81b7306476a"
+version = "20.2.0"
+source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v20.2.0#3c16f9c65f23d71f40ab52fd7f330e4e13a5fd15"
 dependencies = [
  "aes-gcm 0.10.3",
  "android_logger",
@@ -3455,7 +3455,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots 1.0.9",
+ "webpki-roots 1.0.10",
 ]
 
 [[package]]
@@ -3991,7 +3991,7 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 [[package]]
 name = "leviculum-announce-policy"
 version = "0.1.0"
-source = "git+https://github.com/CIRISAI/leviculum?tag=v0.30.0%2Bciris.1#fa6cff3f42531b946dd5da03c6ae28e5d2e9dfcc"
+source = "git+https://github.com/CIRISAI/leviculum?tag=v0.31.0%2Bciris.1#4cf116afdb3dc754293c461c9eceef4315387f9c"
 dependencies = [
  "leviculum-telemetry-policy",
 ]
@@ -3999,7 +3999,7 @@ dependencies = [
 [[package]]
 name = "leviculum-ble-tx"
 version = "0.1.0"
-source = "git+https://github.com/CIRISAI/leviculum?tag=v0.30.0%2Bciris.1#fa6cff3f42531b946dd5da03c6ae28e5d2e9dfcc"
+source = "git+https://github.com/CIRISAI/leviculum?tag=v0.31.0%2Bciris.1#4cf116afdb3dc754293c461c9eceef4315387f9c"
 dependencies = [
  "embassy-sync",
  "leviculum-core",
@@ -4008,15 +4008,15 @@ dependencies = [
 [[package]]
 name = "leviculum-channel-access"
 version = "0.1.0"
-source = "git+https://github.com/CIRISAI/leviculum?tag=v0.30.0%2Bciris.1#fa6cff3f42531b946dd5da03c6ae28e5d2e9dfcc"
+source = "git+https://github.com/CIRISAI/leviculum?tag=v0.31.0%2Bciris.1#4cf116afdb3dc754293c461c9eceef4315387f9c"
 dependencies = [
  "leviculum-core",
 ]
 
 [[package]]
 name = "leviculum-core"
-version = "0.30.0+ciris.1"
-source = "git+https://github.com/CIRISAI/leviculum?tag=v0.30.0%2Bciris.1#fa6cff3f42531b946dd5da03c6ae28e5d2e9dfcc"
+version = "0.31.0+ciris.1"
+source = "git+https://github.com/CIRISAI/leviculum?tag=v0.31.0%2Bciris.1#4cf116afdb3dc754293c461c9eceef4315387f9c"
 dependencies = [
  "aes 0.8.4",
  "cbc",
@@ -4033,8 +4033,8 @@ dependencies = [
 
 [[package]]
 name = "leviculum-lxmf"
-version = "0.30.0+ciris.1"
-source = "git+https://github.com/CIRISAI/leviculum?tag=v0.30.0%2Bciris.1#fa6cff3f42531b946dd5da03c6ae28e5d2e9dfcc"
+version = "0.31.0+ciris.1"
+source = "git+https://github.com/CIRISAI/leviculum?tag=v0.31.0%2Bciris.1#4cf116afdb3dc754293c461c9eceef4315387f9c"
 dependencies = [
  "leviculum-core",
  "rand_core 0.6.4",
@@ -4044,8 +4044,8 @@ dependencies = [
 
 [[package]]
 name = "leviculum-std"
-version = "0.30.0+ciris.1"
-source = "git+https://github.com/CIRISAI/leviculum?tag=v0.30.0%2Bciris.1#fa6cff3f42531b946dd5da03c6ae28e5d2e9dfcc"
+version = "0.31.0+ciris.1"
+source = "git+https://github.com/CIRISAI/leviculum?tag=v0.31.0%2Bciris.1#4cf116afdb3dc754293c461c9eceef4315387f9c"
 dependencies = [
  "bluer",
  "clap 4.6.6",
@@ -4081,7 +4081,7 @@ dependencies = [
 [[package]]
 name = "leviculum-telemetry-policy"
 version = "0.1.0"
-source = "git+https://github.com/CIRISAI/leviculum?tag=v0.30.0%2Bciris.1#fa6cff3f42531b946dd5da03c6ae28e5d2e9dfcc"
+source = "git+https://github.com/CIRISAI/leviculum?tag=v0.31.0%2Bciris.1#4cf116afdb3dc754293c461c9eceef4315387f9c"
 
 [[package]]
 name = "libbz2-rs-sys"
@@ -6180,7 +6180,7 @@ dependencies = [
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
- "webpki-roots 1.0.9",
+ "webpki-roots 1.0.10",
 ]
 
 [[package]]
@@ -6378,9 +6378,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -8291,14 +8291,14 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
 dependencies = [
- "webpki-roots 1.0.9",
+ "webpki-roots 1.0.10",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
 dependencies = [
  "rustls-pki-types",
 ]