ciris-server 0.5.63__tar.gz → 0.5.69__tar.gz

{ciris_server-0.5.63 → ciris_server-0.5.69}/.github/workflows/bench.yml

@@ -77,32 +77,25 @@ jobs:
             echo "key-persist=${KEY_PERSIST}"
             echo "key-edge=${KEY_EDGE}"
             echo "key=${KEY_SERVER}"
+            echo "key-server-prefix=${BASE}-p${P:-none}-e${EDGE:-none}-v${V:-none}-s"
           } >> "$GITHUB_OUTPUT"
           echo "::notice::CIRISCache (${PLAT}): S=${S:-NONE} P=${P:-NONE} V=${V:-NONE} EDGE=${EDGE:-NONE} RUSTC=${RUSTC}"
           echo "::notice::${KEY_VERIFY}"
           echo "::notice::${KEY_PERSIST}"
           echo "::notice::${KEY_EDGE}"
           echo "::notice::${KEY_SERVER}"
-      - name: CIRISCache restore (verify layer)
-        uses: CIRISAI/CIRISCache/restore@v1
+      # Deepest-first, first-hit-wins (CIRISCache restore@v2): one extraction of
+      # the deepest available blob (cumulative supersets) instead of N redundant.
+      - name: CIRISCache restore (server→edge→persist→verify, first hit)
+        uses: CIRISAI/CIRISCache/restore@v2
         continue-on-error: true
         with:
-          key: ${{ steps.cachekey.outputs.key-verify }}
-      - name: CIRISCache restore (persist layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key-persist }}
-      - name: CIRISCache restore (edge layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key-edge }}
-      - name: CIRISCache restore (server layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key }}
+          keys: |
+            ${{ steps.cachekey.outputs.key }}
+            ${{ steps.cachekey.outputs.key-server-prefix }}*
+            ${{ steps.cachekey.outputs.key-edge }}
+            ${{ steps.cachekey.outputs.key-persist }}
+            ${{ steps.cachekey.outputs.key-verify }}
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"

{ciris_server-0.5.63 → ciris_server-0.5.69}/.github/workflows/build-wheels.yml

@@ -9,13 +9,16 @@ name: build-wheels
 # or the cache they share never hits. Keeping the steps in one place guarantees
 # that — there is no second copy to drift.
 #
-# Cache model (GitHub scopes caches by ref — a tag run can only restore the
-# default branch's caches): every rust-cache step SAVES only on main
-# (`save-if: github.ref == 'refs/heads/main'`) and RESTORES everywhere. So when
-# warm-release-cache calls this on a main push it populates the cache; when
-# publish-pypi calls it on a tag it restores that warm cache and skips the
-# ~12–15 min substrate recompile. The maturin-action legs (macOS/Windows) use
-# the action's built-in `sccache` (its GHA object cache), warmed the same way.
+# Cache model (two tiers):
+#   • Swatinem rust-cache (GHA L1) — GitHub scopes GHA caches by ref, and a tag
+#     run can only READ the default branch's caches, so it SAVES only on main
+#     (`save-if: main`) and restores everywhere.
+#   • CIRISCache (GHCR L2, restore@v2) — a GHCR package is NOT ref-scoped, so the
+#     SERVER `-s<version>` blob is saved on main AND on the v* tag publish (this
+#     workflow's only caller now that warm-release-cache is retired). That keeps a
+#     per-version `-s` blob so the next release's restore@v2 `-s*` prefix fallback
+#     pulls the latest lean ~1 GB server blob instead of the larger edge layer.
+# The maturin-action legs (macOS/Windows) use the action's built-in `sccache`.
 
 on:
   workflow_call:
@@ -77,32 +80,25 @@ jobs:
             echo "key-persist=${KEY_PERSIST}"
             echo "key-edge=${KEY_EDGE}"
             echo "key=${KEY_SERVER}"
+            echo "key-server-prefix=${BASE}-p${P:-none}-e${EDGE:-none}-v${V:-none}-s"
           } >> "$GITHUB_OUTPUT"
           echo "::notice::CIRISCache (${PLAT}): S=${S:-NONE} P=${P:-NONE} V=${V:-NONE} EDGE=${EDGE:-NONE} RUSTC=${RUSTC}"
           echo "::notice::${KEY_VERIFY}"
           echo "::notice::${KEY_PERSIST}"
           echo "::notice::${KEY_EDGE}"
           echo "::notice::${KEY_SERVER}"
-      - name: CIRISCache restore (verify layer)
-        uses: CIRISAI/CIRISCache/restore@v1
+      # Deepest-first, first-hit-wins (CIRISCache restore@v2): one extraction of
+      # the deepest available blob (cumulative supersets) instead of N redundant.
+      - name: CIRISCache restore (server→edge→persist→verify, first hit)
+        uses: CIRISAI/CIRISCache/restore@v2
         continue-on-error: true
         with:
-          key: ${{ steps.cachekey.outputs.key-verify }}
-      - name: CIRISCache restore (persist layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key-persist }}
-      - name: CIRISCache restore (edge layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key-edge }}
-      - name: CIRISCache restore (server layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key }}
+          keys: |
+            ${{ steps.cachekey.outputs.key }}
+            ${{ steps.cachekey.outputs.key-server-prefix }}*
+            ${{ steps.cachekey.outputs.key-edge }}
+            ${{ steps.cachekey.outputs.key-persist }}
+            ${{ steps.cachekey.outputs.key-verify }}
       - name: Install build deps
         run: |
           # Drop the preinstalled Microsoft/azure-cli apt repo: it intermittently
@@ -155,7 +151,7 @@ jobs:
       # GITHUB_TOKEN, no external secret).
       - name: CIRISCache save (server layer, main only)
         uses: CIRISAI/CIRISCache/save@v1
-        if: github.ref == 'refs/heads/main'
+        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
         continue-on-error: true
         with:
           key: ${{ steps.cachekey.outputs.key }}
@@ -230,32 +226,25 @@ jobs:
             echo "key-persist=${KEY_PERSIST}"
             echo "key-edge=${KEY_EDGE}"
             echo "key=${KEY_SERVER}"
+            echo "key-server-prefix=${BASE}-p${P:-none}-e${EDGE:-none}-v${V:-none}-s"
           } >> "$GITHUB_OUTPUT"
           echo "::notice::CIRISCache (${PLAT}): S=${S:-NONE} P=${P:-NONE} V=${V:-NONE} EDGE=${EDGE:-NONE} RUSTC=${RUSTC}"
           echo "::notice::${KEY_VERIFY}"
           echo "::notice::${KEY_PERSIST}"
           echo "::notice::${KEY_EDGE}"
           echo "::notice::${KEY_SERVER}"
-      - name: CIRISCache restore (verify layer)
-        uses: CIRISAI/CIRISCache/restore@v1
+      # Deepest-first, first-hit-wins (CIRISCache restore@v2): one extraction of
+      # the deepest available blob (cumulative supersets) instead of N redundant.
+      - name: CIRISCache restore (server→edge→persist→verify, first hit)
+        uses: CIRISAI/CIRISCache/restore@v2
         continue-on-error: true
         with:
-          key: ${{ steps.cachekey.outputs.key-verify }}
-      - name: CIRISCache restore (persist layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key-persist }}
-      - name: CIRISCache restore (edge layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key-edge }}
-      - name: CIRISCache restore (server layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key }}
+          keys: |
+            ${{ steps.cachekey.outputs.key }}
+            ${{ steps.cachekey.outputs.key-server-prefix }}*
+            ${{ steps.cachekey.outputs.key-edge }}
+            ${{ steps.cachekey.outputs.key-persist }}
+            ${{ steps.cachekey.outputs.key-verify }}
       - name: Build wheel (maturin)
         uses: PyO3/maturin-action@v1
         with:
@@ -274,7 +263,7 @@ jobs:
       # Populate the cross-repo CIRISCache blob on main under the SERVER key.
       - name: CIRISCache save (server layer, main only)
         uses: CIRISAI/CIRISCache/save@v1
-        if: github.ref == 'refs/heads/main'
+        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
         continue-on-error: true
         with:
           key: ${{ steps.cachekey.outputs.key }}
@@ -336,32 +325,25 @@ jobs:
             echo "key-persist=${KEY_PERSIST}"
             echo "key-edge=${KEY_EDGE}"
             echo "key=${KEY_SERVER}"
+            echo "key-server-prefix=${BASE}-p${P:-none}-e${EDGE:-none}-v${V:-none}-s"
           } >> "$GITHUB_OUTPUT"
           echo "::notice::CIRISCache (${PLAT}): S=${S:-NONE} P=${P:-NONE} V=${V:-NONE} EDGE=${EDGE:-NONE} RUSTC=${RUSTC}"
           echo "::notice::${KEY_VERIFY}"
           echo "::notice::${KEY_PERSIST}"
           echo "::notice::${KEY_EDGE}"
           echo "::notice::${KEY_SERVER}"
-      - name: CIRISCache restore (verify layer)
-        uses: CIRISAI/CIRISCache/restore@v1
+      # Deepest-first, first-hit-wins (CIRISCache restore@v2): one extraction of
+      # the deepest available blob (cumulative supersets) instead of N redundant.
+      - name: CIRISCache restore (server→edge→persist→verify, first hit)
+        uses: CIRISAI/CIRISCache/restore@v2
         continue-on-error: true
         with:
-          key: ${{ steps.cachekey.outputs.key-verify }}
-      - name: CIRISCache restore (persist layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key-persist }}
-      - name: CIRISCache restore (edge layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key-edge }}
-      - name: CIRISCache restore (server layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key }}
+          keys: |
+            ${{ steps.cachekey.outputs.key }}
+            ${{ steps.cachekey.outputs.key-server-prefix }}*
+            ${{ steps.cachekey.outputs.key-edge }}
+            ${{ steps.cachekey.outputs.key-persist }}
+            ${{ steps.cachekey.outputs.key-verify }}
       - name: Build wheel (maturin)
         uses: PyO3/maturin-action@v1
         with:
@@ -379,7 +361,7 @@ jobs:
       # Populate the cross-repo CIRISCache blob on main under the SERVER key.
       - name: CIRISCache save (server layer, main only)
         uses: CIRISAI/CIRISCache/save@v1
-        if: github.ref == 'refs/heads/main'
+        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
         continue-on-error: true
         with:
           key: ${{ steps.cachekey.outputs.key }}
@@ -437,32 +419,25 @@ jobs:
             echo "key-persist=${KEY_PERSIST}"
             echo "key-edge=${KEY_EDGE}"
             echo "key=${KEY_SERVER}"
+            echo "key-server-prefix=${BASE}-p${P:-none}-e${EDGE:-none}-v${V:-none}-s"
           } >> "$GITHUB_OUTPUT"
           echo "::notice::CIRISCache (${PLAT}): S=${S:-NONE} P=${P:-NONE} V=${V:-NONE} EDGE=${EDGE:-NONE} RUSTC=${RUSTC}"
           echo "::notice::${KEY_VERIFY}"
           echo "::notice::${KEY_PERSIST}"
           echo "::notice::${KEY_EDGE}"
           echo "::notice::${KEY_SERVER}"
-      - name: CIRISCache restore (verify layer)
-        uses: CIRISAI/CIRISCache/restore@v1
+      # Deepest-first, first-hit-wins (CIRISCache restore@v2): one extraction of
+      # the deepest available blob (cumulative supersets) instead of N redundant.
+      - name: CIRISCache restore (server→edge→persist→verify, first hit)
+        uses: CIRISAI/CIRISCache/restore@v2
         continue-on-error: true
         with:
-          key: ${{ steps.cachekey.outputs.key-verify }}
-      - name: CIRISCache restore (persist layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key-persist }}
-      - name: CIRISCache restore (edge layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key-edge }}
-      - name: CIRISCache restore (server layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key }}
+          keys: |
+            ${{ steps.cachekey.outputs.key }}
+            ${{ steps.cachekey.outputs.key-server-prefix }}*
+            ${{ steps.cachekey.outputs.key-edge }}
+            ${{ steps.cachekey.outputs.key-persist }}
+            ${{ steps.cachekey.outputs.key-verify }}
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
@@ -526,7 +501,7 @@ jobs:
       # Populate the cross-repo CIRISCache blob on main under the SERVER key.
       - name: CIRISCache save (server layer, main only)
         uses: CIRISAI/CIRISCache/save@v1
-        if: github.ref == 'refs/heads/main'
+        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
         continue-on-error: true
         with:
           key: ${{ steps.cachekey.outputs.key }}

ciris_server-0.5.69/.github/workflows/ci.yml

@@ -0,0 +1,141 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    # Docs-only commits don't change the Rust build — skip the full compile.
+    paths-ignore:
+      - "**/*.md"
+      - "FSD/**"
+      - "docs/**"
+  pull_request:
+    paths-ignore:
+      - "**/*.md"
+      - "FSD/**"
+      - "docs/**"
+
+# Cancel a superseded run on the same ref (PR re-push / newer main commit). A tag
+# ref is distinct, so this never cancels a release pipeline.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write   # CIRISCache save (GHCR) on main — CIRISServer#99
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  fmt:
+    name: rustfmt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --all --check
+
+  clippy-test:
+    name: clippy + test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - name: Install build deps (Linux)
+        if: runner.os == 'Linux'
+        # libtss2-dev: the Linux-only keyring/tpm backend (cfg(target_os=linux)).
+        # libsqlite3-dev: persist's sqlite. macOS/Windows pull NEITHER tss-esapi
+        # nor openssl (postgres+tpm are Linux-only per Cargo.toml [target.linux]).
+        run: |
+          # Drop the preinstalled Microsoft/azure-cli apt repo: it intermittently
+          # 403s and tanks apt-get update (its packages are not needed here).
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list /etc/apt/sources.list.d/azure-cli.sources
+          sudo apt-get update
+          sudo apt-get install -y libtss2-dev libsqlite3-dev libudev-dev
+      - uses: Swatinem/rust-cache@v2
+        continue-on-error: true
+        with:
+          cache-bin: false
+      # CIRISCache (CIRISServer#99) — 4-layer centipede over the Swatinem GHA L1.
+      # PLAT from the NATIVE target of each runner (macos-latest = arm64). Restore
+      # verify→persist→edge→server; SAVE under the server-specific -s key on main.
+      - name: Compute CIRISCache keys (4-layer centipede, CIRISServer#99)
+        id: cachekey
+        shell: bash
+        run: |
+          case "${{ matrix.os }}" in
+            ubuntu-latest)  PLAT=linux-x86_64 ;;
+            macos-latest)   PLAT=macos-aarch64 ;;
+            windows-latest) PLAT=windows-x64 ;;
+            *)              PLAT=unknown ;;
+          esac
+          RUSTC=$(rustc -V | awk '{print $2}')
+          S=$(grep -m1 '^version = ' Cargo.toml | sed -E 's/^version = "([^"]+)".*/\1/')
+          P=$(grep -m1 'CIRISPersist.*tag = "v' Cargo.toml | sed -E 's/.*tag = "v([0-9.]+)".*/\1/')
+          V=$(grep -m1 'CIRISVerify.*tag = "v'  Cargo.toml | sed -E 's/.*tag = "v([0-9.]+)".*/\1/')
+          EDGE=$(grep -m1 'CIRISEdge.*tag = "v' Cargo.toml | sed -E 's/.*tag = "v([0-9.]+)".*/\1/')
+          BASE="ciris-substrate-v1-${PLAT}-release-rustc${RUSTC}"
+          KEY_VERIFY="${BASE}-pnone-enone-v${V:-none}"
+          KEY_PERSIST="${BASE}-p${P:-none}-enone-v${V:-none}"
+          KEY_EDGE="${BASE}-p${P:-none}-e${EDGE:-none}-v${V:-none}"
+          KEY_SERVER="${BASE}-p${P:-none}-e${EDGE:-none}-v${V:-none}-s${S:-none}"
+          {
+            echo "key-verify=${KEY_VERIFY}"
+            echo "key-persist=${KEY_PERSIST}"
+            echo "key-edge=${KEY_EDGE}"
+            echo "key=${KEY_SERVER}"
+            echo "key-server-prefix=${BASE}-p${P:-none}-e${EDGE:-none}-v${V:-none}-s"
+          } >> "$GITHUB_OUTPUT"
+          echo "::notice::CIRISCache (${PLAT}): S=${S:-NONE} P=${P:-NONE} V=${V:-NONE} EDGE=${EDGE:-NONE} RUSTC=${RUSTC}"
+          echo "::notice::${KEY_VERIFY}"
+          echo "::notice::${KEY_PERSIST}"
+          echo "::notice::${KEY_EDGE}"
+          echo "::notice::${KEY_SERVER}"
+      # Deepest-first, first-hit-wins (CIRISCache restore@v2): the layers are
+      # cumulative supersets, so one restore of the deepest available blob beats
+      # extracting verify→persist→edge→server in sequence (the edge layer alone
+      # measured 452s/7.5min on v1 — redundant overwrite I/O).
+      - name: CIRISCache restore (server→edge→persist→verify, first hit)
+        uses: CIRISAI/CIRISCache/restore@v2
+        continue-on-error: true
+        with:
+          keys: |
+            ${{ steps.cachekey.outputs.key }}
+            ${{ steps.cachekey.outputs.key-server-prefix }}*
+            ${{ steps.cachekey.outputs.key-edge }}
+            ${{ steps.cachekey.outputs.key-persist }}
+            ${{ steps.cachekey.outputs.key-verify }}
+      # Default features build everywhere (sqlite + the binary path); postgres +
+      # tpm are Linux-only (per-target). NOT --all-features: that drags
+      # `extension-module` (libpython-no-link) into the test binary.
+      - run: cargo clippy --all-targets -- -D warnings
+      - run: cargo test
+      # The NOISE FLOOR proof (CIRISServer#14, CEG §19.7 / §19.3 N5) — provable
+      # individual-unrecoverability for erasure compliance, run explicitly so the
+      # MEASURED residual-fidelity numbers land in the CI log (Linux only — one
+      # canonical record; the test also runs on every OS via `cargo test` above).
+      # The three gated cases: (a) revocation ⇒ EjectHardDelete leaves NO
+      # recoverable tier, (b) the measured noise floor below n_source symbols,
+      # (c) N→1 aggregation erases the individual below the 1/N gist bound.
+      - name: Noise floor proof (MEASURED, Linux)
+        if: runner.os == 'Linux'
+        run: cargo test --test noise_floor -- --nocapture
+      # The PyO3 wheel surface (Linux only; libpython linked, no extension-module).
+      - name: clippy (python surface, Linux)
+        if: runner.os == 'Linux'
+        run: cargo clippy --all-targets --features python -- -D warnings
+      # NB: CI does NOT save a cache blob. It builds DEBUG (clippy+test); saving a
+      # debug `target/` measured ~586s (10 min) on main to spare only the ~30s
+      # debug ciris-server recompile next run — a net loss — and it collided with
+      # conformance's RELEASE `-s<version>` blob (same key). The release `-s` is
+      # populated by conformance (on main) + build-wheels (on tags); CI only
+      # RESTORES (the centipede above) and lets cargo do the cheap debug delta.

{ciris_server-0.5.63 → ciris_server-0.5.69}/.github/workflows/client-artifacts.yml

@@ -146,25 +146,25 @@ jobs:
             echo "key-persist=${BASE}-p${P:-none}-enone-v${V:-none}"
             echo "key-edge=${BASE}-p${P:-none}-e${EDGE:-none}-v${V:-none}"
             echo "key=${BASE}-p${P:-none}-e${EDGE:-none}-v${V:-none}-s${S:-none}"
+            echo "key-server-prefix=${BASE}-p${P:-none}-e${EDGE:-none}-v${V:-none}-s"
           } >> "$GITHUB_OUTPUT"
           echo "::notice::CIRISCache (${PLAT}): S=${S:-NONE} P=${P:-NONE} V=${V:-NONE} EDGE=${EDGE:-NONE} RUSTC=${RUSTC}"
-      - uses: CIRISAI/CIRISCache/restore@v1
+      # Deepest-first, first-hit-wins (CIRISCache restore@v2): one extraction.
+      - uses: CIRISAI/CIRISCache/restore@v2
         continue-on-error: true
-        with: { key: "${{ steps.cachekey.outputs.key-verify }}" }
-      - uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with: { key: "${{ steps.cachekey.outputs.key-persist }}" }
-      - uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with: { key: "${{ steps.cachekey.outputs.key-edge }}" }
-      - uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with: { key: "${{ steps.cachekey.outputs.key }}" }
+        with:
+          keys: |
+            ${{ steps.cachekey.outputs.key }}
+            ${{ steps.cachekey.outputs.key-server-prefix }}*
+            ${{ steps.cachekey.outputs.key-edge }}
+            ${{ steps.cachekey.outputs.key-persist }}
+            ${{ steps.cachekey.outputs.key-verify }}
 
-      - name: Set up Java 17 (Liberica — Win7-capable jlink runtime)
-        # Liberica/Zulu retain Windows 7 support; Temurin dropped it. The
-        # trimmed jlink runtime here ships inside the installer, so even the
-        # mainline (Win8.1-floor) build uses a Win7-capable JDK for the JRE.
+      - name: Set up Java 17 (Liberica)
+        # Liberica 17 provides the trimmed jlink runtime bundled into the
+        # installer. Modern Windows floor (Win10+/Server 2016+) since 0.5.65 —
+        # the Win7 support that drove this distro choice is no longer a
+        # requirement, but Liberica stays (stable jlink source).
         uses: actions/setup-java@v4
         with:
           distribution: 'liberica'
@@ -246,16 +246,8 @@ jobs:
           if (-not $jar) { Write-Error "No CIRIS-windows-*.jar found"; exit 1 }
           .\installers\windows\bundle-jre.ps1 -JarPath $jar.FullName -OutputDir dist\runtime
 
-      - name: Fetch Universal CRT redist (Windows 7 prerequisite, best-effort)
-        continue-on-error: true
-        shell: pwsh
-        run: |
-          $dst = "installers/windows/redist"
-          New-Item -ItemType Directory -Force -Path $dst | Out-Null
-          $url = "https://download.microsoft.com/download/5/B/C/5BC5DBB3-652D-4DCE-B14A-475AB85EEF6E/Windows6.1-KB2999226-x64.msu"
-          try {
-            Invoke-WebRequest -Uri $url -OutFile "$dst/Windows6.1-KB2999226-x64.msu" -UseBasicParsing -TimeoutSec 120
-          } catch { Write-Warning "UCRT fetch failed ($_); Win7 users hand-provision." }
+      # (Removed in 0.5.65: the Universal CRT redist fetch was a Win7 SP1
+      # prerequisite — Win10+/Server 2016+ ship the UCRT in-box.)
 
       - name: Install Inno Setup
         uses: nick-fields/retry@v4

{ciris_server-0.5.63 → ciris_server-0.5.69}/.github/workflows/conformance.yml

@@ -79,32 +79,25 @@ jobs:
             echo "key-persist=${KEY_PERSIST}"
             echo "key-edge=${KEY_EDGE}"
             echo "key=${KEY_SERVER}"
+            echo "key-server-prefix=${BASE}-p${P:-none}-e${EDGE:-none}-v${V:-none}-s"
           } >> "$GITHUB_OUTPUT"
           echo "::notice::CIRISCache (${PLAT}): S=${S:-NONE} P=${P:-NONE} V=${V:-NONE} EDGE=${EDGE:-NONE} RUSTC=${RUSTC}"
           echo "::notice::${KEY_VERIFY}"
           echo "::notice::${KEY_PERSIST}"
           echo "::notice::${KEY_EDGE}"
           echo "::notice::${KEY_SERVER}"
-      - name: CIRISCache restore (verify layer)
-        uses: CIRISAI/CIRISCache/restore@v1
+      # Deepest-first, first-hit-wins (CIRISCache restore@v2): one extraction of
+      # the deepest available blob (cumulative supersets) instead of N redundant.
+      - name: CIRISCache restore (server→edge→persist→verify, first hit)
+        uses: CIRISAI/CIRISCache/restore@v2
         continue-on-error: true
         with:
-          key: ${{ steps.cachekey.outputs.key-verify }}
-      - name: CIRISCache restore (persist layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key-persist }}
-      - name: CIRISCache restore (edge layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key-edge }}
-      - name: CIRISCache restore (server layer)
-        uses: CIRISAI/CIRISCache/restore@v1
-        continue-on-error: true
-        with:
-          key: ${{ steps.cachekey.outputs.key }}
+          keys: |
+            ${{ steps.cachekey.outputs.key }}
+            ${{ steps.cachekey.outputs.key-server-prefix }}*
+            ${{ steps.cachekey.outputs.key-edge }}
+            ${{ steps.cachekey.outputs.key-persist }}
+            ${{ steps.cachekey.outputs.key-verify }}
       - name: Install build deps
         #: the family links the TPM keyring backend on Linux.
         # libsqlite3-dev: persist's sqlite backend.