ciris-server 0.5.73__tar.gz → 0.5.74__tar.gz

{ciris_server-0.5.73 → ciris_server-0.5.74}/Cargo.lock

@@ -983,7 +983,7 @@ dependencies = [
 
 [[package]]
 name = "ciris-server"
-version = "0.5.73"
+version = "0.5.74"
 dependencies = [
  "anyhow",
  "async-trait",

ciris_server-0.5.74/Cargo.toml

@@ -0,0 +1,327 @@
+[package]
+name = "ciris-server"
+version = "0.5.74" # 0.5.74 = wheel/image config-CLI parity: `ciris-server config set/get` now works from the pip WHEEL/image entry (py_main), not just the standalone binary. The mesh-seed blocker: Node A runs the published wheel, whose py_main dispatched ONLY import-traces + serve — so `config set net.announce_ownership true` (needed for A to emit its Reticulum identity announce → be rooted by key_id over RNS → be reachable by the relay) silently was unavailable. Fix: moved run_config_set_cli/run_config_get_cli/parse_config_value into the LIB (shared by src/main.rs AND python::py_main) + added the `config` arm to py_main. Substrate UNCHANGED (edge v8.3.0 / persist v11.9.1 / verify v8.3.0). 0.5.73 = mesh-seed operability: claim-records-locally + config CLI (binary-only, the gap this release closes) + copy-all delegation card + runbooks.
+edition = "2021"
+# MSRV floor is set by the substrate: ciris-verify v5.2.0 requires 1.86
+# (persist v6.0.1 is 1.83). Build with the higher of the two.
+rust-version = "1.86"
+authors = ["Eric Moore <eric@ciris.ai>"]
+description = "The fabric node — the federation's headless cohabitation runtime (registry + lens [+ node] over one shared substrate). agent = fabric node + brain. Shipped as both the ciris-server binary and a PyO3 abi3 wheel CIRISAgent consumes. See MISSION.md."
+license = "AGPL-3.0-or-later"
+repository = "https://github.com/CIRISAI/CIRISServer"
+readme = "README.md"
+publish = false
+
+# CIRISServer is ONE cohabitation composition in TWO shapes (MISSION.md §1.2/§6):
+#   - [lib] cdylib  → the PyO3 abi3 wheel CIRISAgent pip-installs (the agent is
+#                     pure Python; it consumes ciris-server, not the cores).
+#   - [lib] rlib    → so the ciris-server binary links the same composition.
+#   - [[bin]]       → the headless fabric node deployment.
+# The composition lives in src/lib.rs; src/main.rs is a thin entry point.
+[workspace]
+# lens-core is absorbed in-tree (CIRISLensCore repo retired); the root package
+# composes it as a path dep. node-core folds in here the same way at Server 1.0.
+members = ["crates/ciris-lens-core"]
+resolver = "2"
+
+[lib]
+name = "ciris_server"
+crate-type = ["cdylib", "rlib"]
+path = "src/lib.rs"
+
+[[bin]]
+name = "ciris-server"
+path = "src/main.rs"
+
+[features]
+# pkcs11 (the YubiKey / PKCS#11-PIV custody backend) ships in DEFAULT so the
+# published wheel + the `ciris-server` binary carry the hardware fed-ID + accord
+# custody path out of the box (no special build). `python`/`extension-module` are
+# deliberately NOT default — the binary must never link libpython; maturin turns
+# them on for the wheel (pyproject [tool.maturin]). TPM/postgres hardware backends
+# are auto-on per-target on Linux (see the [target.*] tables below).
+default = ["pkcs11"]
+# `python` pulls the PyO3 bindings (for the wheel). The binary builds WITHOUT it,
+# so a plain `cargo build` never links libpython.
+# ONE-WHEEL RE-EXPORT (CIRISServer#4): `python` ALSO turns on the substrate
+# crates' OWN pyo3 surfaces (`ciris-persist/pyo3`, `ciris-edge/pyo3`) so their
+# `#[pyclass]`es compile into THIS cdylib — one `.so`, one PyO3 type registry,
+# so the persist `Engine` handed to edge is the SAME type both sides see (the
+# CIRISPersist#109 cross-wheel type-identity bug CANNOT occur). persist names its
+# feature `pyo3` (not `python`); edge likewise, and edge's `pyo3` already pulls
+# `ciris-persist/pyo3` transitively — both listed for explicitness. verify is
+# deliberately ABSENT: it is a ctypes wheel (libciris_verify_ffi.so via
+# ctypes.CDLL), not a `#[pymodule]`, so it cannot be a pyo3 submodule.
+python = [
+    "dep:pyo3",
+    "dep:pyo3-async-runtimes",
+    "ciris-lens-core/python",
+    "ciris-persist/pyo3",
+    "ciris-edge/pyo3",
+]
+# `extension-module` is what maturin builds the wheel with (tells PyO3 not to
+# link libpython). The bin must NOT enable it. See pyproject.toml [tool.maturin].
+# Propagated to the substrate crates so THEIR pyo3 surfaces also skip linking
+# libpython (each crate gates `extension-module` as its own feature).
+extension-module = [
+    "python",
+    "pyo3/extension-module",
+    "ciris-persist/extension-module",
+    "ciris-edge/extension-module",
+]
+# `pkcs11` turns on the YubiKey (PKCS#11 / PIV) custody backend for the USER
+# federation identity (`ciris-server identity create --backend pkcs11`). OFF by
+# default: a plain `cargo build` never links `cryptoki`, and the Pkcs11 backend
+# honestly returns NotSupported without it. It flips `ciris-keyring/pkcs11` on
+# (operator hardware; Linux). The YubiKey path is hardware-validated by the
+# operator — there is no token in CI, so it is gated + flagged, not unit-tested.
+# Like the per-target `tpm` posture, it is NOT in `default`; build it explicitly
+# (`--features pkcs11`) on a Linux box with a token attached.
+# `pkcs11` (the YubiKey custody path) pulls `ciris-keyring/pkcs11` directly and
+# GLOBALLY: CIRISVerify v6.12.0 made cryptoki build on ALL targets (feature
+# parity), so it no longer breaks the macos/android/ios wheels. The ciris-server
+# pkcs11 source compiles wherever this feature is on (gated on `feature = "pkcs11"`,
+# no target_os restriction). At runtime a target with no PKCS#11 module (e.g.
+# android, which reaches a YubiKey over NFC via YubiKit instead) returns
+# NotSupported — present everywhere, hardware-validated where a token is attached.
+pkcs11 = ["ciris-keyring/pkcs11"]
+# NOTE: hardware key custody (TPM/SE/StrongBox) is wired per-TARGET below, not as
+# a cargo feature — TPM (tss-esapi) is Linux-only, so a top-level `tpm` feature
+# made `--all-features` drag tss-esapi onto Windows/macOS (where it can't build).
+# The `[target.'cfg(target_os = "linux")']` table enables keyring/tpm + persist
+# postgres on Linux only; runtime auto-detects hardware and degrades to encrypted
+# software when absent (`is_hardware_backed()` reports the posture). This mirrors
+# the substrate crates' per-target keyring/postgres gating.
+
+# ----------------------------------------------------------------------------
+# Dependencies — CIRISServer AUTHORS NO PRIMITIVES. It composes the core
+# libraries over ONE shared persist Engine (registry + lens read/write the same
+# corpus in-process; per-slice views via Engine::from_shared).
+#
+# Substrate floor (SHIPPED): persist v8.6.0 / edge v4.5.0 / verify-family v5.11.0
+# (ciris-keyring + ciris-crypto + ciris-verify-core), CEG 1.0-RC12. The composition
+# root pins the singleton construction; the in-tree ciris-lens-core co-bumps in
+# lockstep (MAJOR caret pins persist "8" / edge "4"). edge v4.2.0 ships the relay
+# outer-open primitive (`open_av_outer`, CIRISEdge#149) → multi-tier ALM chains
+# (benches/alm_chain.rs). All additive; no composition-root API change. pyo3 0.29.
+# ----------------------------------------------------------------------------
+[dependencies]
+# The composed cores (authority + observation; node folds in at Server 1.0).
+# ciris-registry-core — re-added at Server 0.5, co-bumped to the 6.6/edge-3.2 floor
+# (CIRISRegistry#76). Held OUT of the 0.1 graph: registry-core@main still pins the
+# OLD floor (persist 5.5.5 / edge 2.2.2 / verify 5.1.3) and would drag a second
+# persist+edge rev into the build. The compose_registry() scaffold stays in
+# src/compose.rs; this dep returns once registry co-bumps.
+ciris-lens-core     = { path = "crates/ciris-lens-core" } # ABSORBED in-tree (workspace member); CIRISLensCore repo retired
+# ciris-node-core   — folds in at Server 1.0 / agent 2.9.10 (a substrate gen behind: persist 4.10).
+
+# The substrate trio (also pulled transitively by the cores; pinned here so the
+# composition root owns the singleton construction).
+# sqlite on all platforms; postgres is Linux-only (libpq/openssl don't link
+# cleanly on the macOS/Windows runners — same posture as persist's own CI). The
+# `[target.linux]` table below adds postgres.
+# `cirislens_wa_cert` + `cirislens_service_token_revocation` expose the auth
+# substrate the fabric absorbs (CIRISServer#9, src/auth): the agent's `wa_cert`
+# table (users/WA/OAuth/api-keys) + the `revoked_service_tokens` table.
+ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v11.9.1", features = ["sqlite", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
+ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v8.3.0", features = ["transport-reticulum", "transport-http", "transport-packet-radio"] }
+# Founder-quorum verification + key-id fingerprint at the composition root
+# (threshold:: module path — NOT re-exported at the crate root).
+# LOCKSTEP: persist v9.4.0 transitively pins verify-core v6.6.x — the whole
+# verify family (verify-core/keyring/crypto) MUST ride the SAME tag or cargo
+# resolves two ciris_verify_core crates with incompatible ThresholdMember/keyring
+# types. v6.6.1 (CIRISVerify#89) adds the create_federation_identity `seal_alias`
+# arg the #247 user-key-derived fix consumes. (6.4–6.6 are HUMANITY_ACCORD + STH
+# stack — the accord-genesis surface CIRISServer#41 consumes.)
+ciris-verify-core = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.3.0" }
+# The hybrid crypto primitives (Ed25519 + ML-DSA-65 software signers) — used by
+# the portable software identity occurrence to build a `HybridSigningIdentity`
+# over two software seeds. Same tag as the rest of the verify family.
+ciris-crypto = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.3.0", version = "8", features = ["pqc-ml-dsa", "self-enc"] }
+# Hardware-backed transport-identity keystore (verify v5.2.0 #68 / edge #99).
+# Base = software keystore + byte-identical migration of an existing .rid (works
+# everywhere, no libtss2). The real TPM-2.0 / SE / StrongBox backend rides the
+# `tpm` feature; runtime auto-detects hardware and falls back to software.
+ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.3.0", version = "8", features = ["software", "pqc-ml-dsa"] }
+
+# PyO3 bindings for the abi3 wheel — optional, gated behind the `python` feature
+# so the binary never links them. 0.29 matches the persist/edge family floor.
+pyo3                = { version = "0.29", features = ["abi3-py310"], optional = true }
+pyo3-async-runtimes = { version = "0.29", features = ["tokio-runtime"], optional = true }
+
+tokio   = { version = "1", features = ["rt-multi-thread", "macros", "signal", "time", "sync"] }
+anyhow  = "1"
+fs2       = "0.4"   # available-disk check for realistic-minimum feature gating
+# GET /v1/identity (the fabric-node identity surface) — merged onto the lens
+# read-API listener. axum pinned to lens-core's 0.8 so the merged Router unifies.
+axum       = "0.8"
+base64     = "0.22"
+serde      = { version = "1", features = ["derive"] } # holonomic scoreboard model (benchmarks::)
+serde_json = "1"
+getrandom  = "0.3"   # mint the ML-DSA-65 federation seed on first boot (hybrid PQC)
+# Cosmetic v4 attestation-ids (the content hash is the integrity anchor). Direct
+# dep at the same major persist already pins transitively — no new resolution.
+uuid       = { version = "1", features = ["v4"] }
+# Auth subsystem (src/auth, CIRISServer#9): timestamps on the absorbed wa_cert
+# rows, SHA-256 for api-key / service-token hashing, hex for the digest wire form.
+# All three already in the lock as substrate-transitive deps (no new resolution).
+chrono     = { version = "0.4", features = ["serde"] }
+sha2       = "0.10"
+hex        = "0.4"
+# Auth gap-close (CIRISServer#9, src/auth): the byte-compatible password KDF +
+# the OAuth/native/device-auth outbound-HTTP + JWKS-verify halves. All already in
+# the lock as substrate-transitive deps (reqwest/jsonwebtoken via edge+verify;
+# pbkdf2/hmac/ed25519-dalek via the crypto family) — pinned here so the auth
+# subsystem owns them directly, no new resolution.
+# - pbkdf2 + hmac: reproduce the agent's PBKDF2-HMAC-SHA256(100k) password hash
+#   (auth_service.py `_hash_password`/`_verify_password`) byte-for-byte.
+# - ed25519-dalek: verify the ROOT mint signature (the agent's `verify_root_signature`).
+# - jsonwebtoken: Apple Sign-In RS256 JWKS verification.
+# - reqwest (rustls): Google tokeninfo / OAuth code→token / Apple JWKS / Portal HTTP.
+# - urlencoding: build the provider authorize-URL query string (matches urlencode).
+pbkdf2     = { version = "0.12", default-features = false }
+hmac       = "0.12"
+subtle     = "2"     # constant-time password-hash compare (the agent's hmac.compare_digest)
+ed25519-dalek = "2"
+jsonwebtoken  = "9"
+urlencoding   = "2"
+async-trait   = "0.1"  # the ProviderClient HTTP seam (async fn in trait)
+reqwest    = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] }
+# Mesh control-plane relay (#128 Phase D, src/mesh_relay.rs): the RNS responder
+# dispatches a verified control op into the node's OWN axum Router in-process via
+# `tower::ServiceExt::oneshot` (the same-handlers guarantee, RNS_CONTROL_RELAY.md
+# §5.4). Already in the lock as axum's own dependency (and a dev-dep) — promoting
+# it to a runtime dep adds no new resolution.
+tower      = { version = "0.5", features = ["util"] }
+flate2     = "1"     # read the gz'd legacy-trace dump (import-traces subcommand)
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
+# Non-blocking rolling file sink for the node log (so a headless node launched by
+# the desktop app logs RELIABLY to <home>/logs/, not just the captured console).
+tracing-appender = "0.2"
+
+# Linux-only hardware + Postgres: cargo UNIONS these onto the base deps above.
+# - persist `postgres` (libpq/openssl) — Linux deployment + the postgres
+#   conformance lane; macOS/Windows stay sqlite-only.
+# - keyring `tpm` (tss-esapi / TPM 2.0) — the real hardware backend; needs
+#   libtss2 (Linux build dep). Other targets keep the software keystore.
+[target.'cfg(target_os = "linux")'.dependencies]
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v11.9.1", features = ["postgres", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
+# keyring `tpm` (TPM-at-rest, Linux-only via tss-esapi). `pkcs11` is no longer
+# per-target — it rides the global `pkcs11` feature now that cryptoki builds on all
+# targets (CIRISVerify v6.12.0).
+ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.3.0", version = "8", features = ["tpm-plugin"] }
+
+# Android (arm64/arm32/x86_64): the keyring `android` backend (JNI → Android
+# Keystore/StrongBox); sqlite bundles, no postgres/tpm. Mirrors persist/edge.
+[target.'cfg(target_os = "android")'.dependencies]
+ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.3.0", version = "8", features = ["android"] }
+
+# serialport (the RNode LoRa driver dep, src/radio.rs) pulls libudev-sys on Linux,
+# which only resolves where libudev exists: desktop/server Linux (gnu, x86_64 or
+# aarch64), macOS, Windows. It does NOT cross-compile for armv7 / musl (no libudev
+# in the cross sysroot — the release armv7+musl legs panicked on it) and isn't
+# usable on android/ios. Gate to exactly the serial-capable targets — the SAME
+# predicate guards `pub mod radio` (lib.rs) + the edge attach (compose.rs).
+[target.'cfg(any(target_os = "macos", target_os = "windows", all(target_os = "linux", target_env = "gnu", any(target_arch = "x86_64", target_arch = "aarch64"))))'.dependencies]
+serialport = "4"
+
+# Test-only — the two-node replication integration test (tests/replication.rs)
+# builds + signs CEG batches with the same primitives persist verifies against.
+# ed25519-dalek MUST match persist's locked 2.x (the SigningKey type crosses the
+# Engine::with_signer / put_public_key API boundary).
+[dev-dependencies]
+ed25519-dalek = "2"
+base64        = "0.22"
+chrono        = { version = "0.4", features = ["serde"] }
+serde_json    = "1"
+criterion     = { version = "0.5", features = ["async_tokio"] }
+# Tamper-side raw SQLite handle for the audit hash-chain conformance gate
+# (tests/audit_chain.rs): opens the engine's file-backed DB on a SECOND
+# connection to corrupt one stored row, the only way to land a tampered entry
+# (record_entry validates + rejects, so a broken row can't go in through the
+# trait). Pinned to persist's locked 0.31 + same features (NO `bundled` — links
+# the platform libsqlite3, matching persist's non-mobile target so the two
+# `links = "sqlite3"` crates unify to one symbol set).
+rusqlite      = { version = "0.31", features = ["chrono", "serde_json"] }
+# Drive the merged axum Router in-process for the HTTP trace-ingest test
+# (tests/ingest_http.rs): `ServiceExt::oneshot` + read the response body. tower
+# 0.5 / http-body-util 0.1 match axum 0.8's floor (already in-tree transitively).
+tower            = { version = "0.5", features = ["util"] }
+http-body-util   = "0.1"
+# The PQC primitives the realtime-A/V E2E bench drives directly: hybrid KEX
+# (X25519 + ML-KEM-768) for the per-Link transit key, AES-256-GCM for the
+# two-layer chunk seal. Same pin/features edge composes (tag parity).
+ciris-crypto  = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.3.0", version = "8", features = ["hybrid-kex", "aes-gcm", "pqc-ml-dsa", "self-enc"] }
+# Enable edge's OWN fountain codec (`codec-fountain`, L1-A) for the survival-floor
+# proof — dev/test ONLY (feature unification applies to test/bench builds; the
+# shipped wheel stays codec-free, since a relay forwards sealed symbols opaquely
+# and never encodes/decodes). This lets tests/chaos_mesh.rs exercise the SUBSTRATE
+# codec (`fountain_encode`/`fountain_decode`) directly — a real MEASURED proof,
+# not a reference stand-in.
+ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v8.3.0", features = ["codec-fountain"] }
+
+# PQC realtime-A/V streaming E2E benchmark (CIRISEdge#62 realtime_av profile).
+[[bench]]
+name = "pqc_av_streaming"
+harness = false
+
+# Replication / corpus-ingest throughput (the CEG-RC5 receive spine).
+[[bench]]
+name = "replication_ingest"
+harness = false
+
+# Multi-tier ALM relay chain (CIRISEdge#149 open_av_outer) — per-hop + per-depth
+# cost; the E2E byte-survival invariant is gated in tests/alm_chain.rs.
+[[bench]]
+name = "alm_chain"
+harness = false
+
+# Sustained multi-stream seal throughput — measures the actual core-fraction to
+# seal N blob streams @30fps in a real loop (promotes the page's "2,000 blob
+# streams ≈ 6-10% of a core" from arithmetic to MEASURED).
+[[bench]]
+name = "stream_fanout"
+harness = false
+
+# N_eff capacity-scoring microbench — the lens constraint eigenspectrum pipeline
+# (ciris_server::scorer::n_eff). Feature-matrix build + Jacobi eigendecomposition
+# + PR/entropy derivation: the per-agent per-cadence-tick CPU cost of
+# `capacity:sustained_coherence:v1`. CI-runnable (pure arithmetic, no network,
+# no database).
+[[bench]]
+name = "n_eff_scoring"
+harness = false
+
+# Erasure-survival bench — EMPIRICAL reconstruction rate against the real substrate
+# fountain codec (edge codec-fountain / RaptorQ). Encodes a blob into H holders, drops
+# holders by a per-availability-tier Bernoulli(q) coin, runs many real decode trials,
+# and writes the measured p_reconstruct per tier to target/erasure_survival.json (read
+# by the scoreboard). `harness = false` — survival is a rate, not a latency. Codec is
+# dev-only, so this measurement lives in a bench. `cargo bench --bench erasure_survival`.
+[[bench]]
+name = "erasure_survival"
+harness = false
+
+# Signature-overhead micro-bench — per-event sign+verify latency for classical
+# (Ed25519-only) vs hybrid (Ed25519 + ML-DSA-65, the production provenance signature),
+# using the substrate's REAL ciris_crypto primitives. The scoreboard derives the honest
+# "+N%" post-quantum overhead from the two criterion medians. `cargo bench --bench sig_overhead`.
+[[bench]]
+name = "sig_overhead"
+harness = false
+
+# Mesh-propagation benchmark — N in-process software-key nodes; ONE group-A
+# publisher advertises a synthetic "video" and a FountainSwarmRuntime per node
+# converges the holding-claim to its cohort ONLY. Measures propagation latency /
+# fan-out / group isolation / throughput over an in-memory bus (swarm LOGIC +
+# cohort gate, not wire transport). `cargo run --example mesh_propagation`.
+[[example]]
+name = "mesh_propagation"
+path = "examples/mesh_propagation/main.rs"
+
+[profile.release]
+# panic strategy stays "unwind" (the Win7 build-std lane relies on this being
+# pinned here, not on the build-std crate list — see release.yml win7 lane).
+panic = "unwind"
+strip = false   # release workflow strips per-target after build

{ciris_server-0.5.73 → ciris_server-0.5.74}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ciris-server
-Version: 0.5.73
+Version: 0.5.74
 License-File: LICENSE
 Summary: The fabric node — the federation's headless cohabitation runtime (registry + lens [+ node] over one shared substrate), as the abi3 wheel CIRISAgent consumes. agent = fabric node + brain.
 Author-email: Eric Moore <eric@ciris.ai>

{ciris_server-0.5.73 → ciris_server-0.5.74}/src/lib.rs

@@ -507,6 +507,106 @@ pub fn log_dir_from_args(args: &[String]) -> std::path::PathBuf {
         .join("logs")
 }
 
+// ── `config set/get` console subcommand (shared by the binary AND the wheel) ──
+// These live in the LIB (not `src/main.rs`) so the pip console-script — which
+// enters through `python::py_main`, NOT the binary's `main()` — has the exact
+// same `ciris-server config set/get` surface. Before this, `config` was only in
+// the binary, so the published WHEEL/image `ciris-server` had no way to set
+// boot-structural knobs (e.g. `net.announce_ownership`) on a headless node
+// (CIRISServer mesh-seed blocker: Node A runs the wheel, couldn't self-configure).
+
+/// `ciris-server config set <key> <json-value> [--home <path>] [--key-id <name>]
+/// [--reason <text>]` — write a node-signed `config:*` object from the console.
+/// JSON-first value parse (`'["a:1"]'`→List, `true`→Bool, `7`→I64), bare-string
+/// fallback. Used by the headless/no-session path.
+pub async fn run_config_set_cli(mut args: impl Iterator<Item = String>) -> anyhow::Result<()> {
+    use anyhow::Context;
+    let mut home: Option<String> = None;
+    let mut key_id = config::DEFAULT_KEY_ID.to_string();
+    let mut reason = "console-cli".to_string();
+    let mut key: Option<String> = None;
+    let mut value_raw: Option<String> = None;
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "--home" => home = Some(args.next().context("--home needs a path")?),
+            "--key-id" => key_id = args.next().context("--key-id needs a name")?,
+            "--reason" => reason = args.next().context("--reason needs a value")?,
+            other if other.starts_with("--") => {
+                return Err(anyhow::anyhow!("unknown config-set arg: {other}"))
+            }
+            positional => {
+                if key.is_none() {
+                    key = Some(positional.to_string());
+                } else if value_raw.is_none() {
+                    value_raw = Some(positional.to_string());
+                } else {
+                    return Err(anyhow::anyhow!(
+                        "unexpected extra config-set arg: {positional}"
+                    ));
+                }
+            }
+        }
+    }
+    let key = key.context("config set requires <key> (e.g. net.announce_ownership)")?;
+    let value_raw = value_raw
+        .context("config set requires <json-value> (e.g. true or '[\"108.61.242.236:4242\"]')")?;
+    let value = parse_config_value(&value_raw);
+    let home = home.unwrap_or_else(|| config::DEFAULT_CIRIS_HOME.to_string());
+    let cfg = config::ServerConfig::from_home(std::path::PathBuf::from(home), key_id)?;
+    let entry = run_config_set(cfg, &key, value, &reason).await?;
+    println!(
+        "✅ config set {} (version {}, authored by {})",
+        entry.key, entry.version, entry.updated_by
+    );
+    println!("{}", serde_json::to_string_pretty(&entry.value)?);
+    Ok(())
+}
+
+/// `ciris-server config get <key> [--home <path>] [--key-id <name>]` — read the
+/// latest-wins `config:*` value from the console.
+pub async fn run_config_get_cli(mut args: impl Iterator<Item = String>) -> anyhow::Result<()> {
+    use anyhow::Context;
+    let mut home: Option<String> = None;
+    let mut key_id = config::DEFAULT_KEY_ID.to_string();
+    let mut key: Option<String> = None;
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "--home" => home = Some(args.next().context("--home needs a path")?),
+            "--key-id" => key_id = args.next().context("--key-id needs a name")?,
+            other if other.starts_with("--") => {
+                return Err(anyhow::anyhow!("unknown config-get arg: {other}"))
+            }
+            positional => {
+                if key.is_none() {
+                    key = Some(positional.to_string());
+                } else {
+                    return Err(anyhow::anyhow!(
+                        "unexpected extra config-get arg: {positional}"
+                    ));
+                }
+            }
+        }
+    }
+    let key = key.context("config get requires <key> (e.g. net.announce_ownership)")?;
+    let home = home.unwrap_or_else(|| config::DEFAULT_CIRIS_HOME.to_string());
+    let cfg = config::ServerConfig::from_home(std::path::PathBuf::from(home), key_id)?;
+    match run_config_get(cfg, &key).await? {
+        Some(entry) => println!("{}", serde_json::to_string_pretty(&entry.value)?),
+        None => eprintln!("(no config for key {key:?})"),
+    }
+    Ok(())
+}
+
+/// Parse a `config set` value: JSON-first (so `'["a:1"]'`→List, `true`→Bool,
+/// `7`→I64), with a bare-string fallback.
+pub fn parse_config_value(raw: &str) -> ConfigValue {
+    match serde_json::from_str::<serde_json::Value>(raw) {
+        Ok(v) => serde_json::from_value::<ConfigValue>(v)
+            .unwrap_or_else(|_| ConfigValue::Str(raw.to_string())),
+        Err(_) => ConfigValue::Str(raw.to_string()),
+    }
+}
+
 // ── PyO3 abi3 wheel surface (the shape CIRISAgent consumes) ──────────────────
 // Gated behind the `python` feature so the binary never links libpython.
 #[cfg(feature = "python")]
@@ -552,6 +652,22 @@ mod python {
                 })?;
                 rt_block_on(crate::import_traces(&dir))
             }
+            // `ciris-server config set/get <key> [value] …` — node-signed
+            // `config:*` write/read from the console. This arm MUST live here (not
+            // just in the binary's `main()`) so the pip WHEEL/image `ciris-server`
+            // can set boot-structural knobs (e.g. `net.announce_ownership`,
+            // `net.bootstrap_peers`) on a headless node with no app/owner session.
+            Some("config") => {
+                let sub = args.next();
+                match sub.as_deref() {
+                    Some("set") => rt_block_on(crate::run_config_set_cli(args)),
+                    Some("get") => rt_block_on(crate::run_config_get_cli(args)),
+                    other => Err(pyo3::exceptions::PyRuntimeError::new_err(format!(
+                        "usage: ciris-server config set <key> <json-value> [--home <path>] [--key-id <name>]\n\
+                         \x20      ciris-server config get <key> [--home <path>] [--key-id <name>] (got {other:?})"
+                    ))),
+                }
+            }
             // Default-serve path. `first` is the already-consumed first token (a
             // leading flag like `--home`/`--key-id`, or `None` for a bare boot).
             // Parse it the SAME way the binary does so the WHEEL honors the flags

{ciris_server-0.5.73 → ciris_server-0.5.74}/src/main.rs

@@ -146,8 +146,8 @@ async fn main() -> Result<()> {
         // session). Lets a HEADLESS node set knobs (e.g. `net.bootstrap_peers`) that
         // otherwise only the app/owner-session `/v1/config` surface could reach.
         Some("config") => match args.next().as_deref() {
-            Some("set") => run_config_set_cli(args).await,
-            Some("get") => run_config_get_cli(args).await,
+            Some("set") => ciris_server::run_config_set_cli(args).await,
+            Some("get") => ciris_server::run_config_get_cli(args).await,
             other => Err(anyhow::anyhow!(
                 "usage: ciris-server config set <key> <json-value> [--home <path>] \
                  [--key-id <alias>] [--reason <text>]\n       ciris-server config get <key> \
@@ -414,101 +414,6 @@ async fn run_claim(mut args: impl Iterator<Item = String>) -> Result<()> {
     Ok(())
 }
 
-/// `ciris-server config set <key> <json-value> …` — write a signed `config:v1` CEG
-/// object from the console (node-signed; the SAME path the node + `/v1/config` use).
-async fn run_config_set_cli(mut args: impl Iterator<Item = String>) -> Result<()> {
-    use ciris_server::config::{DEFAULT_CIRIS_HOME, DEFAULT_KEY_ID};
-
-    let mut home: Option<String> = None;
-    let mut key_id = DEFAULT_KEY_ID.to_string();
-    let mut reason = "console-cli".to_string();
-    let mut key: Option<String> = None;
-    let mut value_raw: Option<String> = None;
-    while let Some(arg) = args.next() {
-        match arg.as_str() {
-            "--home" => home = Some(args.next().context("--home needs a path")?),
-            "--key-id" => key_id = args.next().context("--key-id needs a name")?,
-            "--reason" => reason = args.next().context("--reason needs a value")?,
-            other if other.starts_with("--") => {
-                return Err(anyhow::anyhow!("unknown config-set arg: {other}"));
-            }
-            positional => {
-                if key.is_none() {
-                    key = Some(positional.to_string());
-                } else if value_raw.is_none() {
-                    value_raw = Some(positional.to_string());
-                } else {
-                    return Err(anyhow::anyhow!(
-                        "unexpected extra config-set arg: {positional}"
-                    ));
-                }
-            }
-        }
-    }
-    let key = key.context("config set requires <key> (e.g. net.bootstrap_peers)")?;
-    let value_raw =
-        value_raw.context("config set requires <json-value> (e.g. '[\"108.61.242.236:4242\"]')")?;
-    let value = parse_config_value(&value_raw);
-
-    let home = home.unwrap_or_else(|| DEFAULT_CIRIS_HOME.to_string());
-    let cfg = ciris_server::ServerConfig::from_home(std::path::PathBuf::from(home), key_id)?;
-    let entry = ciris_server::run_config_set(cfg, &key, value, &reason).await?;
-    println!(
-        "✅ config set {} (version {}, authored by {})",
-        entry.key, entry.version, entry.updated_by
-    );
-    println!("{}", serde_json::to_string_pretty(&entry.value)?);
-    Ok(())
-}
-
-/// `ciris-server config get <key> …` — read the latest-wins value of a `config:*`
-/// key from the node's signed store (prints JSON; unset ⇒ a note on stderr).
-async fn run_config_get_cli(mut args: impl Iterator<Item = String>) -> Result<()> {
-    use ciris_server::config::{DEFAULT_CIRIS_HOME, DEFAULT_KEY_ID};
-
-    let mut home: Option<String> = None;
-    let mut key_id = DEFAULT_KEY_ID.to_string();
-    let mut key: Option<String> = None;
-    while let Some(arg) = args.next() {
-        match arg.as_str() {
-            "--home" => home = Some(args.next().context("--home needs a path")?),
-            "--key-id" => key_id = args.next().context("--key-id needs a name")?,
-            other if other.starts_with("--") => {
-                return Err(anyhow::anyhow!("unknown config-get arg: {other}"));
-            }
-            positional => {
-                if key.is_none() {
-                    key = Some(positional.to_string());
-                } else {
-                    return Err(anyhow::anyhow!(
-                        "unexpected extra config-get arg: {positional}"
-                    ));
-                }
-            }
-        }
-    }
-    let key = key.context("config get requires <key> (e.g. net.bootstrap_peers)")?;
-    let home = home.unwrap_or_else(|| DEFAULT_CIRIS_HOME.to_string());
-    let cfg = ciris_server::ServerConfig::from_home(std::path::PathBuf::from(home), key_id)?;
-    match ciris_server::run_config_get(cfg, &key).await? {
-        Some(entry) => println!("{}", serde_json::to_string_pretty(&entry.value)?),
-        None => eprintln!("(config key {key:?} is unset)"),
-    }
-    Ok(())
-}
-
-/// Parse a `config set` value: **JSON first** (so `'["1.2.3.4:4242"]'` → list,
-/// `'true'` → bool, `'7'` → int, `'"foo"'` → string), falling back to a bare string
-/// for a non-JSON token (so `config set node.alias mynode` records the string
-/// `"mynode"` rather than erroring).
-fn parse_config_value(raw: &str) -> ciris_server::ConfigValue {
-    match serde_json::from_str::<serde_json::Value>(raw) {
-        Ok(v) => serde_json::from_value::<ciris_server::ConfigValue>(v)
-            .unwrap_or_else(|_| ciris_server::ConfigValue::Str(raw.to_string())),
-        Err(_) => ciris_server::ConfigValue::Str(raw.to_string()),
-    }
-}
-
 /// Today's date in UTC as `YYYY-MM-DD` (the default `--date` for `bench-results`,
 /// overridable so a CI run can stamp the exact build date).
 fn current_utc_date() -> String {