ciris-server 0.5.76__tar.gz → 0.5.78__tar.gz

{ciris_server-0.5.76 → ciris_server-0.5.78}/Cargo.lock

@@ -821,8 +821,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-edge"
-version = "8.4.1"
-source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v8.4.1#a95680eb01ca27c034a75a6e44b0674f2e9681ca"
+version = "8.6.1"
+source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v8.6.1#acf26ce7cfe01aee5400c7e01dbd9d5b2e797d9b"
 dependencies = [
  "async-trait",
  "axum",
@@ -943,8 +943,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-persist"
-version = "12.0.1"
-source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v12.0.1#6cf472a2be325210c9d5da122fac61fb092aad40"
+version = "12.2.0"
+source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v12.2.0#766212c92b52f27f7bf35779bf99f692d6b6a8d0"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -983,7 +983,7 @@ dependencies = [
 
 [[package]]
 name = "ciris-server"
-version = "0.5.76"
+version = "0.5.78"
 dependencies = [
  "anyhow",
  "async-trait",

{ciris_server-0.5.76 → ciris_server-0.5.78}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ciris-server"
-version = "0.5.76" # 0.5.76 = v12.0 GENESIS-MESH adoption + the accord ADMIT-NODE card. Substrate co-bump: verify v8.3.0->v8.5.0 (CIRISVerify#162 produce_scrubbed_key_record) / persist v11.9.1->v12.0.1 (root_binding anchors to the HUMANITY_ACCORD holder keyset, #344/#345) / edge v8.3.0->v8.4.1 (lockstep). NEW: POST /v1/accord/admit-node (src/accord_provision.rs) — an accord holder scrub-signs a node registration on their portable YubiKey+USB holder signer (reuses the ceremony cosign path) via produce_scrubbed_key_record + produce_self_key_record("steward,accord_holder"), saving the genesis SEED object to ceg_outbox()/accord_admit_node/{target}.json (predictable, persist-ingestable) for CIRISPersist v12.0.2 to bake. QA gate tests/accord_admit_node.rs (emulates the accord-genesis QA): the scrubbed record survives persist STRICT register_federation_key + ROOTS at the accord anchor (root_binding_anchored=Confirmed), wrong-anchor rejected. Matching CLIENT card: AdmitNodeResponse DTO + CIRISApiClient.admitNode() + AccordViewModel.admitNode() + AccordScreen "Admit node to trust root" section (testable tags). App holds no keys; the YubiKey touch is consent. NEXT (0.5.77): roster labels, rotation/lost-key wizard (server family/change+supersede exist), partial-consensus announce. 0.5.75 = RNS rooting + hybrid keys.
+version = "0.5.78" # 0.5.78 = edge v8.6.1 / persist v12.2.0 adoption — the COMPLETE admit-node → mesh-seed loop. (1) #144 KEY-PLANE replication (KERI publish-own): the ReplicationRuntime converges an EnvelopeKind::Key coordinator per consent peer + a key_selector publishing the node's OWN key_id. (2) #150 PRODUCER: admit-node now calls persist v12.2.0 Engine::adopt_scrub_upgrade (CIRISPersist#351) to upgrade the node's own self-signed row to the accord-holder-scrubbed record — so the Key plane publishes an ANCHORED, rootable record → peers root it. Producer (server upgrades the row) + publish-own (edge advertises it) = the seed closes in place, no wipe. (3) #147 §Q B5: persist FountainHeldMeta.{content_bytes,cohort_scope} adopted (server has no fountain-content admit path; import.rs already sets cohort_scope). Verify unchanged v8.5.0. 0.5.77 = persist v12.0.2 anchor seed + accord-card UX.
 edition = "2021"
 # MSRV floor is set by the substrate: ciris-verify v5.2.0 requires 1.86
 # (persist v6.0.1 is 1.83). Build with the higher of the two.
@@ -123,8 +123,8 @@ ciris-lens-core     = { path = "crates/ciris-lens-core" } # ABSORBED in-tree (wo
 # `cirislens_wa_cert` + `cirislens_service_token_revocation` expose the auth
 # substrate the fabric absorbs (CIRISServer#9, src/auth): the agent's `wa_cert`
 # table (users/WA/OAuth/api-keys) + the `revoked_service_tokens` table.
-ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v12.0.1", features = ["sqlite", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
-ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v8.4.1", features = ["transport-reticulum", "transport-http", "transport-packet-radio"] }
+ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v12.2.0", features = ["sqlite", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
+ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v8.6.1", features = ["transport-reticulum", "transport-http", "transport-packet-radio"] }
 # Founder-quorum verification + key-id fingerprint at the composition root
 # (threshold:: module path — NOT re-exported at the crate root).
 # LOCKSTEP: persist v9.4.0 transitively pins verify-core v6.6.x — the whole
@@ -206,7 +206,7 @@ tracing-appender = "0.2"
 # - keyring `tpm` (tss-esapi / TPM 2.0) — the real hardware backend; needs
 #   libtss2 (Linux build dep). Other targets keep the software keystore.
 [target.'cfg(target_os = "linux")'.dependencies]
-ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v12.0.1", features = ["postgres", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v12.2.0", features = ["postgres", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
 # keyring `tpm` (TPM-at-rest, Linux-only via tss-esapi). `pkcs11` is no longer
 # per-target — it rides the global `pkcs11` feature now that cryptoki builds on all
 # targets (CIRISVerify v6.12.0).
@@ -259,7 +259,7 @@ ciris-crypto  = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.5.0"
 # and never encodes/decodes). This lets tests/chaos_mesh.rs exercise the SUBSTRATE
 # codec (`fountain_encode`/`fountain_decode`) directly — a real MEASURED proof,
 # not a reference stand-in.
-ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v8.4.1", features = ["codec-fountain"] }
+ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v8.6.1", features = ["codec-fountain"] }
 
 # PQC realtime-A/V streaming E2E benchmark (CIRISEdge#62 realtime_av profile).
 [[bench]]

{ciris_server-0.5.76 → ciris_server-0.5.78}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ciris-server
-Version: 0.5.76
+Version: 0.5.78
 License-File: LICENSE
 Summary: The fabric node — the federation's headless cohabitation runtime (registry + lens [+ node] over one shared substrate), as the abi3 wheel CIRISAgent consumes. agent = fabric node + brain.
 Author-email: Eric Moore <eric@ciris.ai>

{ciris_server-0.5.76 → ciris_server-0.5.78}/crates/ciris-lens-core/Cargo.toml

@@ -26,8 +26,8 @@ crate-type = ["cdylib", "rlib"]
 #
 # OQ-01 closure 2026-05-03: rlib primary, PyO3 cdylib via `python`
 # feature for the deployed-lens cutover.
-ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v12.0.1", version = "12", features = ["extract", "sqlite"] }
-ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge",    tag = "v8.4.1", version = "8", features = ["transport-http", "transport-reticulum"] }
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v12.2.0", version = "12", features = ["extract", "sqlite"] }
+ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge",    tag = "v8.6.1", version = "8", features = ["transport-http", "transport-reticulum"] }
 
 # Keyring — relay mode (CIRISLensCore#10) loads its Edge transport-
 # signing identity via `ciris_keyring::load_local_seed`. Edge's

{ciris_server-0.5.76 → ciris_server-0.5.78}/src/accord_provision.rs

@@ -1048,7 +1048,7 @@ fn default_admit_identity_type() -> String {
 /// (the predictable, persist-ingestable path the operator hands to CIRISPersist
 /// v12.0.2 to bake) and returned. **1-of-N bootstrap:** a single holder suffices —
 /// this is a trust EXTENSION, not the 2/3 kill-switch. Loopback + `pkcs11`-gated.
-async fn admit_node(State(_st): State<ProvisionState>, body: axum::body::Bytes) -> Response {
+async fn admit_node(State(st): State<ProvisionState>, body: axum::body::Bytes) -> Response {
     let req: AdmitNodeRequest = match serde_json::from_slice(&body) {
         Ok(r) => r,
         Err(e) => return err(StatusCode::BAD_REQUEST, &format!("bad request: {e}")),
@@ -1082,11 +1082,11 @@ async fn admit_node(State(_st): State<ProvisionState>, body: axum::body::Bytes)
             "target key_id contains path separators — refusing to write it",
         );
     }
-    admit_node_impl(req).await
+    admit_node_impl(st.engine, req).await
 }
 
 #[cfg(not(feature = "pkcs11"))]
-async fn admit_node_impl(_req: AdmitNodeRequest) -> Response {
+async fn admit_node_impl(_engine: Arc<Engine>, _req: AdmitNodeRequest) -> Response {
     err(
         StatusCode::NOT_IMPLEMENTED,
         "admit-node needs the `pkcs11` feature (the holder's YubiKey + USB-wrapped ML-DSA signer)",
@@ -1094,7 +1094,7 @@ async fn admit_node_impl(_req: AdmitNodeRequest) -> Response {
 }
 
 #[cfg(feature = "pkcs11")]
-async fn admit_node_impl(req: AdmitNodeRequest) -> Response {
+async fn admit_node_impl(engine: Arc<Engine>, req: AdmitNodeRequest) -> Response {
     use std::path::PathBuf;
     use std::sync::Arc;
 
@@ -1253,10 +1253,48 @@ async fn admit_node_impl(req: AdmitNodeRequest) -> Response {
         );
     }
 
+    // #150 — PRODUCER: adopt the scrubbed record onto this node's OWN directory row
+    // (persist v12.2.0 `Engine::adopt_scrub_upgrade`, CIRISPersist#351). When the
+    // target IS this node, its boot-time self-signed own-key row is upgraded to the
+    // accord-holder-scrubbed record, so the Key plane (edge publish-own) advertises
+    // an ANCHORED, rootable record and consent peers root it. The primitive is
+    // self-gating (verifies the scrub sig + only upgrades a self-signed → scrubbed
+    // row for the SAME key_id/pubkey), so we call it unconditionally: a target whose
+    // row isn't a valid local upgrade returns Err and we report it without failing
+    // the outbox write (the JSON is still the transport for a remote target / bake).
+    let applied: serde_json::Value = match serde_json::to_value(&scrubbed)
+        .and_then(serde_json::from_value::<ciris_persist::federation::SignedKeyRecord>)
+    {
+        Ok(persist_rec) => match engine.adopt_scrub_upgrade(persist_rec).await {
+            Ok(outcome) => {
+                tracing::info!(
+                    target_key_id = %req.target.key_id.trim(),
+                    ?outcome,
+                    "admit-node: adopted the scrubbed record onto the local directory row"
+                );
+                serde_json::json!({ "adopted": true, "outcome": format!("{outcome:?}") })
+            }
+            Err(e) => {
+                tracing::warn!(
+                    target_key_id = %req.target.key_id.trim(),
+                    error = %e,
+                    "admit-node: scrubbed record NOT adopted locally (not this node's own \
+                     self-signed row?) — seed JSON saved for transport/bake"
+                );
+                serde_json::json!({ "adopted": false, "reason": e.to_string() })
+            }
+        },
+        Err(e) => {
+            tracing::warn!(error = %e, "admit-node: scrubbed record convert for local adoption");
+            serde_json::json!({ "adopted": false, "reason": format!("record convert: {e}") })
+        }
+    };
+
     (
         StatusCode::OK,
         Json(serde_json::json!({
             "saved_to": out_path.display().to_string(),
+            "applied": applied,
             "seed": seed,
         })),
     )

{ciris_server-0.5.76 → ciris_server-0.5.78}/src/compose.rs

@@ -1352,18 +1352,42 @@ async fn setup_peer_replication(
     //    health:liveness in. v5.1.0 `start` installs the scheduler control channel
     //    unconditionally, so the runtime accepts `set_peers` mutation with no
     //    extra opt-in (CIRISEdge#173 resolved).
+    // Two coordinators per consent peer: Attestation (capacity:* / health:liveness)
+    // AND Key (#144, CIRISEdge#257 — the KERI publish-own key plane). The reconciler
+    // (replication_reconcile.rs) converges the same pair set at runtime.
     let peers: Vec<ReplicationPeer> = desired
         .iter()
-        .map(|p| ReplicationPeer {
-            peer_key_id: p.clone(),
-            kind: EnvelopeKind::Attestation,
+        .flat_map(|p| {
+            [
+                ReplicationPeer {
+                    peer_key_id: p.clone(),
+                    kind: EnvelopeKind::Attestation,
+                },
+                ReplicationPeer {
+                    peer_key_id: p.clone(),
+                    kind: EnvelopeKind::Key,
+                },
+            ]
         })
         .collect();
+
+    // Key-plane publish selector (CIRISEdge#257 / edge v8.6.0): the Key plane's
+    // `list_keys` advertises the key_ids THIS selector yields — the node's OWN
+    // record — instead of the cohort's-own-keys projection. `list_keys` re-reads
+    // the record live each tick, so once admit-node scrub-signs this node's own
+    // record (scrub_key_id = an accord holder), the NEXT anti-entropy round
+    // publishes the scrubbed, ANCHORED record to consent peers → they root it.
+    // (KERI publish-own: the controller publishes its own establishment record.)
+    let own_key_id = cfg.key_id.clone();
+    let key_selector: ciris_edge::replication::CohortProvider =
+        Arc::new(move || vec![own_key_id.clone()]);
+
     let runtime = ReplicationRuntime::start(
         directory,
         transport as Arc<dyn ciris_edge::transport::Transport>,
         peers,
         ReplicationRuntimeConfig::default(),
+        Some(key_selector),
     )
     .await;
 

{ciris_server-0.5.76 → ciris_server-0.5.78}/src/federation_peers.rs

@@ -80,6 +80,11 @@ fn err(code: StatusCode, error: &str) -> Response {
 struct LocalPeerState {
     key_id: String,
     pubkey_ed25519_base64: String,
+    /// The ML-DSA-65 half (present on a hybrid-complete row; `None` on a legacy
+    /// bookmark). Projected so the accord admit-node card can auto-fill BOTH of a
+    /// selected owned node's pubkeys from the local directory — no manual paste.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pubkey_ml_dsa_65_base64: Option<String>,
     canonical: bool,
     /// One of "trusted"|"untrusted"|"blocked"|"unknown". A directory row is an
     /// admitted key ⇒ "trusted".
@@ -104,6 +109,7 @@ fn to_peer(rec: KeyRecord) -> LocalPeerState {
     LocalPeerState {
         key_id: rec.key_id,
         pubkey_ed25519_base64: rec.pubkey_ed25519_base64,
+        pubkey_ml_dsa_65_base64: rec.pubkey_ml_dsa_65_base64,
         canonical,
         trust: "trusted",
         first_seen: rec.valid_from.to_rfc3339(),

{ciris_server-0.5.76 → ciris_server-0.5.78}/src/holonomic.rs

@@ -185,6 +185,8 @@ mod tests {
             min_viable_symbols: 6,
             symbol_size: 256,
             held_symbols: 5,
+            content_bytes: 1280,
+            cohort_scope: Some("federation".to_string()),
             recoverable: false,
             admitted_at: "2026-06-21T00:00:00Z".to_string(),
         };
@@ -207,6 +209,8 @@ mod tests {
             min_viable_symbols: 1,
             symbol_size: 1,
             held_symbols: 0,
+            content_bytes: 0,
+            cohort_scope: None,
             recoverable: false,
             admitted_at: "2026-06-21T00:00:00Z".to_string(),
         };

{ciris_server-0.5.76 → ciris_server-0.5.78}/src/replication_reconcile.rs

@@ -68,13 +68,25 @@ pub async fn reconcile_once(
     // EnvelopeKind::Attestation carries BOTH directions (capacity:* out,
     // health:liveness in).
     let directory = engine.federation_directory();
-    let mut desired: Vec<ReplicationPeer> = Vec::with_capacity(consented.len());
+    let mut desired: Vec<ReplicationPeer> = Vec::with_capacity(consented.len() * 2);
     for peer in consented {
         match directory.lookup_public_key(&peer).await {
-            Ok(Some(_)) => desired.push(ReplicationPeer {
-                peer_key_id: peer,
-                kind: EnvelopeKind::Attestation,
-            }),
+            Ok(Some(_)) => {
+                // BOTH planes per admitted peer:
+                //  - Attestation: capacity:* out, health:liveness in (as before).
+                //  - Key (#144, CIRISEdge#257): the KEY-PLANE anti-entropy. Paired
+                //    with the runtime's `key_selector` (publishes the node's OWN
+                //    record — KERI publish-own), this converges a node's scrub-signed
+                //    accord-anchored record to its consent peers so they can ROOT it.
+                desired.push(ReplicationPeer {
+                    peer_key_id: peer.clone(),
+                    kind: EnvelopeKind::Attestation,
+                });
+                desired.push(ReplicationPeer {
+                    peer_key_id: peer,
+                    kind: EnvelopeKind::Key,
+                });
+            }
             Ok(None) => tracing::warn!(
                 peer_key_id = %peer,
                 "consent:replication observed for an UNADMITTED peer key — skipping reconcile for \
@@ -91,7 +103,9 @@ pub async fn reconcile_once(
     // Diff-converge the live Initiator set to the desired consent peers. Adds
     // become active Initiators (scheduler-driven pull) at runtime; removals stop
     // their rounds + drop inbound routing — all without a restart.
-    let count = desired.len();
+    // `desired` holds TWO coordinators per peer (Attestation + Key); the reported
+    // count is distinct consent peers.
+    let count = desired.len() / 2;
     if let Err(e) = runtime.set_peers(desired).await {
         // The runtime's scheduler has stopped (shutdown) — surface so the caller
         // logs + skips; the controller never panics.

{ciris_server-0.5.76 → ciris_server-0.5.78}/tests/accord.rs

@@ -859,7 +859,11 @@ async fn genesis_refuses_a_member_that_is_not_a_custody_verified_accord_holder()
         "rejection must name the non-holder member; got {body}"
     );
 
-    // No family was entrenched.
+    // The rejected genesis must not entrench THIS test's family. (Every node now
+    // seeds + bakes the canonical HUMANITY_ACCORD genesis A1/B1/C1 — persist
+    // v12.0.2 / verify v8.5.0 — so `family_established` is baseline-true and the
+    // seats are the baked A1/B1/C1; that is orthogonal to this test. What must
+    // hold is that NONE of the proposed test members became a seat.)
     let roster: serde_json::Value = client
         .get(format!("{base}/v1/accord-holders"))
         .send()
@@ -868,10 +872,13 @@ async fn genesis_refuses_a_member_that_is_not_a_custody_verified_accord_holder()
         .json()
         .await
         .unwrap();
-    assert_eq!(
-        roster["family_established"], false,
-        "a rejected genesis must not entrench a family"
-    );
+    let seats = roster["holders"].as_array().expect("holders array");
+    for member in ["seat-a", "seat-b", "outsider-not-a-holder"] {
+        assert!(
+            !seats.iter().any(|h| h["key_id"] == member),
+            "a rejected genesis must not entrench member {member}; got {roster}"
+        );
+    }
 }
 
 // ─── Operational halt (CC 4.2.1 / 4.2.3 / §9.2.1) — the enforceable kill-switch ─
@@ -1116,10 +1123,21 @@ async fn registered_spare_is_not_a_seat_and_cannot_help_reach_quorum() {
         .await
         .unwrap();
     assert_eq!(roster["seat_count"], 3, "exactly 3 seats; got {roster}");
-    assert_eq!(
-        roster["registered_total"], 4,
-        "3 seats + 1 spare registered"
-    );
+    // This test's 3 seats + 1 spare are ALL registered accord_holders. (Every node
+    // also seeds the baked A1/B1/C1 canonical genesis — persist v12.0.2 — so assert
+    // membership rather than an exact `registered_total`, which now baselines +3.)
+    let registered = roster["registered"].as_array().expect("registered array");
+    for kid in [
+        "accord-holder-a",
+        "accord-holder-b",
+        "accord-holder-c",
+        "accord-holder-a-spare",
+    ] {
+        assert!(
+            registered.iter().any(|h| h["key_id"] == kid),
+            "the 3 seats + spare must all be registered; missing {kid}; got {roster}"
+        );
+    }
     assert!(
         !roster["holders"]
             .as_array()

{ciris_server-0.5.76 → ciris_server-0.5.78}/tests/accord_admit_node.rs

@@ -159,3 +159,109 @@ async fn admit_node_scrubbed_record_roots_at_accord_anchor() {
         "must NOT root when A1 is not a pinned anchor, got {verdict_wrong:?}"
     );
 }
+
+/// The PRODUCER path (CIRISServer#150 / CIRISPersist#351): a node that already
+/// holds its boot-time **self-signed** own-key row upgrades that row IN PLACE to
+/// the accord-holder-scrubbed record via `Engine::adopt_scrub_upgrade` (the old
+/// `register_federation_key` is `ON CONFLICT DO NOTHING` and would have left the
+/// self-signed row). After the upgrade the row ROOTS at the anchor, and a second
+/// apply is idempotent — exactly what admit-node relies on to publish an anchored
+/// record over the Key plane.
+#[tokio::test]
+async fn adopt_scrub_upgrade_promotes_self_signed_own_row_and_roots() {
+    use ciris_persist::federation::register::AdoptScrubOutcome;
+
+    let engine = node().await;
+    let now = chrono::Utc::now().to_rfc3339();
+
+    let a1 = HybridSigningIdentity::generate("humanity-accord-a1-test").expect("gen A1");
+    let anchor = produce_self_key_record(&a1, "steward,accord_holder", &now)
+        .await
+        .expect("A1 anchor");
+    let a1_ed_b64 = anchor.record.pubkey_ed25519_base64.clone();
+    engine
+        .register_federation_key(to_persist(&anchor))
+        .await
+        .expect("register A1 anchor");
+
+    // The node's boot-time state: its OWN row, SELF-signed.
+    let target = HybridSigningIdentity::generate("canonical-server-1-test").expect("gen target");
+    let target_self = produce_self_key_record(&target, "node", &now)
+        .await
+        .expect("target self record");
+    let target_ed_b64 = target_self.record.pubkey_ed25519_base64.clone();
+    let target_mldsa_b64 = target_self
+        .record
+        .pubkey_ml_dsa_65_base64
+        .clone()
+        .expect("target ml_dsa");
+    engine
+        .register_federation_key(to_persist(&target_self))
+        .await
+        .expect("register target SELF-signed own row");
+
+    // Precondition: a self-signed row does NOT root.
+    let backend = engine.sqlite_backend().expect("sqlite backend");
+    let anchor_set = [ed32(&a1_ed_b64)];
+    assert!(
+        !matches!(
+            root_binding_anchored(
+                backend.as_ref(),
+                "canonical-server-1-test",
+                &target_ed_b64,
+                &anchor_set
+            )
+            .await,
+            RootingVerdict::Confirmed { .. }
+        ),
+        "precondition: the self-signed own row must NOT root yet"
+    );
+
+    // A1 scrub-signs the target, and the node ADOPTS the upgrade onto its own row.
+    let scrubbed = produce_scrubbed_key_record(
+        &a1,
+        ScrubTarget {
+            key_id: "canonical-server-1-test".to_string(),
+            pubkey_ed25519_base64: target_ed_b64.clone(),
+            pubkey_ml_dsa_65_base64: target_mldsa_b64,
+            identity_type: "node".to_string(),
+        },
+        &now,
+    )
+    .await
+    .expect("A1 scrub-signs target");
+
+    let outcome = engine
+        .adopt_scrub_upgrade(to_persist(&scrubbed))
+        .await
+        .expect("adopt_scrub_upgrade must succeed on a self-signed own row");
+    assert!(
+        matches!(outcome, AdoptScrubOutcome::Upgraded),
+        "first adopt upgrades the self-signed row, got {outcome:?}"
+    );
+
+    // Now the SAME key_id ROOTS — the Key plane would publish an anchored record.
+    assert!(
+        matches!(
+            root_binding_anchored(
+                backend.as_ref(),
+                "canonical-server-1-test",
+                &target_ed_b64,
+                &anchor_set
+            )
+            .await,
+            RootingVerdict::Confirmed { .. }
+        ),
+        "after adopt the own row must ROOT at the accord anchor"
+    );
+
+    // Idempotent: re-applying the same outbox record is a no-op (second boot).
+    let again = engine
+        .adopt_scrub_upgrade(to_persist(&scrubbed))
+        .await
+        .expect("re-adopt must not error");
+    assert!(
+        matches!(again, AdoptScrubOutcome::AlreadyAdopted),
+        "second adopt is idempotent, got {again:?}"
+    );
+}