ciris-server 0.5.77__tar.gz → 0.5.78__tar.gz

{ciris_server-0.5.77 → ciris_server-0.5.78}/Cargo.lock

@@ -821,8 +821,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-edge"
-version = "8.4.2"
-source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v8.4.2#fa66d9319f9293b718d07ae22fde7342e93a0b7e"
+version = "8.6.1"
+source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v8.6.1#acf26ce7cfe01aee5400c7e01dbd9d5b2e797d9b"
 dependencies = [
  "async-trait",
  "axum",
@@ -943,8 +943,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-persist"
-version = "12.0.2"
-source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v12.0.2#883349f4e68b58de0a1905c37ad98ab55a80e918"
+version = "12.2.0"
+source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v12.2.0#766212c92b52f27f7bf35779bf99f692d6b6a8d0"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -983,7 +983,7 @@ dependencies = [
 
 [[package]]
 name = "ciris-server"
-version = "0.5.77"
+version = "0.5.78"
 dependencies = [
  "anyhow",
  "async-trait",

{ciris_server-0.5.77 → ciris_server-0.5.78}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ciris-server"
-version = "0.5.77" # 0.5.77 = persist v12.0.2 (the accord-holder anchor SEED — CIRISPersist#347, seeds A1/B1/C1 at first boot) + edge v8.4.2 adoption, + accord-card UX polish: (1) lists the holder roster, (2) SELECT the holder from the roster (dropdown) instead of typing, (3) SELECT the target from owned-nodes → auto-fills both hybrid pubkeys from the local directory (added pubkey_ml_dsa_65 to LocalPeerState / GET /v1/federation/peers), (4) BROWSE for the USB PQC folder (DirectoryPicker). Verify unchanged v8.5.0. 0.5.76 = the admit-node card + v12.0 adoption.
+version = "0.5.78" # 0.5.78 = edge v8.6.1 / persist v12.2.0 adoption — the COMPLETE admit-node → mesh-seed loop. (1) #144 KEY-PLANE replication (KERI publish-own): the ReplicationRuntime converges an EnvelopeKind::Key coordinator per consent peer + a key_selector publishing the node's OWN key_id. (2) #150 PRODUCER: admit-node now calls persist v12.2.0 Engine::adopt_scrub_upgrade (CIRISPersist#351) to upgrade the node's own self-signed row to the accord-holder-scrubbed record — so the Key plane publishes an ANCHORED, rootable record → peers root it. Producer (server upgrades the row) + publish-own (edge advertises it) = the seed closes in place, no wipe. (3) #147 §Q B5: persist FountainHeldMeta.{content_bytes,cohort_scope} adopted (server has no fountain-content admit path; import.rs already sets cohort_scope). Verify unchanged v8.5.0. 0.5.77 = persist v12.0.2 anchor seed + accord-card UX.
 edition = "2021"
 # MSRV floor is set by the substrate: ciris-verify v5.2.0 requires 1.86
 # (persist v6.0.1 is 1.83). Build with the higher of the two.
@@ -123,8 +123,8 @@ ciris-lens-core     = { path = "crates/ciris-lens-core" } # ABSORBED in-tree (wo
 # `cirislens_wa_cert` + `cirislens_service_token_revocation` expose the auth
 # substrate the fabric absorbs (CIRISServer#9, src/auth): the agent's `wa_cert`
 # table (users/WA/OAuth/api-keys) + the `revoked_service_tokens` table.
-ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v12.0.2", features = ["sqlite", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
-ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v8.4.2", features = ["transport-reticulum", "transport-http", "transport-packet-radio"] }
+ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v12.2.0", features = ["sqlite", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
+ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v8.6.1", features = ["transport-reticulum", "transport-http", "transport-packet-radio"] }
 # Founder-quorum verification + key-id fingerprint at the composition root
 # (threshold:: module path — NOT re-exported at the crate root).
 # LOCKSTEP: persist v9.4.0 transitively pins verify-core v6.6.x — the whole
@@ -206,7 +206,7 @@ tracing-appender = "0.2"
 # - keyring `tpm` (tss-esapi / TPM 2.0) — the real hardware backend; needs
 #   libtss2 (Linux build dep). Other targets keep the software keystore.
 [target.'cfg(target_os = "linux")'.dependencies]
-ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v12.0.2", features = ["postgres", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v12.2.0", features = ["postgres", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
 # keyring `tpm` (TPM-at-rest, Linux-only via tss-esapi). `pkcs11` is no longer
 # per-target — it rides the global `pkcs11` feature now that cryptoki builds on all
 # targets (CIRISVerify v6.12.0).
@@ -259,7 +259,7 @@ ciris-crypto  = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.5.0"
 # and never encodes/decodes). This lets tests/chaos_mesh.rs exercise the SUBSTRATE
 # codec (`fountain_encode`/`fountain_decode`) directly — a real MEASURED proof,
 # not a reference stand-in.
-ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v8.4.2", features = ["codec-fountain"] }
+ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v8.6.1", features = ["codec-fountain"] }
 
 # PQC realtime-A/V streaming E2E benchmark (CIRISEdge#62 realtime_av profile).
 [[bench]]

{ciris_server-0.5.77 → ciris_server-0.5.78}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ciris-server
-Version: 0.5.77
+Version: 0.5.78
 License-File: LICENSE
 Summary: The fabric node — the federation's headless cohabitation runtime (registry + lens [+ node] over one shared substrate), as the abi3 wheel CIRISAgent consumes. agent = fabric node + brain.
 Author-email: Eric Moore <eric@ciris.ai>

{ciris_server-0.5.77 → ciris_server-0.5.78}/crates/ciris-lens-core/Cargo.toml

@@ -26,8 +26,8 @@ crate-type = ["cdylib", "rlib"]
 #
 # OQ-01 closure 2026-05-03: rlib primary, PyO3 cdylib via `python`
 # feature for the deployed-lens cutover.
-ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v12.0.2", version = "12", features = ["extract", "sqlite"] }
-ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge",    tag = "v8.4.2", version = "8", features = ["transport-http", "transport-reticulum"] }
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v12.2.0", version = "12", features = ["extract", "sqlite"] }
+ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge",    tag = "v8.6.1", version = "8", features = ["transport-http", "transport-reticulum"] }
 
 # Keyring — relay mode (CIRISLensCore#10) loads its Edge transport-
 # signing identity via `ciris_keyring::load_local_seed`. Edge's

{ciris_server-0.5.77 → ciris_server-0.5.78}/src/accord_provision.rs

@@ -1048,7 +1048,7 @@ fn default_admit_identity_type() -> String {
 /// (the predictable, persist-ingestable path the operator hands to CIRISPersist
 /// v12.0.2 to bake) and returned. **1-of-N bootstrap:** a single holder suffices —
 /// this is a trust EXTENSION, not the 2/3 kill-switch. Loopback + `pkcs11`-gated.
-async fn admit_node(State(_st): State<ProvisionState>, body: axum::body::Bytes) -> Response {
+async fn admit_node(State(st): State<ProvisionState>, body: axum::body::Bytes) -> Response {
     let req: AdmitNodeRequest = match serde_json::from_slice(&body) {
         Ok(r) => r,
         Err(e) => return err(StatusCode::BAD_REQUEST, &format!("bad request: {e}")),
@@ -1082,11 +1082,11 @@ async fn admit_node(State(_st): State<ProvisionState>, body: axum::body::Bytes)
             "target key_id contains path separators — refusing to write it",
         );
     }
-    admit_node_impl(req).await
+    admit_node_impl(st.engine, req).await
 }
 
 #[cfg(not(feature = "pkcs11"))]
-async fn admit_node_impl(_req: AdmitNodeRequest) -> Response {
+async fn admit_node_impl(_engine: Arc<Engine>, _req: AdmitNodeRequest) -> Response {
     err(
         StatusCode::NOT_IMPLEMENTED,
         "admit-node needs the `pkcs11` feature (the holder's YubiKey + USB-wrapped ML-DSA signer)",
@@ -1094,7 +1094,7 @@ async fn admit_node_impl(_req: AdmitNodeRequest) -> Response {
 }
 
 #[cfg(feature = "pkcs11")]
-async fn admit_node_impl(req: AdmitNodeRequest) -> Response {
+async fn admit_node_impl(engine: Arc<Engine>, req: AdmitNodeRequest) -> Response {
     use std::path::PathBuf;
     use std::sync::Arc;
 
@@ -1253,10 +1253,48 @@ async fn admit_node_impl(req: AdmitNodeRequest) -> Response {
         );
     }
 
+    // #150 — PRODUCER: adopt the scrubbed record onto this node's OWN directory row
+    // (persist v12.2.0 `Engine::adopt_scrub_upgrade`, CIRISPersist#351). When the
+    // target IS this node, its boot-time self-signed own-key row is upgraded to the
+    // accord-holder-scrubbed record, so the Key plane (edge publish-own) advertises
+    // an ANCHORED, rootable record and consent peers root it. The primitive is
+    // self-gating (verifies the scrub sig + only upgrades a self-signed → scrubbed
+    // row for the SAME key_id/pubkey), so we call it unconditionally: a target whose
+    // row isn't a valid local upgrade returns Err and we report it without failing
+    // the outbox write (the JSON is still the transport for a remote target / bake).
+    let applied: serde_json::Value = match serde_json::to_value(&scrubbed)
+        .and_then(serde_json::from_value::<ciris_persist::federation::SignedKeyRecord>)
+    {
+        Ok(persist_rec) => match engine.adopt_scrub_upgrade(persist_rec).await {
+            Ok(outcome) => {
+                tracing::info!(
+                    target_key_id = %req.target.key_id.trim(),
+                    ?outcome,
+                    "admit-node: adopted the scrubbed record onto the local directory row"
+                );
+                serde_json::json!({ "adopted": true, "outcome": format!("{outcome:?}") })
+            }
+            Err(e) => {
+                tracing::warn!(
+                    target_key_id = %req.target.key_id.trim(),
+                    error = %e,
+                    "admit-node: scrubbed record NOT adopted locally (not this node's own \
+                     self-signed row?) — seed JSON saved for transport/bake"
+                );
+                serde_json::json!({ "adopted": false, "reason": e.to_string() })
+            }
+        },
+        Err(e) => {
+            tracing::warn!(error = %e, "admit-node: scrubbed record convert for local adoption");
+            serde_json::json!({ "adopted": false, "reason": format!("record convert: {e}") })
+        }
+    };
+
     (
         StatusCode::OK,
         Json(serde_json::json!({
             "saved_to": out_path.display().to_string(),
+            "applied": applied,
             "seed": seed,
         })),
     )

{ciris_server-0.5.77 → ciris_server-0.5.78}/src/compose.rs

@@ -1352,18 +1352,42 @@ async fn setup_peer_replication(
     //    health:liveness in. v5.1.0 `start` installs the scheduler control channel
     //    unconditionally, so the runtime accepts `set_peers` mutation with no
     //    extra opt-in (CIRISEdge#173 resolved).
+    // Two coordinators per consent peer: Attestation (capacity:* / health:liveness)
+    // AND Key (#144, CIRISEdge#257 — the KERI publish-own key plane). The reconciler
+    // (replication_reconcile.rs) converges the same pair set at runtime.
     let peers: Vec<ReplicationPeer> = desired
         .iter()
-        .map(|p| ReplicationPeer {
-            peer_key_id: p.clone(),
-            kind: EnvelopeKind::Attestation,
+        .flat_map(|p| {
+            [
+                ReplicationPeer {
+                    peer_key_id: p.clone(),
+                    kind: EnvelopeKind::Attestation,
+                },
+                ReplicationPeer {
+                    peer_key_id: p.clone(),
+                    kind: EnvelopeKind::Key,
+                },
+            ]
         })
         .collect();
+
+    // Key-plane publish selector (CIRISEdge#257 / edge v8.6.0): the Key plane's
+    // `list_keys` advertises the key_ids THIS selector yields — the node's OWN
+    // record — instead of the cohort's-own-keys projection. `list_keys` re-reads
+    // the record live each tick, so once admit-node scrub-signs this node's own
+    // record (scrub_key_id = an accord holder), the NEXT anti-entropy round
+    // publishes the scrubbed, ANCHORED record to consent peers → they root it.
+    // (KERI publish-own: the controller publishes its own establishment record.)
+    let own_key_id = cfg.key_id.clone();
+    let key_selector: ciris_edge::replication::CohortProvider =
+        Arc::new(move || vec![own_key_id.clone()]);
+
     let runtime = ReplicationRuntime::start(
         directory,
         transport as Arc<dyn ciris_edge::transport::Transport>,
         peers,
         ReplicationRuntimeConfig::default(),
+        Some(key_selector),
     )
     .await;
 

{ciris_server-0.5.77 → ciris_server-0.5.78}/src/holonomic.rs

@@ -185,6 +185,8 @@ mod tests {
             min_viable_symbols: 6,
             symbol_size: 256,
             held_symbols: 5,
+            content_bytes: 1280,
+            cohort_scope: Some("federation".to_string()),
             recoverable: false,
             admitted_at: "2026-06-21T00:00:00Z".to_string(),
         };
@@ -207,6 +209,8 @@ mod tests {
             min_viable_symbols: 1,
             symbol_size: 1,
             held_symbols: 0,
+            content_bytes: 0,
+            cohort_scope: None,
             recoverable: false,
             admitted_at: "2026-06-21T00:00:00Z".to_string(),
         };

{ciris_server-0.5.77 → ciris_server-0.5.78}/src/replication_reconcile.rs

@@ -68,13 +68,25 @@ pub async fn reconcile_once(
     // EnvelopeKind::Attestation carries BOTH directions (capacity:* out,
     // health:liveness in).
     let directory = engine.federation_directory();
-    let mut desired: Vec<ReplicationPeer> = Vec::with_capacity(consented.len());
+    let mut desired: Vec<ReplicationPeer> = Vec::with_capacity(consented.len() * 2);
     for peer in consented {
         match directory.lookup_public_key(&peer).await {
-            Ok(Some(_)) => desired.push(ReplicationPeer {
-                peer_key_id: peer,
-                kind: EnvelopeKind::Attestation,
-            }),
+            Ok(Some(_)) => {
+                // BOTH planes per admitted peer:
+                //  - Attestation: capacity:* out, health:liveness in (as before).
+                //  - Key (#144, CIRISEdge#257): the KEY-PLANE anti-entropy. Paired
+                //    with the runtime's `key_selector` (publishes the node's OWN
+                //    record — KERI publish-own), this converges a node's scrub-signed
+                //    accord-anchored record to its consent peers so they can ROOT it.
+                desired.push(ReplicationPeer {
+                    peer_key_id: peer.clone(),
+                    kind: EnvelopeKind::Attestation,
+                });
+                desired.push(ReplicationPeer {
+                    peer_key_id: peer,
+                    kind: EnvelopeKind::Key,
+                });
+            }
             Ok(None) => tracing::warn!(
                 peer_key_id = %peer,
                 "consent:replication observed for an UNADMITTED peer key — skipping reconcile for \
@@ -91,7 +103,9 @@ pub async fn reconcile_once(
     // Diff-converge the live Initiator set to the desired consent peers. Adds
     // become active Initiators (scheduler-driven pull) at runtime; removals stop
     // their rounds + drop inbound routing — all without a restart.
-    let count = desired.len();
+    // `desired` holds TWO coordinators per peer (Attestation + Key); the reported
+    // count is distinct consent peers.
+    let count = desired.len() / 2;
     if let Err(e) = runtime.set_peers(desired).await {
         // The runtime's scheduler has stopped (shutdown) — surface so the caller
         // logs + skips; the controller never panics.

{ciris_server-0.5.77 → ciris_server-0.5.78}/tests/accord_admit_node.rs

@@ -159,3 +159,109 @@ async fn admit_node_scrubbed_record_roots_at_accord_anchor() {
         "must NOT root when A1 is not a pinned anchor, got {verdict_wrong:?}"
     );
 }
+
+/// The PRODUCER path (CIRISServer#150 / CIRISPersist#351): a node that already
+/// holds its boot-time **self-signed** own-key row upgrades that row IN PLACE to
+/// the accord-holder-scrubbed record via `Engine::adopt_scrub_upgrade` (the old
+/// `register_federation_key` is `ON CONFLICT DO NOTHING` and would have left the
+/// self-signed row). After the upgrade the row ROOTS at the anchor, and a second
+/// apply is idempotent — exactly what admit-node relies on to publish an anchored
+/// record over the Key plane.
+#[tokio::test]
+async fn adopt_scrub_upgrade_promotes_self_signed_own_row_and_roots() {
+    use ciris_persist::federation::register::AdoptScrubOutcome;
+
+    let engine = node().await;
+    let now = chrono::Utc::now().to_rfc3339();
+
+    let a1 = HybridSigningIdentity::generate("humanity-accord-a1-test").expect("gen A1");
+    let anchor = produce_self_key_record(&a1, "steward,accord_holder", &now)
+        .await
+        .expect("A1 anchor");
+    let a1_ed_b64 = anchor.record.pubkey_ed25519_base64.clone();
+    engine
+        .register_federation_key(to_persist(&anchor))
+        .await
+        .expect("register A1 anchor");
+
+    // The node's boot-time state: its OWN row, SELF-signed.
+    let target = HybridSigningIdentity::generate("canonical-server-1-test").expect("gen target");
+    let target_self = produce_self_key_record(&target, "node", &now)
+        .await
+        .expect("target self record");
+    let target_ed_b64 = target_self.record.pubkey_ed25519_base64.clone();
+    let target_mldsa_b64 = target_self
+        .record
+        .pubkey_ml_dsa_65_base64
+        .clone()
+        .expect("target ml_dsa");
+    engine
+        .register_federation_key(to_persist(&target_self))
+        .await
+        .expect("register target SELF-signed own row");
+
+    // Precondition: a self-signed row does NOT root.
+    let backend = engine.sqlite_backend().expect("sqlite backend");
+    let anchor_set = [ed32(&a1_ed_b64)];
+    assert!(
+        !matches!(
+            root_binding_anchored(
+                backend.as_ref(),
+                "canonical-server-1-test",
+                &target_ed_b64,
+                &anchor_set
+            )
+            .await,
+            RootingVerdict::Confirmed { .. }
+        ),
+        "precondition: the self-signed own row must NOT root yet"
+    );
+
+    // A1 scrub-signs the target, and the node ADOPTS the upgrade onto its own row.
+    let scrubbed = produce_scrubbed_key_record(
+        &a1,
+        ScrubTarget {
+            key_id: "canonical-server-1-test".to_string(),
+            pubkey_ed25519_base64: target_ed_b64.clone(),
+            pubkey_ml_dsa_65_base64: target_mldsa_b64,
+            identity_type: "node".to_string(),
+        },
+        &now,
+    )
+    .await
+    .expect("A1 scrub-signs target");
+
+    let outcome = engine
+        .adopt_scrub_upgrade(to_persist(&scrubbed))
+        .await
+        .expect("adopt_scrub_upgrade must succeed on a self-signed own row");
+    assert!(
+        matches!(outcome, AdoptScrubOutcome::Upgraded),
+        "first adopt upgrades the self-signed row, got {outcome:?}"
+    );
+
+    // Now the SAME key_id ROOTS — the Key plane would publish an anchored record.
+    assert!(
+        matches!(
+            root_binding_anchored(
+                backend.as_ref(),
+                "canonical-server-1-test",
+                &target_ed_b64,
+                &anchor_set
+            )
+            .await,
+            RootingVerdict::Confirmed { .. }
+        ),
+        "after adopt the own row must ROOT at the accord anchor"
+    );
+
+    // Idempotent: re-applying the same outbox record is a no-op (second boot).
+    let again = engine
+        .adopt_scrub_upgrade(to_persist(&scrubbed))
+        .await
+        .expect("re-adopt must not error");
+    assert!(
+        matches!(again, AdoptScrubOutcome::AlreadyAdopted),
+        "second adopt is idempotent, got {again:?}"
+    );
+}

ciris_server-0.5.78/tests/mesh_seed_keyplane_e2e.rs

@@ -0,0 +1,225 @@
+//! TRUE end-to-end QA gate for the genesis-mesh SEED via the KEY PLANE
+//! (deploy-with-confidence). Complements `mesh_seed_e2e.rs` (which covers the
+//! relay/trace Attestation path); this proves the admit-node → rooting loop for
+//! **key records** across TWO independent engines, driving the REAL edge
+//! replication bridge (no mocks of our own logic):
+//!
+//!   1. **Seed** — the baked HUMANITY_ACCORD anchor (A1) is present on BOTH nodes
+//!      (persist v12.0.2 first-boot seed, simulated here by registering A1).
+//!   2. **Producer** (CIRISServer#150 / CIRISPersist#351) — node A holds its
+//!      boot-time SELF-signed own row, then `Engine::adopt_scrub_upgrade` upgrades
+//!      it IN PLACE to the A1-scrubbed (anchored) record.
+//!   3. **Publish-own** (CIRISEdge#257 / edge v8.6.x) — A's replication bridge with
+//!      the Key-plane `key_selector` = A's own key_id advertises A's OWN anchored
+//!      record over `EnvelopeKind::Key` (`list_envelope_refs` + `fetch_envelope_bytes`).
+//!   4. **Receive** — node B applies those exact wire bytes via the bridge
+//!      (`apply_envelope_bytes`) — the receive side of anti-entropy.
+//!   5. **Root** — B now ROOTS A at the accord anchor (`root_binding_anchored`),
+//!      which it could NOT do before receiving A's record.
+//!
+//! The Reticulum transport hop + the scheduler cadence are edge's own tested
+//! concerns; this gate proves OUR composition (producer + publish-set selection +
+//! apply + root) end-to-end and deterministically, with software keys.
+
+use std::sync::Arc;
+
+use base64::Engine as _;
+
+use ciris_edge::replication::{
+    BridgeConfig, CohortProvider, EnvelopeKind, FederationDirectoryReplicationBridge,
+    ReplicationDirectory,
+};
+use ciris_persist::federation::rooting::{root_binding_anchored, RootingVerdict};
+use ciris_persist::federation::FederationDirectory;
+use ciris_persist::federation::SignedKeyRecord as PersistSignedKeyRecord;
+use ciris_persist::prelude::{Engine, LocalSigner};
+use ciris_persist::store::sqlite::SqliteBackend;
+
+use ciris_verify_core::federation_self_record::{
+    produce_scrubbed_key_record, produce_self_key_record, ScrubTarget, SignedKeyRecord,
+};
+use ciris_verify_core::self_at_login::HybridSigningIdentity;
+
+use ciris_keyring::MlDsa65SoftwareSigner;
+use ed25519_dalek::SigningKey;
+
+/// A fresh in-memory sqlite Engine with a distinct signer seed.
+async fn engine(seed: u8, alias: &str) -> Arc<Engine> {
+    let signing_key = SigningKey::from_bytes(&[seed; 32]);
+    let pqc = Arc::new(
+        MlDsa65SoftwareSigner::from_seed_bytes(&[seed ^ 0xFF; 32], format!("{alias}-pqc"))
+            .expect("ML-DSA-65 seed"),
+    );
+    let signer = Arc::new(LocalSigner::from_parts(
+        signing_key,
+        alias.to_string(),
+        Some(pqc),
+        Some(format!("{alias}-pqc")),
+    ));
+    Arc::new(
+        Engine::with_signer(signer, "sqlite::memory:")
+            .await
+            .expect("Engine::with_signer (sqlite::memory:)"),
+    )
+}
+
+fn to_persist(v: &SignedKeyRecord) -> PersistSignedKeyRecord {
+    serde_json::from_value(serde_json::to_value(v).expect("serialize verify record"))
+        .expect("deserialize into persist record")
+}
+
+fn ed32(b64: &str) -> [u8; 32] {
+    base64::engine::general_purpose::STANDARD
+        .decode(b64)
+        .expect("b64 ed25519")
+        .try_into()
+        .expect("32-byte ed25519")
+}
+
+async fn roots(backend: &SqliteBackend, key_id: &str, ed_b64: &str, anchor: &[[u8; 32]]) -> bool {
+    matches!(
+        root_binding_anchored(backend, key_id, ed_b64, anchor).await,
+        RootingVerdict::Confirmed { .. }
+    )
+}
+
+#[tokio::test]
+async fn admit_node_seed_replicates_and_peer_roots_end_to_end() {
+    let node_a_key = "canonical-node-a-test";
+    let node_b_key = "canonical-node-b-test";
+
+    let engine_a = engine(0xA0, node_a_key).await;
+    let engine_b = engine(0xB0, node_b_key).await;
+    let now = chrono::Utc::now().to_rfc3339();
+
+    // (1) SEED — A1, the baked HUMANITY_ACCORD anchor, present on BOTH nodes.
+    let a1 = HybridSigningIdentity::generate("humanity-accord-a1-test").expect("gen A1");
+    let a1_anchor = produce_self_key_record(&a1, "steward,accord_holder", &now)
+        .await
+        .expect("A1 anchor");
+    let a1_ed = ed32(&a1_anchor.record.pubkey_ed25519_base64);
+    for e in [&engine_a, &engine_b] {
+        e.register_federation_key(to_persist(&a1_anchor))
+            .await
+            .expect("seed A1 anchor");
+    }
+
+    // Node A's identity + its BOOT-time SELF-signed own row (what register_self_key
+    // writes) in A's directory.
+    let node_a = HybridSigningIdentity::generate(node_a_key).expect("gen node A");
+    let a_self = produce_self_key_record(&node_a, "node", &now)
+        .await
+        .expect("A self record");
+    let a_ed_b64 = a_self.record.pubkey_ed25519_base64.clone();
+    let a_mldsa_b64 = a_self
+        .record
+        .pubkey_ml_dsa_65_base64
+        .clone()
+        .expect("A ml_dsa");
+    engine_a
+        .register_federation_key(to_persist(&a_self))
+        .await
+        .expect("A self-signed own row");
+
+    let anchor_set = [a1_ed];
+
+    // Precondition: B cannot root A (it has never seen A's record).
+    assert!(
+        !roots(
+            engine_b.sqlite_backend().unwrap().as_ref(),
+            node_a_key,
+            &a_ed_b64,
+            &anchor_set
+        )
+        .await,
+        "precondition: B must NOT root A before receiving A's record"
+    );
+
+    // (2) PRODUCER — A1 scrub-signs A; A adopts the upgrade onto its OWN row.
+    let a_scrubbed = produce_scrubbed_key_record(
+        &a1,
+        ScrubTarget {
+            key_id: node_a_key.to_string(),
+            pubkey_ed25519_base64: a_ed_b64.clone(),
+            pubkey_ml_dsa_65_base64: a_mldsa_b64,
+            identity_type: "node".to_string(),
+        },
+        &now,
+    )
+    .await
+    .expect("A1 scrub-signs A");
+    engine_a
+        .adopt_scrub_upgrade(to_persist(&a_scrubbed))
+        .await
+        .expect("A adopts the scrub upgrade onto its own row");
+
+    // A's own row roots LOCALLY now — the producer worked.
+    assert!(
+        roots(
+            engine_a.sqlite_backend().unwrap().as_ref(),
+            node_a_key,
+            &a_ed_b64,
+            &anchor_set
+        )
+        .await,
+        "A's own row must root locally after adopt"
+    );
+
+    // (3) PUBLISH-OWN — A's bridge with the Key-plane selector = A's own key_id.
+    let a_dir: Arc<dyn FederationDirectory> = engine_a.federation_directory();
+    let cohort_a: CohortProvider = Arc::new(move || vec![node_b_key.to_string()]);
+    let key_sel: CohortProvider = Arc::new(move || vec![node_a_key.to_string()]);
+    let a_bridge =
+        FederationDirectoryReplicationBridge::with_config(a_dir, cohort_a, BridgeConfig::default())
+            .with_key_selector(Some(key_sel));
+
+    let refs = a_bridge.list_envelope_refs(EnvelopeKind::Key).await;
+    assert_eq!(
+        refs.len(),
+        1,
+        "A publishes exactly its OWN record on the Key plane (selector-scoped), got {refs:?}"
+    );
+    let bytes = a_bridge
+        .fetch_envelope_bytes(EnvelopeKind::Key, &refs[0].envelope_hash)
+        .await
+        .expect("A serves its own record bytes");
+
+    // (4) RECEIVE — B applies the exact wire bytes via its bridge (anti-entropy RX).
+    let b_dir: Arc<dyn FederationDirectory> = engine_b.federation_directory();
+    let b_bridge = FederationDirectoryReplicationBridge::with_config(
+        b_dir,
+        Arc::new(move || vec![node_a_key.to_string()]),
+        BridgeConfig::default(),
+    );
+    let admitted = b_bridge
+        .apply_envelope_bytes(EnvelopeKind::Key, &bytes)
+        .await;
+    assert!(
+        admitted,
+        "B must admit A's anchored record (validates against seeded A1)"
+    );
+
+    // (5) ROOT — B now roots A at the accord anchor. THE SEED CLOSED.
+    assert!(
+        roots(
+            engine_b.sqlite_backend().unwrap().as_ref(),
+            node_a_key,
+            &a_ed_b64,
+            &anchor_set
+        )
+        .await,
+        "after receiving A's anchored record, B MUST root A — the mesh seed is complete"
+    );
+
+    // Negative: B still won't root A under a WRONG anchor set (the gate bites).
+    assert!(
+        !roots(
+            engine_b.sqlite_backend().unwrap().as_ref(),
+            node_a_key,
+            &a_ed_b64,
+            &[[0x11u8; 32]]
+        )
+        .await,
+        "B must NOT root A when A1 is not the pinned anchor"
+    );
+}

{ciris_server-0.5.77 → ciris_server-0.5.78}/tests/release_gates/support.rs

@@ -32,8 +32,8 @@ use std::path::PathBuf;
 // verify v8.3.0→v8.5.0 (CIRISVerify#162 produce_scrubbed_key_record, the accord
 // admit-node op), edge v8.3.0→v8.4.1 (anchor gate for free + verify/persist lockstep).
 pub const TARGET_VERIFY: &str = "v8.5.0";
-pub const TARGET_PERSIST: &str = "v12.0.2";
-pub const TARGET_EDGE: &str = "v8.4.2";
+pub const TARGET_PERSIST: &str = "v12.2.0";
+pub const TARGET_EDGE: &str = "v8.6.1";
 /// Stage 6/7: the persist MAJOR family that bakes the canonical genesis seed.
 /// (Name is historical — the seed-bake family moved v10 → **v12** with the v12.0
 /// genesis-mesh rooting anchor: persist v12.0.1 enforces it, v12.0.2 bakes the