ciris-server 0.5.82__tar.gz → 0.5.83__tar.gz

{ciris_server-0.5.82 → ciris_server-0.5.83}/Cargo.lock

@@ -949,7 +949,7 @@ dependencies = [
 
 [[package]]
 name = "ciris-server"
-version = "0.5.82"
+version = "0.5.83"
 dependencies = [
  "anyhow",
  "async-trait",

{ciris_server-0.5.82 → ciris_server-0.5.83}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ciris-server"
-version = "0.5.82" # 0.5.82 = CO-SCRUB END-TO-END. Same substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (no triple change). The cross-device m-of-n seed now works from the app: the co-scrub partial GOSSIPS over the accord peer-plane (the same HTTP set the kill-switch uses) — propose on A1's box → the partial surfaces under "Pending co-signs (canonical)" on B1's box → cosign → conferred, no manual transfer. Server (src/accord_provision.rs): ProvisionState gains an ephemeral bounded pending store + a (target,scrub-count) seen-set; ingest_partial validates structurally + upserts + gossips; NEW open (non-loopback) POST /v1/accord/canonical/gossip-partial peer-receive + GET /v1/accord/canonical/pending; router() split into build()→{loopback,gossip}. Client (#174): proposeCanonical/cosignCanonical/listPendingCoscrubs, the "Pending co-signs (canonical)" section + CanonicalCosignSheet (pending-entry or pasted-partial fallback), "[+ New] Add"→"Propose a canonical server". Bundled: #117 (Delegations loads on screen entry, not VM init → no pre-login 401) + #134 (existing-key offer no longer gated on a typed label; label auto-populates from the picked key_id). 0.5.81 = M-OF-N TRUST ROOT. Substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (CIRISPersist#383: KeyRecord.additional_scrubs + the DYNAMIC m-of-n admission gate via verify's verify_quorum_policy — canonical is conferred iff distinct_scrub_count() ≥ the family's entrenched quorum:M/N, NOT a hardcoded 2; the 1-of-N genesis is no longer auto-baked). Trust Root co-scrub ceremony (server-side, hardware-signed via the shared open_holder_identity custody path): POST /v1/accord/canonical/{propose,cosign} (scrub #1 → gossip/transfer the partial → append_scrub over the byte-identical envelope → adopt_scrub_upgrade lets the m-of-n gate confer/hold), plus /withdraw + /supersede (#377, 2-of-3 via proposal_digest) and IP-in-envelope TransportHint. Accord ops drill + announce (/v1/accord/{drill,announce}, node-synth'd invocation, gossiped, recorded pre-latch) + /halt-status. DRY audit landed (recipes routed through the substrate: build_self_key_record→produce_self_key_record, CANONICAL_BOOTSTRAP_PEERS→Engine::canonical_bootstrap_hints, owner_binding consts aliased). CEG-native Trust Root card redesign (one AttestationCard + ⋮ hamburger; concur now hardware-signs). KNOWN → 0.5.82 (#174): the client "Add canonical" still posts /add (1-scrub partial under m-of-n) — wire the propose→cosign buttons. 0.5.80 = THE MESH-SEED RELEASE. Substrate lockstep edge v9.1.0 / persist v13.0.1 / verify v8.7.0 (CC 1.0 RC1: KeyRecord.consent_role, the accord-conferred `canonical` identity_type role + admission gate CIRISPersist#372, single-owner owner_of #162, CIRISEdge#277 upgrade-aware Key-plane apply → KERI publish-own end-to-end). Trust Root canonical ops (#164): POST /v1/accord/canonical/add — the 1-of-N hardware-scrub SEED op (scrub-sign w/ the canonical role + adopt onto own row + publish address) + GET /v1/accord/canonical/servers + the client "Canonical servers" card (update-address shipped #165; supersede/withdraw → 0.5.81, need a persist role-removal primitive). ci.yml revived (my #155 evidence-step colon had broken the Rust gate repo-wide). 0.5.79 = substrate triple edge v8.7.2 / persist v12.5.0 / verify v8.7.0 (cross-cdylib block_on-deadlock/SIGABRT fix + CC 0.9.3 gates + dep-trims landed: hickory 0.25 de-dup, dead openssl/qrcodegen/bip39 gone) + REMOTE adopt-scrubbed endpoint (#150 — POST /v1/federation/adopt-scrubbed applies an A1-scrubbed record onto a node's own row so it roots; the seed producer's remote leg, keys live off-node) + server-local dep-trims (#152: drop hmac/pyo3-async-runtimes, lens-core async-trait/opentelemetry, base64 0.21→0.22). 0.5.78 = edge v8.6.1 / persist v12.2.0 adoption — the COMPLETE admit-node → mesh-seed loop. (1) #144 KEY-PLANE replication (KERI publish-own): the ReplicationRuntime converges an EnvelopeKind::Key coordinator per consent peer + a key_selector publishing the node's OWN key_id. (2) #150 PRODUCER: admit-node now calls persist v12.2.0 Engine::adopt_scrub_upgrade (CIRISPersist#351) to upgrade the node's own self-signed row to the accord-holder-scrubbed record — so the Key plane publishes an ANCHORED, rootable record → peers root it. Producer (server upgrades the row) + publish-own (edge advertises it) = the seed closes in place, no wipe. (3) #147 §Q B5: persist FountainHeldMeta.{content_bytes,cohort_scope} adopted (server has no fountain-content admit path; import.rs already sets cohort_scope). Verify unchanged v8.5.0. 0.5.77 = persist v12.0.2 anchor seed + accord-card UX.
+version = "0.5.83" # 0.5.83 = BAKED-FAMILY RECOGNITION + RAISE-A-HALT. Same substrate (edge v9.1.2 / persist v13.2.0 / verify v8.9.0). Fixes "No accord family established on this node yet" on a node that has the BAKED genesis but no entrenched federation_families row (persist seeds the 3 holder KEY rows, not the family row — durable fix filed CIRISPersist#386): GET /v1/accord/family + the co-scrub quorum_needed now fall back to verify's baked humanity_accord_genesis() (the 2/3 family + 3 seats, entrenched=false, recognized_via=baked-genesis) — the same recognition resolve_kill_switch_roster already uses. PLUS raise-a-halt: POST /v1/accord/halt (initiate_halt, the binding twin of /drill — one opener signature is sub-quorum and cannot latch; 2-of-3 concur latches) + the client "Halt the mesh" action (was a disabled placeholder). 0.5.82 = CO-SCRUB END-TO-END. Same substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (no triple change). The cross-device m-of-n seed now works from the app: the co-scrub partial GOSSIPS over the accord peer-plane (the same HTTP set the kill-switch uses) — propose on A1's box → the partial surfaces under "Pending co-signs (canonical)" on B1's box → cosign → conferred, no manual transfer. Server (src/accord_provision.rs): ProvisionState gains an ephemeral bounded pending store + a (target,scrub-count) seen-set; ingest_partial validates structurally + upserts + gossips; NEW open (non-loopback) POST /v1/accord/canonical/gossip-partial peer-receive + GET /v1/accord/canonical/pending; router() split into build()→{loopback,gossip}. Client (#174): proposeCanonical/cosignCanonical/listPendingCoscrubs, the "Pending co-signs (canonical)" section + CanonicalCosignSheet (pending-entry or pasted-partial fallback), "[+ New] Add"→"Propose a canonical server". Bundled: #117 (Delegations loads on screen entry, not VM init → no pre-login 401) + #134 (existing-key offer no longer gated on a typed label; label auto-populates from the picked key_id). 0.5.81 = M-OF-N TRUST ROOT. Substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (CIRISPersist#383: KeyRecord.additional_scrubs + the DYNAMIC m-of-n admission gate via verify's verify_quorum_policy — canonical is conferred iff distinct_scrub_count() ≥ the family's entrenched quorum:M/N, NOT a hardcoded 2; the 1-of-N genesis is no longer auto-baked). Trust Root co-scrub ceremony (server-side, hardware-signed via the shared open_holder_identity custody path): POST /v1/accord/canonical/{propose,cosign} (scrub #1 → gossip/transfer the partial → append_scrub over the byte-identical envelope → adopt_scrub_upgrade lets the m-of-n gate confer/hold), plus /withdraw + /supersede (#377, 2-of-3 via proposal_digest) and IP-in-envelope TransportHint. Accord ops drill + announce (/v1/accord/{drill,announce}, node-synth'd invocation, gossiped, recorded pre-latch) + /halt-status. DRY audit landed (recipes routed through the substrate: build_self_key_record→produce_self_key_record, CANONICAL_BOOTSTRAP_PEERS→Engine::canonical_bootstrap_hints, owner_binding consts aliased). CEG-native Trust Root card redesign (one AttestationCard + ⋮ hamburger; concur now hardware-signs). KNOWN → 0.5.82 (#174): the client "Add canonical" still posts /add (1-scrub partial under m-of-n) — wire the propose→cosign buttons. 0.5.80 = THE MESH-SEED RELEASE. Substrate lockstep edge v9.1.0 / persist v13.0.1 / verify v8.7.0 (CC 1.0 RC1: KeyRecord.consent_role, the accord-conferred `canonical` identity_type role + admission gate CIRISPersist#372, single-owner owner_of #162, CIRISEdge#277 upgrade-aware Key-plane apply → KERI publish-own end-to-end). Trust Root canonical ops (#164): POST /v1/accord/canonical/add — the 1-of-N hardware-scrub SEED op (scrub-sign w/ the canonical role + adopt onto own row + publish address) + GET /v1/accord/canonical/servers + the client "Canonical servers" card (update-address shipped #165; supersede/withdraw → 0.5.81, need a persist role-removal primitive). ci.yml revived (my #155 evidence-step colon had broken the Rust gate repo-wide). 0.5.79 = substrate triple edge v8.7.2 / persist v12.5.0 / verify v8.7.0 (cross-cdylib block_on-deadlock/SIGABRT fix + CC 0.9.3 gates + dep-trims landed: hickory 0.25 de-dup, dead openssl/qrcodegen/bip39 gone) + REMOTE adopt-scrubbed endpoint (#150 — POST /v1/federation/adopt-scrubbed applies an A1-scrubbed record onto a node's own row so it roots; the seed producer's remote leg, keys live off-node) + server-local dep-trims (#152: drop hmac/pyo3-async-runtimes, lens-core async-trait/opentelemetry, base64 0.21→0.22). 0.5.78 = edge v8.6.1 / persist v12.2.0 adoption — the COMPLETE admit-node → mesh-seed loop. (1) #144 KEY-PLANE replication (KERI publish-own): the ReplicationRuntime converges an EnvelopeKind::Key coordinator per consent peer + a key_selector publishing the node's OWN key_id. (2) #150 PRODUCER: admit-node now calls persist v12.2.0 Engine::adopt_scrub_upgrade (CIRISPersist#351) to upgrade the node's own self-signed row to the accord-holder-scrubbed record — so the Key plane publishes an ANCHORED, rootable record → peers root it. Producer (server upgrades the row) + publish-own (edge advertises it) = the seed closes in place, no wipe. (3) #147 §Q B5: persist FountainHeldMeta.{content_bytes,cohort_scope} adopted (server has no fountain-content admit path; import.rs already sets cohort_scope). Verify unchanged v8.5.0. 0.5.77 = persist v12.0.2 anchor seed + accord-card UX.
 edition = "2021"
 # MSRV floor is set by the substrate: ciris-verify v5.2.0 requires 1.86
 # (persist v6.0.1 is 1.83). Build with the higher of the two.

{ciris_server-0.5.82 → ciris_server-0.5.83}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ciris-server
-Version: 0.5.82
+Version: 0.5.83
 License-File: LICENSE
 Summary: The fabric node — the federation's headless cohabitation runtime (registry + lens [+ node] over one shared substrate), as the abi3 wheel CIRISAgent consumes. agent = fabric node + brain.
 Author-email: Eric Moore <eric@ciris.ai>

{ciris_server-0.5.82 → ciris_server-0.5.83}/src/accord.rs

@@ -1062,14 +1062,58 @@ async fn genesis_assemble(
         .into_response()
 }
 
+/// Project the family from the BAKED verify genesis (`humanity_accord_genesis`) — the
+/// recognized-but-not-yet-entrenched form used when no persist `federation_families` row
+/// exists. The genesis body's `family` block already carries `family_name`,
+/// `consensus_protocol` (`quorum:2/3`), and the `members` list ({key_id, role}) verbatim —
+/// exactly the `GET /v1/accord/family` shape. `entrenched:false` + `recognized_via` tell the
+/// client this is the baked recognition, not an entrenched row. 404 only if the genesis is
+/// somehow unbaked (never, in a shipped build).
+fn recognized_family_from_baked_genesis() -> Response {
+    let Some(genesis) = humanity_accord_genesis() else {
+        return err(StatusCode::NOT_FOUND, "no HUMANITY_ACCORD family yet");
+    };
+    let fam = genesis.body.get("family");
+    let family_name = fam
+        .and_then(|f| f.get("family_name"))
+        .and_then(|v| v.as_str())
+        .unwrap_or("HUMANITY_ACCORD");
+    let consensus_protocol = fam
+        .and_then(|f| f.get("consensus_protocol"))
+        .and_then(|v| v.as_str())
+        .unwrap_or("quorum:2/3");
+    let members = fam
+        .and_then(|f| f.get("members"))
+        .cloned()
+        .unwrap_or_else(|| serde_json::json!([]));
+    (
+        StatusCode::OK,
+        Json(serde_json::json!({
+            "family_key_id": HUMANITY_ACCORD_FAMILY_KEY_ID,
+            "family_name": family_name,
+            "consensus_protocol": consensus_protocol,
+            "entrenched": false,
+            "recognized_via": "baked-genesis",
+            "members": members,
+        })),
+    )
+        .into_response()
+}
+
 /// `GET /v1/accord/family` — the entrenched HUMANITY_ACCORD family, read from the
 /// persist `federation_families` row via the generic family layer
 /// ([`crate::family::lookup`]) + its LIVE roster ([`crate::family::active_members`],
-/// revocation-folded). 404 until genesis is assembled.
+/// revocation-folded). Falls back to the BAKED genesis recognition
+/// ([`recognized_family_from_baked_genesis`]) when no row is entrenched yet.
 async fn get_family(State(st): State<AccordState>) -> Response {
     let family = match crate::family::lookup(&st.engine, HUMANITY_ACCORD_FAMILY_KEY_ID).await {
         Ok(Some(f)) => f,
-        Ok(None) => return err(StatusCode::NOT_FOUND, "no HUMANITY_ACCORD family yet"),
+        // No entrenched `federation_families` row — but the family is still RECOGNIZED from
+        // the BAKED genesis (verify's `humanity_accord_genesis`), the same recognition the
+        // kill-switch roster uses. Project the baked 2/3 family (entrenched=false) so the
+        // Trust Root card + the co-scrub quorum resolve on a fresh node, BEFORE persist bakes
+        // the row (CIRISPersist#386 — the durable fix that makes this fallback redundant).
+        Ok(None) => return recognized_family_from_baked_genesis(),
         Err(e) => return err(StatusCode::SERVICE_UNAVAILABLE, &format!("store: {e}")),
     };
     // The live seats (admitted MINUS revoked) — what a swap reflects immediately.
@@ -1196,8 +1240,9 @@ async fn hardware_sign_invocation(
 /// the id / message — never a signed envelope (it holds no keys and fabricates no
 /// crypto), so the node mints the CSPRNG nonce, the §0.5 timestamps (a 1-hour
 /// validity window), and the §0.6 `payload_sha256` (binding the notify's `message`;
-/// the empty payload for a drill). Only ever used for the non-binding kinds — a
-/// `CONSTITUTIONAL` halt is never synthesized (its full invocation is caller-supplied).
+/// the empty payload for a drill). Used for the non-binding kinds AND for RAISING a
+/// `CONSTITUTIONAL` halt ([`initiate_halt`]) — the synthesized halt carries ONE opener
+/// signature, which is sub-quorum and cannot latch; only the family M-of-N does.
 fn synth_invocation(kind: InvocationKind, invocation_id: &str, payload: &[u8]) -> Invocation {
     use base64::Engine as _;
     let mut nonce = [0u8; 32];
@@ -1309,6 +1354,82 @@ async fn initiate_drill(State(st): State<AccordState>, body: axum::body::Bytes)
     .await
 }
 
+/// `POST /v1/accord/halt` request. Mirror of [`DrillRequest`] — supply a full
+/// `constitutional` `invocation` (holder-app path) OR just an `invocation_id` (or nothing,
+/// for a fresh `halt-<uuid>`) for the node to synthesize it. The cosignature is client-
+/// submitted OR hardware-signed on the node.
+#[derive(Debug, Deserialize)]
+#[cfg_attr(not(feature = "pkcs11"), allow(dead_code))]
+struct HaltRequest {
+    #[serde(default)]
+    invocation: Option<Invocation>,
+    #[serde(default)]
+    invocation_id: Option<String>,
+    #[serde(default)]
+    signature: Option<ThresholdSignature>,
+    /// Hardware-sign path (mirrors admit-node): the holder's federation `key_id`.
+    #[serde(default)]
+    key_id: Option<String>,
+    /// Hardware-sign path: the USB directory holding the wrapped ML-DSA-65 half.
+    #[serde(default)]
+    mldsa_usb_path: Option<String>,
+    /// Hardware-sign path: the holder's YubiKey PKCS#11 / PIV knobs.
+    #[serde(default)]
+    pkcs11: crate::accord_provision::ProvisionPkcs11,
+}
+
+/// `POST /v1/accord/halt` — **RAISE** a 2-of-3 `CONSTITUTIONAL` kill-switch invocation.
+///
+/// The initiating holder hardware-signs ONE signature — which is **sub-quorum**, so this
+/// does **NOT** latch anything: a halt latches ONLY when the family M-of-N is met
+/// ([`replicate_and_maybe_halt`]'s `is_global_halt` requires `quorum_met`). Raising is thus
+/// safe to expose from the app; the gravity is protected by the QUORUM, not by making the
+/// switch un-raisable. The raised invocation gossips to peers and surfaces in their pending
+/// set; the other holders cosign via `/v1/accord/invocation/concur`, and the quorum-
+/// completing signature is what replicates-first-then-latches the disk halt.
+///
+/// This is the binding twin of [`initiate_drill`] (identical opener; the kind is
+/// `constitutional` instead of `drill`). Unlike a drill, a synthesized halt is a REAL
+/// kill-switch once it reaches quorum — the sub-quorum raise is the deliberately safe part.
+async fn initiate_halt(State(st): State<AccordState>, body: axum::body::Bytes) -> Response {
+    let req: HaltRequest = match serde_json::from_slice(&body) {
+        Ok(r) => r,
+        Err(e) => return err(StatusCode::BAD_REQUEST, &format!("bad request: {e}")),
+    };
+    // A full constitutional invocation (holder-app path) takes precedence; otherwise the
+    // node synthesizes it from the id (the app holds no keys). The single opener signature
+    // is sub-quorum — it gossips but cannot latch.
+    let invocation = match req.invocation {
+        Some(inv) => {
+            if inv.invocation_kind != InvocationKind::Constitutional {
+                return err(
+                    StatusCode::BAD_REQUEST,
+                    "the halt endpoint requires invocation_kind \"constitutional\"",
+                );
+            }
+            inv
+        }
+        None => {
+            let id = req
+                .invocation_id
+                .as_deref()
+                .map(str::trim)
+                .filter(|s| !s.is_empty())
+                .map_or_else(|| format!("halt-{}", uuid::Uuid::new_v4()), str::to_string);
+            synth_invocation(InvocationKind::Constitutional, &id, b"")
+        }
+    };
+    open_invocation(
+        &st,
+        invocation,
+        req.signature,
+        req.key_id,
+        req.mldsa_usb_path,
+        &req.pkcs11,
+    )
+    .await
+}
+
 /// Shared opener for [`create_invocation`] / [`initiate_drill`]: resolve the
 /// initiating cosignature (client-submitted OR hardware-signed on the node), build the
 /// invocation object over the registered roster, replicate + maybe-halt (which
@@ -2445,6 +2566,9 @@ pub fn router_with_halt(engine: Arc<Engine>, halt: AccordHalt) -> Router {
             "/v1/accord/announce",
             axum::routing::post(initiate_announce),
         )
+        // RAISE a 2-of-3 CONSTITUTIONAL halt (one opener signature — sub-quorum, cannot
+        // latch; the family M-of-N cosign latches). The binding twin of /drill.
+        .route("/v1/accord/halt", axum::routing::post(initiate_halt))
         .route("/v1/accord/halt-status", axum::routing::get(halt_status))
         .route("/v1/accord/events", axum::routing::get(list_events))
         // genesis ceremony
@@ -2517,6 +2641,25 @@ mod tests {
         }
     }
 
+    /// With no entrenched `federation_families` row, `GET /v1/accord/family` projects the
+    /// BAKED genesis — the 2/3 HUMANITY_ACCORD family with its 3 seats — so a fresh node's
+    /// Trust Root card + co-scrub quorum resolve before persist bakes the row (#386).
+    #[tokio::test]
+    async fn get_family_falls_back_to_the_baked_genesis() {
+        let resp = recognized_family_from_baked_genesis();
+        assert_eq!(resp.status(), StatusCode::OK);
+        let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
+            .await
+            .unwrap();
+        let v: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
+        assert_eq!(v["family_key_id"], HUMANITY_ACCORD_FAMILY_KEY_ID);
+        assert_eq!(v["family_name"], "HUMANITY_ACCORD");
+        assert_eq!(v["consensus_protocol"], "quorum:2/3");
+        assert_eq!(v["entrenched"], false);
+        assert_eq!(v["recognized_via"], "baked-genesis");
+        assert_eq!(v["members"].as_array().map(|a| a.len()), Some(3));
+    }
+
     /// A client-submitted signature is passed through verbatim (the holder-app
     /// contract keeps working, feature-independent).
     #[tokio::test]

{ciris_server-0.5.82 → ciris_server-0.5.83}/src/accord_provision.rs

@@ -1795,16 +1795,30 @@ fn now_rfc3339() -> String {
     chrono::Utc::now().to_rfc3339()
 }
 
-/// The accord family's live m-of-n `M` (0 when the family/quorum isn't locally resolvable).
+/// The accord family's live m-of-n `M`. Reads the entrenched persist family row when
+/// present, else falls back to the BAKED verify genesis quorum (the same recognition the
+/// kill-switch roster + `GET /v1/accord/family` use) so a fresh node reports `2` rather than
+/// `0` before persist entrenches the row (CIRISPersist#386). `0` only if unresolvable.
 async fn family_quorum_m(engine: &Engine) -> usize {
-    use ciris_verify_core::accord_genesis::HUMANITY_ACCORD_FAMILY_KEY_ID;
+    use ciris_verify_core::accord_genesis::{
+        humanity_accord_genesis, HUMANITY_ACCORD_FAMILY_KEY_ID,
+    };
     use ciris_verify_core::threshold::QuorumPolicy;
-    match crate::family::lookup(engine, HUMANITY_ACCORD_FAMILY_KEY_ID).await {
-        Ok(Some(fam)) => QuorumPolicy::parse(&fam.consensus_protocol)
+    if let Ok(Some(fam)) = crate::family::lookup(engine, HUMANITY_ACCORD_FAMILY_KEY_ID).await {
+        return QuorumPolicy::parse(&fam.consensus_protocol)
             .map(|p| p.m)
-            .unwrap_or(0),
-        _ => 0,
-    }
+            .unwrap_or(0);
+    }
+    humanity_accord_genesis()
+        .and_then(|g| {
+            g.body
+                .get("family")
+                .and_then(|f| f.get("consensus_protocol"))
+                .and_then(|v| v.as_str())
+        })
+        .and_then(QuorumPolicy::parse)
+        .map(|p| p.m)
+        .unwrap_or(0)
 }
 
 /// The accord family roster's member `key_id`s (None when it can't be resolved — e.g. no