ciris-server 0.5.83__tar.gz → 0.5.85__tar.gz

{ciris_server-0.5.83 → ciris_server-0.5.85}/Cargo.lock

@@ -793,8 +793,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-edge"
-version = "9.1.2"
-source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v9.1.2#f045e0ce73dda711dbbd65faf3e4f9dbb3283c3e"
+version = "9.1.4"
+source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v9.1.4#7eb24431004e7a49aad950855fd5c4836c622918"
 dependencies = [
  "async-trait",
  "axum",
@@ -911,8 +911,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-persist"
-version = "13.2.0"
-source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v13.2.0#3f1506d42b67332a7fdcd3a6eca7d10dd25b9b83"
+version = "13.3.1"
+source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v13.3.1#abb45050b7fa64cfa05295224e69135780acb925"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -949,7 +949,7 @@ dependencies = [
 
 [[package]]
 name = "ciris-server"
-version = "0.5.83"
+version = "0.5.85"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -970,6 +970,7 @@ dependencies = [
  "hex",
  "http-body-util",
  "jsonwebtoken",
+ "libsqlite3-sys",
  "pbkdf2",
  "pyo3",
  "reqwest",

{ciris_server-0.5.83 → ciris_server-0.5.85}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ciris-server"
-version = "0.5.83" # 0.5.83 = BAKED-FAMILY RECOGNITION + RAISE-A-HALT. Same substrate (edge v9.1.2 / persist v13.2.0 / verify v8.9.0). Fixes "No accord family established on this node yet" on a node that has the BAKED genesis but no entrenched federation_families row (persist seeds the 3 holder KEY rows, not the family row — durable fix filed CIRISPersist#386): GET /v1/accord/family + the co-scrub quorum_needed now fall back to verify's baked humanity_accord_genesis() (the 2/3 family + 3 seats, entrenched=false, recognized_via=baked-genesis) — the same recognition resolve_kill_switch_roster already uses. PLUS raise-a-halt: POST /v1/accord/halt (initiate_halt, the binding twin of /drill — one opener signature is sub-quorum and cannot latch; 2-of-3 concur latches) + the client "Halt the mesh" action (was a disabled placeholder). 0.5.82 = CO-SCRUB END-TO-END. Same substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (no triple change). The cross-device m-of-n seed now works from the app: the co-scrub partial GOSSIPS over the accord peer-plane (the same HTTP set the kill-switch uses) — propose on A1's box → the partial surfaces under "Pending co-signs (canonical)" on B1's box → cosign → conferred, no manual transfer. Server (src/accord_provision.rs): ProvisionState gains an ephemeral bounded pending store + a (target,scrub-count) seen-set; ingest_partial validates structurally + upserts + gossips; NEW open (non-loopback) POST /v1/accord/canonical/gossip-partial peer-receive + GET /v1/accord/canonical/pending; router() split into build()→{loopback,gossip}. Client (#174): proposeCanonical/cosignCanonical/listPendingCoscrubs, the "Pending co-signs (canonical)" section + CanonicalCosignSheet (pending-entry or pasted-partial fallback), "[+ New] Add"→"Propose a canonical server". Bundled: #117 (Delegations loads on screen entry, not VM init → no pre-login 401) + #134 (existing-key offer no longer gated on a typed label; label auto-populates from the picked key_id). 0.5.81 = M-OF-N TRUST ROOT. Substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (CIRISPersist#383: KeyRecord.additional_scrubs + the DYNAMIC m-of-n admission gate via verify's verify_quorum_policy — canonical is conferred iff distinct_scrub_count() ≥ the family's entrenched quorum:M/N, NOT a hardcoded 2; the 1-of-N genesis is no longer auto-baked). Trust Root co-scrub ceremony (server-side, hardware-signed via the shared open_holder_identity custody path): POST /v1/accord/canonical/{propose,cosign} (scrub #1 → gossip/transfer the partial → append_scrub over the byte-identical envelope → adopt_scrub_upgrade lets the m-of-n gate confer/hold), plus /withdraw + /supersede (#377, 2-of-3 via proposal_digest) and IP-in-envelope TransportHint. Accord ops drill + announce (/v1/accord/{drill,announce}, node-synth'd invocation, gossiped, recorded pre-latch) + /halt-status. DRY audit landed (recipes routed through the substrate: build_self_key_record→produce_self_key_record, CANONICAL_BOOTSTRAP_PEERS→Engine::canonical_bootstrap_hints, owner_binding consts aliased). CEG-native Trust Root card redesign (one AttestationCard + ⋮ hamburger; concur now hardware-signs). KNOWN → 0.5.82 (#174): the client "Add canonical" still posts /add (1-scrub partial under m-of-n) — wire the propose→cosign buttons. 0.5.80 = THE MESH-SEED RELEASE. Substrate lockstep edge v9.1.0 / persist v13.0.1 / verify v8.7.0 (CC 1.0 RC1: KeyRecord.consent_role, the accord-conferred `canonical` identity_type role + admission gate CIRISPersist#372, single-owner owner_of #162, CIRISEdge#277 upgrade-aware Key-plane apply → KERI publish-own end-to-end). Trust Root canonical ops (#164): POST /v1/accord/canonical/add — the 1-of-N hardware-scrub SEED op (scrub-sign w/ the canonical role + adopt onto own row + publish address) + GET /v1/accord/canonical/servers + the client "Canonical servers" card (update-address shipped #165; supersede/withdraw → 0.5.81, need a persist role-removal primitive). ci.yml revived (my #155 evidence-step colon had broken the Rust gate repo-wide). 0.5.79 = substrate triple edge v8.7.2 / persist v12.5.0 / verify v8.7.0 (cross-cdylib block_on-deadlock/SIGABRT fix + CC 0.9.3 gates + dep-trims landed: hickory 0.25 de-dup, dead openssl/qrcodegen/bip39 gone) + REMOTE adopt-scrubbed endpoint (#150 — POST /v1/federation/adopt-scrubbed applies an A1-scrubbed record onto a node's own row so it roots; the seed producer's remote leg, keys live off-node) + server-local dep-trims (#152: drop hmac/pyo3-async-runtimes, lens-core async-trait/opentelemetry, base64 0.21→0.22). 0.5.78 = edge v8.6.1 / persist v12.2.0 adoption — the COMPLETE admit-node → mesh-seed loop. (1) #144 KEY-PLANE replication (KERI publish-own): the ReplicationRuntime converges an EnvelopeKind::Key coordinator per consent peer + a key_selector publishing the node's OWN key_id. (2) #150 PRODUCER: admit-node now calls persist v12.2.0 Engine::adopt_scrub_upgrade (CIRISPersist#351) to upgrade the node's own self-signed row to the accord-holder-scrubbed record — so the Key plane publishes an ANCHORED, rootable record → peers root it. Producer (server upgrades the row) + publish-own (edge advertises it) = the seed closes in place, no wipe. (3) #147 §Q B5: persist FountainHeldMeta.{content_bytes,cohort_scope} adopted (server has no fountain-content admit path; import.rs already sets cohort_scope). Verify unchanged v8.5.0. 0.5.77 = persist v12.0.2 anchor seed + accord-card UX.
+version = "0.5.85" # 0.5.85 = SEED-UX cut (no substrate change; edge v9.1.4 / persist v13.3.1 / verify v8.9.0). The fixes that let the operator + a second holder seed the canonical mesh cleanly from the desktop UI: (1) OS-AWARE ykcs11 module path — the node's default PKCS#11 module now resolves per-OS (macOS Homebrew .dylib Apple-Silicon/Intel; Windows Yubico PIV Tool .dll / PATH; Linux .so) via identity.rs::default_ykcs11_module, wired into Pkcs11Options + the accord propose/cosign/admit paths, so a macOS/Windows holder's YubiKey cosign works (was hardcoded Linux → dlopen failure). Optional per-request "PKCS#11 module path (advanced)" field in the hardware-scrub sheet as an override. (2) COPY/EXPORT the co-scrub partial + finished record from the Trust Root card (Propose/Cosign/Pending) — Copy-to-clipboard + Save-to-file; no more pulling JSON off disk. (3) NAV label "Accord" → "Trust Root". (4) CIRISServer#127++ — the memory graph now PROJECTS persist's CEG state (seed_ceg_graph): ~40+ nodes (identity, owner, owned nodes, HUMANITY_ACCORD family + holders, canonical servers, config:*, delegations/consent/structural attestations) with CEG-native typed edges (delegates_to owner-binding, has_member family→holder seat, scrub_conferral holder→canonical, has_config, replicates_to, authored, supersedes/withdraws/recants); each node carries kind·subject·status·record so the client can render it as an AttestationCard. Follow-ups: wire the Trust Root ⋮ hamburger onto graph nodes (client); 28-language fan-out for the 7 new strings; pending-co-scrub graph node. 0.5.84 = THE FULL SAFE-MESH-SEED CUT. Substrate lockstep bumped edge v9.1.2→v9.1.4 / persist v13.2.0→v13.3.1 (v13.3.1 #387 adds the test-only with_signer_no_genesis_seed seam so the accord ceremony tests get a clean engine) (verify v8.9.0 unchanged). (1) CIRISPersist#386: the HUMANITY_ACCORD federation_families row (quorum:2/3, A1/B1/C1) is now SEEDED at boot on every node (idempotent) — lookup_family resolves durably, so the 0.5.83 baked-genesis fallbacks are RETIRED (recognized_family_from_baked_genesis + family_quorum_m fallback deleted; get_family reads the real entrenched row; V097 drops the family_key_id→federation_keys FK — a constitutional family is keyless). (2) CIRISServer#181 producer hook: POST /v1/safety/flag (duty-gated: verify_request + admit_moderation_action(Moderate)) emits the substrate-reserved content_class:{infohazard|reported} flag via a NEW node-scoped substrate_persist identity (sealed Ed25519 <alias>-substrate + software ML-DSA seed, registered through register_federation_key) — the duty-holder authorizes, the substrate signs; action:clear supersedes. This makes the #161 infohazard reveal gate actually FIRE (flag → GET /v1/safety/reveal 403 interstitial for a non-consented viewer). (3) CIRISServer#161 (already on main): POST /v1/safety/reveal — the CC 4.5.13 consent gate. #378 single-owner marker gate rides the persist bump (no server action). Follow-ups: retire ensure_accord_family_anchor throwaway key (low-risk, legacy assemble path); infohazard consent lifecycle + interstitial UX (#180 umbrella / #182-#185). 0.5.83 = BAKED-FAMILY RECOGNITION + RAISE-A-HALT. Same substrate (edge v9.1.2 / persist v13.2.0 / verify v8.9.0). Fixes "No accord family established on this node yet" on a node that has the BAKED genesis but no entrenched federation_families row (persist seeds the 3 holder KEY rows, not the family row — durable fix filed CIRISPersist#386): GET /v1/accord/family + the co-scrub quorum_needed now fall back to verify's baked humanity_accord_genesis() (the 2/3 family + 3 seats, entrenched=false, recognized_via=baked-genesis) — the same recognition resolve_kill_switch_roster already uses. PLUS raise-a-halt: POST /v1/accord/halt (initiate_halt, the binding twin of /drill — one opener signature is sub-quorum and cannot latch; 2-of-3 concur latches) + the client "Halt the mesh" action (was a disabled placeholder). 0.5.82 = CO-SCRUB END-TO-END. Same substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (no triple change). The cross-device m-of-n seed now works from the app: the co-scrub partial GOSSIPS over the accord peer-plane (the same HTTP set the kill-switch uses) — propose on A1's box → the partial surfaces under "Pending co-signs (canonical)" on B1's box → cosign → conferred, no manual transfer. Server (src/accord_provision.rs): ProvisionState gains an ephemeral bounded pending store + a (target,scrub-count) seen-set; ingest_partial validates structurally + upserts + gossips; NEW open (non-loopback) POST /v1/accord/canonical/gossip-partial peer-receive + GET /v1/accord/canonical/pending; router() split into build()→{loopback,gossip}. Client (#174): proposeCanonical/cosignCanonical/listPendingCoscrubs, the "Pending co-signs (canonical)" section + CanonicalCosignSheet (pending-entry or pasted-partial fallback), "[+ New] Add"→"Propose a canonical server". Bundled: #117 (Delegations loads on screen entry, not VM init → no pre-login 401) + #134 (existing-key offer no longer gated on a typed label; label auto-populates from the picked key_id). 0.5.81 = M-OF-N TRUST ROOT. Substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (CIRISPersist#383: KeyRecord.additional_scrubs + the DYNAMIC m-of-n admission gate via verify's verify_quorum_policy — canonical is conferred iff distinct_scrub_count() ≥ the family's entrenched quorum:M/N, NOT a hardcoded 2; the 1-of-N genesis is no longer auto-baked). Trust Root co-scrub ceremony (server-side, hardware-signed via the shared open_holder_identity custody path): POST /v1/accord/canonical/{propose,cosign} (scrub #1 → gossip/transfer the partial → append_scrub over the byte-identical envelope → adopt_scrub_upgrade lets the m-of-n gate confer/hold), plus /withdraw + /supersede (#377, 2-of-3 via proposal_digest) and IP-in-envelope TransportHint. Accord ops drill + announce (/v1/accord/{drill,announce}, node-synth'd invocation, gossiped, recorded pre-latch) + /halt-status. DRY audit landed (recipes routed through the substrate: build_self_key_record→produce_self_key_record, CANONICAL_BOOTSTRAP_PEERS→Engine::canonical_bootstrap_hints, owner_binding consts aliased). CEG-native Trust Root card redesign (one AttestationCard + ⋮ hamburger; concur now hardware-signs). KNOWN → 0.5.82 (#174): the client "Add canonical" still posts /add (1-scrub partial under m-of-n) — wire the propose→cosign buttons. 0.5.80 = THE MESH-SEED RELEASE. Substrate lockstep edge v9.1.0 / persist v13.0.1 / verify v8.7.0 (CC 1.0 RC1: KeyRecord.consent_role, the accord-conferred `canonical` identity_type role + admission gate CIRISPersist#372, single-owner owner_of #162, CIRISEdge#277 upgrade-aware Key-plane apply → KERI publish-own end-to-end). Trust Root canonical ops (#164): POST /v1/accord/canonical/add — the 1-of-N hardware-scrub SEED op (scrub-sign w/ the canonical role + adopt onto own row + publish address) + GET /v1/accord/canonical/servers + the client "Canonical servers" card (update-address shipped #165; supersede/withdraw → 0.5.81, need a persist role-removal primitive). ci.yml revived (my #155 evidence-step colon had broken the Rust gate repo-wide). 0.5.79 = substrate triple edge v8.7.2 / persist v12.5.0 / verify v8.7.0 (cross-cdylib block_on-deadlock/SIGABRT fix + CC 0.9.3 gates + dep-trims landed: hickory 0.25 de-dup, dead openssl/qrcodegen/bip39 gone) + REMOTE adopt-scrubbed endpoint (#150 — POST /v1/federation/adopt-scrubbed applies an A1-scrubbed record onto a node's own row so it roots; the seed producer's remote leg, keys live off-node) + server-local dep-trims (#152: drop hmac/pyo3-async-runtimes, lens-core async-trait/opentelemetry, base64 0.21→0.22). 0.5.78 = edge v8.6.1 / persist v12.2.0 adoption — the COMPLETE admit-node → mesh-seed loop. (1) #144 KEY-PLANE replication (KERI publish-own): the ReplicationRuntime converges an EnvelopeKind::Key coordinator per consent peer + a key_selector publishing the node's OWN key_id. (2) #150 PRODUCER: admit-node now calls persist v12.2.0 Engine::adopt_scrub_upgrade (CIRISPersist#351) to upgrade the node's own self-signed row to the accord-holder-scrubbed record — so the Key plane publishes an ANCHORED, rootable record → peers root it. Producer (server upgrades the row) + publish-own (edge advertises it) = the seed closes in place, no wipe. (3) #147 §Q B5: persist FountainHeldMeta.{content_bytes,cohort_scope} adopted (server has no fountain-content admit path; import.rs already sets cohort_scope). Verify unchanged v8.5.0. 0.5.77 = persist v12.0.2 anchor seed + accord-card UX.
 edition = "2021"
 # MSRV floor is set by the substrate: ciris-verify v5.2.0 requires 1.86
 # (persist v6.0.1 is 1.83). Build with the higher of the two.
@@ -122,8 +122,8 @@ ciris-lens-core     = { path = "crates/ciris-lens-core" } # ABSORBED in-tree (wo
 # `cirislens_wa_cert` + `cirislens_service_token_revocation` expose the auth
 # substrate the fabric absorbs (CIRISServer#9, src/auth): the agent's `wa_cert`
 # table (users/WA/OAuth/api-keys) + the `revoked_service_tokens` table.
-ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.2.0", features = ["sqlite", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
-ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.1.2", features = ["transport-reticulum", "transport-http", "transport-packet-radio"] }
+ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.3.1", features = ["sqlite", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
+ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.1.4", features = ["transport-reticulum", "transport-http", "transport-packet-radio"] }
 # Founder-quorum verification + key-id fingerprint at the composition root
 # (threshold:: module path — NOT re-exported at the crate root).
 # LOCKSTEP: persist v9.4.0 transitively pins verify-core v6.6.x — the whole
@@ -204,7 +204,7 @@ tracing-appender = "0.2"
 # - keyring `tpm` (tss-esapi / TPM 2.0) — the real hardware backend; needs
 #   libtss2 (Linux build dep). Other targets keep the software keystore.
 [target.'cfg(target_os = "linux")'.dependencies]
-ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.2.0", features = ["postgres", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.3.1", features = ["postgres", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
 # keyring `tpm` (TPM-at-rest, Linux-only via tss-esapi). `pkcs11` is no longer
 # per-target — it rides the global `pkcs11` feature now that cryptoki builds on all
 # targets (CIRISVerify v6.12.0).
@@ -224,6 +224,20 @@ ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.9.0"
 [target.'cfg(any(target_os = "macos", target_os = "windows", all(target_os = "linux", target_env = "gnu", any(target_arch = "x86_64", target_arch = "aarch64"))))'.dependencies]
 serialport = "4"
 
+# libsqlite3-sys (pulled by persist's `sqlite` feature) links the SYSTEM libsqlite3
+# by default — which the musl / armv7 CROSS sysroots don't provide, so the release
+# legs failed at LINK: `unable to find dynamic system library 'sqlite3'`. Compile
+# sqlite FROM SOURCE (`bundled`) for exactly those two cross triples — `zig cc`
+# builds the C in, statically, no dynamic dependency. Scoped per-triple so every
+# mainstream target keeps linking its system sqlite (smaller; matches persist's
+# non-mobile default). SAME libsqlite3-sys 0.28 the `sqlite` feature already locks,
+# so it UNIFIES to one crate (one `links = "sqlite3"`, no collision).
+[target.aarch64-unknown-linux-musl.dependencies]
+libsqlite3-sys = { version = "0.28", features = ["bundled"] }
+
+[target.armv7-unknown-linux-gnueabihf.dependencies]
+libsqlite3-sys = { version = "0.28", features = ["bundled"] }
+
 # Test-only — the two-node replication integration test (tests/replication.rs)
 # builds + signs CEG batches with the same primitives persist verifies against.
 # ed25519-dalek MUST match persist's locked 2.x (the SigningKey type crosses the
@@ -257,7 +271,13 @@ ciris-crypto  = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.9.0"
 # and never encodes/decodes). This lets tests/chaos_mesh.rs exercise the SUBSTRATE
 # codec (`fountain_encode`/`fountain_decode`) directly — a real MEASURED proof,
 # not a reference stand-in.
-ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.1.2", features = ["codec-fountain"] }
+ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.1.4", features = ["codec-fountain"] }
+# Enable persist's TEST-ONLY genesis-seam (`test-genesis-seam`, CIRISPersist#387) for the
+# accord ceremony tests (tests/accord.rs): `Engine::with_signer_no_genesis_seed` yields a
+# clean engine with the baked HUMANITY_ACCORD family seed SKIPPED, so those tests can stand
+# up their OWN custom-holder family via the assemble ceremony. Dev/test ONLY — resolver-2
+# keeps this feature out of the shipped lib/bin/wheel (prod always seeds the baked family).
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.3.1", features = ["test-genesis-seam"] }
 
 # PQC realtime-A/V streaming E2E benchmark (CIRISEdge#62 realtime_av profile).
 [[bench]]

{ciris_server-0.5.83 → ciris_server-0.5.85}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ciris-server
-Version: 0.5.83
+Version: 0.5.85
 License-File: LICENSE
 Summary: The fabric node — the federation's headless cohabitation runtime (registry + lens [+ node] over one shared substrate), as the abi3 wheel CIRISAgent consumes. agent = fabric node + brain.
 Author-email: Eric Moore <eric@ciris.ai>
@@ -142,8 +142,8 @@ capability page at <https://cirisai.github.io/CIRISServer/>, and the §19.7
 noise-floor compliance bench. Below the lens-store disk minimum the node degrades
 to a Reticulum relay node.
 
-Substrate floor: **persist v8.6.0 / edge v4.5.0 / verify-family v5.11.0**
-(CEG 1.0-RC12). `ciris-lens-core` is **absorbed in-tree** — the standalone
+Substrate floor: **persist v13.3.0 / edge v9.1.3 / verify-family v8.9.0**
+(the 0.5.84 safe-mesh-seed cut; see `Cargo.toml`). `ciris-lens-core` is **absorbed in-tree** — the standalone
 CIRISLensCore library and the CIRISLens deployment (Grafana/TimescaleDB/Python
 ingest) retire. Cohabitation + CEG-profile conformance is gated by
 [CIRISConformance](https://github.com/CIRISAI/CIRISConformance) against the

{ciris_server-0.5.83 → ciris_server-0.5.85}/README.md

@@ -131,8 +131,8 @@ capability page at <https://cirisai.github.io/CIRISServer/>, and the §19.7
 noise-floor compliance bench. Below the lens-store disk minimum the node degrades
 to a Reticulum relay node.
 
-Substrate floor: **persist v8.6.0 / edge v4.5.0 / verify-family v5.11.0**
-(CEG 1.0-RC12). `ciris-lens-core` is **absorbed in-tree** — the standalone
+Substrate floor: **persist v13.3.0 / edge v9.1.3 / verify-family v8.9.0**
+(the 0.5.84 safe-mesh-seed cut; see `Cargo.toml`). `ciris-lens-core` is **absorbed in-tree** — the standalone
 CIRISLensCore library and the CIRISLens deployment (Grafana/TimescaleDB/Python
 ingest) retire. Cohabitation + CEG-profile conformance is gated by
 [CIRISConformance](https://github.com/CIRISAI/CIRISConformance) against the

{ciris_server-0.5.83 → ciris_server-0.5.85}/crates/ciris-lens-core/Cargo.toml

@@ -26,8 +26,8 @@ crate-type = ["cdylib", "rlib"]
 #
 # OQ-01 closure 2026-05-03: rlib primary, PyO3 cdylib via `python`
 # feature for the deployed-lens cutover.
-ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.2.0", version = "13", features = ["extract", "sqlite"] }
-ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge",    tag = "v9.1.2", version = "9", features = ["transport-http", "transport-reticulum"] }
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.3.1", version = "13", features = ["extract", "sqlite"] }
+ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge",    tag = "v9.1.4", version = "9", features = ["transport-http", "transport-reticulum"] }
 
 # Keyring — relay mode (CIRISLensCore#10) loads its Edge transport-
 # signing identity via `ciris_keyring::load_local_seed`. Edge's

{ciris_server-0.5.83 → ciris_server-0.5.85}/evidence/cc_impl.tsv

@@ -8,47 +8,47 @@ decimal_id	claim_id	repo	path#symbol	crate@version
 2.2	CLM-conformance	—	—	open
 2.3.1	CLM-subject_kind-subject-2	CIRISVerify	src/ciris-verify-core/src/fedcode.rs#FedKind	ciris-verify-core@v8.9.0
 2.3.2.1	CLM-registry-canonical	CIRISVerify	src/ciris-verify-core/src/federation_self_record.rs#produce_self_key_record	ciris-verify-core@v8.9.0
-2.4.1.1	CLM-withdraws	CIRISPersist	src/federation/admission.rs#resolve_withdraws_admission_rule	ciris-persist@v13.2.0
+2.4.1.1	CLM-withdraws	CIRISPersist	src/federation/admission.rs#resolve_withdraws_admission_rule	ciris-persist@v13.3.1
 2.6.1.1	CLM-round-trip	CIRISVerify	src/ciris-verify-core/src/jcs.rs#canonicalize	ciris-verify-core@v8.9.0
 2.6.1.1.1	CLM-canonicalization-array	CIRISVerify	src/ciris-verify-core/src/federation_keyset.rs#federation_keyset_signing_bytes	ciris-verify-core@v8.9.0
 2.6.1.2	CLM-per-field	CIRISVerify	src/ciris-verify-core/src/skill_import.rs#verify_skill_import_manifest	ciris-verify-core@v8.9.0
-2.6.1.3	CLM-canonical	CIRISPersist	src/verify/canonical.rs#JcsCanonicalizer	ciris-persist@v13.2.0
+2.6.1.3	CLM-canonical	CIRISPersist	src/verify/canonical.rs#JcsCanonicalizer	ciris-persist@v13.3.1
 2.6.1.4	CLM-worked	—	—	open
 2.6.2	CLM-canonicalization	CIRISVerify	src/ciris-verify-core/src/skill_import.rs#check_canonical_rfc3339	ciris-verify-core@v8.9.0
 2.6.3	CLM-canonicalization-hexadecimal	CIRISVerify	src/ciris-verify-core/src/skill_import.rs#check_canonical_hex64	ciris-verify-core@v8.9.0
 2.6.4	CLM-policy-versioning	—	—	open
 2.6.5	CLM-references	—	—	open
-2.6.6	CLM-canonicalization-cell	CIRISPersist	src/federation/location.rs#parse_canonical_cell	ciris-persist@v13.2.0
-2.6.6.1	CLM-location	CIRISPersist	src/federation/location.rs#validate_location_cell	ciris-persist@v13.2.0
-2.6.6.2	CLM-cell	CIRISPersist	src/federation/location.rs#h3_cell_contained	ciris-persist@v13.2.0
-2.6.7	CLM-time	CIRISPersist	src/federation/operational.rs#check_skew_bound	ciris-persist@v13.2.0
+2.6.6	CLM-canonicalization-cell	CIRISPersist	src/federation/location.rs#parse_canonical_cell	ciris-persist@v13.3.1
+2.6.6.1	CLM-location	CIRISPersist	src/federation/location.rs#validate_location_cell	ciris-persist@v13.3.1
+2.6.6.2	CLM-cell	CIRISPersist	src/federation/location.rs#h3_cell_contained	ciris-persist@v13.3.1
+2.6.7	CLM-time	CIRISPersist	src/federation/operational.rs#check_skew_bound	ciris-persist@v13.3.1
 2.6.8	CLM-key_id	CIRISServer	src/nodecode.rs#encode	ciris-server@main
 2.6.9	CLM-conformance-language	—	—	open
 3.1.2.1	CLM-provenance	CIRISVerify	src/ciris-verify-core/src/holds_bytes.rs#verify_holds_bytes	ciris-verify-core@v8.9.0
 3.1.9.1	CLM-contributions	CIRISVerify	src/ciris-verify-core/src/manifest_contribution.rs#verify_build_manifest_contribution	ciris-verify-core@v8.9.0
-3.3.2	CLM-subject_kind	CIRISPersist	src/federation/admission.rs#envelope_subject_kind	ciris-persist@v13.2.0
-3.3.3	CLM-subject_kind-subject	CIRISPersist	src/federation/types.rs#LocationProof	ciris-persist@v13.2.0
-3.3.4	CLM-family-subject	CIRISPersist	src/federation/types.rs#Family	ciris-persist@v13.2.0
-3.3.5	CLM-consent-subject	CIRISPersist	src/federation/types.rs#consent_record::SUBJECT_KIND	ciris-persist@v13.2.0
-3.3.6	CLM-identity	CIRISPersist	src/federation/types.rs#IdentityOccurrence	ciris-persist@v13.2.0
-3.3.6.1	CLM-encryption_pubkeys	CIRISPersist	src/federation/types.rs#EncryptionPubkeys	ciris-persist@v13.2.0
+3.3.2	CLM-subject_kind	CIRISPersist	src/federation/admission.rs#envelope_subject_kind	ciris-persist@v13.3.1
+3.3.3	CLM-subject_kind-subject	CIRISPersist	src/federation/types.rs#LocationProof	ciris-persist@v13.3.1
+3.3.4	CLM-family-subject	CIRISPersist	src/federation/types.rs#Family	ciris-persist@v13.3.1
+3.3.5	CLM-consent-subject	CIRISPersist	src/federation/types.rs#consent_record::SUBJECT_KIND	ciris-persist@v13.3.1
+3.3.6	CLM-identity	CIRISPersist	src/federation/types.rs#IdentityOccurrence	ciris-persist@v13.3.1
+3.3.6.1	CLM-encryption_pubkeys	CIRISPersist	src/federation/types.rs#EncryptionPubkeys	ciris-persist@v13.3.1
 3.3.6.2	CLM-transport-authenticated	CIRISVerify	src/ciris-verify-core/src/transport_binding.rs#verify_transport_binding	ciris-verify-core@v8.9.0
 3.3.6.2.1	CLM-rns	CIRISVerify	src/ciris-verify-core/src/transport_binding.rs#compute_destination_hash	ciris-verify-core@v8.9.0
 3.3.7	CLM-consent-directed	CIRISServer	src/peer.rs#emit_replication_consent	ciris-server@main
-3.4.1	CLM-accord-reservation	CIRISPersist	src/federation/admission.rs#check_reserved_prefix_admission	ciris-persist@v13.2.0
-3.4.2	CLM-community-location	CIRISPersist	src/federation/hard_case.rs#kind::COMMUNITY_MEMBERSHIP_CHANGE	ciris-persist@v13.2.0
-3.4.3	CLM-system	CIRISPersist	src/federation/admission.rs#default_reserved_prefix_rules	ciris-persist@v13.2.0
-3.4.4	CLM-family-self	CIRISPersist	src/federation/hard_case.rs#kind::FAMILY_MEMBERSHIP_CHANGE	ciris-persist@v13.2.0
-3.4.5	CLM-capacity-score	CIRISPersist	src/federation/admission.rs#check_reserved_prefix_admission	ciris-persist@v13.2.0
-3.4.6	CLM-reservation-delivery	CIRISPersist	src/federation/stream_receipt.rs#DeliveryReceipt	ciris-persist@v13.2.0
-3.4.7	CLM-enforcement	CIRISPersist	src/federation/admission.rs#DimensionAdmissionPolicy::check	ciris-persist@v13.2.0
-3.4.7.1	CLM-identity-set	CIRISPersist	src/federation/types.rs#identity_type::set_contains	ciris-persist@v13.2.0
-3.4.7.2	CLM-consent-counter	CIRISEdge	src/detector/probe_pattern_observer.rs#ConsentRole::permits_detection_emission	ciris-edge@v9.1.2
-3.4.8	CLM-detector-only	CIRISEdge	src/detector/probe_pattern_observer.rs#ProbePatternObserver	ciris-edge@v9.1.2
+3.4.1	CLM-accord-reservation	CIRISPersist	src/federation/admission.rs#check_reserved_prefix_admission	ciris-persist@v13.3.1
+3.4.2	CLM-community-location	CIRISPersist	src/federation/hard_case.rs#kind::COMMUNITY_MEMBERSHIP_CHANGE	ciris-persist@v13.3.1
+3.4.3	CLM-system	CIRISPersist	src/federation/admission.rs#default_reserved_prefix_rules	ciris-persist@v13.3.1
+3.4.4	CLM-family-self	CIRISPersist	src/federation/hard_case.rs#kind::FAMILY_MEMBERSHIP_CHANGE	ciris-persist@v13.3.1
+3.4.5	CLM-capacity-score	CIRISPersist	src/federation/admission.rs#check_reserved_prefix_admission	ciris-persist@v13.3.1
+3.4.6	CLM-reservation-delivery	CIRISPersist	src/federation/stream_receipt.rs#DeliveryReceipt	ciris-persist@v13.3.1
+3.4.7	CLM-enforcement	CIRISPersist	src/federation/admission.rs#DimensionAdmissionPolicy::check	ciris-persist@v13.3.1
+3.4.7.1	CLM-identity-set	CIRISPersist	src/federation/types.rs#identity_type::set_contains	ciris-persist@v13.3.1
+3.4.7.2	CLM-consent-counter	CIRISEdge	src/detector/probe_pattern_observer.rs#ConsentRole::permits_detection_emission	ciris-edge@v9.1.4
+3.4.8	CLM-detector-only	CIRISEdge	src/detector/probe_pattern_observer.rs#ProbePatternObserver	ciris-edge@v9.1.4
 3.4.9	CLM-co-stewarded	—	—	open
-3.4.10	CLM-witness-emitter	CIRISPersist	src/federation/admission.rs#default_reserved_prefix_rules	ciris-persist@v13.2.0
-3.5.1	CLM-concurrent-write	CIRISPersist	src/federation/precedence.rs#precedence_winner	ciris-persist@v13.2.0
-4.1.1	CLM-anti-pattern-delegation	CIRISPersist	src/federation/admission.rs#AttestationLadderTransitionPolicy	ciris-persist@v13.2.0
+3.4.10	CLM-witness-emitter	CIRISPersist	src/federation/admission.rs#default_reserved_prefix_rules	ciris-persist@v13.3.1
+3.5.1	CLM-concurrent-write	CIRISPersist	src/federation/precedence.rs#precedence_winner	ciris-persist@v13.3.1
+4.1.1	CLM-anti-pattern-delegation	CIRISPersist	src/federation/admission.rs#AttestationLadderTransitionPolicy	ciris-persist@v13.3.1
 4.1.4	CLM-withdraws-arbitrage	—	—	open
 4.2.1.1	CLM-invocation	CIRISVerify	src/ciris-verify-core/src/humanity_accord.rs#Invocation::canonical_bytes	ciris-verify-core@v8.9.0
 4.2.1.2	CLM-notify	CIRISVerify	src/ciris-verify-core/src/humanity_accord.rs#InvocationKind	ciris-verify-core@v8.9.0
@@ -59,59 +59,59 @@ decimal_id	claim_id	repo	path#symbol	crate@version
 4.4	CLM-composition-policies	—	—	open
 4.4.1	CLM-frickerian	—	—	open
 4.4.3.1.1	CLM-sub-quorum	CIRISServer	src/accord.rs#replicate_and_maybe_halt	ciris-server@main
-4.4.3.2.1	CLM-community-three	CIRISPersist	src/federation/community_dek.rs#encrypt_and_cascade_community	ciris-persist@v13.2.0
+4.4.3.2.1	CLM-community-three	CIRISPersist	src/federation/community_dek.rs#encrypt_and_cascade_community	ciris-persist@v13.3.1
 4.4.3.2.4.1	CLM-deterministic	CIRISVerify	src/ciris-verify-core/src/transport_binding.rs#compute_destination_hash	ciris-verify-core@v8.9.0
-4.4.3.2.8	CLM-affiliations	CIRISPersist	src/federation/cohort.rs#Cohort::Affiliations	ciris-persist@v13.2.0
-4.4.3.4	CLM-family-policy	CIRISPersist	src/federation/at_rest_cascade.rs#resolve_recipients	ciris-persist@v13.2.0
-4.4.3.4.1	CLM-cascade	CIRISPersist	src/federation/at_rest_cascade.rs#encrypt_and_cascade	ciris-persist@v13.2.0
+4.4.3.2.8	CLM-affiliations	CIRISPersist	src/federation/cohort.rs#Cohort::Affiliations	ciris-persist@v13.3.1
+4.4.3.4	CLM-family-policy	CIRISPersist	src/federation/at_rest_cascade.rs#resolve_recipients	ciris-persist@v13.3.1
+4.4.3.4.1	CLM-cascade	CIRISPersist	src/federation/at_rest_cascade.rs#encrypt_and_cascade	ciris-persist@v13.3.1
 4.4.3.4.3	CLM-cohort	CIRISVerify	src/ciris-verify-core/src/self_at_login.rs#perform_self_at_login	ciris-verify-core@v8.9.0
 4.4.3.4.3.1	CLM-canonicalization-signing	CIRISVerify	src/ciris-verify-core/src/self_at_login.rs#sign_partnership_grant	ciris-verify-core@v8.9.0
-4.4.3.5.4	CLM-multi-subject	CIRISPersist	src/federation/admission.rs#resolve_withdraws_admission_rule	ciris-persist@v13.2.0
-4.4.3.6	CLM-policy-attestation	CIRISPersist	src/federation/admission.rs#is_attestation_ladder_dimension	ciris-persist@v13.2.0
-4.4.3.10	CLM-policy-trusted	CIRISPersist	src/cirisnode/media_sharing.rs#LegalBasis::composes_with_age_gate	ciris-persist@v13.2.0
-4.5.1.1	CLM-axis	CIRISPersist	src/federation/schema_resolver.rs#axis_from_dimension	ciris-persist@v13.2.0
-4.5.2.1	CLM-subject_kind-subject-3	CIRISPersist	src/federation/admission.rs#envelope_subject_kind	ciris-persist@v13.2.0
+4.4.3.5.4	CLM-multi-subject	CIRISPersist	src/federation/admission.rs#resolve_withdraws_admission_rule	ciris-persist@v13.3.1
+4.4.3.6	CLM-policy-attestation	CIRISPersist	src/federation/admission.rs#is_attestation_ladder_dimension	ciris-persist@v13.3.1
+4.4.3.10	CLM-policy-trusted	CIRISPersist	src/cirisnode/media_sharing.rs#LegalBasis::composes_with_age_gate	ciris-persist@v13.3.1
+4.5.1.1	CLM-axis	CIRISPersist	src/federation/schema_resolver.rs#axis_from_dimension	ciris-persist@v13.3.1
+4.5.2.1	CLM-subject_kind-subject-3	CIRISPersist	src/federation/admission.rs#envelope_subject_kind	ciris-persist@v13.3.1
 4.5.2.2	CLM-compliance-vertical	—	—	open
-4.5.3	CLM-takedown	CIRISPersist	src/cirisnode/takedown_handler.rs#process_takedown_admission	ciris-persist@v13.2.0
+4.5.3	CLM-takedown	CIRISPersist	src/cirisnode/takedown_handler.rs#process_takedown_admission	ciris-persist@v13.3.1
 4.5.4	CLM-registry-named	CIRISServer	src/safety/named.rs#existence_verdict	ciris-server@main
 4.5.5	CLM-takedown-moderation	CIRISServer	src/safety/moderation.rs#admit_moderation_action	ciris-server@main
 4.5.7	CLM-registry-watchlist	CIRISServer	src/safety/watchlist.rs#enable_watchlist	ciris-server@main
-4.5.8.1	CLM-cohabitation	CIRISPersist	src/federation/admission.rs#check_node_agency_admission	ciris-persist@v13.2.0
+4.5.8.1	CLM-cohabitation	CIRISPersist	src/federation/admission.rs#check_node_agency_admission	ciris-persist@v13.3.1
 4.5.8.3	CLM-settled	—	—	open
 4.5.10.4	CLM-documents-what-2	—	—	open
-4.5.12.2	CLM-envelope-multi	CIRISPersist	src/federation/mod.rs#add_family_member	ciris-persist@v13.2.0
+4.5.12.2	CLM-envelope-multi	CIRISPersist	src/federation/mod.rs#add_family_member	ciris-persist@v13.3.1
 4.5.13	CLM-reverse-quorum	CIRISVerify	src/ciris-verify-core/src/accord_live_quorum.rs#tally_live_quorum	ciris-verify-core@v8.9.0
 5.3.1	CLM-witness	CIRISVerify	src/ciris-verify-core/src/transparency.rs#SignedTreeHead::cosign	ciris-verify-core@v8.9.0
 5.3.1.1	CLM-consistency-proof	CIRISVerify	src/ciris-verify-core/src/transparency.rs#verify_consistency	ciris-verify-core@v8.9.0
-5.3.2.1	CLM-holder	CIRISPersist	src/federation/blobs.rs#list_holders	ciris-persist@v13.2.0
-5.3.2.3	CLM-merge	CIRISPersist	src/federation/operational.rs#SubjectKind::merge_intent	ciris-persist@v13.2.0
-5.3.2.4	CLM-attestation-tier	CIRISPersist	src/federation/types.rs#Attestation	ciris-persist@v13.2.0
-5.3.2.4.1	CLM-authority-local	CIRISPersist	src/federation/admission.rs#check_local_tier_eligibility	ciris-persist@v13.2.0
-5.3.2.4.2	CLM-local	CIRISPersist	src/engine.rs#Engine::attestation_promote	ciris-persist@v13.2.0
-5.3.2.4.3	CLM-two	CIRISPersist	src/federation/types.rs#attestation_tier	ciris-persist@v13.2.0
-5.3.2.4.3.1	CLM-admission-pqc	CIRISPersist	src/federation/tier_ingest.rs#verify_federation_tier_ingest	ciris-persist@v13.2.0
-5.3.2.5	CLM-full-sha	CIRISPersist	src/federation/blobs.rs#assemble_chunk_dag_range	ciris-persist@v13.2.0
-5.3.3.1	CLM-stream	CIRISEdge	src/transport/realtime_av.rs#seal_av_chunk	ciris-edge@v9.1.2
-5.3.3.2.1	CLM-namespace-realtime	CIRISEdge	src/transport/realtime_av.rs#CODEC_AV1_SVC	ciris-edge@v9.1.2
-5.3.3.2.3	CLM-registry-wire	CIRISEdge	src/transport/realtime_av.rs#SealedAvChunk::to_bytes	ciris-edge@v9.1.2
-5.3.3.2.4	CLM-chunklayer	CIRISEdge	src/transport/realtime_av.rs#ChunkLayer	ciris-edge@v9.1.2
-5.3.3.4	CLM-liveness	CIRISEdge	src/transport/realtime_av.rs#RealtimeFanout::plan_layered	ciris-edge@v9.1.2
-5.3.3.5	CLM-transport-edge	CIRISEdge	src/transport/mod.rs#Transport	ciris-edge@v9.1.2
-5.3.3.6	CLM-delivery	CIRISPersist	src/federation/stream_receipt.rs#DeliveryReceipt	ciris-persist@v13.2.0
-5.3.3.7	CLM-normative	CIRISEdge	src/transport/packet_radio/frame.rs#encode_frame	ciris-edge@v9.1.2
+5.3.2.1	CLM-holder	CIRISPersist	src/federation/blobs.rs#list_holders	ciris-persist@v13.3.1
+5.3.2.3	CLM-merge	CIRISPersist	src/federation/operational.rs#SubjectKind::merge_intent	ciris-persist@v13.3.1
+5.3.2.4	CLM-attestation-tier	CIRISPersist	src/federation/types.rs#Attestation	ciris-persist@v13.3.1
+5.3.2.4.1	CLM-authority-local	CIRISPersist	src/federation/admission.rs#check_local_tier_eligibility	ciris-persist@v13.3.1
+5.3.2.4.2	CLM-local	CIRISPersist	src/engine.rs#Engine::attestation_promote	ciris-persist@v13.3.1
+5.3.2.4.3	CLM-two	CIRISPersist	src/federation/types.rs#attestation_tier	ciris-persist@v13.3.1
+5.3.2.4.3.1	CLM-admission-pqc	CIRISPersist	src/federation/tier_ingest.rs#verify_federation_tier_ingest	ciris-persist@v13.3.1
+5.3.2.5	CLM-full-sha	CIRISPersist	src/federation/blobs.rs#assemble_chunk_dag_range	ciris-persist@v13.3.1
+5.3.3.1	CLM-stream	CIRISEdge	src/transport/realtime_av.rs#seal_av_chunk	ciris-edge@v9.1.4
+5.3.3.2.1	CLM-namespace-realtime	CIRISEdge	src/transport/realtime_av.rs#CODEC_AV1_SVC	ciris-edge@v9.1.4
+5.3.3.2.3	CLM-registry-wire	CIRISEdge	src/transport/realtime_av.rs#SealedAvChunk::to_bytes	ciris-edge@v9.1.4
+5.3.3.2.4	CLM-chunklayer	CIRISEdge	src/transport/realtime_av.rs#ChunkLayer	ciris-edge@v9.1.4
+5.3.3.4	CLM-liveness	CIRISEdge	src/transport/realtime_av.rs#RealtimeFanout::plan_layered	ciris-edge@v9.1.4
+5.3.3.5	CLM-transport-edge	CIRISEdge	src/transport/mod.rs#Transport	ciris-edge@v9.1.4
+5.3.3.6	CLM-delivery	CIRISPersist	src/federation/stream_receipt.rs#DeliveryReceipt	ciris-persist@v13.3.1
+5.3.3.7	CLM-normative	CIRISEdge	src/transport/packet_radio/frame.rs#encode_frame	ciris-edge@v9.1.4
 5.3.4	CLM-multi-steward	CIRISServer	src/accord.rs#list_holders	ciris-server@main
 5.3.6.1	CLM-envelope-error	CIRISVerify	src/ciris-verify-core/src/ceg_error.rs#CegError	ciris-verify-core@v8.9.0
 5.4.1	CLM-record-id	CIRISVerify	src/ciris-crypto/src/scope_privacy.rs#derive_record_id	ciris-crypto@v8.9.0
 5.4.2	CLM-symbol	CIRISVerify	src/ciris-crypto/src/xchacha.rs#seal	ciris-crypto@v8.9.0
-5.4.4	CLM-welcome-wrap	CIRISEdge	src/transport/realtime_av_mls.rs#commit_add	ciris-edge@v9.1.2
+5.4.4	CLM-welcome-wrap	CIRISEdge	src/transport/realtime_av_mls.rs#commit_add	ciris-edge@v9.1.4
 5.4.5	CLM-witness-content	CIRISVerify	src/ciris-crypto/src/scope_privacy.rs#witness_cover_leaf	ciris-crypto@v8.9.0
-5.4.6	CLM-announce-suppress	CIRISEdge	src/transport/addressing.rs#reticulum_destination_for_pubkey	ciris-edge@v9.1.2
-6.1.2	CLM-noise-classify	CIRISPersist	src/fountain/types.rs#classify	ciris-persist@v13.2.0
+5.4.6	CLM-announce-suppress	CIRISEdge	src/transport/addressing.rs#reticulum_destination_for_pubkey	ciris-edge@v9.1.4
+6.1.2	CLM-noise-classify	CIRISPersist	src/fountain/types.rs#classify	ciris-persist@v13.3.1
 6.1.2	CLM-noise-descent	CIRISVerify	src/ciris-verify-core/src/holonomic/aggregation.rs#ejection_verdict	ciris-verify-core@v8.9.0
 6.1.2.1	CLM-aggregationmetav1	CIRISVerify	src/ciris-verify-core/src/holonomic/aggregation.rs#AggregationMetaV1	ciris-verify-core@v8.9.0
 6.1.2.2	CLM-descent	CIRISVerify	src/ciris-verify-core/src/holonomic/aggregation.rs#descend_order	ciris-verify-core@v8.9.0
 6.1.2.3	CLM-noise-ejection	CIRISVerify	src/ciris-verify-core/src/holonomic/aggregation.rs#EjectionVerdict	ciris-verify-core@v8.9.0
 6.1.5	CLM-noise-N5	CIRISVerify	src/ciris-verify-core/src/holonomic/fountain.rs#retention_decision	ciris-verify-core@v8.9.0
 6.1.5.1	CLM-registry-replication	CIRISServer	src/benchmarks/scoreboard.rs#FountainPolicy	ciris-server@main
-6.1.6	CLM-deterministic-alm	CIRISEdge	src/holonomic/deterministic_topology.rs#compute_alm_topology	ciris-edge@v9.1.2
+6.1.6	CLM-deterministic-alm	CIRISEdge	src/holonomic/deterministic_topology.rs#compute_alm_topology	ciris-edge@v9.1.4
 6.1.8	CLM-trust	CIRISVerify	src/ciris-verify-core/src/holonomic/bootstrap.rs#recursive_trust_bootstrap	ciris-verify-core@v8.9.0