ciris-server 0.5.85__tar.gz → 0.5.86__tar.gz

{ciris_server-0.5.85 → ciris_server-0.5.86}/Cargo.lock

@@ -793,8 +793,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-edge"
-version = "9.1.4"
-source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v9.1.4#7eb24431004e7a49aad950855fd5c4836c622918"
+version = "9.1.5"
+source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v9.1.5#fe2369e12be90037cf1f2d87dc5e3129c68e6009"
 dependencies = [
  "async-trait",
  "axum",
@@ -911,8 +911,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-persist"
-version = "13.3.1"
-source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v13.3.1#abb45050b7fa64cfa05295224e69135780acb925"
+version = "13.4.0"
+source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v13.4.0#7acaa94d73ff087abdc5753db8d44196389ecf10"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -949,7 +949,7 @@ dependencies = [
 
 [[package]]
 name = "ciris-server"
-version = "0.5.85"
+version = "0.5.86"
 dependencies = [
  "anyhow",
  "async-trait",

{ciris_server-0.5.85 → ciris_server-0.5.86}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ciris-server"
-version = "0.5.85" # 0.5.85 = SEED-UX cut (no substrate change; edge v9.1.4 / persist v13.3.1 / verify v8.9.0). The fixes that let the operator + a second holder seed the canonical mesh cleanly from the desktop UI: (1) OS-AWARE ykcs11 module path — the node's default PKCS#11 module now resolves per-OS (macOS Homebrew .dylib Apple-Silicon/Intel; Windows Yubico PIV Tool .dll / PATH; Linux .so) via identity.rs::default_ykcs11_module, wired into Pkcs11Options + the accord propose/cosign/admit paths, so a macOS/Windows holder's YubiKey cosign works (was hardcoded Linux → dlopen failure). Optional per-request "PKCS#11 module path (advanced)" field in the hardware-scrub sheet as an override. (2) COPY/EXPORT the co-scrub partial + finished record from the Trust Root card (Propose/Cosign/Pending) — Copy-to-clipboard + Save-to-file; no more pulling JSON off disk. (3) NAV label "Accord" → "Trust Root". (4) CIRISServer#127++ — the memory graph now PROJECTS persist's CEG state (seed_ceg_graph): ~40+ nodes (identity, owner, owned nodes, HUMANITY_ACCORD family + holders, canonical servers, config:*, delegations/consent/structural attestations) with CEG-native typed edges (delegates_to owner-binding, has_member family→holder seat, scrub_conferral holder→canonical, has_config, replicates_to, authored, supersedes/withdraws/recants); each node carries kind·subject·status·record so the client can render it as an AttestationCard. Follow-ups: wire the Trust Root ⋮ hamburger onto graph nodes (client); 28-language fan-out for the 7 new strings; pending-co-scrub graph node. 0.5.84 = THE FULL SAFE-MESH-SEED CUT. Substrate lockstep bumped edge v9.1.2→v9.1.4 / persist v13.2.0→v13.3.1 (v13.3.1 #387 adds the test-only with_signer_no_genesis_seed seam so the accord ceremony tests get a clean engine) (verify v8.9.0 unchanged). (1) CIRISPersist#386: the HUMANITY_ACCORD federation_families row (quorum:2/3, A1/B1/C1) is now SEEDED at boot on every node (idempotent) — lookup_family resolves durably, so the 0.5.83 baked-genesis fallbacks are RETIRED (recognized_family_from_baked_genesis + family_quorum_m fallback deleted; get_family reads the real entrenched row; V097 drops the family_key_id→federation_keys FK — a constitutional family is keyless). (2) CIRISServer#181 producer hook: POST /v1/safety/flag (duty-gated: verify_request + admit_moderation_action(Moderate)) emits the substrate-reserved content_class:{infohazard|reported} flag via a NEW node-scoped substrate_persist identity (sealed Ed25519 <alias>-substrate + software ML-DSA seed, registered through register_federation_key) — the duty-holder authorizes, the substrate signs; action:clear supersedes. This makes the #161 infohazard reveal gate actually FIRE (flag → GET /v1/safety/reveal 403 interstitial for a non-consented viewer). (3) CIRISServer#161 (already on main): POST /v1/safety/reveal — the CC 4.5.13 consent gate. #378 single-owner marker gate rides the persist bump (no server action). Follow-ups: retire ensure_accord_family_anchor throwaway key (low-risk, legacy assemble path); infohazard consent lifecycle + interstitial UX (#180 umbrella / #182-#185). 0.5.83 = BAKED-FAMILY RECOGNITION + RAISE-A-HALT. Same substrate (edge v9.1.2 / persist v13.2.0 / verify v8.9.0). Fixes "No accord family established on this node yet" on a node that has the BAKED genesis but no entrenched federation_families row (persist seeds the 3 holder KEY rows, not the family row — durable fix filed CIRISPersist#386): GET /v1/accord/family + the co-scrub quorum_needed now fall back to verify's baked humanity_accord_genesis() (the 2/3 family + 3 seats, entrenched=false, recognized_via=baked-genesis) — the same recognition resolve_kill_switch_roster already uses. PLUS raise-a-halt: POST /v1/accord/halt (initiate_halt, the binding twin of /drill — one opener signature is sub-quorum and cannot latch; 2-of-3 concur latches) + the client "Halt the mesh" action (was a disabled placeholder). 0.5.82 = CO-SCRUB END-TO-END. Same substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (no triple change). The cross-device m-of-n seed now works from the app: the co-scrub partial GOSSIPS over the accord peer-plane (the same HTTP set the kill-switch uses) — propose on A1's box → the partial surfaces under "Pending co-signs (canonical)" on B1's box → cosign → conferred, no manual transfer. Server (src/accord_provision.rs): ProvisionState gains an ephemeral bounded pending store + a (target,scrub-count) seen-set; ingest_partial validates structurally + upserts + gossips; NEW open (non-loopback) POST /v1/accord/canonical/gossip-partial peer-receive + GET /v1/accord/canonical/pending; router() split into build()→{loopback,gossip}. Client (#174): proposeCanonical/cosignCanonical/listPendingCoscrubs, the "Pending co-signs (canonical)" section + CanonicalCosignSheet (pending-entry or pasted-partial fallback), "[+ New] Add"→"Propose a canonical server". Bundled: #117 (Delegations loads on screen entry, not VM init → no pre-login 401) + #134 (existing-key offer no longer gated on a typed label; label auto-populates from the picked key_id). 0.5.81 = M-OF-N TRUST ROOT. Substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (CIRISPersist#383: KeyRecord.additional_scrubs + the DYNAMIC m-of-n admission gate via verify's verify_quorum_policy — canonical is conferred iff distinct_scrub_count() ≥ the family's entrenched quorum:M/N, NOT a hardcoded 2; the 1-of-N genesis is no longer auto-baked). Trust Root co-scrub ceremony (server-side, hardware-signed via the shared open_holder_identity custody path): POST /v1/accord/canonical/{propose,cosign} (scrub #1 → gossip/transfer the partial → append_scrub over the byte-identical envelope → adopt_scrub_upgrade lets the m-of-n gate confer/hold), plus /withdraw + /supersede (#377, 2-of-3 via proposal_digest) and IP-in-envelope TransportHint. Accord ops drill + announce (/v1/accord/{drill,announce}, node-synth'd invocation, gossiped, recorded pre-latch) + /halt-status. DRY audit landed (recipes routed through the substrate: build_self_key_record→produce_self_key_record, CANONICAL_BOOTSTRAP_PEERS→Engine::canonical_bootstrap_hints, owner_binding consts aliased). CEG-native Trust Root card redesign (one AttestationCard + ⋮ hamburger; concur now hardware-signs). KNOWN → 0.5.82 (#174): the client "Add canonical" still posts /add (1-scrub partial under m-of-n) — wire the propose→cosign buttons. 0.5.80 = THE MESH-SEED RELEASE. Substrate lockstep edge v9.1.0 / persist v13.0.1 / verify v8.7.0 (CC 1.0 RC1: KeyRecord.consent_role, the accord-conferred `canonical` identity_type role + admission gate CIRISPersist#372, single-owner owner_of #162, CIRISEdge#277 upgrade-aware Key-plane apply → KERI publish-own end-to-end). Trust Root canonical ops (#164): POST /v1/accord/canonical/add — the 1-of-N hardware-scrub SEED op (scrub-sign w/ the canonical role + adopt onto own row + publish address) + GET /v1/accord/canonical/servers + the client "Canonical servers" card (update-address shipped #165; supersede/withdraw → 0.5.81, need a persist role-removal primitive). ci.yml revived (my #155 evidence-step colon had broken the Rust gate repo-wide). 0.5.79 = substrate triple edge v8.7.2 / persist v12.5.0 / verify v8.7.0 (cross-cdylib block_on-deadlock/SIGABRT fix + CC 0.9.3 gates + dep-trims landed: hickory 0.25 de-dup, dead openssl/qrcodegen/bip39 gone) + REMOTE adopt-scrubbed endpoint (#150 — POST /v1/federation/adopt-scrubbed applies an A1-scrubbed record onto a node's own row so it roots; the seed producer's remote leg, keys live off-node) + server-local dep-trims (#152: drop hmac/pyo3-async-runtimes, lens-core async-trait/opentelemetry, base64 0.21→0.22). 0.5.78 = edge v8.6.1 / persist v12.2.0 adoption — the COMPLETE admit-node → mesh-seed loop. (1) #144 KEY-PLANE replication (KERI publish-own): the ReplicationRuntime converges an EnvelopeKind::Key coordinator per consent peer + a key_selector publishing the node's OWN key_id. (2) #150 PRODUCER: admit-node now calls persist v12.2.0 Engine::adopt_scrub_upgrade (CIRISPersist#351) to upgrade the node's own self-signed row to the accord-holder-scrubbed record — so the Key plane publishes an ANCHORED, rootable record → peers root it. Producer (server upgrades the row) + publish-own (edge advertises it) = the seed closes in place, no wipe. (3) #147 §Q B5: persist FountainHeldMeta.{content_bytes,cohort_scope} adopted (server has no fountain-content admit path; import.rs already sets cohort_scope). Verify unchanged v8.5.0. 0.5.77 = persist v12.0.2 anchor seed + accord-card UX.
+version = "0.5.86" # 0.5.86 = GENESIS-BAKE + GRAPH-FIX. Substrate bump persist v13.3.1→v13.4.0 / edge v9.1.4→v9.1.5 (verify v8.9.0 unchanged). (1) CIRISPersist#390/#391: the 2-of-3 canonical genesis server (ciris-canonical-1-d7bdeu223k) is now BAKED at genesis — the operator's live accord-co-scrubbed record (A1 primary + B1 in additional_scrubs, field-conferred this session) restores the seed #383 deferred (a 1-of-N founding record was a first-strike weakness; canonical ADD is 2-of-3, so the baked genesis is too). A FRESH install boots already trusting ciris-canonical-1 (adopt_scrub_upgrade seeds/upgrades every node's row incl. Node A's own → A self-roots on upgrade), nodes addressable by key_id — no ceremony. edge v9.1.5 = coherence re-pin of persist v13.4.0 (same-repo [patch] gotcha). (2) GRAPH-VIEW FIX: the memory graph crashed loading (JsonConvertException: NodeType has no 'attestation') — 0.5.85's seed_ceg_graph projects CEG trust-root kinds (owner/owned_node/canonical_server/family/holder/delegation/attestation/peer) the client's strict NodeType enum didn't know, so ONE unknown value failed the whole /v1/memory/timeline payload. Fix (client): added the 8 CEG variants + a TOLERANT NodeTypeSerializer (unknown→UNKNOWN, never throws again) + distinct CEG-plane colors. 0.5.85 = SEED-UX cut (no substrate change; edge v9.1.4 / persist v13.3.1 / verify v8.9.0). The fixes that let the operator + a second holder seed the canonical mesh cleanly from the desktop UI: (1) OS-AWARE ykcs11 module path — the node's default PKCS#11 module now resolves per-OS (macOS Homebrew .dylib Apple-Silicon/Intel; Windows Yubico PIV Tool .dll / PATH; Linux .so) via identity.rs::default_ykcs11_module, wired into Pkcs11Options + the accord propose/cosign/admit paths, so a macOS/Windows holder's YubiKey cosign works (was hardcoded Linux → dlopen failure). Optional per-request "PKCS#11 module path (advanced)" field in the hardware-scrub sheet as an override. (2) COPY/EXPORT the co-scrub partial + finished record from the Trust Root card (Propose/Cosign/Pending) — Copy-to-clipboard + Save-to-file; no more pulling JSON off disk. (3) NAV label "Accord" → "Trust Root". (4) CIRISServer#127++ — the memory graph now PROJECTS persist's CEG state (seed_ceg_graph): ~40+ nodes (identity, owner, owned nodes, HUMANITY_ACCORD family + holders, canonical servers, config:*, delegations/consent/structural attestations) with CEG-native typed edges (delegates_to owner-binding, has_member family→holder seat, scrub_conferral holder→canonical, has_config, replicates_to, authored, supersedes/withdraws/recants); each node carries kind·subject·status·record so the client can render it as an AttestationCard. Follow-ups: wire the Trust Root ⋮ hamburger onto graph nodes (client); 28-language fan-out for the 7 new strings; pending-co-scrub graph node. 0.5.84 = THE FULL SAFE-MESH-SEED CUT. Substrate lockstep bumped edge v9.1.2→v9.1.4 / persist v13.2.0→v13.3.1 (v13.3.1 #387 adds the test-only with_signer_no_genesis_seed seam so the accord ceremony tests get a clean engine) (verify v8.9.0 unchanged). (1) CIRISPersist#386: the HUMANITY_ACCORD federation_families row (quorum:2/3, A1/B1/C1) is now SEEDED at boot on every node (idempotent) — lookup_family resolves durably, so the 0.5.83 baked-genesis fallbacks are RETIRED (recognized_family_from_baked_genesis + family_quorum_m fallback deleted; get_family reads the real entrenched row; V097 drops the family_key_id→federation_keys FK — a constitutional family is keyless). (2) CIRISServer#181 producer hook: POST /v1/safety/flag (duty-gated: verify_request + admit_moderation_action(Moderate)) emits the substrate-reserved content_class:{infohazard|reported} flag via a NEW node-scoped substrate_persist identity (sealed Ed25519 <alias>-substrate + software ML-DSA seed, registered through register_federation_key) — the duty-holder authorizes, the substrate signs; action:clear supersedes. This makes the #161 infohazard reveal gate actually FIRE (flag → GET /v1/safety/reveal 403 interstitial for a non-consented viewer). (3) CIRISServer#161 (already on main): POST /v1/safety/reveal — the CC 4.5.13 consent gate. #378 single-owner marker gate rides the persist bump (no server action). Follow-ups: retire ensure_accord_family_anchor throwaway key (low-risk, legacy assemble path); infohazard consent lifecycle + interstitial UX (#180 umbrella / #182-#185). 0.5.83 = BAKED-FAMILY RECOGNITION + RAISE-A-HALT. Same substrate (edge v9.1.2 / persist v13.2.0 / verify v8.9.0). Fixes "No accord family established on this node yet" on a node that has the BAKED genesis but no entrenched federation_families row (persist seeds the 3 holder KEY rows, not the family row — durable fix filed CIRISPersist#386): GET /v1/accord/family + the co-scrub quorum_needed now fall back to verify's baked humanity_accord_genesis() (the 2/3 family + 3 seats, entrenched=false, recognized_via=baked-genesis) — the same recognition resolve_kill_switch_roster already uses. PLUS raise-a-halt: POST /v1/accord/halt (initiate_halt, the binding twin of /drill — one opener signature is sub-quorum and cannot latch; 2-of-3 concur latches) + the client "Halt the mesh" action (was a disabled placeholder). 0.5.82 = CO-SCRUB END-TO-END. Same substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (no triple change). The cross-device m-of-n seed now works from the app: the co-scrub partial GOSSIPS over the accord peer-plane (the same HTTP set the kill-switch uses) — propose on A1's box → the partial surfaces under "Pending co-signs (canonical)" on B1's box → cosign → conferred, no manual transfer. Server (src/accord_provision.rs): ProvisionState gains an ephemeral bounded pending store + a (target,scrub-count) seen-set; ingest_partial validates structurally + upserts + gossips; NEW open (non-loopback) POST /v1/accord/canonical/gossip-partial peer-receive + GET /v1/accord/canonical/pending; router() split into build()→{loopback,gossip}. Client (#174): proposeCanonical/cosignCanonical/listPendingCoscrubs, the "Pending co-signs (canonical)" section + CanonicalCosignSheet (pending-entry or pasted-partial fallback), "[+ New] Add"→"Propose a canonical server". Bundled: #117 (Delegations loads on screen entry, not VM init → no pre-login 401) + #134 (existing-key offer no longer gated on a typed label; label auto-populates from the picked key_id). 0.5.81 = M-OF-N TRUST ROOT. Substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (CIRISPersist#383: KeyRecord.additional_scrubs + the DYNAMIC m-of-n admission gate via verify's verify_quorum_policy — canonical is conferred iff distinct_scrub_count() ≥ the family's entrenched quorum:M/N, NOT a hardcoded 2; the 1-of-N genesis is no longer auto-baked). Trust Root co-scrub ceremony (server-side, hardware-signed via the shared open_holder_identity custody path): POST /v1/accord/canonical/{propose,cosign} (scrub #1 → gossip/transfer the partial → append_scrub over the byte-identical envelope → adopt_scrub_upgrade lets the m-of-n gate confer/hold), plus /withdraw + /supersede (#377, 2-of-3 via proposal_digest) and IP-in-envelope TransportHint. Accord ops drill + announce (/v1/accord/{drill,announce}, node-synth'd invocation, gossiped, recorded pre-latch) + /halt-status. DRY audit landed (recipes routed through the substrate: build_self_key_record→produce_self_key_record, CANONICAL_BOOTSTRAP_PEERS→Engine::canonical_bootstrap_hints, owner_binding consts aliased). CEG-native Trust Root card redesign (one AttestationCard + ⋮ hamburger; concur now hardware-signs). KNOWN → 0.5.82 (#174): the client "Add canonical" still posts /add (1-scrub partial under m-of-n) — wire the propose→cosign buttons. 0.5.80 = THE MESH-SEED RELEASE. Substrate lockstep edge v9.1.0 / persist v13.0.1 / verify v8.7.0 (CC 1.0 RC1: KeyRecord.consent_role, the accord-conferred `canonical` identity_type role + admission gate CIRISPersist#372, single-owner owner_of #162, CIRISEdge#277 upgrade-aware Key-plane apply → KERI publish-own end-to-end). Trust Root canonical ops (#164): POST /v1/accord/canonical/add — the 1-of-N hardware-scrub SEED op (scrub-sign w/ the canonical role + adopt onto own row + publish address) + GET /v1/accord/canonical/servers + the client "Canonical servers" card (update-address shipped #165; supersede/withdraw → 0.5.81, need a persist role-removal primitive). ci.yml revived (my #155 evidence-step colon had broken the Rust gate repo-wide). 0.5.79 = substrate triple edge v8.7.2 / persist v12.5.0 / verify v8.7.0 (cross-cdylib block_on-deadlock/SIGABRT fix + CC 0.9.3 gates + dep-trims landed: hickory 0.25 de-dup, dead openssl/qrcodegen/bip39 gone) + REMOTE adopt-scrubbed endpoint (#150 — POST /v1/federation/adopt-scrubbed applies an A1-scrubbed record onto a node's own row so it roots; the seed producer's remote leg, keys live off-node) + server-local dep-trims (#152: drop hmac/pyo3-async-runtimes, lens-core async-trait/opentelemetry, base64 0.21→0.22). 0.5.78 = edge v8.6.1 / persist v12.2.0 adoption — the COMPLETE admit-node → mesh-seed loop. (1) #144 KEY-PLANE replication (KERI publish-own): the ReplicationRuntime converges an EnvelopeKind::Key coordinator per consent peer + a key_selector publishing the node's OWN key_id. (2) #150 PRODUCER: admit-node now calls persist v12.2.0 Engine::adopt_scrub_upgrade (CIRISPersist#351) to upgrade the node's own self-signed row to the accord-holder-scrubbed record — so the Key plane publishes an ANCHORED, rootable record → peers root it. Producer (server upgrades the row) + publish-own (edge advertises it) = the seed closes in place, no wipe. (3) #147 §Q B5: persist FountainHeldMeta.{content_bytes,cohort_scope} adopted (server has no fountain-content admit path; import.rs already sets cohort_scope). Verify unchanged v8.5.0. 0.5.77 = persist v12.0.2 anchor seed + accord-card UX.
 edition = "2021"
 # MSRV floor is set by the substrate: ciris-verify v5.2.0 requires 1.86
 # (persist v6.0.1 is 1.83). Build with the higher of the two.
@@ -122,8 +122,8 @@ ciris-lens-core     = { path = "crates/ciris-lens-core" } # ABSORBED in-tree (wo
 # `cirislens_wa_cert` + `cirislens_service_token_revocation` expose the auth
 # substrate the fabric absorbs (CIRISServer#9, src/auth): the agent's `wa_cert`
 # table (users/WA/OAuth/api-keys) + the `revoked_service_tokens` table.
-ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.3.1", features = ["sqlite", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
-ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.1.4", features = ["transport-reticulum", "transport-http", "transport-packet-radio"] }
+ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.4.0", features = ["sqlite", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
+ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.1.5", features = ["transport-reticulum", "transport-http", "transport-packet-radio"] }
 # Founder-quorum verification + key-id fingerprint at the composition root
 # (threshold:: module path — NOT re-exported at the crate root).
 # LOCKSTEP: persist v9.4.0 transitively pins verify-core v6.6.x — the whole
@@ -204,7 +204,7 @@ tracing-appender = "0.2"
 # - keyring `tpm` (tss-esapi / TPM 2.0) — the real hardware backend; needs
 #   libtss2 (Linux build dep). Other targets keep the software keystore.
 [target.'cfg(target_os = "linux")'.dependencies]
-ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.3.1", features = ["postgres", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.4.0", features = ["postgres", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
 # keyring `tpm` (TPM-at-rest, Linux-only via tss-esapi). `pkcs11` is no longer
 # per-target — it rides the global `pkcs11` feature now that cryptoki builds on all
 # targets (CIRISVerify v6.12.0).
@@ -271,13 +271,13 @@ ciris-crypto  = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.9.0"
 # and never encodes/decodes). This lets tests/chaos_mesh.rs exercise the SUBSTRATE
 # codec (`fountain_encode`/`fountain_decode`) directly — a real MEASURED proof,
 # not a reference stand-in.
-ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.1.4", features = ["codec-fountain"] }
+ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.1.5", features = ["codec-fountain"] }
 # Enable persist's TEST-ONLY genesis-seam (`test-genesis-seam`, CIRISPersist#387) for the
 # accord ceremony tests (tests/accord.rs): `Engine::with_signer_no_genesis_seed` yields a
 # clean engine with the baked HUMANITY_ACCORD family seed SKIPPED, so those tests can stand
 # up their OWN custom-holder family via the assemble ceremony. Dev/test ONLY — resolver-2
 # keeps this feature out of the shipped lib/bin/wheel (prod always seeds the baked family).
-ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.3.1", features = ["test-genesis-seam"] }
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.4.0", features = ["test-genesis-seam"] }
 
 # PQC realtime-A/V streaming E2E benchmark (CIRISEdge#62 realtime_av profile).
 [[bench]]

{ciris_server-0.5.85 → ciris_server-0.5.86}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ciris-server
-Version: 0.5.85
+Version: 0.5.86
 License-File: LICENSE
 Summary: The fabric node — the federation's headless cohabitation runtime (registry + lens [+ node] over one shared substrate), as the abi3 wheel CIRISAgent consumes. agent = fabric node + brain.
 Author-email: Eric Moore <eric@ciris.ai>

{ciris_server-0.5.85 → ciris_server-0.5.86}/crates/ciris-lens-core/Cargo.toml

@@ -26,8 +26,8 @@ crate-type = ["cdylib", "rlib"]
 #
 # OQ-01 closure 2026-05-03: rlib primary, PyO3 cdylib via `python`
 # feature for the deployed-lens cutover.
-ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.3.1", version = "13", features = ["extract", "sqlite"] }
-ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge",    tag = "v9.1.4", version = "9", features = ["transport-http", "transport-reticulum"] }
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.4.0", version = "13", features = ["extract", "sqlite"] }
+ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge",    tag = "v9.1.5", version = "9", features = ["transport-http", "transport-reticulum"] }
 
 # Keyring — relay mode (CIRISLensCore#10) loads its Edge transport-
 # signing identity via `ciris_keyring::load_local_seed`. Edge's

{ciris_server-0.5.85 → ciris_server-0.5.86}/src/accord_provision.rs

@@ -2608,13 +2608,14 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn list_canonical_servers_is_empty_on_a_fresh_node() {
-        // persist v13.2.0 makes canonical admission **m-of-n** (the family's
-        // entrenched `quorum:M/N`, via verify's `verify_quorum_policy`), so the old
-        // 1-of-N A1-only genesis is no longer auto-baked: a `canonical` role is
-        // conferred ONLY on a record whose scrub set meets the quorum. A fresh node
-        // therefore lists NO canonical servers until a proper m-of-n one is
-        // co-minted (CIRISPersist#383). (Was: asserted the 1-of-N #380 genesis.)
+    async fn list_canonical_servers_returns_the_baked_genesis_on_a_fresh_node() {
+        // persist v13.4.0 (CIRISPersist#390/#391) BAKES the 2-of-3 canonical genesis
+        // server `ciris-canonical-1-d7bdeu223k` — the operator's accord-co-scrubbed
+        // record (A1 + B1), seeded at boot via `seed_canonical_servers`. So a fresh
+        // node now ships trusting exactly that one canonical server, conferred via the
+        // baked 2-of-3 genesis (NOT self-claimed — canonical admission stays m-of-n).
+        // (Was: `..._is_empty_on_a_fresh_node`, the post-#383 gap before the 2-of-3
+        // replacement existed — see #390.)
         let app = router_with_engine().await;
         let resp = app
             .oneshot(
@@ -2631,11 +2632,22 @@ mod tests {
             .await
             .unwrap();
         let v: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
+        let servers = v["servers"].as_array().expect("servers array");
         assert_eq!(
-            v["servers"].as_array().map(|a| a.len()),
-            Some(0),
-            "a fresh node has no canonical servers — the 1-of-N genesis is gone; \
-             canonical is conferred only via the m-of-n co-scrub: {v}"
+            servers.len(),
+            1,
+            "a fresh node ships exactly the baked genesis canonical server: {v}"
+        );
+        assert_eq!(
+            servers[0]["key_id"].as_str(),
+            Some("ciris-canonical-1-d7bdeu223k"),
+            "the baked genesis canonical server is ciris-canonical-1: {v}"
+        );
+        assert!(
+            servers[0]["identity_type"]
+                .as_str()
+                .is_some_and(|t| t.contains("canonical")),
+            "the baked row carries the accord-conferred canonical role: {v}"
         );
     }
 

{ciris_server-0.5.85 → ciris_server-0.5.86}/tests/release_gates/support.rs

@@ -35,8 +35,8 @@ use std::path::PathBuf;
 // KeyRecord.consent_role, the accord-conferred `canonical` identity_type role
 // (CIRISPersist#372), single-owner `owner_of` (#162), verify unchanged v8.7.0.
 pub const TARGET_VERIFY: &str = "v8.9.0";
-pub const TARGET_PERSIST: &str = "v13.3.1";
-pub const TARGET_EDGE: &str = "v9.1.4";
+pub const TARGET_PERSIST: &str = "v13.4.0";
+pub const TARGET_EDGE: &str = "v9.1.5";
 /// Stage 6/7: the persist MAJOR family that bakes the canonical genesis seed.
 /// (Name is historical — the seed-bake family moved v10 → v12 → **v13**: the v12.0
 /// genesis-mesh rooting anchor persisted, v13.0.0 adds the accord-conferred