ciris-server 0.5.87__tar.gz → 0.5.89__tar.gz

{ciris_server-0.5.87 → ciris_server-0.5.89}/Cargo.lock

@@ -766,8 +766,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-crypto"
-version = "8.9.0"
-source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v8.9.0#31a3a6fd1dc50f77b39bd388fce004f9ec41bf7f"
+version = "8.10.0"
+source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v8.10.0#a64c08996edd0e9c4c0fd27c1fae72dcedc4474f"
 dependencies = [
  "chacha20poly1305",
  "ed25519-dalek",
@@ -793,8 +793,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-edge"
-version = "9.1.6"
-source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v9.1.6#1c1f1f02329e9b47330660f33ea284193689cb96"
+version = "9.2.0"
+source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v9.2.0#365424cec7e897aa5a5199c30d22caef4d528a2a"
 dependencies = [
  "async-trait",
  "axum",
@@ -847,8 +847,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-keyring"
-version = "8.9.0"
-source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v8.9.0#31a3a6fd1dc50f77b39bd388fce004f9ec41bf7f"
+version = "8.10.0"
+source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v8.10.0#a64c08996edd0e9c4c0fd27c1fae72dcedc4474f"
 dependencies = [
  "aes-gcm",
  "async-trait",
@@ -911,8 +911,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-persist"
-version = "13.4.1"
-source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v13.4.1#e0370aade3acdbc6ce26feb235f7ae69a1405114"
+version = "13.4.2"
+source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v13.4.2#ac214bf3df87693a13fca9f62e2a021d4eefb19e"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -949,7 +949,7 @@ dependencies = [
 
 [[package]]
 name = "ciris-server"
-version = "0.5.87"
+version = "0.5.89"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -991,8 +991,8 @@ dependencies = [
 
 [[package]]
 name = "ciris-verify-core"
-version = "8.9.0"
-source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v8.9.0#31a3a6fd1dc50f77b39bd388fce004f9ec41bf7f"
+version = "8.10.0"
+source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v8.10.0#a64c08996edd0e9c4c0fd27c1fae72dcedc4474f"
 dependencies = [
  "android_system_properties",
  "async-trait",

{ciris_server-0.5.87 → ciris_server-0.5.89}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ciris-server"
-version = "0.5.87" # 0.5.87 = PYO3-SEED FIX ADOPTION. Substrate bump persist v13.4.0→v13.4.1 / edge v9.1.5→v9.1.6 (verify v8.9.0 unchanged). CIRISPersist#392: the pyo3/wheel ctor PyEngine::new hand-rolled its own genesis seed and stopped at the accord holders — it never ran the #386 entrenched-family (v13.3.0) or #390 canonical (v13.4.0) bakes that Engine::with_signer does. So EVERY wheel consumer (the server's own py_main boot + agent-embedded engines, CIRISServer#191 / CIRISAgent#896) got A1/B1/C1 but NO HUMANITY_ACCORD family row and list_canonical_servers()==[] — the canonical bake never reached the installs it was meant to light up. v13.4.1 factors the full post-holders sequence (verify anchor → family #386 → canonical #390) into ONE shared genesis::seed_family_and_canonical(dir) called by BOTH ctors, so pyo3 + Rust engines are seed-identical. edge v9.1.6 = coherence re-pin of persist v13.4.1. NO server source change — pure substrate adoption; a fresh wheel Engine now returns ciris-canonical-1 + an entrenched family. 0.5.86 = GENESIS-BAKE + GRAPH-FIX. Substrate bump persist v13.3.1→v13.4.0 / edge v9.1.4→v9.1.5 (verify v8.9.0 unchanged). (1) CIRISPersist#390/#391: the 2-of-3 canonical genesis server (ciris-canonical-1-d7bdeu223k) is now BAKED at genesis — the operator's live accord-co-scrubbed record (A1 primary + B1 in additional_scrubs, field-conferred this session) restores the seed #383 deferred (a 1-of-N founding record was a first-strike weakness; canonical ADD is 2-of-3, so the baked genesis is too). A FRESH install boots already trusting ciris-canonical-1 (adopt_scrub_upgrade seeds/upgrades every node's row incl. Node A's own → A self-roots on upgrade), nodes addressable by key_id — no ceremony. edge v9.1.5 = coherence re-pin of persist v13.4.0 (same-repo [patch] gotcha). (2) GRAPH-VIEW FIX: the memory graph crashed loading (JsonConvertException: NodeType has no 'attestation') — 0.5.85's seed_ceg_graph projects CEG trust-root kinds (owner/owned_node/canonical_server/family/holder/delegation/attestation/peer) the client's strict NodeType enum didn't know, so ONE unknown value failed the whole /v1/memory/timeline payload. Fix (client): added the 8 CEG variants + a TOLERANT NodeTypeSerializer (unknown→UNKNOWN, never throws again) + distinct CEG-plane colors. 0.5.85 = SEED-UX cut (no substrate change; edge v9.1.4 / persist v13.3.1 / verify v8.9.0). The fixes that let the operator + a second holder seed the canonical mesh cleanly from the desktop UI: (1) OS-AWARE ykcs11 module path — the node's default PKCS#11 module now resolves per-OS (macOS Homebrew .dylib Apple-Silicon/Intel; Windows Yubico PIV Tool .dll / PATH; Linux .so) via identity.rs::default_ykcs11_module, wired into Pkcs11Options + the accord propose/cosign/admit paths, so a macOS/Windows holder's YubiKey cosign works (was hardcoded Linux → dlopen failure). Optional per-request "PKCS#11 module path (advanced)" field in the hardware-scrub sheet as an override. (2) COPY/EXPORT the co-scrub partial + finished record from the Trust Root card (Propose/Cosign/Pending) — Copy-to-clipboard + Save-to-file; no more pulling JSON off disk. (3) NAV label "Accord" → "Trust Root". (4) CIRISServer#127++ — the memory graph now PROJECTS persist's CEG state (seed_ceg_graph): ~40+ nodes (identity, owner, owned nodes, HUMANITY_ACCORD family + holders, canonical servers, config:*, delegations/consent/structural attestations) with CEG-native typed edges (delegates_to owner-binding, has_member family→holder seat, scrub_conferral holder→canonical, has_config, replicates_to, authored, supersedes/withdraws/recants); each node carries kind·subject·status·record so the client can render it as an AttestationCard. Follow-ups: wire the Trust Root ⋮ hamburger onto graph nodes (client); 28-language fan-out for the 7 new strings; pending-co-scrub graph node. 0.5.84 = THE FULL SAFE-MESH-SEED CUT. Substrate lockstep bumped edge v9.1.2→v9.1.4 / persist v13.2.0→v13.3.1 (v13.3.1 #387 adds the test-only with_signer_no_genesis_seed seam so the accord ceremony tests get a clean engine) (verify v8.9.0 unchanged). (1) CIRISPersist#386: the HUMANITY_ACCORD federation_families row (quorum:2/3, A1/B1/C1) is now SEEDED at boot on every node (idempotent) — lookup_family resolves durably, so the 0.5.83 baked-genesis fallbacks are RETIRED (recognized_family_from_baked_genesis + family_quorum_m fallback deleted; get_family reads the real entrenched row; V097 drops the family_key_id→federation_keys FK — a constitutional family is keyless). (2) CIRISServer#181 producer hook: POST /v1/safety/flag (duty-gated: verify_request + admit_moderation_action(Moderate)) emits the substrate-reserved content_class:{infohazard|reported} flag via a NEW node-scoped substrate_persist identity (sealed Ed25519 <alias>-substrate + software ML-DSA seed, registered through register_federation_key) — the duty-holder authorizes, the substrate signs; action:clear supersedes. This makes the #161 infohazard reveal gate actually FIRE (flag → GET /v1/safety/reveal 403 interstitial for a non-consented viewer). (3) CIRISServer#161 (already on main): POST /v1/safety/reveal — the CC 4.5.13 consent gate. #378 single-owner marker gate rides the persist bump (no server action). Follow-ups: retire ensure_accord_family_anchor throwaway key (low-risk, legacy assemble path); infohazard consent lifecycle + interstitial UX (#180 umbrella / #182-#185). 0.5.83 = BAKED-FAMILY RECOGNITION + RAISE-A-HALT. Same substrate (edge v9.1.2 / persist v13.2.0 / verify v8.9.0). Fixes "No accord family established on this node yet" on a node that has the BAKED genesis but no entrenched federation_families row (persist seeds the 3 holder KEY rows, not the family row — durable fix filed CIRISPersist#386): GET /v1/accord/family + the co-scrub quorum_needed now fall back to verify's baked humanity_accord_genesis() (the 2/3 family + 3 seats, entrenched=false, recognized_via=baked-genesis) — the same recognition resolve_kill_switch_roster already uses. PLUS raise-a-halt: POST /v1/accord/halt (initiate_halt, the binding twin of /drill — one opener signature is sub-quorum and cannot latch; 2-of-3 concur latches) + the client "Halt the mesh" action (was a disabled placeholder). 0.5.82 = CO-SCRUB END-TO-END. Same substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (no triple change). The cross-device m-of-n seed now works from the app: the co-scrub partial GOSSIPS over the accord peer-plane (the same HTTP set the kill-switch uses) — propose on A1's box → the partial surfaces under "Pending co-signs (canonical)" on B1's box → cosign → conferred, no manual transfer. Server (src/accord_provision.rs): ProvisionState gains an ephemeral bounded pending store + a (target,scrub-count) seen-set; ingest_partial validates structurally + upserts + gossips; NEW open (non-loopback) POST /v1/accord/canonical/gossip-partial peer-receive + GET /v1/accord/canonical/pending; router() split into build()→{loopback,gossip}. Client (#174): proposeCanonical/cosignCanonical/listPendingCoscrubs, the "Pending co-signs (canonical)" section + CanonicalCosignSheet (pending-entry or pasted-partial fallback), "[+ New] Add"→"Propose a canonical server". Bundled: #117 (Delegations loads on screen entry, not VM init → no pre-login 401) + #134 (existing-key offer no longer gated on a typed label; label auto-populates from the picked key_id). 0.5.81 = M-OF-N TRUST ROOT. Substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (CIRISPersist#383: KeyRecord.additional_scrubs + the DYNAMIC m-of-n admission gate via verify's verify_quorum_policy — canonical is conferred iff distinct_scrub_count() ≥ the family's entrenched quorum:M/N, NOT a hardcoded 2; the 1-of-N genesis is no longer auto-baked). Trust Root co-scrub ceremony (server-side, hardware-signed via the shared open_holder_identity custody path): POST /v1/accord/canonical/{propose,cosign} (scrub #1 → gossip/transfer the partial → append_scrub over the byte-identical envelope → adopt_scrub_upgrade lets the m-of-n gate confer/hold), plus /withdraw + /supersede (#377, 2-of-3 via proposal_digest) and IP-in-envelope TransportHint. Accord ops drill + announce (/v1/accord/{drill,announce}, node-synth'd invocation, gossiped, recorded pre-latch) + /halt-status. DRY audit landed (recipes routed through the substrate: build_self_key_record→produce_self_key_record, CANONICAL_BOOTSTRAP_PEERS→Engine::canonical_bootstrap_hints, owner_binding consts aliased). CEG-native Trust Root card redesign (one AttestationCard + ⋮ hamburger; concur now hardware-signs). KNOWN → 0.5.82 (#174): the client "Add canonical" still posts /add (1-scrub partial under m-of-n) — wire the propose→cosign buttons. 0.5.80 = THE MESH-SEED RELEASE. Substrate lockstep edge v9.1.0 / persist v13.0.1 / verify v8.7.0 (CC 1.0 RC1: KeyRecord.consent_role, the accord-conferred `canonical` identity_type role + admission gate CIRISPersist#372, single-owner owner_of #162, CIRISEdge#277 upgrade-aware Key-plane apply → KERI publish-own end-to-end). Trust Root canonical ops (#164): POST /v1/accord/canonical/add — the 1-of-N hardware-scrub SEED op (scrub-sign w/ the canonical role + adopt onto own row + publish address) + GET /v1/accord/canonical/servers + the client "Canonical servers" card (update-address shipped #165; supersede/withdraw → 0.5.81, need a persist role-removal primitive). ci.yml revived (my #155 evidence-step colon had broken the Rust gate repo-wide). 0.5.79 = substrate triple edge v8.7.2 / persist v12.5.0 / verify v8.7.0 (cross-cdylib block_on-deadlock/SIGABRT fix + CC 0.9.3 gates + dep-trims landed: hickory 0.25 de-dup, dead openssl/qrcodegen/bip39 gone) + REMOTE adopt-scrubbed endpoint (#150 — POST /v1/federation/adopt-scrubbed applies an A1-scrubbed record onto a node's own row so it roots; the seed producer's remote leg, keys live off-node) + server-local dep-trims (#152: drop hmac/pyo3-async-runtimes, lens-core async-trait/opentelemetry, base64 0.21→0.22). 0.5.78 = edge v8.6.1 / persist v12.2.0 adoption — the COMPLETE admit-node → mesh-seed loop. (1) #144 KEY-PLANE replication (KERI publish-own): the ReplicationRuntime converges an EnvelopeKind::Key coordinator per consent peer + a key_selector publishing the node's OWN key_id. (2) #150 PRODUCER: admit-node now calls persist v12.2.0 Engine::adopt_scrub_upgrade (CIRISPersist#351) to upgrade the node's own self-signed row to the accord-holder-scrubbed record — so the Key plane publishes an ANCHORED, rootable record → peers root it. Producer (server upgrades the row) + publish-own (edge advertises it) = the seed closes in place, no wipe. (3) #147 §Q B5: persist FountainHeldMeta.{content_bytes,cohort_scope} adopted (server has no fountain-content admit path; import.rs already sets cohort_scope). Verify unchanged v8.5.0. 0.5.77 = persist v12.0.2 anchor seed + accord-card UX.
+version = "0.5.89" # 0.5.89 = FEDERATION DELIVERY (#205, subsumes #204). edge v9.1.7→v9.2.0 (CIRISEdge#289: current_edge() downstream-public + require_local_signer attested-announce; persist v13.4.2 / verify v8.10.0 unchanged) + `ffi-uniffi` on the edge dep so ciris_edge::current_edge() links into the controller. NEW pyo3 entry `start_federation_delivery(cadence_seconds=None, announce_logger=True) -> int` (src/federation_delivery.rs + src/lib.rs): the bare AGENT edge, after init_edge_runtime, calls ONE thing that runs the compose delivery controller in-process against current_rust_engine()+current_edge() — reads the baked canonical transport_hints→targets (subsumes #204's read), authors this node's directed consent:replication grant per admitted canonical peer, starts the ONE ReplicationRuntime seeding the canonical key_ids, installs inbound routing (safe post-boot — Edge::run reads the routing OnceLock live per frame), spawns the consent reconcile loop (set_peers) + announce logger. Compose boot UNCHANGED — factored setup_peer_replication's core into compose::start_replication_runtime(engine,edge,node_key_id,extra_targets) (compose passes &[], the controller passes canonical key_ids) + a shared build_replication_peers. CONTRACT: init_edge_runtime(engine=from_shared_with_local(...), disable_reticulum=False, require_local_signer=True, announce_interval_seconds=15) → start_federation_delivery(). CAVEAT: the Reticulum transport only adds a TCP *dial* peer at BUILD time (no runtime add-peer), so the canonical IP MUST be in the edge init bootstrap_peers (agent-side, the user's peers=1 path) — the controller drives everything downstream of the dial. Live delivery is the agent live-lens QA (not unit-testable: needs a live edge + Node A); 4 new unit tests cover peer-set assembly / dedup / empty sets / uninitialized-guard. 0.5.88 = NODE-A BOOT FIX (triple adoption). Substrate bump persist v13.4.1→v13.4.2 / edge v9.1.6→v9.1.7 / verify v8.9.0→v8.10.0. CIRISPersist#394: the #390 canonical bake made seed_canonical_servers `put_public_key` the baked 2-of-3 record — but on the CANONICAL NODE ITSELF (ciris-canonical-1-d7bdeu223k already exists as its own self-signed `node` row, same pubkeys, minted at first registration), put_public_key saw same-key/different-content → Err → EngineError::GenesisSeed → BOOT ABORT. The one node the bake was meant to serve couldn't boot on v13.4.0/v13.4.1 (RCA'd here; bisected 0.5.85✅/0.5.86❌). v13.4.2 seeds via adopt_scrub_upgrade instead: absent→insert, self-signed same-pubkey→UPGRADE to the scrubbed canonical record (A self-roots), already-scrubbed→no-op, drift→reject. verify v8.9.0→v8.10.0 (persist v13.4.2 requires it): additive — the new `ciris-verify manifest sign` CLI (#176/#177, the canonical build-manifest producer emitting SignedCegObject/build_manifest_contribution scoped infra:attest); no server consumer break. edge v9.1.7 = coherence re-pin of persist v13.4.2 + verify v8.10.0. NO server source change — pure substrate adoption; unblocks Node A's upgrade off 0.5.85. 0.5.87 = PYO3-SEED FIX ADOPTION. Substrate bump persist v13.4.0→v13.4.1 / edge v9.1.5→v9.1.6 (verify v8.9.0 unchanged). CIRISPersist#392: the pyo3/wheel ctor PyEngine::new hand-rolled its own genesis seed and stopped at the accord holders — it never ran the #386 entrenched-family (v13.3.0) or #390 canonical (v13.4.0) bakes that Engine::with_signer does. So EVERY wheel consumer (the server's own py_main boot + agent-embedded engines, CIRISServer#191 / CIRISAgent#896) got A1/B1/C1 but NO HUMANITY_ACCORD family row and list_canonical_servers()==[] — the canonical bake never reached the installs it was meant to light up. v13.4.1 factors the full post-holders sequence (verify anchor → family #386 → canonical #390) into ONE shared genesis::seed_family_and_canonical(dir) called by BOTH ctors, so pyo3 + Rust engines are seed-identical. edge v9.1.6 = coherence re-pin of persist v13.4.1. NO server source change — pure substrate adoption; a fresh wheel Engine now returns ciris-canonical-1 + an entrenched family. 0.5.86 = GENESIS-BAKE + GRAPH-FIX. Substrate bump persist v13.3.1→v13.4.0 / edge v9.1.4→v9.1.5 (verify v8.9.0 unchanged). (1) CIRISPersist#390/#391: the 2-of-3 canonical genesis server (ciris-canonical-1-d7bdeu223k) is now BAKED at genesis — the operator's live accord-co-scrubbed record (A1 primary + B1 in additional_scrubs, field-conferred this session) restores the seed #383 deferred (a 1-of-N founding record was a first-strike weakness; canonical ADD is 2-of-3, so the baked genesis is too). A FRESH install boots already trusting ciris-canonical-1 (adopt_scrub_upgrade seeds/upgrades every node's row incl. Node A's own → A self-roots on upgrade), nodes addressable by key_id — no ceremony. edge v9.1.5 = coherence re-pin of persist v13.4.0 (same-repo [patch] gotcha). (2) GRAPH-VIEW FIX: the memory graph crashed loading (JsonConvertException: NodeType has no 'attestation') — 0.5.85's seed_ceg_graph projects CEG trust-root kinds (owner/owned_node/canonical_server/family/holder/delegation/attestation/peer) the client's strict NodeType enum didn't know, so ONE unknown value failed the whole /v1/memory/timeline payload. Fix (client): added the 8 CEG variants + a TOLERANT NodeTypeSerializer (unknown→UNKNOWN, never throws again) + distinct CEG-plane colors. 0.5.85 = SEED-UX cut (no substrate change; edge v9.1.4 / persist v13.3.1 / verify v8.9.0). The fixes that let the operator + a second holder seed the canonical mesh cleanly from the desktop UI: (1) OS-AWARE ykcs11 module path — the node's default PKCS#11 module now resolves per-OS (macOS Homebrew .dylib Apple-Silicon/Intel; Windows Yubico PIV Tool .dll / PATH; Linux .so) via identity.rs::default_ykcs11_module, wired into Pkcs11Options + the accord propose/cosign/admit paths, so a macOS/Windows holder's YubiKey cosign works (was hardcoded Linux → dlopen failure). Optional per-request "PKCS#11 module path (advanced)" field in the hardware-scrub sheet as an override. (2) COPY/EXPORT the co-scrub partial + finished record from the Trust Root card (Propose/Cosign/Pending) — Copy-to-clipboard + Save-to-file; no more pulling JSON off disk. (3) NAV label "Accord" → "Trust Root". (4) CIRISServer#127++ — the memory graph now PROJECTS persist's CEG state (seed_ceg_graph): ~40+ nodes (identity, owner, owned nodes, HUMANITY_ACCORD family + holders, canonical servers, config:*, delegations/consent/structural attestations) with CEG-native typed edges (delegates_to owner-binding, has_member family→holder seat, scrub_conferral holder→canonical, has_config, replicates_to, authored, supersedes/withdraws/recants); each node carries kind·subject·status·record so the client can render it as an AttestationCard. Follow-ups: wire the Trust Root ⋮ hamburger onto graph nodes (client); 28-language fan-out for the 7 new strings; pending-co-scrub graph node. 0.5.84 = THE FULL SAFE-MESH-SEED CUT. Substrate lockstep bumped edge v9.1.2→v9.1.4 / persist v13.2.0→v13.3.1 (v13.3.1 #387 adds the test-only with_signer_no_genesis_seed seam so the accord ceremony tests get a clean engine) (verify v8.9.0 unchanged). (1) CIRISPersist#386: the HUMANITY_ACCORD federation_families row (quorum:2/3, A1/B1/C1) is now SEEDED at boot on every node (idempotent) — lookup_family resolves durably, so the 0.5.83 baked-genesis fallbacks are RETIRED (recognized_family_from_baked_genesis + family_quorum_m fallback deleted; get_family reads the real entrenched row; V097 drops the family_key_id→federation_keys FK — a constitutional family is keyless). (2) CIRISServer#181 producer hook: POST /v1/safety/flag (duty-gated: verify_request + admit_moderation_action(Moderate)) emits the substrate-reserved content_class:{infohazard|reported} flag via a NEW node-scoped substrate_persist identity (sealed Ed25519 <alias>-substrate + software ML-DSA seed, registered through register_federation_key) — the duty-holder authorizes, the substrate signs; action:clear supersedes. This makes the #161 infohazard reveal gate actually FIRE (flag → GET /v1/safety/reveal 403 interstitial for a non-consented viewer). (3) CIRISServer#161 (already on main): POST /v1/safety/reveal — the CC 4.5.13 consent gate. #378 single-owner marker gate rides the persist bump (no server action). Follow-ups: retire ensure_accord_family_anchor throwaway key (low-risk, legacy assemble path); infohazard consent lifecycle + interstitial UX (#180 umbrella / #182-#185). 0.5.83 = BAKED-FAMILY RECOGNITION + RAISE-A-HALT. Same substrate (edge v9.1.2 / persist v13.2.0 / verify v8.9.0). Fixes "No accord family established on this node yet" on a node that has the BAKED genesis but no entrenched federation_families row (persist seeds the 3 holder KEY rows, not the family row — durable fix filed CIRISPersist#386): GET /v1/accord/family + the co-scrub quorum_needed now fall back to verify's baked humanity_accord_genesis() (the 2/3 family + 3 seats, entrenched=false, recognized_via=baked-genesis) — the same recognition resolve_kill_switch_roster already uses. PLUS raise-a-halt: POST /v1/accord/halt (initiate_halt, the binding twin of /drill — one opener signature is sub-quorum and cannot latch; 2-of-3 concur latches) + the client "Halt the mesh" action (was a disabled placeholder). 0.5.82 = CO-SCRUB END-TO-END. Same substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (no triple change). The cross-device m-of-n seed now works from the app: the co-scrub partial GOSSIPS over the accord peer-plane (the same HTTP set the kill-switch uses) — propose on A1's box → the partial surfaces under "Pending co-signs (canonical)" on B1's box → cosign → conferred, no manual transfer. Server (src/accord_provision.rs): ProvisionState gains an ephemeral bounded pending store + a (target,scrub-count) seen-set; ingest_partial validates structurally + upserts + gossips; NEW open (non-loopback) POST /v1/accord/canonical/gossip-partial peer-receive + GET /v1/accord/canonical/pending; router() split into build()→{loopback,gossip}. Client (#174): proposeCanonical/cosignCanonical/listPendingCoscrubs, the "Pending co-signs (canonical)" section + CanonicalCosignSheet (pending-entry or pasted-partial fallback), "[+ New] Add"→"Propose a canonical server". Bundled: #117 (Delegations loads on screen entry, not VM init → no pre-login 401) + #134 (existing-key offer no longer gated on a typed label; label auto-populates from the picked key_id). 0.5.81 = M-OF-N TRUST ROOT. Substrate lockstep edge v9.1.2 / persist v13.2.0 / verify v8.9.0 (CIRISPersist#383: KeyRecord.additional_scrubs + the DYNAMIC m-of-n admission gate via verify's verify_quorum_policy — canonical is conferred iff distinct_scrub_count() ≥ the family's entrenched quorum:M/N, NOT a hardcoded 2; the 1-of-N genesis is no longer auto-baked). Trust Root co-scrub ceremony (server-side, hardware-signed via the shared open_holder_identity custody path): POST /v1/accord/canonical/{propose,cosign} (scrub #1 → gossip/transfer the partial → append_scrub over the byte-identical envelope → adopt_scrub_upgrade lets the m-of-n gate confer/hold), plus /withdraw + /supersede (#377, 2-of-3 via proposal_digest) and IP-in-envelope TransportHint. Accord ops drill + announce (/v1/accord/{drill,announce}, node-synth'd invocation, gossiped, recorded pre-latch) + /halt-status. DRY audit landed (recipes routed through the substrate: build_self_key_record→produce_self_key_record, CANONICAL_BOOTSTRAP_PEERS→Engine::canonical_bootstrap_hints, owner_binding consts aliased). CEG-native Trust Root card redesign (one AttestationCard + ⋮ hamburger; concur now hardware-signs). KNOWN → 0.5.82 (#174): the client "Add canonical" still posts /add (1-scrub partial under m-of-n) — wire the propose→cosign buttons. 0.5.80 = THE MESH-SEED RELEASE. Substrate lockstep edge v9.1.0 / persist v13.0.1 / verify v8.7.0 (CC 1.0 RC1: KeyRecord.consent_role, the accord-conferred `canonical` identity_type role + admission gate CIRISPersist#372, single-owner owner_of #162, CIRISEdge#277 upgrade-aware Key-plane apply → KERI publish-own end-to-end). Trust Root canonical ops (#164): POST /v1/accord/canonical/add — the 1-of-N hardware-scrub SEED op (scrub-sign w/ the canonical role + adopt onto own row + publish address) + GET /v1/accord/canonical/servers + the client "Canonical servers" card (update-address shipped #165; supersede/withdraw → 0.5.81, need a persist role-removal primitive). ci.yml revived (my #155 evidence-step colon had broken the Rust gate repo-wide). 0.5.79 = substrate triple edge v8.7.2 / persist v12.5.0 / verify v8.7.0 (cross-cdylib block_on-deadlock/SIGABRT fix + CC 0.9.3 gates + dep-trims landed: hickory 0.25 de-dup, dead openssl/qrcodegen/bip39 gone) + REMOTE adopt-scrubbed endpoint (#150 — POST /v1/federation/adopt-scrubbed applies an A1-scrubbed record onto a node's own row so it roots; the seed producer's remote leg, keys live off-node) + server-local dep-trims (#152: drop hmac/pyo3-async-runtimes, lens-core async-trait/opentelemetry, base64 0.21→0.22). 0.5.78 = edge v8.6.1 / persist v12.2.0 adoption — the COMPLETE admit-node → mesh-seed loop. (1) #144 KEY-PLANE replication (KERI publish-own): the ReplicationRuntime converges an EnvelopeKind::Key coordinator per consent peer + a key_selector publishing the node's OWN key_id. (2) #150 PRODUCER: admit-node now calls persist v12.2.0 Engine::adopt_scrub_upgrade (CIRISPersist#351) to upgrade the node's own self-signed row to the accord-holder-scrubbed record — so the Key plane publishes an ANCHORED, rootable record → peers root it. Producer (server upgrades the row) + publish-own (edge advertises it) = the seed closes in place, no wipe. (3) #147 §Q B5: persist FountainHeldMeta.{content_bytes,cohort_scope} adopted (server has no fountain-content admit path; import.rs already sets cohort_scope). Verify unchanged v8.5.0. 0.5.77 = persist v12.0.2 anchor seed + accord-card UX.
 edition = "2021"
 # MSRV floor is set by the substrate: ciris-verify v5.2.0 requires 1.86
 # (persist v6.0.1 is 1.83). Build with the higher of the two.
@@ -122,8 +122,8 @@ ciris-lens-core     = { path = "crates/ciris-lens-core" } # ABSORBED in-tree (wo
 # `cirislens_wa_cert` + `cirislens_service_token_revocation` expose the auth
 # substrate the fabric absorbs (CIRISServer#9, src/auth): the agent's `wa_cert`
 # table (users/WA/OAuth/api-keys) + the `revoked_service_tokens` table.
-ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.4.1", features = ["sqlite", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
-ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.1.6", features = ["transport-reticulum", "transport-http", "transport-packet-radio"] }
+ciris-persist     = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.4.2", features = ["sqlite", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
+ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.2.0", features = ["transport-reticulum", "transport-http", "transport-packet-radio", "ffi-uniffi"] }
 # Founder-quorum verification + key-id fingerprint at the composition root
 # (threshold:: module path — NOT re-exported at the crate root).
 # LOCKSTEP: persist v9.4.0 transitively pins verify-core v6.6.x — the whole
@@ -132,16 +132,16 @@ ciris-edge        = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.1.
 # types. v6.6.1 (CIRISVerify#89) adds the create_federation_identity `seal_alias`
 # arg the #247 user-key-derived fix consumes. (6.4–6.6 are HUMANITY_ACCORD + STH
 # stack — the accord-genesis surface CIRISServer#41 consumes.)
-ciris-verify-core = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.9.0" }
+ciris-verify-core = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.10.0" }
 # The hybrid crypto primitives (Ed25519 + ML-DSA-65 software signers) — used by
 # the portable software identity occurrence to build a `HybridSigningIdentity`
 # over two software seeds. Same tag as the rest of the verify family.
-ciris-crypto = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.9.0", version = "8", features = ["pqc-ml-dsa", "self-enc"] }
+ciris-crypto = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.10.0", version = "8", features = ["pqc-ml-dsa", "self-enc"] }
 # Hardware-backed transport-identity keystore (verify v5.2.0 #68 / edge #99).
 # Base = software keystore + byte-identical migration of an existing .rid (works
 # everywhere, no libtss2). The real TPM-2.0 / SE / StrongBox backend rides the
 # `tpm` feature; runtime auto-detects hardware and falls back to software.
-ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.9.0", version = "8", features = ["software", "pqc-ml-dsa"] }
+ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.10.0", version = "8", features = ["software", "pqc-ml-dsa"] }
 
 # PyO3 bindings for the abi3 wheel — optional, gated behind the `python` feature
 # so the binary never links them. 0.29 matches the persist/edge family floor.
@@ -204,16 +204,16 @@ tracing-appender = "0.2"
 # - keyring `tpm` (tss-esapi / TPM 2.0) — the real hardware backend; needs
 #   libtss2 (Linux build dep). Other targets keep the software keystore.
 [target.'cfg(target_os = "linux")'.dependencies]
-ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.4.1", features = ["postgres", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.4.2", features = ["postgres", "cirisgraph", "cirislens_wa_cert", "cirislens_service_token_revocation", "cirisaudit", "cirislens_tasks", "cirislens_thoughts", "cirislens_tickets", "cirislens_correlations", "cirislens_deferral_reports", "cirislens_maintenance_locks", "cirislens_creation_ceremonies", "cirislens_legacy_migration", "cirisincident", "telemetry", "secrets"] }
 # keyring `tpm` (TPM-at-rest, Linux-only via tss-esapi). `pkcs11` is no longer
 # per-target — it rides the global `pkcs11` feature now that cryptoki builds on all
 # targets (CIRISVerify v6.12.0).
-ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.9.0", version = "8", features = ["tpm-plugin"] }
+ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.10.0", version = "8", features = ["tpm-plugin"] }
 
 # Android (arm64/arm32/x86_64): the keyring `android` backend (JNI → Android
 # Keystore/StrongBox); sqlite bundles, no postgres/tpm. Mirrors persist/edge.
 [target.'cfg(target_os = "android")'.dependencies]
-ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.9.0", version = "8", features = ["android"] }
+ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.10.0", version = "8", features = ["android"] }
 
 # serialport (the RNode LoRa driver dep, src/radio.rs) pulls libudev-sys on Linux,
 # which only resolves where libudev exists: desktop/server Linux (gnu, x86_64 or
@@ -264,20 +264,20 @@ http-body-util   = "0.1"
 # The PQC primitives the realtime-A/V E2E bench drives directly: hybrid KEX
 # (X25519 + ML-KEM-768) for the per-Link transit key, AES-256-GCM for the
 # two-layer chunk seal. Same pin/features edge composes (tag parity).
-ciris-crypto  = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.9.0", version = "8", features = ["hybrid-kex", "aes-gcm", "pqc-ml-dsa", "self-enc"] }
+ciris-crypto  = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.10.0", version = "8", features = ["hybrid-kex", "aes-gcm", "pqc-ml-dsa", "self-enc"] }
 # Enable edge's OWN fountain codec (`codec-fountain`, L1-A) for the survival-floor
 # proof — dev/test ONLY (feature unification applies to test/bench builds; the
 # shipped wheel stays codec-free, since a relay forwards sealed symbols opaquely
 # and never encodes/decodes). This lets tests/chaos_mesh.rs exercise the SUBSTRATE
 # codec (`fountain_encode`/`fountain_decode`) directly — a real MEASURED proof,
 # not a reference stand-in.
-ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.1.6", features = ["codec-fountain"] }
+ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge", tag = "v9.2.0", features = ["codec-fountain"] }
 # Enable persist's TEST-ONLY genesis-seam (`test-genesis-seam`, CIRISPersist#387) for the
 # accord ceremony tests (tests/accord.rs): `Engine::with_signer_no_genesis_seed` yields a
 # clean engine with the baked HUMANITY_ACCORD family seed SKIPPED, so those tests can stand
 # up their OWN custom-holder family via the assemble ceremony. Dev/test ONLY — resolver-2
 # keeps this feature out of the shipped lib/bin/wheel (prod always seeds the baked family).
-ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.4.1", features = ["test-genesis-seam"] }
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.4.2", features = ["test-genesis-seam"] }
 
 # PQC realtime-A/V streaming E2E benchmark (CIRISEdge#62 realtime_av profile).
 [[bench]]

{ciris_server-0.5.87 → ciris_server-0.5.89}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ciris-server
-Version: 0.5.87
+Version: 0.5.89
 License-File: LICENSE
 Summary: The fabric node — the federation's headless cohabitation runtime (registry + lens [+ node] over one shared substrate), as the abi3 wheel CIRISAgent consumes. agent = fabric node + brain.
 Author-email: Eric Moore <eric@ciris.ai>

{ciris_server-0.5.87 → ciris_server-0.5.89}/crates/ciris-lens-core/Cargo.toml

@@ -26,8 +26,8 @@ crate-type = ["cdylib", "rlib"]
 #
 # OQ-01 closure 2026-05-03: rlib primary, PyO3 cdylib via `python`
 # feature for the deployed-lens cutover.
-ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.4.1", version = "13", features = ["extract", "sqlite"] }
-ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge",    tag = "v9.1.6", version = "9", features = ["transport-http", "transport-reticulum"] }
+ciris-persist = { git = "https://github.com/CIRISAI/CIRISPersist", tag = "v13.4.2", version = "13", features = ["extract", "sqlite"] }
+ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge",    tag = "v9.2.0", version = "9", features = ["transport-http", "transport-reticulum"] }
 
 # Keyring — relay mode (CIRISLensCore#10) loads its Edge transport-
 # signing identity via `ciris_keyring::load_local_seed`. Edge's
@@ -37,12 +37,12 @@ ciris-edge    = { git = "https://github.com/CIRISAI/CIRISEdge",    tag = "v9.1.6
 # CIRISVerify tag persist + edge pin (v5.0.0 — CEG 1.0 / Agent 3.0 substrate
 # release; MAJOR 4→5 but additive for lens-core) — single verify version.
 # features mirror edge's keyring pin exactly.
-ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.9.0", version = "8", features = ["software", "pqc-ml-dsa"] }
+ciris-keyring = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.10.0", version = "8", features = ["software", "pqc-ml-dsa"] }
 # verify-core for `fedcode::derive_key_id` — the lens seal path must stamp the
 # DERIVED federation key_id (`derive_key_id(<alias>, <ed25519 pubkey>)`), the id
 # `receive_and_persist` verifies against, NOT the bare `local_key_id` alias
 # (CIRISServer#118; same class as the closed CIRISEdge#203). Single verify version.
-ciris-verify-core = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.9.0", version = "8" }
+ciris-verify-core = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v8.10.0", version = "8" }
 
 # persist's `sqlite` feature: relay mode persists inbound batches via
 # `Engine::receive_and_persist` + reads `Engine::sqlite_backend()` for

{ciris_server-0.5.87 → ciris_server-0.5.89}/crates/ciris-lens-core/src/ffi/pyo3.rs

@@ -563,9 +563,12 @@ enum LensClientInner {
 /// )
 /// ```
 ///
-/// The cohabitation path calls these engine Python methods:
+/// The cohabitation path calls these engine Python methods (the seal is HYBRID —
+/// CIRISServer#121 — so both signing halves are invoked):
 /// - `engine.local_key_id()` → str — key ID stamped onto the trace
 /// - `engine.local_sign(canonical_bytes: bytes)` → 64-byte Ed25519 sig
+/// - `engine.local_pqc_sign(canonical ‖ ed25519_sig: bytes)` → ML-DSA-65 sig
+/// - `engine.local_pqc_public_key_b64()` → str — the producer's ML-DSA-65 pubkey
 /// - `engine.receive_and_persist(batch_bytes: bytes, pre_verified=False)` →
 ///   `{"envelopes_processed": N, "trace_events_inserted": N, ...,
 ///    "signatures_verified": N}` — persists via the host engine's
@@ -607,7 +610,7 @@ enum LensClientInner {
 /// cohabiting in the same process) cannot be tested in-repo — it requires
 /// two separately-built wheels. This is a CIRISConformance `requires_lens`
 /// cohabitation cell (not faked here). The Rust side of the cohabitation path
-/// (`PyEngineCapture::prepare` → `canonical_bytes_for` → `apply_signature_and_batch`)
+/// (`PyEngineCapture::prepare` → `canonical_bytes_for` → `apply_hybrid_signature_and_batch`)
 /// IS tested in `src/capture/py_engine.rs` via `py_engine_path_bytes_round_trip_through_persist`.
 #[pyclass(name = "LensClient")]
 struct PyLensClient {
@@ -863,18 +866,21 @@ impl PyLensClient {
 
             // ── Cohabitation path (CIRISLensCore#43.1 P0 fix) ────────
             //
-            // Orchestration:
+            // Orchestration (HYBRID seal — CIRISServer#121; an Ed25519-only seal is
+            // rejected by persist's hybrid-strict floor with verify_hybrid_required):
             // 1. PyEngineCapture::prepare (Rust) — store, consent, provenance,
             //    stamp deployment_profile + trace_level. Sync, no tokio needed.
             // 2. For non-sealing outcomes → return immediately.
             // 3. For ReadyToSeal:
             //    a. canonical_bytes_for (Rust — JCS / V2Jcs dispatch)
-            //    b. engine.local_key_id() (Python)
-            //    c. engine.local_sign(canonical_bytes) (Python) → 64-byte sig
-            //    d. PyEngineCapture::apply_signature_and_batch (Rust)
-            //    e. tee_write_if_configured (Rust)
-            //    f. engine.receive_and_persist(batch_bytes) (Python) → summary
-            //    g. Extract trace_events_inserted + signatures_verified from summary
+            //    b. engine_federation_key_id (Python) — the DERIVED key_id (#118)
+            //    c. engine.local_sign(canonical) (Python) → 64-byte Ed25519 sig
+            //    d. engine.local_pqc_sign(canonical ‖ ed25519_sig) (Python) → ML-DSA-65
+            //    e. engine.local_pqc_public_key_b64() (Python) — rides the envelope
+            //    f. PyEngineCapture::apply_hybrid_signature_and_batch (Rust)
+            //    g. tee_write_if_configured (Rust)
+            //    h. engine.receive_and_persist(batch_bytes) (Python) → summary
+            //    i. Extract trace_events_inserted + signatures_verified from summary
             LensClientInner::Cohabitation { capture, py_engine } => {
                 let cap = Arc::clone(capture);
                 let engine = py_engine.bind(py);

{ciris_server-0.5.87 → ciris_server-0.5.89}/src/compose.rs

@@ -1468,9 +1468,77 @@ async fn setup_peer_replication(
     edge: &Edge,
     cfg: &ServerConfig,
 ) -> Result<Option<Arc<ciris_edge::replication::ReplicationRuntime>>> {
-    use ciris_edge::replication::{
-        EnvelopeKind, ReplicationPeer, ReplicationRuntime, ReplicationRuntimeConfig,
-    };
+    // Server 0.5 (zero env): there is NO env peer-bootstrap branch. The replication
+    // topology is owner-authored consent ONLY — a peer is admitted + a
+    // consent:replication object emitted via the owner-gated POST
+    // /v1/federation/peering. The prior CIRIS_PEER_B_* env-seed branch is deleted.
+    tracing::info!(
+        "replication topology is owner-authored consent only (POST /v1/federation/peering) — \
+         zero env (Server 0.5)"
+    );
+    // Compose seeds NO extra targets: the boot topology is exactly the corpus's
+    // consent:replication set. The agent-embedded delivery controller
+    // (crate::federation_delivery) is the caller that seeds the baked canonical
+    // key_ids as extra_targets — the ONLY behavioural difference between the two.
+    start_replication_runtime(engine, edge, &cfg.key_id, &[]).await
+}
+
+/// Assemble the per-peer [`ReplicationPeer`] coordinator set from a set of
+/// admitted peer `key_id`s. Two coordinators per peer:
+///   - [`EnvelopeKind::Attestation`] — capacity:* / trace out, health:liveness in.
+///   - [`EnvelopeKind::Key`] (#144, CIRISEdge#257) — the KERI publish-own key plane.
+///
+/// Pure (no I/O) so both the compose boot path and the agent-embedded delivery
+/// controller share ONE assembly, and it is unit-testable without an engine.
+pub(crate) fn build_replication_peers(
+    desired: &[String],
+) -> Vec<ciris_edge::replication::ReplicationPeer> {
+    use ciris_edge::replication::{EnvelopeKind, ReplicationPeer};
+    desired
+        .iter()
+        .flat_map(|p| {
+            [
+                ReplicationPeer {
+                    peer_key_id: p.clone(),
+                    kind: EnvelopeKind::Attestation,
+                },
+                ReplicationPeer {
+                    peer_key_id: p.clone(),
+                    kind: EnvelopeKind::Key,
+                },
+            ]
+        })
+        .collect()
+}
+
+/// Core replication-runtime bring-up, shared by the compose boot path
+/// ([`setup_peer_replication`], `extra_targets = &[]`) AND the agent-embedded
+/// federation-delivery controller ([`crate::federation_delivery`], `extra_targets`
+/// = the baked canonical `key_id`s). Factoring the body here keeps the two callers
+/// byte-identical except for the extra seed set, so compose's boot behaviour is
+/// unchanged when `extra_targets` is empty.
+///
+/// `node_key_id` is the local federation signing key (the consent AUTHOR + the
+/// KERI publish-own selector); compose passes `cfg.key_id`, the delivery
+/// controller passes `edge.signer_key_id()`.
+///
+/// Returns `Ok(None)` when the Edge carries no Reticulum transport — the read API
+/// still writes CEG (consent objects), there is just no runtime to converge.
+///
+/// MUST run BEFORE `edge.run()` consumes the Edge on the COMPOSE path (so
+/// `install_replication_routing` + `reticulum_transport()` are wired before the
+/// inbound loop starts). On the agent-embedded path the Edge is ALREADY running;
+/// this is safe because `Edge::run` clones the `Arc<OnceLock>` replication-registry
+/// and reads `.get()` LIVE per inbound frame (edge.rs `run`), so a post-boot
+/// `install_replication_routing` is observed on the next frame — see
+/// [`crate::federation_delivery`] for the full ordering note.
+pub(crate) async fn start_replication_runtime(
+    engine: &Arc<Engine>,
+    edge: &Edge,
+    node_key_id: &str,
+    extra_targets: &[String],
+) -> Result<Option<Arc<ciris_edge::replication::ReplicationRuntime>>> {
+    use ciris_edge::replication::{ReplicationRuntime, ReplicationRuntimeConfig};
     use ciris_persist::federation::FederationDirectory;
 
     // Require a Reticulum transport to run replication at all. Without it the read
@@ -1487,19 +1555,19 @@ async fn setup_peer_replication(
         .context("replication runtime requires a SQLite-backed Engine")?
         .clone();
 
-    // Server 0.5 (zero env): there is NO env peer-bootstrap branch. The replication
-    // topology is owner-authored consent ONLY — a peer is admitted + a
-    // consent:replication object emitted via the owner-gated POST
-    // /v1/federation/peering. The prior CIRIS_PEER_B_* env-seed branch is deleted.
-    tracing::info!(
-        "replication topology is owner-authored consent only (POST /v1/federation/peering) — \
-         zero env (Server 0.5)"
-    );
-
-    // 1. Desired Initiator set from CEG — admitted consent:replication subjects.
-    let consented = crate::peer::replication_peers_from_consent(engine, &cfg.key_id).await?;
-    let mut desired: Vec<String> = Vec::with_capacity(consented.len());
-    for peer in consented {
+    // 1. Desired Initiator set from CEG — admitted consent:replication subjects,
+    //    UNIONED with any caller-seeded `extra_targets` (the delivery controller's
+    //    baked canonical key_ids). Every candidate is admission-filtered against the
+    //    federation directory (an unknown key has no record to route/verify).
+    let consented = crate::peer::replication_peers_from_consent(engine, node_key_id).await?;
+    let mut candidates: Vec<String> = consented;
+    for t in extra_targets {
+        if !candidates.contains(t) {
+            candidates.push(t.clone());
+        }
+    }
+    let mut desired: Vec<String> = Vec::with_capacity(candidates.len());
+    for peer in candidates {
         match directory.lookup_public_key(&peer).await {
             Ok(Some(_)) => desired.push(peer),
             Ok(None) => tracing::warn!(
@@ -1517,28 +1585,10 @@ async fn setup_peer_replication(
 
     // 2. Always start the ONE long-lived runtime (even with an empty desired set)
     //    so the registry + routing exist for the reconciler's runtime hot-add.
-    //    EnvelopeKind::Attestation carries BOTH directions: capacity:* out,
-    //    health:liveness in. v5.1.0 `start` installs the scheduler control channel
-    //    unconditionally, so the runtime accepts `set_peers` mutation with no
-    //    extra opt-in (CIRISEdge#173 resolved).
-    // Two coordinators per consent peer: Attestation (capacity:* / health:liveness)
-    // AND Key (#144, CIRISEdge#257 — the KERI publish-own key plane). The reconciler
-    // (replication_reconcile.rs) converges the same pair set at runtime.
-    let peers: Vec<ReplicationPeer> = desired
-        .iter()
-        .flat_map(|p| {
-            [
-                ReplicationPeer {
-                    peer_key_id: p.clone(),
-                    kind: EnvelopeKind::Attestation,
-                },
-                ReplicationPeer {
-                    peer_key_id: p.clone(),
-                    kind: EnvelopeKind::Key,
-                },
-            ]
-        })
-        .collect();
+    //    v5.1.0 `start` installs the scheduler control channel unconditionally, so
+    //    the runtime accepts `set_peers` mutation with no extra opt-in
+    //    (CIRISEdge#173 resolved).
+    let peers = build_replication_peers(&desired);
 
     // Key-plane publish selector (CIRISEdge#257 / edge v8.6.0): the Key plane's
     // `list_keys` advertises the key_ids THIS selector yields — the node's OWN
@@ -1547,7 +1597,7 @@ async fn setup_peer_replication(
     // record (scrub_key_id = an accord holder), the NEXT anti-entropy round
     // publishes the scrubbed, ANCHORED record to consent peers → they root it.
     // (KERI publish-own: the controller publishes its own establishment record.)
-    let own_key_id = cfg.key_id.clone();
+    let own_key_id = node_key_id.to_string();
     let key_selector: ciris_edge::replication::CohortProvider =
         Arc::new(move || vec![own_key_id.clone()]);
 
@@ -1562,16 +1612,9 @@ async fn setup_peer_replication(
 
     // Wire the runtime's registry into the Edge's inbound dispatch (CIRISEdge#119) —
     // EXACTLY ONCE on the single long-lived runtime (set-once OnceLock; never
-    // rebuild the runtime).
+    // rebuild the runtime). Safe post-boot on the embedded path (see the fn doc).
     edge.install_replication_routing(&runtime);
 
-    // OPT-IN to the v5.1.0 scheduler control channel so the reconciler can mutate
-    // the live Initiator set at runtime (register_initiator_peer / remove_peer /
-    // set_peers). In edge v5.1.0 `ReplicationRuntime::start` already installs the
-    // control channel unconditionally — the runtime exposes no separate public
-    // `install_control_channel`; the orchestrator is always-on after `start`, so
-    // there is nothing further to call here (CIRISEdge#173 resolved).
-
     tracing::info!(
         initiator_peers = desired.len(),
         "CEG-driven replication runtime started + routed into the shared Edge ({} consent-derived \
@@ -1597,7 +1640,7 @@ async fn setup_peer_replication(
 /// (transport teardown) or on a closed channel. A lagged receiver logs the
 /// drop count rather than aborting — announces are periodic, so a missed batch
 /// is re-emitted on the next `ANNOUNCE_INTERVAL`.
-fn spawn_announce_logger(bus: Arc<ciris_edge::events::EventBus>) {
+pub(crate) fn spawn_announce_logger(bus: Arc<ciris_edge::events::EventBus>) {
     use ciris_edge::events::EventSeverity;
     use tokio::sync::broadcast::error::RecvError;
     let mut rx = bus.subscribe_announces();
@@ -1887,7 +1930,7 @@ async fn open_engine_for_cli(cfg: &ServerConfig) -> Result<(Arc<Engine>, ServerC
 /// pubkey-derived overlay address (not an internet bootstrap target) and is skipped.
 /// Returns empty on a substrate whose canonical records carry no `transport_hints`
 /// yet (forward-compatible: a pre-#381 record simply has no such envelope key).
-async fn canonical_bootstrap_addrs(engine: &Engine) -> Vec<std::net::SocketAddr> {
+pub(crate) async fn canonical_bootstrap_addrs(engine: &Engine) -> Vec<std::net::SocketAddr> {
     match engine.canonical_bootstrap_hints().await {
         Ok(hints) => ip_addrs_from_hints(&hints),
         Err(e) => {
@@ -1902,7 +1945,7 @@ async fn canonical_bootstrap_addrs(engine: &Engine) -> Vec<std::net::SocketAddr>
 /// canonical records' signed envelopes (CIRISPersist#381). Split out so the filter is
 /// unit-testable without an engine. Skips non-`ip` kinds (a `reticulum` hint is a
 /// pubkey-derived overlay address, not a TCP bootstrap target) + un-parseable dests.
-fn ip_addrs_from_hints(
+pub(crate) fn ip_addrs_from_hints(
     hints: &[(String, ciris_persist::federation::types::TransportHint)],
 ) -> Vec<std::net::SocketAddr> {
     let mut out = Vec::new();