Ship/expose the verify FFI (libciris_verify_ffi.so) in the ciris-server wheel so the agent rides us for verify — enables CIRISAgent#917 to drop the standalone ciris-verify pin (kills the v9.0.0-vs-v5.1.3 skew)

[emooreatx]

Summary

The agent is supposed to ride ciris-server for the WHOLE substrate — verify included — but today it can't: the agent loads libciris_verify_ffi.so from a separately-pinned ciris-verify wheel (ciris_adapters/ciris_verify/ffi_bindings/: jcs_canonicalize, operational_admit, hybrid_kex, key_grant, locale_merkle, self_enc, attestation). ciris-server bundles verify as a Rust cdylib inside its own wheel (symbols in ciris_server's .so), so a ffi_bindings that dlopens libciris_verify_ffi.so finds nothing in the ciris-server install → the agent must keep the standalone wheel → two verify lineages (bundled v9.0.0 vs standalone v5.1.3), the wire/canonical-hash skew (CIRISAgent#917).

For the agent to drop the standalone ciris-verify and ride us, ciris-server must PROVIDE the verify FFI surface the agent consumes, at the SAME version it bundles.

Ask

Ship/expose the verify FFI so ffi_bindings can source it from the ciris-server install. Two viable shapes (pick one):

1. Ship the cdylib — include libciris_verify_ffi.so (+ .dylib/.dll) in the ciris-server wheel (built from the same ciris-verify-ffi at the bundled tag, v9.0.0), and expose its path (e.g. ciris_server.verify_ffi_path()), so the agent's ffi_bindings loader finds it there instead of the standalone wheel. Simplest for the agent (its ctypes loader just repoints).
2. pyo3 re-export — surface the verify functions the agent calls as ciris_server pyo3 entries (jcs_canonicalize, self_enc_*, operational_admit, key_grant, hybrid_kex, locale_merkle, attestation). Cleaner API but a larger surface to wrap + keep in sync.

Recommend (1) — it's a packaging change (bundle the already-built FFI cdylib at the pinned tag), preserves the agent's existing ctypes bindings verbatim, and guarantees the FFI version == the bundled substrate version (no skew by construction).

Acceptance

• The ciris-server wheel contains libciris_verify_ffi.{so,dylib,dll} at the bundled verify tag; a verify_ffi_path() (or documented location) resolves it.
• CIRISAgent#917 drops ciris-verify from requirements and repoints ffi_bindings at the ciris-server-provided lib; jcs/attestation/etc. run against the SAME verify the substrate uses.
• Version-skew impossible: one verify, bundled + FFI, one tag.

[emooreatx]

Unblocked — CIRISVerify#187 shipped in v9.0.1. ciris-verify-ffi now emits an rlib (additive; the standalone libciris_verify_ffi.so cdylib + staticlib are unchanged), so ciris-server can depend on it as a Rust crate and force-export the verify FFI symbols into ciris_server._native.so.

Recommended shape (option 2 / re-host, guarantees version == bundled substrate, no skew by construction):

1. Depend on the FFI at the bundled tag:

   ciris-verify-ffi = { git = "https://github.com/CIRISAI/CIRISVerify", tag = "v9.0.1" }

2. Force-export its #[no_mangle] extern "C" symbols into ciris_server._native.so with a #[used] reference (same mechanism you use to re-host persist/edge). e.g.:

   // keep the linker from GC-ing the verify FFI symbols out of the cdylib
   #[used]
   static _KEEP_VERIFY_FFI: [extern "C" fn(); 1] =
       [ciris_verify_ffi::ciris_verify_self_enc_pubkeys as extern "C" fn()];

   (Reference one symbol per module you need retained — jcs, operational_admit, hybrid_kex, key_grant, locale_merkle, self_enc, attestation — or use -Wl,--whole-archive / an export list if you prefer to retain the whole surface.)
3. Expose the location (verify_ffi_path() or documented) so the agent's ffi_bindings dlopens ciris_server._native.so.

Then CIRISAgent#917 drops ciris-verify from requirements and repoints ffi_bindings → one verify version (v9.0.1, bundled + FFI), zero lineage skew.

NB v9.0.0 was a BREAKING bump: ScrubTarget gained a required roles: Vec<String> field — if ciris-server constructs ScrubTarget (holder-app "admit node" / the new CI-key blessing), each site needs roles: vec![] (node/canonical) or roles: vec!["infra:attest".into()] (CI pipeline key). See CIRISVerify#185.

[emooreatx]

Unblocked + shape decided — folding the rlib into _native.so (needs one small verify anchor)

verify v9.0.1 (#187/#188) landed crate-type = [..., "rlib"] on ciris-verify-ffi — the mechanical blocker. Shape chosen (over #232's option-1 separate-cdylib): fold the FFI directly into ciris_server._native.so — one .so, one verify lineage, version-match by construction, matching the persist/edge one-wheel re-host pattern. verify_ffi_path() will just return _native's own path.

One catch, one dependency: an rlib's #[no_mangle] C symbols get dead-stripped from the final cdylib because no Rust code references them (the agent reaches them via ctypes at runtime). Filed CIRISVerify#189 for a ciris_verify_ffi_link_anchor() keep-alive — ciris-server references it via #[used] so the linker retains the whole FFI surface. Fails per-platform-silently otherwise.

Sequence: verify ships v9.0.2 (anchor) → I fold + verify_ffi_path() + a cross-platform nm/dumpbin symbol-presence CI smoke → bundle into 0.5.107 alongside the CIRISServer#238 canonical boot-prime (already staged). Then CIRISAgent#917 drops ciris-verify and repoints ffi_bindings at ciris_server.verify_ffi_path().

[emooreatx]

Ready to fold — the linker keep-alive shipped in v9.0.2 (CIRISVerify#189).

ciris_verify_ffi_link_anchor() references all 84 exported ciris_verify_* symbols (each conditional fn under its own #[cfg]), so a single #[used] reference retains the whole surface through --gc-sections. A source-level CI check (check-ffi-link-anchor.sh) fails on any future export that drifts past the anchor, so this stays exhaustive.

Fold recipe (at tag = v9.0.2):

// one reference retains ALL 84 ciris_verify_* symbols in _native.so
#[used]
static KEEP_VERIFY_FFI: extern "C" fn() -> usize = ciris_verify_ffi::ciris_verify_ffi_link_anchor;

// belt-and-suspenders on boot so LTO can't fold it away:
let _ = std::hint::black_box(ciris_verify_ffi::ciris_verify_ffi_link_anchor());

Then your acceptance nm/dumpbin check across the 3 platforms:

• Linux: nm -D _native.so | grep -c ' T ciris_verify_' → expect ≥ 85 (84 + anchor)
• macOS: nm -gU _native.dylib | grep -c ' T _ciris_verify_'
• Windows: dumpbin /exports _native.pyd | grep -c ciris_verify_

That's the last verify-side piece — fold + nm-verify + cut 0.5.107, and CIRISAgent#917 drops the standalone ciris-verify pin. Ping if any symbol comes up missing on a platform.

[emooreatx]

Windows unblocked — the DllMain deadlock is fixed in CIRISVerify v10.1.1 (#197).

Root cause was exactly as reported: ciris-verify-ffi's DllMain ran early_verify() — a Tokio runtime + block_on HTTPS fetch — under the Windows loader lock. Once you folded our rlib into _native.pyd, that became your pyd's DllMain, so import ciris_server hung during LoadLibrary.

Fixed by removing every platform constructor:

• Windows DllMain — deleted.
• macOS/iOS #[ctor::ctor] — deleted too (network I/O from a library constructor is a hazard on its own merits; the load path is now uniformly inert).
• early_verify() now lazily triggers from ciris_verify_init() on every platform.

Loading the FFI is now completely passive: no threads, no sockets, no I/O. Release cdylib verified to export 0 DllMain symbols. A source-level CI guard (check-no-loader-callbacks.sh) prevents any loader callback from being reintroduced — source-level deliberately, since the old hook was #[cfg(not(any(test, debug_assertions)))] (release-only) and stayed invisible to every test job.

Bump the pin to tag = "v10.1.1" (it also carries the #189 link-anchor, so keep the #[used] reference), re-run the cross-platform fold smoke, and 0.5.107 should be good to cut. Ping if anything still hangs.