CIRISPersist v8.8.0 ships the single canonical §5.6.8.15 federation-key admission gate as a public API — Engine::register_federation_key(SignedKeyRecord) (Rust) / engine.register_federation_key(signed_key_record_json) (FFI). Hybrid-verifies (Ed25519 + ML-DSA-65, Strict) the registration over ceg_produce_canonicalize(registration_envelope) against scrub_key_id's pubkeys + cross-checks original_content_hash, then composes put_public_key. Fail-secure: any failure ⇒ not stored.
Ask: src/ceg.rs (the B→A side — CIRISStatus replicating health:liveness:v1 back to the in-group lens node) should adopt this single gate instead of re-deriving the peer-key registration + admission locally. Per CEG §5.6.8.15 normative-honesty, key-registration IS the substrate admission teeth for the out-of-group peering; consent:replication stays the CEG-side governance/audit record. Pin ciris-persist >= 8.8.0.
⚠️ Breaking FFI rename in 8.8.0: the old v1.5.3 register_federation_key self-registration convenience helper is now register_self_federation_key (signature unchanged). Update the name if you call the self-helper over FFI.
Refs: CIRISPersist#234, CEG 1.0-RC28/RC29 §5.6.8.15, CIRISRegistry#97/#98.
CIRISPersist v8.8.0 ships the single canonical §5.6.8.15 federation-key admission gate as a public API —
Engine::register_federation_key(SignedKeyRecord)(Rust) /engine.register_federation_key(signed_key_record_json)(FFI). Hybrid-verifies (Ed25519 + ML-DSA-65, Strict) the registration overceg_produce_canonicalize(registration_envelope)againstscrub_key_id's pubkeys + cross-checksoriginal_content_hash, then composesput_public_key. Fail-secure: any failure ⇒ not stored.Ask:
src/ceg.rs(the B→A side — CIRISStatus replicatinghealth:liveness:v1back to the in-group lens node) should adopt this single gate instead of re-deriving the peer-key registration + admission locally. Per CEG §5.6.8.15 normative-honesty, key-registration IS the substrate admission teeth for the out-of-group peering;consent:replicationstays the CEG-side governance/audit record. Pinciris-persist >= 8.8.0.register_federation_keyself-registration convenience helper is nowregister_self_federation_key(signature unchanged). Update the name if you call the self-helper over FFI.Refs: CIRISPersist#234, CEG 1.0-RC28/RC29 §5.6.8.15, CIRISRegistry#97/#98.