From d42993d85689ac55c349a1c57e617ced37199c91 Mon Sep 17 00:00:00 2001 From: Eric Moore Date: Mon, 7 Sep 2026 14:22:56 -0500 Subject: [PATCH 1/2] =?UTF-8?q?0.3.65:=20adopt=20ciris-server=200.5.201=20?= =?UTF-8?q?=E2=80=94=20the=20triple=20(persist=20v42.0.0=20/=20edge=20v21.?= =?UTF-8?q?0.0=20/=20verify=20v15.0.0)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pin moves v0.5.200 -> v0.5.201 and, for the first time since 0.3.60, the substrate moves with it: persist v42.0.0 / edge v21.0.0 / verify v15.0.0 (CIRISServer#559), a MAJOR on both. leviculum unchanged. The lock moves the server, lens-core, and the substrate crates; one copy of each (cargo tree -i). What matters to THIS node: persist v42 admits one live `config:` row per (subject, scope, leaf) and requires a renewal to supersede the row it replaces (CIRISPersist#814 part 3). The server now keys each config key to its own leaf `config:{key}:v1`; rows this node wrote before the upgrade on the legacy `config:v1` leaf still read and are shadowed by version when the key is next written, so the wizard's keys, `node.alias`, and the retention knobs survive the restart with no migration step. `registry` / `verify` are gated co-stewards now; `license` / `grant` join the delegated-duty scopes. This crate mints no FedCode, so verify v15's `#[non_exhaustive]` changes nothing here. clippy -D warnings clean, 114 tests pass, `cargo metadata --locked` proves the lock (version bumped before the lock refresh, CIRISStatus#75's lesson). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_0132ELwj5JU6t4jEKpwH9bJ7 --- Cargo.lock | 29 +++++++++++++++-------------- Cargo.toml | 22 ++++++++++++++++++++-- 2 files changed, 35 insertions(+), 16 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 0cff48e..de386e8 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -880,8 +880,8 @@ dependencies = [ [[package]] name = "ciris-crypto" -version = "14.2.0" -source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v14.2.0#84fef3bdfc6d02e8d3e16d123750d890aae7fe01" +version = "15.0.0" +source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v15.0.0#3531334e829395f0c2664aff1a3277981bcbd086" dependencies = [ "chacha20poly1305", "ed25519-dalek", @@ -907,8 +907,8 @@ dependencies = [ [[package]] name = "ciris-edge" -version = "20.3.0" -source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v20.3.0#905a50ed1dd0230173ddfb7c726b3eb8f7a83ded" +version = "21.0.0" +source = "git+https://github.com/CIRISAI/CIRISEdge?tag=v21.0.0#6174b20533a19558d274df446494fea744d32f2c" dependencies = [ "async-trait", "axum", @@ -959,8 +959,8 @@ dependencies = [ [[package]] name = "ciris-keyring" -version = "14.2.0" -source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v14.2.0#84fef3bdfc6d02e8d3e16d123750d890aae7fe01" +version = "15.0.0" +source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v15.0.0#3531334e829395f0c2664aff1a3277981bcbd086" dependencies = [ "aes-gcm", "async-trait", @@ -997,7 +997,7 @@ dependencies = [ [[package]] name = "ciris-lens-core" version = "1.4.4" -source = "git+https://github.com/CIRISAI/CIRISServer?tag=v0.5.200#a801ee3360903990954bfbc3702cbd69191dcf7c" +source = "git+https://github.com/CIRISAI/CIRISServer?tag=v0.5.201#ed2ccb56a7363cfc93d99a06c713fd6f2fa4e6e5" dependencies = [ "axum", "base64 0.22.1", @@ -1022,8 +1022,8 @@ dependencies = [ [[package]] name = "ciris-persist" -version = "41.2.0" -source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v41.2.0#52f659257a480f3956824f3241b60fca4a5ece39" +version = "42.0.0" +source = "git+https://github.com/CIRISAI/CIRISPersist?tag=v42.0.0#13aa6347f15085cd8253a6265a3e873202650126" dependencies = [ "anyhow", "async-trait", @@ -1067,8 +1067,8 @@ dependencies = [ [[package]] name = "ciris-server" -version = "0.5.200" -source = "git+https://github.com/CIRISAI/CIRISServer?tag=v0.5.200#a801ee3360903990954bfbc3702cbd69191dcf7c" +version = "0.5.201" +source = "git+https://github.com/CIRISAI/CIRISServer?tag=v0.5.201#ed2ccb56a7363cfc93d99a06c713fd6f2fa4e6e5" dependencies = [ "anyhow", "async-trait", @@ -1097,6 +1097,7 @@ dependencies = [ "serde_json", "serialport", "sha2 0.10.9", + "signal-hook-registry", "subtle", "tokio", "tower", @@ -1110,7 +1111,7 @@ dependencies = [ [[package]] name = "ciris-status" -version = "0.3.64" +version = "0.3.65" dependencies = [ "anyhow", "async-trait", @@ -1135,8 +1136,8 @@ dependencies = [ [[package]] name = "ciris-verify-core" -version = "14.2.0" -source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v14.2.0#84fef3bdfc6d02e8d3e16d123750d890aae7fe01" +version = "15.0.0" +source = "git+https://github.com/CIRISAI/CIRISVerify?tag=v15.0.0#3531334e829395f0c2664aff1a3277981bcbd086" dependencies = [ "android_system_properties", "async-trait", diff --git a/Cargo.toml b/Cargo.toml index b8efaef..707a16e 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "ciris-status" -version = "0.3.64" +version = "0.3.65" edition = "2021" description = "The ciris.ai public health/status surface — now a ciris-server fabric node + a StatusAdapter (mirrors CIRISAgent's adapter model). Serves /health, /v1/status, /api/v1/status, /api/v1/status/history + the public scoring roster (Flow A, own corpus) + live SSE/WS, by live outbound probes + a SQLite uptime history. The federation node (engine, edge, consent:replication, read API, ownership, safety, NAT-traversal) is ciris-server's serve; the status page is the adapter." license = "AGPL-3.0-or-later" @@ -200,7 +200,25 @@ libc = "0.2" # the same move 0.3.63 made in this binary — with a loopback-only trim door # behind `--diagnostics` (CIRISServer#552). Substrate UNCHANGED through this # pin: persist v41.2.0 / edge v20.3.0 / verify v14.2.0 / leviculum v0.25.0+ciris.1. -ciris-server = { git = "https://github.com/CIRISAI/CIRISServer", tag = "v0.5.200" } +# +# 0.5.201 — THE TRIPLE, AND EACH CONFIG KEY IS ITS OWN LEAF (2026-09-07). The +# substrate MOVES through this pin, a MAJOR on both: persist v42.0.0 / edge +# v21.0.0 / verify v15.0.0 (CIRISServer#559; leviculum v0.25.0+ciris.1 +# unchanged). persist v42 admits ONE live `config:` row per (subject, scope, +# leaf) and requires a renewal to be a `supersedes` naming the row it replaces +# (CIRISPersist#814 part 3, CC 3.4.5.1); the server had kept every config key +# on one leaf `config:v1`, so the second key's write was refused — each key now +# rides its own leaf `config:{key}:v1`, the first write a `scores` row and every +# later write a `supersedes` of the leaf head, rows written before 0.5.201 on +# the legacy leaf still read and are shadowed by version when next written. So +# THIS node's config plane (the wizard's keys, `node.alias`, the retention +# knobs) keeps reading across the upgrade with no migration step; the first +# write of each key after the restart opens its leaf. Also: `registry` and +# `verify` are gated co-stewards now (a self-asserted one is refused at the +# door), and `license` / `grant` join the delegated-duty scopes. verify v15 +# makes `FedCode` / `OwnedNode` `#[non_exhaustive]` — this crate mints no +# code, so nothing here changes shape. +ciris-server = { git = "https://github.com/CIRISAI/CIRISServer", tag = "v0.5.201" } # NO ciris-persist PIN. persist arrives through ciris-server's `pub use # ciris_persist` re-export, so this crate cannot resolve a different persist From ba201779ac9943cbe0d260d6eca898a377583577 Mon Sep 17 00:00:00 2001 From: Eric Moore Date: Mon, 7 Sep 2026 17:01:41 -0500 Subject: [PATCH 2/2] =?UTF-8?q?0.3.65=20pins=20v0.5.202=20=E2=80=94=20the?= =?UTF-8?q?=20tag=20that=20shipped=20(v0.5.201=20exists=20but=20never=20pu?= =?UTF-8?q?blished)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v0.5.201's Windows wheel failed on a one-line type break in the server, so its publish never ran; v0.5.202 is the same release plus that cast and a CRLF fix in one gate. Same substrate (persist v42.0.0 / edge v21.0.0 / verify v15.0.0), same 114 tests, clippy clean, `cargo metadata --locked` proves the lock, one copy of each crate. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_0132ELwj5JU6t4jEKpwH9bJ7 --- Cargo.lock | 6 +++--- Cargo.toml | 9 ++++++--- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index de386e8..d509281 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -997,7 +997,7 @@ dependencies = [ [[package]] name = "ciris-lens-core" version = "1.4.4" -source = "git+https://github.com/CIRISAI/CIRISServer?tag=v0.5.201#ed2ccb56a7363cfc93d99a06c713fd6f2fa4e6e5" +source = "git+https://github.com/CIRISAI/CIRISServer?tag=v0.5.202#e55175899f8acac148809ec92309e7f767d5f202" dependencies = [ "axum", "base64 0.22.1", @@ -1067,8 +1067,8 @@ dependencies = [ [[package]] name = "ciris-server" -version = "0.5.201" -source = "git+https://github.com/CIRISAI/CIRISServer?tag=v0.5.201#ed2ccb56a7363cfc93d99a06c713fd6f2fa4e6e5" +version = "0.5.202" +source = "git+https://github.com/CIRISAI/CIRISServer?tag=v0.5.202#e55175899f8acac148809ec92309e7f767d5f202" dependencies = [ "anyhow", "async-trait", diff --git a/Cargo.toml b/Cargo.toml index 707a16e..f29afcc 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -201,7 +201,7 @@ libc = "0.2" # behind `--diagnostics` (CIRISServer#552). Substrate UNCHANGED through this # pin: persist v41.2.0 / edge v20.3.0 / verify v14.2.0 / leviculum v0.25.0+ciris.1. # -# 0.5.201 — THE TRIPLE, AND EACH CONFIG KEY IS ITS OWN LEAF (2026-09-07). The +# 0.5.202 — THE TRIPLE, AND EACH CONFIG KEY IS ITS OWN LEAF (2026-09-07). The # substrate MOVES through this pin, a MAJOR on both: persist v42.0.0 / edge # v21.0.0 / verify v15.0.0 (CIRISServer#559; leviculum v0.25.0+ciris.1 # unchanged). persist v42 admits ONE live `config:` row per (subject, scope, @@ -217,8 +217,11 @@ libc = "0.2" # `verify` are gated co-stewards now (a self-asserted one is refused at the # door), and `license` / `grant` join the delegated-duty scopes. verify v15 # makes `FedCode` / `OwnedNode` `#[non_exhaustive]` — this crate mints no -# code, so nothing here changes shape. -ciris-server = { git = "https://github.com/CIRISAI/CIRISServer", tag = "v0.5.201" } +# code, so nothing here changes shape. (v0.5.201 exists as a tag but never +# published: its Windows wheel failed on a one-line type break; v0.5.202 is +# the same release plus that cast and a CRLF fix in one gate — pin the tag +# that shipped.) +ciris-server = { git = "https://github.com/CIRISAI/CIRISServer", tag = "v0.5.202" } # NO ciris-persist PIN. persist arrives through ciris-server's `pub use # ciris_persist` re-export, so this crate cannot resolve a different persist