0.5.215: keys now reach the canonical but no attestation does — a federation-scoped consent:replication grant written before the round is never received

[emooreatx]

Follow-on from #629, as its own ladder asked: step 1 passes, step 2 fails. The node keys now reach the canonical; no attestation row does — including a consent:replication:v1 grant that the agent did write, federation-scoped, before the round that should have carried it.

Agent side: ciris-server 0.5.215, CIRISAgent five-platform gate run 35896050806. Canonical: 0.5.215 since 17:33Z.

Canonical side (operator, read-only mode=ro)

• Step 1 passes. Since 17:44Z the canonical admitted keys from six runs, three each: the node key (ciris-node-bootstrap-*), the agent key, and the owner (qa-node-*, stored as type user). The previous qa-node-* key was from 2026-09-08; on 0.5.214 only the agent key ever arrived. 0.5.214: the consent:replication grant is authored on the agent (prefixes include trace:) but never reaches the canonical — no kind=Attestation round is ever scheduled #629's fix works.
• Step 2 fails. None of those 18 keys has a single attestation on the canonical, of any type. The newest consent row there is still 2026-09-18T17:01Z.

Agent side: the grant is written, and it's the right scope

From the agent's own database (federation_attestations, gate artifact db-android.db; db-ios.db is identical in shape):

consent:replication:v1
  attesting_key_id  qa-node-1790186668-…            (the OWNER)
  attested_key_id   ciris-canonical-1-d7bdeu223k
  cohort_scope      federation
  tier              federation
  admitted_at       2026-09-23T18:05:21.951Z
  promoted_at       NULL

So this isn't a scoping mistake — the grant is written the way peer.rs::emit_grant_row intends. And it exists six seconds before the round below.

All 19 rows on the agent after the run:

dimension	attester	cohort_scope	tier
(3 rows with no dimension — key/occurrence envelopes)	A1 / agent	federation	federation
accord:lifecycle:v1	A1	federation	federation
ownership:responsible_party:node:v1	owner	self	federation
age_self_declared:adult:v1	owner	federation	federation
ownership:responsible_party:node:v1	owner	federation	federation
config:net.announce_ownership:v1 (×2)	agent	self	federation
consent:replication:v1	owner	federation	federation
consent:state:granted:v1 (×2)	owner	federation	federation
consent:community_trust:v1 (×2)	agent	self	federation
consent:community_trust:v1 (×2)	agent	federation	federation
consent:partnership_grant:v1	owner	self	local
consent:partnership_accept:v1	agent	self	local
self:delegates_to:agent_occurrence:v1	owner	federation	federation

Eleven rows are federation-scoped and signed by keys the canonical now holds. None arrived.

The round that should have carried it (android node log)

18:05:21.951  consent:replication:v1 admitted locally (above)
18:05:27.687  anti_entropy_round{peer=canonical kind=Attestation kicked=true}
              attestation send-set resolved (consent ∪ owner-bound ∪ self-collective)
              consent=1 owner_routed=0 collective_routed=1 complete=true
18:05:27.698  attestation withheld — recipient not in the row's audience   attester=qa-node-…  audience="self"
18:05:27.699  attestation withheld — recipient not in the row's audience   attester=ciris-agent-…  audience="self"
18:05:27.700  attestation withheld — recipient not in the row's audience   attester=ciris-agent-…  audience="self"
18:05:28.683  CRPL reply ROUTED into our INITIATOR's round inbox  kind=TransportDestination   (×3)
              — no reply routed for kind=Attestation in this window
round timed out waiting for peer reply: 7 over the run

The three withheld rows are correct to withhold. They're audience=self, and the self-scoped rows above match their attesters (owner ×1, agent ×2). A self row belongs on the owner's own nodes, not on the canonical. (The log names neither the row nor its dimension, so I can't say which self rows they were.)

The federation rows are invisible in that log either way. In bridge.rs the audience filter has Audience::Federation => true and only logs on withhold, so a federation row that passes produces no line. The log can't tell us whether the grant was in the offer.

The question

The grant was written, scoped to federation, before the round. So either:

1. it was not in the round's offer — something between "admitted locally" and "advertised" (the publish-own set, the send-set's per-scope reach, CIRISPersist#884) doesn't include an owner-signed federation row on a split home; or
2. it was offered and the round never completed — the Attestation round got no reply we can see (only TransportDestination replies routed back) and rounds kept timing out, so nothing transferred.

Separating these needs one of:

• the canonical's view of what the qa-node-*/agent peers offered in Attestation rounds after 17:44Z — any summary or inbound frame from them for kind=Attestation; or
• edge naming each row offered and each row withheld (row id + dimension) at debug. Today's withhold line carries peer, attester, audience, site only, and rows that pass the filter aren't logged at all — so raising RUST_LOG on our side won't list them. We already run ciris_edge=debug.

Not this

• The grant's scope. It's federation, as intended. The audience="self" lines are self-plane rows being withheld correctly.
• The c3dc6f27… Key refusal. Still logged, confirmed non-blocking earlier.
• CIRISClient#66 — macOS stuck on Startup after the run-without-AI hand-off. That's a client issue and unrelated to this.

Refs #629, #628, CIRISPersist#884, CIRISAgent#1184.

[emooreatx]

Canonical side, read-only (container ciris-server, image 0.5.215 since 17:33:52Z; daily log + sqlite mode=ro)

It is neither branch of the fork exactly: the round's frames reached the canonical and were dropped at the transport, before any round or admission code saw them.

At 18:05:27.95Z, the same second as the agent's Attestation round, the canonical dropped three inbound frames from the run's node key:

18:05:27.949438Z WARN ciris_edge::transport::reticulum: inbound frame NOT attributed —
  resolved binding fails Rooted∧owns_key … link=LinkId(3db5609b…)
  peer=ciris-node-bootstrap-jkzvi6fqoh resolved_provenance=Advisory resolved_owns_key=true
  resolved_epoch=0 stored_provenance=None

(×3, 3db5609b… / 30ad2ea0… / 9f33afbd…). The 17:44:36Z run shows the same thing for ciris-node-bootstrap-u63alqfo3b.

This explains everything you saw: the frames that carried the grant were discarded because the peer is not attributed, so no Attestation reply comes back and the round times out. The TransportDestination replies are a different plane, which is why those came through.

Why the binding is only Advisory. Each node key announced about 90 s before its round (18:03:53 announce Stage 1: first-seen peer bound (Advisory) … Stage 2 (rooting) queued (CIRISEdge#627)). Stage 2 (the rooting walk) is queued 37 times today and logs no result of any kind. In edge v29.5.0 resolve_announce_cold_start, a RootingVerdict::Rejected falls to Advisory and is logged only at debug, so the canonical records no reason. stored_provenance=None means it has never been Rooted: not a churn downgrade, even though the message suggests one.

So the question for this issue is now concrete: why does persist's root_binding reject the split node key ciris-node-bootstrap-* at the canonical? Its chain runs node → owner-binding → qa-node-* (identity_type=user). The node, agent and owner keys are all admitted (step 1 passes), so UnknownKeyId is unlikely. The rejection kind is the missing fact, and this node doesn't log it.

Also confirmed on the canonical:

• Step 1 passes: each of 6 runs since 17:44Z admitted node + agent + owner keys. The last qa-node-* before that was 2026-09-08.
• Step 2 fails: zero attestations of any type from those 18 keys, and the newest consent row is still 2026-09-18T17:01Z.
• The repeating delivered envelope REFUSED … federation_invalid_argument lines (same content hashes every 10 min) come from long-running datum-* / echo-* agents and are unrelated to this run.

[emooreatx]

RCA — the trace plane went dark on 2026-09-18 at 22:41Z, and why every ladder stayed green

One sentence: no production agent has ever been attributable at the canonical under edge's rule; for months they were admitted through a hole in which the canonical attributed every unattributable inbound link to itself; CIRISServer#607 (0.5.212) closed that hole on the server side and CIRISEdge#621/#623 (v29.1) closed it on the edge side; both fixes are correct, and nothing was put in their place.

The mechanism

1. Edge attributes an inbound frame only if the sending peer is Rooted ∧ owns_key (SourceKeyId::from_rooted_binding, unchanged since v19). Rooting means the peer's key chain terminates at a pinned accord holder (A1/B1/C1).
2. No production agent can be Rooted. Every agent, node and owner key on the canonical is self-signed (scrub_key_id = key_id, 0 rows of type steward/accord_holder besides A1/B1/C1). persist's root_binding answers NotRootedAtSteward for all of them. That is by design, not a defect.
3. Until 0.5.212 the canonical primed ITSELF into its peers map as Rooted. Link attribution's destination branch resolves an inbound link by its destination — which for an inbound link is the canonical's own — so every link that failed the identity branch resolved to the canonical's own key, which passed both conditions. Every unrooted peer's frames were admitted as if the canonical had sent them; the responder then tried to reply to itself (responder reply send failed … no route to peer: key_id=ciris-canonical-1-…, 15 times on 09-18). Rows landed; rounds were never served ("zero rounds served since 0.5.107" — scenarios/traceflow.sh records this beside the served rung).
4. 09-18 22:41Z: the canonical rolled onto 0.5.212 and logged canonical prime: this node IS that canonical — not priming itself as a peer (CIRISServer#607). The last self-addressed reply is 17:14:58Z. The last row from any agent is 17:02:34Z.
5. 09-22 12:36Z: edge v29.1 (0.5.213) added LinkAttribution::ResolvedToSelf → drop (CIRISEdge#621, commit 862b0a8). Same closure, made explicit.
6. With the hole closed an unrooted peer has no attribution path: condition 1 needs Rooted; the durable-store heal correctly refuses the peer's own rooted self-claim (does NOT root against this node's anchor … NOT laundered, 18× today); the bootstrap door (0.5.216: adopt edge v30.3.0 / persist v47.3.0 — the trace plane relights, and the OWNER accepts the root (CIRISServer#632 step 2) #636) only handles links with no candidate key, and an announced peer always has one. Only the three bootstrap kinds (Key / IdentityOccurrence / TransportDestination) still cross, via the carve-out — which is exactly what the canonical's directory shows: keys admitted, nothing else.

The evidence, all read-only

fact	source
keys admitted per day vs rows landed: 09-18 26 / 36, 09-21 10 / 0, 09-22 12 / 0, 09-23 35 / 0	canonical federation_keys × federation_attestations
self-addressed responder replies: 09-18 15, 09-21..23 0	canonical log
#607 guard present in 0.5.212, absent in 0.5.211; canonical restart 22:41:21Z on 09-18	git + canonical log
edge gate, heal, carve-out, bootstrap-kind set, rooting adapter, persist root_binding: byte-identical v25.0.0 → v29.5.0 (only ResolvedToSelf added)	source diffs
DIAG#632 operands on a production-faithful local run: resolved=(Advisory, owns_key=true), item2_binding_exists=false, door not_applicable	harness, edge patched with unthrottled diagnostics
every row is hybrid-verified at persist admission regardless of carrier (verify_hybrid_via_directory, Strict; attester must be registered; transport bindings signed)	persist admission.rs

Not this: the actor/node split (shipped 0.5.189, rows still landed 09-18); owner-authored consent (0.5.211; the grant is authored, federation-scoped, and never offered because the frame is dropped before the round exists); datum-*/echo-* — those are attributed and then refused by persist (federation_invalid_argument, same content hashes every 10 min since ≤09-15), a separate and older failure.

Why every ladder was green

The harness agent registered through the canonical's unauthenticated test-admit-peer, which scrub-signs it under the test root → the canonical roots it → attribution passes on condition 1. That admission exists for no production agent. The harness also ran an unsplit embedded agent and let harness agents dial the production canonical. Reproduced faithfully today with CIRIS_TEST_ADMIT_NO_BLESS=true (docker-compose.faithful.yml, scenario traceflow_unrooted): the canonical rejects the re-announce NotRootedAtSteward exactly as production does, admits the three bootstrap kinds, and drops everything else with the operands above.

The fix, by construction

Edge (owns the gate) — CIRISEdge issue filed alongside this: attribution answers who sent this frame; rooting answers what they may be served. Attribute on owns_key ∧ verified transport binding — the link's proven transport identity equals the hybrid-verified SignedTransportDestination for a key whose registered pubkey matched — and keep Rooted as the gate for serving (trace:* already says so). Admission stays the trust boundary: persist verifies every row. ResolvedToSelf stays a drop.

Server (this repo):

• the production-faithful admission becomes the default for every ladder; the blessed path is renamed to what it is (a rooted-peer variant) and stops being how we measure production;
• a claimed, split agent joins the harness (the QA runner's shape), and harness agents stop dialing production;
• the DIAG#632 lines become permanent: every dropped frame logs its key, both identities and the failing condition, unthrottled and exempt from log_dedup; the rooting rejection is logged at warn; "RNS announce rooted" no longer says rooted for an Advisory admit;
• the agent-side leg-B gap in the harness (the canonical's infra:serve grant, which production gets from the baked genesis) is filled the production-shaped way (a root-signed delegates_to(root → canonical) on the agent), not by blessing.

Until the edge change lands, no unrooted agent can deliver a non-bootstrap row to any node, on any version from 0.5.212 up. That is the current state of the mesh.

[emooreatx]

Ruling and the resulting model are on CIRISEdge#659 (second comment): Rooted = the two trust sets intersect on a valid root — any valid root, several may be pinned — proven at first contact by making the peer's own trust:accepts and owner-binding rows bootstrap-eligible. Conferral stays a separate property.

[emooreatx]

Full account for edge — what each side had wrong, the certification checklist their harness must pass, and the FSD sections that move — is on CIRISEdge#659 (fourth comment). Server-side items from it stay tracked here.

[emooreatx]

Harness update: the production-shaped ladder now reproduces the field at the right rung — and found the eighth actor/node instance on the way

traceflow_prod (branch harness/632-production-faithful): the agent as the QA runner runs it — persist opened on compose's store and seeds, key registered as agent, embedded edge, then the server folded onto it (compose finds an ACTOR key and mints a NODE key: one engine, one transport); no SEED (never self-blesses), no test-admit-peer; the operator's acts over HTTP (console mint + loopback claim, announce, genesis import, owner-authored consent); the trust root imported from a genesis bundle the canonical assembles the way the accord ceremony does (new test-anchor door GET /v1/federation/test-genesis-bundle, verify_bundle-gated); egress to the production canonical REJECTed with iptables (edge's FFI seeds that dial under testing mode — CIRISEdge#661) and the run refused if any node connected.

Run 6 (before the fix): BROKEN AT converge. Seven prepare assertions green (node up, split, unblessed, claimed, announced, genesis imported+accepted+entrenched, owner consent), traces sealed, the owner's grant a live federation row — and the reconciler at converged to 0 consent peers. Cause: persist's consent_peers_by_principals(k) counts a steward's grant only if the steward is bound to k AND for_key_id == k; compose hands the reconciler the ACTOR key; a claim made AFTER the split binds the NODE key (node_self_code names the held node key — every fresh install whose wizard runs after first boot); and consent_author named for_key_id as the engine key (owner path) or None (explicit-pen path, the HTTP peering route). Production's 0.5.215 agents converge only because their claims predate the split. Fixed by construction so both field shapes work: replication_peers_from_consent folds over every key this node is and unions; consent_author names the wire identity on both paths.

Run 7 (after): SUCCESS at served — consent ✓ converge ✓ served ✓ — and then, on the live stack, exactly the field: the canonical admits the three keys, serves the bootstrap rounds, and drops the agent's non-bootstrap frames:

durable store holds `Rooted` for this peer but its provenance chain does NOT root against this node's anchor — a replicated self-claim … NOT laundered

Canonical store: 0 attestations from the agent, 0 trace_events. arrive is RED for the #659 reason, one rung after everything ours is green. Run 8 requires seal/trace_att so that red is measured inside the window rather than skipped.

The datum/echo refusals resolved to a known cause. attesting_key_id echo-speculative-…-2f7jxoqhxz does not exist in federation_keys, 851× on 09-01 alone, daily since: those agents' rows are signed by an actor key their publish-own set never offered — #629's other face, on agents not yet on 0.5.215. No new issue; it resolves on adoption (CIRISAgent#1184).

Filed alongside: CIRISEdge#661 (production dial under testing mode), CIRISEdge#662 (responder-inbox drops since v29.1). Persist's side of the ruling is CIRISPersist#901.

[emooreatx]

Step 1 is up as PR #633: the production-shaped ladder (traceflow_prod, in the CI matrix), the consent-fold fix (eighth actor/node instance), the canonical's test genesis-bundle door, the dedup exemption for diagnostics, and the egress belt against CIRISEdge#661. Step 2 (acceptance on the owner's pen at claim; announce/move on the wire key with the owner's cohort preserved) follows in its own PR.

[emooreatx]

Runbook — heal the owner key record on the production canonical (one boot with the pen present)

For: the bridge (whoever rolls ciris-server on 108.61.242.236).
From: the server session (CIRISServer#632 thread). Authorized by Eric, 2026-09-24.
Scope: five files placed for one restart, then removed. No code change, no compose change, no DB write by hand.

Why this is a one-off, and why it is done HERE

The canonical's federation_keys row for Eric's portable fedID
eric-moore-v2-portable-f34de31d8c21-6e2b4kpvxk (user, registered 2026-07-02T20:18:27.266198894Z)
has the pre-persist-#659 envelope {"key_id": …} and nothing else. Every verify ≥ v15.2 peer
refuses it at admission ("does not bind identity_type"), so it can never replicate.

Facts measured read-only on the canonical (2026-09-24):

• The canonical itself is owned by that key — delegates_to(eric-moore-v2-portable-… → ciris-canonical-1-d7bdeu223k), signed 2026-07-02T20:18:27.267Z (plus 8 more to Aug-11/12 QA clients). It is the ONLY unbound user row on the canonical.

• The heal already runs on every boot and fails only for lack of the pen. 0.5.215 boot log, 2026-09-23T17:33:53Z:

  WARN ciris_server::compose: boot: owner key record heal failed (non-fatal)
    error=consent refused: node ciris-canonical-1-d7bdeu223k is owned by
    eric-moore-v2-portable-f34de31d8c21-6e2b4kpvxk, but no software seed for that key is under
    /var/lib/ciris/identity/user (alias "ciris-canonical-1-user"). …
  

  Path: compose.rs boot → node_key::heal_owner_key_record → peer::owner_consent_pen (walks owner_of(node), resolves the owner's signer from <home>/identity/user) → auth::ownership::rebind_owner_key_record → persist v44.7 rebind_key_record. It re-signs the stored row with a bound envelope: same key, pubkeys, identity_type, identity_ref, valid_from, roles, evidence — only the envelope, its hash and the self-signature move. Persist refuses anything else (RebindChangesRecord), and the server refuses a pen whose pubkeys ≠ the stored row's before any write.

So the whole repair is: make the pen resolvable for one boot. Nothing has to be carried anywhere; the row is rewritten in place where it lives.

Do NOT try to heal it by claiming/associating a node with the USB, or by POST /v1/federation/peering / test-admit. A fresh registration is a different claim (valid_from = now); the canonical answers rebind_changes_record and first-seen wins. Only the same claim re-signed bound is a rebind.

What the pen resolver needs on disk (inside the container: /var/lib/ciris; on the host: /data/cirisserver)

Container runs as uid/gid 1000:1000 (ciris). Everything below must be owned 1000:1000; dirs 0700, files 0600.

#	container path	content	source
1	identity/user/active_user_alias	the single line eric-moore-v2-portable-f34de31d8c21	type it
2	identity/user/eric-moore-v2-portable-f34de31d8c21.backend	software (8 bytes, as on the USB)	copy from USB
3	identity/user/eric-moore-v2-portable-f34de31d8c21.ed25519.seed	raw 32-byte seed	copy from USB
4	identity/keys/eric-moore-v2-portable-f34de31d8c21.mldsa65.seed.blob	sealed ML-DSA-65 half (60 bytes)	~/ciris.qa-retired-20260813-174202/keys/ on lapbuntu2
5	identity/keys/eric-moore-v2-portable-f34de31d8c21.master.key	the blob's file-tier master key (32 bytes)	same dir as #4

USB source dir (same path for both of us):
/media/emoore/Memorex USB/eric-moore-v2/Memorex USB/
holds eric-moore-v2-portable-f34de31d8c21.{backend,ed25519.seed,mldsa65.seed} + manifest.json.

Why #4/#5 come from the retired QA home and not the USB: the resolver opens the Ed25519 half from the RAW seed (open_software_ed25519_signer → <user>/<alias>.ed25519.seed) but the ML-DSA half ONLY from the sealed store (get_platform_sealed_mldsa65_signer(alias, <home>/identity/keys) — identity.rs:989: a raw <alias>.mldsa65.seed beside it is "unusable"). There is no shipped CLI that seals a raw ML-DSA seed. The retired QA home (the last node this key claimed) still holds the sealed pair; the keyring's file tier is self-contained — <alias>.master.key is the whole secret — and it is the same tier the canonical's own ciris-canonical-1.{ed25519.seed.blob,master.key} use, so the pair opens there. sealed_keys_dir_in looks in <home>/identity/keys FIRST, so placing it there wins over any global store. If the pair does not match the USB identity, the heal refuses ("pen … does not hold the pubkeys registered") and writes nothing — see the refusal table.

Steps

# ── on lapbuntu2, as emoore: stage a bundle to ship (nothing is written to the USB) ──
S="/media/emoore/Memorex USB/eric-moore-v2/Memorex USB"
R=~/ciris.qa-retired-20260813-174202/keys
A=eric-moore-v2-portable-f34de31d8c21
B=$(mktemp -d)/pen && mkdir -p "$B/user" "$B/keys"
printf '%s\n' "$A" > "$B/user/active_user_alias"
cp "$S/$A.backend" "$S/$A.ed25519.seed" "$B/user/"
cp "$R/$A.mldsa65.seed.blob" "$R/$A.master.key" "$B/keys/"
chmod 700 "$B" "$B/user" "$B/keys" && chmod 600 "$B"/*/*
# sanity: sizes 8 / 32 / 60 / 32 bytes
find "$B" -type f -printf '%s\t%p\n'
tar -C "$B" -cf - . | ssh root@108.61.242.236 'mkdir -p /root/pen && tar -C /root/pen -xf -'
rm -rf "$(dirname "$B")"

# ── on the canonical host, as root ──
D=/data/cirisserver/identity            # == /var/lib/ciris/identity in the container
install -d -o 1000 -g 1000 -m 700 "$D/user" "$D/keys"
install -o 1000 -g 1000 -m 600 /root/pen/user/* "$D/user/"
install -o 1000 -g 1000 -m 600 /root/pen/keys/* "$D/keys/"
shred -u /root/pen/*/* && rmdir /root/pen/user /root/pen/keys /root/pen
ls -la "$D/user" "$D/keys"               # five files, 1000:1000, 0600

docker restart ciris-server

Verify (≤ 2 minutes after the restart — the heal runs in compose's boot sequence, before :4243 binds)

docker logs ciris-server --since 5m 2>&1 | grep -E 'registration record was rebound|owner key record heal|is UNBOUND|consent re-sign'

Success is exactly this line:

INFO ciris_server::compose: boot: the owner's registration record was rebound (#606)

Then the row (read-only; there is no sqlite3 in the image, use python):

docker exec ciris-server python3 -c "
import sqlite3
c=sqlite3.connect('file:/var/lib/ciris/data/ciris_engine.db?mode=ro',uri=True)
r=c.execute(\"select registration_envelope, hex(substr(original_content_hash,1,4)), scrub_timestamp, mutated_at from federation_keys where key_id='eric-moore-v2-portable-f34de31d8c21-6e2b4kpvxk'\").fetchone()
print(r)"

Healed ⇔ the envelope now carries identity_type, pubkey_ed25519_base64 and pubkey_ml_dsa_65_base64 (before: {"key_id": …} only) and the hash prefix is no longer 1EB23B00. Peers that refused the row will admit it on their next pull; nothing else to do.

Clean up — same day

The manifest labels this keyset "INSECURE software"; it should not live at rest on the VPS longer than the boot that needs it. After the success line:

shred -u /data/cirisserver/identity/user/eric-moore-v2-portable-f34de31d8c21.* \
         /data/cirisserver/identity/user/active_user_alias \
         /data/cirisserver/identity/keys/eric-moore-v2-portable-f34de31d8c21.*
rmdir /data/cirisserver/identity/user /data/cirisserver/identity/keys 2>/dev/null; true

No second restart is needed; the heal is durable (Bound forever after). The next boot will log the same owner key record heal failed … no software seed WARN as before — expected and harmless (that warn is what we had all along).

What else that boot does with the pen (expected, all benign)

• migrate_consent_to_owner — re-signs machine-authored consent:replication grants as the owner. The canonical has authored zero such rows → no-op; you may see boot: machine-authored consent re-signed by the owner peers=[] or nothing.
• heal_owner_key_record — the thing we want.
• The already-present lines publish-own set gains this node's OWNER / self room CREATED … owner=eric-… do not depend on the pen and appear either way.

If it does not say "rebound"

log text	meaning	fix
no software seed for that key is under /var/lib/ciris/identity/user	#1/#2/#3 missing, wrong name, or not readable by uid 1000	check names/owner/mode
re-open sealed ML-DSA-65 half for the user signer: … KeyNotFound	#4/#5 not in identity/keys (or wrong name)	check keys/
user seed at alias … derives "<other id>" — a different person	#3 is not this identity's Ed25519 seed	recopy from the USB
owner key record heal failed … the pen for … does not hold the pubkeys registered for it	#4/#5 open, but the ML-DSA pubkey ≠ the row's	the retired pair is not this identity — stop, ping me; nothing was written
the owner's registration record is UNBOUND and could not be rebound refusal=<token>	persist's rebind door refused (rebind_changes_record, unverifiable_signature, …)	nothing was written; send me the token
the owner's registration record already binds / no heal line at all	it reported Bound (already healed)	verify the row as above

Every failure mode leaves the row untouched; there is nothing to roll back. Do not retry by editing the DB.

Not in scope (for the record)

• 529 agent rows on the canonical also have unbound ({}) envelopes — 2026-07-14 → 08-14, none since Sep 1: dead QA agents, not owner records, nobody publishes them. Separate cleanup, not this runbook.
• The trust:accepts/owner-acceptance work (CIRISServer#632 step 2) is a code change on 0.5.216, not part of this.

[emooreatx]

Runbook run 2026-09-24 01:52Z — pen resolved, heal silent, row unchanged → root cause found, fix in #634

The bridge ran the runbook above exactly (five files, one docker restart on 0.5.215, files shredded at 01:55Z). Result: the pen resolved (Using software-only secure storage … alias=eric-moore-v2-portable-…, MlDsa65SoftwareSigner: key imported from bytes, three responsible-user signer resolved lines) and then no heal line at all — not rebound, not failed, not UNBOUND. Row unchanged.

Root cause: auth::ownership::rebind_owner_key_record located the row by owner_signer.derived_key_id(). Production's owner pen is built by hardware_user_local_signer, which hands from_hardware_parts the DERIVED id, so on that pen key_id() is the registered id and derived_key_id() re-derives it into <alias>-<fp>-<fp> (eric-moore-v2-portable-f34de31d8c21-6e2b4kpvxk-6e2b4kpvxk) — a key registered nowhere. identity.rs documents the convention (CIRISServer#597 §4: "every existing caller reads key_id()"); this door, added in 0.5.213, was the one that did not. Lookup → None → OwnerKeyRecordState::Absent → the Ok(_) => {} arm at boot, claim and delivery swallowed it. The gate stayed green because its fixture pen is named by ALIAS — the shape production never builds.

Fix: #634 (0.5.216) — the caller names the row (owner_of's steward / the binding's responsible_user_key_id), the pen must be that key and hold the row's pubkeys, every outcome is logged by name at all three sites; the gate now builds a production-shaped pen (A/B on the old lookup: left: Absent, right: Rebound) and a source gate pins the key_id() convention.

What's needed: merge + tag 0.5.216, the bridge rolls it, then the SAME runbook once more (same five files, one restart, shred). Expected: boot: the owner's registration record was rebound (#606) — or, now, a named reason.

The runbook's "no heal line → already Bound" row was wrong and is superseded by this: on 0.5.216 there is no silent outcome.

[emooreatx]

edge v30.2.0 is tagged (834e12d). Ladder triple: edge v30.2.0 · persist v47.1.0 · verify v16.1.0 — no pin move, no ABI move, wheel floor unchanged (ciris-persist>=47,<48).

What it carries (full note: docs/RELEASE_NOTES.md § v30.2.0):

• GET /v1/my-data/capacity is one path with two owners and two incompatible payloads #659 — attribution is not trust. SourceKeyId::from_attributed_binding(key_id, owns_key) replaces from_rooted_binding (provenance is not an input; a direct caller updates the call, the FFI is already updated). A self-signed, owned agent is now Attributed on its first announce and its rows are admitted. Rooted is a pair property, computed every sweep (rooted_with: owner-binding → owner's acceptance → a valid root in common via persist owner_of/trusted_roots_of/trust_root_valid), never stored. The serve floor: nothing this node holds about others is served below Rooted (WithholdReason::RecipientNotRooted, token recipient_not_rooted), with one exemption found by the ladder — rows the node's own self-publish identities authored (its owner-binding, its owner's acceptance) cross to an Attributed peer, because replication is pull-based and those are the rows that make a pair Rooted; without it two fresh peers withheld from each other forever (PR Two facts about the node have no node route, so two cards labelled "this node" read the brain and fail open #668). trace:* keeps its conferral gate; trust weighting and audience untouched.
• The first-contact ladder as an edge e2e — tests/first_contact_ladder_659.rs, two nodes on real Reticulum links, peer shaped like every production agent (self-signed, owned, subject-bound records, Adopt CIRISPersist v31.1.0 — two hash re-pins, entrenched() widens, and three .pyi signatures are wrong in the SHIPPED 31.0.0 wheel #406 route). Shared root: both directions land. Different roots: A's own facts cross, what A holds about another is withheld across N rounds and A's RecipientNotRooted ledger moved, and it arrives the moment B's owner also accepts A's root. In the CI reticulum lane.
• The memory reads carry a storage partition where the client needs a cohort, and serve a sampled date as a fact #661 — no baked production canonical dial while a test trust root is active (init_edge_runtime(..., baked_canonical_dials: Optional[bool] = None)).
• There is no cohort-scoped roster read, so the first card in every Rules tab fetches nothing #662 — a full responder inbox names the driver's phase (driver_phase gauge), drops are counted by role (replication_inbound_backpressure_drops_by_role), the driver never ends on a step error.
• Observability (A client cannot ask a remote node whether it already has an owner, and owned-nodes rows are two fields #667) — every dropped frame logs its attribution operands at debug; the bootstrap door logs both identities (federation key + transport destination); cold-start rooting rejections at a throttled warn per key.

What to expect on the canonical after adopting: agents become Attributed and their rows land (the "no row since 2026-09-18" symptom ends). They are served once their owner and the canonical's owner accept a common valid root — the "traces flow" milestone is this tag; "the mesh serves" is the owners' acceptances + the canonical side (server step 2). The end-to-end cut is one PR behind this: persist v47.3.0 (CIRISPersist#901 — a valid root is as attested as its holders) is tagged, and edge v30.3.0 (CIRISEdge#670) adopts it: ladder triple edge v30.3.0 · persist v47.3.0 · verify v16.1.0, no ABI / grammar-hash / wheel-floor move. Its ladder e2e is green locally over evidence-carrying holder records. If you have not started on v30.2.0, wait for the v30.3.0 tag post (same thread); a canonical on v30.2.0 with persist v47.1.0 judges roots WITHOUT the holder-hardware leg.

[emooreatx]

edge v30.3.0 is tagged (f70e878) — this is the end-to-end cut for CIRISEdge#659. Ladder triple: edge v30.3.0 · persist v47.3.0 · verify v16.1.0. All four persist ABI constants and CONSENT_GRAMMAR_HASH are unchanged from v47.1.0; wheel floor ciris-persist>=47,<48 unchanged. Full note: docs/RELEASE_NOTES.md § v30.3.0.

What lands with persist v47.3.0 (CIRISPersist#901 / #903): trust_root_valid now judges every charter holder's key record where the root is judged — Layer A (structural hardware evidence, no clock) and Layer B (YubiKey PIV chain walk where the node pins a root; None for TPM / Secure Enclave / StrongBox, never a refusal), holders_hardware_attested folded into valid. Edge's rooted_with reads .valid and re-derives nothing, so the ruling lands in the serve floor by construction. A Key-kind root whose holder record carries no hardware evidence is not valid ⇒ two peers accepting only it are Attributed, never Rooted ⇒ served nothing but each other's self-authored facts. Witness: bridge::a_common_root_whose_holder_is_unattested_is_not_rooted_901 (the evidence column is the only difference). The first-contact ladder (tests/first_contact_ladder_659.rs) is green against v47.3.0 over evidence-carrying holder records.

For the canonical (server), the whole chain now reads: a self-signed, owned agent announces → Attributed (owns_key ∧ hybrid binding; no conferral asked) → its rows are admitted → the agent's owner and the canonical's owner each accept one common root whose holders carry attested hardware (the canonical accord's three YubiKey holders pass Layer A + Layer B against the production pin) → Rooted → served. Persist's note asks the same of you: re-run the replication ladder against the canonical's evidence-carrying records before pinning.

Also in this pin, from persist v47.2.0 (no edge code change): BlobError::Withdrawn (blob_withdrawn) from the read and serve doors — edge's MissReason::Withdrawn / ChunkSourceRefusal::Withdrawn are now reachable from persist; Engine::evict_blob; Python RuntimeError("blob_withdrawn: <sha>").

Test-side only: edge's dev-dependency on ciris-persist enables persist's test-anchor feature so fixtures reach fresh_accord_holder_evidence — unified into cargo test / --all-targets builds only; release artifacts unchanged.

[emooreatx]

edge v30.3.1 is tagged (bad6b37, PR CIRISEdge#673) — the fix for CIRISEdge#671. PATCH on v30.3.0; ladder triple unchanged: edge v30.3.1 · persist v47.3.0 · verify v16.1.0 — no pin, ABI, grammar-hash or wheel-floor move. Full note: docs/RELEASE_NOTES.md § v30.3.1.

What changes for the canonical. A peer the node has not consented to is no longer refused the whole Attestation plane. It is minted a ResolvedRecipient with reach FirstContact, which the audience gate confines to exactly this node's allegiance facts: authored by a self-publish identity (node key or owner), delegates_to, and one of persist's three readings — the CC 3.2 owner-binding (is_owner_binding_envelope), an acceptance (the far end is in persist's own trusted_roots_of(attester) fold), or a self-charter — at federation audience. Every other row toward that peer still books recipient_not_in_send_set (same token, same counter, minus those rows). Never minted for the node itself or an empty peer id. Rooted is still not consent: a Rooted pair with no consent:replication grant is served nothing about others (CC 3.3.7).

So the measured chain now closes: the canonical (consents to nobody) hands every Attributed agent its owner-binding + acceptance (+ charter) at first contact → the agent reads the canonical as Rooted (peer_roots moves off 0) → the agent, which consents to the canonical and holds it Rooted, serves it trace:* (given the canonical's conferred infra:serve, unchanged). The canonical's recipient_not_in_send_set keeps counting the rows it still withholds about others — that is the contract, not a residual.

The contract in full: FSD/FIRST_CONTACT.md — the pair-level state space (link × consent axes), the closed sets that cross at each rung, the state machine with every regression, production's topology walked step by step (§4), gate order, nine invariants each with a witness, the certification rungs still owed, and the six ciris.ai First-Contact Protocols mapped to mechanism.

Witnesses: bridge::a_peer_outside_the_send_set_is_served_exactly_this_nodes_allegiance_facts_671 (advertise + fetch twin; a self-authored consent grant and a third party's row withheld; Rooted without a grant does not widen the set); the ladder's shared-root rung now builds production's one-directional consent on real Reticulum links (A's allegiance lands on B with no consent from A; B reads A as Rooted and serves A a row it holds about another; A serves B nothing about others and its ledger moved) — 2/2. Observability: first_contact_recipients counter on the bridge; a debug line names the peer at the mint.

[emooreatx]

edge v31.0.0 is tagged (d53056a, PR CIRISEdge#674) — MAJOR: adopts persist v48.0.0 (CIRISPersist#860 / #905), which adds the 17th replicated kind. Ladder triple: edge v31.0.0 · persist v48.0.0 · verify v16.1.0. Full note: docs/RELEASE_NOTES.md § v31.0.0.

Re-pin all three (no ABI move; DIRECTORY_ABI_VERSION stays 5):

Pin	new value
persist REPLICATION_POLICY_HASH	9d62d3a86f7a0ab955969256a10c8160da73a390953ba3c87167a2da96828a19
persist CONSENT_GRAMMAR_HASH (kind list is in the hash; grammar unchanged)	07a677bbcdff236e2018f0786e8d9b0d0ef6b5b7cc2b871d41459e26ff8864a9
edge SERVE_ADVERTISE_POLICY_HASH (new plane row)	d6e4f0dfccbf02d274b7c76a70f8b3af8548d177fffaeed699efe3bd423b1df0
wheel floor	ciris-persist>=48,<49

What it carries for the mesh:

• The roster converges both ways — CommunityMembershipWidening, the append-plane mirror of the revocation: rooms are keyless (V151: every pair room can be revoked from), a widening replicates as its own kind and folds at read (active_community_members; a removal wins a tie), so CommunityRosterFork stops. Edge wires it exactly like the revocation (structural, Global, bodies held, V2 framing, three-part resume id). Producer change: add_community_member's spec is the authority's scrub over the widening row (community_roster::community_membership_widening does it); the v47 grown-record scrub is refused with the signature reason.
• #905 — sealed traces become offerable on an owned agent: the promotion sweep and the crossing take a grant by principals (the machine's own, or its bound steward's naming it in for_key_id). Persist-side; your production ladder should now read offerable>0 with no server change beyond the pin.
• OAuth redirect check accepts //evil.host, any https host, and localhost.evil.host — the login code goes to an attacker's host #672 — tests/anchor_block_generate.rs is gone; mint with persist's cargo run --example mint_test_anchor --features test-anchor.

Two deployment preconditions the first-contact chain silently assumed, now stated as invariants (FSD/FIRST_CONTACT.md I10/I11) — please check both on the canonical before the ladder run:

1. The canonical's self-publish set must name its owner key ([node_key, owner_key]). First contact (A run-without-AI node has no inbound data-subject-request surface, and the duty does not depend on owning an AI #671) carries only rows authored by a self-publish identity, and an owned node is judged through its owner's acceptance — a set of [node] alone hands the agent the node's own acceptance and no root for the trust subject, and the pair never Roots.
2. A root is judged from the judge's own records: the agent must hold the accord's charter and the holders' evidence-carrying key records (genesis-seeded on every node — verify the seeded accord-holder records carry attestation_evidence, or v47.3.0's holder-hardware leg reads the accord invalid at the agent).

With v31.0.0 on both ends the chain edge can witness is complete: announce → Attributed (v30.2.0) → the agent's allegiance lands (consented) → the canonical reads it Rooted with attested holders (v30.3.0) → the canonical's allegiance reaches the agent without consent (v30.3.1) → the agent reads the canonical Rooted → serves trace:* under the conferral gate → the sealed traces are offerable (v31.0.0). What remains is yours: the owner's acceptance written (#636), the two preconditions above, and the production-shaped run — that run is the certification; edge's ladder is its model with software roots.

[emooreatx]

v0.5.216 RELEASED — tag on f0386c44 (PR #640), PyPI 9/9, 33 release assets. Production-shaped ladder green in CI. Adoption: CIRISAI/CIRISAgent#1198 (agent), CIRISAI/CIRISClient#78 (client). Production relights when the canonical rolls to 0.5.216 (the owner-record heal re-runs on that boot with the pen) and agents update.