Skip to content

feat: complete RFC-0022 host cutover - #327

Merged
pgherveou merged 8 commits into
mainfrom
codex/rfc0022-builtins
Aug 3, 2026
Merged

feat: complete RFC-0022 host cutover#327
pgherveou merged 8 commits into
mainfrom
codex/rfc0022-builtins

Conversation

@replghost

Copy link
Copy Markdown
Contributor

Summary

  • land the canonical RFC-0022 hard product-subtree/soft selector runtime and product-subtree SSO exchange
  • derive the public identity from //product//uid.dot/{index_bytes(0)} and lite-person ring-VRF entropy from ring-vrf//peopl.dot//{index_bytes(1)} across activation, registration, allowance, responder, and CLI paths
  • cut SSO v2 over to 32-byte X25519 keys with HKDF-SHA256 and ChaCha20-Poly1305; remove the active P-256/AES fallback while retaining registration-only P-256 compatibility in attestation

Verification

  • cargo test -p truapi-server (426 passed)
  • cargo test -p truapi-host-cli (102 passed)
  • cargo check -p truapi-server --target wasm32-unknown-unknown
  • cargo fmt --all -- --check

The first three commits are the previously unmerged canonical runtime cutover already consumed by UserAgentKit's vendored core; the final commit adds the remaining built-in identity, personhood, and SSO migration.

@replghost
replghost requested a review from a team August 3, 2026 07:27
@socket-security

socket-security Bot commented Aug 3, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedcargo/​chacha20poly1305@​0.10.110010093100100

View full report

@pgherveou

Copy link
Copy Markdown
Collaborator

Thanks will test it out

pg added 2 commits August 3, 2026 14:56
Fold the single-function truapi-dynamic-vrf crate into truapi-server as a
private dynamic_vrf module. Relax the workspace unsafe_code lint from forbid
to deny so the module's audited unsafe helper can carry a local allow instead
of a per-crate lint override.
@pgherveou
pgherveou enabled auto-merge August 3, 2026 13:15
pg added 2 commits August 3, 2026 15:23
…form surface

AutoSigningKey storage key and the SignVrf confirmation review are now part
of the emitted host callbacks.
@pgherveou
pgherveou added this pull request to the merge queue Aug 3, 2026
Merged via the queue into main with commit 5aa47fd Aug 3, 2026
13 checks passed
@pgherveou
pgherveou deleted the codex/rfc0022-builtins branch August 3, 2026 14:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants