Dev keri compliant devices

.auths/roots

@@ -0,0 +1 @@
+did:keri:ECHoDk6bcHtZm3rngCXNpANJNh-U-3Bd5bSO1YVx6Fac

.cargo/audit.toml

@@ -28,6 +28,14 @@ ignore = [
     # Waiting for AWS SDK to ship with rustls 0.23+.
     "RUSTSEC-2026-0098",
     "RUSTSEC-2026-0099",
+
+    # rustls-webpki 0.101.7 reachable panic parsing a CRL with an empty
+    # onlySomeReasons BIT STRING — same aws-smithy-http-client -> rustls 0.21 ->
+    # rustls-webpki 0.101.7 legacy AWS SDK path. Not exploitable: auths doesn't
+    # use CRLs and the AWS SDK's TLS path doesn't parse them. The 0.103.x copy is
+    # already patched to 0.103.13; this 0.101.7 copy is pinned until the AWS SDK
+    # ships rustls 0.23+.
+    "RUSTSEC-2026-0104",
 ]
 
 [yanked]

.github/workflows/verify-commits.yml

@@ -18,6 +18,13 @@ jobs:
 
       - uses: auths-dev/verify@v1
         with:
+          # Stateless KEL-native verification: the committed identity bundle
+          # carries the identity + authorization chain so the runner can verify
+          # commit signatures without ~/.auths. Regenerate when keys rotate or
+          # the bundle's TTL lapses:
+          #   auths id export-bundle --alias main \
+          #     --output .auths/ci-bundle.json --max-age-secs 31536000
+          token: .auths/ci-bundle.json
           fail-on-unsigned: true
           post-pr-comment: 'true'
           github-token: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -137,6 +137,12 @@ my-artifact.txt.auths.json
 tests/e2e/.auths-ci/
 .capsec-cache
 
+# === Auths trust anchors ===
+# .auths/roots (pinned trusted roots) and .auths/ci-bundle.json are committed.
+# .auths/allowed_signers is an auths-managed local file from the legacy
+# ssh-keygen verification model — unused by KEL-native commit verification.
+.auths/allowed_signers
+
 # jnkn
 .jnkn/
 jnkn.db

.pre-commit-config.yaml

@@ -3,7 +3,10 @@ repos:
     rev: v5.0.0
     hooks:
       - id: trailing-whitespace
+        # Byte-exact keripy oracle fixtures must not be reformatted.
+        exclude: '^crates/auths-keri/tests/fixtures/keripy/'
       - id: end-of-file-fixer
+        exclude: '^crates/auths-keri/tests/fixtures/keripy/'
       - id: check-yaml
         args: [--unsafe]
       - id: check-toml

Cargo.toml

@@ -50,7 +50,6 @@ schemars = "0.8"
 # version and the `rand::thread_rng` / `rand::random` clippy bans cannot be
 # bypassed by version skew.
 rand = "0.8"
-
 # -------------------------------------------------------------------------
 # fn-128.T9: EXACT-PINNED crypto crates.
 #