ContextLattice v3.14.0 - Context That Can Travel Without Losing Its Proof

v3.14 turns a working context into a signed, bounded, expiring artifact, then
encrypts it for explicit recipients without turning ContextLattice into another
sync service.

What changed

• Added context_passport.v1. A Passport binds project scope, objective state,
  proof-carrying claims, evidence references, lineage, capabilities, redaction
  metadata, replay inputs, validity, digest, and Ed25519 signature.
• Added deterministic Passport verification, revision diff, non-executing replay
  planning, explicit import, and append-only lineage reconciliation.
• Added complete-batch transaction metadata. Conflict-free batches become visible
  together; an interrupted partial batch is ignored on reload.
• Added context_mesh_envelope.v1 using the stable age v1 format with native
  X25519 recipients and ChaCha20-Poly1305 payload protection.
• Added signed, expiring, project-scoped recipient grants with required receive
  capabilities and signed local revocation tombstones.
• Bound the encrypted inner payload and signed outer envelope to the same sender,
  envelope ID, project, expiry, grants, recipients, and Passport digest.
• Added dry-run-first Mesh import. Identical imports are idempotent; divergent
  revisions survive as conflict branches instead of overwriting local truth.
• Added eleven primary CLI commands, native HTTP and telemetry routes, eight
  bounded contracts, and Go/Rust generated contract identities.
• Mapped Temporal Claims, context policy, Skill Foundry, Passport, identity, and
  Mesh stores into the existing durable gateway data volume.
• Expanded public-core parity from 19 to 21 capabilities.

Paid/private extension

The paid/operator artifact adds context_mesh_orchestration.v1 and the primary
contextlattice_mesh_orchestrate CLI. It can produce deterministically ordered
encrypted envelopes for up to 32 recipient sets or verify an entire incoming
batch before one conflict-free Passport transaction. The surface is disabled by
default, requires entitlement enforcement in production, defaults reconciliation
to dry-run, and still performs zero transport or delivery calls.

See docs/entitled-context-mesh-orchestration.md
for commands, gates, limits, atomicity, and degraded-receipt semantics.

The boundary

• ContextLattice does not send, upload, relay, poll, discover, or synchronize a
  Mesh envelope. The caller owns transport.
• Imported text remains evidence. Replay returns a validated plan and never
  executes imported content or elevates it into policy.
• A signature proves integrity and key continuity, not that an unknown signing
  key belongs to a trusted person. Pin important keys out of band.
• Private Ed25519 and age identities remain in an owner-only local file and are
  never returned by API, CLI, telemetry, or contract payloads.
• No MCP tool was added, so portable context does not inflate every agent's tool
  list.
• No model call, external network call, Python application service, or gateway
  subprocess was added.

Measured behavior

Five-run component benchmarks on the release development host:

• Passport sign plus verify: median 88792 ns/op, 10985 B/op, 157 allocs/op.
• Mesh age encrypt plus decrypt: median 967342 ns/op, 279818 B/op,
  981 allocs/op.
• Model calls: 0.
• External network and delivery calls: 0.

These are bounded component benchmarks, not universal latency promises. The
holdouts and reproduction commands live in
docs/evals/v3.14-context-passport-mesh.json.

Try it

contextlattice_passport_export \
  "prepare a portable project handoff" \
  --project contextlattice \
  --output passport.json \
  --pretty

contextlattice_passport_verify --file passport.json --pretty
contextlattice_mesh_identity --pretty

Create a project-scoped recipient grant, encrypt the Passport, move the JSON
through a channel you control, then dry-run before apply:

contextlattice_mesh_grant create \
  --recipient-id workstation-b \
  --recipient age1... \
  --projects contextlattice \
  --pretty

contextlattice_mesh_export \
  --passport-id <passport-id> \
  --grant-ids <grant-id> \
  --output envelope.json \
  --pretty

contextlattice_mesh_import --file envelope.json --pretty
contextlattice_mesh_import --file envelope.json --apply --pretty

The complete trust, revocation, conflict, storage, and HTTP contracts are in
docs/context-passport-mesh.md.