Pre-0.7.67 Python nodes may need manual first upgrade to restore key-ready auto-update

[RobLe3]

Live IICP adoption evidence on 2026-06-27 still shows one heartbeating Python node on SDK 0.7.62 without a CX key. Strict clients now refuse plaintext by default, so the node remains reachable but privacy-upgrade-needed.\n\nExpected outcome:\n- Document/operator path for a one-time manual upgrade from pre-0.7.67 Python nodes to the current SDK.\n- After the manual restart, verify the hourly auto-update loop reports current latest_seen and keeps the node key-ready.\n- Keep plaintext fallback disabled by default; do not weaken IICP-CX requirements to hide the adoption gap.\n\nEvidence to verify before closing:\n- /api/v1/stats reports no downlevel Python node.\n- /api/v1/registry/nodes reports the node as key_ready=true and sdk_status=current.\n- /api/v1/discover advertises cx_public_key/public_key for the node.\n\nThis is primarily an adoption/recovery issue for nodes too old to self-upgrade reliably, not a request to loosen the directory or client privacy rules.

[RobLe3]

Fresh live evidence after directory v1.10.54 / website v1.9.205 deploy (2026-06-27 14:38–14:39 UTC):

• Mesh has 5 active nodes.
• 4 nodes report SDK 0.7.73 and key_ready=true.
• One Python node prefix 6e6b07dd still reports SDK 0.7.62, sdk_status=downlevel, key_ready=false, and state upgrade_privacy_needed.
• Strict client query behavior is correct: iicp-node query skips 6e6b07dd with “refusing plaintext by default” and succeeds via keyed nodes.

Operator recovery guidance for the affected pre-0.7.67 Python node:

python -m pip install --upgrade iicp-client
iicp-node --version
# then restart the managed node process/container/service once

For Dockerized nodes, rebuild/recreate from the current image/package rather than relying on the pre-0.7.67 in-process updater. After restart, verify on the live directory that the node reports sdk_status=current, key_ready=true, and discover output includes cx_public_key/public_key.

Do not close this until live /api/v1/stats no longer reports Python 0.7.62 and registry/discover both show the node as key-ready.

[RobLe3]

FORGE re-check, 2026-06-27:

Live evidence still matches the issue and this is not safely closable yet:

• /api/v1/stats: 5 heartbeating nodes, 4 key-ready, 1 downlevel.
• /api/v1/registry/nodes: node prefix 6e6b07dd is heartbeating and public-routable, but key_ready=false, sdk_status=downlevel, privacy_routing_status=transitional, state upgrade_privacy_needed.
• /api/v1/discover?intent=urn:iicp:intent:llm:chat:v1: node 6e6b07dd-c07d-4f54-a12a-2902546bf720 reports sdk_language=python, sdk_version=0.7.62, key_ready=false, cx_public_key=null, public_key=null.

The current Python README already contains the required operator path under “Keeping provider nodes current”:

python -m pip install --upgrade iicp-client
iicp-node --version
# restart the managed node/container/service once

For Dockerized pre-0.7.67 providers, rebuild/recreate the container once; then the hardened 0.7.73 updater path can take over. Strict plaintext refusal should stay as-is.

Disposition: leaving this issue open / externally blocked until the affected operator performs the one-time manual upgrade and live registry+discover show sdk_status=current, key_ready=true, and cx_public_key/public_key present.