meta-core claims model: pin meta-core 2.0.1, meta-read 1.4.1, meta-watch 1.1.0, meta-search 1.3.2, meta-share 2.7.0, gateway 1.1.1, meta-sort 1.1.1, plugins 1.1.0; signing keys + db-cache backup exclude

Apps/MetaPluginFullHash/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metapluginfullhash-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-fullhash:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-fullhash:1.1.0
     cpu_shares: 30
     container_name: metapluginfullhash-plugin
     # 2 GB, swap disabled (memswap_limit == mem_limit) → OOM instead of
@@ -50,10 +50,16 @@ services:
       # Nothing to configure: this plugin takes its work from the /process
       # payload and writes back through the caller. No key, no WebDAV.
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginfullhash-plugin.key"
     volumes:
       # Plugin cache. Persisted so a recreate does not redo work that is
       # expensive to redo; safe to delete, it rebuilds.
       - ${DATA_ROOT:-/DATA}/AppData/metapluginfullhash/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginfullhash/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -139,3 +145,6 @@ x-compose-app:
     - path: /DATA/AppData/metapluginfullhash/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metapluginfullhash/keys
+      user: $PUID
+      group: $PGID