build(deps): pin the api to main, which carries the time-sync contract

api main also declares the SCEP and TSA RPCs, which this node does not serve
yet. internal/grpc/unserved.go answers them Unimplemented. It is byte for byte
the file the protocol-switches change adds, so rebasing onto that change
merges it cleanly.

Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>

Author: Bugs5382

go.mod

@@ -3,7 +3,7 @@ module github.com/CryptOS-PKI/cryptos
 go 1.25.0
 
 require (
-	github.com/CryptOS-PKI/api v0.0.0-20260929205700-cc4308e5886b
+	github.com/CryptOS-PKI/api v0.0.0-20260930142054-81494db99991
 	github.com/google/go-tpm v0.9.8
 	github.com/google/go-tpm-tools v0.4.8
 	github.com/spf13/cobra v1.10.2

go.sum

@@ -1,5 +1,5 @@
-github.com/CryptOS-PKI/api v0.0.0-20260929205700-cc4308e5886b h1:8IJpCxaCfWAQ0QddBz/CtolWOBDqA/5U7E9k6QbLDzU=
-github.com/CryptOS-PKI/api v0.0.0-20260929205700-cc4308e5886b/go.mod h1:tmeaYhNoUblqPYYNtTbGBGIUsZ7xLATgLdKq4S33rmE=
+github.com/CryptOS-PKI/api v0.0.0-20260930142054-81494db99991 h1:gRd3iY+smHPGl98k/T9Ezc9wG9/8hh+kJ8eZoGOOkW8=
+github.com/CryptOS-PKI/api v0.0.0-20260930142054-81494db99991/go.mod h1:tmeaYhNoUblqPYYNtTbGBGIUsZ7xLATgLdKq4S33rmE=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=

internal/grpc/unserved.go

@@ -0,0 +1,62 @@
+package grpc
+
+/*
+Apache License 2.0
+
+Copyright 2026 Shane
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import (
+	"context"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	cryptosv1 "github.com/CryptOS-PKI/api/go/cryptos/v1"
+)
+
+// The SCEP and RFC 3161 TSA RPCs are in the api contract, but this build does
+// not serve either protocol yet. Each answers Unimplemented until its server
+// lands and replaces the stub here.
+
+func (s *Server) MintScepChallenge(context.Context, *cryptosv1.MintScepChallengeRequest) (*cryptosv1.MintScepChallengeResponse, error) {
+	return nil, errSCEPUnserved
+}
+
+func (s *Server) ListScepChallenges(context.Context, *cryptosv1.ListScepChallengesRequest) (*cryptosv1.ListScepChallengesResponse, error) {
+	return nil, errSCEPUnserved
+}
+
+func (s *Server) RevokeScepChallenge(context.Context, *cryptosv1.RevokeScepChallengeRequest) (*cryptosv1.RevokeScepChallengeResponse, error) {
+	return nil, errSCEPUnserved
+}
+
+func (s *Server) ListScepEnrollments(context.Context, *cryptosv1.ListScepEnrollmentsRequest) (*cryptosv1.ListScepEnrollmentsResponse, error) {
+	return nil, errSCEPUnserved
+}
+
+func (s *Server) ApproveScepEnrollment(context.Context, *cryptosv1.ApproveScepEnrollmentRequest) (*cryptosv1.ApproveScepEnrollmentResponse, error) {
+	return nil, errSCEPUnserved
+}
+
+func (s *Server) RejectScepEnrollment(context.Context, *cryptosv1.RejectScepEnrollmentRequest) (*cryptosv1.RejectScepEnrollmentResponse, error) {
+	return nil, errSCEPUnserved
+}
+
+func (s *Server) ListTsaCertificates(context.Context, *cryptosv1.ListTsaCertificatesRequest) (*cryptosv1.ListTsaCertificatesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "the RFC 3161 time-stamp authority is not served by this build")
+}
+
+var errSCEPUnserved = status.Error(codes.Unimplemented, "SCEP is not served by this build")

internal/grpc/unserved_test.go

@@ -0,0 +1,80 @@
+package grpc
+
+/*
+Apache License 2.0
+
+Copyright 2026 Shane
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import (
+	"context"
+	"testing"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	cryptosv1 "github.com/CryptOS-PKI/api/go/cryptos/v1"
+)
+
+// TestUnservedRPCs_ReturnUnimplemented pins the answer for the NodeService
+// RPCs in the api contract that this build does not serve yet: Unimplemented,
+// never a panic or a silent empty success.
+func TestUnservedRPCs_ReturnUnimplemented(t *testing.T) {
+	srv, err := New(ServerConfig{
+		TLSConfig: newFixtures(t).serverConf,
+		Auditor:   &mockAuditor{},
+	})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	ctx := context.Background()
+	calls := map[string]func() error{
+		"MintScepChallenge": func() error {
+			_, err := srv.MintScepChallenge(ctx, &cryptosv1.MintScepChallengeRequest{})
+			return err
+		},
+		"ListScepChallenges": func() error {
+			_, err := srv.ListScepChallenges(ctx, &cryptosv1.ListScepChallengesRequest{})
+			return err
+		},
+		"RevokeScepChallenge": func() error {
+			_, err := srv.RevokeScepChallenge(ctx, &cryptosv1.RevokeScepChallengeRequest{})
+			return err
+		},
+		"ListScepEnrollments": func() error {
+			_, err := srv.ListScepEnrollments(ctx, &cryptosv1.ListScepEnrollmentsRequest{})
+			return err
+		},
+		"ApproveScepEnrollment": func() error {
+			_, err := srv.ApproveScepEnrollment(ctx, &cryptosv1.ApproveScepEnrollmentRequest{})
+			return err
+		},
+		"RejectScepEnrollment": func() error {
+			_, err := srv.RejectScepEnrollment(ctx, &cryptosv1.RejectScepEnrollmentRequest{})
+			return err
+		},
+		"ListTsaCertificates": func() error {
+			_, err := srv.ListTsaCertificates(ctx, &cryptosv1.ListTsaCertificatesRequest{})
+			return err
+		},
+	}
+	for name, call := range calls {
+		t.Run(name, func(t *testing.T) {
+			if got := status.Code(call()); got != codes.Unimplemented {
+				t.Errorf("%s code = %v, want Unimplemented", name, got)
+			}
+		})
+	}
+}