Vac R&D Roadmaps and Reports

Search

SearchSearch

2025-11-10 Vac weekly

Nov 10, 2025, 11 min read

Vac 2025/11/10

highlights

  • QA: RLN contract fuzz and adversarial suites expanded via waku-rlnv2-contract#40 and #42, keeping the property-based pipeline current with protocol changes.
  • QA: Status-go functional tests gained new settings wrappers plus reduced noise as status-go#6984 iterates toward green.
  • QA: Desktop QA broadened e2e coverage around toplevel windows, Squish 9.1 setup, and Windows send flows while verifying release PRs such as status-desktop#19227.
  • QA: Mobile QA advanced BrowserStack/Jenkins wiring (status-desktop#19163) and continued the Appium 1x1 chat test port.
  • DST: Gas-price overflow during RLN registrations was isolated on vac:dst:waku:2025q4-waku-scaling:TWN-supports-RLN-tree, explaining the stalled Merkle tree fills.
  • DST: Browser bootstrapping work overcame multi-arch docker manifest gaps and now runs in the dedicated zerotesting-pwhite namespace.
  • DST: Codex-in-Status integration scenarios were tuned via retention and archival limits ahead of handoff.
  • DST: Regression sweeps on nwaku v0.37 exposed packet loss/logging issues, prompting new image proposals and analysis script fixes.
  • Nim: Nimble 1.0.0 now supports Nim binary parametrization (nimble#1514) and instrumentation call trees (#1511).
  • Nim: Packaging fixes such as copying VCS metadata before install (nimble#1513) and addressing nimResolve assertion defects (#1512) cleared several long-standing issues.
  • Nim: Confutils now flattens nested options and improves subcommand help thanks to status-im/nim-confutils#118 and #119.
  • P2P: QUIC stabilization merged docker-compose harnesses plus negotiated protocol, wildcard resolver, EOF handling, and timeout fixes across nim-libp2p/nim-quic.
  • P2P: C-bindings now support threaded workers and richer request handling via nim-libp2p#1820.
  • P2P: Kademlia provider work delivered getProviders, provider-manager limits, and integration test prep spanning nim-libp2p#1852, #1789, #1843, and #1848.
  • P2P: Maintenance tightened test layouts, coverage bundles, CI naming, and AsyncSemaphore support in nim-chronos#586.
  • ACZ: Zerokit removed the legacy FFI implementation (zerokit#337) while the wasm/public API rework (#352) moves toward review.
  • ACZ: RLN shared database PoC now has unit tests and pending performance fixes before landing in the monorepo.
  • ACZ: Logos discovery RFC drafting advanced alongside a working POC covering lookup/advertise flows and registrar RPC exchanges.
  • ACZ: Multi-steward DE-MLS RFC updates from the Waku offsite are being folded into the final review cycle.
  • RFC: Slot builder RFC #209 advanced toward first-draft completion.
  • RFC: Marketplace RFC phase 2 is nearly wrapped via #208, while block-exchange research kicked off.
  • RFC: RFC index maintenance continued, keeping open reviews moving across specs.
  • SC: SimpleKarmaDistributor deploy scripts were extended with initialization logic in status-network-monorepo#62.
  • SC: Distributed slashing mitigation research continues ahead of the pre-audit protocol enhancement review.
  • SC: The team is investing in Risc0 upskilling to support Logos and Status L2 zero-knowledge needs.
  • Security: Web3 security essentials curriculum is nearly publish-ready after reviewing the DeFi, development, and job-search checklists.
  • Security: Secure signing efforts onboarded legacy members while testing Falcon agents, USB passthrough, and VM builds with multiple hardware wallets.
  • Security: Incident response closed STATUS-352 Jenkins issues, validated Balancer exposure, and removed a phishing clone of Status Wallet.
  • Security: Finance automation received final approval for the bank data notifications and continued unified admin audit testing across platforms.
  • TKE: Karma incentives modeling began using Cyp’s asset strategy as input.
  • TKE: The Funding the Commons voting workshop app is underway for Devconnect.
  • TKE: All Hands and Devconnect travel logistics and scheduling were organized to keep the team aligned onsite.
  • Web: SN Hub deposit, withdraw, discovery, staking, and karma components all moved toward release with new dialogs, skeleton states, and unstaking flows.
  • Web: Logos/PSF sites advanced with new landing pages, spaces calendar dashboards, and admin tooling updates while staging agency onboarding.
  • Web: Maintenance shipped the new mobile release (status-web#842), FtW promo updates, vac.dev RLN page, and release CI fixes.
  • Web: Cross-team reviews kept status-web, psf.logos.co, admin-acid, and vac.dev branches healthy ahead of upcoming launches.
  • BI: IFT weekly news site regained missing Logos posts while pulling new Vac blogs via refreshed Airbyte jobs.
  • BI: Finance dashboards advanced with DBT balance work, treasury syncs, and etherscan-backed transaction validation.
  • BI: RAG LLM pipeline hardened through chunk-prefix tweaks, Qdrant fixes, and fresh source-count dashboards.
  • Infra: LIDO validators swapped hardware and gained Agenix/ZFS tooling plus fixed Cloudflare token usage.
  • Infra: CI stack received a Jenkins security upgrade, fresh GitHub runners, and Mac M4 Qt build fixes.
  • Infra: Nimbus fleets finished storage migrations while mitigating REST API attacks and Clang build regressions.
  • Nescience: Wallet personalization PRs landed alongside deterministic seed-recovery work and new proving benchmarks.
  • Nescience: Privacy-preserving tail-calls progressed despite active Risc0 blockers, while Miden consulting docs shipped.

vac:qa:

vac:dst:

vac:nim:

vac:p2p:

vac:acz:

vac:rfc:

vac:sc:

vac:sec:

  • ift:2025q4-awareness-program:web3-security-essentials
    • Final-reviewed the new modules, leaving only a few sections pending before release.
  • ift:2025q4-secure-signing-process-training:signatory-onboarding-run
    • Continued onboarding legacy signers.
  • ift:2025q4-secure-signing-env-deployment:build-a-secure-vm-for signing
    • Tested USB passthrough with Trezor and Ledger.
  • ift:2025q4-secure-signing-environment:endpoint-security-evaluation
    • Installed Falcon agents on test devices and began exercising AV/device control features.
  • ift:2025q4-defi-strategy-access-control:aave-horizon-pendle-update
    • Added Aave Horizon market support and enabled Pendle term tokens inside scope audits.
  • ift:2025q4-cicd-security-review:status-design-reviews
    • Completed detailed Desktop/Wallet code reviews, dependency sweeps, Ethereum hardfork impact analysis, CodeQL tuning, and GitHub token approvals.
  • ift:2025q4-vulma-and-ir:incidents
    • Resolved STATUS-352 Jenkins executor issues, assessed the Balancer incident for Status impact, rotated tokens/secrets, and took down a phishing clone site.
  • ift:2025q4-vulma-and-ir:remediation-tracking
    • Closed Dependabot/CodeQL findings, synchronized lockfiles/SBOMs, and patched npm/crypto CVEs with partners.
  • ift:2025q4-finance-automation-enhancements
    • Monitored daily executions, supported ad-hoc requests, and completed final tests/approval for the new bank-data notification.
  • ift:2025q4-iam-operations:admin-audit
    • Tested the unified admin audit flow while documenting blockers around GitHub API access, Discord bots, and Notion endpoints.
  • admin/misc
    • Tracked Hackenproof updates and reviewed security engineering candidate profiles.

vac:tke:

  • admin
    • Coordinated All Hands travel plus Devconnect scheduling and logistics.
  • vac:tke:status:karma-incentives
    • Discussed asset strategy options and kicked off modeling work.
  • vac:tke:ift:tokenomics-research-forum:voting-workshop
    • Built out the voting workshop app for Funding the Commons @ Devconnect.

vac:web:

vac:bi:

  • IFT Weekly News Website
    • Improved custom CSS, added Vac blogs via Airbyte, and restored missing Logos Press Engine posts.
  • Finance Dashboard
    • Advanced Finance DBT balance processes (test data pending), aligned with Deivids/Nacho on the treasury dashboard, and sanity-checked transactions against etherscan.io.
  • RAG LLM
    • Updated chunk prefixes, fixed intermittent Qdrant HTTPS bugs, reloaded the newest data, refreshed the source-count dashboard, debugged YouTube metadata/transcripts, and raised a data-freshness alert as Qdrant grows.
  • Logos Launch Strategy Review
  • MISC
    • Started Telegram extraction, built Discord notifications for the monthly report, enhanced the Discord Airbyte connector to fetch membership data, and resolved YubiKey SSH issues on Windows.

vac:infra:

  • LIDO
    • Swapped node-01 with spare-02, improved Agenix tooling, added ZFS usage helpers for key hosts, and fixed Cloudflare API token handling in the dev shell.
  • CI
    • Upgraded Jenkins for security fixes, resolved Qt build issues on the Mac M4 host, deployed additional GitHub self-hosted runners, and improved the runner metrics exporter.
  • STATUS
    • Fixed Brew bottle fetching for Windows/macOS builds, advanced the new Windows E2E setup, continued MatterBridge fork upgrades, bridged additional Status communities, and upgraded Squish on CI hosts.
  • NIMBUS
    • Completed storage migrations for the mainnet fleet, mitigated attacks on public REST API endpoints, researched Commit-Boost/MEV-Boost on Hoodi, and fixed Clang mismatch build failures.
  • SITES
    • Migrated psf.logos.co to ps.logos.co, progressed the Status Network Hub deployment, and fixed Vac RFC website build issues.
  • MISC
    • Deployed the new Finance SNT vesting tool, investigated missing Rootly SMS alerts, ordered the new Vac DST cluster (finance-approved), cleaned legacy Codex infra on Hetzner, and shipped Nix fixes for Zerokit/Nim-Waku packages.

vac:nes:

  • state-separation-architecture-poc:ux-wallet
    • Finalized PR#148 covering wallet personalization.
  • state-separation-architecture-poc:seed-recovery
    • Started PR#149 to implement deterministic hierarchical keys.
  • ACZ docs Review
  • vac:nes:2025q4:state-separation-architecture-poc:privacy-tail-calls
    • Continued the privacy-preserving tail-call effort; progress is currently blocked by Risc0 limitations.
  • vac:nes:2025q4:state-separation-architecture-poc:client-side-bench
    • Benchmarked client-side proving with and without Groth16-wrapped proofs and refreshed documentation (PR#150).
  • vac:acz:nes:2025q4-nescience-consulting:miden-privacy
  • vac:acz:nes:2025q4-nescience-consulting:miden-testnet

Graph View

Backlinks

  • No backlinks found