2026-09-14 IFT-TS weekly

IFT-TS 2026/09/14

top highlights

• WEB team published Status Wallet Extension 0.1.3 to the Chrome Web Store.
• QA team improved LEZ tests for registering sequencers and reported several issues.
• NIM team worked on a high-impact nimlangserver fix for Constantine and added tests to catch recurring bugs.

team highlights

• BI: Set up Circle CRM for production and showed it to the Logos Movement team.
• BI: Collected Blockchain node data and continued building the dashboard.
• BI: Collected LEZ monitoring data and continued building the dashboard.
• BI: Updated the Keycard report for monthly reporting.
• DST: Investigated an anoncomms discovery problem and found a second issue that was fixed.
• DST: Set up a separate Blend test network and reported missing traces despite normal block production.
• DST: Tested Logos Delivery message relaying on a separate network of 1,000 nodes.
• DST: Moved most system services to metal-01 and found they reserved more CPU than they used.
• DST: Added checks that network disruptions happened as intended and message delivery matched the logs.
• INFRA: Deployed LEZ releases to devnet and testnet and replaced their keys.
• INFRA: Fixed Logos Basecamp file uploads that were blocking module releases.
• INFRA: Moved Lido validator keys and upgraded the Validator Ejector on Hoodi.
• INFRA: Added flock process locking to Nimbus beacon nodes and validator clients.
• INFRA: Reduced Status database server sizes to lower costs.
• INFRA: Rebuilt all attacked macOS build servers and wrote the incident report.
• NIM: Fixed Nimble problems with dependency locks, package downloads, and checksum checks.
• NIM: Updated Nim Docker images to 2.2.12.
• NIM: Added nimlangserver tests to catch recurring bugs and automated checks on macOS and Windows.
• P2P: Prepared nim-libp2p v2.4.0 and applied fixes to the older v2.3.x releases.
• P2P: Hid sensitive data in nim-libp2p logs and limited repeated messages.
• P2P: Worked on choosing connection attempts based on relay use and connection type.
• QA: Moved Logos Delivery messaging tests into the new REST end-to-end test workflow.
• QA: Added Logos Basecamp MCP tests for app search, categories, dialogs, and filtering.
• QA: Improved LEZ tests for registering sequencers and reported possible issues found by scanning the code.
• QA: Added Status Desktop tests for Keycard signing, spare-card login, and joining communities.
• QA: Added status-go tests for cold-wallet migration, Keycard login, pairing, and syncing.
• QA: Added Status Mobile messaging tests using one phone and a backend peer.
• SEC: Reported three LEZ findings, including one high-severity issue.
• SEC: Reviewed alerts about vulnerable dependencies, code issues, and exposed secrets.
• SEC: Tracked security-related Status changes, including WalletConnect pairing fixes.
• SEC: Monitored threats involving npm packages, OAuth, and build tools.
• TKE: Continued the report on the Logos token buyback-and-make model.
• TKE: Addressed feedback on the new proof-of-work rewards model.
• TKE: Clarified the token allocation document and discussed decisions with Finance.
• TKE: Finished a document on ways to connect culture and economics.
• WEB: Published Status Wallet Extension 0.1.3 and updated 0.1.4 to fix missing UNI token icons.
• WEB: Built the Field Station residency page with updated text.
• WEB: Built the PriFi page and added links to it throughout the Logos website.

ift-ts:bi:

• ift-ts:bi:status:2026q3-status-scam-detection
  • Worked on the Hermes connection and a new Python SDK version.
  • Prepared the Engagement Bot for production.
• ift-ts:bi:logos:2026q3-logos-movement-crm
  • Set up the production Circle CRM and presented it to the Logos Movement team.
• ift-ts:bi:logos:2026q3-logos-testnet-monitoring:blockchain
  • Extracted data from the Blockchain node; dashboard work is in progress.
• ift-ts:bi:logos:2026q3-logos-testnet-monitoring:lez
  • Extracted LEZ data for monitoring; dashboard work is in progress.
• ift-ts:bi:logos:2026q3-logos-testnet-monitoring
  • Finished the weekly report based on Logos Blockchain, Storage, and Delivery logs.
• ift-ts:bi:keycard:2026q3-keycard-social-media-analysis
  • Updated the report for monthly reporting.

ift-ts:dst:

• other notes
  • Worked on Status task planning
  • Reviews and task tracking
  • Keep improving flow with p2p team
• ift-ts:dst:logos:2026q3-anoncomms-evaluation:service-discovery-scenarios
  • Discovered and investigated another issue with anoncomms team
    • Discord Thread
    • This exposed another issue that was detected and fixed.
• ift-ts:dst:ift:2026q3-libp2p-evaluation:regression-testing
  • Started taking a look at v2.4.0
  • vacp2p/dst-libp2p-test-node#55
  • Updated the analysis and scraping improvements PRs and got reviews.
    • Github PR: Capture pod logs with the run as a collector fallback (merged)
    • Github PR: Read a scrape’s metric folder as well as a plain CSV path (merged)
    • Github PR: Write scraped CSVs with a .csv suffix (merged)
    • Github PR: Verify each scenario’s disturbance actually happened (merged)
    • Github PR: Cross-check log-derived delivery against the nodes’ received counter (merged)
    • Github PR: Post-run analysis for the three regression scenarios (open)
• ift-ts:dst:ift:2026q3-dst-tooling:general-tooling
  • Github PR: Plot file names #399 (merged)
  • Github PR: Plot generic config #400 (merged)
  • Github PR: Scrape interval fix #401 (merged)
• ift-ts:dst:logos:2026q3-blockchain-evaluation:blendnet-benchmarking
  • Discord Thread: Blend Benchmarking task
  • Deployed isolated testbed for blend issue investigation
  • Analyzed and reported findings to Gusto
  • No traces reached Tempo, although blocks were produced and accepted.
  • Gusto proposed a new image that may fix the trace injection bug.
• ift-ts:dst:ift:2026q3-dst-tooling:slow-proof-analysis
  • Github PR: Move System workloads to Metal-01 - #51 (open)
    • Moved most system workloads onto metal-01 (homepage, kyverno, longhor-ui, vmselect, vlselect etc.)
    • CPU reservations on metal-01 are nearly full, so Grafana and Rancher still run on normal nodes.
    • Actual CPU usage on metal-01 is low, suggesting that some system workloads reserve more CPU than they use.
• ift-ts:dst:ift:2026q3-dst-tooling:dashboard-improvements
  • Github PR: Frontend Enhancements - 1 - #355 (open)
    • Updated PR to have maximum one panel per experiment in the homepage. Try next panel only if the first request returns an error.
• ift-ts:dst:logos:2026q3-messaging-evaluation:logos-delivery-node
  • Ran the relay sanity check for Logos messaging on our own isolated fleet at 1000 nodes. Written in the pre-regression report.
  • Moved the mixed node scenario onto our Python harness. It also checks that every store node archived every message, which was never checked before.
    • Github PR: Fix the volume and dns-search calls in the waku builders (merged)
  • Updated the lab metrics pipeline so the messaging node metrics reach the dashboards again.
    • Github PR: Add logos_delivery Metrics to the vmagent Keep List (merged)
  • built our own node images and ran small scale tests to confirm the full logos delivery scenario works.

ift-ts:infra:

• develp
  • Worked on decommissioning the old metrics 01 host in the TYO1 data center.
• lido
  • Worked on starting the Lido consolidation process via an EasyTrack motion.
  • Migrated CMv1 validator keys to the master-05 host.
  • Deployed the Lido validator exit automaton to master hosts.
  • Decommissioned multiple hosts in the TYO1 data center.
  • Deployed the Lido Validator Ejector upgrade for the Hoodi testnet.
• rocket
  • Upgraded Rocketpool smartone, beacon node, and execution-layer components.
  • Investigated poor oDAO node performance and prepared for migration.
  • Tested oDAO committee calls against a beacon node to identify the bottleneck.
  • Deployed timers for dry runs of oDAO rewards tree generation.
  • Identified a potential dry-run improvement using --use-rolling-records.
  • Worked on porting the Rocketpool setup to NixOS, following other Develp fleets.
• staking
  • Fixed the Nimbus beacon node patch after observing the first two timing games proposals.
• nimbus
  • Continued generating ERE files for all Nimbus testnet fleets.
  • Worked on adding verification of generated ERE files.
  • Researched flock as an alternative to doppelganger detection.
  • Implemented flock usage for the beacon node and validator client.
• logos
  • Continued Logos package signing and notarization work on macOS.
  • Deployed LEZ releases to devnet and testnet, rotated keys, and worked on the Grafana dashboard.
  • Fixed Logos Basecamp artifact uploads, resolving module release issues.
  • Helped with Delivery module deployments and automation.
  • Enabled the Storage upload API on logos.dev fleet RS nodes.
  • Investigated slow uploads on Alibaba Cloud Storage nodes.
• status
  • Researched Jenkins priorities to reduce the impact of some jobs on the queue.
  • Serialized some Status jobs to reduce runner usage.
  • Fixed Foundry tooling issues in the status-go Docker image.
  • Finished downscaling Status database hosts to reduce fleet costs.
  • Fixed Windows RC builds by purchasing more DigiCert signatures.
  • Removed iOS and Windows E2E from status-go PR app builds.
• sites
  • Set up automation for deploying Caddy-Git websites via Jenkins.
  • Adjusted Logos E-Learning platform permissions for Santiago.
  • Helped rebrand Logos Stewards as Logos Learning.
  • Updated the Logos Learning Docker image to include the new theme.
  • Enabled guest access to one course.
• ci
  • Wrote the postmortem for the September 4 macOS Jenkins CI worker CVE attack.
  • Purged and bootstrapped all attacked macOS CI hosts.
  • Fixed macOS bootstrapping issues, including automatic CLI Tools installation.
  • Created an Ansible Wazuh agent role for macOS hosts.
  • Replaced the HTTP 1.1 workaround with a read-only token for GitHub cloning.
  • Added retries to s5cmd uploads of Jenkins build artifacts.
• hq
  • Researched a VPN solution for accessing infrastructure hosts and services.
  • Increased undersized root volumes on Google Cloud hosts.
  • Fixed nimbus-eth1 JSON log parsing in Logstash.
• bi
  • Worked on deploying the Status Bot with new engagement features.
  • Added Status Bot metrics, PR checks, and release management.
  • Fixed broken status-im automatic permissions for Finance repositories.

ift-ts:nim:

• ift-ts:nim:ift:2026q3-nimble:nimble-1.0.0
  • Fix selective lock refresh to preserve compatible pins (fixes #1849) (nim-lang/nimble#1852)
  • Point the init wizard’s package-type link at the Nimble guide (#1835) (nim-lang/nimble#1850)
  • Don’t abort the package-list refresh on the first unreachable mirror fixes #1845 (nim-lang/nimble#1848)
  • Fix lock checksum mismatches: skip Nim’s bundled nimble, hash untrack… (nim-lang/nimble#1847)
    • Fix lock checksum mismatches: skip Nim’s bundled nimble, hash untracked dirs (#1840)
    • Fix CI
  • Bump chronos to 536169b4 to fix SIGSEGV on Windows i386 (fixes #1829) (nim-lang/nimble#1846)
• ift-ts:nim:ift:2026q3-nim-core-libs:maintenance
  • status-im/nim-json-rpc#297 Add missing malformed framing checks to socket transport
  • status-im/nim-json-rpc#300 Add lastError to RpcConnection
  • status-im/nim-json-rpc#296 Stdio transport
  • nim-lang/langserver#449 Regression test suite
  • nim-lang/langserver#451 CI failures fix
  • nim-lang/langserver#447 Enable nim track tests
  • nim-lang/langserver#450 CI: enable macos and windows
  • nim-lang/langserver#448 Avoid some dangling nimsuggests
  • nim-lang/langserver#446 Remove all nested waitFor
  • Fix nimlangserver for constantine
    • nim-lang/langserver#436
    • Nimsuggest fix:
      • nim-lang/Nim#26226
    • Langserver improvements:
      • nim-lang/langserver#453
      • nim-lang/langserver#454
  • Update Nim Docker images to 2.2.12
    • docker-library/official-images#22227
  • Update info about Docker images on nim-lang.org
    • nim-lang/website#436

ift-ts:p2p:

• ift-ts:p2p:ift:2026q3-nimlibp2p-maintenance
  • vacp2p/nim-libp2p#3116 chore: bump lsquic
  • vacp2p/nim-libp2p#3090 fix(muxers): preserve yamux framing when discarding stream data and remove redundant guard
  • vacp2p/nim-libp2p#3111 fix(quic): avoid caching partially constructed dial endpoints
  • vacp2p/nim-libp2p#3100 fix(pubsub): stop peer tasks before connection teardown
  • vacp2p/nim-libp2p#3089 fix(autonatv2): require fresh inbound dialback connections
  • vacp2p/nim-libp2p#3079 fix(nat): enforce dial-back validation and clean up relay and hole-punching lifecycles
  • vacp2p/nim-libp2p#3074 fix(service_discovery): propagate RPC cancellation and check local ads first
  • vacp2p/nim-libp2p#3091 fix(tests): exclude local dependencies from test discovery
  • vacp2p/nim-boringssl#21 ci: drop Linux i386 support
  • vacp2p/nim-boringssl#20 ci: check generated BoringSSL bindings before merging
  • vacp2p/nim-boringssl#19 ci(bindings): require source changes with generated bindings
  • vacp2p/nim-libp2p#3068 fix(connmanager): restore readiness waits and tag decay on restart
  • vacp2p/nim-libp2p#3070 fix: clean up failed negotiations and reject truncated buffer reads
  • vacp2p/nim-libp2p#3072 refactor(kademlia): unify get-value response handling
  • vacp2p/nim-libp2p#3081 fix(autotls): handle auth edge cases and clean up pending DNS queries
  • vacp2p/nim-libp2p#3073 fix(kademlia): track provider RPCs immediately and preserve keys on refresh
  • vacp2p/nim-libp2p#3067 fix(cbind): exit examples safely on timeout and use local dependency paths
  • vacp2p/nim-libp2p#3066 fix(transports): harden SOCKS5 handling and simplify transport cleanup
  • vacp2p/nim-libp2p#3069 fix(cid): correct validation offset and hash equivalent CIDs consistently
  • vacp2p/nim-lsquic#168 refactor: simplify connection lifecycle and remove redundant transport code
  • vacp2p/nim-libp2p#3071 chore: remove hexdump example, simplify test setup and fix cancellation handling
  • vacp2p/nim-libp2p#3056 fix(dialer): retain lookup results across suspended dials
  • vacp2p/nim-libp2p#3065 refactor: simplify error handling with isOkOr
  • vacp2p/nim-libp2p#3057 fix(service-discovery): use Unix seconds for ticket timestamps
  • vacp2p/nim-libp2p#3055 fix(tor): reject DNS names exceeding SOCKS5 length limit
  • vacp2p/nim-libp2p#3058 fix(wstransport): report closed transport without retrying
  • vacp2p/nim-libp2p#3052 fix(pubsub): handle non-canonical PeerId aliases
  • vacp2p/nim-lsquic#167 fix: ignore closed-stream errors in read and write callbacks
  • vacp2p/nim-libp2p#3007 fix(dialer): dial dnsaddr results without waiting for siblings
  • vacp2p/nim-libp2p#3034 fix(crypto): improve public key parsing
  • vacp2p/nim-libp2p#3035 fix(mplex): refine stream setup buffering
  • Prepare release v2.4.0
  • Backport fixes to v2.3.x
  • vacp2p/nim-libp2p#3105 chore(opt): rename withValue to ifValue
  • vacp2p/nim-libp2p#3104 chore(opt): improvements
  • vacp2p/nim-libp2p#3099 chore(kad): utilize Key & Value in protobuf types
  • vacp2p/nim-libp2p#3086 chore(kad): make Key & Value distinc types
  • vacp2p/nim-libp2p#3085 chore(kad): add Value type
  • vacp2p/nim-libp2p#3083 ci: increasing timeout test workflows
  • vacp2p/nim-libp2p#3084 chore(errors): valueOrRaise and onErrorRaise helpers
  • vacp2p/nim-libp2p#3093 fix(service-disco): gate registrar seats on the discovery codec
  • vacp2p/nim-libp2p#3112 chore(coverage): filter gcov noise from the report
  • vacp2p/nim-libp2p#3115 fix(interop): build peers before they run
  • vacp2p/nim-libp2p#3043 fix(gossipsub): track in-flight IWANT requests
  • vacp2p/nim-libp2p#3109 refactor(service-disco): apply review follow-ups from #3080
  • vacp2p/nim-libp2p#3094 fix(service-disco): admit advertised peers through the kad admission probe
  • vacp2p/nim-libp2p#3095 fix(service-disco): evict peers that reset discovery requests
  • vacp2p/nim-libp2p#3101 fix(autonat): remove race in ‘Peer must be not reachable and then reachable’
  • vacp2p/nim-libp2p#3080 fix(service-discovery): stop publishing and dialing undialable addresses
  • vacp2p/nim-libp2p#3087 fix(service-disco): admit registrar senders through the shared Kademlia path
  • vacp2p/nim-libp2p#3097 fix(tests): copy lent loop variables before asyncTest capture
  • vacp2p/nim-libp2p#3088 fix(autonat): classify addresses per family
  • vacp2p/nim-libp2p#3063 feat(service-discovery): measure provider discovery latency
  • vacp2p/nim-libp2p#3039 feat(dns): full DNS message codec
  • vacp2p/nim-libp2p#3048 fix(autotls): keep ACME requests on the directory origin
  • vacp2p/nim-libp2p#3042 fix(gossipsub): ignore RPCs from graylisted peers
  • vacp2p/nim-libp2p#3041 fix(autonatv2): bound dial backs
  • logos-messaging/nim-ffi#165 fix(ci): assert the sanitizer is actually linked into the e2e binaries
  • vacp2p/nim-libp2p#3040 chore(perf): rename uploadSize to responseSize
  • vacp2p/nim-libp2p#3028 fix(rendezvous): cap the namespace table and prune empty namespaces
  • vacp2p/nim-libp2p#3033 fix(service-disco): cache the advertisement bytes so rotations keep the seqNo
  • vacp2p/nim-libp2p#3024 chore: native hkdf and autotls pem encoding
  • vacp2p/nim-libp2p#3037 fix(addr-mgr): count the peers which observe an address, not the reports
  • vacp2p/nim-libp2p#3036 fix(floodsub): limit the entry count of the seen cache
  • vacp2p/nim-libp2p#3025 fix(rendezvous): discover no longer allocates one int per registration
  • vacp2p/nim-libp2p#3026 chore(wstransport): bump websock to 0.4.1
  • vacp2p/nim-libp2p#3014 chore(perf): improve ChaChaPoly and remove byte-at-a-time frame copies
  • vacp2p/nim-libp2p#2071 chore: run cbind examples and a test_all job under AddressSanitizer
  • vacp2p/nim-libp2p#3016 fix(gossipsub): cancel a queued relay when the peer already has the message
  • logos-messaging/logos-delivery#4152 feat(net): dial through a NetBackend
• other notes
  • libp2p/specs reviews
• ift-ts:p2p:ift:2026q3-nimlibp2p-log-noise-reduction
  • vacp2p/nim-libp2p#3106 chore(Rng): redact type
  • vacp2p/nim-libp2p#3107 chore(logs): add Copilot instruction
  • vacp2p/nim-libp2p#3078 docs(logs): improve logging docs
  • vacp2p/nim-libp2p#3082 feat: redact sensitive types
  • vacp2p/nim-libp2p#3076 chore(logs): reuse shortLog code
  • vacp2p/nim-libp2p#3075 chore(logs): add formatIt for all types
  • vacp2p/nim-libp2p#3061 chore(logs): add logs
  • vacp2p/nim-libp2p#3064 chore(logs): redact field content
  • vacp2p/nim-libp2p#3062 chore(logs): add logs with rate limit
  • vacp2p/nim-libp2p#3060 chore(logs): use shortlog for large fields
  • vacp2p/nim-libp2p#3059 ci(logs): add test build with trace log lvl
  • vacp2p/nim-libp2p#3051 chore(tools): fix logs fields lint
  • vacp2p/nim-libp2p#3050 chore(logs): messages improved
  • vacp2p/nim-libp2p#3053 chore(logs): add logs with background operation
  • vacp2p/nim-libp2p#3047 docs(logs): add log ownership section
  • vacp2p/nim-libp2p#3045 chore(logs): add logs with background operation
  • vacp2p/nim-libp2p#3044 chore(logs): remove unecessery logs
  • vacp2p/nim-libp2p#3038 chore(logs): standardize log fields
• ift-ts:p2p:ift:2026q3-nimlibp2p-dial-ranking-backoffs:dial-racing
  • vacp2p/nim-libp2p#3110 feat(dialer): rank dials by relay and transport

ift-ts:qa:

• ift-ts:qa:logos:2026q3-messaging-testing:interop-migration
  • chore(tests): use nightly Logos delivery node for functional tests
  • ci: test Logos Delivery nightly and issue reporting in Jenkins
  • logos-messaging/logos-delivery#4198 test(e2e): add REST e2e workflow and port the first smoke tests (migration 1)
  • logos-messaging/logos-delivery#4203 test(e2e): remaining smoke tests and retire the interop job (migration 2)
  • logos-messaging/logos-delivery#4206 test: rewrite the remaining smoke tests (migration 3)
  • logos-messaging/logos-delivery#4222 test: resolve the relay tests (migration 4)
  • logos-messaging/logos-delivery#4235 test: resolve the filter tests (migration 5)
  • logos-messaging/logos-delivery#4242 test: resolve the lightpush tests (migration 6)
  • logos-messaging/logos-delivery#4243 ci(tests): split the test job + improvements
• ift-ts:qa:logos:2026q3-logos-basecamp:mcp-tests
  • Test/MCP UI app manager search narrows the grid
  • Test/MCP UI app manager search with no match hides every section
  • Test/MCP UI app manager search tolerates special characters
  • Test/MCP UI app manager category selection filters the grid
  • Test/MCP UI app manager reload settles without losing apps
  • Test/MCP UI app manager context menu matches install state
  • Test/MCP UI app manager Details opens the Add Application dialog
  • Test/MCP UI app manager dialog wording for an installed app
  • Test/MCP UI dashboard shows version, build type and commits
  • Test/MCP UI apps inspector search filters the table
• ift-ts:qa:logos:2026q3-lez-sequencing:cucumber-tests
  • test: Sequencer registration - cucumber
  • test: Chained-caller and second-mover test prerequisites
  • test: Cucumber sequencer registration scenarios - part 2
  • Trial source code scan with Claude + GPT:
    • Wallet reveals the commitments it is about to spend to the sequencer via getProofsAndRoot
    • AMM derives the token program from a caller-supplied holding account and hands vault PDA authorization to it
    • Wallet-created private accounts are seeded with identifier 0
    • Private note ciphertext length equals the fixed header plus the raw account encoding
    • Init note view tag is derived only from the recipient’s public keys
    • Public actions, nonces and program image claims of a private transaction are not padded
    • Wallet and core code print or log decrypted account state and secret key material
    • AMM remove_liquidity multiplies reserve and supply by a caller-chosen amount without checked arithmetic
    • Wallet stores decrypted note contents without checking that the recomputed commitment is in the transaction
    • Wallet persists spending, authorization, viewing, group and sealing secrets as plaintext JSON and discards the password
    • Private transactions are admitted to the mempool without a fee, proof verification, or deduplication
    • Slash approvals sign only a domain, key and inscription and are not recorded once consumed
    • Token definition and account initialization write to any empty target without requiring authorization
    • Block timestamp is chosen by the producer and only checked for agreement with the clock transaction
    • Publish failure after block building drops the mempool transactions included in the block
    • Group invites are accepted without any sender authentication or group binding
    • Indexer getBlocks materializes one block id and one RocksDB key per requested row before any lookup
    • Sequencer getProofsAndRoot and getAccountsNonces have no element cap and run under the chain lock; getBlockRange materializes up to 1024 blocks per call
    • Sequencer requeueCrossZoneDeadLetter is an unauthenticated state-mutating method on the public RPC port
    • Program loader WriteSegment and CreateHeader accept any default target without requiring authorization
• ift-ts:qa:logos:2026q3-lez-fuzz-testing:framework-maintenance
  • chore: automated weekly corpus update- #31
• ift-ts:qa:status:2026q3-status-qa-desktop:e2e-keycard-mock
  • status-im/keycard-qt#12 fix: keep secure channel and pairing in sync with the applet
  • status-im/status-keycard-qt#37 feat: add jcardsim integration tests for keycard flows
  • status-im/status-app#22385 chore: update status keycard qt version
  • status-im/status-app#22370 tests(@e2e): sign message with keycard to wallet connect
  • status-im/status-app#22351 tests(@e2e): sign and send transaction with keycard
  • status-im/status-app#22330 tests(@e2e): replace with spare card and login with this keycard scenarios
  • status-im/status-app#22294 tests(@e2e): sign community join request with keycard
• ift-ts:qa:status:2026q3-status-qa-desktop:release-testing
  • status-im/status-app#22414 ci: serialise linux and macos jobs and build from system nim
• ift-ts:qa:status:2026q3-status-qa-desktop:windows-performance-tests
  • status-im/status-go#7812 feat: expose Waku and wallet HTTP byte counters
  • status-im/status-app-benchmarks#31 desktop: data consumption charts
  • status-im/status-app#22379 tests(@e2e): app data usage metrics
• ift-ts:qa:status:2026q3-status-qa-desktop:maintenance
  • status-im/status-app#22347 chore(@e2e): fix nightly failures
  • status-im/status-app#22193 chore(@e2e): fix for port range and image dialog
  • status-im/status-app#22306 chore: bump status-keycard-qt version
• ift-ts:qa:status:2026q3-status-go-functional-testing:keycard-puk
  • status-im/status-go#7758 test(accounts): cover cold-wallet migration and keystore guards
  • status-im/status-go#7759 test(protocol): cover cold-wallet keypair sync edge paths
  • status-im/status-go#7760 test(backend): cover keycard login, convert, and xpub backfill
  • status-im/status-go#7761 test(pairing): cover keycard payload and keystore re-pair guards
  • status-im/status-go#7804 test(backend): characterize keycard defects pending a product decision
  • status-im/status-go#7823 test(functional): scope wait_for_login to the login just issued
  • status-im/status-go#7824 test(functional): extend non-profile cold-wallet guards
  • status-im/status-go#7825 test(functional): cover cold-wallet keypair signing and operability
  • status-im/status-go#7826 test(functional): cover profile keypair to and from a keycard
  • status-im/status-go#7827 test(functional): cover restoring an account that lives on a keycard
  • status-im/status-go#7828 test(functional): cover cold-wallet keypair sync to a second device
• ift-ts:qa:status:2026q3-status-qa-mobile:keycard-ui
  • status-im/keycard-qt#14 test: add a simulator-backed lane for PIN, PUK and factory reset
  • status-im/keycard-qt#13 fix: include QElapsedTimer in the pbkdf2 test
  • Reviewed keycard-qt#12; merge-with-changes, draft ready
• ift-ts:qa:status:2026q3-status-qa-mobile:backend-peer-gate
  • status-im/status-app#22339 test(e2e_appium): headless status-backend peer
  • status-im/status-app#22340 test(e2e_appium): peer_chat, one phone plus a peer
  • status-im/status-app#22341 test(e2e_appium): gate messaging with a peer
  • status-im/status-app#22349 ci: run the e2e messaging peer as a container
  • status-im/status-app#22361 ci: run the PR gate on one phone plus a peer
• ift-ts:qa:status:2026q3-status-qa-mobile:gate-health
  • status-im/status-app#22378 fix(e2e_appium): schedule the longest test modules first
  • Triaged the nightly red: harness defect plus a BrowserStack upload timeout, no product regression
• ift-ts:qa:status:2026q3-status-go-functional-testing
  • Started 1:1 send-to-receive latency for the nightly benchmark, full and light modes

ift-ts:sec:

• ift:2026q3-ir-vulma:security-incidents
  • macOS CI IR (macm2-01.ih-eu-mda1.ci.release, declared 2026-09-04) — host reinstall/re-attestation, fleet-wide firewall rollout check, and IOC sweep still open with jakubgs; the incident remained open.
  • HackenProof dev validation — Status-476 (vote-weight unit mismatch: whole-token SNT vs raw base units), Status-479 (finalizeVotingRoom snapshot at executing block)
• ift:2026q3-ir-vulma:vulnerability-management
  • Continued triage on Dependabot, code-scanning, and secret-scanning queues
  • Internal-audit backlog (#120–#126, #136–#142, LEZ line with joocho) and the 16 crawl findings (#143–#158) — still open.
• ift:2026q3-tr-continuity-plan:define-and-test-ir-runbooks
  • Runbook definitions with Jason remained unresolved.
  • W0001/W0002 runbook updates remained outstanding after the first live secure-multisig-signer signing
• ift:2026q3-tr-wallet-security:audit-treasury-multisig
  • master-wallet-index reconciliation and outstanding signatory removals
• ift:2026q3-tr-continuty-plan:investment-team-recalibration
  • Backup-signatory selection with Jason and the investment team remained outstanding.
• ift:2026q3-cicd-security-review:code-review-activities
  • Review rotation continued; per 2026-09-14 crawl all carried PRs still open — status-go #7607, #7580, #7475, #7461, #7452; status-app #21421, #20971
  • Security-relevant merges crawled: status-go #7811 fix(walletconnect): pairing fixes and handshake diagnostics, #7807 feat(bot): stop auto-sending the support bot contact request, #7805 fix(messaging): fix bridge sendmessage + cherry-pick #7818; status-app #22367 fix(dapps): WalletConnect pairing fixes and diagnostics, #22404 disable password autofocus when signing with biometrics, #22390 fix(SendContactRequestModal): adaptive contact dialog, #22371 / #22358 Privacy Policy updates
  • Post-merge review remained outstanding for the status-app browser downloads stack #21849–#21853
  • Reviewed pending PAT requests; iterated on security checklist and Copilot policy
• ift:2026q3-threat-intelligence:supply-chain-attack-research
  • Continued npm / OAuth / CI-tool supply-chain watch
• ift:2026q3-internal-audit:logos-execution-zone-security-review
  • Reported one high-severity finding: #163.
  • Reported two findings in the Logos Execution Zone module: #164 and #165.
  • Discord discussion.
• ift:2026q3-internal-audit:logos-blockchain-security-review
  • Reported one finding: #159; no fix was made because the behavior is by design.
  • Set up and ran a node.
  • Ran an app on testnet.

ift-ts:tke:

• other notes
  • OOO: 6 CC days.
• vac:tke:ift:logos-token:value-accrual
  • continued the report about the buyback-and-make model
• vac:tke:blockchain:pow:new-rewards
  • addressed feedback
• vac:tke:ift:logos-token:allocation-strategy
  • cleaned up the main doc for distribution
  • discussed current decisions with Finance
• vac:tke:ift:logos-token:token-sales
  • reviewed Danny’s token sale research
• vac:tke:ift:ecodev:rfps
  • reviewed the token vesting
• vac:tke:ift:ecodev:market-validation
  • continued helping EcoDev reach out to projects
• vac:tke:ift:ecodev:xprize
  • Worked on budget planning.
• vac:tke:ift:support-to-ift-units:governance
  • Started reviewing Eric’s feedback.
• vac:tke:ift:support-to-ift-units:residency
  • Edited materials and reviewed the application and other launch materials.
• vac:tke:ift:ecodev:wrapped-assets
  • BD coordination discussions
• vac:tke:ift:logos-token:culture-econ
  • Finished the document on mechanisms connecting culture and economics.

ift-ts:web:

• ift-ts:web:status:2026q3-status-wallet-extension:maintenance
  • Hid Swap in production releases while keeping it available during development: PR
    • Bumped the extension to 0.1.3
    • Published the new version on Chrome web store
  • fix(wallet): restore UNI icons and handle image failures: PR
    • Bumped the extension to 0.1.4
• ift-ts:web:logos:2026q3-logos-website:field-station
  • Implemented the Field Station residency page based on the Figma design: PR, Preview
    • Added the tracks, application process, venue, activities, FAQ, partners and structured data
    • Reused existing sections without changing their current page defaults
    • Applied the latest brief and copy updates
    • Linked the installation step to the Basecamp installation guide
• ift-ts:web:logos:2026q3-logos-website:prifi
  • Implemented the PriFi landing page and site-wide entry points: PR, Preview
    • Added the interactive supply-chain section and responsive Figma layout
    • Added the PriFi module to the homepage
    • Linked the homepage banner, Research menu and footer to the PriFi page
    • Added metadata and page-level header colour handling
• ift-ts:web:ift:2026q3-maintenance:maintenance
  • Moved Builders Hub detail copy behind i18n keys and added a build guard for sitemap URLs without exported pages: PR
• ift-ts:web:status:2026q3-status-website:seo
  • Fixed invalid blog slugs and paths containing dots returning 500 instead of 404: PR
    • Preserved the existing behaviour for real Ghost outages and transient failures
• ift-ts:web:logos:2026q3-logos-core
  • Merged the browser-native Logos Messaging and Blockchain demos: PR
    • Replaced the explorer dependency with live testnet node APIs
    • Added live block streaming, search and block detail pages
  • Added the Logos Storage demo: PR
    • Added the live storage fleet view and browser-side CID generation
  • Replaced the temporary file store with block proof verification and added site metadata: PR
  • Added source references to every demo and rewrote the descriptions in plain language: PR
• other notes
  • Followed up on the stale get.status.app sitemap PR and proposed closing it if it is no longer relevant: PR
  • OOO: 5 CC days.