IFT-TS Roadmaps and Reports

2026-09-28 IFT-TS weekly

18 min read

0
Teams
0
GitHub Links
Link Types:GitHubInternal (roadmap.vac.dev)ExternalTask ID

IFT-TS 2026/09/28

top highlights

  • NIM team released Nimble 0.26.0.
  • SEC team Reported 18 LEZ findings and wrote an AMM threat model.

team highlights

  • BI: Continued work on the Hermes connection and researched language support for the Status Engagement Bot.
  • BI: Continued the Logos communication funnel dashboard.
  • BI: Worked on the Logos testnet dashboard.
  • DST: Anoncomms service-discovery experiments and discussed unexpected findings with the team.
  • DST: Investigated nim-libp2p mesh formation and a potential Kademlia liveness issue in Shadow.
  • DST: Submitted Logos Delivery experiment and analysis changes for review.
  • INFRA: Deployed new hosts for federated metrics collection with Thanos.
  • INFRA: Re-imported Hoodi ERE files and deployed a Sepolia light client for nimbus-eth1.
  • INFRA: Split Logos Modules release work between GitHub Actions index rebuilding and Jenkins builds and signing.
  • INFRA: Upgraded all Discourse forums to address known vulnerabilities.
  • INFRA: Reinstalled all macOS CI hosts and deployed Wazuh agents for threat detection.
  • NIM: Released Nimble 0.26.0 and fixed dependency resolution and offline refresh behavior.
  • NIM: Fixed Nim network sends that could corrupt data or loop indefinitely after disconnects.
  • NIM: Updated JSON serialization API documentation.
  • P2P: Simplified anoncomms Mix routing.
  • P2P: Exposed QUIC engine configuration through nim-libp2p.
  • P2P: Improved nim-lsquic logging.
  • P2P: Improved error-handling through nim-libp2p transports and services.
  • P2P: Fixed Kademlia liveness loops and repeated bootstrap attempts to unreachable peers.
  • QA: Logos Delivery interoperability test migrations, including nightly tests through a live fleet.
  • QA: LEZ Atomic Swaps compliance and test-coverage report for v0.2.4.
  • QA: Status Desktop message delivery measurements. Expanded Keycard tests.
  • QA: Expanded status-go functional tests for Keycard.
  • QA: Found an Android chat-opening failure through nightly tests.
  • SEC: Reported 18 LEZ findings and wrote an AMM threat model.
  • SEC: Reported 3 Logos Blockchain findingss.
  • TKE: Wrote an explainer and FAQs for the Logos token buyback-and-make mechanism.
  • TKE: Reviewed node-program reward calculations and discussed its design with Legal.
  • TKE: Applied LEZ sequencer economics fixes and addressed discussion feedback.
  • TKE: Continued the liquid staking prioritization analysis.
  • TKE: Analyzed Penumbra and its potential application to Logos Blockchain.
  • WEB: Completed the blog.logos.co => logos.co/media migration.
  • WEB: Moved Past Present Future page into a SvelteKit app with reproducible builds.
  • WEB: Refreshed Field Station visuals.
  • WEB: Started the CMS publishing workflow with deployment controls and an admin interface.
  • WEB: Moved Logos funnel forms to the new API and validated the changes in production.

ift-ts:bi:

ift-ts:dst:

ift-ts:infra:

  • develp
    • Deployed new hosts for federated metrics collection using Thanos.
    • Continued separating common fleet components into infra-modules.
    • Extracted the systems-diff package from fleet repositories into infra-modules.
    • Made the infra-modules repository private and added checkout keys.
    • Completed the Loki migration from the tyo1 host to the OVH data center.
    • Debugged latency spikes and packet drops on the OVH mainnet geth-01 host.
    • Fixed broken labels sent to Loki in the Fluent Bit configuration.
    • Deployed a nixpkgs upgrade to all HQ fleet hosts.
    • Added Statix and Deadnix linting to the fleet CI pipeline.
    • Started testing Determinate Systems Nix for the Develp NixOS setup.
    • Opened an OVH support ticket about renewal emails.
  • lido
    • Followed up with Finance to sign the CMv1-to-CMv2 operator mapping.
    • Fixed KAPI issues by pointing it at the spare-01 beacon node.
    • Researched delaying validator-client restarts when a proposal is imminent.
    • Researched joining the Lido CSM 0x02 Hoodi testnet and mainnet.
    • Set up the infra-csm repository and an OVH host for the CSM Hoodi testnet.
  • rocket
    • Researched using Erigon with Ceplin for the Rocketpool oDAO smartnode.
    • Investigated poor Nimbus beacon-node performance associated with limited parallelization.
    • Deployed new OVH hosts and bootstrapped them with the NixOS infra-rocket setup.
  • nimbus
    • Debugged slow REST API test runs causing timeouts and intermittent failures.
    • Fixed authentication failures in Elasticsearch index cleanup.
    • Finished re-importing Hoodi ERE files for nimbus-eth1.
    • Deployed a light client on Sepolia to drive nimbus-eth1.
    • Added a 1.6 TB SSD to the Sepolia host and upgraded ZFS.
    • Removed duplicate Nimbus beacon-node flags from the Ansible role.
    • Verified the effect of the regenerated Hoodi validator keys.
    • Upgraded Geth to release 1.17.6 for Glamsterdam CI testing.
    • Adjusted Erigon container memory limits on the mainnet fleet to avoid out-of-memory failures.
    • Worked on enabling more REST API validator-client endpoint metrics in Nimbus.
    • Handled the fallout from a power outage at the Innova Hosting data center.
  • logos
    • Continued work on the Logos Modules release-signing CI pipeline and S3 uploads.
    • Moved index rebuilding to GitHub Actions, with builds and signing in Jenkins.
    • Worked on automatic deployments of the Logos Delivery module on the dev fleet.
    • Deployed multiple LEZ devnet configuration fixes.
  • status
    • Improved serialization of status-app Jenkins pipelines.
    • Adjusted s3cmd upload flags to address intermittent upload failures.
    • Continued work on the status-app ARM job using the new ARM host.
    • Debugged go-sql-cipher build failures on ARM.
    • Upgraded the Ubuntu build image to 24.04 and adjusted it to support ARM.
    • Added the Relay API key to status-app CI builds.
  • office
    • Automated forced session expiration when deactivating Keycloak users.
  • sites
    • Upgraded all Discourse forum instances to address known CVEs.
    • Added Strapi and Simplecast credentials to release Jenkins for logos.co/media.
    • Fixed the connect-src content security policy for logos.co and dev.logos.co.
  • ci
    • Deployed Wazuh agents to all macOS CI worker hosts for threat detection.
    • Finished reinstalling all macOS CI hosts to bring their operating systems up to date.
    • Worked on transferring multiple former vacp2p repositories to the iftech organization.
    • Researched Tart for running macOS microVMs on Jenkins workers.
    • Checked Innova options for Macs with 32 GB RAM to run microVMs.
    • Researched Firecracker for running Linux microVMs on Jenkins workers.
  • hq
    • Reorganized group_vars for all hosts in the Ansible fleet repositories.
    • Continued researching a NetBird-based VPN setup for IFT.
    • Researched and prepared an upgrade of the Vault secrets management system.
    • Fixed missing Grafana editor permissions for some contributors.
  • bi
    • Upgraded Airflow DAGs and Airbyte connections for Logos.

ift-ts:nim:

ift-ts:p2p:

ift-ts:qa:

ift-ts:sec:

  • ift:2026q3-internal-audit:logos-execution-zone-security-review
    • Issued ten findings, #180–#189, and shared them in the Discord thread.
    • Started reviewing lez-programs and wrote an AMM threat model.
    • Issued two findings on amm-program, #169–#170, and six on amm-app, #171–#176.
  • ift:2026q3-internal-audit:logos-blockchain-security-review
    • Issued three findings, #177–#179.
    • Continued reviewing RFPs; the search for audit firms continued.
  • ift:2026q3-ir-vulma:security-incidents
    • The September 28 GitHub check found no visible remediation PRs for Status-476 / Status-479; remediation status on HackenProof remained unconfirmed.
  • ift:2026q3-ir-vulma:vulnerability-management
    • Rechecked the logos-co audit findings: 23 new findings since September 21, #167–#189, all open: ten high, seven medium, and six low severity; 20 concerned LEZ and three concerned Logos Blockchain.
    • Findings #143–#158 remained open. High-severity finding #163 was the only closure observed since September 14.
  • ift:2026q3-tr-wallet-security:audit-treasury-multisig
  • ift:2026q3-cicd-security-review:code-review-activities

ift-ts:tke:

  • other notes
    • Explored ways to help with Martin’s move to EcoDev.
    • OOO: 1 CC days.
  • vac:tke:ift:logos-token:value-accrual
    • Wrote an explainer and FAQs about the buyback-and-make mechanism.
    • Continued working on the buyback-and-make model.
    • Commented on the buyback-and-make model.
  • vac:tke:ift:ecodev:node-program-validators
    • Reviewed the points-reward calculation.
    • Discussed the node program design with Legal.
  • vac:tke:ift:ecodev:market-validation
    • Continued working with Rahul on using the previous EcoDev brief as a case study to identify B2B products addressing gaps left by Canton.
  • vac:tke:lez:sequencer-econ
    • Implemented fixes and addressed discussion feedback on LEZ sequencer economics.
  • vac:tke:blockchain:stake-delegation
    • Continued the liquid staking prioritization analysis.
  • vac:tke:blockchain:penumbra-analysis
    • Analyzed Penumbra and how it could be applied to Logos Blockchain.

ift-ts:web:

Graph View